Method and apparatus for pervasive authentication domains

• US 8,103,871 B2
• Filed: 10/31/2007
• Issued: 01/24/2012
• Est. Priority Date: 10/14/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Giles, James R., Sailer, Reiner
• Primary Examiner(s): SHAW, YIN CHEN
• Application Number:
  US11/932,918
• Publication Number:
  US 20080141357A1
• Time in Patent Office: 1,546 Days
• Field of Search: 726/2, 726 5- 10, 713/150, 713/153, 713/168, 713/170, 713/182
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

Methods and apparatus for enabling a Pervasive Authentication Domain. A Pervasive Authentication Domain allows many registered Pervasive Devices to obtain authentication credentials from a single Personal Authentication Gateway and to use these credentials on behalf of users to enable additional capabilities for the devices. It provides an arrangement for a user to store credentials in one device (the Personal Authentication Gateway), and then make use of those credentials from many authorized Pervasive Devices without re-entering the credentials. It provides a convenient way for a user to share credentials among many devices, particularly when it is not convenient to enter credentials as in a smart wristwatch environment. It further provides an arrangement for disabling access to credentials to devices that appear to be far from the Personal Authentication Gateway as measured by metrics such as communications signal strengths.

Claims

1. A method comprising:

registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials;

ascertaining the device configured as a personal authentication gateway from the at least one pervasive device included in a pervasive authentication domain;

sending at least one token request from the at least one pervasive device to the device configured as a personal authentication gateway; and

receiving a token response including the access credentials from the device configured as a personal authentication gateway;

wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and

wherein said registering step comprises;

entering a same random password on the at least one pervasive device and the device configured as a personal authentication gateway;

generating on the device configured as a personal authentication gateway a protected encryption key by having Slave_ID_Secret encrypted by the same random password;

transferring the protected key to the at least one pervasive device and computing a fingerprint of the protected key on the device configured as a personal authentication gateway; and

comparing the fingerprint of the received and decrypted protected encryption key on the at least one pervasive device.

2. The method according to claim 1, wherein said ascertaining step comprises broadcasting a pervasive authentication domain discovery request message and receiving at least one discovery response message.

3. The method according to claim 1, wherein said ascertaining step comprises looking up a personal authentication gateway address in configuration settings.

4. The method according to claim 1, wherein the at least one token request comprises a pervasive device identification, a message type, and a protection arrangement for fields of the at least one token request, the protection arrangement being adapted to ensure integrity and confidentiality.

5. The method according to claim 1, wherein said receiving step comprises storing received credentials for use by other applications.

6. The method according to claim 1, further comprising the step of registering a pervasive device to be a member of the pervasive authentication domain by registering with the device configured as a personal authentication gateway.

7. A method comprising:

registering, at a device configured as a personal authentication gateway, at least one pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials;

receiving at least one token request for access credentials from the at least one pervasive device;

determining whether the at least one pervasive device is a member of the pervasive authentication domain based on a pervasive device identification; and

sending at least one token response including the access credentials to the at least one pervasive device from the device configured as a personal authentication gateway;

wherein the access credentials allow the at least one pervasive device to authenticate to one or more services on behalf of a user as configured in the device configured as a personal authentication gateway; and

wherein said registering step comprises;

entering a same random password on the at least one pervasive device and the device configured as a personal authentication gateway;

generating on the device configured as a personal authentication gateway a protected encryption key by having Slave_ID_Secret encrypted by the same random password;

transferring the protected key to the at least one pervasive device and computing a fingerprint of the protected key on the device configured as a personal authentication gateway; and

comparing the fingerprint of the received and decrypted protected encryption key on the at least one pervasive device.

8. The method according to claim 7, wherein said sending step comprises the device configured as a personal authentication gateway responding to a pervasive authentication domain discovery message from the at least one pervasive device.

9. The method according to claim 8, wherein:

said device configured as a personal authentication gateway has a pervasive authentication domain;

said sending comprises sending the at least one token response only if the pervasive device identification for the pervasive authentication domain discovery message is a member of the pervasive authentication domain of the device configured as a personal authentication gateway.

10. The method according to claim 7, wherein said receiving step comprises:

determining a pervasive device identification of the at least one token request;

deriving at least one pervasive authentication domain for the at least one pervasive device; and

retrieving at least one authentication token for the pervasive device.

11. The method according to claim 7, wherein the at least one token response sent comprises of a pervasive device identification, the message type, authentication tokens, and a protection arrangement for fields of the at least one token response, the protection arrangement being adapted to ensure integrity and confidentiality.

12. The method according to claim 7, wherein the encryption key, Slave_ID_Secret, is used as a protection arrangement for token requests and token responses.

13. The method according to claim 10, wherein said determining step comprises validating that the at least one pervasive device has been registered for the at least one pervasive authentication domain.

14. The method according to claim 10, wherein said determining step comprises ascertaining whether the at least one pervasive device is within a given distance of the device configured as a personal authentication gateway.

15. The method according to claim 10, wherein said determining step comprises ascertaining whether the at least one pervasive device has recently made a previous request.

16. The method according to claim 10, wherein said determining step comprises ascertaining whether the at least one pervasive device has not sent a message indicating that the at least one pervasive device is no longer to be trusted.

17. A method comprising:

configuring a pervasive device as a personal authentication gateway;

registering, at the pervasive device, at least one other pervasive device for membership in a pervasive authentication domain, the pervasive authentication domain including devices authorized to share access credentials;

receiving at least one token request for access credentials from the at least one other pervasive device;

determining whether the at least one other pervasive device is a member of the pervasive authentication domain; and

sending at least one token response including the access credentials to the at least one other pervasive device from the pervasive device;

wherein the access credentials allow the at least one other pervasive device to authenticate to one or more services on behalf of a user as configured in the pervasive device; and

wherein said registering step comprises;

entering a same random password on the at least one pervasive device and the device configured as a personal authentication gateway;

generating on the device configured as a personal authentication gateway a protected encryption key by having Slave_ID_Secret encrypted by the same random password;

transferring the protected key to the at least one pervasive device and computing a fingerprint of the protected key on the device configured as a personal authentication gateway; and

comparing the fingerprint of the received and decrypted protected encryption key on the at least one pervasive device.