System and method for identity management for mobile devices

• US 9,729,537 B2
• Filed: 06/06/2016
• Issued: 08/08/2017
• Est. Priority Date: 02/15/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Lambert, Kenneth Jason William, Cornet, Jrme Bertrand Nicolas, McBride, Brian Everett
• Primary Examiner(s): Nguyen, David Q
• Application Number:
  US15/174,831
• Publication Number:
  US 20160285849A1
• Time in Patent Office: 428 Days
• Field of Search: 455411, 455410, 455409, 4554141, 379 9303
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

Systems and methods for managing a user identity on a mobile device are provided. The system comprises the mobile device comprising a user agent and a client application, the user agent and the client application in communication with each other. The system further comprises an identity provider in communication with the mobile device, and a client service in communication with the mobile device. The user agent is configured to communicate with the identity provider and retrieve the user identity for the client application, and the client application is configured to transmit the user identity to the client service.

Claims

1. A non-transitory computer readable media for storing computer executable instructions for enabling a processor to perform cryptographic operations for secure communication of data to a client service in communication with an untrusted client application on a mobile device for enabling a user to utilize the client service, the computer executable instructions for:

generating a request for user profile data stored externally at an identity provider;

sending the request to the identity provider;

obtaining, in response to the request, a token secret and an encrypted token provided to the untrusted client application and the client service, the encrypted token comprising the user profile data specified in the request and the token secret, the encrypted token being decryptable by the client service;

wherein the untrusted client application is unable to decrypt the encrypted token to obtain the user profile data, communicating the encrypted token to the client service for authentication; and

providing the token secret from the untrusted client application to the client service as proof of ownership of the encrypted token; and

wherein the client service verifies that the token secret from the untrusted client application matches the token secret of the encrypted token as proof that the token secret includes the requested user profile data.

2. The non-transitory computer readable media of claim 1 wherein the encrypted token is only decryptable by the client service.

3. The non-transitory computer readable media of claim 1 wherein providing the request to the identity provider comprises:

the client application generating the request; and

providing the request to a user agent on the mobile device for communicating the request to the identity provider.

4. The non-transitory computer readable media of claim 1 wherein a user agent on the mobile device obtains and stores the token secret and the encrypted token.

5. The non-transitory computer readable media of claim 4 wherein the user agent sends the token secret and the encrypted token to the client application, and the client application communicates the token secret and the encrypted token to the client service.

6. The non-transitory computer readable media of claim 4 wherein the user agent stores the token secret and the encrypted token for a threshold amount of time before the encrypted token is revoked.

7. The non-transitory computer readable media of claim 4 wherein multiple users are authenticated to the mobile device, and the user agent identifies which one of the multiple of users is presently authenticated to the mobile device.

8. The non-transitory computer readable media of claim 4 wherein the user agent issues a prompt to the user via a user interface of the mobile device requesting consent to provide the encrypted token and the token secret to the client application, and if the user agent does not receive consent, then the user agent does not provide at least the encrypted token to the client application.

9. The non-transitory computer readable media of claim 1 wherein the user profile data includes an ecoID for identifying the user, wherein the ecoID is a property of a token that does not change over time.

10. A non-transitory computer readable media for storing computer executable instructions for managing user identity information, the computer executable instructions for:

sending user credentials from a user agent on a mobile device to an identity provider for verification, the mobile device in communication with the identity provider;

if the user credentials are verified, receiving, by the user agent, a token from the identity provider;

receiving a request for the user identity information from a client service;

sending the request and the token to the identity provider;

retrieving the user identity information from the identity provider; and

sending the user identity information from the user agent to the client service, via a client application on the mobile device.

11. The non-transitory computer readable media of claim 10 wherein the identity provider comprises a server, and the client service comprises another server.

12. The non-transitory computer readable media of claim 10 wherein the mobile device comprises an operating system, and the computer executable instructions further comprises instructions for the operating system invoking the user agent when turning on the mobile device.

13. The non-transitory computer readable media of claim 10 wherein the mobile device comprises multiple client applications, and the computer executable instructions further comprises instructions for the mobile device, upon signing into the user agent, signing into the multiple client applications.

14. The non-transitory computer readable media of claim 10 wherein the computer executable instructions further comprise instructions for, if the user credentials are verified, creating a credential store on the mobile device to store the user credentials and the token.

15. The non-transitory computer readable media of claim 10 wherein the user credentials comprise a username and a password.

16. The non-transitory computer readable media of claim 10, the computer executable instructions further comprising instructions for:

displaying a graphical user interface on the mobile device, and receiving through a GUI the user credentials.

17. The non-transitory computer readable media of claim 14 wherein the credential store stores credentials for the client application.

18. The non-transitory computer readable media of claim 17 wherein, to sign into the client application, the computer executable instructions further comprises instructions for:

the user agent retrieving from the credential store the credentials for the client application and sending the credentials for the client application to the client application; and

the client application using the credentials for the client application to log into the client application.