HTTP header-based adaptable authentication mechanism

Patent metadata

Field	Value
Publication number	US-9641504-B2
Application number	US-201414570734-A
Country	US
Kind code	B2
Filing date	Dec 15, 2014
Priority date	Dec 15, 2014
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

The disclosure is generally directed to systems and methods for HTTP header-based authentication. For example, the systems and methods include receiving, at a mobile platform server, a first request message from a client device, the first request message requesting to download an application from the mobile platform server, sending, to the client device, a first response message having a first authentication query within header portions of the first response message, receiving, at the mobile platform server, a second request message having first authentication credentials within header portions of the second request message, sending, to the client device, a second response message having a second authentication query within header portions of the second response message, receiving, at the mobile platform server first device, a third request message having second authentication credentials within header portions of the third request message, and sending, to the client device, the application.

First claim

We claim:

1. A computer-implemented method for exchanging data using a data transfer protocol between a first device and a second device, the method comprising:
receiving, at the first device, a first request message from a second device, the first request message requesting to download an application from the first device;
responsive to receipt of the first request message, sending, to the second device, a first response message having a first authentication query within header portions of the first response message;
receiving, at the first device, a second request message having first authentication credentials within header portions of the second request message, the first authentication credentials being responsive to the first authentication query;
determining whether the first authentication credentials satisfy the first authentication query;
responsive to determining that the first authentication credentials satisfy the first authentication query, sending, to the second device, a second response message having a second authentication query within header portions of the second response message;
receiving, at the first device, a third request message having second authentication credentials within header portions of the third request message, the second authentication credentials being responsive to the second authentication query;
determining whether the second authentication credentials satisfy the second authentication query, wherein each of the first and second authentication credentials rely upon different security mechanisms;
responsive to determining that the second authentication credentials satisfy the second authentication query; and
transmitting, to the second device, the application upon a predetermined number of authentication techniques having been used as determined by a request counter that updates in connection with the authentication queries.

2. The method according to claim 1 , wherein the data transfer protocol standard is a hypertext transfer protocol (HTTP).

3. The method according to claim 1 , wherein the second authentication credential is selected from secure sockets layer certificates, authorization tokens, basic authentication, Kerberos authentication, remote authentication dial in user service (RADIUS), and security assertion markup language (SAML) mechanisms.

4. The method according to claim 3 , wherein a subsequent third authentication credential is selected from secure sockets layer certificates, authorization tokens, basic authentication, Kerberos authentication, remote authentication dial in user service (RADIUS), and security assertion markup language (SAML) mechanisms, and differs from the second authentication credential, ensured by the use of the request counter.

5. A non-transitory computer readable storage medium storing one or more programs configured to be executed by a processor, the one or more programs for exchanging data using a data transfer protocol between a first device and a second device, and comprising instructions for:
receiving, at the first device, a first request message from a second device, the first request message requesting to download an application from the first device;
responsive to receipt of the first request message, sending, to the second device, a first response message having a first authentication query within header portions of the first response message;
receiving, at the first device, a second request message having first authentication credentials within header portions of the second request message, the first authentication credentials being responsive to the first authentication query;
determining whether the first authentication credentials satisfy the first authentication query;
responsive to determining that the first authentication credentials satisfy the first authentication query, sending, to the second device, a second response message having a second authentication query within header portions of the second response message;
receiving, at the first device, a third request message having second authentication credentials within header portions of the third request message, the second authentication credentials being responsive to the second authentication query;
determining whether the second authentication credentials satisfy the second authentication query, wherein each of the first and second authentication credentials rely upon different security mechanisms;
responsive to determining that the second authentication credentials satisfy the second authentication query; and
transmitting, to the second device, the application upon a predetermined number of authentication techniques having been used as determined by a request counter that updates in connection with the authentication queries.

6. The computer readable storage medium according to claim 5 , wherein the data transfer protocol standard is a hypertext transfer protocol (HTTP).

7. The computer readable storage medium according to claim 5 , wherein the second authentication credential is selected from secure sockets layer certificates, authorization tokens, basic authentication, Kerberos authentication, remote authentication dial in user service (RADIUS), and security assertion markup language (SAML) mechanisms.

8. The computer readable storage medium according to claim 7 , wherein a subsequent third authentication credential is selected from secure sockets layer certificates, authorization tokens, basic authentication, Kerberos authentication, remote authentication dial in user service (RADIUS), and security assertion markup language (SAML) mechanisms, and differs from the second authentication credential, ensured by the use of the request counter.

9. A communication apparatus comprising:
one or more processors; and
a memory storing one or more programs for exchanging data using a data transfer protocol between a first device and a second device, and comprising instructions for execution by the one or more processors, the one or more programs including instructions for:
receiving, at the first device, a first request message from a second device, the first request message requesting to download an application from the first device;
responsive to receipt of the first request message, sending, to the second device, a first response message having a first authentication query within header portions of the first response message;
receiving, at the first device, a second request message having first authentication credentials within header portions of the second request message, the first authentication credentials being responsive to the first authentication query;
determining whether the first authentication credentials satisfy the first authentication query;
responsive to determining that the first authentication credentials satisfy the first authentication query, sending, to the second device, a second response message having a second authentication query within header portions of the second response portion;
receiving, at the first device, a third request message having second authentication credentials within header portions of the third request message, the second authentication credentials being responsive to the second authentication query;
determining whether the second authentication credentials satisfy the second authentication query, wherein each of the first and second authentication credentials rely upon different security mechanisms;
responsive to determining that the second authentication credentials satisfy the second authentication query; and
transmitting, to the second device, the application upon a predetermined number of authentication techniques having been used as determined by a request counter that updates in connection with the authentication que

Assignees

• Sap Se

Inventors

• Stevens Karl
• Hoos Jason
• Hall John
• Xue Yunjiao
• Wang Steven
• Natarajan Senthil

Classifications

• H04W4/60 Primary

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04W4/003

  Electricity · mapped topic

• H04W12/06

  Authentication · CPC title