Single sign-on process

• US 20060013393A1
• Filed: 09/14/2005
• Published: 01/19/2006
• Est. Priority Date: 02/08/2000
• Status: Active Grant

• Current Assignee: VL Collective IP, LLC (VideoLabs, Inc.)
• Original Assignee: Swisscom Mobile AG (Government of Switzerland)
• Inventors: Lauper, Eric, Ferchichi, Azim
• Granted Patent: US 8,793,779 B2
• Time in Patent Office: Days
• US Class Current: 380/247
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

Single sign-on process allowing a mobile user with a mobile phone or with a laptop to remote-access a remote server, comprising the steps of: (1) sending a first authenticator over a first communication layer to a first intermediate equipment between said mobile equipment and said remote server, (2) verifying in said first intermediate equipment said first authenticator sent by said mobile equipment, (3) if said first authenticator is accepted by said first intermediate equipment, completing the communication layer between said mobile equipment and said intermediate equipment, (4) repeating steps (1) to (3) with a plurality of successive intermediate equipment and over a plurality of successive communication layers, until a communication has been completed at the last requested communication layer between said mobile equipment and said remote server, wherein at least a plurality of said authenticators are furnished by a smart-card in said mobile equipment.

Claims

1. A single sign-on method allowing a user to remote-access a remote location using a single sign-on module, comprising the steps of:

authenticating said user in a mobile network, using a first authenticator provided by said single sign-on module,

establishing a connexion over said mobile network with said remote location,

authenticating said user in said remote location, using a third authenticator provided by said single sign-on module, said third authenticator being different from said first authenticator,

if said third authenticator is accepted by said remote location, granting access to the user to said remote location.

2. The single sign-on method of claim 1, said remote location comprising an IPSEC gateway, said third authenticator being used by said IPSEC gateway for verifying the identity of said user.

3. The single sign-on method of claim 1, said remote location comprising a firewall, said third authenticator being used by said firewall for verifying the identity of said user.

4. The single sign-on method of claim 1, said remote location comprising a Windows domain, for example a NT domain, said third authenticator comprising a password for logging onto said Windows domain.

5. The single sign-on method of claim 1, said remote location comprising an IPSEC gateway and/or a firewall, said third authenticator being used by said IPSEC gateway and/or by said firewall for verifying the identity of said user,

said remote location further comprising a Windows domain, for example a NT domain, a fourth authenticator being retrieved from said single sign-on module and sent to said Windows domain for logging said user onto said Windows domain.

6. The single sign-on method of claim 1, said remote location comprising a corporate network with remote access capabilities.

7. The single sign-on method of claim 6, said single sign-on module comprising a laptop and a terminal for a mobile network.

8. The single sign-on method of claim 7, said mobile network being a GPRS, EDGE, HSCSD and/or UMTS network.

9. The single sign-on method of claim 1, said single sign-on module comprising processing means for processing said authenticators.

10. The single sign-on method of claim 9, wherein at least one of said authenticators is computed in said single sign-on module using a cryptographic function using at least one key.

11. The single sign-on method of claim 1, said single sign-on module comprising a smart-card for delivering said authenticators.

12. The single sign-on method of claim 1, wherein said single sign-on module initially prompts said user to enter a secret,

and wherein said first authenticator is only sent if the secret entered by said user is correct.

13. A single sign-on module comprising processing means for delivering a plurality of different authenticators for authenticating said user in a mobile network and in a corporate network.

14. The single sign-on module of claim 13, said processing means being arranged for delivering authenticators for authenticating said user in an access point to the Internet.

15. The single sign-on module of claim 13, said processing means being arranged for delivering authenticators for authenticating said user in an IPSEC gateway.

16. The single sign-on module of claim 13, said processing means being arranged for delivering authenticators for authenticating said user in a firewall of said remote location.

17. A single sign-on module comprising processing means for delivering:

first authenticators for authenticating an user in a mobile network,

second authenticators for authenticating said user in an ISP server,

third authenticators for authenticating said user in a corporate network.

18. A method allowing a remote user to replace a secret requested for accessing a network, comprising:

proving knowledge of the old secret to be replaced,

encrypting a new replacement secret with a public key,

sending said encrypted replacement secret to said user,

decrypting said replacement secret with the private key corresponding to said public key,

replacing said old secret with said replacement secret.