Method and apparatus for remotely accessing a password-protected service in a data communication system

• US 6,993,666 B1
• Filed: 02/25/2000
• Issued: 01/31/2006
• Est. Priority Date: 08/27/1997
• Status: Expired due to Fees

• Current Assignee: Teliasonera Finland Oyj (Telia Company AB)
• Original Assignee: Sonera Oyj
• Inventors: Hokkanen, Tuomo, Linkola, Janne
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Nalven, Andrew L.
• Application Number:
  US09/513,704
• Time in Patent Office: 2,167 Days
• Field of Search: 713/202, 713/200, 713/183, 713/155
• US Class Current: 726/5
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A procedure and a data communication system in which a service provider provides to a remote user of a service a set of expendable passwords for use by the user in accessing the service via a telecommunication and/or data network. The user'"'"'s terminal device is provided with means for automatically transmitting a password at log-on to the service, and a server to which the terminal device sets up a connection includes means for identifying the password and for allowing or denying access to the service on the basis of the supplied password. The terminal device further includes means for storing a set of passwords and for selecting, at log-on to a predetermined service, the correct password from the stored set of passwords for automatic addition of the password to a connection setup signal transmitted from the terminal device to the server.

Claims

1. In a data communication system in which a remote user of a service provided by a server on a network of the system is required to transmit to the server a valid expendable password, from a set of expendable passwords provided to the user, in order to obtain remote user-access to the service via the network, the improvement comprising a terminal device connected to the network for use by the user in remotely accessing the service via the network, said terminal device comprising:

storage means for storing at the terminal device the set of expendable passwords provided to the user for use in remotely accessing the service from the terminal device via the network;

selecting means for automatically selecting, from the stored set of expendable passwords at user log-on to the service, one of the stored passwords for use in remotely logging-on to the service from the terminal device; and

adding means for automatically adding, to a connection setup signal to be transmitted from the terminal device to the server over the network to remotely log-on to the service from the terminal device of the user, the one of the stored passwords selected by said selecting means, wherein the network is a GSM network and said terminal device comprises a GSM mobile telephone, said terminal device further comprising a subscriber identity module that implements said selecting means and said adding means in software on said subscriber identity module,

said software on the subscriber identity module further comprising means for identifying the service by a telephone number entered by the user at the terminal device to access the service, and said adding means further comprising means for appending, to the telephone number, a predetermined number of digits characterizing the one of the stored passwords selected by said selecting means.

2. In the data communication system of claim 1, wherein the server includes means for updating the single-use passwords stored at the terminal device by transmitting a new set of single-use passwords from the server to the terminal device via the network, said terminal device further comprising means for receiving a set of passwords from the server via the network.

3. In the data communication system of claim 1, said terminal device further comprising means for automatically ordering, from the server via the network, a new set of single-use passwords for use in logging-on to the service when each of the passwords stored at the terminal device has been used to remotely log-on to the service from the terminal device.

4. In the data communication system of claim 1, said storage means of said terminal device comprising means for storing a plurality of sets of single-use passwords, each said stored set of single-use passwords comprising a plurality of single-use passwords for use in remotely accessing a corresponding one of a plurality of services remotely-accessible by the user of the terminal device.

5. In the data communication system of claim 4, said selecting means comprising means for automatically selecting, from a one of the plurality of stored sets of single-use passwords for use with the corresponding one of the plural services to be accessed by the user, a one of the single-use passwords from said one set for use in logging-on to the corresponding one of the plural services.

6. In the data communication system of claim 1, wherein the network comprises a wired telecommunication network, and wherein said terminal device comprises a telephone set in the wired network.

7. In the data communication system of claim 1, said subscriber identity module further comprising a service directory storing information specifying a plurality of services accessible by the user of the terminal device, service identifier data for each of the accessible services, and password file names to be used in conjunction with remote user access to the plural services.

8. In the data communication system of claim 7, said service directory further comprising a pointer for each of the plural services and arranged to point to a first unused password in the set of passwords to be used to attain access to a corresponding service and to be updated to point to a sequentially-next unused password in the set of passwords for the corresponding service as each stored password is used to access the corresponding service.

9. In the data communication system of claim 1, said software on the subscriber identity module further comprising means for automatically ordering, from the server via the network using the short-message service (SMS-PP service) of the GSM network, a new set of single-use passwords for use in logging-on to the service when each of the passwords stored at the terminal device has been used to remotely log-on to the service from the terminal device, and for receiving the new set of single-use passwords transmitted from the server using the short-message service.