Authentication management platform for managed security service providers

• US 7,707,626 B2
• Filed: 06/01/2005
• Issued: 04/27/2010
• Est. Priority Date: 06/01/2005
• Status: Active Grant

• Current Assignee: Rakuten Group, Inc.
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Lee, Jonathan C., Drake, Alton W. II, Furst, Cheryl L., Holloway, James W., Hurr, Tien Y., Wallace, Michael F., Albisu, Luis F.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Hailu; Teshome
• Application Number:
  US11/141,862
• Publication Number:
  US 20060288405A1
• Time in Patent Office: 1,791 Days
• Field of Search: 726/8, 726/9
• US Class Current: 726/8
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

An authentication management platform that enables authentication systems from various vendors to be integrated into a single service offering. The disclosed arrangement can support multiple, distinct customers and multiple primary authentication servers on a single platform. The management platform provides access only to users that enter a valid passcode comprising both: (1) a personal identification number (PIN) and (2) the current code generated by a security token card assigned to that user. The authentication management platform may be configured to be controlled and maintained by the subscriber to the system, or may be serviced/maintained by a third party service provider.

Claims

1. A method of authenticating a user to a plurality of disparate network elements and network systems having unique validation arrangements using a single authentication procedure, the method comprising:

maintaining a centralized database of a plurality of authenticated users and associated user IDs/personal identification numbers (PINs) for the plurality of disparate network elements and network systems in a provisioning server;

providing a token code generation unit within the provisioning server;

distributing a separate security token card to each authenticated user; and

re-synchronizing a distributed security token card with the token code generation unit upon receiving a predetermined number of invalid entry attempts at the centralized database.

2. The method as defined in claim 1 wherein the method further includes:

an authenticated user activating his associated security token card with an entry of a valid user ID/PIN and a valid, current token security code, where said authenticated user is provided with an access to the plurality of disparate network elements and network systems in the single authentication procedure.

3. The method as defined by claim 1 wherein a third party vendor maintains the centralized database and distributes the security token cards to said plurality of authenticated users.

4. The method as defined by claim 1 wherein a corporate system subscriber maintains the centralized database and distributes the security token cards to said plurality of authenticated users.

5. The method as defined by claim 1 wherein the maintaining said centralized database of said plurality of authenticated users includes adding new users to said centralized database.

6. The method as defined in claim 1 wherein the distributing said security token cards comprises delivering said security token cards to said plurality of authenticated users utilizing an outside delivery system.

7. An authentication management platform for authenticating a user to a plurality of disparate network elements and network systems using a single authentication procedure, the authentication management platform comprising:

a centralized database of user IDs/personal identification numbers (PINs) associated with a plurality of authenticated users permitted access to the plurality of disparate network elements and network systems; and

a token code generator for interacting with a plurality of synchronized security token cards in possession of said plurality of authenticated users, the token code generator for providing a unique password for a one-time login attempt, with new passwords being generated at predetermined intervals, wherein in order to access the plurality of disparate network elements and network systems, a potential user accesses the authentication management platform and provides a user ID/PIN and a current value of his security token card;

wherein said authentication management platform is configured to re-synchronize a security token card with the token code generator upon receiving a predetermined number of invalid entry attempts at the centralized database.

8. The authentication management platform as defined in claim 7 wherein the authentication management platform resides at a location of a subscriber and is maintained by the subscriber.

9. The authentication management platform as defined in claim 7 wherein the authentication management platform resides at a network location and is maintained by a third party.