Method of authenticating a terminal by a gateway of an internal network protected by an access security entity providing secure access

Patent metadata

Field	Value
Publication number	US-2016142914-A1
Application number	US-201414898100-A
Country	US
Kind code	A1
Filing date	Jun 13, 2014
Priority date	Jun 14, 2013
Publication date	May 19, 2016
Grant date	—

Abstract

One embodiment is an authentication method comprising on receiving a request from the web browser of the terminal, the request including a user identifier, obtaining authentication data that is associated with the user identifier and that is stored in a database of the internal network, configuring a proxy server authorizing access via the access security entity to the internal network for a determined set of connection parameters, generating a first application from the connection parameters of the set, which application is protected using at least one determined portion of the authentication data and being configured to, on being executed by the web browser, set up a connection between the terminal and the proxy server using the parameters, this being done in response to the at least determined portion of the authentication data being supplied and transmitting the first application to the web browser of the terminal.

First claim

1 . An authentication method enabling a gateway of a internal network that is protected by an access security entity for securing access to authenticate a terminal provided with a web browser, the method comprising:
on receiving a request coming from the web browser of the terminal and including a user identifier, obtaining authentication data that is associated with said user identifier and that is stored in a database of the internal network; configuring a proxy server authorizing a determined set of connection parameters to access said internal network via the access security entity; generating a first application from parameters of said determined set of connection parameters, said first application being protected using at least one determined portion of said authentication data and being configured to, on being executed by the web browser of the terminal, set up a connection between said terminal and said proxy server by using said parameters, in response to said at least one determined portion of the authentication data being supplied; and transmitting said first application to the web browser of the terminal.

2 . An authentication method according to claim 1 , wherein, during the generation of said first application, said at least one portion of the authentication data used for protecting the application is determined in a random manner.

3 . An authentication method according to claim 1 , wherein the first application as generated during the generation step includes said at least one determined portion of the authenticated data in protected form.

4 . An authentication method according to claim 3 , wherein said protected form comprises a digital fingerprint of said at least one determined portion of the authentication data as generated using a hashing function.

5 . An authentication method according to claim 1 , wherein said first application is in the JavaScript® language.

6 . An authentication method according to claim 1 , wherein the first application is generated in a manner that triggers deletion of said first application in the event of terminal authentication data that does not correspond to said at least one determined portion of the authentication data used for protecting the first application being supplied in succession some predetermined number of times.

7 . An authorization method enabling a gateway of an internal network protected by a security entity to authorize a terminal having a web browser to access a service made available by a service platform of an external network distinct from the internal network, the method comprising:
authenticating said terminal by executing an authentication method according to claim 1 ; if said terminal is authorized to access said service, generating a second application configured to, on being executed by the web browser of the terminal, supply a direct connection between said terminal and said service platform for accessing said service; and transmitting said second application to the web browser of the terminal.

8 . An authorization method according to claim 7 , wherein said second application includes a security parameter previously exchanged between said service platform and an entity of the internal network for accessing said service, said second application being configured to supply the security parameter to said service platform on setting up the direct connection between the terminal and said service platform.

9 . An authorization method according to claim 7 , wherein the second application is in the JavaScript® language.

10 . A connection set-up method for setting up a connection with an internal network protected by an access security entity for providing secure access, said method being for performing by a web browser of the terminal and comprising:
after said web browser has sent a request including a user identity to a gateway of the internal network, receiving from said gateway a first application that is protected using at least one determined portion of authentication data associated with said user identifier in a database of the internal network; and executing said first application, the execution comprising:
the first application obtaining authentication data from the terminal; and
if said authentication data obtained from the terminal corresponds to said at least one determined portion of said authentication data protecting the first application, the first application setting up a connection between said terminal and a proxy server, said connection using parameters from a set of connection parameters authorized by said proxy server for accessing said internal network via said access security entity.

11 . An access method enabling a terminal having a web browser to access a service offered by a service platform of an external network, said method comprising:
executing, by the web browser of the terminal, a method according to claim 10 and resulting in said terminal being authenticated with an internal network protected by an access security entity, via a first application transmitted to said web browser by a gateway of the internal network, and in said first application setting up a connection between said terminal and a proxy server, said connection making use of parameters of a set of connection parameters authorized by said proxy server for accessing said internal network via said access security entity; sending, by said first application, a request to the proxy server via said connection, the request being for access to said service made available by said service platform; if the terminal is authorized to access said service, receiving, by said web browser, a second application generated by the gateway; and executing said second application, thereby supplying the terminal with a direct connection to said service platform to access said service.

12 . A computer having stored thereon a program including instructions for performing the authentication method according to claim 1 when said program is executed by said computer.

13 . A non-transitory computer readable data medium having stored thereon a computer program including instructions for performing the authentication method according to claim 1 when said program is executed by a processor.

14 . A gateway of an internal network protected by an access security entity for providing secure access, said gateway comprising:
an obtaining module that is activated on receiving a request coming from a web browser of a terminal and including a user identifier, said obtaining module being configured to obtain authentication data that is associated with user identifier and that is stored in a database of the internal network; a configuration module configured to configure a proxy server allowing a determined set of connection parameters to access to said internal network via said access security entity; a generation module configured to generate a first application from parameters of said determined set of connection parameters, said first application being protected by using at least one determined portion of said authentication data and being configured to, on being executed by the web browser of the terminal set up a connection between said terminal and said proxy server by using said parameters, in response to said at least one determined portion of the authentication data being supplied; and a transmission module configured to transmit the first application to the web browser of the terminal.

15 . A gateway according to claim 14 , further comprising:
a generation module configured to generate a second application that is activated if said terminal is authorized to

Assignees

• Orange

Inventors

• He Ruan
• Chawki Jamil

Classifications

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title