APPARATUS AND METHOD FOR INTEGRATING AUTHENTICATION PROTOCOLS IN THE ESTABLISHMENT OF CONNECTIONS BETWEEN COMPUTING DEVICES

• US 20110167484A1
• Filed: 03/14/2011
• Published: 07/07/2011
• Est. Priority Date: 09/22/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Hammell, Jonathan F., Brown, Michael K., Kirkup, Michael G., Robertson, Ian M., Little, Herbert A.
• Granted Patent: US 8,533,329 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

An apparatus and method for integrating authentication protocols in the establishment of connections between a controlled-access first computing device and at least one second computing device. In one embodiment, network access user authentication data needed to access the at least one second computing device is transmitted to an authentication server automatically if the user has access to use the first computing device, thereby not requiring the user to manually enter the authentication data needed for such access at the first computing device. The network access user authentication data may be, for example, retrieved from a memory store of the first computing device and/or generated in accordance with an authentication data generating algorithm.

Claims

1. A mobile device configured to integrate authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the processor is configured to:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiate user authentication at the remote device by transmitting user authentication data for the remote device to an authentication server;

wherein the user authentication data for the remote device transmitted to the authentication server comprises a combination of network access user authentication data stored on the mobile device and additional authentication data generated at the mobile device; and

wherein the processor is configured to retrieve formatting data stored on the mobile device, wherein the formatting data specifies a format for combining the network access user authentication data stored on the mobile device with the additional authentication data generated at the mobile device;

and wherein the processor is configured to format the user authentication data for the remote device, according to the format specified by the formatting data, prior to transmission of the user authentication data for the remote device to the authentication server.

2. The device of claim 1, wherein the authentication server resides on a third computing device coupled to the remote device.

3. The device of claim 1, wherein the authentication server resides on the remote device.

4. The device of claim 1, wherein the processor is further configured to:

receive device access user authentication data for requesting access to use the mobile device;

perform user authentication at the mobile device using the device access user authentication data; and

grant access to use the mobile device if the user authentication at the mobile device is successful.

5. The device of claim 1, wherein the connection connects the mobile device and the remote device in a virtual private network.

6. The device of claim 1, wherein the processor is configured to store the network access user authentication data in a memory store of the mobile device prior to negotiating user authentication at the remote device.

7. The device of claim 6, wherein the network access user authentication data is stored in the memory store after determining that storage of the network access user authentication data is permitted by an IT Policy governing the use of the mobile device.

8. The device of claim 6, wherein the network access user authentication data stored on the mobile device comprises a password.

9. The device of claim 1, wherein the additional authentication data generated at the mobile device is generated after determining that generation of the additional authentication data is permitted by an IT Policy governing the use of the mobile device.

10. The device of claim 1, wherein the additional authentication data generated at the mobile device is generated in accordance with a token generating algorithm.

11. The device of claim 10, wherein the token generating algorithm is a two-factor token generating algorithm.

12. The device of claim 1, wherein the processor is configured to set a state of an indicator to one of an active state and an inactive state to indicate whether the user authentication data for the remote device should be automatically transmitted to the authentication server, wherein the user authentication data for the remote device is transmitted automatically from the mobile device to the authentication server after determining that the indicator is set to the active state.

13. The device of claim 12, wherein the state of the indicator is settable remotely in accordance with an IT policy governing use of the mobile device.

14. The device of claim 1, wherein the processor is configured to retrieve the network access user authentication data from a different device prior to storing the network access user authentication data on the mobile device.

15. The device of claim 14, wherein the different device is configured to inform the remote device to expect a connection request from the mobile device, in response to network access user authentication data being retrieved from the different device by the mobile device.

16. The device of claim 1, wherein the processor is configured to format the user authentication data for the remote device as a string.

17. The device of claim 16, wherein the format requires the network access user authentication data stored on the mobile device to precede the additional authentication data generated at the mobile device in the string.

18. The device of claim 16, wherein the format requires the network access user authentication data stored on the mobile device to follow the additional authentication data generated at the mobile device in the string.

19. A method of integrating, on a mobile device, authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the processor performs acts of the method comprising:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiating user authentication at the remote device by transmitting user authentication data for the remote device to an authentication server;

wherein the user authentication data for the remote device transmitted to the authentication server comprises a combination of network access user authentication data stored on the mobile device and additional authentication data generated at the mobile device; and

wherein the processor is configured to retrieve formatting data stored on the mobile device, wherein the formatting data specifies a format for combining the network access user authentication data stored on the mobile device with the additional authentication data generated at the mobile device;

and wherein the processor is configured to format the user authentication data for the remote device, according to the format specified by the formatting data, prior to transmission of the user authentication data for the remote device to the authentication server.

20. A computer-readable medium comprising instructions for integrating, on a mobile device, authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the instructions when executed configures the processor to:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiate user authentication at the remote device by transmitting user authentication data for the remote device to an authentication server;

wherein the user authentication data for the remote device transmitted to the authentication server comprises a combination of network access user authentication data stored on the mobile device and additional authentication data generated at the mobile device; and

wherein the processor is configured to retrieve formatting data stored on the mobile device, wherein the formatting data specifies a format for combining the network access user authentication data stored on the mobile device with the additional authentication data generated at the mobile device;

and wherein the processor is configured to format the user authentication data for the remote device, according to the format specified by the formatting data, prior to transmission of the user authentication data for the remote device to the authentication server.