Method of Securely Logging Into Remote Servers

• US 20100169962A1
• Filed: 03/22/2007
• Published: 07/01/2010
• Est. Priority Date: 03/22/2006
• Status: Active Grant

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Axalto S A
• Inventors: Lu, HongQuian Karen
• Granted Patent: US 8,434,137 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

The invention relates to a system comprising a network device (NSC), a host computer (HOST) and a remote server remote (SRV). The host computer (HOST) and the network device (NSC) server are connectable through a network. The host computer (HOST) and the remote server (SRV) are connectable through the Internet. The smart network device (NSC) comprises a web server accessible from the host computer (HOST). The network device (NSC) is set to store a user'"'"'s authentication credential. The host computer (HOST) is set to display a web page produced by the remote server (SRV) to the user. The remote server (SRV) is set to include a login link in said web page, the login link pointing to said web server. The web server is set to display a login page to the user on the host computer (HOST) when the user clicks on said login link, in order to authenticate the user. Upon authentication of the user, the network device (NSC) is set to send the user'"'"'s authentication credential to the remote server (SRV) in order to authenticate the user to the remote server (SRV).

Claims

1. A system comprising a network device (NSC), a host computer (HOST) and a remote server (SRV), wherein the host computer (HOST) and the network device (NSC) are connectable through a network, wherein the host computer (HOST) and the remote server (SRV) are connectable through the Internet, wherein the network device (NSC) comprises a web server accessible from the host computer (HOST), wherein the network device (NSC) is set to store a user'"'"'s authentication credential, wherein the host computer (HOST) is set to display a web page produced by the remote server (SRV) to the user, the system further comprising:

a. the remote server (SRV) is set to include a login link in said web page, the login link pointing to said web server;

b. said web server is set to display a login page to the user on the host computer (HOST) when the user clicks on said login link, in order to authenticate the user; and

c. upon authentication of the user, the network device (NSC) is set to send the user'"'"'s authentication credential to the remote server (SRV) in order to authenticate the user to the remote server (SRV).

2. The system according to claim 1, wherein the login link contains a generic domain name of the network device (NSC), and wherein the network device (NSC) comprises a Domain Name Server set to resolve said generic domain name.

3. The system according to claim 1, wherein the login link further comprises a parameter identifying the remote server (SRV).

4. The system according to claim 1, wherein the web page further comprises a session identifier.

5. The system according to claim 1 wherein the web page further comprises a script set to request a session identifier from the remote server (SRV).

6. The system according to claim 5, wherein the session identifier is obtained by an XMLHttpRequest object.

7. The system according to claim 4 wherein the network device (NSC) is set to send the session identifier to the remote server (SRV) together with the user'"'"'s authentication credential.

8. The system according to claim 1, wherein the login page comprises a button, and wherein the user requests the network device (NSC) to send the authentication credential to the remote server (SRV) by clicking the button.

9. The system according to claim 1, wherein all communications between the network device (NSC) and the remote server (SRV) are encrypted by SSL or TLS.

10. The system according to claim 1, wherein the remote server (SRV) is set to include a CAPTCHA in the web page, wherein the user has to input the data displayed in the CAPTCHA into the host computer (HOST), wherein the host computer (HOST) is set to send said data to the network device (NSC), and wherein the network device (NSC) is set to send said data securely to the remote server (SRV).

11. The system according to claim 1, wherein the network device (NSC) is a network smart card.

12. The system according to claim 11, wherein the network device (NSC) is a USB token.

13. A method for authenticating a user of a host computer (HOST) to a remote server (SRV), wherein the user has a network device (NSC), wherein the network device (NSC) and the host computer (HOST) are connectable through a network, wherein the host computer (HOST) and the remote server (SRV) are connectable through the Internet, wherein the user connects to the remote server (SRV) through a web page produced by the remote server (SRV) and displayed on the host computer (HOST), wherein the network device (NSC) is set to store a user'"'"'s authentication credential, wherein the network device (NSC) comprises a web server accessible from the host computer (HOST), the method comprising:

a. the remote server (SRV) is set to include a login link pointing to said web server in said web page

b. said web server is set to display a login page to the user on the host computer (HOST) when the user clicks on said login link, in order to authenticate the user; and

c. upon authentication of the user, the network device (NSC) is set to send the user'"'"'s authentication credential to the remote server (SRV) in order to authenticate the user to the remote server (SRV).

14. The method according to claim 13, wherein the login link contains a generic domain name of the network device (NSC), and wherein the network device (NSC) comprises a Domain Name Server set to resolve said generic domain name.

15. The method according to claim 13, wherein the login link further comprises a parameter identifying the remote server (SRV).

16. The method according to claim 13 wherein the web page further comprises a session identifier.

17. The method according to claim 13 wherein the web page further comprises a script set to request a session identifier from the remote server (SRV).

18. The method according to claim 17, wherein the session identifier is obtained by an XMLHttpRequest object.

19. The method according to claim 16, wherein the network device (NSC) is set to send the session identifier to the remote server (SRV) together with the user'"'"'s authentication credential.

20. The method according to claim 13, wherein the login page comprises a button, and wherein the user requests the network device (NSC) to send the authentication credential to the remote server (SRV) by clicking the button.

21. The method according to claim 13, wherein all communications between the network device (NSC) and the remote server (SRV) are encrypted by SSL or TLS.

22. The method according to claim 13, wherein the remote server (SRV) is set to include a CAPTCHA in the web page, wherein the user has to input the data displayed in the CAPTCHA into the host computer (HOST), wherein the host computer (HOST) is set to send said data to the network device (NSC), and wherein the network device (NSC) is set to send said data securely to the remote server (SRV).

23. The method according to claim 13, wherein the network device (NSC) is a network smart card.

24. The method according to claim 23, wherein the network device (NSC) is a USB token.

25. The method according to claim 13, wherein the method comprises the following steps:

a. The user types the address of the remote server (SRV) in a browser on the host computer (HOST);

b. The user connects his network device (NSC) with the host computer (HOST);

c. The user clicks on the login link inside the web page of the remote server (SRV);

d. The user authenticates to the network device (NSC) through the login page opened when clicking the login link, by using an authentication method of the network device (NSC); and

e. Upon authentication of the user, the network device (NSC) sends the authentication credential to the remote server (SRV) in order to authenticate the user to the remote server (SRV).