Mobile device user authentication for accessing protected network resources

Patent metadata

Field	Value
Publication number	US-10257699-B2
Application number	US-201615178725-A
Country	US
Kind code	B2
Filing date	Jun 10, 2016
Priority date	Jan 29, 2014
Publication date	Apr 9, 2019
Grant date	Apr 9, 2019

Abstract

A method for user authentication for accessing protected applications by computing devices includes receiving, by a processor of a mobile computing device, a first authentication token. The method further includes transmitting an authentication request using the first authentication token. The method further includes receiving, in response to the authentication request, a second authentication token. The method further includes transmitting a resource access token request using the second authentication token. The method further includes receiving, in response to the resource access token request, a resource access token. The method further includes transmitting a computing resource access request using the resource access token.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a processor of a client device, an authentication token, wherein the authentication token is provided by one of: a short-lived certificate or a one-time password;
transmitting, by the processor, an authentication request comprising a value generated by applying a pre-defined function to the authentication token, wherein no long-term authentication keys are stored by the client device;
receiving, in response to the authentication request, a single sign-on token authorizing access to a plurality of computing resources of an enterprise network;
transmitting, by the processor, a resource access token request using the single sign-on token;
receiving, in response to the resource access token request, a resource access token; and
transmitting, using the resource access token, a request to access a computing resource of the plurality of computing resources.

2. The method of claim 1 , further comprising:
accessing a computing resource identified by the resource access token.

3. The method of claim 1 , wherein transmitting the authentication request is performed via a communication interface provided by at least one of: a network communication interface, a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

4. The method of claim 1 , wherein transmitting the authentication request is performed over a Secure Socket Layer (SSL) connection.

5. The method of claim 1 , wherein the single sign-on token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

6. The method of claim 1 , wherein the authentication request conforms to Kerberos protocol.

7. A system, comprising:
a memory; and
a processor, operatively coupled to the memory, to:
receive an authentication token, wherein the authentication token is provided by one of: a short-lived certificate or a one-time password;
transmit an authentication request comprising a value generated by applying a pre-defined function to the authentication token, wherein no long-term authentication keys are stored by the system;
receive, in response to the authentication request, a single sign-on token authorizing access to a plurality of computing resources of an enterprise network;
transmit a resource access token request using the single sign-on token;
receive, in response to the resource access token request, a resource access token; and
transmit, using the resource access token, a request to access a computing resource of the plurality of computing resources.

8. The system of claim 7 , wherein the processor is further to:
accessing a computing resource identified by the resource access token.

9. The system of claim 7 , wherein the processor is to transmit the authentication request via a communication interface provided by at least one of: a network communication interface, a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

10. The system of claim 7 , wherein the processor is to transmit the authentication request over a Secure Socket Layer (SSL) connection.

11. The system of claim 7 , wherein the single sign-on token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

12. The system of claim 7 , wherein the authentication request conforms to Kerberos protocol.

13. A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a processor of a computing device, cause the processor to:
receive an authentication token, wherein the authentication token is provided by one of: a short-lived certificate or a one-time password;
transmit an authentication request comprising a value generated by applying a pre-defined function to the authentication token, wherein no long-term authentication keys are stored by the computing device;
receive, in response to the authentication request, a single sign-on token authorizing access to a plurality of computing resources of an enterprise network;
transmit, by the processor, a resource access token request using the single sign-on token;
receive, in response to the resource access token request, a resource access token; and
transmit, using the resource access token, a request to access a computing resource of the plurality of computing resources.

14. The computer-readable non-transitory storage medium of claim 13 , further comprising executable instructions causing the processor to:
access a computing resource identified by the resource access token.

15. The computer-readable non-transitory storage medium of claim 13 , wherein the single sign-on token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

16. The method of claim 1 , wherein the authentication request is transmitted via a HyperText Transfer Protocol (HTTP) proxy server.

17. The method of claim 1 , wherein the authentication token is generated based on a secret known to an authentication server, and wherein the authentication request is transmitted to the authentication server.

Assignees

• Red Hat Inc

Inventors

• Pal Dmitri

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L2209/80

  Wireless · CPC title