Zero sign-on authentication

• US 9,602,425 B2
• Filed: 06/26/2014
• Issued: 03/21/2017
• Est. Priority Date: 12/31/2009
• Status: Active Grant

• Current Assignee: Cable Television Laboratories Incorporated
• Original Assignee: Cable Television Laboratories Incorporated
• Inventors: Durbha, Seetharama R., Marcia, Oscar, Hoggan, Stuart, Krauss, Simon
• Primary Examiner(s): DOAN, DUYEN MY
• Application Number:
  US14/315,949
• Publication Number:
  US 20140310416A1
• Time in Patent Office: 999 Days
• Field of Search: 709/225, 726/2, 726/4, 726/6
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1012 to domains
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 65/1023 Media gateways
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/25841 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; arrangements for identifying locations of receiving stations in broadcast systems H04H60/51; location of the user terminal in data switching networks H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00

Abstract

A authenticating system and process for authenticating user devices to a access a media service where access to certain portions of the media service may be limited according to a gateway or other device used by a user device to facilitate interfacing a user with the media service. The authentication may be achieved without directly assessing a trustworthiness of the user devices, and optionally, without requiring a user thereof to complete a sign-on operation.

Claims

1. A method of providing zero sign-on (ZSO) authentication comprising:

determining a media access request from a first device requesting access to a media service associated with a service provider, the media access request being generated as a result of a user interacting with a webpage displayed on the device using signaling transmitted through a gateway;

determining a location for the gateway as a function of information included within the media access request;

determining a level of trust for a second device determined to be at the location; and

enabling the first device ZSO authentication sufficient to access the media service if the level of trust is sufficient and denying the first device ZSO authentication if the level of trust is insufficient.

2. The method claim 1 further comprising providing the first device ZSO authentication by enabling the first device access to the media service without requiring the user to input a username and password combination to the first device and without requiring communication of the username and password combination via the signaling being transmitted through the gateway from the first device to facilitate transmitting the media access request.

3. The method claim 2 further comprising providing the first device sign-on (SO) authentication sufficient to access the media service following transmission of the username and password combination from the first device via the gateway when the level of trust is insufficient for ZSO authentication.

4. The method of claim 2 further comprising determining the level of trust for the second device as a function of a credential transmitted to the service provider via signaling sent independently of the gateway such that the level of trust is determined independently of the gateway and without assessing trustworthiness of the gateway, including determining the level of trust to be sufficient if the credential includes information or data indicating the second device is within a domain of the service provider.

5. The method claim 1 further comprising:

receiving a credential from the second device; and

determining the level of trust for the second device as a function of information included within the credential.

6. The method claim 5 further comprising receiving the credential within signaling transmitted from the second device to the service provider through the gateway proximate in time to the media request transmitted from the first device to the service provider through the gateway.

7. The method of claim 5 further comprising receiving the credential through signaling transmitted independently of the gateway.

8. The method claim 7 further comprising receiving the credential through signaling transmitted over a private network of the service provider, the gateway being unable to facilitate signaling over the private network.

9. The method claim 1 further comprising:

receiving a nonce signed by the second device via signaling transmitted from the first device through the gateway; and

determining the level of trust for the second device as a function of information associated with the nonce if a signature of the nonce is verified to be that of the second device.

10. The method of claim 9 further comprising:

determining a port being used by the second device to listen for messages carried over a network at the location; and

directing the first device to transmit the nonce to the port for signature by the second device.

11. The method claim 10 wherein the gateway provides network address translation (NAT) for the network such that the first and second devices are each assigned a unique inside address when communicating over the network and a same outside address when communicating outside of the network, the media access request being transmitted through the gateway outside of the network.

12. The method of claim 1 further comprising selecting the second device from a plurality of devices, each of the plurality of devices being associated with an Internet Protocol (IP) address used by the gateway to facilitate signaling over an outside network operating independently of an inside network connecting the first and second devices to the gateway.

13. A non-transitory computer-readable medium having a plurality of instructions operable with a processor to facilitate providing zero sign-on (ZSO) authentication, the plurality of instructions being sufficient for:

determining a media access request issued from a first device requesting access to a media service associated with a service provider, the media access request identifying an Internet Protocol (IP) address for a gateway used to transmit the media access request;

enabling the first device ZSO authentication to the media service if a level of trust for a second device also communicating signaling through the gateway using the IP address is sufficient and denying the first device ZSO authentication if the level of trust is insufficient; and

determining the level of trust for the second device as a function of a credential transmitted from the second device to the service provider independently of the gateway such that the credential is received by the service provider without passing or otherwise being communicated through the gateway.

14. The non-transitory computer-readable medium of claim 13 further comprising instructions sufficient for:

instructing the first device to request the second device to sign a nonce provided from the first device for purposes of generating a signed nonce;

instructing the first device to transmit the signed nonce to the service provider via the gateway; and

verifying the signed nonce as having been previously signed by the second device before determining the level of trust to be sufficient for the ZSO authentication.

15. The non-transitory computer-readable medium of claim 14 further comprising instructions sufficient for instructing the first device to issue a nonce request to the second device over a network connected therebetween, the nonce request including the nonce and prompting the second device to provide the signed nonce to the first device and being addressed to a port identified with a dial home application operating on the second device, the dial home application identifying the port to the service provider using signaling transmitted through the gateway.

16. A non-transitory computer-readable medium having a plurality of instructions operable with a processor to facilitate authenticating an untrusted device to access a media service previously authenticated as being available to a trusted device when both of the trusted and untrusted devices communicate with each other over an inside network and communicate with a source of the content over an outside network, an untrusted gateway facilitating exchange of signaling between the inside and outside networks, the plurality of instructions being sufficient for:

determining a media access request issued from the untrusted device through the untrusted gateway requesting access to the media service;

determining an inside address for the trusted device as a function of information included within the media access request;

instructing the untrusted device to obtain a nonce signed by the trusted device using signaling communicated over the inside network according to the inside address;

determining the nonce issued from the untrusted device through the untrusted gateway; and

enabling the untrusted device ZSO authentication to the media service if a signature of the nonce issued from the untrusted device is verified and denying the untrusted device ZSO authentication if the signature is unverified.

17. The non-transitory computer-readable medium of claim 16 further comprising instructions sufficient for determining the inside address as a function of a message received from a dial home application operating on the trusted device, the dial home application determining the inside address a function of a port listened to by the trusted device to receive signaling over the inside network.

18. The non-transitory computer-readable medium of claim 17 further comprising receiving the message through signaling communicated from the trusted device independently of the gateway.

19. The non-transitory computer-readable medium of claim 18 further comprising non-transitory instructions sufficient for issuing a key to the trusted device through a private network used to communicate the message independently of the gateway, the trusted device subsequently using the key to sign the nonce.