Method for using a remote secure device to authenticate a client device to access a remote service

• US 9,455,971 B2
• Filed: 11/18/2011
• Issued: 09/27/2016
• Est. Priority Date: 11/30/2010
• Status: Expired due to Fees

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Ganem, Herve
• Primary Examiner(s): Zhao, Don
• Application Number:
  US13/990,424
• Publication Number:
  US 20130254846A1
• Time in Patent Office: 1,775 Days
• Field of Search: 726/3, 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04M 1/72412 using two-way short-range wireless interfaces

Abstract

The invention relates to a method for a client device (2) to access to remote secure data on a remote secure device (1), said secure data being associated to a remote service, characterized in that it comprises creating a secure peer to peer channel (3) between a client application (21) of a client device and said remote secure device so as the client device and the remote secure device exchange data (4) securely and bidirectionally.

Claims

1. A method to provide access for a user to a remote service application via a client application executing on a client device by using remote secure data on a remote secure device to authenticate the client application to the remote service application, the remote secure data being associated to a remote service, the method comprising:

establishing a first communications session between the client application and the remote service;

receiving by the client application an authentication challenge from the remote service;

transmitting the authentication challenge from the client application to a virtual secure device reader of the client device;

establishing a second communications session that is a secure channel between the virtual secure device reader and the remote secure device , the second communications session enabling that the client device and the remote secure device exchange data securely and bidirectionally;

transmitting the authentication challenge from the virtual secure device reader of the client device to the remote secure device;

transferring a dynamically changing user interface for authenticating the user from the remote secure device to the client device; and

upon successful authentication of the user to the remote secure device using the transferred interface, operating the remote secure device to answer the authentication challenge using the remote secure data to the virtual secure device reader;

forwarding an authentication challenge answer from the virtual secure device reader to the remote service via the client application; and

initiating the remote service upon verifying the authentication challenge answer as an authentication credential to the remote service.

2. The method according to claim 1, further comprising accessing to the remote service after an authentication of the user.

3. The method according to claim 2, further comprising using a server for establishing the second communications session between the virtual secure device reader of the client device and the secure remote device, the server allowing only one user to register at the same time.

4. The method according to claim 2, further comprising using a PC or a handset as client device.

5. The method according to claim 2, further comprising building secure IMS applications.

6. The method according to claim 1, further comprising using a server for establishing the second communications session between the virtual secure device reader of the client device and the secure remote device, the server allowing only one user to register at the same time.

7. The method according to claim 6, wherein the server for establishing the second communications session is a predefined SIP (Session Initiation Protocol) server which allows only the one user to register at the same time at a SIP address.

8. The method according to claim 7, further comprising using a PC or a handset as client device.

9. The method according to claim 7 wherein the remote secure device is also connected to the predefined SIP server by means of a mutual authentication between the SIP and the remote secure device.

10. The method according to claim 9 wherein the virtual secure device reader device passes an authentication challenge from the remote service to the remote secure device and receives answers from the remote secure device over the second communications session.

11. The method according to claim 10 wherein the second communications session is an MSRP (Message Session Relay Protocol) SIP session between the virtual secure device reader device and the remote secure device.

12. The method according to claim 6, further comprising using a PC or a handset as client device.

13. The method according to claim 6, further comprising building secure IMS applications.

14. The method according to claim 1, further comprising using a PC or a handset as client device.

15. The method according to claim 1, further comprising building secure IMS applications.