Authentication method and system for asynchronous eventing over the internet

• US 20070050630A1
• Filed: 02/14/2006
• Published: 03/01/2007
• Est. Priority Date: 08/24/2005
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Messer, Alan, Cheng, Doreen, Kumar, Praveen, Song, Yu
• Application Number:
  US11/354,405
• Publication Number:
  US 20070050630A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

An authentication method and system is provided for asynchronous eventing between a client and a server over the Internet. In a subscription phase, the client sends a subscription request to the server to express interest in receiving notifications associated with one or more particular events that may asynchronously occur on the server. The client authenticates the server by checking the identity of the server, and if the client determines that the server can be trusted, the client subscribes the notifications, otherwise, the client does not subscribe. After a successful subscription, in a notification phase, the server notifies each client that has subscribed for a particular type of event. Each client upon receiving a notification, authenticates the server by verifying that the received notification is sent by the server with which the client subscribed for the notification.

Claims

1. A method for authenticating eventing between a first node and a second node in a network, comprising the steps of:

in a subscription phase, the first node sending a subscription request to the second node to express interest in receiving notifications associated with one or more particular events that may asynchronously occur on the second node;

the first node authenticating the second node by checking the identity of the second node, and if the first node determines that the second node can be trusted, the first node subscribes events from the second node, otherwise, the first node does not subscribe;

after a successful subscription, in a notification phase, the second node notifying each first node that has subscribed for a particular type of event; and

each first node upon receiving a notification, authenticating the second node by verifying that the received notification is sent by the second node with which the first node subscribed for the notification.

2. The method of claim 1 wherein the network includes the Internet.

3. The method of claim 1 wherein the first node comprises a CE device.

4. The method of claim 1 wherein the second node comprises a CE device.

5. The method of claim 1 wherein the first node and the second node utilize secure communication links.

6. The method of claim 1 wherein the first node and the second node utilize a communication link through which communicating parties can securely verify the identity of each other.

7. The method of claim 6 wherein the first node and the second node utilize Source Authenticate-able Links (SAL) for eventing communications.

8. The method of claim 1 wherein the first node and the second node utilize InSecure Links (ISL) for eventing communications.

9. The method of claim 1 wherein the first node and the second node utilize Source Authenticate-able Links for subscription phase communications, and InSecure Links for notification phase communications.

10. The method of claim 9 wherein upon receiving a notification, the first node uses the domain name included in a Web page pointed to by an HTTPS URL link embedded in a notification email from the second node verify the identity of the second node.

11. The method of claim 1 wherein the first node and the second node utilize Source Authenticate-able Links (SAL) for subscription phase and notification phase communications

12. The method of claim 11 wherein upon receiving a notification from a second node, the first node verifies identity of that second node using the SAL.

13. The method of claim 1 wherein Source Authenticate-able Links protocol is utilized for authentication, and ISL is used for sending notifications.

14. The method of claim 13 wherein the first node and second node use challenge/response protocol for verification of second node identity during the notification phase.

15. The method of claim 1 wherein the first node and second node use Source Authenticate-able Links (SAL) communication protocol for both subscription and notification.

16. The method of claim 15 wherein a cookie, generated during the subscription phase, is used during the notification phase for verification of the identity of the second node.

17. The method of claim 1 wherein the first node and the second node use Source Authenticate-able Links (SAL) communication protocol during the subscription phase, and during the notification phase a notification is signed by the second node using a private key, wherein the notification is sent to the first node by ISL, wherein the first node verifies the signature using the second node'"'"'s public key.

30. The system of claim 1 wherein the second node comprises a CE device.

18. An authenticating eventing system, comprising:

a first node and a second node, wherein in a subscription phase, the first node sends a subscription request to the second node to express interest in receiving notifications associated with one or more particular events that may asynchronously occur on the second node;

the first node authenticates the second node by checking the identity of the second node, and if the first node6 determines that the second node can be trusted, the first node subscribes notifications, otherwise, the first node does not subscribe;

after a successful subscription, in a notification phase, the second node notifies each first node that has subscribed for a particular type of event; and

each first node upon receiving a notification, authenticates the second node by verifying that the received notification is sent by the second node with which the first node subscribed for the notification.

19. The system of claim 18, wherein the network includes multiple first nodes, such that:

in the subscription phase each first node sends a subscription request to the second node to express interest in receiving notifications associated with particular events that may asynchronously occur on the second node; and

in the notification phase, after successful subscription, the second node notifies each first node that has subscribed for a particular type of event.

20. The system of claim 18, wherein the network includes multiple servers, such that:

in the subscription phase the first node sends a subscription request to each second node to express interest in receiving notifications associated with particular events that may asynchronously occur on that second node; and

in the notification phase, after successful subscription, each second node notifies each first node that has subscribed for a particular type of event.

21. The system of claim 18, wherein when an asynchronous event occurs, the second node publishes the event and sending a notification directly to the first node.

22. The system of claim 18, wherein when an asynchronous event occurs, the first node polls for notifications directly from the second node.

23. The system of claim 18, wherein when an asynchronous event occurs, the second node publishes the event on a notification center in the network, wherein the notification center sends a notification to the first node.

24. The system of claim 18, wherein when an asynchronous event occurs, the second node publishes the event on a notification center in the network, wherein the first node polls the notification center for the notification.

25. The system of claim 18, wherein the network further includes a notification center, such that:

in the subscription phase the first node sends a subscription request to the notification center to request notifications for one or more events from one or more second nodes; and

in the notification phase, after a successful subscription, the first node polls the notification center for notification.

26. The system of claim 25 wherein further each second node sends a subscription request to the notification center for permission to publish events on the notification center;

after a successful server subscription, the second node publishes events on the notification center as they occur on the server; and

the notification center notifies each first node of published notifications that the first node subscribed for with the notification center.

27. The system of claim 18 where the network includes a local area network (LAN) such that the first node and the second node are connected to the LAN.

28. The system of claim 18 where the network includes the Internet a local area network (LAN) such that the first node and the second node are connected to the Internet.

29. The system of claim 18 wherein the first node comprises a CE device.