Authenticating Cloud Computing Enabling Secure Services

• US 20130269020A1
• Filed: 01/08/2013
• Published: 10/10/2013
• Est. Priority Date: 01/13/2012
• Status: Active Grant

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: McFarland, Keith A., Griffin, John L., Wells, William P.
• Granted Patent: US 9,384,339 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/062 Pre-authentication

Abstract

Authenticating cloud computing enabling secure services (ACCESS) offloads “client authentication” activity onto a third-party authenticating cloud computing enabling secure services (ACCESS) node. Instead of having a client device authenticate itself directly to a network server, the client device instead authenticates itself to a third-party authenticating cloud computing enabling secure services (ACCESS) node. The authenticating cloud computing enabling secure services (ACCESS) node then provides credentials that are used by the client device to communicate directly with the server (and utilize the service) without any further authentication being necessary.

Claims

1. A method of authenticating a cloud-based secure service, comprising:

receiving an initializer from a service server;

receiving credentials from a client device; and

passing an authentication token to said client device when said credentials from said client device are pre-authorized;

whereby said client device is enabled to access a service from said service server using said authentication token.

2. The method of authenticating a cloud-based secure service according to claim 1, wherein said initializer from said service server comprises:

a registration message encrypted using a shared secret cryptographic key.

3. The method of authenticating a cloud-based secure service according to claim 1, further comprising:

providing a notification to said service server identifying said client device when authenticated.

4. The method of authenticating a cloud-based secure service according to claim 3, wherein said notification comprises:

a push notification.

5. The method of authenticating a cloud-based secure service according to claim 1, further comprising:

receiving a request from said service server to verify validity of said authentication token received by said service server from said client device.

6. The method of authenticating a cloud-based secure service according to claim 5, wherein said notification comprises:

a pull notification.

7. The method of authenticating a cloud-based secure service according to claim 1, further comprising:

receiving a request from said service server for additional information regarding authentication of said client device to access a secure service on said service server.

8. Apparatus to authenticate a cloud-based secure service, comprising:

means for receiving an initializer from a service server;

means for receiving credentials from a client device; and

means for passing an authentication token to said client device when said credentials from said client device are pre-authorized;

whereby said client device is enabled to access a service from said service server using said authentication token.

9. The apparatus for authenticating a cloud-based secure service according to claim 8, wherein said initializer from said service server comprises:

a registration message encrypted using a shared secret cryptographic key.

10. The apparatus for authenticating a cloud-based secure service according to claim 8, further comprising:

means for providing a notification to said service server identifying said client device when authenticated.

11. The apparatus for authenticating a cloud-based secure service according to claim 10, wherein said notification comprises:

a push notification.

12. The apparatus for authenticating a cloud-based secure service according to claim 8, further comprising:

means for receiving a request from said service server to verify validity of said authentication token received by said service server from said client device.

13. The apparatus for authenticating a cloud-based secure service according to claim 12, wherein said notification comprises:

a pull notification.

14. The apparatus for authenticating a cloud-based secure service according to claim 8, further comprising:

means for receiving a request from said service server for additional information regarding authentication of said client device to access a secure service on said service server.