METHOD AND APPARATUS FOR SINGLE SIGN-ON COLLABORATION AMONG MOBILE DEVICES

• US 20140189840A1
• Filed: 12/27/2012
• Published: 07/03/2014
• Est. Priority Date: 12/27/2012
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: METKE, ANTHONY R., Reitsma, Katrin, Lewis, Adam C., Popovich, George, Upp, Steven D.
• Granted Patent: US 8,782,766 B1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A system for, and method of, single sign-on collaboration among a plurality of mobile devices, includes a server for issuing a first identity token to subsequently authenticate a user of a first of the mobile devices to a service provider, and for generating and sending a collaboration credential to the first device based on the first identity token or user authentication. The first device sends the collaboration credential generated by the server to a second device paired with the first device. The server also issues a second identity token to subsequently authenticate to the service provider the user of the second device based on the collaboration credential received from the first device, to support single sign-on collaboration for the user across the plurality of mobile devices.

Claims

1. An apparatus for enabling a user of a first mobile device to extend user authentication credentials to a second mobile device, the apparatus comprising:

a server having a processor that is configured to;

issue and send a first identity token to the first mobile device, wherein the first identity token can be utilized to authenticate the user of the first mobile device to a service provider;

generate a collaboration credential, wherein generation of the collaboration credential is based on one or more of user authentication and receipt of a collaboration request associated with the first identity token and wherein the collaboration credential is sharable among a plurality of mobile devices;

send the collaboration credential to the first mobile device;

receive the collaboration credential from the second mobile device;

verify the collaboration credential received from the second mobile device; and

in response to verifying the collaboration credential received from the second mobile device, issue and send a second identity token to the second mobile device, wherein the second identity token can be utilized to authenticate the second mobile device to the service provider.

2. The apparatus of claim 1, wherein the processor is configured to receive the collaboration request from the first mobile device and wherein the processor is configured to generate the collaboration credential in response to receiving the collaboration request.

3. The apparatus of claim 1, further comprising the first mobile device, wherein the first mobile device is configured to:

receive the first identity token and the collaboration credential from the server; and

send the collaboration credential to the second mobile device.

4. The apparatus of claim 3, further comprising the second mobile device, wherein the second mobile device is configured to:

receive the collaboration credential from the first mobile device;

send the collaboration credential to the server; and

in response to sending the collaboration credential, receive the second identity token.

5. The apparatus of claim 1, wherein the processor further is configured to receive the collaboration credential from a third mobile device and, in response to receiving the collaboration credential from the third mobile device, issue and send a third identity token to the third mobile device, wherein the third identity token can be utilized to authenticate the user of the third mobile device to the service provider.

6. The apparatus of claim 1, wherein the processor further is configured to receive, from the first mobile device and in response to sending the collaboration credential to the first mobile device, a collaboration notification that identifies the first mobile device as a source of the collaboration credential and identifies the second mobile device as a recipient of the collaboration credential.

7. The apparatus of claim 1, wherein the processor further is configured to configure the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first mobile device, an identification of which of a plurality of mobile devices are permitted to collaborate with the first mobile device, and an identification of the conditions under which the collaboration is permitted to be conducted.

8. The apparatus of claim 1, wherein the processor further is configured to configure each identity token as a data structure comprising at least one of an identification of the user and an identification of the mobile device to which the respective identity token is sent.

9. The apparatus of claim 1, wherein the server comprises an identity management server that is configured to issue each identity token and generate and verify the collaboration credential.

10. The apparatus of claim 1, wherein the server comprises:

an identity management server that is configured to issue each identity token; and

a collaboration manager server that is configured to generate and verify the collaboration credential.

11. A method for enabling a user of a first mobile device to extend user authentication credentials to a second mobile device, the method comprising:

issuing and sending a first identity token to the first mobile device, wherein the first identity token can be utilized to authenticate the user of the first mobile device to a service provider;

generating a collaboration credential, wherein generation of the collaboration credential is based on one or more of user authentication and receipt of a collaboration request associated with the first identity token and wherein the collaboration credential is sharable among a plurality of mobile devices;

sending the collaboration credential to the first mobile device;

receiving the collaboration credential from the second mobile device;

verifying the collaboration credential received from the second mobile device; and

in response to verifying the collaboration credential received from the second mobile device, issuing and sending a second identity token to the second mobile device, wherein the second identity token can be utilized to authenticate the second mobile device to the service provider.

12. The method of claim 11, wherein the method further comprises receiving the collaboration request from the first mobile device and wherein generating the collaboration credential comprises generating the collaboration credential in response to receiving the collaboration request.

13. The method of claim 11, further comprising:

receiving, by the first mobile device, the first identity token and the collaboration credential from the server; and

sending, by the first mobile device, the collaboration credential to the second mobile device.

14. The method of claim 13, further comprising:

receiving, by the second mobile device, the collaboration credential from the first mobile device;

sending, by the second mobile device to the server, the collaboration credential; and

in response to sending the collaboration credential, receiving, by the second mobile device, the second identity token.

15. The method of claim 11, further comprising:

receiving the collaboration credential from the third mobile device; and

in response to receiving the collaboration credential from the third mobile device, issuing and sending a third identity token to the third mobile device, wherein the third identity token can be utilized to authenticate the user of the third mobile device to the service provider.

16. The method of claim 11, further comprising, in response to sending the collaboration credential to the first mobile device, receiving a collaboration notification that identifies the first mobile device as a source of the collaboration credential and identifies the second mobile device as a recipient of the collaboration credential.

17. The method of claim 11, further comprising configuring the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first mobile device, an identification of which of a plurality of mobile devices are permitted to collaborate with the first mobile device, and an identification of the conditions under which the collaboration is permitted to be conducted.

18. The method of claim 11, further comprising configuring each identity token as a data structure comprising at least one of an identification of the user and an identification of the mobile device to which the respective identity token is sent.

19. An apparatus for enabling single sign-on collaboration among a plurality of mobile devices, the apparatus comprising:

a mobile device comprising a processor that is configured to;

receive each of a first identity token and a collaboration credential from a server, wherein the first identity token can be utilized to authenticate a user of the mobile device to a service provider and wherein the collaboration credential is sharable among a plurality of mobile devices and may be utilized to provide an identity token to each mobile device of the plurality of mobile devices; and

send the collaboration credential to another mobile device.

20. The apparatus of claim 19, wherein the processor is configured to receive the collaboration credential by sending a collaboration request to the server, wherein the collaboration request is associated with the first identity token, and, in response to sending the collaboration request, receive the collaboration credential.

21. The apparatus of claim 19, wherein the mobile device is a first mobile device and wherein the apparatus further comprises a second mobile device that is configured to:

receive the collaboration credential from the first mobile device;

send the collaboration credential to the server; and

in response to sending the collaboration credential, receive the second identity token from the server, wherein the second identity token can be utilized to authenticate the user of the second mobile device to the service provider.

22. The apparatus of claim 19, wherein the processor further is configured to, in response to receiving the collaboration credential, send a collaboration notification to the server, wherein the collaboration notification identifies the mobile device as a source of the collaboration credential and identifies the another mobile device as a recipient of the collaboration credential.

23. A method for enabling single sign-on collaboration among a plurality of mobile devices, the method comprising:

receiving, by a mobile device of the plurality of communication devices, each of a first identity token and a collaboration credential from a server, wherein the first identity token can be utilized to authenticate a user of the mobile device to a service provider and wherein the collaboration credential is sharable among a plurality of mobile devices and may be utilized to provide an identity token to each mobile device of the plurality of mobile devices; and

sending, by the mobile device, the collaboration credential to another mobile device of the plurality of mobile devices.

24. The method of claim 23, wherein receiving the collaboration credential comprises:

sending a collaboration request to the server, wherein the collaboration request is associated with the first identity token; and

in response to sending the collaboration request, receiving the collaboration credential.

25. The method of claim 23, wherein the method further comprises, in response to receiving, by the mobile device, the collaboration credential, sending a collaboration notification to the server, wherein the collaboration notification identifies the mobile device as a source of the collaboration credential and identifies the another mobile device as a recipient of the collaboration credential.