Method and System for the Authentication of a User of a Data Processing System

• US 20080295159A1
• Filed: 11/07/2003
• Published: 11/27/2008
• Est. Priority Date: 11/07/2003
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Sentinelli, Mauro
• Granted Patent: US 8,166,524 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A method of authenticating a user'"'"'s data processing terminal for granting the data processing terminal access to selected services provided by a data processing system. The method includes performing a first, SIM-based authentication of the user'"'"'s data processing terminal at an authentication data processing server in the data processing system, by operatively associating with the user'"'"'s data processing terminal a first subscriber identity module issued to the data processing terminal user, for example, of a type adopted in mobile communication networks for authenticating mobile communication terminals. The authentication of the user'"'"'s data processing terminal in the data processing system is conditioned to a second authentication, based on identification information provided to the user at a mobile communication terminal through a mobile communication network to which the mobile communication terminal is connected, e.g. in the form of an SMS message.

Claims

1-32. -32. (canceled)

33. A method of authenticating a data processing terminal of a user for granting the data processing terminal access to selected services provided by a data processing system, the user being provided with an authenticatable mobile communication terminal adapted to be used in a mobile communication network, comprising:

performing a first, SIM-based authentication of the user'"'"'s data processing terminal in the data processing system at an authentication data processing server, said performing the SIM-based authentication comprising operatively associating with the user'"'"'s data processing terminal a first subscriber identity module issued to the data processing terminal user;

having the user'"'"'s mobile communication terminal authenticated in the mobile communication network; and

conditioning the authentication of the user'"'"'s data processing terminal in the data processing system to a second authentication, said second authentication being based on identification information provided to the user at the mobile communication terminal through the mobile communication network.

34. The method according to claim 33, wherein said second authentication comprises:

generating a first password at the authentication data processing server;

sending the first password to the mobile communication terminal over the mobile communication network; and

checking a correspondence between the first password and a second password, depending on the first password, entered at the data processing terminal and provided to the authentication data processing server through the data processing system.

35. The method according to claim 34, comprising having the user entering the second password through the data processing terminal.

36. The method according to claim 34, wherein the second password is entered automatically upon receipt of the first password at the user'"'"'s mobile communication terminal.

37. The method according to claim 34, wherein said first password is usable a limited number of times, or one time only.

38. The method according to claim 33, comprising issuing to the user a second subscriber identity module adapted to be used in the user'"'"'s mobile communication terminal for authentication thereof in the mobile communication network.

39. The method according to claim 38, wherein the second subscriber identity module has a fixed, one-to-one relationship with the first subscriber identity module.

40. The method according to claim 38, wherein the first subscriber identity module is associated with an identifier of the second subscriber identity module, or a mobile communication terminal number.

41. The method according to claim 33, wherein said identification information is sent to the user'"'"'s mobile communication terminal by way of a short message service message.

42. The method according to claim 33, wherein said first subscriber identity module is of a type adopted in mobile communication networks for authenticating mobile communication terminals.

43. The method according to claim 42, wherein said performing the first, SIM-based authentication of the data processing terminal comprises having the first subscriber identity module authenticated by an authentication server of the data processing system, the authentication server acting substantially as an authentication center of a mobile communication network operator.

44. A method by which a data processing terminal in a data processing system is authenticated in order to be granted access to selected services provided by the data processing system, the method comprising:

interacting with a first user'"'"'s subscriber identity module (SIM) operatively associated with the data processing terminal, and with an authentication data processing server in the data processing system, for performing a SIM-based authentication of the user'"'"'s data processing terminal;

acquiring personal identification information provided to the user at a user'"'"'s mobile communication terminal authenticated through a mobile communication network; and

sending said personal identification information to the authentication data processing server for completing the authentication of the data processing terminal.

45. The method of claim 44, in which the first subscriber identity module is of a type adopted in mobile communication networks for authenticating mobile communication terminals.

46. The method of claim 45, further comprising:

retrieving SIM identification data from the first subscriber identity module;

communicating the retrieved SIM identification data to the authentication server, the authentication server acting substantially as an authentication center of a mobile communication network operator;

receiving from the authentication server SIM authentication data corresponding to the SIM identification data, and passing the SIM identification data to the first subscriber identity module; and

communicating to the authentication server a response generated by the first subscriber identity module.

47. A computer program directly loadable into a working memory of a data processing terminal capable of performing, when executed, the method according to claim 44.

52. A computer program product comprising a computer readable medium on which the computer program of claim 47 or 51 is stored.

62. An authentication kit for authenticating a user'"'"'s data processing terminal in a data processing system in order to grant the data processing terminal access to selected services provided by the data processing system, comprising:

a first subscriber identity module;

a computer peripheral device having associated therewith the first subscriber identity module and operatively associatable with the user'"'"'s data processing terminal;

a second subscriber identity module operatively associated with a user'"'"'s mobile communication terminal for allowing connection thereof to a mobile communication network; and

the computer program product of claim 52.

48. A method by which an authentication data processing server authenticates a user'"'"'s data processing terminal in a data processing system in order to grant the data processing terminal access to selected services provided by the data processing system, comprising:

receiving a request of authentication of the data processing terminal, the data processing terminal having operatively associated therewith a first subscriber identity module;

performing a SIM-based authentication of the data processing terminal based on data associated with the first subscriber identity module;

providing the user with first personal identification information by exploiting a user'"'"'s mobile communication terminal authenticated in a mobile communication network; and

conditioning the authentication of the user'"'"'s data processing terminal to a prescribed correspondence between the first personal identification information provided to the user and second personal identification information received from the user'"'"'s data processing terminal in reply to the provision of the first personal identification information.

49. The method according to claim 48, wherein the first subscriber identity module is of a type adopted in mobile communication networks for authenticating mobile communication terminals, the authentication data processing server acting substantially as an authentication center of a mobile communication network operator.

50. The method according to claim 49, further comprising:

generating at the authentication data processing server a first password and sending the first password over the mobile communication network to the user'"'"'s mobile communication terminal; and

conditioning the authentication of the data processing terminal in the data processing system to a prescribed correspondence between the first password and a second password, depending on the first password, entered at the data processing terminal and provided to the authentication data processing server through the data processing system.

51. A computer program directly loadable into a working memory of an authentication data processing system capable of performing, when executed, the method according to claim 48.

53. In a data processing system, a system for authenticating a data processing terminal of a user so as to grant the data processing terminal access to selected services provided by the data processing system, the user having an authenticatable mobile communication terminal adapted to be used in a mobile communication network, comprising:

a first subscriber identity module operatively associatable with the data processing terminal; and

an authentication data processing server adapted to carry out a first authentication step based on the first subscriber identity module;

the authentication data processing server being further adapted to carry out a second authentication process based on identification information provided to the user at the mobile communication terminal through the mobile communication network.

54. The system according to claim 53, wherein the first subscriber identity module is of a type adopted in mobile communication networks for authenticating mobile communication terminals.

55. The system according to claim 54, comprising a second subscriber identity module to be used in the mobile communication terminal for authenticating the mobile communication terminal in a mobile communication network.

56. The system according to claim 55, wherein the second subscriber identity module is in a fixed, one-to-one relationship with the first subscriber identity module.

57. The system according to claim 55, wherein the second subscriber identity module is associated with an identifier of the second subscriber identity module, particularly a mobile communication terminal number.

58. The system according to claim 53, wherein said first subscriber identity module is associated with a device connectable to the computer through a computer peripheral connection port.

59. The system according to claim 53, wherein said mobile communication network is one among a GSM, a GPRS, and a UMTS network.

60. An authentication kit for authenticating a user'"'"'s data processing terminal in a data processing system in order to grant the data processing terminal access to selected services provided by the data processing system, comprising:

a first subscriber identity module;

a computer peripheral device having associated therewith the first subscriber identity module and operatively associatable with the user'"'"'s data processing terminal; and

a second subscriber identity module operatively associated with a user'"'"'s mobile communication terminal for allowing connection thereof to a mobile communication network.

61. The authentication kit according to claim 60, wherein the first subscriber identity module is of a type adopted in mobile communication networks for authenticating mobile communication terminals.