US20140189840A1 - Method and apparatus for single sign-on collaboration among mobile devices - Google Patents

Method and apparatus for single sign-on collaboration among mobile devices Download PDF

Info

Publication number
US20140189840A1
US20140189840A1 US13/728,422 US201213728422A US2014189840A1 US 20140189840 A1 US20140189840 A1 US 20140189840A1 US 201213728422 A US201213728422 A US 201213728422A US 2014189840 A1 US2014189840 A1 US 2014189840A1
Authority
US
United States
Prior art keywords
mobile device
collaboration
credential
identity token
collaboration credential
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US13/728,422
Other versions
US8782766B1 (en
Inventor
Anthony R. Metke
Katrin REITSMA
Adam C. Lewis
George Popovich
Steven D. Upp
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Motorola Solutions Inc
Original Assignee
Motorola Solutions Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Motorola Solutions Inc filed Critical Motorola Solutions Inc
Priority to US13/728,422 priority Critical patent/US8782766B1/en
Assigned to MOTOROLA SOLUTIONS, INC. reassignment MOTOROLA SOLUTIONS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: METKE, ANTHONY R., POPOVICH, GEORGE, REITSMA, Katrin, UPP, STEVEN D., LEWIS, ADAM C.
Publication of US20140189840A1 publication Critical patent/US20140189840A1/en
Application granted granted Critical
Publication of US8782766B1 publication Critical patent/US8782766B1/en
Application status is Active legal-status Critical
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0884Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements, e.g. access security or fraud detection; Authentication, e.g. verifying user identity or authorisation; Protecting privacy or anonymity ; Protecting confidentiality; Key management; Integrity; Mobile application security; Using identity modules; Secure pairing of devices; Context aware security; Lawful interception
    • H04W12/06Authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/41User authentication where a single sign-on provides access to a plurality of computers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0815Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network providing single-sign-on or federations

Abstract

A system for, and method of, single sign-on collaboration among a plurality of mobile devices, includes a server for issuing a first identity token to subsequently authenticate a user of a first of the mobile devices to a service provider, and for generating and sending a collaboration credential to the first device based on the first identity token or user authentication. The first device sends the collaboration credential generated by the server to a second device paired with the first device. The server also issues a second identity token to subsequently authenticate to the service provider the user of the second device based on the collaboration credential received from the first device, to support single sign-on collaboration for the user across the plurality of mobile devices.

Description

    REFERENCE TO RELATED APPLICATIONS
  • The present application is related to U.S. patent application Ser. No. ______, attorney docket no. CM15507, entitled “Method of and System for Authenticating and Operating Personal Communication Devices over Public Safety Networks”; U.S. patent application Ser. No. ______, attorney docket no. CM15513, entitled “Method and Apparatus for Single Sign-On Collaboration Among Mobile Devices”; U.S. patent application Ser. No. ______, attorney docket no. CM15568, entitled “Method and Apparatus for Ensuring Collaboration Between a Narrowband Device and a Broadband Device”; U.S. patent application Ser. No. ______, attorney docket no. CM15610, entitled “System and Method for Scoping a User Identity Assertion to Collaborative Devices”; and U.S. patent application Ser. No. ______, attorney docket no. CM15805, entitled “Apparatus for and Method of Multi-Factor Authentication Among Collaborating Mobile Devices”; which applications are commonly owned and filed on the same date as this application and the contents of which applications are incorporated herein in their entirety by reference thereto.
  • FIELD OF THE DISCLOSURE
  • The present disclosure relates generally to a system for, and a method of, single sign-on (SSO) collaboration among a plurality of mobile devices.
  • BACKGROUND
  • Single sign-on (SSO) technology is a session/user authentication process that permits an on-line user to enter identity information, for example, a user name and a password, in response to prompts in order to access multiple applications, e.g., email, banking services, shopping services, etc., at various web sites or internet domains hosted by a service provider, on a single mobile device. The SSO process authenticates the user for all the applications that he or she has been given rights to, and eliminates further prompts when the user switches applications during a particular on-line session. Security Assertion Markup Language (SAML) and Web Authorization Protocol (OAuth) are examples of open standards for exchanging authentication and authorization data between such multiple applications on a single mobile device.
  • As advantageous as the known SSO processes have been, they do not support SSO when a user of one mobile device changes or switches to another mobile device. By way of example, a user may be checking his or her email on a personal digital assistant or a smartphone, and then, for whatever reason, may subsequently wish to check his or her email, or even run a different application, on his or her laptop computer or a desktop computer. Thereafter, the user may wish to check his or her email, or even run a different application, on his or her tablet. The user may, in case of emergency, subsequently wish to run an application on his or her land mobile radio (LMR). At present, whenever the user changes mobile devices, he or she must re-enter the identity information, for example, the user name and password, in response to prompts made by each new mobile device.
  • Accordingly, there is a need to enable SSO across a plurality of mobile devices to reduce the amount of time and the annoyance of having to log in and enter the identity information each and every time that the user changes devices.
  • BRIEF DESCRIPTION OF THE FIGURES
  • The accompanying figures, where like reference numerals refer to identical or functionally similar elements throughout the separate views, together with the detailed description below, are incorporated in and form part of the specification, and serve to further illustrate embodiments of concepts that include the claimed invention, and explain various principles and advantages of those embodiments.
  • FIG. 1 is a schematic view of a system for single sign-on (SSO) collaboration among a plurality of mobile devices in accordance with the present disclosure
  • FIG. 2 is a message sequence chart depicting steps performed in a method of single sign-on (SSO) collaboration among a plurality of mobile devices in accordance with one embodiment of the present disclosure.
  • FIG. 3 is a message sequence chart depicting steps performed in a method of single sign-on (SSO) collaboration among a plurality of mobile devices in accordance with another embodiment of the present disclosure.
  • Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions and locations of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of embodiments of the present invention.
  • The system and method components have been represented where appropriate by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the embodiments of the present invention so as not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.
  • DETAILED DESCRIPTION
  • One aspect of this disclosure relates to a system for single sign-on collaboration among a plurality of mobile devices. The term “collaboration” or “SSO collaboration” refers to a type of working cooperation among mobile devices, whereby a user can sign-on, or login, to a first service from a first mobile device, and leverage a set of enhanced identity management procedures to securely access the first service, as well as other services, from the first mobile device, as well as from other mobile devices, without needing to perform additional manual sign-on procedures.
  • The system includes a server operative for issuing a first identity token (as defined below) to subsequently authenticate a user of a first of the mobile devices to a service provider, and for generating and sending a collaboration credential to the first mobile device based on the first identity token and/or user authentication. The first mobile device is operative for sending the collaboration credential generated by the server to a second mobile device paired with the first mobile device. The server is further operative for issuing a second identity token (as defined below) to subsequently authenticate the user of the second mobile device to the service provider based on the collaboration credential received from the first mobile device, to support single sign-on collaboration for the user across the plurality of mobile devices. The collaboration credential can be generated first, and then used by either mobile device to request a respective identity token.
  • Advantageously, the server configures the collaboration credential as a data structure that comprises at least one of an identification of the user, an identification of the first mobile device, an identification of which of the plurality of mobile devices are permitted to collaborate with the first mobile device, and an identification of the conditions under which the collaboration is permitted to be conducted. In one embodiment, the collaboration credential is concatenated with a message authentication data structure, such as a keyed hash, also known as a message authentication code (MAC), or a digital signature. In another embodiment, the collaboration credential is encrypted with a key known only to the server.
  • The server also configures each identity token as a data structure that comprises at least one of an identification of the user and an identification of the mobile device to which the respective identity token is sent. As used herein, the term “data structure” includes a list, string, array, or any complex data structure that includes files or data sets. When the data structure of the collaboration credential is a file, then the file format may be JavaScript Object Notation (JSON), XML, HTML, ASCII, Binary, or any other file format, and the file may be compressed or encrypted, in part or in whole. Computing and concatenating a MAC to a data structure is herein referred to as “MACing”.
  • The server can constitute a single identity management server for issuing each identity token and for generating and verifying the collaboration credential. In a variant construction, the server can constitute an identity management server for issuing each identity token, and a collaboration manager server for generating and verifying the collaboration credential.
  • A method, in accordance with another aspect of this disclosure, of single sign-on collaboration among a plurality of mobile devices, is performed by issuing and sending a first identity token to a first of the mobile devices to subsequently authenticate a user of the first mobile device to a service provider, generating and sending a collaboration credential to the first mobile device based on the first identity token and/or user authentication, pairing the first mobile device with a second mobile device, sending the collaboration credential to the second mobile device, requesting a second identity token based on the collaboration credential, and issuing and sending a second identity token to the second mobile device to subsequently authenticate the user of the second mobile device to the service provider, for supporting single sign-on collaboration for the user across the plurality of mobile devices.
  • Turning now to the drawings, reference numeral 10 in FIG. 1 generally identifies a system for single sign-on collaboration for a user 50 among a plurality of his or her mobile devices, such as, by way of non-limiting example, a personal digital assistant 12, a smartphone 14, a desktop computer 16, a tablet 18, a land mobile radio (LMR) 20, and a laptop computer 22. Other mobile devices, and other device types, that are different from those illustrated are also contemplated by the present disclosure. Each of these mobile devices has one or more network interfaces, which may include one or more radio frequency (RF) transceivers operatively connected to a network 24, for example, the Internet, preferably over a bi-directional wireless link, such as Wi-Fi, which is an open wireless standard for transmission of digital voice and data. The network 24 need not be a single network as illustrated, but could comprise a plurality of networks interconnected by forwarding equipment. The mobile devices 12, 14, 16, 18, 20 and 22 not only communicate over the network 24 with a service provider (SP) 52, but can also wirelessly communicate with one another, for example, via Bluetooth®, which is another open wireless standard for transmission of digital voice and data between devices.
  • In one embodiment, all of the user's mobile devices 12, 14, 16, 18, 20 and 22 can communicate directly with each other. In another embodiment, some of the user's mobile devices may have to communicate with each other via one or more of the user's other mobile devices. In one embodiment, all of the user's mobile devices have the same wireless interface, such as Bluetooth®. In another embodiment, some of the user's mobile devices have one wireless interface, such as Bluetooth®; others of the mobile devices have another wireless interface, such as Wi-Fi; and still others of the mobile devices have both, or other interfaces.
  • The system 10 includes a server 30, which comprises either a single identity management server (IdM) 26, as described below in connection with FIG. 2, or the IdM 26 in combination with a collaboration manager server (CM) 28, as described below in connection with FIG. 3. The server 30 is operatively connected to the network 24 over a bi-directional link, which may be wired or wireless, and interacts with one or more of the devices 12, 14, 16, 18, 20 and 22, as described in detail below. Each server comprises one or more processes running on one or more computers.
  • Each of the server 30 and the mobile devices 12, 14, 16, 18, 20 and 22 includes a processor, such as one or more microprocessors, microcontrollers, digital signal processors (DSPs), combinations thereof or such other devices known to those having ordinary skill in the art. The particular operations/functions of the processor, and respectively thus of the server and mobile devices, is determined by an execution of software instructions and routines that are stored in a respective at least one memory device associated with the processor, such as random access memory (RAM), dynamic random access memory (DRAM), and/or read only memory (ROM) or equivalents thereof, that store data and programs that may be executed by the corresponding processor. Further, in the event that the server 30 is implement as both the IdM 26 and the CM 28, each of the IdM and the CM includes a processor whose particular operations/functions, and respectively thus of the server, is determined by an execution of software instructions and routines that are stored in a respective at least one memory device associated with the processor. Unless otherwise specified herein, the functionality described herein as being performed by the server(s) and mobile devices is implemented with or in software programs and instructions stored in the respective at least one memory device of the server(s) and mobile devices and executed by the associated processor of the server(s) and mobile devices.
  • Turning now to the message sequence chart of FIG. 2, across the top of the chart, any one of the aforementioned mobile devices 12, 14, 16, 18, 20 and 22 is depicted, and hereinafter referred to, as device 1, and any other of the aforementioned mobile devices 12, 14, 16, 18, 20 and 22 is depicted, and hereinafter referred to, as device 2. It will be appreciated that the devices 1 and 2 may be of different types, or may be of the same type, e.g., both devices 1 and 2 may be smartphones. Also shown, across the top of the chart, is the IdM 26 and the SP 52, e.g., a host for hosting services and applications that are provided over the network 24. The timed sequence in which various actions are performed is shown as one proceeds down away from the top of the chart.
  • Initially, the user 50 of device 1 (box 100) is not logged into the SP 52, and the user 50 of device 2 (box 102) is not logged into the SP 52. Thereupon, the user 50 of the device 1 first establishes a secure connection or “tunnel” between the device 1 and the IdM 26 (see message 104), and then authenticates himself or herself to the IdM 26. The user 50 inputs into the device 1, and the device conveys to IdM 26, identity information, for example, a user name and a user password, and, optionally, some other data, such as what other devices or types of devices to which the user 50 wants to gain access, or the conditions under which such access is to be permitted or denied.
  • In one embodiment, rather than explicitly entering the other devices or device types, or the conditions under which access is to be permitted, the user 50 could instead input to the device 1, and the device conveys to IdM 26, an indication of what actions the user 50 intends to perform, or what services/applications the user 50 intends to use. In another embodiment, data, such as the devices, the types of devices, the actions or the services/applications, is not entered by the user 50, but instead, is automatically generated by the device 1 and is sent to the server 30. In response to receiving the identity information from device 1, the IdM 26 issues a first data structure (see box 106) or first identity token 1 (as defined below) and sends the first identity token 1 to the device 1 to subsequently authenticate the user 50 of the device 1 to the SP 52 (see message 108).
  • In one embodiment, the device 1 next requests from the IdM 26 a collaboration credential based on the first identity token 1 and/or user authentication (see message 110) and that is sharable among two or more of mobile devices 12, 14, 16, 18, 20 and 22, and more particularly between device 1 and device 2. For example, in response to receiving the first identity token 1, device 1 may convey, to the IdM 26, a collaboration request that is associated with the first identity token 1, for example, that includes the first identity token 1 or a value associated with the first identity token 1, such as a value derived from the first identity token 1, or where the collaboration request is secured by the first identity token, or transmitted over a link secured with the first identity token, or transited by a device which uses the first identity token to establish a secure communications session. This request can be performed automatically or manually. In response to receiving the request, the IdM 26 generates the collaboration credential (see box 112) as a data structure, and sends the collaboration credential to the device 1 (see message 114). In another embodiment, rather than sending the first identity token 1 and the collaboration credential as independent actions, the IdM 26 may send the collaboration credential to device 1 simultaneously with the first identity token 1, for example, in a same message, in response to authenticating the user of device 1.
  • In one embodiment, the collaboration credential is a Kerberos data structure or ticket containing, by way of non-limiting example, one or more of a user identification, a session identification, a collaboration device identification(s), other collaboration device description(s), an expiration time, and other usage constraints. In another embodiment, the collaboration credential is an OAuth token, a SAML token, a JSON Web Token (JWT), or another type of identity token. In one embodiment, the collaboration credential is a data structure that contains information used to bind multiple devices to a single user 50, or to bind multiple devices to a single purpose, or to bind the user 50 to a device, or to bind a device to one or more other devices, or to bind at least one device to a user group. The device 1 now knows which of the plurality of mobile devices 12, 14, 16, 18, 20 and 22 are permitted to collaborate with the device 1, and also knows the conditions under which such collaboration is permitted to be conducted.
  • By way of non-limiting example, the device 1 might be instructed by the collaboration credential to collaborate with only one other device, such as the user's desktop computer 16, or to only collaborate with another device for a set period of time, or to only collaborate using certain applications hosted by the SP 52, or to collaborate only with mobile devices with which it is able to perform certificate-based authentication, etc. The data contained in the collaboration credential may have been supplied by the user 50, or by the device 1, during identification/authentication as described above, or may have been entered into a database of the server 30 beforehand. In one embodiment, the data provided by the user 50 may be used in conjunction with data in the aforementioned database to determine the conditions under which collaboration is permitted.
  • Next, a transport layer security (TLS) session is established between the device 1 and the SP 52 (see message 116). Cryptographic protocols, other than TLS, such as Internet Protocol Security (IPsec), Secure Sockets Layer (SSL), Secure Shell (SSH), and like cryptographic protocols that provide communication security over the Internet, could also be employed. Alternatively, no cryptographic protocol between the device 1 and the SP 52 could be used. The device 1 requests service based on the first identity token 1 (see message 118). In response, the SP 52 activates the service and/or associated application and allows device 1 access to the service/application (see message 120). The user 50 is now authenticated and logged into the SP 52 (see box 122).
  • When collaboration with another device, that is, the device 2, is desired, the devices 1 and 2 must establish a security association between each other. When such collaborating devices form such a security association, they are said to be paired. If Bluetooth® is employed, then pairing occurs when two Bluetooth® devices agree to communicate with each other and establish a secure connection. In some cases, Bluetooth® can provide the needed security association, and in other cases a higher communication layer can provide the needed security association. In some cases, a shared secret, also sometimes referred to as a passkey or a personal identification number (PIN), is exchanged between the two devices 1 and 2. Alternatively, the devices 1 and 2 can each derive a shared secret without directly exchanging the value of the shared secret between each other, such as is provided by the well known Diffie-Hellman algorithm.
  • A passkey is a code shared by both devices 1 and 2, which proves that both devices have agreed to pair with each other. Once paired (see message 124), the device 1 is operative for sending the collaboration credential (see box 126) generated by the server 30 to the device 2 (see message 128). The pairing need not be performed immediately prior to the sharing of the collaboration credential, but could be performed beforehand. It will be appreciated by those skilled in the art that once a security association exists between devices, data can be sent securely between the devices using the security association.
  • In one embodiment the security association used for collaborative pairing is established through the use of certificate-based authentication. Where the collaborating devices exchange digital certificates, such as standard X.509 certificates, public key cryptographic methods, such as those described by the TLS standard, are used to establish the necessary security association. In one embodiment, attributes in the exchanged certificates can be used determine the applicability of SSO collaboration for the device presenting the certificate.
  • In one embodiment, the device 1 sends a collaboration notification (see message 125) to the server 30 to indicate that it has sent, or will send, the collaboration credential to the device 2. The collaboration notification is a message, file or data structure, which identifies the device 1 as the source of the collaboration credential, and identifies the device 2 as the recipient of the collaboration credential. The collaboration notification may further contain scoping assertions about the intended use of the collaboration credential. For example, the scoping assertions may indicate that the collaboration credential may only be used for services specifically identified in the collaboration notification. In one embodiment, the collaboration notification may be sent to the device 2 by the device 1, after which the device 2 forwards the collaboration notification to the server 30.
  • Next, a TLS session is established between the device 2 and the IdM 26 (see message 130). The device 2 next requests a second data structure or second identity token 2 (as defined below) based on the collaboration credential (see message 132). In response, the IdM 26 verifies the collaboration credential (see box 134), and issues and sends to device 2 the second identity token 2 (see message 136), which second identity token subsequently is used to authenticate the user of the device 2 to the SP 52. In one embodiment, when the IdM 26 verifies the collaboration credential, the IdM 26 will compare the identity of the device from which it received the collaboration credential (i.e., the device 2) with any collaboration notification received from the device 1. In one embodiment, the second identity token 2 identifies the same user 50 as the first identity token 1. The collaboration credential can be generated first, and then used by either mobile device 1 or 2 to request a respective identity token 1 or 2.
  • Next, a TLS session is established between the device 2 and the SP 52 (see message 138). The device 2 requests service based on the second identity token 2 and/or user authentication (see message 140). In response, the SP 52 activates the service/application and allows device 2 access to the service/application (see message 142), thereby enabling single sign-on collaboration for the user 50 across the devices 1 and 2. The user 50 is now authenticated and logged into the SP 52 (see box 144). If additional collaboration is required for an additional one of the aforementioned devices 12, 14, 16, 18, 20 and 22, then the above-described process is repeated. It will be noted that the identity tokens 1 and 2 are not shared; only the collaboration credential is passed between the devices 1 and 2.
  • FIG. 3 is analogous to FIG. 2, except that the SP 52 has been omitted for ease of illustration, and, instead of the server 30 just constituting the IdM 26, the server 30 now comprises the IdM 26 and the CM 28. This embodiment allows the potential re-use of a commercial-off-the-shelf (COTS) IdM 26. In brief, the IdM 26 still issues identity tokens, as described above, but now the CM 28 generates and verifies the collaboration credential.
  • As shown in FIG. 3, the user 50 of device 1 (box 200) is not logged into the SP 52, and the user 50 of device 2 (box 202) is not logged into the SP 52. The user 50 then logs into the device 1 (box 204), and establishes a secure connection or “tunnel” between the device 1 and the IdM 26 as described with respect to FIG. 2. The user 50 then enters the user's identification data into device 1 and the device conveys the identification data as described with respect to FIG. 2 to the IdM 26 (see message 206). In response to receiving the identification data, the IdM 26 issues the first identity token 1 (see box 208) and sends the first identity token 1 to the device 1 (see message 210) for use in subsequently authenticatating the user 50 of the device 1 to the SP 52.
  • The device 1 next requests, from the CM 28, the collaboration credential based on the first identity token 1 and/or user authentication (see message 212). The CM 28 verifies the first identity token 1 (see message 214) after which the CM 28 generates the collaboration credential (see box 214) and sends the collaboration credential to the device 1 (see message 218). Verifying the first identity token 1 by the CM 28 may involve performing MAC or signature verification, or may require an explicit request to the IdM 26. The user 50 is now able to log into, and be authenticated to, the SP 52 via the device 1 (see box 220).
  • The devices 1 and 2 are paired (see message 222), as described with respect to FIG. 2, after which the device 1 (see box 224) is operative for sending the collaboration credential to the device 2 (see message 226). Next, a secure tunnel is established between the device 2 and the CM 28 (see message 228). The device 2 next requests, from the CM 28, the second identity token 2 based on the collaboration credential (see message 230). In response, the CM 28 verifies the collaboration credential (see box 232), and sends the request for the second identity token 2 to the IdM 26 (see message 234). In response to receiving the request from the CM, the IdM 26 issues the second identity token 2 (see box 236) and sends the second identity token 2 to the CM 28 (see message 238), which, in turn, sends the second identity token 2 to the device 2 (see message 240) for use in subsequently authenticating the user 50 of the device 2 to the SP 52. The same user 50 is now able to be logged into, and be authenticated to, the SP 52 via the device 2 (see box 242).
  • In a preferred embodiment, rather than having the device 2 request the second identity token 2 from the CM 28, the device 2 can directly request the identity token 2 from the IdM 26. Also, rather than having the IdM 26 send the second identity token 2 to the CM 28, the IdM 26 can directly send the second identity token 2 to the device 2. Further, in the preferred embodiment, the identity token is an OAuth token, and the collaboration credential is an OAuth Request with a grant type equal to a SAML assertion or a JWT assertion.
  • As described so far, the collaboration credential is the same for all the devices. It is also contemplated that different collaboration credentials could be used for different sets of the devices. For example, one collaboration credential can be used by the device 1 to enable SSO collaboration with other devices, and a separate collaboration credential can be used by device 2 to collaborate with other devices. Alternatively, one collaboration credential may be constrained to a specific application, a set of applications, a device type, a device assurance level, a collaborative network type (personal area network, vehicular area network, etc.), or to any other device, user, or network attribute. The collaboration credential can be generated first, and then used by either mobile device to request a respective identity token.
  • Throughout this specification, the term “identity token” is used to refer to a syntactical structure that communicates information about the user 50. Types of information often communicated within an identity token include: a unique identifier for the user 50, a unique identifier of the server 30 which issued the identity token, an expiration time after which the identity token may no longer be used, the time at which the identity token was issued, and a primary authentication context reference specifying the time at which the user authenticated themselves in order to obtain the identity token and the method of authentication they used (passwords and RSA passcodes are two examples).
  • Identity tokens may also contain other relevant attributes about the user 50, such as his or her agency of employment, roles within his or her agency, special skills, or identifying facial attributes. This list is meant to be exemplary of a typical identity token, and non-binding, as many other attributes might be included as well. Identity tokens may be either digitally signed by the token issuer, or may alternatively require a secure connection between the consumer of the identity token (often referred to as the relying party, service provider, or resource server) and the identity token issuer.
  • Identity tokens are also known by other names within industry and standards. In the SAML 2.0 protocol, identity tokens may be referred to as SAML assertions, or simply, identity assertions. In OAuth, identity tokens are referred to as access tokens, and in OpenID Connect, identity tokens may be referred to as id tokens. Other identity tokens are intended for usage strictly between the user and the token issuing server, and these are often referred to as session tokens. In OAuth, a refresh token could be thought of as but one example of a session token.
  • In the foregoing specification, specific embodiments have been described. However, one of ordinary skill in the art appreciates that various modifications and changes can be made without departing from the scope of the invention as set forth in the claims below. For example, although the TLS protocol has been described and illustrated herein, other cryptographic protocols, such as Internet Protocol Security (IPsec), Secure Sockets Layer (SSL), Secure Shell (SSH), and like cryptographic protocols that provide communication security over the Internet, could be employed. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of present teachings.
  • The benefits, advantages, solutions to problems, and any element(s) that may cause any benefit, advantage, or solution to occur or become more pronounced are not to be construed as a critical, required, or essential features or elements of any or all the claims. The invention is defined solely by the appended claims including any amendments made during the pendency of this application and all equivalents of those claims as issued.
  • Moreover in this document, relational terms such as first and second, top and bottom, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms “comprises,” “comprising,” “has,” “having,” “includes,” “including,” “contains,” “containing,” or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises, has, includes, contains a list of elements does not include only those elements, but may include other elements not expressly listed or inherent to such process, method, article, or system. An element proceeded by “comprises . . . a,” “has . . . a,” “includes . . . a,” or “contains . . . a,” does not, without more constraints, preclude the existence of additional identical elements in the process, method, article, or system that comprises, has, includes, or contains the element. The terms “a” and “an” are defined as one or more unless explicitly stated otherwise herein. The terms “substantially,” “essentially,” “approximately,” “about,” or any other version thereof, are defined as being close to as understood by one of ordinary skill in the art, and in one non-limiting embodiment the term is defined to be within 10%, in another embodiment within 5%, in another embodiment within 1%, and in another embodiment within 0.5%. The term “coupled” as used herein is defined as connected, although not necessarily directly and not necessarily mechanically. A device or structure that is “configured” in a certain way is configured in at least that way, but may also be configured in ways that are not listed.
  • It will be appreciated that some embodiments may be comprised of one or more generic or specialized processors (or “processing devices”) such as microprocessors, digital signal processors, customized processors, and field programmable gate arrays (FPGAs), and unique stored program instructions (including both software and firmware) that control the one or more processors to implement, in conjunction with certain non-processor circuits, some, most, or all of the functions of the method and/or system described herein. Alternatively, some or all functions could be implemented by a state machine that has no stored program instructions, or in one or more application specific integrated circuits (ASICs), in which each function or some combinations of certain of the functions are implemented as custom logic. Of course, a combination of the two approaches could be used.
  • Moreover, an embodiment can be implemented as a computer-readable storage medium having computer readable code stored thereon for programming a computer (e.g., comprising a processor) to perform a method as described and claimed herein. Examples of such computer-readable storage mediums include, but are not limited to, a hard disk, a CD-ROM, an optical storage device, a magnetic storage device, a ROM (Read Only Memory), a PROM (Programmable Read Only Memory), an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read Only Memory) and a Flash memory. Further, it is expected that one of ordinary skill, notwithstanding possibly significant effort and many design choices motivated by, for example, available time, current technology, and economic considerations, when guided by the concepts and principles disclosed herein, will be readily capable of generating such software instructions and programs and ICs with minimal experimentation.
  • The Abstract of the Disclosure is provided to allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in various embodiments for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separately claimed subject matter.

Claims (25)

1. An apparatus for enabling a user of a first mobile device to extend user authentication credentials to a second mobile device, the apparatus comprising:
a server having a processor that is configured to:
issue and send a first identity token to the first mobile device, wherein the first identity token can be utilized to authenticate the user of the first mobile device to a service provider;
generate a collaboration credential, wherein generation of the collaboration credential is based on one or more of user authentication and receipt of a collaboration request associated with the first identity token and wherein the collaboration credential is sharable among a plurality of mobile devices;
send the collaboration credential to the first mobile device;
receive the collaboration credential from the second mobile device;
verify the collaboration credential received from the second mobile device; and
in response to verifying the collaboration credential received from the second mobile device, issue and send a second identity token to the second mobile device, wherein the second identity token can be utilized to authenticate the second mobile device to the service provider.
2. The apparatus of claim 1, wherein the processor is configured to receive the collaboration request from the first mobile device and wherein the processor is configured to generate the collaboration credential in response to receiving the collaboration request.
3. The apparatus of claim 1, further comprising the first mobile device, wherein the first mobile device is configured to:
receive the first identity token and the collaboration credential from the server; and
send the collaboration credential to the second mobile device.
4. The apparatus of claim 3, further comprising the second mobile device, wherein the second mobile device is configured to:
receive the collaboration credential from the first mobile device;
send the collaboration credential to the server; and
in response to sending the collaboration credential, receive the second identity token.
5. The apparatus of claim 1, wherein the processor further is configured to receive the collaboration credential from a third mobile device and, in response to receiving the collaboration credential from the third mobile device, issue and send a third identity token to the third mobile device, wherein the third identity token can be utilized to authenticate the user of the third mobile device to the service provider.
6. The apparatus of claim 1, wherein the processor further is configured to receive, from the first mobile device and in response to sending the collaboration credential to the first mobile device, a collaboration notification that identifies the first mobile device as a source of the collaboration credential and identifies the second mobile device as a recipient of the collaboration credential.
7. The apparatus of claim 1, wherein the processor further is configured to configure the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first mobile device, an identification of which of a plurality of mobile devices are permitted to collaborate with the first mobile device, and an identification of the conditions under which the collaboration is permitted to be conducted.
8. The apparatus of claim 1, wherein the processor further is configured to configure each identity token as a data structure comprising at least one of an identification of the user and an identification of the mobile device to which the respective identity token is sent.
9. The apparatus of claim 1, wherein the server comprises an identity management server that is configured to issue each identity token and generate and verify the collaboration credential.
10. The apparatus of claim 1, wherein the server comprises:
an identity management server that is configured to issue each identity token; and
a collaboration manager server that is configured to generate and verify the collaboration credential.
11. A method for enabling a user of a first mobile device to extend user authentication credentials to a second mobile device, the method comprising:
issuing and sending a first identity token to the first mobile device, wherein the first identity token can be utilized to authenticate the user of the first mobile device to a service provider;
generating a collaboration credential, wherein generation of the collaboration credential is based on one or more of user authentication and receipt of a collaboration request associated with the first identity token and wherein the collaboration credential is sharable among a plurality of mobile devices;
sending the collaboration credential to the first mobile device;
receiving the collaboration credential from the second mobile device;
verifying the collaboration credential received from the second mobile device; and
in response to verifying the collaboration credential received from the second mobile device, issuing and sending a second identity token to the second mobile device, wherein the second identity token can be utilized to authenticate the second mobile device to the service provider.
12. The method of claim 11, wherein the method further comprises receiving the collaboration request from the first mobile device and wherein generating the collaboration credential comprises generating the collaboration credential in response to receiving the collaboration request.
13. The method of claim 11, further comprising:
receiving, by the first mobile device, the first identity token and the collaboration credential from the server; and
sending, by the first mobile device, the collaboration credential to the second mobile device.
14. The method of claim 13, further comprising:
receiving, by the second mobile device, the collaboration credential from the first mobile device;
sending, by the second mobile device to the server, the collaboration credential; and
in response to sending the collaboration credential, receiving, by the second mobile device, the second identity token.
15. The method of claim 11, further comprising:
receiving the collaboration credential from the third mobile device; and
in response to receiving the collaboration credential from the third mobile device, issuing and sending a third identity token to the third mobile device, wherein the third identity token can be utilized to authenticate the user of the third mobile device to the service provider.
16. The method of claim 11, further comprising, in response to sending the collaboration credential to the first mobile device, receiving a collaboration notification that identifies the first mobile device as a source of the collaboration credential and identifies the second mobile device as a recipient of the collaboration credential.
17. The method of claim 11, further comprising configuring the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first mobile device, an identification of which of a plurality of mobile devices are permitted to collaborate with the first mobile device, and an identification of the conditions under which the collaboration is permitted to be conducted.
18. The method of claim 11, further comprising configuring each identity token as a data structure comprising at least one of an identification of the user and an identification of the mobile device to which the respective identity token is sent.
19. An apparatus for enabling single sign-on collaboration among a plurality of mobile devices, the apparatus comprising:
a mobile device comprising a processor that is configured to:
receive each of a first identity token and a collaboration credential from a server, wherein the first identity token can be utilized to authenticate a user of the mobile device to a service provider and wherein the collaboration credential is sharable among a plurality of mobile devices and may be utilized to provide an identity token to each mobile device of the plurality of mobile devices; and
send the collaboration credential to another mobile device.
20. The apparatus of claim 19, wherein the processor is configured to receive the collaboration credential by sending a collaboration request to the server, wherein the collaboration request is associated with the first identity token, and, in response to sending the collaboration request, receive the collaboration credential.
21. The apparatus of claim 19, wherein the mobile device is a first mobile device and wherein the apparatus further comprises a second mobile device that is configured to:
receive the collaboration credential from the first mobile device;
send the collaboration credential to the server; and
in response to sending the collaboration credential, receive the second identity token from the server, wherein the second identity token can be utilized to authenticate the user of the second mobile device to the service provider.
22. The apparatus of claim 19, wherein the processor further is configured to, in response to receiving the collaboration credential, send a collaboration notification to the server, wherein the collaboration notification identifies the mobile device as a source of the collaboration credential and identifies the another mobile device as a recipient of the collaboration credential.
23. A method for enabling single sign-on collaboration among a plurality of mobile devices, the method comprising:
receiving, by a mobile device of the plurality of communication devices, each of a first identity token and a collaboration credential from a server, wherein the first identity token can be utilized to authenticate a user of the mobile device to a service provider and wherein the collaboration credential is sharable among a plurality of mobile devices and may be utilized to provide an identity token to each mobile device of the plurality of mobile devices; and
sending, by the mobile device, the collaboration credential to another mobile device of the plurality of mobile devices.
24. The method of claim 23, wherein receiving the collaboration credential comprises:
sending a collaboration request to the server, wherein the collaboration request is associated with the first identity token; and
in response to sending the collaboration request, receiving the collaboration credential.
25. The method of claim 23, wherein the method further comprises, in response to receiving, by the mobile device, the collaboration credential, sending a collaboration notification to the server, wherein the collaboration notification identifies the mobile device as a source of the collaboration credential and identifies the another mobile device as a recipient of the collaboration credential.
US13/728,422 2012-12-27 2012-12-27 Method and apparatus for single sign-on collaboration among mobile devices Active 2033-02-07 US8782766B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US13/728,422 US8782766B1 (en) 2012-12-27 2012-12-27 Method and apparatus for single sign-on collaboration among mobile devices

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US13/728,422 US8782766B1 (en) 2012-12-27 2012-12-27 Method and apparatus for single sign-on collaboration among mobile devices
EP13803394.9A EP2939386B1 (en) 2012-12-27 2013-11-26 Method and apparatus for single sign-on collaboration among mobile devices
PCT/US2013/071850 WO2014105338A1 (en) 2012-12-27 2013-11-26 Method and apparatus for single sign-on collaboration among mobile devices
AU2013368370A AU2013368370B2 (en) 2012-12-27 2013-11-26 Method and apparatus for single sign-on collaboration among mobile devices
CA2896169A CA2896169C (en) 2012-12-27 2013-11-26 Method and apparatus for single sign-on collaboration among mobile devices

Publications (2)

Publication Number Publication Date
US20140189840A1 true US20140189840A1 (en) 2014-07-03
US8782766B1 US8782766B1 (en) 2014-07-15

Family

ID=49759604

Family Applications (1)

Application Number Title Priority Date Filing Date
US13/728,422 Active 2033-02-07 US8782766B1 (en) 2012-12-27 2012-12-27 Method and apparatus for single sign-on collaboration among mobile devices

Country Status (5)

Country Link
US (1) US8782766B1 (en)
EP (1) EP2939386B1 (en)
AU (1) AU2013368370B2 (en)
CA (1) CA2896169C (en)
WO (1) WO2014105338A1 (en)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140310173A1 (en) * 2013-04-11 2014-10-16 Ryan Caldwell Syncing two separate authentication channels to the same account or data using a token or the like
US9277407B2 (en) 2010-03-29 2016-03-01 Motorola Solutions, Inc. Methods for authentication using near-field
US9426183B2 (en) 2013-07-28 2016-08-23 Acceptto Corporation Authentication policy orchestration for a user device
US20160294842A1 (en) * 2013-07-03 2016-10-06 Amazon Technologies, Inc. Bootstrapping user authentication on devices
US9503444B2 (en) * 2015-02-20 2016-11-22 International Business Machines Corporation System and method for sharing access to a service within a home network
EP3142326A1 (en) * 2015-09-11 2017-03-15 Comcast Cable Communications, LLC Embedded authentication in a service provider network
WO2017074822A1 (en) * 2015-10-29 2017-05-04 Microsoft Technology Licensing, Llc Resolving authenticating issues with a second device
WO2017079523A1 (en) * 2015-11-06 2017-05-11 Nasdaq, Inc. Systems and methods for controlling sign-on to web applications
US10325259B1 (en) 2014-03-29 2019-06-18 Acceptto Corporation Dynamic authorization with adaptive levels of assurance
US10387980B1 (en) 2015-06-05 2019-08-20 Acceptto Corporation Method and system for consumer based access control for identity information
US10397222B2 (en) * 2014-10-03 2019-08-27 Gopro, Inc. Authenticating a limited input device via an authenticated application
US10404678B2 (en) * 2014-02-26 2019-09-03 Secureauth Corporation Security object creation, validation, and assertion for single sign on authentication
US10461942B1 (en) * 2016-07-20 2019-10-29 United Services Automobile Association Multi-factor authentication with code rotation

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9992021B1 (en) 2013-03-14 2018-06-05 GoTenna, Inc. System and method for private and point-to-point communication between computing devices
US9332433B1 (en) * 2013-09-30 2016-05-03 Emc Corporation Distributing access and identification tokens in a mobile environment
US10142378B2 (en) * 2014-01-30 2018-11-27 Symantec Corporation Virtual identity of a user based on disparate identity services
US9853971B2 (en) * 2015-03-30 2017-12-26 Vmware, Inc. Proximity based authentication using bluetooth
US9730001B2 (en) 2015-03-30 2017-08-08 Vmware, Inc. Proximity based authentication using bluetooth

Family Cites Families (87)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6421768B1 (en) * 1999-05-04 2002-07-16 First Data Corporation Method and system for authentication and single sign on using cryptographically assured cookies in a distributed computer environment
US6704542B2 (en) 1999-06-25 2004-03-09 Cocomo Mb Communications, Inc. Hub and probe system and method
US6760758B1 (en) * 1999-08-31 2004-07-06 Qwest Communications International, Inc. System and method for coordinating network access
DE10012057A1 (en) 2000-03-14 2001-09-20 Bosch Gmbh Robert Identification/authentication data transfer method for connecting mobile telephone to radio network, involves establishing wireless short range communication between mobile telephones
US6876643B1 (en) 2000-08-08 2005-04-05 International Business Machines Corporation Clustering in wireless ad hoc networks
TW498168B (en) 2000-09-07 2002-08-11 Savi Techn Inc Method and apparatus for tracking devices using tags
US7181015B2 (en) 2001-07-31 2007-02-20 Mcafee, Inc. Method and apparatus for cryptographic key establishment using an identity based symmetric keying technique
US7987501B2 (en) * 2001-12-04 2011-07-26 Jpmorgan Chase Bank, N.A. System and method for single session sign-on
US20030159072A1 (en) 2002-02-04 2003-08-21 Atreus Systems Corp. Single sign-on for multiple network -based services
US20050198204A1 (en) 2002-04-25 2005-09-08 Kohichi Takahashi Collaboration server, collaboration system, and session management method
US7899915B2 (en) 2002-05-10 2011-03-01 Richard Reisman Method and apparatus for browsing using multiple coordinated device sets
US20040097217A1 (en) 2002-08-06 2004-05-20 Mcclain Fred System and method for providing authentication and authorization utilizing a personal wireless communication device
US7185199B2 (en) 2002-08-30 2007-02-27 Xerox Corporation Apparatus and methods for providing secured communication
US7788711B1 (en) * 2003-10-09 2010-08-31 Oracle America, Inc. Method and system for transferring identity assertion information between trusted partner sites in a network using artifacts
EP1533971A1 (en) 2003-11-18 2005-05-25 STMicroelectronics S.r.l. Method and system for establishing secure communication
US7672255B2 (en) 2004-04-05 2010-03-02 Oomble, Inc. Mobile instant messaging conferencing method and system
US20050221813A1 (en) 2004-04-05 2005-10-06 Jarno Rajahalme System and method for initiating auxiliary communication interfaces via a primary communication interface
US7817606B2 (en) 2004-04-05 2010-10-19 Daniel J. LIN Method for establishing network connections between stationary terminals and remote devices through mobile devices
US20050266826A1 (en) 2004-06-01 2005-12-01 Nokia Corporation Method for establishing a security association between a wireless access point and a wireless node in a UPnP environment
DE102004027311B4 (en) 2004-06-04 2016-02-11 Giesecke & Devrient Gmbh telecommunications system
EP1635508A1 (en) 2004-09-08 2006-03-15 Philips Electronics N.V. Secure pairing for wireless communications devices
US20060075230A1 (en) * 2004-10-05 2006-04-06 Baird Leemon C Iii Apparatus and method for authenticating access to a network resource using multiple shared devices
FI118501B (en) 2004-12-21 2007-11-30 Teliasonera Ab Improving the use of telecommunications services
US8015116B2 (en) 2005-01-21 2011-09-06 Newport Scientific Research Llc Methods for authentication
US20060185004A1 (en) * 2005-02-11 2006-08-17 Samsung Electronics Co., Ltd. Method and system for single sign-on in a network
CN101218559A (en) * 2005-05-06 2008-07-09 弗里塞恩公司 Token sharing system and method
US7925022B2 (en) 2005-05-23 2011-04-12 The Invention Science Fund I, Llc Device pairing via device to device contact
US20060293028A1 (en) 2005-06-27 2006-12-28 Gadamsetty Uma M Techniques to manage network authentication
US20070019616A1 (en) 2005-06-29 2007-01-25 Olli Rantapuska Group formation using mobile computing devices
US20070022301A1 (en) 2005-07-19 2007-01-25 Intelligent Voice Research, Llc System and method for highly reliable multi-factor authentication
US8090945B2 (en) 2005-09-16 2012-01-03 Tara Chand Singhal Systems and methods for multi-factor remote user authentication
FR2891677A1 (en) 2005-10-05 2007-04-06 France Telecom User e.g. employee, authenticating method for accessing service e.g. product, involves verifying that identity level relative to user`s earlier authentication is stored with identity provider, and granting access authorization to user
WO2007045937A1 (en) 2005-10-18 2007-04-26 Nokia Corporation Security in wireless environments using out-of-band channel communication
US8154386B2 (en) 2005-11-03 2012-04-10 Lg Innotek Co., Ltd. RFID reader and RFID system
EP1802155A1 (en) 2005-12-21 2007-06-27 Cronto Limited System and method for dynamic multifactor authentication
CN101371530B (en) 2006-01-18 2017-08-29 皇家飞利浦电子股份有限公司 The automatic and safe configuration of wireless medical networks
US8041339B2 (en) 2006-01-31 2011-10-18 Alcatel Lucent Method for secure authentication of mobile devices
KR100800733B1 (en) 2006-02-08 2008-02-01 삼성전자주식회사 Bluetooth system and bluetooth bonding process method
US7612675B2 (en) 2006-02-14 2009-11-03 Miller Ronald N RFID—sensor system for lateral discrimination
US20070203850A1 (en) 2006-02-15 2007-08-30 Sapphire Mobile Systems, Inc. Multifactor authentication system
EP1997292B1 (en) 2006-03-20 2018-11-07 British Telecommunications public limited company Establishing communications
US20070264976A1 (en) 2006-03-30 2007-11-15 Sony Ericsson Mobile Communication Ab Portable device with short range communication function
US20070236586A1 (en) 2006-04-05 2007-10-11 Ryckman Lawrence G Performance-driven promotional super network with recording booth nexus
US20070254709A1 (en) 2006-04-28 2007-11-01 Motorola, Inc. Method and system for unambiguous accessory association
EP1865656A1 (en) 2006-06-08 2007-12-12 BRITISH TELECOMMUNICATIONS public limited company Provision of secure communications connection using third party authentication
CN101584178A (en) 2006-08-15 2009-11-18 Nxp股份有限公司 Device with an EEPROM having both a near field communication interface and a second interface
US7737383B2 (en) 2006-08-25 2010-06-15 Thermal Dynamics Corporation Contoured shield orifice for a plasma arc torch
US8327427B2 (en) * 2006-09-25 2012-12-04 Rockstar Consortium Us Lp System and method for transparent single sign-on
US8365258B2 (en) 2006-11-16 2013-01-29 Phonefactor, Inc. Multi factor authentication
US8201231B2 (en) 2007-02-21 2012-06-12 Microsoft Corporation Authenticated credential-based multi-tenant access to a service
US8522019B2 (en) 2007-02-23 2013-08-27 Qualcomm Incorporated Method and apparatus to create trust domains based on proximity
US20080268776A1 (en) 2007-04-25 2008-10-30 General Instrument Corporation Method and Apparatus for Secure Pairing of Bluetooth Devices
US8078787B2 (en) 2007-06-22 2011-12-13 Apple Inc. Communication between a host device and an accessory via an intermediate device
US8321508B2 (en) 2007-09-25 2012-11-27 International Business Machines Corporation Controlling collaboration participation
US7970350B2 (en) 2007-10-31 2011-06-28 Motorola Mobility, Inc. Devices and methods for content sharing
US20090132813A1 (en) 2007-11-08 2009-05-21 Suridx, Inc. Apparatus and Methods for Providing Scalable, Dynamic, Individualized Credential Services Using Mobile Telephones
US20100281261A1 (en) 2007-11-21 2010-11-04 Nxp B.V. Device and method for near field communications using audio transducers
EP2068597A1 (en) 2007-12-07 2009-06-10 Gemalto SA A method for loading credentials into a mobile communication device such as a mobile phone.
DE102008007085A1 (en) 2008-01-31 2009-08-06 T-Mobile Internationale Ag Method for managing the authorization of mobile phones without a SIM card
US20090202079A1 (en) 2008-02-11 2009-08-13 Nokia Corporation Method, apparatus and computer program product for providing mobile broadcast service protection
WO2009104131A1 (en) 2008-02-19 2009-08-27 Nxp B.V. System and method for entering a pairing mode without user intervention
US20090217367A1 (en) * 2008-02-25 2009-08-27 Norman James M Sso in volatile session or shared environment
US8220035B1 (en) 2008-02-29 2012-07-10 Adobe Systems Incorporated System and method for trusted embedded user interface for authentication
US9286742B2 (en) 2008-03-31 2016-03-15 Plantronics, Inc. User authentication system and method
WO2009133419A1 (en) 2008-04-28 2009-11-05 Nokia Corporation Method, apparatus, and computer program product for providing a group based decentralized authorization mechanism
US8006291B2 (en) 2008-05-13 2011-08-23 Veritrix, Inc. Multi-channel multi-factor authentication
US20100088390A1 (en) 2008-10-03 2010-04-08 Microsoft Corporation Data sharing proxy for mobile devices
US8838503B2 (en) 2008-12-08 2014-09-16 Ebay Inc. Unified identity verification
US8141134B2 (en) 2009-06-08 2012-03-20 Bank Of America Corporation Authentication engine for enrollment into a computer environment
US20110028091A1 (en) 2009-08-03 2011-02-03 Motorola, Inc. Method and system for near-field wireless device pairing
US8281381B2 (en) 2009-08-03 2012-10-02 Novell, Inc. Techniques for environment single sign on
US20110119743A1 (en) 2009-11-17 2011-05-19 General Instrument Corporation Communication of content to event attendees
CN102656841B (en) * 2009-12-18 2015-07-08 诺基亚公司 Credential transfer
US8228883B2 (en) 2010-01-03 2012-07-24 Mitsubishi Electric Research Labortories, Inc. Method and network for transmitting data in a wireless network with fixed transmission intervals
US8670709B2 (en) 2010-02-26 2014-03-11 Blackberry Limited Near-field communication (NFC) system providing mobile wireless communications device operations based upon timing and sequence of NFC sensor communication and related methods
US8464063B2 (en) 2010-03-10 2013-06-11 Avaya Inc. Trusted group of a plurality of devices with single sign on, secure authentication
US8850196B2 (en) 2010-03-29 2014-09-30 Motorola Solutions, Inc. Methods for authentication using near-field
US8886730B2 (en) 2010-09-22 2014-11-11 Intel Mobile Communications GmbH Methods and devices for authorization in collaborative communications sessions
US8819437B2 (en) 2010-09-30 2014-08-26 Microsoft Corporation Cryptographic device that binds an additional authentication factor to multiple identities
US8825767B2 (en) 2010-10-05 2014-09-02 Sivapathalingham Sivavakeesar Scalable secure wireless interaction enabling methods, system and framework
US8544068B2 (en) 2010-11-10 2013-09-24 International Business Machines Corporation Business pre-permissioning in delegated third party authorization
EP2456245B1 (en) 2010-11-19 2013-09-11 BlackBerry Limited System, devices and method for secure authentication
US8868915B2 (en) 2010-12-06 2014-10-21 Verizon Patent And Licensing Inc. Secure authentication for client application access to protected resources
US9826404B2 (en) 2011-01-11 2017-11-21 Qualcomm Incorporated System and method for peer-to-peer authorization via non-access stratum procedures
US9413750B2 (en) * 2011-02-11 2016-08-09 Oracle International Corporation Facilitating single sign-on (SSO) across multiple browser instance
US8875269B2 (en) * 2011-02-23 2014-10-28 International Business Machines Corporation User initiated and controlled identity federation establishment and revocation mechanism
US20130018975A1 (en) 2011-07-15 2013-01-17 Motorola Solutions, Inc. Low frequency method of pairing a master device to multiple slave devices

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9277407B2 (en) 2010-03-29 2016-03-01 Motorola Solutions, Inc. Methods for authentication using near-field
US9940614B2 (en) * 2013-04-11 2018-04-10 Mx Technologies, Inc. Syncing two separate authentication channels to the same account or data using a token or the like
US20140310173A1 (en) * 2013-04-11 2014-10-16 Ryan Caldwell Syncing two separate authentication channels to the same account or data using a token or the like
US10009355B2 (en) * 2013-07-03 2018-06-26 Amazon Technologies, Inc. Bootstrapping user authentication on devices
US20160294842A1 (en) * 2013-07-03 2016-10-06 Amazon Technologies, Inc. Bootstrapping user authentication on devices
US9426183B2 (en) 2013-07-28 2016-08-23 Acceptto Corporation Authentication policy orchestration for a user device
US10148699B1 (en) 2013-07-28 2018-12-04 Acceptto Corporation Authentication policy orchestration for a user device
US9742809B1 (en) 2013-07-28 2017-08-22 Acceptto Corporation Authentication policy orchestration for a user device
US10404678B2 (en) * 2014-02-26 2019-09-03 Secureauth Corporation Security object creation, validation, and assertion for single sign on authentication
US10325259B1 (en) 2014-03-29 2019-06-18 Acceptto Corporation Dynamic authorization with adaptive levels of assurance
US10397222B2 (en) * 2014-10-03 2019-08-27 Gopro, Inc. Authenticating a limited input device via an authenticated application
US9503444B2 (en) * 2015-02-20 2016-11-22 International Business Machines Corporation System and method for sharing access to a service within a home network
US10387980B1 (en) 2015-06-05 2019-08-20 Acceptto Corporation Method and system for consumer based access control for identity information
EP3142326A1 (en) * 2015-09-11 2017-03-15 Comcast Cable Communications, LLC Embedded authentication in a service provider network
WO2017074822A1 (en) * 2015-10-29 2017-05-04 Microsoft Technology Licensing, Llc Resolving authenticating issues with a second device
US9787654B2 (en) 2015-10-29 2017-10-10 Microsoft Technology Licensing, Llc Resolving authenticating issues with a second device
US9985972B2 (en) 2015-11-06 2018-05-29 Nasdaq, Inc. Systems and methods for controlling sign-on to web applications
WO2017079523A1 (en) * 2015-11-06 2017-05-11 Nasdaq, Inc. Systems and methods for controlling sign-on to web applications
US10412091B2 (en) 2015-11-06 2019-09-10 Nasdaq, Inc. Systems and methods for controlling sign-on to web applications
US10461942B1 (en) * 2016-07-20 2019-10-29 United Services Automobile Association Multi-factor authentication with code rotation

Also Published As

Publication number Publication date
AU2013368370B2 (en) 2015-11-26
CA2896169A1 (en) 2014-07-03
EP2939386A1 (en) 2015-11-04
US8782766B1 (en) 2014-07-15
CA2896169C (en) 2016-11-29
AU2013368370A1 (en) 2015-07-09
EP2939386B1 (en) 2017-02-15
WO2014105338A1 (en) 2014-07-03

Similar Documents

Publication Publication Date Title
US8959652B2 (en) Graduated authentication in an identity management system
ES2308087T3 (en) Management of security links in dynamic networks.
US9300653B1 (en) Delivery of authentication information to a RESTful service using token validation scheme
CA2866500C (en) Secure authentication in a multi-party system
EP2873192B1 (en) Methods and systems for using derived credentials to authenticate a device across multiple platforms
US8689290B2 (en) System and method for securing a credential via user and server verification
US20140095865A1 (en) Exchange of digital certificates in a client-proxy-server network configuration
KR101718824B1 (en) Controlling access
DE112013002656T5 (en) Communication session transmission between devices
US9722972B2 (en) Methods and apparatuses for secure communication
US9386015B2 (en) Security model for industrial devices
US8893251B2 (en) System and method for embedded authentication
JP5683746B2 (en) Key management using pseudo-out-of-band authentication architecture
CN104094270B (en) User certificate is protected for computing device
US7240362B2 (en) Providing identity-related information and preventing man-in-the-middle attacks
US9491175B2 (en) System and method for proxying federated authentication protocols
US9369457B2 (en) Mobile multifactor single-sign-on authentication
CN101978675B (en) System and method for securely issuing subscription credentials to communication devices
US20130173915A1 (en) System and method for secure nework login
US9654463B2 (en) Application specific certificate management
JP4989204B2 (en) System and method for setting temporary and permanent credentials for secure online commerce
US9172544B2 (en) Systems and methods for authentication between networked devices
US20140075513A1 (en) Device token protocol for authorization and persistent authentication shared across applications
US8532620B2 (en) Trusted mobile device based security
CN103535090A (en) System and method for identity management for mobile devices

Legal Events

Date Code Title Description
AS Assignment

Owner name: MOTOROLA SOLUTIONS, INC., ILLINOIS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:METKE, ANTHONY R.;REITSMA, KATRIN;LEWIS, ADAM C.;AND OTHERS;SIGNING DATES FROM 20121212 TO 20121219;REEL/FRAME:029534/0684

STCF Information on status: patent grant

Free format text: PATENTED CASE

CC Certificate of correction
MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551)

Year of fee payment: 4