Authentication management platform for managed security service providers

• US 20060288405A1
• Filed: 06/01/2005
• Published: 12/21/2006
• Est. Priority Date: 06/01/2005
• Status: Active Grant

• Current Assignee: Rakuten Group, Inc.
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Lee, Jonathan C., Drake, Alton W. II, Furst, Cheryl L., Holloway, James W., Hurr, Tien Y., Wallace, Michael F., Albisu, Luis F.
• Granted Patent: US 7,707,626 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

An authentication management platform that enables authentication systems from various vendors to be integrated into a single service offering. The disclosed arrangement can support multiple, distinct customers and multiple primary authentication servers on a single platform. The management platform provides access only to users that enter a valid passcode comprising both: (1) a personal identification number (PIN) and (2) the current code generated by a security token card assigned to that user. The authentication management platform may be configured to be controlled and maintained by the subscriber to the system, or may be serviced/maintained by a third party service provider.

Claims

1. A method of authenticating a user to a plurality of disparate network elements and network systems having unique validation arrangements using a single authentication procedure, the method comprising the steps of:

maintaining a centralized database of a plurality of authenticated users and associated user IDs/personal identification numbers (PINs) for the plurality of disparate network elements and network systems;

storing a security token generator at the centralized database; and

distributing a separate security token card to each authenticated user.

2. The method as defined in claim 1 wherein the method further includes the step of:

an authenticated user activating his associated security token card with the entry of a valid user ID/PIN and valid, current token security code, providing access to the plurality of disparate network elements and network systems in the single authentication procedure.

3. The method as defined by claim 1 wherein a third party vendor maintains the centralized database and distributes the security token cards to validated users.

4. The method as defined by claim 1 wherein a corporate system subscriber maintains the centralized database and distributes the security tokens to validated users.

5. The method as defined by claim 1 wherein the step of establishing a plurality of authenticated users includes the step of adding new users to an established database of user IDs.

6. The method as defined in claim 1 wherein the step of distributing security token cards comprises the step of delivering security token cards to authenticated users utilizing an outside delivery system.

7. The method as defined in claim 1 wherein the method further comprises the step of re-synchronizing a distributed security token with the security token generation upon receiving a predetermined number of invalid entry attempts at the centralized database.

8. An authentication management platform for authenticating a user to a plurality of disparate network elements and network systems using a single authentication procedure, the authentication management platform comprising

a centralized database of user IDs/personal identification numbers (PINs) associated with a plurality of authenticated users permitted access to the plurality of disparate network elements and network systems;

and

a security token generator for interacting with a plurality of synchronized security token cards in the possession of authenticated users, the security token generator for providing a unique password for a one-time login attempt, with new passwords being generated at predetermined intervals, wherein in order to access the plurality of disparate network elements and network systems, a potential user accesses the management platform and provides a user ID/PIN and a current value of his security token card.

9. The authentication management platform as defined in claim 8 wherein the authentication management platform resides at a subscriber'"'"'s location and is maintained by the subscriber.

10. The authentication management platform as defined in claim 8 wherein the authentication management platform resides at a network location and is maintained by a third party.