Authenticating a user device to access services based on a device ID

Patent metadata

Field	Value
Publication number	US-9537659-B2
Application number	US-201314015072-A
Country	US
Kind code	B2
Filing date	Aug 30, 2013
Priority date	Aug 30, 2013
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

A first device may receive a first session token from a second device; determine that the first session token is expired or invalid; provide a security input to the second device to cause the second device to generate a first hash value of the security input using a key corresponding to a key identifier (ID); receive the key ID and the first hash value from the second device; generate a second hash value using the key corresponding to the key ID; determine that the first hash value matches the second hash value; and establish a session with the second device based on determining that the first hash value matches the second hash value.

First claim

What is claimed is:

1. A method comprising:
receiving, by a first device, a first session token from a second device;
determining, by the first device, that the first session token is expired or invalid;
providing, by the first device and to the second device, a security input and an identifier of an application used by the second device, based on determining that the first session token is expired or invalid,
the identifier of the application being different than a device identifier of the second device,
the security input and the identifier of the application causing the second device to:
provide a key identifier (ID) request to a third device,
receive, from the third device and based on the key ID request, a key ID response that includes a key corresponding to the key ID, and
generate a first hash value of the security input using the key corresponding to the key ID;

receiving, by the first device and from the second device, a session token request that includes the key ID and the first hash value;
providing, by the first device and to the third device, a key request that includes the key ID;
receiving, by the first device and from the third device based on the key request, a key response that includes the key corresponding to the key ID;
generating, by the first device, a second hash value using the key corresponding to the key ID provided in the key response;
determining, by the first device, that the first hash value matches the second hash value;
generating, by the first device, a second session token based on determining that the first hash value matches the second hash value;
providing, by the first device, the second session token to the second device;
receiving, by the first device and from the second device, a request to establish a session with the first device,
the request including the second session token; and

establishing, by the first device, a session with the second device based on the request and the second session token.

2. The method of claim 1 , where the second device stores the second session token.

3. The method of claim 1 , further comprising:
receiving a request for content from the second device via the established session; and
providing the content to the second device via the established session.

4. The method of claim 1 , further comprising:
receiving an update to account information or subscription information from the second device via the established session; and
updating the account information or the subscription information.

5. The method of claim 1 , where determining that the first session token is expired or invalid is based on an expiry timestamp included in the first session token or based on a value stored by a secure storage included in the first session token.

6. The method of claim 1 , further comprising:
determining that the second device is authorized to communicate with the first device based on the device identifier of the second device,
where establishing the session is based on determining that the second device is authorized to communicate with the first device.

7. The method of claim 1 ,
where the application is used by the second device to communicate with the first device.

8. The method of claim 1 , further comprising:
notifying the second device that the session cannot be established based on determining that the first hash value does not match the second hash value.

9. A system comprising:
a first device to:
receive a first session token from a second device;
determine that the first session token is expired or invalid;
provide, to the second device, a security input and an identifier of an application used by the second device, based on determining that the first session token is expired or invalid,
the identifier of the application being different than a device identifier of the second device,

the security input and the identifier of the application causing the second device to:
provide a key identifier (ID) request to a third device,
receive, from the third device and based on the key ID request, a key ID response that includes a key corresponding to the key ID, and
generate a first hash value of the security input using the key corresponding to the key ID;

receive, from the second device, a session token request that includes the key ID and the first hash value;
provide, to the third device, a key request that includes the key ID;
receive, from the third device and based on the key request, a key response that includes the key corresponding to the key ID;
generate a second hash value using the key corresponding to the key ID provided in the key response;
determine that the first hash value matches the second hash value;
generate a second session token based on determining that the first hash value matches the second hash value;
provide the second session token to the second device;
receive, from the second device, a request to establish a session with the first device,
the request including the second session token; and

establish a session with the second device based on the request and the second session token.

10. The system of claim 9 , where the second device stores the second session token.

11. The system of claim 9 , where the first device is further to:
receive an update to account information or subscription information from the second device via the established session; and
update the account information or the subscription information.

12. The system of claim 9 , where, when determining that the first session token is expired or invalid, the first device is to:
determine that the first session token is expired or invalid based on an expiry timestamp included in the first session token or based on a value stored by a secure storage included in the first session token.

13. The system of claim 9 , where the first device is further to:
determine that the second device is authorized to communicate with the first device based on the device identifier of the second device,
where, when providing the security input and the identifier of the application to the second device, the first device is to provide the security input and the identifier of the application to the second device based on determining that the second device is authorized to communicate with the first device.

14. The system of claim 9 , where the application is used by the second device to communicate with the first device.

15. The system of claim 9 , where the first device is further to:
notify the second device that the session cannot be established based on determining that the first hash value does not match the second hash value.

16. A non-transitory computer-readable medium for storing instructions, the instructions comprising:
a plurality of instructions which, when executed by one or more processors associated with a first device, cause the one or more processors to:
receive a first session token from a second device;
determine that the first session token is expired or invalid;
provide, to the second device, a security input and an identifier of an application used by the second device, based on determining that the first session token is expired or invalid,
the identifier of the application being different than a device identifier of the second device,
the security input and the identifier of the application causing the second device to:
provide a key identifier (ID) request to a third device,
receive, from the third device and based on the key ID request, a key ID response that includes a key corresponding to the key ID, and
generate a first hash value of

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Yin Fenglin

Classifications

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title