Apparatus and method for integrating authentication protocols in the establishment of connections between computing devices

• US 8,533,329 B2
• Filed: 03/14/2011
• Issued: 09/10/2013
• Est. Priority Date: 09/22/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Hammell, Jonathan F., Robertson, Ian M., Brown, Michael Kenneth, Kirkup, Michael Grant, Little, Herbert Anthony
• Primary Examiner(s): Tran, Philip B.
• Application Number:
  US13/046,861
• Publication Number:
  US 20110167484A1
• Time in Patent Office: 911 Days
• Field of Search: 709/225, 726/4, 726/6, 726/15
• US Class Current: 709/225
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

An apparatus and method for integrating authentication protocols in the establishment of connections between a controlled-access first computing device and at least one second computing device. In one embodiment, network access user authentication data needed to access the at least one second computing device is transmitted to an authentication server automatically if the user has access to use the first computing device, thereby not requiring the user to manually enter the authentication data needed for such access at the first computing device. The network access user authentication data may be, for example, retrieved from a memory store of the first computing device and/or generated in accordance with an authentication data generating algorithm.

Claims

1. A mobile device configured to integrate authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the processor is configured to:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiate user authentication at the remote device by;

retrieving network access user authentication data stored on the mobile device;

generating additional authentication data at the mobile device;

retrieving formatting data stored on the mobile device, wherein the formatting data specifies a format for a login string as being the generated additional authentication data followed by the stored network access user authentication data, or the generated additional authentication data preceded by the stored network access user authentication data;

combining the stored network access user authentication data with the generated additional authentication data according to the format specified by the formatting data to produce the login string, prior to transmission of the user authentication data for the remote device to an authentication server; and

transmitting, to the authentication server, the login string for user authentication at the remote device.

2. The device of claim 1, wherein the authentication server resides on a third computing device coupled to the remote device.

3. The device of claim 1, wherein the authentication server resides on the remote device.

4. The device of claim 1, wherein the processor is further configured to:

receive device access user authentication data for requesting access to use the mobile device;

perform user authentication at the mobile device using the device access user authentication data; and

grant access to use the mobile device if the user authentication at the mobile device is successful.

5. The device of claim 1, wherein the connection connects the mobile device and the remote device in a virtual private network.

6. The device of claim 1, wherein the processor is configured to store the network access user authentication data in a memory store of the mobile device prior to negotiating user authentication at the remote device.

7. The device of claim 6, wherein the network access user authentication data is stored in the memory store after determining that storage of the network access user authentication data is permitted by an IT Policy governing the use of the mobile device.

8. The device of claim 6, wherein the network access user authentication data stored on the mobile device comprises a password.

9. The device of claim 1, wherein the additional authentication data generated at the mobile device is generated after determining that generation of the additional authentication data is permitted by an IT Policy governing the use of the mobile device.

10. The device of claim 1, wherein the additional authentication data generated at the mobile device is generated in accordance with a token generating algorithm.

11. The device of claim 10, wherein the token generating algorithm is a two-factor token generating algorithm.

12. The device of claim 1, wherein the processor is configured to set a state of an indicator to one of an active state and an inactive state to indicate whether the user authentication data for the remote device should be automatically transmitted to the authentication server, wherein the user authentication data for the remote device is transmitted automatically from the mobile device to the authentication server after determining that the indicator is set to the active state.

13. The device of claim 12, wherein the state of the indicator is settable remotely in accordance with an IT policy governing use of the mobile device.

14. The device of claim 1, wherein the processor is configured to retrieve the network access user authentication data from a different device prior to storing the network access user authentication data on the mobile device.

15. The device of claim 14, wherein the different device is configured to inform the remote device to expect a connection request from the mobile device, in response to network access user authentication data being retrieved from the different device by the mobile device.

16. A method of integrating, on a mobile device, authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the processor performs acts of the method comprising:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiating user authentication at the remote device by;

retrieving network access user authentication data stored on the mobile device;

generating additional authentication data at the mobile device;

retrieving formatting data stored on the mobile device, wherein the formatting data specifies a format for a login string as being the generated additional authentication data followed by the stored network access user authentication data, or the generated additional authentication data;

combining the stored network access user authentication data with the generated additional authentication data according to the format specified by the formatting data to produce the login string, prior to transmission of the user authentication data for the remote device to an authentication server; and

transmitting, to the authentication server, the login string for user authentication at the remote device.

17. A computer-readable memory comprising instructions for integrating, on a mobile device, authentication protocols in establishing a connection to a remote device, the mobile device comprising a processor and a memory, wherein the instructions when executed configures the processor to:

in response to a successful user authentication at the mobile device such that access to use the mobile device has been granted, negotiate user authentication at the remote device by;

retrieving network access user authentication data stored on the mobile device;

generating additional authentication data at the mobile device;

retrieving formatting data stored on the mobile device, wherein the formatting data specifies a format for a login string as being the generated additional authentication data followed by the stored network access user authentication data, or the generated additional authentication data preceded by the stored network access user authentication data;

combining the stored network access user authentication data with the generated additional authentication data according to the format specified by the formatting data to produce the login string, prior to transmission of the user authentication data for the remote device to an authentication server; and

transmitting, to the authentication server, the login string for user authentication at the remote device.