Systems and Methods for Secure Sign-Up Procedures for Application Servers in Wired and Wireless Environments

• US 20090260070A1
• Filed: 04/14/2009
• Published: 10/15/2009
• Est. Priority Date: 04/15/2008
• Status: Abandoned Application

• Current Assignee: Elevate Technologies Pty Limited
• Original Assignee: Elevate Technologies Pty Limited
• Inventors: Soliman, Hesham
• Application Number:
  US12/423,058
• Publication Number:
  US 20090260070A1
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Systems and methods of providing strong authentication for a client device to sign-up with an online service. Authentication can involve verifying user'"'"'s identity, message authentication, message integrity and nonrepudiation. The security procedures may, in some cases, be sufficient to verify all of these parameters. In other cases, the sign-up procedure needs to be combined with other information in order to verify the user'"'"'s real identity.

Claims

1. A method of generating information for secure data exchange with an application server, the method comprising:

performing, by a client device, an authentication with an authentication server of a wireless communication network;

sending, by the client device, a signup message to the application server, the signup message includes a signup form and a requested username;

receiving, by the client device, a signup acknowledgement message from the application server, the signup acknowledgement message includes an accepted username and a root key; and

storing, by the client device, the accepted username and root key, wherein the accepted username and root key are employed for secure data exchange with the application server, and the application server and client device do not have a prior security relationship.

2. The method of claim 1, further comprising:

generating, by the client device, an application-specific key using information obtained from the authentication with the authentication server.

3. The method of claim 2, wherein the application-specific key is generated by generating a hash value from a session key from the authentication with the authentication server and an application label.

4. The method of claim 2, wherein the authentication server generates an application-specific key using information obtained from the authentication with the authentication server and provides the application-specific key to the application server.

5. The method of claim 1, wherein the signup message includes a nonce.

6. The method of claim 1, wherein when the requested username is already reserved, the accepted username received in the signup acknowledgement message includes a list of suggested usernames.

7. The method of claim 1, wherein the signup form includes a billing method and payment information.

8. The method of claim 1, wherein the signup acknowledgement message also includes an authentication method for the secure data exchange.

9. The method of claim 1, further comprising:

requesting, by the client device from the application server, a security credential; and

providing the security credential to another client device, wherein the application server associates the another client device with a user of the client device.

10. The method of claim 9, wherein the another client device performs the acts of:

performing an authentication with the authentication server of the wireless communication network;

sending a signup message to the application server, the signup message includes a signup form, the requested username and the security credential;

receiving a signup acknowledgement message from the application server, the signup acknowledgement message includes the accepted username and the root key; and

storing the accepted username and root key, wherein the accepted username and root key are employed for secure data exchange with the application server.

11. A method of generating information for secure data exchange with an application server, the method comprising:

obtaining, by a client device, a certificate for an application associated with the secure exchange of data;

generating, by the client device, a key;

sending, by the client device to the application server, a signup message to an application server, the signup message including the generated key, a requested username and a requested password;

receiving, by the client device from the application server, a signup acknowledgement message, the signup acknowledgement message include an accepted username, an accepted password and a certificate for the secure data exchange.

12. The method of claim 11, wherein the key generated by the client device is a public key.

13. The method of claim 11, wherein the key generated by the client device is a root key.

14. The method of claim 11, wherein the signup message also includes a user information form.

15. The method of claim 14, wherein the user information form includes a billing method and payment information.

16. The method of claim 11, wherein when the requested username is already reserved, the accepted username received in the signup acknowledgement message includes a list of suggested usernames.

17. The method of claim 11, wherein the signup acknowledgement message also includes an authentication method for the secure data exchange.

18. The method of claim 11, further comprising:

requesting, by the client device from the application server, a security credential; and

providing the security credential to another client device, wherein the application server associates the another client device with a user of the client device.