Universal authentication mechanism
First Claim
1. A method for authentication of a user, wherein an application device requests a service for the user from the service provider and the service provider requests an authentication of the user by an authentication server before granting access to the requested service, wherein the following steps are performed:
- transmitting a user identity from the application device to the service provider,transmitting a request for confirmation of the user identity from the service provider, to an authentication server with the request comprisinga service provider generated user identity for providing the user'"'"'s identity to the authentication server anda first service identity for identifying the requested service to the authentication server, the user identity being identical to the received user identity or being derived from the received user identity by a conversion performed by the service provider (SP);
the authentication server verifying the received identities;
the authentication server deriving a second service identity from the first service identity for identifying the requested service to an authentication device associated with the user;
transmitting a request for service authentication from the authentication server to the authentication device of the user with the request for service authentication indicating the requested service to the authentication device,generating a service authentication confirmation confirming the request for service authentication,transmitting the service authentication confirmation from the authentication device to the authentication server,analyzing the service authentication confirmation;
confirming the user identity to the service provider according to the result of the analysis; and
granting of service access to the user by the service provider according to the confirmation of the user identity.
2 Assignments
0 Petitions
Accused Products
Abstract
A universal authentication mechanism for authenticating a user to a service provider (SP) is disclosed. An application device (ApD) requests a service for the user from the service provider (SP) and performs a transmission of a user identity (S10) identifying the user to the service provider (SP). The service provider sends a request for confirmation of the user identity (S20) to an authentication server (AS). The request comprises the user identity and a service identity identifying the requested service. The authentication server (AS) sends a request for service authentication (S50) to the authentication device (AuD) for confirmation. Based on the result of an analysis (S80) of a service authentication confirmation (S60) received from the authentication device (AuD), the authentication server (AS) sends a confirmation of the user identity (S90) confirming the identity of the user to the service provider (SP), which grants service access (S100).
-
Citations
26 Claims
-
1. A method for authentication of a user, wherein an application device requests a service for the user from the service provider and the service provider requests an authentication of the user by an authentication server before granting access to the requested service, wherein the following steps are performed:
-
transmitting a user identity from the application device to the service provider, transmitting a request for confirmation of the user identity from the service provider, to an authentication server with the request comprising a service provider generated user identity for providing the user'"'"'s identity to the authentication server and a first service identity for identifying the requested service to the authentication server, the user identity being identical to the received user identity or being derived from the received user identity by a conversion performed by the service provider (SP); the authentication server verifying the received identities; the authentication server deriving a second service identity from the first service identity for identifying the requested service to an authentication device associated with the user; transmitting a request for service authentication from the authentication server to the authentication device of the user with the request for service authentication indicating the requested service to the authentication device, generating a service authentication confirmation confirming the request for service authentication, transmitting the service authentication confirmation from the authentication device to the authentication server, analyzing the service authentication confirmation; confirming the user identity to the service provider according to the result of the analysis; and granting of service access to the user by the service provider according to the confirmation of the user identity. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. An authentication server comprising a receiving unit, a transmitting unit, and a processing unit, wherein
the receiving unit is adapted to receive a request for confirmation of a user identity from a service provider with the request comprising a service provider generated user identity and a first service identity for identifying a service of the service provider; -
the processing unit being adapted to execute a verification of the received identities; the authentication server being adapted to derive a second service identity from the first service identity for identifying the reguested service to an authentication device associated with the user; the processing unit is adapted to generate a request for service authentication indicating the service to an authentication device of the user; the transmitting unit is adapted to send the request for service authentication to the authentication device; the receiving unit is adapted to receive a service authentication confirmation from the authentication device confirming the request for service authentication; the processing unit is adapted to execute an analysis of the received service authentication confirmation and to generate a confirmation of the user identity according to the result of the analysis, the confirmation of the user identity confirming the identity of the user to the service provider; and the transmitting unit is adapted to send the confirmation of the user identity to the service provider. - View Dependent Claims (14, 15, 16, 17, 18, 19)
-
-
20. A computer program loadable into a processing unit of an authentication server, wherein the computer program is adapted to perform the steps of
processing of a request for confirmation of a user identity from a service provider with the request comprising the user identity and a first service identity identifying a requested service; -
generating a request for service authentication to an authentication device of the user, wherein the request includes a second service identity derived from the first service identity; initializing a transmission of the request for service authentication to the authentication device; executing an analysis of a service authentication request confirmation from the authentication device; generating a confirmation of the user identity according to the result of the analysis. the confirmation of the user identity confirming the identity of the user to the service provider; and transmitting the confirmation of the user identity to the service provider. - View Dependent Claims (21, 22, 23, 24, 25)
-
-
26. A node comprising:
-
a receiving unit, the receiving unit being adapted for receiving a request for confirmation of a user identity from a service provider, the request comprising the user identity and a first service identity identifying a service requested by the user to the node; a processing unit, the processing unit, in response to receipt of the confirmation request, being adapted for verifying the received identities and generating a request for service authentication, wherein the request for service authentication comprises a second service identity derived from the first service identity and a keyword associated with the user identity for identifying the node to an authentication device associated with the user, wherein the keyword is retrieved from a database available to the node a transmitting unit being adapted to send the request for service authentication to the authentication device; the receiving unit is further adapted to receive a service authentication response from the authentication device, the service authentication response confirming the request for service authentication; the processing unit further being adapted to analyze the received service authentication confirmation and to generate a confirmation of the user identity, wherein the confirmation of the user identity is for confirming the user identity to the service provider; and the transmitting unit being adapted to send the confirmation of the user identity to the service provider.
-
Specification