Method of and system for controlling access to contents provided by a contents supplier

• US 7,389,418 B2
• Filed: 12/20/2002
• Issued: 06/17/2008
• Est. Priority Date: 12/20/2001
• Status: Expired due to Fees

• Current Assignee: Volubill
• Original Assignee: Volubill
• Inventors: Bouthors, Nicolas
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): LASHLEY, LAUREL L
• Application Number:
  US10/324,142
• Publication Number:
  US 20030135588A1
• Time in Patent Office: 2,006 Days
• Field of Search: 713/176, 713/182, 380/30, 380/277, 709/219
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

Access control to contents is by a user of a terminal connected through a computer network to at least one server of a contents supplier. The user selects or accepts interactive data exchange through a wireless communication network between a trusted organization on the computer network, and a mobile terminal accessible to the user.

Claims

1. A method of controlling access to a content by a user of two terminals, using a first terminal connected through a computer network to at least one server of a contents supplier, the method comprising causing an interactive data exchange through a wireless communication network between a trusted organization on the computer network and a wireless mobile second terminal accessible to the user, the trusted organization being selected or accepted by the user and the interactive data exchange being triggered by the first terminal through the contents supplier.

2. Method according to claim 1, wherein the interactive data exchange comprises causing the trusted organization to send a request to the wireless mobile second terminal, the request asking the user to confirm or send authentication data from the mobile terminal.

3. Method according to claim 1, further comprising testing the availability of the wireless mobile second terminal and determining the communication standard used by the mobile terminal.

4. Method according to claim 1, further comprising determining identification data about the user either by reading from at least one database or by sending a request for definition of these identification data to at least one of the first terminal and wireless mobile second terminal, the identification data being determined by a server agent on the computer network referenced as being trusted for the contents supplier, or by the contents supplier.

5. Method according to claim 4, further comprising causing the server agent or the contents supplier to send a request including user identification data to the trusted organization.

6. Method according to claim 5, further comprising encrypting the identification data to be sent to the trusted organization.

7. Method according to claim 5 further comprising causing the trusted organization to check the source of the request.

8. Method according to claim 4, further comprising sending a determined response from the trusted organization to the server agent or to the contents supplier.

9. Method according to claim 8, wherein the response sent from the trusted organization to the server agent includes a security level achieved or that could be reached during an access control procedure that has been done or is to be done.

10. Method according to claim 8, further comprising causing the server agent or the contents supplier to react based on the response sent by the trusted organization, the reaction including establishing replacement actions if the security level required by the user to access of the contents supplier has not been or cannot be achieved.

11. Method according to claim 4, further comprising causing the server agent or the contents supplier to send data to the trusted organization, the data being representative of a security level required by the user for access to the contents, and establishing an access control procedure defined for the security level.

12. Method according to claim 4, further comprising causing the user to input in advance on at least one sheet managed by the server agent or the contents supplier the identification data including the name and address of the trusted organization, a user identifier with the trusted organization, the security level required by the user for the contents to be accessed and replacement actions to be performed.

13. Method according to claim 1, further comprising performing a control step at the end of an access session to the required contents controlled from the wireless mobile second terminal.

14. Method according to claim 1, wherein a communication between the trusted organization and the wireless mobile second terminal is made via a radio telephony network.

15. Method according to claim 14, wherein the radio telephony network operates in accordance with one of the WAP, GPRS or UMTS standards.

16. System for access control to a content by a user of two terminals, wherein the user can use a first terminal connected through a computer network to at least one server of a contents supplier, the system comprising a data exchanger for making interactive data exchanges through a wireless communication network between a wireless mobile second terminal accessible to the user and a selected trusted organization on the computer network or a trusted organization accepted by the user, the data exchanger being arranged to be triggered by the first terminal through the contents supplier.

17. System according to claim 16, wherein the data exchanger comprises a secure processor for (a) transferring at least one request through the trusted organization to the wireless mobile second terminal, (b) asking the user to (i) confirm authentication data or (ii) send authentication data from the wireless mobile second terminal.

18. System according to claim 16, further comprising a memory for storing identification data about the user in at least one database located on a server agent of the computer network referenced as being trusted by the contents supplier, or at the contents supplier.

19. System according to claim 18, wherein the identification data include the name and the address of the user'"'"'s trusted organization and a user identifier including the trusted organization.

20. System according to claim 18, wherein the memory is arranged for storing data representing a security level defined by the user to access contents of the supplier, and replacement actions to be established if the security level is not achieved or cannot be achieved in at least one database.

21. System according to claim 20, wherein the replacement actions include access to only some contents of the contents supplier, access to the contents of the contents supplier, or some content in a read only mode, or sending a message to the wireless mobile second terminal via the trusted organization.

22. System according to claim 16, wherein the trusted organization is arranged for testing the availability of the mobile terminal and a communication standard followed by the mobile terminal.

23. System according to claim 22, wherein the system is arranged for activating replacement actions representing a procedure for authentication of a lower security level if the mobile terminal is not available and/or does not operate according to an appropriate standard.

24. System according to claim 20, wherein the trusted organization is arranged for generating and sending a response to the server agent or to the contents supplier, the response comprising data representative of the security level achieved or that could be achieved.

25. System according to claim 24, wherein the server agent or the contents supplier is arranged for processing the response received from the trusted organization and for activating one or several replacement actions if the required security level has not been achieved or cannot be achieved.

26. System according to one of claim 20, wherein the server agent or the contents supplier is arranged for reading the at least one database to determine (a) identification data for the user and (b) replacement actions for cases in which the security level is not achieved.

27. System according to claim 18, further comprising an input device for enabling the user to supply user identification data, the security level required by the user and replacement actions to be applied if this level is not achieved, on at least one sheet managed by the server agent or by the contents supplier.

28. System according to claim 16, wherein the wireless communication network between the trusted organization and the mobile terminal includes a radio telephony network.

29. System according to claim 28, wherein the radio telephony network functions according to one of the WAP, GPRS or UMTS standards.

30. A method of controlling coupling of a mobile wireless terminal for a user to a server arrangement of an organization trusted by the user, the trusted organization and the mobile terminal including transmitters and receivers that are parts of a wireless communication network;

the trusted organization also being part of a computer network including a client computer of the user of the mobile terminal, the computer network also including a protected contents supplier storing a profile of the user;

the trusted organization, the client computer and the protected contents supplier including transmitters and receivers that are parts of the computer network;

the method comprising;

in response to the user logging in to the computer network, causing the protected contents supplier to send an authentication request with at least some of the protected contents about the profile of the user to the trusted organization via the computer network, and

the trusted organization responding to the authentication request by determining whether the protected contents supplier can be trusted as being authentic for the user of the client computer;

the authentic determination being performed in response to the trusted organization communicating with the mobile terminal via the wireless communication network; and

establishing coupling between the mobile wireless terminal and the server arrangement of the trusted organization in response to the authentic determination being positive.