Mobile device user authentication for accessing protected network resources

Patent metadata

Field	Value
Publication number	US-2016286400-A1
Application number	US-201615178725-A
Country	US
Kind code	A1
Filing date	Jun 10, 2016
Priority date	Jan 29, 2014
Publication date	Sep 29, 2016
Grant date	—

Abstract

A method for user authentication for accessing protected applications by computing devices includes receiving, by a processor of a mobile computing device, a first authentication token. The method further includes transmitting an authentication request using the first authentication token. The method further includes receiving, in response to the authentication request, a second authentication token. The method further includes transmitting a resource access token request using the second authentication token. The method further includes receiving, in response to the resource access token request, a resource access token. The method further includes transmitting a computing resource access request using the resource access token.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a processor of a computing device, a first authentication token; transmitting, by the processor, an authentication request using the first authentication token; receiving, in response to the authentication request, a second authentication token; transmitting, by the processor, a resource access token request using the second authentication token; receiving, in response to the resource access token request, a resource access token; and transmitting, by the processor, a computing resource access request using the resource access token.

2 . The method of claim 1 , further comprising:
accessing a computing resource identified by the resource access token.

3 . The method of claim 1 , wherein transmitting the authentication request is performed via a Hypertext Transfer Protocol (HTTP) proxy server.

4 . The method of claim 1 , wherein transmitting the authentication request is performed via a communication interface provided by at least one of: a network communication interface, a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

5 . The method of claim 1 , wherein transmitting the authentication request is performed over a Secure Socket Layer (SSL) connection.

6 . The method of claim 1 , wherein the first authentication token is provided by one of: a short-lived certificate or a one-time password.

7 . The method of claim 1 , wherein the second authentication token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

8 . The method of claim 1 , wherein the authentication request conforms to Kerberos protocol.

9 . A computing device comprising:
a memory; and a processor, operatively coupled to the memory, to:
receive a first authentication token;
transmit an authentication request using the first authentication token;
receive, in response to the authentication request, a second authentication token;
transmit a resource access token request using the second authentication token;
receive, in response to the resource access token request, a resource access token; and
transmit a computing resource access request using the resource access token.

10 . The system of claim 9 , wherein the processor is further to:
accessing a computing resource identified by the resource access token.

11 . The system of claim 9 , wherein the processor is to transmit the authentication request via a Hypertext Transfer Protocol (HTTP) proxy server.

12 . The system of claim 9 , wherein the processor is to transmit the authentication request via a communication interface provided by at least one of: a network communication interface, a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

13 . The system of claim 9 , wherein the processor is to transmit the authentication request over a Secure Socket Layer (SSL) connection.

14 . The system of claim 9 , wherein the first authentication token is provided by one of: a short-lived certificate or a one-time password.

15 . The system of claim 9 , wherein the second authentication token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

16 . The system of claim 9 , wherein the authentication request conforms to Kerberos protocol.

17 . A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a processor of a computing device, cause the processor to:
receive a first authentication token; transmit, by the processor, an authentication request using the first authentication token; receive, in response to the authentication request, a second authentication token; transmit, by the processor, a resource access token request using the second authentication token; receive, in response to the resource access token request, a resource access token; and transmit, by the processor, a computing resource access request using the resource access token.

18 . The computer-readable non-transitory storage medium of claim 17 , further comprising executable instructions causing the processor to:
access a computing resource identified by the resource access token.

19 . The computer-readable non-transitory storage medium of claim 17 , wherein the first authentication token is provided by one of: a short-lived certificate or a one-time password.

20 . The computer-readable non-transitory storage medium of claim 17 , wherein the second authentication token is provided by a ticket granting ticket, and wherein the resource access token is provided by a service ticket.

Assignees

• Red Hat Inc

Inventors

• Pal Dmitri

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3228

  One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title