METHOD FOR AUTHORIZING ACCESS TO PROTECTED CONTENT

• US 20140068746A1
• Filed: 10/24/2011
• Published: 03/06/2014
• Est. Priority Date: 11/24/2010
• Status: Active Grant

• Current Assignee: Telefonica SA
• Original Assignee: Diego Gonzalez Martinez, Enrique Velez Tarilonte, Jorge Guillen Navarro
• Inventors: Gonzlez Martnez, Diego, Lozano Llanos, David, Munuera Andreo, Jorge, Vlez Tarilonte, Enrique, Guilln Navarro, Jorge
• Granted Patent: US 9,118,648 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 4/14 : Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

The invention refers to a method for authorizing access to a third party application, called client (2), to protected resources owned by a user (1) and hosted in a server (3). The method comprising: the client being used by the user asking for a temporary token to the server; the server sending a first SMS to the user, said first SMS providing means to authenticate the user; authenticating the user by the means provided in previous two steps; the user authorizing the client; the server sending a second SMS to the user providing some information needed to obtain an access token; the client getting the information of the previous step from the user and the access token; the client accessing protected resources using the access token.

Claims

1. Method for authorizing access to a third party application, called client (2), to protected resources owned by a user (1) and hosted in a server (3), the method comprising:

the client being used by the user asking for a temporary token to the server;

in addition to responding to the client with said temporary token, the server sending a first SMS to the user, said first SMS providing means to authenticate the user;

authenticating the user by the means provided in previous two steps;

the user authorizing the client;

after the authentication of the user and authorization of the user to the client, the server sending a second SMS to the user providing some information needed to obtain an access token;

the client getting the information of the previous step from the user and the access token;

the client accessing protected resources using the access token.

2. The method according to claim 1 further comprising defining or using a parameter in the client to indicate who the user is and where to send the first SMS.

3. The method according to claims 1-2, wherein the means to authenticate the user, included in the first SMS, are an URL carrying a token not known for the client and an indication for the user to click on the URL.

4. The method according to claims 1-2, wherein the means included in the first SMS to authenticate the user, are a token not known for the client and indications for the user to send a SMS with the token to a designated number.

5. The method according to claim 1 further comprising defining or using a parameter in the client to indicate that an SMS or a binary-SMS has to be sent to the user after the user authentication and authorization.

6. The method according to any one of claims 1, 2 and 5, wherein the information needed to obtain an access token is a verification code included in the second SMS, said verification code is given to the client by the user.

7. The method according to any one of claims 1, 2 and 5, wherein the information needed to obtain an access token is a verification code included in the second SMS, being the second SMS a binary SMS sent to an indicated port of a handset of the user where the client obtains the verification code directly.

8. The method according to any one of claims 1, 2 and 5, wherein the information sent in the second SMS is the access token, and said access token is given to the client by the user.

9. The method according to any one of claims 1, 2 and 5, wherein the information sent in the second SMS is the access token, being the second SMS a binary SMS sent to an indicated port of a handset of the user where the client obtains the access token directly.

10. Method according to claims 1, 2 and 5, wherein standard OAuth protocol is used for performing method steps.

11. The method according to any one of claims 2 and 5, wherein the first parameter is defined by using an additional parameter non-defined in OAuth protocol.

12. The method according to any one of claims 2 and 5, wherein the first parameter is defined by re-using a parameter defined in OAuth protocol.

13. The method according to any one of claims 1, 2 and 5, further comprising defining a second parameter in the client for signalling.

14. The method according to claim 13, wherein the second parameter is defined by using an additional parameter non-defined in OAuth protocol.

15. The method according to claim 11, wherein the second parameter is the callbackURL parameter of the OAuth protocol.