System and method of authenticating a user to a service provider

• US 20050289341A1
• Filed: 06/24/2004
• Published: 12/29/2005
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Nokia Corporation
• Inventors: Ritola, Timo, Somero, Mika
• Granted Patent: US 8,499,153 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A system, device, computer program product, and method provide authentication of a user to a service provider. The system includes a service provider, a terminal, and a network that allows communication between the service provider and the terminal. The terminal includes a memory, a communication interface, a processor, and an Identity Provider (IDP) application. The communication interface is configured to receive an authentication request from a service provider wherein the authentication request includes an acceptable identity provider and to send the authentication request to the acceptable identity provider if the acceptable identity provider matches a supported identity provider stored in the memory of the terminal. The processor is coupled to the communication interface and to the memory and executes the IDP application. The IDP application is configured to compare the acceptable identity provider with the supported identity provider stored in the memory.

Claims

1. A method of authenticating a user to a service provider, the method comprising:

receiving an authentication request from a service provider at a terminal using a network wherein the authentication request includes an acceptable identity provider;

comparing, at the terminal, the acceptable identity provider with a supported identity provider stored in a memory of the terminal; and

if the acceptable identity provider matches the supported identity provider, sending the authentication request from the terminal to the acceptable identity provider using the network.

2. The method of claim 1;

wherein the memory comprises a cache.

3. The method of claim 1, wherein the memory comprises a non-volatile memory.

4. The method of claim 1, further comprising storing the supported identity provider in a cache of the terminal.

5. The method of claim 1, wherein the supported identity provider comprises a default identity provider.

6. The method of claim 1, further comprising selecting a default identity provider.

7. A method of authenticating a user to a service provider, the method comprising:

receiving an authentication request from a service provider at a terminal using a network wherein the authentication request includes an acceptable identity provider;

comparing, at the terminal, the acceptable identity provider with a supported identity provider stored in a memory of the terminal;

if the acceptable identity provider matches the supported identity provider, displaying the acceptable identity provider to a user of the terminal;

selecting the acceptable identity provider displayed to the user of the terminal; and

sending the authentication request from the terminal to the selected acceptable identity provider using the network.

8. The method of claim 7, wherein the memory comprises a cache.

9. The method of claim 7, wherein the memory comprises a non-volatile memory.

10. The method of claim 7, further comprising entering an access code before comparing the acceptable identity provider with the supported identity provider.

11. The method of claim 7, further comprising:

if the acceptable identity provider does not match the supported identity provider, forwarding the authentication request to the acceptable identity provider from the terminal;

if the authentication request is forwarded to the acceptable identity provider, receiving the authentication request at the acceptable identity provider;

if the authentication request is received at the acceptable identity provider, authenticating the user at the acceptable identity provider;

if the user is authenticated at the acceptable identity provider, creating an authentication response at the acceptable identity provider;

if the authentication response is created at the acceptable identity provider, sending the authentication response to the terminal from the acceptable identity provider;

if the authentication response is sent from the acceptable identity provider, receiving the authentication response at the terminal; and

if the authentication response is received, sending the authentication response from the terminal to the service provider using the network.

12. The method of claim 11, further comprising storing the acceptable identity provider in the memory of the terminal if the authentication response is received at the terminal.

13. A computer program product for authenticating a user to a service provider, the computer program product comprising:

computer code configured to;

receive an authentication request from a service provider wherein the authentication request includes an acceptable identity provider;

compare the acceptable identity provider with a supported identity provider; and

if the acceptable identity provider matches the supported identity provider, send the authentication request to the acceptable identity provider.

14. The computer program product of claim 13, wherein the computer code is further configured to store supported identity provider data in a memory.

15. The computer program product of claim 14, wherein the memory is a cache.

16. The computer program product of claim 13, wherein the supported identity provider comprises a default identity provider.

17. The computer program product of claim 13, wherein the computer code is further configured to allow a user to select a default identity provider.

18. A computer program product for authenticating a user to a service provider, the computer program product comprising:

computer code configured to;

receive an authentication request from a service provider wherein the authentication request includes an acceptable identity provider;

compare the acceptable identity provider with a supported identity provider;

if the acceptable identity provider matches the supported identity provider, display the acceptable identity provider to a user;

allow a user to select the acceptable identity provider displayed to the user; and

send the authentication request to the selected acceptable identity provider.

19. The computer program product of claim 18, wherein the computer code is further configured to prompt the user for an access code before comparing the acceptable identity provider with the supported identity provider.

20. The computer program product of claim 18, wherein the computer code is further configured to:

if the acceptable identity provider does not match the supported identity provider, forward the authentication request to the acceptable identity provider;

if an authentication response is sent from the acceptable identity provider, receive the authentication response; and

if the authentication response is received, send the authentication response to the service provider.

21. The computer program product of claim 20, wherein the computer code is further configured to store the acceptable identity provider in a memory if the authentication response is received.

22. A device for authenticating a user to a service provider, the device comprising:

a memory;

a communication interface configured to;

receive an authentication request from a service provider wherein the authentication request includes an acceptable identity provider; and

send the authentication request to the acceptable identity provider if the acceptable identity provider matches a supported identity provider stored in the memory;

a processor, coupled to the communication interface and to the memory, to execute an application; and

the application configured to compare the acceptable identity provider with the supported identity provider stored in the memory.

23. The device of claim 22, wherein the memory comprises a cache.

24. The device of claim 22, wherein the memory comprises a non-volatile memory.

25. The device of claim 22, wherein the application is further configured to store the acceptable identity provider in a cache.

26. The device of claim 22, wherein the supported identity provider comprises a default identity provider.

27. The device of claim 22, wherein the application is further configured to allow a user to select a default identity provider.

28. The device of claim 22, wherein the application is further configured to:

if the acceptable identity provider matches the supported identity provider, display the acceptable identity provider to a user; and

allow a user to select the acceptable identity provider displayed to the user.

29. The device of claim 28, wherein the application is further configured to prompt the user for an access code before comparing the acceptable identity provider with the supported identity provider.

30. The device of claim 28, wherein the communication interface is further configured to:

if the acceptable identity provider does not match the supported identity provider, forward the authentication request to the acceptable identity provider;

if an authentication response is sent from the acceptable identity provider, receive the authentication response; and

if the authentication response is received, send the authentication response to the service provider.

31. The device of claim 30, wherein the application is further configured to store the acceptable identity provider in the memory if the authentication response is received.

32. A system for authenticating a user to a service provider, the system comprising:

a service provider;

a terminal comprising;

a memory;

a communication interface configured to;

receive an authentication request from the service provider wherein the authentication request includes an acceptable identity provider; and

send the authentication request to the acceptable identity provider if the acceptable identity provider matches a supported identity provider stored in the memory;

a processor, coupled to the communication interface and to the memory, to execute an application; and

the application configured to compare the acceptable identity provider with the supported identity provider stored in the memory; and

a network that allows communication between the service provider and the terminal.

33. The system of claim 32, wherein the network comprises a wireless network.

34. The system of claim 32, wherein the network comprises a cellular telephone network.

35. The system of claim 32, wherein the network comprises the Internet.

36. The system of claim 32, wherein the memory of the terminal comprises a cache.

37. The system of claim 32, wherein the memory of the terminal comprises a non-volatile memory.

38. The system of claim 32, wherein the application of the terminal is further configured to store the supported identity provider in a cache of the terminal.

39. The system of claim 32, wherein the supported identity provider of the terminal comprises a default identity provider.

40. The system of claim 32, wherein the application of the terminal is further configured to allow a user to select a default identity provider.

41. The system of claim 32, wherein the application of the terminal is further configured to:

if the acceptable identity provider matches the supported identity provider, display the acceptable identity provider to a user; and

allow a user to select the acceptable identity provider displayed to the user.

42. The system of claim 41, wherein the application is further configured to prompt the user for an access code before comparing the acceptable identity provider with the supported identity provider.

43. The system of claim 41, wherein the communication interface of the terminal is further configured to:

if the acceptable identity provider does not match the supported identity provider, forward the authentication request to the acceptable identity provider;

if an authentication response is sent from the acceptable identity provider, receive the authentication response; and

if the authentication response is received, send the authentication response to the service provider.

44. The system of claim 43, wherein the application of the terminal is further configured to store the acceptable identity provider in the memory of the terminal if the authentication response is received.