Authentication

• US 20100024019A1
• Filed: 05/02/2007
• Published: 01/28/2010
• Est. Priority Date: 05/03/2006
• Status: Active Grant

• Current Assignee: Emillion Oy
• Original Assignee: Emillion Oy
• Inventors: Backlund, Kjell
• Granted Patent: US 8,683,565 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

User authentication is based on a home network user database that authenticates users to external service providers. A user logs into home network and starts accessing the external service by clicking on a link labelled for the external service provider. The link is directed to script at a home server. The script causes the home server to obtain details related to the user from a home network user database. The home server passes information related to the user to a foreign server associated with the service provider. Based on the passed information, the foreign server grants or denies authentication of the user to the external service. If granting, the foreign server provides the home server with access data and the home server forwards the access data to the user so that the user can initialise an authorised external service session using the access data.

Claims

1. In a home server of an organisation, a method for obtaining access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with the home server and with a foreign server, the foreign server being capable of granting access to the external service, the method comprising:

detecting a request of the client;

maintaining a shared secret common to the organisation and the external service;

identifying in the request a pointer to an authentication script;

responsive to the request, performing by the authentication script;

obtaining at least one detail related to the user;

passing the at least one detail and the shared secret or a derivative of the shared secret to the foreign server;

receiving from the foreign server access data that enables the client to access the external service; and

passing the access data to the client.

2. A method according to claim 1, wherein the at least one detail comprises at least one of the following:

one or more particulars from a user profile of the home server; and

an identifier that specifies the user within the organisation.

3. A method according to claim 1, wherein the request comprises a Universal Resource Indicator (URI) or a Universal Resource Locator (URL).

4. A method according to any claim 2, wherein the foreign server creates and maintains user profiles based on the at least one detail.

5. A method according to any claim 2, wherein the obtaining of the at least one detail comprises accessing a database of personnel or members.

6. A method according to any claim 2, wherein the access data comprises an address to the external service.

7. A home server for obtaining access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with the home server and with a foreign server, the foreign server being capable of granting access to the external service, the home server comprising:

means for detecting a request of the client;

a memory for storing a shared secret common to the organisation and the external service;

a processor configured to identify in the request a pointer to an authentication script and, responsive to the request, to perform by the script;

obtaining at least one detail related to the user;

passing the at least one detail and the shared secret or a derivative of the shared secret to the foreign server;

receivinge from the foreign server access data that enables the client to access the external service; and

passing the access data to the client.

8. A home server according to claim 7, wherein the at least one detail comprises hashed derivative information.

9. A home server according to claim 7, wherein the request comprises a Universal Resource Indicator (URI) or a Universal Resource Locator (URL).

10. A home server according to claim 7, wherein the obtaining of the at least one detail comprises accessing a database of personnel or members.

11. A home server according to claim 7, wherein the access data comprises an address to the external service.

12. In a foreign server, a method for providing access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with a home server and with the foreign server, wherein the home server is associated with a given organisation, the method comprising:

receiving from the home server a) a shared secret common to the organisation and the external service or a derivative of the shared secret and b) at least one detail related to the user;

determining the organisation associated with the home server, based on the shared secret; and

responsively to a positive determination, providing the home server with access data that enables the client to access the external service.

13. A method according to claim 12, further comprising generating a temporary address for the user.

14. A method according to claim 12, further comprising detecting an access communication from the client to the temporary address and responsively establishing an authenticated session with the client.

15. A method according to any one of claims 12, wherein the foreign server creates and maintains user profiles based on the at least one detail.

16. A method according to claims 12, wherein in that the foreign server derives the user profiles based on the at least one detail using a rule specific to the organisation of the user.

17. A method according to claim 012, further comprising detecting an access communication from the client, which access communication is based on the access data, and responsively to said detecting, generating an authenticated session based on the access data and at least one detail related to the client, for allowing the client to access the external service.

18. A foreign server for providing access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with a home server and with the foreign server, wherein the home server is associated with a given organisation, the foreign server comprising:

means for receiving from the home server a) a shared secret common to the organisation and the external service or a derivative of the shared secret and b) at least one detail related to the user;

means for determining the organisation associated with the home server, based on the shared secret; and

means for providing the home server with access data that enables the client to access the external service, responsively to a positive determination.

19. A foreign server according to claim 18, the foreign server further comprising means for generating a temporary access for the user.

20. A foreign server according to claim 18, the foreign server further comprising means for detecting an access communication from the client to the temporary address and means for responsively establishing an authenticated session with the client.

21. A foreign server according to claim 18, wherein the foreign server is configured to create and maintain user profiles based on the at least one detail.

22. A foreign server according to claim 18, wherein the foreign server is configured to derive the user profiles based on the at least one detail using a rule specific to the organisation of the user.

23. A foreign server according to claim 18, further comprising means for detecting an access communication from the client, which access communication is based on the access data, and means for generating an authenticated session based on the access data and at least one detail related to the client responsively to said detecting of the access communication.

24. A computer program comprising computer executable program code stored in a computer readable medium, the program being configured to control a home server of an organisation to obtain access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with the home server and with a foreign server, the foreign server being capable of granting access to the external service, the computer program comprising computer program code configured when run by the home server to:

detect a request of the client;

maintain a shared secret common to the organisation and the external service;

identify in the request a pointer to an authentication script;

responsive to the request, perform by the authentication script;

obtain at least one detail related to the user;

pass the at least one detail and the shared secret or a derivative of the shared secret to the foreign server;

receive from the foreign server access data that enables the client to access the external service; and

pass the access data to the client.

25. A computer program comprising computer executable program code stored in a computer readable medium, the program being configured to control a foreign server to provide access for a user to an external service in a networked environment wherein the user has access to a client that is capable of communicating with a home server and with the foreign server, wherein the home server is associated with a given organisation, the computer program comprising computer program code configured when run by the foreign server to:

receive from the home server a) a shared secret common to the organisation and the external service or a derivative of the shared secret and b) at least one detail related to the user;

determine the organisation associated with the home server, based on the shared secret; and

responsively to a positive determination, to provide the home server with access data that enables the client to access the external service.