AUTHENTICATION ON THIN CLIENTS USING INDEPENDENT DEVICES

• US 20180227296A1
• Filed: 02/03/2017
• Published: 08/09/2018
• Est. Priority Date: 02/03/2017
• Status: Active Grant

• Current Assignee: Dell Marketing Corporation (Dell Technologies Inc.)
• Original Assignee: Wyse Technology L.L.C. (Dell Technologies Inc.)
• Inventors: Joshi, Salil, Kaushik, Puneet, Popli, Sumit, Dubey, Suruchi, Rombakh, Oleg, Raghavan, Varun
• Granted Patent: US 10,523,665 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Authentication can be performed on thin clients using independent mobile devices. Because many users have smart phones or other similar mobile devices that include biometric scanners, such mobile devices can be leveraged to perform authentication of users as part of logging in to a thin client desktop. A mapping can be created on a central server between a user'"'"'s mobile device and the user'"'"'s domain identity. A mapping can also be created between the user'"'"'s domain identity and the user'"'"'s thin client desktop. Then, when a user desires to log in to his thin client desktop, the user can employ the appropriate biometric scanner on his mobile device to perform authentication. The central server can then rely on this authentication to identify and log the user into his thin client desktop.

Claims

1. A method for performing authentication on a thin client using a mobile device, the method comprising:

receiving, at an authentication service that executes on a server, an authentication notification that indicates that a user has performed authentication on a mobile device, the authentication notification including mobile device information that identifies the mobile device;

using the mobile device information included in the authentication notification to identify a domain identity of the user and a thin client desktop associated with the domain identity; and

sending a logon command to an agent on a thin client including providing login information for the domain identity to allow the agent to log the user into the thin client desktop associated with the domain identity.

2. The method of claim 1, wherein the mobile device information includes one or more of an IMEI number, a phone number, or a MAC address.

3. The method of claim 1, wherein the domain identity comprises a username.

4. The method of claim 1, wherein the thin client desktop comprises one of a local desktop or a remote desktop.

5. The method of claim 1, wherein the authentication service maintains mappings between mobile device information and domain identities.

6. The method of claim 1, wherein the login information includes authentication information that was received from the mobile device in the authentication notification.

7. The method of claim 1, further comprising;

prior to sending the logon command, evaluating the authentication notification against one or more policies.

8. The method of claim 7, wherein the one or more policies are identified based on the domain identity.

9. The method of claim 1, further comprising:

sending an authentication confirmation to a mobile application executing on the mobile device; and

in response to the authentication confirmation, receiving a desktop launch request from the mobile application;

wherein the logon command is sent in response to receiving the desktop launch request.

10. The method of claim 9, wherein the authentication confirmation includes a token, the method further comprising:

validating a token received by the thin client against the token that was included in the authentication confirmation.

11. The method of claim 1, wherein the login information includes a username and password for the domain identity.

12. The method of claim 1, further comprising:

sending a Wake-On-LAN command to the agent.

13. The method of claim 1, wherein the authentication performed on the mobile device comprises biometric-based authentication.

14. The method of claim 1, wherein the mobile device is a smart phone.

15. The method of 1, wherein the thin client to which the logon command is sent is selected based on input from the user of the mobile device, or based on an identification of the thin client that is associated with the thin client desktop.

16. One or more computer storage media storing computer-executable instructions which when executed implement a method comprising:

in response to a user authenticating on a mobile device, sending, by a mobile application on the mobile device, an authentication notification that includes mobile device information that identifies the mobile device;

in response to receiving the authentication notification, identifying, by an authentication service on a server, a domain identity associated with the mobile device information included in the authentication notification;

based on the domain identity, identifying a thin client desktop;

sending a logon command to an agent on a thin client;

providing login information associated with the thin client desktop to the agent; and

employing, by the agent, the login information to log a user into the thin client desktop on the thin client.

17. The computer storage media of claim 16, wherein the method further comprises, prior to employing the login information to log the user into the thin client desktop on the thin client:

sending, by the authentication service, a token to the mobile application;

receiving, at the agent, the token; and

validating the token received by the agent against the token sent by the authentication service.

18. The computer storage media of claim 16, wherein the method further comprises:

evaluating the authentication notification against one or more policies.

19. A method for logging a user into a thin client desktop, the method comprising;

receiving, at an authentication service, an authentication notification that indicates that a user of a mobile device has successfully authenticated on the mobile device;

based on the authentication notification, identifying a domain identity of the user as well as a thin client desktop associated with the domain identity; and

instructing an agent on a thin client to employ the domain identity to log the user into the thin client desktop on the thin client.

20. The method of claim 19, wherein instructing the agent on the thin client to employ the domain identity to log the user into the thin client desktop on the thin client comprises providing one or more of:

a password;

or

authentication information that was included in the authentication notification.