Authenticating mobile applications using policy files

Patent metadata

Field	Value
Publication number	US-9923880-B2
Application number	US-201514817383-A
Country	US
Kind code	B2
Filing date	Aug 4, 2015
Priority date	Dec 4, 2014
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

Examples of techniques for authenticating mobile applications are described herein. A method includes receiving, at a first server, a key pair and a policy file associated with a mobile service on a second server, the policy file includes a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication. The method includes distributing the key pair and the policy file to a security device. The method also includes receiving, at the first server, an authentication request from a mobile application. The method further includes creating an authenticity challenge as specified in the policy file and sending the authenticity challenge with a response to the mobile application.

First claim

What is claimed is:

1. A method, comprising:
receiving, via a processor in a first server, a key pair and a policy file associated with a mobile service from a second server, the policy file comprising a list of:
a plurality of security objects to be authenticated,
a plurality of computing devices to authenticate the security objects, and
an order of authentication;

distributing, via the processor, the key pair and the policy file;
receiving, via the processor in the first server, an authentication request from a mobile application;
creating, via the processor, an authenticity challenge as specified in the policy file and sending the authenticity challenge with a response to the mobile application; and
performing an authentication sequence based on the order of authentication from the policy file, the authentication sequence comprising the authenticity challenge including a request for application data of the mobile application, a device authentication challenge including a request for device identification of the mobile application, and a user authentication challenge to authenticate a user of the mobile application.

2. The method of claim 1 , further comprising receiving a valid authenticity challenge response from the mobile application.

3. The method of claim 2 , further comprising sending the device authentication challenge with a second response to the mobile application.

4. The method of claim 3 , further comprising receiving a grant token request from the mobile application and sending a grant token to the mobile application.

5. The method of claim 4 , further comprising receiving the grant token from the mobile application at the first server.

6. The method of claim 5 , further comprising creating an access token at the first server and sending the access token to the mobile application.

7. The method of claim 1 , wherein the key pair and the policy file are received from mobile application metadata.

Assignees

• IBM

Inventors

• Borovoy Ishai
• Levin Iddo
• Schneider Haim
• Shachor Gal
• Spector Artem

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04W12/06 Primary

  Authentication · CPC title