WO2010119427A2

WO2010119427A2 - Method and system for deployment of software applications to mobile computing devices

Info

Publication number: WO2010119427A2
Application number: PCT/IB2010/051663
Authority: WO
Inventors: Francois. Malan Joubert
Original assignee: Fireid (Proprietary) Limited
Priority date: 2009-04-16
Filing date: 2010-04-16
Publication date: 2010-10-21
Also published as: WO2010119427A3

Abstract

A method and system are disclosed for installing a software application, such as a one-time password application or token, on a mobile computing device. The method includes creating an account for a user on a network, the account having a user name, a user e- mail address and an address of a mobile computing device of the user. The mobile computing device of the user is preferably a mobile telephone, a PDA or another mobile computing device with wireless connectivity. An authentication server generates a Shared Secret, encrypts it using a Secret Key and transmits the encrypted Shared Secret without the Secret Key to a deployment server where it is stored. The deployment server generates a unique deployment URL and transmits it to the authentication server, which transmits a registration invitation message comprising the unique deployment URL to a computer terminal of the user. The user accesses a web page supported by the deployment server to accept the registration invitation. A message containing a unique download URL is then transmitted to the mobile computing device of the user, who sends a confirmatory request to install the software application. Data comprising the software application is transmitted from the deployment server to the mobile computing device of the user, for installation on the mobile computing device of the user.

Description

METHOD AND SYSTEM FOR DEPLOYMENT OF SOFTWARE APPLICATIONS TO MOBILE COMPUTING DEVICES

BACKGROUND OF THE INVENTION

THIS invention relates to a method and system for installing a software application on a mobile computing device.

The use of one time passwords (OTPs) to enhance security in accessing a company network, for example, is well established. The most common way of implementing a system using OTPs is to provide a hardware token to each user, which the user must plug into a terminal such as a PC which is used to access the network. The token contains hardware and software and generates a unique password each time the user accesses the network. The cost and logistics involved in providing each user of such a network with a hardware token are substantial.

In order to address some of the disadvantages of the abovementioned tokens, systems and methods have been developed to deploy software applications, such as a one-time password (OTP) security application, on a mobile computing device. The OTP application enables the mobile computing device to be used as an authentication token, equivalent to a dedicated authentication token as currently used in other systems, to gain access to secure networks.

It is an object of the invention to provide an alternative method and system which can be used for installing a software application, such as a one time password application, on a mobile computing device. SUMMARY OF THE INVENTION

According to the invention there is provided a method of installing a software application on a mobile computing device, the method including:

creating an account for a user on a network, the account having user identification data associated therewith including a user name, a user e-mail address and an address of a mobile computing device of the user;

at an authentication server, generating a Shared Secret using a cryptographically secure pseudo random number generator and encrypting the Shared Secret using a Secret Key;

transmitting the encrypted Shared Secret without the Secret Key from the authentication server to a deployment server;

storing the encrypted Shared Secret at the deployment server;

generating a unique deployment URL at the deployment server and transmitting it to the authentication server;

transmitting a registration invitation message comprising the unique deployment URL from the authentication server to a computer terminal of the user to enable the user to access a web page supported by the deployment server to accept the registration invitation;

transmitting a message containing a unique download URL from the deployment server to the mobile computing device of the user;

at the deployment server, receiving a confirmatory request from the mobile computing device to install the software application; and transmitting data comprising the software application from the deployment server to the mobile computing device of the user, for installation of the software application on the mobile computing device of the user.

The mobile computing device of the user is preferably a mobile telephone, a PDA or another mobile computing device with wireless connectivity.

The software application may be security software, such as a one-time password application or token.

The registration invitation message is preferably sent from the authentication server to the user in the form of an e-mail message transmitted to an e-mail address of the user.

The invitation message is preferably received by a user at a computer terminal of the user other than said mobile computing device.

The deployment server preferably transmits the message containing the unique download URL to the mobile computing device of the user in response to data transmitted by the user from said computer terminal of the user other than said mobile computing device.

Preferably, the message containing the unique download URL that is transmitted from the deployment server to the mobile computing device of the user is an SMS format message.

The method preferably includes transmitting the Secret Key to the user via out-of-band means, for use in installation of the application software on the mobile computing device of the user.

For example, the Secret Key may be transmitted to the user as a secure e- mail message sent to said e-mail address of the user. -A-

Further according to the invention there is provided a system for installing a software application on a mobile computing device, the system comprising:

an authentication server associated with a network, the network having a plurality of users each having an account with user identification data associated therewith; and

a deployment server supporting an application installation web page;

the system being operable to:

create an account for a user on the network, the account having user identification data associated therewith including a user name, a user e-mail address and an address of a mobile computing device of the user;

at the authentication server, generate a Shared Secret using a cryptographically secure pseudo random number generator and encrypt the Shared Secret using a Secret Key;

transmit the encrypted Shared Secret without the Secret Key from the authentication server to the deployment server;

store the encrypted Shared Secret at the deployment server;

generate a unique deployment URL at the deployment server and transmit it to the authentication server;

transmit a registration invitation message comprising the unique deployment URL from the authentication server to a computer terminal of the user to enable the user to access the application installation web page supported by the deployment server to accept the registration invitation; transmit a message containing a unique download URL from the deployment server to the mobile computing device of the user;

at the deployment server, receive a confirmatory request from the mobile computing device to install the software application; and

transmit data comprising the software application from the deployment server to the mobile computing device of the user for installation of the software application on the mobile computing device of the user.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a simplified schematic diagram of a system for installing a security software application on a mobile computing device of a user according to the present invention; and

Figure 2 is a flow chart illustrating major steps in the method of installing the software application.

DESCRIPTION OF AN EMBODIMENT

In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of an embodiment of the present disclosure. It will be evident, however, to one skilled in the art that the present disclosure may be practiced without these specific details.

Figure 1 shows, in a highly simplified schematic format, a system for installing a software application on a mobile computing device of a user.

For purposes of this application, the term "mobile computing device" includes, but is not limited to, mobile telephones (including cellular telephones), Personal Digital Assistants (PDAs), Smartphones, laptop or notebook computers, and other such devices. In general, devices of this kind have a user interface including a display and a keypad or keyboard, an onboard processor and software, and a communication interface which is preferably wireless.

The present invention is concerned with the installation of a software application on such a mobile computing device. One example of such an application is a one-time password (OTP) security application, and the following description is based on this example. However, those skilled in the art will understand that the invention has application to other software applications as well, such as messaging applications (e.g. MXIT) and games, for example.

According to an example embodiment of the invention, a user of a network, which is typically a secure computer network operated by a company or organisation, has both a main computer (which could be a home computer or a network computer) and a mobile computing device, shown as a PDA or Smartphone. The mobile computing device is able to communicate via GSM (in this example) with a wireless telephone network which includes an SMS (Short Message Service) gateway. Other messaging protocols could be used instead.

The network to which the user wishes to gain access includes an authentication server. The network will typically include a firewall and an administrator workstation which, together with other components of the network, are omitted for simplicity. Associated with the network is a deployment server 26.

In the described embodiment of the invention, it is desired to deploy software on the mobile computing device of the user to enable the mobile computing device to be used as an authentication token, equivalent to a dedicated authentication token as currently used to gain access to secure networks. Essentially, the software installed on the mobile computing device transforms it into such an authentication token, similar to conventional dedicated hardware tokens but superior in several respects.

It will be appreciated that, in the example embodiment, the security of deployment of the application software to the mobile device is important. Another problem to be addressed is the sheer number of mobile telephones, PDAs and Smartphones, and the diversity of user interfaces incorporated in these devices.

In this context, the present invention provides a central deployment server that can form a hub securely connecting multiple authentication servers to mobile telephones and other mobile computing devices of network users, without having to expose the authentication servers over the Internet.

The general operation of the method and system of the present invention is a development of the method and system described in International patent application PCT/IB2008/051580 (published under no. WO 2008/132670) the contents of which are incorporated herein by reference.

The main steps carried out in an example embodiment of the method of the present invention are as follows:

The deployment process starts with the network system administrator deploying a user and creating a user account for the user on the network.

The Authentication Server generates a Shared Secret using a cryptographically secure pseudo random number generator and encrypts the Shared Secret using a Secret Key. The Authentication Server sends the encrypted data comprising the Shared Secret to the Deployment Server but not the Secret Key. The Deployment Server stores the encrypted data but does not have the Secret Key.

The Deployment Server now sends a unique Deployment URL to the Authentication Server. The Authentication Server e-mails a unique Deployment URL to the e-mail address of the User, who opens the Deployment URL and verifies his/her account details via a web page supported by the Deployment Server. The User can view GPRS setup advice while waiting for an SMS format message from the Deployment Server.

The Deployment Server now sends an SMS message to the User's mobile computing device. The User opens a unique download URL in the SMS message. The Deployment Server identifies the mobile computing device, and assembles model-specific application for the mobile device, i.e., a token application on the deployment server builds and serves the application to the User's mobile computing device.

If the Deployment server is unable to inject data into the application, it issues a blank token. The User downloads the token application containing encrypted data from the Deployment Server. The token application install has install callback to a Business Systems server that completes the installation.

The Authentication Server sends a Secret key to the User via out-of-band means, e.g., via secure e-mail to the same e-mail address used previously. The User enters the Secret Key in the application on the mobile computing device to decrypt data and is able now to generate OATH-compliant Hash One Time Passwords as required.

The User types the generated One Time Password in an application, for example, when logging on to an Internet Banking service or when performing a VPN login. The Authentication Server authenticates the One Time Password and approves or rejects the login request.

The above steps are illustrated sequentially in Figures 1 and 2.

This described example embodiment of the invention thus delivers a One Time Password application for the user's specific phone or other mobile computing device, with specific encrypted data for the user's account. This makes the whole deployment process much easier.

Claims

1. A method of installing a software application on a mobile computing device, the method including:

a. creating an account for a user on a network, the account having user identification data associated therewith including a user name, a user e-mail address and an address of a mobile computing device of the user;

b. at an authentication server, generating a Shared Secret using a cryptographically secure pseudo random number generator and encrypting the Shared Secret using a Secret Key;

c. transmitting the encrypted Shared Secret without the Secret Key from the authentication server to a deployment server;

d. storing the encrypted Shared Secret at the deployment server;

e. generating a unique deployment URL at the deployment server and transmitting it to the authentication server;

f. transmitting a registration invitation message comprising the unique deployment URL from the authentication server to a computer terminal of the user to enable the user to access a web page supported by the deployment server to accept the registration invitation;

g. transmitting a message containing a unique download URL from the deployment server to the mobile computing device of the user; h. at the deployment server, receiving a confirmatory request from the mobile computing device to install the software application; and

i. transmitting data comprising the software application from the deployment server to the mobile computing device of the user, for installation of the software application on the mobile computing device of the user.

2. A method according to claim 1 wherein the mobile computing device of the user is a mobile telephone, a PDA or another mobile computing device with wireless connectivity.

3. A method according to claim 1 or claim 2 wherein the software application is security software.

4. A method according to claim 3 wherein the software application is a one-time password application or token.

5. A method according to any one of claims 1 to 4 wherein the registration invitation message is sent from the authentication server to the user in the form of an e-mail message transmitted to an e- mail address of the user.

6. A method according to claim 5 wherein the invitation message is received by a user at a computer terminal of the user other than said mobile computing device.

7. A method according to any one of claims 1 to 6 wherein the deployment server transmits the message containing the unique download URL to the mobile computing device of the user in response to data transmitted by the user from said computer terminal of the user other than said mobile computing device.

8. A method according to claim 7 wherein the message containing the unique download URL that is transmitted from the deployment server to the mobile computing device of the user is an SMS format message.

9. A method according to any one of claims 1 to 8 including transmitting the Secret Key to the user via out-of-band means, for use in installation of the application software on the mobile computing device of the user.

10. A method according to claim 9 wherein the Secret Key is transmitted to the user as a secure e-mail message sent to said e- mail address of the user.

11. A system for installing a software application on a mobile computing device, the system comprising:

a. an authentication server associated with a network, the network having a plurality of users each having an account with user identification data associated therewith; and

b. a deployment server supporting an application installation web page;

the system being operable to:

store the encrypted Shared Secret at the deployment server;

transmit a registration invitation message comprising the unique deployment URL from the authentication server to a computer terminal of the user to enable the user to access the application installation web page supported by the deployment server to accept the registration invitation;

transmit a message containing a unique download URL from the deployment server to the mobile computing device of the user;