WO2012045908A1 - Dispositif et procédé pour accéder à un service de réseau - Google Patents

Dispositif et procédé pour accéder à un service de réseau Download PDF

Info

Publication number
WO2012045908A1
WO2012045908A1 PCT/FI2011/050380 FI2011050380W WO2012045908A1 WO 2012045908 A1 WO2012045908 A1 WO 2012045908A1 FI 2011050380 W FI2011050380 W FI 2011050380W WO 2012045908 A1 WO2012045908 A1 WO 2012045908A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
user
service
arrangement
password
Prior art date
Application number
PCT/FI2011/050380
Other languages
English (en)
Inventor
Martti PITKÄNEN
Original Assignee
Aplcomp Oy
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from PCT/FI2010/050773 external-priority patent/WO2011055002A1/fr
Application filed by Aplcomp Oy filed Critical Aplcomp Oy
Publication of WO2012045908A1 publication Critical patent/WO2012045908A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/224—Monitoring or handling of messages providing notification on incoming messages, e.g. pushed notifications of received messages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/029—Location-based management or tracking services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the invention pertains to computers and related communications infrastructure.
  • the invention concerns logging in to a service provided by a remote computer system and associated authentication.
  • Access control in conjunction with network services may imply user identification, which can be generally based on a variety of different approaches. For example, three categories may be considered including anonymous, standard and strong identification. Regarding anonymous case, the service users do not have to be and are not identified. Standard, or 'normal', identification may refer to what the requestor for access knows, such as a password, or bears such as a physical security token. Such a token may include password-generating device (e.g. SecurlDTM), a list of one-time passwords, a smart card and a reader, or a one-time password transmitted to a mobile terminal.
  • password-generating device e.g. SecurlDTM
  • strong identification may be based on a biometric property, particularly a biometrically measurable property, of a user, such as a fingerprint or retina, or a security token the transfer of which between persons is difficult, such as a mobile terminal including a PKI (Public Key Infrastructure) certificate requiring entering a ⁇ (Personal Identification Number) code upon each instance of use.
  • a biometric property particularly a biometrically measurable property
  • a security token the transfer of which between persons is difficult, such as a mobile terminal including a PKI (Public Key Infrastructure) certificate requiring entering a ⁇ (Personal Identification Number) code upon each instance of use.
  • network service -related authentication i.e. reliable identification
  • Weak authentication may refer to the use of single standard category identification means such as user ID/password pair.
  • strongish authentication may apply at least two standard identification measures utilizing different techniques. With strong authentication, at least one of the identification measures should be strong. Notwithstanding the various advancements taken place during the last years in the context of user and service identification, authentication, and related secure data transfer, some defects still remain therewith and are next briefly and non- exhaustively reviewed with useful general background information.
  • access control methods to network services include push and pull methods.
  • pull methods a user may first identify oneself anonymously to a network service providing a login screen in return. The user may then type in the user ID and a corresponding password, whereupon he/she may directly access the service or be funneled into the subsequent authentication phase.
  • a network server may first transmit information to the e-mail address of the user in order to authorize accessing the service. Preferably only the user knows the password of the e-mail account. The users are often reluctant to manually manage a plurality of user IDs and corresponding passwords.
  • a password is typically enabled by access control management entity that also stores the password locally. If the security of the data repository is later jeopardized, third parties may acquire all the passwords stored therein. Also if the user forgets the password or it has to be changed for some other reason, actions have to be taken by the user and optionally service provider. The user has to memorize the new password. Further, the adoption of a personal, potentially network service-specific token such as a smartcard, e.g. SecurlDTM, and a related reader device may require intensive training. The increase in the use of smart cards correspondingly raises the risk of thefts and provision of replacement cards.
  • a smartcard e.g. SecurlDTM
  • the objective is to at least alleviate one or more problems described hereinabove regarding the usability issues and security risks, such as authentication risks, associated with the contemporary remote computer systems and related network services.
  • the objective is achieved by the arrangement, such as an apparatus or a plurality of at least functionally connected apparatuses, and method in accordance with the present invention disclosing service access technology and technique, respectively, preferably incorporating e-mail account and mobile device -related communication resulting in at least two-factor authentication in conjunction with the overall procedure, which provides both trustworthy authentication and pleasant use experience.
  • Various electronic services such as cloud computing services, remote desktop services, and customer portal services may be accessed and related documents programmatically transmitted from a database to registered recipients, for instance.
  • an arrangement for controlling access to a network service, such as a cloud service, utilizing multi-factor authentication, comprises a processing entity and a memory entity for processing and storing data, respectively, and a data transfer entity for receiving and sending data, the arrangement being configured to send an e-mail notice to an e-mail address associated with a predetermined user, the e-mail notice including a preferably secure link for a browser, such as an Internet browser, receive an indication of the activation of the preferably secure link, such as a data request like a web resource request sent via a browser, in response to which the arrangement being further configured to send
  • -first browser data such as web page data, requesting the user of the browser to input a secret
  • OTP one-time password
  • the enablement may generally include sending data such as second browser data, e.g. a UI (web) page of the associated network service or other service data, which may further enable the user to access the service and/or fetch a desired electronic document via a download link, for instance.
  • the enablement incorporates or basically is about providing service access -enabling data to the user (terminal).
  • the transferred enabling data may include at least one element selected from the group consisting of: a browser executable program, a Java entity such as a Java applet, an executable such as a binary executable, and a service password or related data required for generating it preferably in encrypted form.
  • the data may be transferred via the browser connection, and/or through other connection.
  • the service password may be used for accessing such as logging in to the network service. Multiple data elements may be transferred substantially simultaneously, e.g. one substantially after each other, or during a longer period.
  • the service password, the resulting authentication, e.g. log-in, action and/or the resulting service connection may be associated with a predetermined or dynamic validity or expiration condition such as a period.
  • the service password may be user and/or terminal device -specific.
  • the service password may be embedded in the transferred other data such as transferred program or transferred (other) file.
  • the utilization of the service password, or 'service code' may be substantially transparent or invisible from the standpoint of the user, i.e.
  • the service password may be handled automatically for log-in purposes so that after providing the OTP the user may omit substantive further manual actions in order to access the service, or the required action(s) are minimal such as a number of simple confirmation actions like click or button press- type actions.
  • the service password may also be lengthy, e.g. of available maximum length as advantageously, the user does not have to manually play with it or even know it.
  • the password generation may be of 'black box' type, i.e. a specific entity may be configured to generate it in a non- transparent manner. Likewise, the password may be afterwards operated via a number of black box entities.
  • the password may remain secret from the service operator even though the service operator may advantageously trigger resetting the password upon need.
  • the password may be stored as encrypted.
  • the password remains secret to the user, operator and third parties.
  • the tasks of password or related data provision, verification (receipt and checking) and/or service provision may be executed by different entities.
  • a certain network entity comprising a number of network devices of the arrangement may thus take care of OTP and/or service password provision and/or verification.
  • a certain other network entity may provide the network service.
  • the entities may also overlap as to the included devices.
  • the service password may be a one-time password and/or a temporally limited password. It may be created dynamically. For example, a new service password may be created and/or transferred when necessary. In some embodiments, the new password may be provided upon each instance of a service log in procedure after the mobile-based OTP authentication as described herein.
  • the established service connection is maintained based on a number of security measures the outcome of which is used to determine the future of the service connection, i.e. let it remain, terminate it, or change it, for example.
  • fingerprint methodology may be applied.
  • the client terminal may initially, upon service log-in, for instance, provide a fingerprint based on a number of predetermined elements, such as browser data such as version data, OS data such as version data, obtained Java entity data such as version data, and/or obtained executable data such as version data.
  • Version data may include ID data such as version identifier or generally the identifier (application or software name, for example) of the associated element.
  • the arrangement may be configured to request new fingerprint in response to an event such as a timer or other temporal event (timed requests, e.g. on a regular basis).
  • an event such as a timer or other temporal event (timed requests, e.g. on a regular basis).
  • the client may provide fingerprints independently based on timer and/or some other event, for instance.
  • the arrangement may utilize the most recent fingerprint and a number of earlier fingerprints, e.g. the initial one, in a procedure such as a comparison procedure.
  • the procedure may be executed to determine the validity of the current access (user). For example, if the compared fingerprints match, a positive outcome may be determined indicating no increased security risk and the connection may remain as is. A mismatch may trigger a further security procedure or terminating the connection.
  • the arrangement is location-aware advantageously in a sense it utilizes location information to authenticate the user.
  • a number of predetermined locations may be associated with each user of the arrangement.
  • the location may refer to at least one element selected from the group consisting of: address, network address, sub-network, IP (Internet Protocol) address, IP sub-network, cell, cell-ID, street address, one or more coordinates, GPS coordinates, GLONASS coordinates, district, town, country, continent, distance to a predetermined location, and direction from a predetermined location.
  • IP Internet Protocol
  • GLONASS Global System
  • Failed location-based authentication may result in a failed overall authentication (denied access), or alternatively, a limited functionality such as limited access to the service may be provided.
  • a limited functionality such as limited access to the service may be provided.
  • Each authentication factor may be associated with a characterizing weight (effect) in the authentication process.
  • a certain location may be associated with a certain user by "knowing" the user, which may refer to optionally automatically profiling and learning the user via monitoring one's habits such as location and optionally movements. As a result, a number of common, or “allowed", locations may be determined and subsequently utilized for authentication purposes. Additionally or alternatively, the user may manually register a number of allowed locations for utilizing the solution in the arrangement. Generally, in various embodiments of the present invention, knowing the user and/or his/her gear and utilizing the related information such as location information in connection with access control, conducting automated attacks such as different dictionary attacks against the service may be made more futile.
  • the location of the user (terminal) and/or data route may be estimated, e.g. by the arrangement, based on transit delay and/or round-trip delay. For example, delays relating to data packets may be compared with delays associated with a number of e.g. location-wise known references such as reference network nodes, which may include routers, servers, switches, firewalls, terminals, etc.
  • the secure link may include a U I with an applicable scheme such as a HTTPS scheme implying the use of SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol for encrypting traffic between the browser and the server.
  • the traffic may be encrypted utilizing some other method.
  • the link may include an address of a web page including the first browser data for user input.
  • the address may contain a secure element that is practically impossible to guess or deduce.
  • the secure element may include a hash such as an MD5 (Message-Digest algorithm 5) hash, for instance, for the determination of which service or document data and secret key of the server may have been applied.
  • MD5 Message-Digest algorithm 5
  • the notice may be provided as digitally signed utilizing a substantially S/MIME-compliant (Secure/Multipurpose Internet Mail Extensions) identity certificate, OpenPGP (Pretty Good Privacy, RFC 4880)-compliant identity certificate, and/or X.509- compliant identity certificate.
  • S/MIME-compliant identity certificate Secure/Multipurpose Internet Mail Extensions
  • OpenPGP Pretty Good Privacy, RFC 4880
  • X.509-compliant identity certificate may be utilized in connection with S/MIME e-mails.
  • a text message such as an SMS-compliant (Short Message Service) message
  • SMS-compliant Short Message Service
  • MMS Multimedia Messaging Service
  • the network service is a cloud service (running in a cloud). Additionally or alternatively, the service may arrange virtual desktop and/or remote desktop to the user.
  • HTTP Hypertext Transfer Protocol
  • the actual execution order of the first browser data and OTP sending items may differ depending on the embodiment, which is also described in further detail hereinafter.
  • the previously presented considerations concerning the various embodiments of the arrangement may be flexibly applied to the embodiments of the method mutatis mutandis, and vice versa, as being appreciated by a skilled person.
  • the utility of the present invention follows from a plurality of issues depending on each particular embodiment.
  • the suggested solution potentially enables applying e.g. strongish authentication such that the use experience is improved, security risks are mitigated, and the supply chain of services and/or digitally transferable documents such as bills or account statements among numerous other options is shortened. Indeed, at least strongish if not strong authentication is achieved with minimal additional costs. Encryption may be flexibly utilized for information transfer.
  • Existing, proprietary network services may be cultivated by adding at least two-factor authentication thereto as a front-end solution without necessarily causing a need to make major changes to the already established, underlying authentication/log-in practice of the service.
  • a service may be practically ready for exploitation by the user as soon as the one has received the notification e-mail.
  • the e-mail contains only a link to access the OTP-requesting front-end of the network service, potential lack of e-mail encryption does not expose any confidential information.
  • the password of e-mail account and the control over mobile account are used as authentication factors among other options such as location information. The risk of undesirably lowering the authentication level due to careless management of passwords practically disappears. Spyware-related risks may be overcome, for example.
  • the arrangement may store information such as e-mail addresses and cell phone numbers of the users of the provided services, but such information is not typically considered as particularly confidential and would be stored anyway in respect of customer records as desirable contact details.
  • information such as e-mail addresses and cell phone numbers of the users of the provided services, but such information is not typically considered as particularly confidential and would be stored anyway in respect of customer records as desirable contact details.
  • a relatively ordinary mobile device may be applied as a security token, proprietary new tokens do not have to be obtained.
  • a plurality of refers herein to any positive integer starting from two (2), e.g. to two, three, or four.
  • data transfer may refer to transmitting data, receiving data, or both, depending on the role(s) of a particular entity under analysis relative a data transfer action, i.e. a role of a sender, a role of a recipient, or both.
  • Fig. la illustrates the concept of the present invention via both block and signaling diagram approaches relative to an embodiment thereof.
  • Fig. lb illustrates one possibility for providing remote service access to the user of a client terminal after successful OTP- capitalizing authentication.
  • Fig. lc is a block diagram representing an embodiment of selected internals of the arrangement according to the present invention.
  • Fig. 2 is a flow chart disclosing an embodiment of a method in accordance with the present invention.
  • Fig. 3 is a flow chart disclosing an embodiment of enabling the user to access a remote service in response to a successful authentication in accordance with the present invention.
  • the user preferably has an e-mail account (advantageously private e-mail), a browser application, network access such as Internet accessibility, a mobile (communications) device and a mobile subscription.
  • the user may have a desktop, a laptop, a thin-client or a hand-held computer for e-mail, browsing and/or various other purposes, for instance.
  • the mobile device may be utilized also for such use.
  • many contemporary and forthcoming higher end mobile terminals such as so-called "smartphones" bear necessary capabilities for both e- mail and web surfing purposes.
  • a number of various other software solutions, e.g. clients may be run on the mobiles.
  • the e-mail address and mobile number of the user are stored in the arrangement for future use.
  • the user may have to be supplied with service data such as virtual desktop and/or financial reports requiring at least strongish authentication.
  • service data such as virtual desktop and/or financial reports requiring at least strongish authentication.
  • a related document may be, e.g. upon first instance of use (fetch by a recipient) converted into a target format such as the PDF format and/or digitally signed.
  • the potential users of the provided arrangement and method include different network service providers, operators, cloud operators, virtual and/or remote desktop service providers, software manufacturers, financial institutions, companies, and private persons in the role of a service provider/data sender, intermediate entity, or user/recipient, for example.
  • the invention is thus generally applicable in a wide variety of different use scenarios and service/document delivery applications.
  • the service may include customer portal service and the service data may correspondingly include customer portal data.
  • the portal Through the portal, a user may inspect the available general data, company or other organization-related data or personal data such as data about rental assets, estate or other targets. Associated reports may be obtained via the service.
  • Figure 1 a illustrates the overall concept of the present invention according to an embodiment thereof.
  • the embodiment may be related, by way of example only, to the provision of a network service such as a virtual desktop service or document delivery service, e.g. delivery of a bill including a notice of maturity regarding a bank loan.
  • Entity 102 refers to the service user (recipient) and associated devices such as a desktop or laptop computer and/or a mobile device utilized for accessing the service in the role of a client, for instance.
  • the device(s) preferably provide access to a network such as the Internet.
  • the mobile device such as a mobile phone (e.g. a smartphone) or a PDA (personal digital assistant) may preferably be wirelessly connected to a compatible network, such as a cellular network.
  • Entity 106 refers to an arrangement of a number of at least functionally connected devices for user verification and service provision and/or document delivery.
  • the entity 106 may only participate in user authentication and thus service access, but the service provision is then taken care of by a number of further devices.
  • the entity 106 may also contain a number of devices actually in charge of service (data) provision after authentication/log- in phase.
  • NAS Network access server
  • the communication between the entities 102 and 106 may take place over the Internet and underlying technologies, for example.
  • the entity 106 is functionally also connected to a mobile network.
  • the NAS 106 stores information about a service to be provided to users and/or documents such as bills to be delivered to them in a number of databases for preferably permanent storage. Further, user data may be obtained and managed.
  • a notice regarding the service and/or document is sent, as digitally signed by S/MIME, for example, and utilizing a first communication technique, preferably e-mail, to the registered e-mail address of the intended recipient. Further, the e-mail may be encrypted. With e-mail it is referred to Internet e-mail, for example. Also other electronic mail systems or platforms may be applied.
  • the applied protocol may be SMTP (Simple Mail Transfer Protocol), for example.
  • the user 102 receives the e-mail notice informing about a possibility to access the service or e.g. fetch a new bill via NAS 106.
  • the notice may be received via a desktop computer or a portable, e.g. laptop or palm-top, computing device such as a smartphone as mentioned above.
  • a plurality of authentication options may be provided to the user as described in more detail hereinafter.
  • the user 102 may verify the sender of the e-mail by referring to the digital signature to avoid spammers' notices. Thereafter, the user 102 may select a secure link included in the notice and comprising a unique, optionally one-time accessible, URI for proceeding further with accessing the service or e.g.
  • Item 148a illustrates the simplified screen view visualizing the notice and the embedded link(s) to the user 102.
  • the used e-mail client may include a standalone application (UI) or e.g. a webmail application.
  • anonymous pull-type login could be applied by the user for accessing the service in some embodiments.
  • the user may, for instance, first access the network server 106 anonymously.
  • a related service (web) page may then provide a registration and/or login screen.
  • the server 106 may subsequently send a notice such as the aforesaid e-mail notice to the e-mail address of the user.
  • the notice may include a link such as an URI for service access.
  • the URI may be stored as a bookmark for facilitated logins in case the link is substantially permanent or of a longer term/multiple uses anyway.
  • the user 102 may have to utilize a personal user ID and/or password optionally each time upon entering the service.
  • the obtainable overall security level in the context of present invention is fully scalable ranging from the use of permanent service links and user ID/password pairs to one-time links, mobile-transferred OTPs and optional further security factors such as the location- factor.
  • the server 106 preferably validates the URI address based on e.g. the secure element thereof.
  • the server 106 sends browser data for representing an initial login screen to the user 102 (again e.g. HTTPS may be applied) and, optionally in response to a specific request by the user 102 e.g. via the login screen, an OTP preferably to the mobile device (e.g. cell phone number) associated with him/her e.g. in an SMS message delivered via an SMS gateway, for instance.
  • the mobile device e.g. cell phone number
  • At least part of the transmission path to the mobile device is preferably wireless and the air interface of a wireless, e.g. cellular, network compatible with the mobile device is applied.
  • At least partially different (second) communications technique may be thus exploited in contrast to the delivery of the e-mail notice. Accordingly, 2-factor/2- channel authentication may be achieved.
  • the message and/or the OTP may be encrypted utilizing a predetermined encryption technique.
  • the user 102 receives the login screen that is visualized on his/her terminal device, see the example at 148b.
  • the OTP is received preferably with the mobile device.
  • the user 102 types the OTP in the login screen.
  • the related communication may apply HTTPS (TTL/SSL), for instance.
  • access control logic of the server 106 compares the received OTP and the reference OTP (correct OTP sent at 138b), and in case these two match and optional additional conditions are fulfilled as well, transmits, at 144, data for enabling the user to access the service or document received at 146.
  • the procedure may include generating a new view enabling the user 102 to access a service, download a document such as a bill or view it directly, e.g. via HTML page(s) interpreted by compatible browser and necessary browser add-on(s), optionally with supplementary data such as indication of available functionalities like change of the presentation mode.
  • the enablement may refer to further, e.g. security- related, operations prior to gaining an access to the service. Such operations are explained in more detail hereinafter.
  • HTTPS and/or SSH Secure Shell
  • a switchover from HTML to PDF or some other presentation may be triggered.
  • location information 143 may be utilized in the authentication process.
  • the server 106 and/or other entities external to the user's 102 terminal gear may be configured to locate one or more of the terminals the user 102 applies for obtaining the document, i.e. a first terminal used for e-mail and browsing/login procedure, and a second terminal used for OTP reception, if different.
  • the location of the terminal(s) typically gives a hint about the user's 102 location.
  • the terminal devices may bear an own role in the positioning process and execute at least part of the necessary positioning actions locally. Actions required to position a terminal may be shared between the terminal(s) and at least one external entity.
  • address information may be used in the positioning process to deduce the location of the particular terminal in question.
  • terminal or access network addresses such as IP addresses are at least loosely associated with physical locations so that the address-based locating is at least limitedly possible.
  • roaming signal and data transmission -based positioning For example, by checking the ID of the base station(s) the mobile device is communicating with, at least approximate location of the mobile device may be obtained. Yet, through more comprehensive signal analysis, such as TOA (Time- Of-Arrival), OTD (Observed-Time-Difference), or AOA (Angle-Of- Arrival), the mobile device may be located.
  • TOA Time- Of-Arrival
  • OTD Observed-Time-Difference
  • AOA Angle-Of- Arrival
  • a satellite navigation receiver such as a GPS (Global Positioning System) or GLONASS (GLObal Navigation Satellite System) in connection with a terminal device may be exploited.
  • the terminal may share the locally received satellite information with external entities as such or in cultivated form (e.g. ready-determined coordinates based on received satellite signal(s)).
  • data entity such as data packet transit times or TT times may be monitored, if possible, e.g. in relation to both the monitored user/terminal and e.g. location-wise known reference entities as described hereinbefore in order to assess the location of the user/terminal by associated comparison.
  • the server 106 may then introduce a further factor, i.e.
  • a location -based factor to the authentication procedure and verify, whether the current location of the terminal in question matches with predetermined location information defining a number of allowed locations and/or banned locations in the light of the service and/or document access.
  • the status of the location-based factor may be evaluated prior to the evaluation of the fulfillment of other authentication factors, in conjunction with them, or as a final check before authorizing the user to access the service and/or electronic document.
  • a communications technology different from mobile technology could be applied for delivering the OTP. This might take place upon "no service" situations relative to the mobile network, for instance, as a secondary, back-up connection.
  • the arrangement may be configured to autonomously detect the fulfillment of a triggering condition, such as mobile connection failure, for utilizing the secondary connection for OTP transfer, and/or the user may request such by selecting a related (secure) link included in the e-mail notice, for example.
  • the secondary connection may refer to transmitting the OTP via e-mail, for instance.
  • the information provided in or through the document and/or the associated network service may be scaled (down) accordingly to match the achieved authentication level. Less information, e.g. less confidential, may be available to the recipient, for example.
  • the information may be pre- classified into a number of security classes for facilitating the scaling.
  • the user rights for the network service provided by the arrangement may be flexibly scaled via the utilization of a plurality of authentication options.
  • the options may be indicated in the e-mail notice via links, text, graphics, and/or other means, for example.
  • the user receiving the receipt notice may directly access the related service and/or document by activating a relating link included therein.
  • the achieved authentication level corresponds to a traditional e- mail communication such as a transfer of a bill.
  • the arrangement may be configured to offer merely a limited, low-level functionality of the overall service to the user, such as simple access to the bill in selected format such as PDF format, and no other functions.
  • FIG. lb illustrates one possibility for enabling a remote service access to the user of a client terminal after successful, OTP- capitalizing authentication.
  • the service may be a virtual or remote desktop service and/or a cloud service, for example.
  • NoMachineTM products such as NoMachine NX may be optionally utilized for the purpose.
  • the disclosed items may be considered to incorporate the aforementioned items 144, 146, which is highlighted in the figure by naming the corresponding items with postfix a, i.e. 144a, 146a.
  • the arrangement may provide the client device with data necessary for accessing the service, i.e. enabling data. Data transfer may still exploit the encrypted connection (e.g. HTTPS: SSL/TLS, or SSH) via the browser, for instance.
  • HTTPS HTTPS: SSL/TLS, or SSH
  • the data may at least partially differ. For instance, upon first access, more data may be provided including e.g. software that may be stored in the terminal such that further downloads of the same software may be omitted in the future.
  • substantially one-time (use) data such as a password
  • data expiring automatically based on e.g. a temporal event such as timer expiry
  • Further data such as user ID may be provided.
  • At least part of the provided data, such as the password may be determined in response to the successful OTP-authentication just finished.
  • the arrangement 106 may provide data such as software for accessing the network service at 144a to the terminal 102 such as a desktop or portable computer.
  • the software may include a Java language entity such as a Java applet or other entity that may be executable in the browser of the terminal. Additional or alternative software such as an executable may be provided.
  • the different software entities such as the Java entity and the executable entity may cooperatively enable the user to access the network service.
  • the data may be provided with signature(s) to facilitate verifying the source thereof at the receiving end.
  • the terminal may receive the data, store it and/or take it into use/install it depending on the nature thereof.
  • a Java entity such as applet may be obtained and executed. It may be stored in the cache of the browser for enabling rapid future use as well.
  • the terminal does not contain JVM (Java Virtual Machine)
  • JRE Java Runtime Environment
  • the data may further include additional or alternative applications such as a client executable for accessing a predetermined network service.
  • a password may be received, preferably in encrypted form. As the connection may itself be encrypted and the password may be separately encrypted as well (e.g.
  • the terminal 102 may, in response to the received data, process the data, executed an action associated therewith and/or transmit data 184 such as at least part of the processed data to a remote entity such as the arrangement 106.
  • a Java client such as at least one Java applet and optionally further software such as a binary executable may cooperatively handle and/or process a received password, such as decrypt the password, and transmit the processed version securely, preferably over e.g. SSH, to a remote system such as back to the arrangement for accessing the target service.
  • Browser-based data transfer may again be utilized.
  • the password may be input to the GUI (Graphical User Interface) in order to log in to a virtual or remote desktop service, for example.
  • GUI Graphic User Interface
  • Some, most or all the related actions may be automated such that after providing the OTP, the user may, at most, validate the execution of a number of selected actions, if necessary.
  • the received data may include data such as a program and/or source data for generating and optionally preferably securely communicating (e.g. to the service) the service password.
  • the network service such as a virtual or remote desktop may be or include a Windows-basedTM service. In some other embodiments, it may be or include a Linux, e.g. UbuntuTM, -based service.
  • the arrangement 106 or other entity may then receive the data such as the decrypted service password at 186 and execute a related predetermined action 188 such as log the user in and provide the user with the desired target service such as virtual desktop service 188a.
  • Associated service data may be transferred 188 between the parties.
  • a selected method such as device fingerprints, may be utilized to verify optionally regularly the user/terminal identity also during the service access.
  • FIG. 1 c is a block diagram illustrating the selected internals of an embodiment of the arrangement presented herein.
  • the arrangement 106 such as a number of servers, may physically contain a number of at least functionally connected elements.
  • the arrangement 106 is typically provided with one or more processing devices capable of processing instructions and other data, such as one or more microprocessors, micro-controllers, DSP's (digital signal processor), programmable logic chips, etc.
  • the processing entity 150 may thus, as a functional entity, comprise a plurality of mutually co-operating processors and/or a number of sub-processors connected to a central processing unit, for instance.
  • the processing entity 150 may be configured to execute the code stored in a memory 152, which may refer to instructions and data relative to the software logic and software architecture for controlling the arrangement 106.
  • the processing entity may at least partially execute and/or manage the execution of the aforesaid receiving, sending, determining, and/or enabling tasks.
  • the memory entity 152 may be divided between one or more physical memory chips or other memory elements.
  • the memory 152 may store program code and other data such as user contact information, electronic documents, various service data etc.
  • the memory 152 may further refer to and include other storage media such as a preferably detachable memory card, a floppy disc, a CD- ROM, or a fixed storage medium such as a hard drive.
  • the memory 152 may be non-volatile, e.g. ROM (Read Only Memory), and/or volatile, e.g. RAM (Random Access Memory), by nature.
  • Software (product) 152 may be provided on a carrier medium such as a memory card, a memory stick, an optical disc (e.g. CD-ROM or DVD), or some other memory carrier.
  • the UI user interface
  • the UI may comprise a display or a data projector 154, and keyboard/keypad or other applicable user (control) input entity 154b such as a touch screen and/or a voice control input, or a number of separate keys, buttons, knobs, switches, a touchpad, a joystick, and/or a mouse, configured to provide the user of the arrangement with practicable data visualization and device control means, respectively.
  • the UI may include one or more loudspeakers and associated circuitry such as D/A (digital-to-analogue) converter(s) for sound output, and optionally a microphone with A/D converter for sound input.
  • a printer may be included in the arrangement for providing more permanent output.
  • the arrangement 106 further comprises a data interface 156 such as a number of wired and/or wireless transmitters, receivers, and/or transceivers for communication with other devices such as terminals and/or network infrastructure(s).
  • a data interface 156 such as a number of wired and/or wireless transmitters, receivers, and/or transceivers for communication with other devices such as terminals and/or network infrastructure(s).
  • a data interface 156 such as a number of wired and/or wireless transmitters, receivers, and/or transceivers for communication with other devices such as terminals and/or network infrastructure(s).
  • a data interface 156 such as a number of wired and/or wireless transmitters, receivers, and/or transceivers for communication with other devices such as terminals and/or network infrastructure(s).
  • WLAN Wireless Local Area Network
  • LAN wireless local area network
  • WiFi Wireless Fidelity
  • Ethernet USB
  • USB Universal Serial Bus
  • GSM Global System for Mobile Communications
  • GPRS General Packe
  • the arrangement 106 may comprise numerous additional functional and/or structural elements for providing advantageous communication, processing or other features, whereupon this disclosure is not to be construed as limiting the presence of the additional elements in any manner.
  • Entity 158 refers to such additional element(s) found useful depending on the embodiment.
  • Figure 2 discloses, by way of example only, a method flow diagram in accordance with an embodiment of the present invention.
  • the arrangement of the present invention is obtained and configured, for example through loading and execution of related software, for managing the electronic service, related authentication and/or electronic document delivery system.
  • an indication of a required authentication is received from the current or future user of the service, or a related entity.
  • User registration data for the service may be obtained now or it may have been obtained earlier.
  • the data may include name/id, e-mail, and/or mobile number data, for instance.
  • a service user may have several (sub-)accounts each optionally defining a valid e- mail address - mobile number combination.
  • a notification regarding the service is transmitted towards the user based on contact information available.
  • An e-mail account associated with the user may be applied, for example.
  • the notification may include a link (typically a hyperlink), preferably also being a secure link, the activation of which funnels the client application such as the browser of the activator to the login/password entering page for proceeding further with service access.
  • the link may refer to a one-time or temporally limited link.
  • the link may be associated with e.g. location and/or device restrictions that limit the application of the link respectively to certain locations (e.g. geographical such as GPS or IP verification) and/or terminal devices.
  • the link could be applied successfully multiple times by the user without need to gain a new link upon each access.
  • the data transmission e.g. HTTP(S) request, such as GET
  • the arrangement responds by supplying an password request or potentially a more comprehensive login page (e.g. user ID may be requested) back at 210 as e.g. a web page matching the received request, for example.
  • an OTP may be optionally specifically requested by the user.
  • associated control functionality such as a button may be activated or triggered by the user on the associated service page potentially also provided at 209.
  • an OTP to be provided by the user as a response to the password query is supplied utilizing e.g. cellular communication to a mobile device associated with the user and advantageously with the e-mail whereto the notification was sent.
  • the addresses whereto the e-mail and OTP are transmitted are indeed different to enhance the security of the overall arrangement. More preferably, the transmission techniques also at least partially differ, e.g. TCP/IP vs. cellular communication.
  • further data such as user ID may be provided.
  • the order of items 210 and 212 may be reversed, or substantially simultaneous execution thereof may be preferred, as being clear to a skilled person. The issue is highlighted in the figure by the bi-directional broken arrow between the two items 210, 212.
  • the order of items 209 and 210 could in some embodiments be reversed or the items be combined as the password query towards the user generated at 210 may also include provision of a user- controllable functionality such as a web page control (button) for requesting the OTP, for instance.
  • item 212 could be executed even prior to or upon item 208.
  • a corresponding data transmission is triggered towards the arrangement that, at 214, receives the transmission.
  • further authentication factors such as location factor may be optionally considered.
  • Optionality of the further factors is depicted by the broken outline of item 215.
  • the exact execution instant of further authentication checks may be determined per each particular embodiment, and the illustrated position is just one feasible option. For instance, one other applicable position could reside between items 216 and 218 such that the location check would be the ultimate verification prior to authorizing access to the service and/or related electronic document.
  • the password entered by the user is compared against the archived one. In case the passwords do not match, a further possibility may be given to the user to enter a correct password, which is indicated by a dotted loop-back arrow. In some embodiments, a limited number of retries may be permitted. If the maximum number of tries is met without success and/or a predetermined timer is exceeded for entering a proper password, a predetermined action may be executed. For example, the service administrator or e-document sender may be informed about the service access/document delivery failure and its cause via e- mail or other electronic communication.
  • the arrangement may transmit, in response to the correct OTP input, data enabling service access, either directly or automatically, or via optional user intervention -requiring phase(s).
  • the data may generally include software required for accessing the service, e.g. Java-based software, and/or preferably user-specific service password data (e.g. password or data for generating it) optionally in encrypted form.
  • the desired electronic document(s) may be transmitted to the user via the browser connection.
  • a separate authorization display may be first provided, for example, implying that the password was correct (and optionally that further authentication factor checks were successful as well) and access to the document is now allowed.
  • a link to enter the service or download the document may be simultaneously or successively presented.
  • the method execution is ended. The execution of various method items may be naturally repeated upon need. As already alluded above, the execution order may be changed depending on the needs of the embodiment at issue.
  • Fig. 3 is a flow chart disclosing an embodiment of enabling the user to access a remote service in response to a successful OTP-based authentication in accordance with the present invention.
  • the embodiment is also feasible with proprietary network services by adding at least two-factor authentication thereto without necessarily creating a need to make changes to the already established authentication/log-in interface and/or internal practice of the service.
  • enabling data is provided to the terminal as disclosed hereinbefore.
  • the data may include software and e.g. password or password-generation data.
  • the password data such as an encrypted password provided in .nxs file with reference to e.g.
  • NoMachineTM virtual desktop solutions may be meant for one access or log-in event only, or be applicable for a longer period such as for the time being if not substantially perpetually relative to e.g. the life cycle of the service.
  • Software may include a number of software entities such as a browser-based entity, e.g. a Java applet, and/or a (binary) executable.
  • the elements may be configured to communicate with each other.
  • the obtained data may be utilized in the terminal.
  • the Java applet may access the password and provide it to the executable.
  • the executable may optionally decrypt the password.
  • the Java applet and/or other software entity such as the executable may be configured to address the optionally decrypted password to the network service for gaining access thereto, i.e. log in to the service.
  • the network service may operate at least tangentially through the arrangement with a number of common elements or independently as mentioned hereinbefore.
  • an access request utilizing the data may be provided 308 by the terminal to the network service operated through and/or by the arrangement or some other entity.
  • the terminal may perform these actions automatically or alternatively, at least some of them may require user intervention such as confirmation.
  • the service side i.e. the arrangement and/or service entity external thereto, may verify the credentials and if satisfied, begin serving the terminal 310 according to the service practices.
  • a visual GUI for a virtual desktop may be provided to the terminal in connection with a corresponding kind of a network service.
  • the user in question is provided with associated user rights (e.g. the role of an organization superuser)
  • he/she may be able to modify or even add new user accounts including e.g. related e-mail - mobile number combinations and other information to the service portion, such as organization-related portion, under his/her control.
  • new users may be conveniently added to the userbase of the service.
  • the OTP authentication may be again executed generally in accordance with the embodiment of Figure 2, for instance, followed by the actual service log- in as, by way of example, represented in Figure 3.
  • all the data such as Java applet or binary executable may not be necessary to re-transfer.
  • a new, optionally encrypted (recalling the fact that as the connection may be encrypted itself, the password may be actually multiple times encrypted during the transfer) service password may be provided to the terminal for local use and subsequent service log-in request (308).
  • the suggested solution may add to overall security level of the network service as an OTP- based multi-factor, at least two-factor, authentication is provided thereto.
  • a computer program comprising a code means adapted, when run on a computer, to execute an embodiment of the desired method steps in accordance with the present invention, may be provided.
  • a carrier medium such as an optical disc, floppy disc, or a memory card, comprising the computer program may further be provided.
  • the program may be delivered over a communication network and a communication channel.
  • WML Wireless Markup Language
  • WML Wireless Markup Language
  • a multi-times still preferably a limited-times (authorizing e.g. two or three log-ins)
  • a merely temporally limited-life password may be utilized for the mobile-enhanced authentication.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

L'invention concerne un dispositif (106), tel qu'un serveur ou une pluralité de serveurs et/ou d'autres appareils au moins fonctionnellement connectés, pour contrôler l'accès à un service de réseau, tel qu'un service cloud, au moyen d'une authentification multi-factorielle, au moins bifactorielle; lequel dispositif comprend une entité de traitement (150) et une entité de mémoire (152) pour traiter et stocker des données, respectivement, et une entité de transfert de données (156) pour recevoir et envoyer des données, le dispositif étant configuré pour envoyer une notification par e-mail (128) à une adresse électronique associée à un utilisateur prédéterminé, la notification par e-mail comprenant une liaison de préférence sécurisée pour un navigateur, tel qu'un navigateur Internet, recevoir une indication de l'activation de la liaison de préférence sécurisée (134), telle qu'une requête de données comme une requête de ressources web envoyée par l'intermédiaire d'un navigateur, en réponse à laquelle le dispositif est alors configuré pour envoyer des premières données de navigateur, telles que des données de pages web, demander à l'utilisateur du navigateur d'entrer un secret (136) et un mot de passe valable une fois (OTP) dans un dispositif mobile associé à l'utilisateur prédéterminé (138b), recevoir une entrée utilisateur relative à la demande du secret (140), déterminer si l'entrée utilisateur correspond au mot de passage valable une fois (OTP) envoyé (142) et, si tel est le cas, autoriser l'utilisateur du navigateur et du dispositif terminal associé, ainsi authentifié en tant qu'utilisateur prédéterminé, à accéder au service (144, 144a, 186, 88). L'autorisation comprend, de préférence, le transfert des données d'autorisation telles que les données de programme et/ou de mot de passe au dispositif terminal. L'invention concerne également un procédé correspondant.
PCT/FI2011/050380 2010-10-06 2011-04-27 Dispositif et procédé pour accéder à un service de réseau WO2012045908A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
FIPCT/FI2010/050773 2010-10-06
PCT/FI2010/050773 WO2011055002A1 (fr) 2009-11-03 2010-10-06 Agencement et procédé permettant une distribution de document électronique

Publications (1)

Publication Number Publication Date
WO2012045908A1 true WO2012045908A1 (fr) 2012-04-12

Family

ID=45928580

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/FI2011/050380 WO2012045908A1 (fr) 2010-10-06 2011-04-27 Dispositif et procédé pour accéder à un service de réseau

Country Status (1)

Country Link
WO (1) WO2012045908A1 (fr)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2712142A1 (fr) * 2012-09-25 2014-03-26 MindMatics Secure Messaging GmbH Procédé d'échange d'une information confidentielle entre un serveur et un terminal mobile
US20140254558A1 (en) * 2011-11-04 2014-09-11 Nokia Corporation Service type selection in wireless network
CN105187458A (zh) * 2015-10-28 2015-12-23 青岛汇云无限物联网有限公司 一种基于硬件本地认证请求的WiFi芯片认证系统及认证方法
FR3026875A1 (fr) * 2014-10-01 2016-04-08 Avencis Procedes de configuration d'un peripherique de type terminal connecte a un reseau afin de permettre une authentification forte d'un utilisateur
EP3093785A1 (fr) * 2015-05-15 2016-11-16 Fuji Xerox Co., Ltd. Système de transmission de données, appareil de transmission de données, procédé de transmission de données et programme
EP3310017A1 (fr) * 2016-10-14 2018-04-18 Alcatel Lucent Dispositif électronique d'authentification à deux facteurs
WO2019219205A1 (fr) * 2018-05-18 2019-11-21 Telefonaktiebolaget Lm Ericsson (Publ) Contrôle d'accès à un programme d'application
CN113922975A (zh) * 2020-06-22 2022-01-11 中移(苏州)软件技术有限公司 一种安全控制方法、服务器、终端、系统和存储介质
USRE49769E1 (en) * 2013-07-12 2023-12-26 Stephen Cassar Secure electronic document delivery system

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1999066666A2 (fr) * 1998-06-14 1999-12-23 Csafe Ltd. Procede et appareil permettant de produire des informations textuelles dans un environnement de reseau
US20020099942A1 (en) * 2001-01-23 2002-07-25 Gohl Erika Monika Authenticating communications
FI115745B (fi) * 2003-04-25 2005-06-30 Deltagon Group Oy Menetelmä ja palvelin sähköpostin turvaamiseksi
US20070136573A1 (en) * 2005-12-05 2007-06-14 Joseph Steinberg System and method of using two or more multi-factor authentication mechanisms to authenticate online parties
US20090235346A1 (en) * 2007-07-19 2009-09-17 Joseph Steinberg System and method for augmented user and site authentication from mobile devices
US20100022254A1 (en) * 2008-07-22 2010-01-28 Bank Of America Corporation Location-Based Authentication of Mobile Device Transactions

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1999066666A2 (fr) * 1998-06-14 1999-12-23 Csafe Ltd. Procede et appareil permettant de produire des informations textuelles dans un environnement de reseau
US20020099942A1 (en) * 2001-01-23 2002-07-25 Gohl Erika Monika Authenticating communications
FI115745B (fi) * 2003-04-25 2005-06-30 Deltagon Group Oy Menetelmä ja palvelin sähköpostin turvaamiseksi
US20070136573A1 (en) * 2005-12-05 2007-06-14 Joseph Steinberg System and method of using two or more multi-factor authentication mechanisms to authenticate online parties
US20090235346A1 (en) * 2007-07-19 2009-09-17 Joseph Steinberg System and method for augmented user and site authentication from mobile devices
US20100022254A1 (en) * 2008-07-22 2010-01-28 Bank Of America Corporation Location-Based Authentication of Mobile Device Transactions

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"D3 Envelope method - Receiver authentication. Datasheets", DELTAGON, 2008, Retrieved from the Internet <URL:http://web.archive.org/web/20080411210134/www.deltagon.com/envelope_method.html> [retrieved on 20110201] *

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140254558A1 (en) * 2011-11-04 2014-09-11 Nokia Corporation Service type selection in wireless network
US9867110B2 (en) * 2011-11-04 2018-01-09 Nokia Technologies Oy Service type selection in wireless network
EP2712142A1 (fr) * 2012-09-25 2014-03-26 MindMatics Secure Messaging GmbH Procédé d'échange d'une information confidentielle entre un serveur et un terminal mobile
USRE49769E1 (en) * 2013-07-12 2023-12-26 Stephen Cassar Secure electronic document delivery system
FR3026875A1 (fr) * 2014-10-01 2016-04-08 Avencis Procedes de configuration d'un peripherique de type terminal connecte a un reseau afin de permettre une authentification forte d'un utilisateur
EP3093785A1 (fr) * 2015-05-15 2016-11-16 Fuji Xerox Co., Ltd. Système de transmission de données, appareil de transmission de données, procédé de transmission de données et programme
CN105187458A (zh) * 2015-10-28 2015-12-23 青岛汇云无限物联网有限公司 一种基于硬件本地认证请求的WiFi芯片认证系统及认证方法
EP3310017A1 (fr) * 2016-10-14 2018-04-18 Alcatel Lucent Dispositif électronique d'authentification à deux facteurs
WO2018069435A1 (fr) * 2016-10-14 2018-04-19 Alcatel Lucent Dispositif électronique pour authentification à deux facteurs
WO2019219205A1 (fr) * 2018-05-18 2019-11-21 Telefonaktiebolaget Lm Ericsson (Publ) Contrôle d'accès à un programme d'application
US11785013B2 (en) 2018-05-18 2023-10-10 Telefonaktiebolaget Lm Ericsson (Publ) Application program access control
CN113922975A (zh) * 2020-06-22 2022-01-11 中移(苏州)软件技术有限公司 一种安全控制方法、服务器、终端、系统和存储介质
CN113922975B (zh) * 2020-06-22 2024-05-24 中移(苏州)软件技术有限公司 一种安全控制方法、服务器、终端、系统和存储介质

Similar Documents

Publication Publication Date Title
US11870769B2 (en) System and method for identifying a browser instance in a browser session with a server
US9729537B2 (en) System and method for identity management for mobile devices
WO2012045908A1 (fr) Dispositif et procédé pour accéder à un service de réseau
US10135805B2 (en) Connected authentication device using mobile single sign on credentials
EP2743855B1 (fr) Configuration sécurisée d&#39;une application mobile
EP2684330B1 (fr) Procédé et système pour autoriser l&#39;accès à un site web sécurisé
US9628282B2 (en) Universal anonymous cross-site authentication
US10158491B2 (en) Qualified electronic signature system, method and mobile processing terminal for qualified electronic signature
EP3208732A1 (fr) Procédé et système destinés à l&#39;authentification
DK2582115T3 (en) Qualified electronic signature system, associated method and mobile phone to qualified, electronic signature
WO2014105263A1 (fr) Authentification à facteurs multiples et système de connexion complexe pour des réseaux de serveurs clients
US9331995B2 (en) Secure configuration of mobile application
EP4152188B1 (fr) Procédés, systèmes et appareil d&#39;authentification multifactorielle améliorée dans un système de communication multi-applications
US11658963B2 (en) Cooperative communication validation
WO2011055002A1 (fr) Agencement et procédé permettant une distribution de document électronique
US20220253520A1 (en) Methods and systems for verifying applications
EP2439969B1 (fr) Authentification de données personnelles dans un système de télécommunications
WO2013190169A1 (fr) Système et procédé permettant d&#39;accéder à un service de réseau
US20230299958A1 (en) Methods and systems for authenticating a candidate user of a first and as second electronic service
Marković et al. Mobile Government Systems in Cross-Border Environments
Pokherl Secure Web System in a Cloud Environment
OA16529A (en) Method and system for granting access to a secured website.
KR20140007984A (ko) 인스턴트메시지에 의한 로그인 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11830254

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11830254

Country of ref document: EP

Kind code of ref document: A1