Adaptive authentication methods, systems, devices, and computer program products

• US 20070143832A1
• Filed: 12/21/2005
• Published: 06/21/2007
• Est. Priority Date: 12/21/2005
• Status: Active Grant

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Kreiner, Barrett, Perrella, Ronald, Bailey, Samuel
• Granted Patent: US 8,091,120 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method of providing data communications between first and second computing devices over a data network may include receiving a request for data communication at the first computing device from the second computing device over the data network. After receiving the request for data communication, a request for a credential according to an authentication standard may be transmitted from the first computing device to the second computing device, and the request for the credential may identify the authentication standard. After transmitting the request for the credential according to the authentication standard, a credential according to the authentication standard may be received, and the credential maybe verified. Responsive to receiving the request for data communication and responsive to verifying the authentication credential, the requested data communication may be allowed.

Claims

1. A method of providing data communications between first and second computing devices over a data network, the method comprising:

receiving a request for data communication at the first computing device from the second computing device over the data network;

after receiving the request for data communication, transmitting a request for a credential according to an authentication standard from the first computing device to the second computing device wherein the request for the credential identifies the authentication standard;

after transmitting the request for the credential according to the authentication standard, receiving a credential according to the authentication standard;

verifying the credential; and

responsive to receiving the request for data communication and responsive to verifying the authentication credential, allowing the requested data communication.

2. A method according to claim 1 further comprising:

after allowing the requested data communication, receiving a second request for data communication at the first computing device from the second computing device over the data network;

after receiving the second request for data communication, transmitting a request for a second credential according to a second authentication standard from the first computing device to the second computing device wherein the first and second authentication standards are different;

after transmitting the request for the second credential according to the second authentication standard, receiving a second credential according to the second authentication standard;

verifying the second credential; and

responsive to receiving the second request for data communication and responsive to verifying the second authentication credential, allowing the second requested data communication.

3. A method according to claim 2 wherein the first credential according to the first authentication standard comprises a credential assigned by one of the first and/or second computing devices and wherein the second credential according to the second authentication standard comprises a credential assigned by a certification authority independent of both of the first and second computing devices.

4. A method according to claim 2 wherein the first credential according to the first authentication standard comprises a credential assigned by a certification authority independent of both of the first and second computing devices and wherein the second credential according to the second authentication standard comprises a credential assigned by one of the first and/or second computing devices.

5. A method according to claim 2 wherein the first credential according to the first authentication standard is assigned by a first certification authority, wherein the second credential according to the second authentication authority is assigned by a second certification authority, wherein the first and second certification authorities are different, and wherein the first and second certification authorities are independent of both of the first and second computing devices.

6. A method according to claim 2 wherein the first credential comprises one of a digital certificate, a username/password, a secure token, a mobile network secret, a public/private key, and/or a ticket according to the first authentication standard, and wherein the second credential comprises one of a digital certificate, a username/password, a secure token, a mobile network secret, a public/private key, and/or a ticket according to the second authentication standard

7. A method according to claim 1 wherein transmitting a request for a credential comprises transmitting the request in a fault message from the first computing device to the second computing device.

8. A method according to claim 7 wherein the fault message comprises a fault message according to a Simple Object Access Protocol (SOAP).

9. A method according to claim 1 wherein the first computing device comprises a server computing device, wherein the second computing device comprises a client computing device, and wherein the data network comprises the Internet.

10. A method according to claim 1 further comprising:

before transmitting the request for a credential according to a currently acceptable authentication standard, receiving a first credential according to a first authentication standard; and

determining that the first authentication standard is not a currently acceptable authentication standard;

wherein transmitting the request for a credential according to the currently acceptable authentication standard comprises transmitting a request for a second credential according to a second authentication standard different than the first authentication standard and wherein verifying the credential comprises verifying the second credential.

11. A method of providing data communications between first and second computing devices over a data network, the method comprising:

transmitting a request for data communication from the first computing device to the second computing device over the data network;

after transmitting the request for data communication, receiving a request for a credential according to an authentication standard from the second computing device at the first computing device wherein the request for the credential identifies the authentication standard;

after receiving the request for the credential according to the authentication standard, transmitting a credential according to the authentication standard; and

after transmitting the credential, providing the requested data communication.

12. A method according to claim 11 further comprising:

after providing the requested data communication, transmitting a second request for data communication from the first computing device to the second computing device;

after transmitting the second request for data communication, receiving a request for a second credential according to a second authentication standard from the second computing device at the first computing device wherein the first and second authentication standards are different;

after receiving the request for the second credential according to the second authentication standard, transmitting a second credential according to the authentication standard; and

after transmitting the second credential, providing the second requested data communication.

13. A method according to claim 12 wherein the first credential according to the first authentication standard comprises a credential assigned by one of the first and/or second computing, devices and wherein the second credential according to the second authentication standard comprises a credential assigned by a certification authority independent of both of the first and second computing devices.

14. A method according to claim 12 wherein the first credential according to the first authentication standard comprises a credential assigned by a certification authority independent of both of the first and second computing devices and wherein the second credential according to the second authentication standard comprises a credential assigned by one of the first and/or second computing devices.

15. A method according to claim 12 wherein the first credential according to the first authentication standard is assigned by a first certification authority, wherein the second credential according to the second authentication authority is assigned by a second certification authority, wherein the first and second certification authorities are different, and wherein the first and second certification authorities are independent of both of the first and second computing devices.

16. A method according to claim 12 wherein the first credential comprises one of a digital certificate, a username/password, a secure token, a mobile network secret, a public/private key, and/or a ticket according to the first authentication standard, and wherein the second credential comprises one of a digital certificate, a username/password, a secure token, a mobile network secret, a public/private key, and/or a ticket according to the second authentication standard.

17. A method according to claim 11 wherein receiving a request for a credential comprises receiving the request in a fault message at the first computing device from the second computing device.

18. A method according to claim 17 wherein the fault message comprises a fault message according to a Simple Object Access Protocol (SOAP).

19. A method according to claim 11 wherein the first computing device comprises a client computing device, wherein the second computing device comprises a server computing device, and wherein the data network comprises the Internet.

20. A method according to claim 11 further comprising:

before receiving the request for a credential according to a currently acceptable authentication standard, transmitting a first credential according to a first authentication standard; and

wherein receiving the request for a credential according to the currently acceptable authentication standard comprises receiving a request for a second credential according to a second authentication standard different than the first authentication standard and wherein transmitting the credential comprises transmitting the second credential.