Mobile device user authentication for accessing protected network resources

Patent metadata

Field	Value
Publication number	US-9369282-B2
Application number	US-201414166935-A
Country	US
Kind code	B2
Filing date	Jan 29, 2014
Priority date	Jan 29, 2014
Publication date	Jun 14, 2016
Grant date	Jun 14, 2016

Abstract

Systems and methods for strong user authentication for accessing protected applications by mobile computing devices. An example method may comprise: receiving, by a mobile computing device, a cryptographic nonce via a first communication interface; transmitting, via a second communication interface, an authentication request using the cryptographic nonce, to an authentication server via an HTTP proxy server; receiving a resource access token from the authentication server; and transmitting a computing resource access request using the resource access token.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a processor of a mobile computing device, a cryptographic nonce from a physical authentication token via a first communication interface, wherein the cryptographic nonce is based on a secret shared by the physical authentication token and an authentication server;
transmitting, by the processor, via a second communication interface, an authentication request using the cryptographic nonce, to an authentication server via a Hypertext Transfer Protocol (HTTP) proxy server;
receiving a single sign-on authentication token from the authentication server;
transmitting, to the authentication server, a resource access token request using the single sign-on authentication token;
receiving a resource access token from the authentication server; and
transmitting a computing resource access request using the resource access token.

2. The method of claim 1 , further comprising:
accessing, via the second communication interface, a computing resource referenced by the computing resource access request.

3. The method of claim 1 , wherein the first communication interface is provided by at least one of: a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

4. The method of claim 1 , wherein the second communication interface is provided by a network communication interface.

5. The method of claim 1 , wherein the authentication request conforms to Kerberos protocol.

6. The method of claim 1 , wherein transmitting the authentication request is performed over a Secure Socket Layer (SSL) connection.

7. The method of claim 1 , wherein the cryptographic nonce is provided by one of: a short-lived certificate or a one-time password.

8. A mobile computing device comprising:
a memory; and
a processor, operatively coupled to the memory, to:
receive a cryptographic nonce from a physical authentication token via a first communication interface, wherein the cryptographic nonce is based on a secret shared by the physical authentication token and an authentication server;
transmit, via a second communication interface, an authentication request using the cryptographic nonce, to an authentication server via a Hypertext Transfer Protocol (HTTP) proxy server;
receive a single sign-on authentication token from the authentication server;
transmit, to the authentication server, a resource access token request using the single sign-on authentication token;
receive a resource access token from the authentication server; and
transmit a computing resource access request using the resource access token.

9. The mobile computing device of claim 8 , wherein the processor is further to:
access, via the second communication interface, a computing resource referenced by the computing resource access request.

10. The mobile computing device of claim 8 , wherein the first communication interface is provided by at least one of: a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

11. The mobile computing device of claim 8 , wherein the second communication interface is provided by a network communication interface.

12. The mobile computing device of claim 8 , wherein the authentication request conforms to Kerberos protocol.

13. The mobile computing device of claim 8 , wherein the cryptographic nonce is provided by one of: a short-lived certificate or a one-time password.

14. A computer-readable non-transitory storage medium comprising executable instructions to cause a processor to:
receive, by the processor, a cryptographic nonce from a physical authentication token via a first communication interface, wherein the cryptographic nonce is based on a secret shared by the physical authentication token and an authentication server;
transmit, via a second communication interface, an authentication request using the cryptographic nonce, to an authentication server via a Hypertext Transfer Protocol (HTTP) proxy server;
receive a single sign-on authentication token from the authentication server;
transmit, to the authentication server, a resource access token request using the single sign-on authentication token;
receive a resource access token from the authentication server; and
transmit a computing resource access request using the resource access token.

15. The computer-readable non-transitory storage medium of claim 14 , further comprising executable instructions to cause the processor to:
access, via the second communication interface, a computing resource referenced by the computing resource access request.

16. The computer-readable non-transitory storage medium of claim 14 , wherein the first communication interface is provided by at least one of: a near field communication (NFC) interface, a Bluetooth interface, or an infrared interface.

17. The computer-readable non-transitory storage medium of claim 14 , wherein the cryptographic nonce is provided by one of: a short-lived certificate or a one-time password.

Assignees

• Red Hat Inc

Inventors

• Pal Dmitri

Classifications

• H04L63/0838

  using one-time-passwords · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L2209/80

  Wireless · CPC title