Method and system for providing user access to a secure application

• US 20070157298A1
• Filed: 09/19/2006
• Published: 07/05/2007
• Est. Priority Date: 03/20/2005
• Status: Active Grant

• Current Assignee: Actividentity Corporation (Assa Abloy AB)
• Original Assignee: Actividentity Corporation (Assa Abloy AB)
• Inventors: Boyer, John, Hart, Jason, Clark, John, Dingwall, Timothy, Herscovitch, Matthew
• Granted Patent: US 8,381,271 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method and system for providing remote user access to secure financial applications by deployment of SSO software (126) to client workstations (120), including receiving a password for collaborating access to a secure server (110); navigating to the secure server (110) using a web browser (124) on a remote workstation (120); providing user authorisation details and the received password to the secure server (120); generating a subsequent password at the secure server (110) upon validation of the user authorisation details and received password; downloading an SSO deployment file (122) to the remote workstation (120), said deployment file (122) including the subsequent password; executing the SSO deployment file (122) to install an SSO client application (126) on the remote workstation; reading workstation settings and user credentials from a secure file or data store; and running the SSO client application (126) on the workstation to employ the user credentials and subsequent password to logon to the secure application.

Claims

1. A method for providing remote user access to secure financial applications by deployment of SSO software to client workstations, said method including the steps of:

receiving a password for collaborating access to a secure server;

navigating to the secure server using a web browser on a remote workstation;

providing user authorisation details and the received password to the secure server;

generating a subsequent password at the secure server upon validation of the user authorisation details and received password;

downloading an SSO deployment file to the remote workstation, said deployment file including the subsequent password;

executing the SSO deployment file to install an SSO client application on the remote workstation;

reading workstation settings and user credentials from a secure file or data store; and

running the SSO client application on the workstation to employ the user credentials and subsequent password to logon to the secure financial application.

2. The method of claim 1 wherein, if the remote workstation is a shared client workstation, the method further includes the step of uninstalling the SSO client application upon any of:

a) termination of the web browser application,

b) log off from a current user session, or

c) re-starting of the client workstation.

3. The method of claim 1 wherein, if the remote workstation is a single user client workstation, the SSO client application starts automatically without requiring re-entry of user credentials.

4. The method of claim 1 wherein the SSO client facilitates reduced or single sign on type remote access to a plurality of secure applications.

5. The method of claim 1 wherein a secure file for the user credentials is stored on:

a) the user workstation,

b) the web server, and/or

c) a secure third party server.

6. The method of claim 5 wherein the secure file takes the form of an LDAP directory entry, an ordinary file on a local or remote file system, a file on a portable storage device, a token or a smart card.

7. The method of claim 1 wherein user credentials may take the form of identifiers;

passwords, including one-time passwords (OTP);

pass phrases;

certificates;

encryption, signing and authentication key pairs or keys;

Kerberos tickets;

any other authentication or authorisation data.

8. The method of claim 1 wherein the user credentials are secured in a local file by the user authorisation details, such as an initial username and password.

9. The method of claim 1 wherein step of installing the SSO client application is undertaken dynamically to deliver client application functionality based on client location and/or user credentials.

10. The method of claim 1 further including the precursor step of consolidating, encrypting and storing user credentials in the secure file or data store.

11. The method of claim 1 wherein the user authorisation details are encrypted and stored on the web server.

12. The method of claim 1 wherein the SSO application is adapted to intercept and respond to authentication requests issued by the secure application, including requests issued by mainframe applications, web sites, Java applications, Unix applications and/or Windows applications.

13. The method of claim 12 wherein the SSO application is further adapted, in the event that a secure application prompts user credentials to be changed, to:

intercept such application prompts;

ask the user for the changed credentials or automatically generate changed user credentials;

validate that the changed credentials meet the secure application'"'"'s requirements;

enter the changed credentials into the application prompt that was intercepted; and

encrypt and send the changed credentials to the secure file or SSO datastore.

14. The method of claim 13 wherein changes to the SSO datastore are monitored and transferred to an authentication database of the secure application.

15. The method according to claim 1 wherein the password is received from an external source.

16. A system for providing remote user access to secure applications, said system including:

a secure server coupled to a publicly accessible global communications network, said secure server having a single sign-on (SSO) service module, an SSO deployment file and associated user authorisation details;

at least one remote workstation having a web browser for navigating to the secure server via the publicly accessible global communications network; and

wherein the SSO deployment file includes instructions for execution on a plurality of processors for performing the method of any one of claims 1 to 15 to deploy SSO software to client workstations.

17. The system of claim 16 wherein the SSO service module effects initial user authentication and thereafter manages download of the SSO deployment file for execution on said at least one remote workstation.

18. The system of claim 16 wherein the SSO deployment file includes a management control program for controlling download from the secure server and installation of an SSO client application on said at least one workstation.

19. The system of claim 18 wherein, once installed, the SSO client application provides sign-on and user credential caching in relation to said secure application for the user at said remote workstation.

20. The system of claim 16 further including a sub-system for reverse synchronisation of user credentials required to access secure applications for a server managing an SSO datastore accessible by a plurality of remote workstations, said sub-system including:

an SSO datastore monitor server coupled to the server for monitoring changes to user credentials in the SSO datastore; and

upon changes being effected to user credentials for a secure application, said SSO datastore monitor server is adapted to;

connect to a respective back-end system hosting said secure application, and

modify the corresponding user credentials held in an authentication database for the secure application on the back-end system.

21. A method for providing remote user access to secure financial applications by deployment of single sign-on (SSO) software to client workstations, substantially as hereinbefore described with reference to the accompanying drawings.

22. A system for providing remote user access to secure financial applications, substantially as hereinbefore described and/or illustrated in any one or more of the accompanying drawings.