System and method for over the air communication authentication using a service token

• US 20090138717A1
• Filed: 05/11/2007
• Published: 05/28/2009
• Est. Priority Date: 05/11/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Danger Incorporated (Microsoft Corporation)
• Inventors: Montemayor, Oscar A., Gebhardt, Henry W. III, Khadilkar, Mandar, Britt, Joe Freeman JR., Calamera, Pablo
• Granted Patent: US 8,296,835 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A system and method are described for securing over the air communications between a service and a communication device. For example, one embodiment of a method for creating a security token on a communication device for communication between the communication device and a service includes combining a device identification of the communication device with a device capability to create a device information, the device capability known by the service. The method further includes encrypting the device information.

Claims

1. A service for creating a security token for authenticating communication between a communication device and the service, comprising:

a module to combine an at least one property of an image to be sent to the communication device with an at least one device capability to create a token, the device capability known by the device or the service.

2. The service of claim 1, further comprising:

a module to store an information about the token on the service; and

a module to store an information about the device to which the token is to be sent on the service.

3. The service of claim 2, wherein the stored information is an entry in a database of the service, wherein all entries in the database is indexed by a device id of the device to receive the token.

4. The service of claim 2, wherein the information about the token includes when the token was created and/or the token.

5. The service of claim 2, wherein the information about the device includes a session identification of a communication session during which the token is to be sent to the device.

6. The service of claim 1, further comprising a module to encrypt the token.

7. A method for authenticating communication between a service and a communication device, comprising:

creating a service token on the service;

sending the service token to the communication device;

receiving a service token from the communication device;

determining if the received service token is the same as the sent service token; and

authenticating communication between the service and the communication device if the received service token is the same as the sent service token.

8. The method of claim 7, further comprising:

receiving a device token from the communication device; and

determining if the received device token is valid;

wherein authenticating communication between the service and the communication device further depends on if the received device token is valid.

9. The method of claim 8, wherein determining if the received device token is valid includes extracting a unique device identifier from the received device token.

10. The method of claim 9, wherein the unique device identifier is an International Mobile Equipment Identity (IMEI).

11. The method of claim 10, wherein determining if the received device token is valid further includes performing a Luhn Check on the IMEI.

12. The method of claim 10, wherein determining if the received device token is valid further includes determining if the IMEI is within a range of IMEI'"'"'s for a valid carrier.

13. The method of claim 8, wherein determining if the received device token is valid includes:

extracting a device characteristic of the communication device from the device token; and

determining if the device characteristic is valid.

14. The method of claim 7, further comprising:

storing an information about a communication session through which the service token is sent to the communication device;

receiving an information about a communication session through which the service token is received from the communication device; and

determining if the communication session through which the service token is sent is the same communication session through which the service token is received from the communication device;

wherein authenticating communication between the service and the communication device further depends on if the communication session through which the service token is sent is the same communication session through which the service token is received.

15. The method of claim 7, further comprising:

determining if a time between when the service token is created and when the service token is received from the communication device is below a predetermined threshold;

wherein authenticating communication between the service and the communication device further depends on if the time is below a predetermined threshold.

16. A service for authenticating communication between the service and a communication device, comprising:

a module to create a service token;

a module to send the service token to the communication device;

a module to receive a service token from the communication device;

a module to determine if the received service token is the same as the sent service token; and

a module to authenticate communication between the service and the communication device if the received service token is the same as the sent service token.

17. The service of claim 16, further comprising:

a module to receive a device token from the communication device; and

a module to determine if the received device token is valid;

wherein authenticating communication between the service and the communication device further depends on if the received device token is valid.

18. The service of claim 17, wherein determining if the received device token is valid includes extracting a unique device identifier from the received device token.

19. The service of claim 18, wherein the unique device identifier is an International Mobile Equipment Identity (IMEI).

20. The service of claim 19, wherein determining if the received device token is valid further includes performing a Luhn Check on the IMEI.

21. The service of claim 19, wherein determining if the received device token is valid further includes determining if the IMEI is within a range of IMEI'"'"'s for a valid carrier.

22. The service of claim 17, wherein determining if the received device token is valid includes:

extracting a device characteristic of the communication device from the device token; and

determining if the device characteristic is valid.

23. The service of claim 16, further comprising:

a module to store an information about a communication session through which the service token is sent to the communication device;

a module to receive an information about a communication session through which the service token is received from the communication device; and

a module to determine if the communication session through which the service token is sent is the same communication session through which the service token is received from the communication device;

wherein authenticating communication between the service and the communication device further depends on if the communication session through which the service token is sent is the same communication session through which the service token is received.

24. The service of claim 16, further comprising:

a module to determine if a time between when the service token is created and when the service token is received from the communication device is below a predetermined threshold;

wherein authenticating communication between the service and the communication device further depends on if the time is below a predetermined threshold.