Method and apparatus for obtaining and verifying credentials for accessing a computer application program

• US 20060101507A1
• Filed: 11/02/2005
• Published: 05/11/2006
• Est. Priority Date: 11/05/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan L.
• Granted Patent: US 8,006,288 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates

Abstract

Methods for obtaining credentials and for verifying credentials are disclosed. In some embodiments, a request may be generated to register a computing device of a user to a registration issuer, and in response a device related credential for the computing device may be obtained, the device related credential being for exclusive use of that computing device and being related to a unique identifier of the user. A request for a credential for an application program may be generated, and in response an application credential for the application program may be obtained, the application credential being related to the unique identifier of the user. A request for access to the application program may be generated, the request comprising the application credential and the device related credential. In response to the request for access, access to the application may be granted if the device related credential and the application credential relate to the same unique user identifier.

Claims

1. A method for obtaining access to an application program, comprising the steps of:

obtaining a device related credential for a computing device of a user, the device related credential being for exclusive use of that computing device, and the device related credential being related to a unique identifier of the user;

obtaining an application credential for an application program, the application credential being related to the unique identifier of the user;

generating a request for access to the application program, the request comprising the application credential and the device related credential; and

receiving access to the application if the device related credential and the application credential relate to the same unique user identifier.

2. The method according to claim 1, wherein obtaining the device related credential comprises reading the device related credential from a memory in the device.

3. The method according to claim 1, wherein obtaining the device related credential comprises receiving a device related credential from a registration issuer and incorporating the unique identifier of the user into the received device related credential at the device to be registered.

4. The method according to claim 3, wherein the method further comprises submitting proof of the validity of the unique identifier that was incorporated into the credential.

5. The method according to claim 1, wherein obtaining an application credential for the application program comprises submitting a request for an application credential to an application issuer computer.

6. The method according to claim 5, wherein obtaining an application credential further comprises receiving the application credential from the application issuer computer, the application credential being issued by the application issuer computer and being related to the unique identifier of the user at the device to be registered.

7. The method according to claim 5, wherein obtaining an application credential further comprises receiving at the user'"'"'s device an application credential from the application issuer computer, and incorporating at the user'"'"'s device the unique identifier of the user into the received application credential.

8. The method according to claim 7, wherein obtaining an application credential further comprises submitting proof of the validity of the unique identifier that was incorporated into a credential.

9. The method according to claim 1, wherein determining whether the device related credential and the application credential relate to the same unique identifier is performed by means of a zero knowledge proof protocol.

10. A method for granting access to an application based on the use of credentials, comprising the steps of:

receiving from a user'"'"'s computer device a request for access to an application, te request comprising an application credential and a device related credential, the device related credential being exclusive for use in connection with the requesting computing device and being related to a unique identifier of the user, and the application credential being related to a unique identifier of the user;

verifying that the device related credential and the application credential relate to the same unique identifier; and

granting access to the application based at least on part on the verification that the device related credential and the application credential relate to the same unique identifier.

11. The method according to claim 10, wherein verifying that the device related credential and the application credential relate to the same unique identifier is performed by means of a zero knowledge proof protocol.

12. A computer program product which when loaded in a computer device of a user is able to carry out the steps of:

obtaining an application credential for an application program, the application credential being related to a unique identifier of the user;

generating a request for access to the application program, the request comprising the application credential and a device related credential, the device related credential being for exclusive use of that computer device and being related to a unique identifier of the user; and

receiving access to the application if the device related credential and the application credential relate to the same unique user identifier.

13. The computer program product according to claim 12, wherein obtaining an application credential for the application program comprises submitting a request for an application credential to an application issuer computer.

14. The computer program product according to claim 13, wherein obtaining an application credential further comprises receiving the application credential from the application issuer computer, the application credential being issued by the application issuer computer and being related to the unique identifier of the user.

15. The computer program product according to claim 13, wherein obtaining an application credential further comprises receiving at the user'"'"'s computer device an application credential from the application issuer computer, and incorporating the unique identifier of the user into the received application credential at the user'"'"'s computer device.

16. The computer program product according to claim 15, wherein obtaining an application credential further comprises submitting proof of the validity of the unique identifier that was incorporated into a credential.

17. The computer program product according to claim 12, wherein determining whether the device related credential and the application credential relate to the same unique identifier is performed by means of a zero knowledge proof protocol.