CA2511201C - System and method of user credential management - Google Patents

System and method of user credential management Download PDF

Info

Publication number
CA2511201C
CA2511201C CA2511201A CA2511201A CA2511201C CA 2511201 C CA2511201 C CA 2511201C CA 2511201 A CA2511201 A CA 2511201A CA 2511201 A CA2511201 A CA 2511201A CA 2511201 C CA2511201 C CA 2511201C
Authority
CA
Canada
Prior art keywords
user
mobile device
user credential
credential
server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CA2511201A
Other languages
French (fr)
Other versions
CA2511201A1 (en
Inventor
Ian Elbury
Rastislav Hodul
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Psion Inc
Original Assignee
Psion Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Psion Inc filed Critical Psion Inc
Priority to CA2511201A priority Critical patent/CA2511201C/en
Publication of CA2511201A1 publication Critical patent/CA2511201A1/en
Application granted granted Critical
Publication of CA2511201C publication Critical patent/CA2511201C/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80Wireless

Abstract

A user credential management system and method for managing user credentials are provided. The user credential management system comprises an authentication module for authenticating a user login to a mobile device, and a message transforming module for associating a user credential to a message sent from the mobile device to a server. The method comprising the steps of authenticating a user login to a mobile device, locating a user credential associated with the user login, and associating the user credential to a message between the mobile device and a server.

Description

r System and Method of User Credential Management FIELD OF INVENTION
[0001] The present invention relates generally to distributed mobile applications, and in particular, to a system and method of user credential management.
BACKGROUND OF THE INVENTION
[0002] Mobile devices may be used by multiple users. For example, an enterprise may provide each worker with a mobile device to work with and report to a central server. Alternatively, a plurality of devices may be provided to a plurality of locations to be used by a plurality of users. When data is collected and posted to a server, it is desirable to know who the user is.
[0003] On Windows Embedded Compact (CE) devices there is NT LAN Manager (NTLM) authentication against an Internet Information Server (IS) server available if the device is online. There are other single sign on technologies (such as Kerberos) but these require all participating systems to accept the same type of credential. There is a need for offline authentication for mobile devices.
SUMMARY OF THE INVENTION
[0004] The present invention relates to distributed mobile applications where data collection can take place in environments with and without radio (or other telecommunication) coverage. It is an object of the invention to provide a system and method of user credential management.
[0005] In accordance with an embodiment of the invention, there is provided a user credential management system for managing user credentials. The user credential management system comprises an authentication module for authenticating a user login to a mobile device, and a message transforming module for associating a user credential to a message sent from the mobile device to a server.
[0006] In accordance with another embodiment of the invention, there is provided a method of managing user credentials. The method comprising the steps of authenticating a user login to a mobile device, locating a user credential associated with the user login, and associating the user credential to a message between the mobile device and a server.
-
[0007] Advantageously, the system and method of user credential management allows for centrally managed user and credential management. The login to multiple backend systems is transparent to the user (only needs one user name and password ยจ
single sign on).
[0008] This summary of the invention does not necessarily describe all features of the invention.
BRIEF DESCRIPTION OF THE DRAWINGS
[0009] These and other features of the invention will become more apparent from the following description in which reference is made to the appended drawings wherein:
[0010] Figure 1 shows in a network diagram an example of a system overview of a design, development and operational environment, in accordance with an embodiment of the invention;
[0011] Figure 2 shows in a layer diagram another example of a system overview of a design, development and operational environment, in accordance with an embodiment of the invention;
[0012] Figure 3 shows an example of a user credential management system for managing user credentials, in accordance with an embodiment of the invention;
[0013] Figure 4 shows in a flowchart an example of a method of managing user credentials, in accordance with an embodiment of the user credential management system;
[0014] Figure 5 shows another example of a user credential management system;
and
[0015] Figure 6 shows in a flowchart another example of a method of managing user credentials, in accordance with an embodiment of the user credential management system.
DETAILED DESCRIPTION
[0016] The following description is of a preferred embodiment.
[0017] The present invention will be further illustrated in the following examples.
[0018] Figure 1 shows in a network diagram an example of a system overview 100 of a design, development and operational environment for deploying feature rich applications (that use web services) to mobile devices and desktop personal computers, in accordance with an embodiment of the invention. The system overview 100 comprises one or more or mobile client components (or handheld terminals) for allowing a user to collect, review and modify data; a server component 104 for providing applications and connectivity options to external systems; a network 106 for allowing the handheld terminals 102 to communicate with the server component via a communications protocol; and a back-end system (or host) 108 for providing a database or enterprise resource planning (ERP) system. Examples of mobile components include personal computers (PCs), vehicle mount computers, tablet PCs, and devices with embedded operating systems, etc.
[0019] Figure 2 shows in a layer diagram another example of a system overview of a design, development and operational environment, in accordance with an embodiment of the invention. The mobile client component 102 comprises one or more client applications 202 that communicate with a web services client 204.
The server component 104 comprises an Internet information server (ITS) 206 for communicating with the web services client 204, one or more server applications 208 and a host interconnect module 210 for communicating with the host (or back-end system) 108. The server applications 208 communicate with both the ITS 206 and the host interconnect module 210.
[0020] An application console may be installed as client application 202 on the mobile client component 102 to provide a presentation layer and application framework that end users use to collect, review and modify data. The application console communicates with the server component 104 via web services running on the ITS 206. The server component 104 is a middle tier where data is synchronized before being sent to the back-end system 108.
[0021] The server component 104 provides the applications and connectivity options to integrate back-end systems 108. A unified administration console for administering middleware may be installed as a server application 206 to provide a single source for system management and monitoring and can be used remotely. Advantageously, the unified administrative console simplifies multi-site, multi-device management and deployment. This allows for ease of deployment and controlled rollouts. Host interconnect modules 210 provide the information and logic used to integrate with the back-end systems 108.
[0022] Back-end systems 108, whether databases or full-featured ERP systems, are supported via the host interconnect modules 210 installed on the server component 104. Standard interface technologies are supported, including extensible markup language (XML) and open database connectivity (ODBC), as well as ERP-specific interfaces.
[0023] Figure 3 shows an example of a user credential management system 300 for managing user credentials, in accordance with an embodiment of the invention.
The user credential management system 300 comprises an authentication module 302 for authenticating a user login to a mobile device 102, a user credential locator module 304 for determining the user credential associated with the user login, and a message transforming module 306 for associating user credentials to a user message sent from the mobile device to a server. Other components may be added to the user credential management system 300, such as a credential sender implemented on a server for sending user credentials to a mobile device, a credential receiver module implemented on a mobile device for receiving credentials from a server, and a user credential repository for storing user credentials.
[0024] The user credential management system 300 can be implemented in the application console. Preferably, a user credential is encrypted and comprises a random string appended to a user password. Preferably, a user credential repository is implemented on a server with a plurality of user credentials. The plurality of user credentials may be divided into groups. A user credential repository may also be implemented on a mobile device, preferably for one or a group of credentials.
Advantageously, dividing the user credentials into groups allows for less information to download to a mobile device, makes the user credentials easier to manage, and allows an administrator to manage a site locally.
[0025] Figure 4 shows in a flowchart an example of a method of managing user credentials (400), in accordance with an embodiment of the user credential management system 300. The method (400) comprises the steps of authenticating a user login to a mobile device (402), determining a user credential associated with the user login (404), and associating user credentials to a communication message between the mobile device and a server (406). Preferably, the user credential may be determined by mapping an authentic user login to a user credential.
Alternatively, the user login may generate the appropriate user credential. A message may be associated with a user credential by automatically attaching the user credential to the message during communication. Other steps may be added to the method (400), such as sending user credentials to a mobile device, receiving credentials from a server, and creating and storing user credentials.
[0026] Figure 5 shows another example of a user credential management system 500.
The user credential management system 500 comprises the authentication module 302, the user credential locator module 304, the message transforming module 306, a credential receiver module 508 for receiving credentials from a server, and a mobile credential repository 510 for storing one or a group of user credentials on the mobile device. These components 302, 304, 306, 508, and 510 are preferably implemented as code in a mobile device. The user credential management system 500 further comprises components implemented as code on a server, including a credential sender module 512 for sending user credentials to a mobile device, and a user credential repository 514 for storing a plurality of user credentials. Other components may be added to the user credential management system 500, including an application provisioning system for administering and delivering software applications or components to client devices 102.
[0027] A user database (or the user credential repository 514) is centrally managed on the server. Preferably, this database is encrypted and assigned to the workstations using application provisioning and downloaded to the workstation as any other component assigned to it. Alternatively, the workstations can download the database file from the server in other means, such file transfer protocol (ftp), web services, etc.
Once the database is present on the workstation, the client runtime environment, or application console, prompts the user to login. After successful login, the user's identity is attached to every single web service request the application makes using web services enhancements (WSE).
[0028] Each user can have one or many extended credentials attached to them on the server that are not downloaded to the workstation. When the client application calls the web service that is supposed to send the data to ERP (e.g., SAP) for which further credentials are required, the service can search the credentials of the calling user and use them to login to ERP system.
[0029] Figure 6 shows in a flowchart another example of a method of managing user credentials (600), in accordance with an embodiment of the user credential management system 500. The method (600) comprises the step of storing user credentials in a repository on a server (602). The user credentials (for example, a user name and password) may be stored in one database table. Credentials to foreign systems (e.g., ERP) may be stored in another database table. A user credential or group of user credentials may be sent to a mobile device (604). The mobile device receives the user credential or group (606) and stores same in a local mobile credential repository (608). When an application is started (610), a user login is authenticated (402). A user credential associated with the user login is located (404). A
communication sent by the user between the mobile device and the server is associated with the user credential (406) as found in the mobile credential database and server user credential database. Preferably, when the message from the client arrives, the credential attached to it is re-authenticated on the server again, to make sure that someone along the way did not inject a bogus credential. Thus, the username and hashed password attached to the message is again authenticated on the server, as a precaution. Other steps may be added to the method (600), including storing a plurality of user credentials for a single user, the plurality of user credentials associated with a plurality of foreign servers, and associating messages between the mobile device and foreign servers with the appropriate user credential.
[0030] Typically, operating systems for mobile devices do not offer an authentication mechanism in a disconnected environment. Users of the user credential management system 300, 500 and method 400, 600 can authenticate the user on a workstation even if the user is not contacting the server. The single sign on brings transparency to the user when the user's data is further posted to ERP system. The user does not need to know or be aware of the user credentials to the ERP system.
[0031] Advantageously, the system 300, 500 and method 400, 600 of user credential management allows for centrally managed user and credential management. The login to multiple backend systems is transparent to the user (only needs one user name and password--single sign on).
[0032] The user credential management system and method according to the present invention may be implemented by any hardware, software or a combination of hardware and software having the above described functions. The software code, either in its entirety or a part thereof, may be stored in a computer readable memory.
Further, a computer data signal representing the software code which may be embedded in a carrier wave may be transmitted via a communication network.
Such a computer readable memory and a computer data signal are also within the scope of the present invention, as well as the hardware, software and the combination thereof.
=

Claims (25)

WHAT IS CLAIMED:
1. A user credential management system comprising:
a computer readable storage medium for storing instructions or statements for use in the execution in a computer of a method of managing user credentials, the method comprising:
receiving, by a receiver of the mobile device, at least one user credential sent by an authentication server, wherein the at least one user credential is stored in a server repository of the authentication server;
storing, in a repository of the mobile device, in the mobile device, the at least one user credential received by the receiver ;
receiving a user login request at the mobile device;
authenticating, by an authentication module of the mobile device, the user login based on the at least one user credential stored in the repository of the mobile device, thereby enabling authentication of the user login even when a connection to the authentication server is not available;
determining, by a user credential locator module of the mobile device, a user credential associated with the authenticated user login; and associating, at a message transforming module of the mobile device, the user credential associated with the authenticated user login to a message sent from the mobile device to a foreign server after authentication of the user login.
2. The user credential management system as claimed in claim 1, wherein the user credential is attached to the message.
3. The user credential management system as claimed in claim 1, wherein the user credential is encrypted and includes a username and a string of characters.
4. The user credential management system as claimed in claim 1, wherein the repository includes a mapping between the user credential and a username.
5. The user credential management system as claimed in claim 1, wherein the user credential is sent to the mobile device.
6. The user credential management system as claimed in claim 1, wherein the at least one user credential in the repository of the server is grouped.
7, The user credential management system according to claim 1, wherein the repository of the server stores at least one extended credential for user login to at least one foreign system, and the at least one extended credential is further associated with the message sent by the mobile device.
8. The user credential management system as claimed in any one of claims 1 to 7, wherein the method comprises locating the user credential associated with the user login.
9. A user credential management system comprising:
a computer readable storage medium for storing instructions or statements for use in the execution in a computer of a method of managing user credentials, the method comprising:
receiving, by a receiver of the mobile device, at least one user credential sent by an authentication server, wherein the at least one user credential is stored in a server repository of the authentication server, the user credentials stored in the server repository being grouped, the group of user credentials including user credentials for a foreign server;
storing, in a repository of the mobile device, in a mobile device, the at least one user credential received by the receiver;
authenticating, by an authentication module of the mobile device, a user login based on the at least one user credential stored in the repository of the mobile device, thereby enabling authentication of the user login even when a connection to the authentication server is not available;
determining, by a credential locator module of the mobile device, a user credential associated with the authenticated user login from the at least one user credential received, wherein the user credential is in the group of user credentials for the foreign server; and associating, at a message transforming module of the mobile device, the user credential to a message sent from the mobile device to the foreign server, after authentication of the user login.
10. The user credential management system as claimed in claim 9, wherein the user credential is attached to the message.
11. The user credential management system as claimed in claim 9, wherein the user credential is encrypted and includes a username and a string of characters.
12. The user credential management system as claimed in claim 9, wherein the repository includes a mapping between the user credential and a username.
13. The user credential management system as claimed in claim 9, wherein the user credential is sent to the mobile device.
14. The user credential management system according to claim 9, wherein the repository of the server stores at least one extended credential for user login to at least one foreign system, and the at least one extended credential is further associated with the message sent by the mobile device.
15. The user credential management system as claimed in any one of claims 9 to 14, wherein the method comprises locating the user credential associated with the user login.
16. A method of managing user credentials, comprising:
receiving, by a receiver of the mobile device, at least one user credential sent by an authentication server, wherein the at least one user credential is stored in a repository of the authentication server;
storing, in a repository of the mobile device, in the mobile device, the at least one user credential received by the receiver ;
receiving a user login request at the mobile device;
authenticating, by an authentication module of the mobile device, the user login based on the at least one user credential stored in the repository of the mobile device, thereby enabling authentication of the user login even when a connection to the authentication server is not available ;
determining, by a user credential locator module of the mobile device, a user credential associated with the authenticated user login; and associating, at a message transforming module of the mobile device, the user credential associated with the authenticated user login to a message sent from the mobile device to a foreign server after authentication of the user login.
17. The method as claimed in claim 16, wherein the user credential is attached to the message.
18. The method as claimed in claim 16, wherein the user credential is encrypted and includes a username and a string of characters.
19. The method as claimed in claim 16, wherein the repository includes a mapping between the user credential and a username.
20. The method as claimed in any one of claims 16 to 19, wherein the method comprises locating the user credential associated with the user login.
21. A method of managing user credentials, the method comprising:
receiving, by a receiver of the mobile device, at least one user credential sent by an authentication server, wherein the at least one user credential is stored in a server repository of the authentication server, the user credentials stored in the server repository being grouped, the group of user credentials including user credentials for a foreign server;
storing, in a repository of the mobile device, in a mobile device, the at least one user credential received by the receiver;
authenticating, by an authentication module of the mobile device, a user login based on the at least one user credential stored in the repository of the mobile device, thereby enabling authentication of the user login even when a connection to the authentication server is not available;
determining, by a credential locator module of the mobile device, a user credential associated with the authenticated user login, wherein the user credential is in the group of user credentials for the foreign server; and associating, at a message transforming module of the mobile device, the user credential to a message sent from the mobile device to the foreign server, after authentication of the user login.
22. The method as claimed in claim 21, wherein the user credential is attached to the message.
23. The method as claimed in claim 21, wherein the user credential is encrypted and includes a username and a string of characters.
24. The method as claimed in claim 21, wherein the repository includes a mapping between the user credential and a username.
25. The method as claimed in any one of claims 21 to 24, further comprising:
locating the user credential associated with the user login.
CA2511201A 2005-06-30 2005-06-30 System and method of user credential management Active CA2511201C (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CA2511201A CA2511201C (en) 2005-06-30 2005-06-30 System and method of user credential management

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CA2511201A CA2511201C (en) 2005-06-30 2005-06-30 System and method of user credential management

Publications (2)

Publication Number Publication Date
CA2511201A1 CA2511201A1 (en) 2006-12-30
CA2511201C true CA2511201C (en) 2014-01-28

Family

ID=37561647

Family Applications (1)

Application Number Title Priority Date Filing Date
CA2511201A Active CA2511201C (en) 2005-06-30 2005-06-30 System and method of user credential management

Country Status (1)

Country Link
CA (1) CA2511201C (en)

Also Published As

Publication number Publication date
CA2511201A1 (en) 2006-12-30

Similar Documents

Publication Publication Date Title
US8219814B2 (en) System and method of user credential management
US11088903B2 (en) Hybrid cloud network configuration management
US9344883B2 (en) System and method for wide area wireless connectivity to the internet
US11449596B2 (en) Event-based user state synchronization in a local cloud of a cloud storage system
US8195153B1 (en) Mobile access to backup and recovery services
US9111086B2 (en) Secure management of user rights during accessing of external systems
US20030069848A1 (en) A User interface for computer network management
US9930028B2 (en) Method to enroll a certificate to a device using SCEP and respective management application
CN101626369B (en) Method, device and system for single sign-on
US20070088825A1 (en) System and method of distributed license management
EP1749389B1 (en) Method and system for authentication in a computer network
US20040003084A1 (en) Network resource management system
US20140041002A1 (en) Secure Access Method, Apparatus And System For Cloud Computing
CN101217368A (en) A network logging on system and the corresponding configuration method and methods for logging on the application system
US7917947B2 (en) Secured communication channel between IT administrators using network management software as the basis to manage networks
CN101488857B (en) Authenticated service virtualization
US20150039884A1 (en) Secure Configuration of Authentication Servers
KR20150137518A (en) Hybride Cloud-Based ICT Service System and Method thereof
US7636852B1 (en) Call center dashboard
CN105490861A (en) System and method of management of network management device
US8290901B2 (en) Techniques for remote resource mounting
CN102970308A (en) User authentication method and server
CN105071965B (en) A kind of management system of the network equipment
CN106657112A (en) Authentication method and apparatus
CN109189590A (en) Memory management method and device based on RESTful service

Legal Events

Date Code Title Description
EEER Examination request