Network access system which is adapted for the use of a simplified signature method, and server used to implement same

• US 20070056021A1
• Filed: 09/07/2004
• Published: 03/08/2007
• Est. Priority Date: 09/23/2003
• Status: Active Grant

• Current Assignee: Orange France (Orange S.A.)
• Original Assignee: Orange France (Orange S.A.)
• Inventors: Annic, Etienne, Bauban, Patrick, Sahnoun, Rym, Goutard, Cedric, Boutroux, Anne
• Granted Patent: US 7,823,188 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

The invention relates to a system for accessing a packet-switching network (4), which is adapted for the use of a simplified signature method. The inventive system comprises a supplementary server (60) which is independent of a proxy server (50) of an access provider (12) and a simplified signature module (60) which is provided in the supplementary server (60). The proxy server (50) is equipped with an interface (64) which enables the connection of said proxy server to the supplementary server (60) and the transmission of at least the authentication requests sent by contacted service providers to the supplementary server (60) in order for said requests to be processed by the simplified signature module (60).

Claims

1-13. -13. (canceled)

14. System for access to a packet switching network suitable for implementing a simplified signature method, this system comprising:

a proxy server through which all the data flows pass which are exchanged between a user and the network,

a plurality of service providers which are connected to the network, each service provider being capable of transmitting an authentication request to the user who contacts it in order to identify and/or authenticate this user before providing him with personalised and/or secure services, the response to be provided by the same user to this authentication request being able to be different in accordance with the service provider contacted,

at least one authentication server which is capable of storing at least one item of authentication data for each user and transmitting, in response to an authentication request, an authentication response which contains an item of authentication data in accordance with both the service provider who transmitted the authentication request and the identity of the user who contacted this service provider, and

a simplified signature module which is capable of automatically processing on behalf of the user the authentication requests transmitted by the service providers contacted, this module being capable for each user;

of directing the authentication requests to the appropriate authentication server, and

of transmitting to the service provider the corresponding authentication response transmitted by the appropriate authentication server,

wherein it comprises a supplementary server which is independent from the proxy server, the simplified signature module being implemented in this supplementary server, and wherein the proxy server is provided with an interface which allows it to be connected to the supplementary server and allows at least the authentication requests transmitted by the service providers contacted to be transmitted to the supplementary server in order to process these requests using the simplified signature module.

15. System according to claim 14, wherein the simplified signature module comprises a sub-module which is capable of identifying the user from his network address and adding an identifier of the user to the authentication requests directed to the authentication servers.

16. System according to claim 14, wherein the at least one item of authentication data stored for each user comprises an item of data relating to a level of authentication available for this user, wherein each authentication request transmitted by a service provider specifies features relating to the authentication level required by this service provider in order to be able to access the services it provides, wherein the or each authentication server is capable of comparing the features relating to the required authentication level specified by the authentication request with the data relating to the authentication level available in order to determine whether the authentication level required corresponds to the authentication level available for this user, and wherein the or each authentication server is capable of transmitting to the user an active authentication request which is capable of activating an interactive process for identification and/or authentication of the user if the authentication level required does not correspond to the authentication level available.

17. System according to claim 16, wherein the supplementary server comprises a sub-module which is capable of directing the response of the user to the active authentication requests to the authentication server which has transmitted it.

18. System according to claim 16, wherein the supplementary server comprises a sub-module which is capable of directing the active authentication request to the user.

19. System according to claim 14, wherein the simplified signature module comprises a sub-module which is capable of adding, to the requests transmitted by the user to a service provider, an identification signal of a simplified signature service, in response to which the service provider transmits the authentication request.

20. System according to claim 14, wherein the supplementary server and the proxy server are capable of communicating with each other using a Hyper Text Transfer Protocol (HTTP).

21. System according to claim 20, wherein the Hyper Text Transfer Protocol is the iCAP protocol (Internet Content Adaptation Protocol) or the OCP protocol (OPES Call Out Protocol).

22. System according to claim 20, wherein the supplementary server is capable of communicating with the service providers only by means of the Hyper Text Transfer Protocol used between it and the proxy server.

23. System according to claim 14, wherein the supplementary server also implements an HTTP (Hyper Text Transfer Protocol) server and/or client in order to communicate directly with the or each service provider and/or the or each authentication server using only the HTTP protocol.

24. System according to claim 14, wherein it comprises a provider of access to the network to which the user must be connected in order to be able to access the network, this access provider being provided with the proxy server.

25. System according to claim 14, wherein the network is the World Wide Web.

26. Supplementary server which is capable of being used in a system according to claim 14, wherein it comprises the simplified signature module which is capable of automatically processing on behalf of the user the authentication requests transmitted by the or each service provider contacted, and is capable of communicating with a proxy server in order to receive at least the authentication requests transmitted by the service providers.