Method and apparatus for pervasive authentication domains
First Claim
1. An apparatus comprising:
- at least one processor;
a discoverer which finds at least one device configured as a personal authentication gateway capable of responding to token requests for access credentials from at least one pervasive device included in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials;
a token requestor which sends at least one token request for at least one token required by the at least one pervasive device;
a token client which accepts at least one token response including the access credentials from the device configured as a personal authentication gateway;
wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and
an arrangement adapted to register a pervasive device to be a member of a pervasive authentication domain by registering with the device configured as a personal authentication gateway;
wherein said registering arrangement comprises;
an arrangement adapted to enter a same random password on the pervasive device as on the device configured as the personal authentication gateway;
an arrangement adapted to receive an encryption key and encrypted value generated on the device configured as the personal authentication gateway;
an arrangement adapted to compute a fingerprint of the value encrypted by the encryption key and the same random password; and
an arrangement adapted to compare the fingerprint of the value on the pervasive device.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods and apparatus for enabling a Pervasive Authentication Domain. A Pervasive Authentication Domain allows many registered Pervasive Devices to obtain authentication credentials from a single Personal Authentication Gateway and to use these credentials on behalf of users to enable additional capabilities for the devices. It provides an arrangement for a user to store credentials in one device (the Personal Authentication Gateway), and then make use of those credentials from many authorized Pervasive Devices without re-entering the credentials. It provides a convenient way for a user to share credentials among many devices, particularly when it is not convenient to enter credentials as in a smart wristwatch environment. It further provides an arrangement for disabling access to credentials to devices that appear to be far from the Personal Authentication Gateway as measured by metrics such as communications signal strengths.
-
Citations
18 Claims
-
1. An apparatus comprising:
-
at least one processor; a discoverer which finds at least one device configured as a personal authentication gateway capable of responding to token requests for access credentials from at least one pervasive device included in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; a token requestor which sends at least one token request for at least one token required by the at least one pervasive device; a token client which accepts at least one token response including the access credentials from the device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and an arrangement adapted to register a pervasive device to be a member of a pervasive authentication domain by registering with the device configured as a personal authentication gateway; wherein said registering arrangement comprises; an arrangement adapted to enter a same random password on the pervasive device as on the device configured as the personal authentication gateway; an arrangement adapted to receive an encryption key and encrypted value generated on the device configured as the personal authentication gateway; an arrangement adapted to compute a fingerprint of the value encrypted by the encryption key and the same random password; and an arrangement adapted to compare the fingerprint of the value on the pervasive device. - View Dependent Claims (2, 3, 4)
-
-
5. An apparatus comprising:
-
at least one processor; means for registering at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; and means for receiving a token request for the access credentials from at least one pervasive device; means for determining whether the at least one pervasive device is a member of the pervasive authentication domain based on a pervasive device identification; means for sending at least one token response including the access credentials to said at least one pervasive device from a device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; wherein said means for registering comprises; means for entering a same random password on the device configured as the personal authentication gateway as on the at least one pervasive device; and means for transmitting an encryption key and encrypted value generated on the device configured as the personal authentication gateway to the at least one pervasive device such that the at least one pervasive device can compute a fingerprint of the value encrypted by the encryption key and the same random password and compare the fingerprint of the value. - View Dependent Claims (6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform steps comprising:
-
registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; ascertaining the device configured as a personal authentication gateway from the at least one pervasive device; sending at least one token request for the access credentials from the at least one pervasive device to the device configured as a personal authentication gateway; and receiving a token response including the access credentials at the at least one pervasive device from the device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and wherein said registering step comprises; entering a same random password on the pervasive device as on the device configured as the personal authentication gateway; receiving an encryption key and encrypted value on the device configured as the personal authentication gateway; computing a fingerprint of the value encrypted by the encryption key and the same random password; and comparing the fingerprint of the value on the pervasive device.
-
-
15. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform steps comprising:
-
registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; receiving at least one token request for access credentials from at least one pervasive device at a device configured as a personal authentication gateway for a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; determining whether the at least one pervasive device is a member of the pervasive authentication domain; and sending at least one token response including the access credentials to the at least one pervasive device from the device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and wherein said registering step comprises; entering a same random password on the device configured as the personal authentication gateway as on the at least one pervasive device; and transmitting an encryption key and encrypted value generated on the device configured as the personal authentication gateway to the at least one pervasive device such that the at least one pervasive device can compute a fingerprint of the value encrypted by the encryption key and the same random password and compare the fingerprint of the value.
-
-
16. An article of manufacture comprising:
-
a non-transitory computer usable medium having computer readable program code means embodied therein for performing steps for retrieving at least one authentication token from a device configured as a personal authentication gateway, said steps comprising; registering, at the device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; ascertaining a device configured as a personal authentication gateway for a pervasive authentication domain from at least one pervasive device, the pervasive authentication domain including devices authorized to share access credentials; sending at least one token request for access credentials from at least one pervasive device to the device configured as a personal authentication gateway; and receiving a token response including the access credentials at the at least one pervasive device from the device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and wherein said registering step comprises; entering a same random password on the pervasive device as on the device configured as the personal authentication gateway; receiving an encryption key and encrypted value generated on the device configured as the personal authentication gateway; computing a fingerprint of the value encrypted by the encryption key and the same random password; and comparing the fingerprint of the value on the pervasive device.
-
-
17. An article of manufacture comprising:
-
a non-transitory computer usable medium having computer readable program code means embodied therein for performing steps comprising; registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; receiving at least one token request for access credentials from at least one pervasive device at a device configured as a personal authentication gateway for a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; determining whether the at least one pervasive device is authorized to receive authentication tokens; and sending at least one token response including the access credentials to the at least one pervasive device from the device configured as a personal authentication gateway; wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as the personal authentication gateway; and wherein said registering step comprises; entering a same random password on the device configured as the personal authentication gateway as on the at least one pervasive device; and transmitting an encryption key and encrypted value generated on the device configured as the personal authentication gateway to the at least one pervasive device such that the at least one pervasive device can compute a fingerprint of the value encrypted by the encryption key and the same random password and compare the fingerprint of the value.
-
-
18. A computer program product comprising a non-transitory computer usable medium having computer readable program code means embodied therewith for performing steps comprising:
-
registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials; discovering the device configured as a personal authentication gateway for a pervasive authentication domain, the pervasive authentication domain including one or more pervasive devices authorized to receive authentication tokens including access credentials for authenticating to one or more services on behalf of a user; sending at least one request for at least one token required by the at least one pervasive device for authenticating to one or more services; accepting at least one token request and sending at least one token response with at least one authentication token to the at least one pervasive device; wherein said registering step comprises; entering a same random password on the pervasive device as on the device configured as the personal authentication gateway; receiving an encryption key and encrypted value generated on the device configured as the personal authentication gateway; computing a fingerprint of the value encrypted by the encryption key and the same random password; and comparing the fingerprint of the value on the pervasive device.
-
Specification