DEVICE INDEPENDENT AUTHENTICATION SYSTEM AND METHOD

• US 20070204044A1
• Filed: 04/30/2007
• Published: 08/30/2007
• Est. Priority Date: 10/18/2002
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Rice, Mike, Keshav, Sineesh
• Granted Patent: US 8,156,549 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A system is disclosed which facilitates authentication processes with web-enabled wireless devices, including those that do not support the use of cookie files. To facilitate such authentication, a web server analyzes an HTTP request file from a communication device for the presence of security token data. Where none is found, a client is directed to a login page for input of authentication data, such as a user name and password information. Upon proper authentication, the client'"'"'s communication device is issued a security token using standard HTML-INPUT tags. Thereafter, the web server determines if each additional HTTP request file received from the client includes a security token before responding to the request.

Claims

1. A method for creating a secure communication channel between a communication device and a host web server, said method including:

receiving a request from said communication device to communicate with said host web server;

transmitting a security token to said communication device within an HTML tag; and

,

determining when a response from said communication device includes said security token sent over said secure communication channel.

2. The method of claim 1, further including receiving authentication credentials from said communication device over said secure communication channel.

3. The method of claim 1, further including receiving authentication credentials from said communication device over said secure communication channel and transmitting said security token to said communication device when authentication credentials from said communications device have been authenticated.

4. The method of claim 1, further including transmitting an authentication request to said communication device when no security token is present in said response.

5. The method of claim 1, wherein said response is an HTTP response.

6. The method of claim 1, wherein said response includes client agent data and communication device model data.

7. The method of claim 6, further including comparing at least one of:

said client agent data to authorized client agents and said communication device model data to authorized communication device models on an associated database to at least one of;

configure, grant, and deny access to said host web server.

8. The method of claim 1, further including determining when said response received from said communication device includes said security token before responding to said communications device.

9. The method of claim 1, wherein said communication device is at least one of a wireless device and a PC-based device.

10. The method of claim 1, further including receiving URL information identifying a type of communication device issuing said request.

11. The method of claim 1, further includes receiving device-specific browser information identifying a type of communication device issuing said request.

12. The method of claim 1, further including:

issuing a login page to said communication device when no security token is located, wherein said login page requests input of at least one of a user name and a password;

receiving and analyzing login information from said communication device; and

issuing said security token to said communication device upon validation of said login information.

13. The method of claim 1, wherein said security token facilitates at least one of:

establishing a secure session with a web server and tracking a particular web session within a web site.

14. A method for creating a secure communication channel between a communication device and a host web server, said method including:

transmitting a request to said host web server to communicate with said host web server;

receiving, from said host web server, a security token device within an HTML tag; and

,

transmitting a response to said host web server over said secure communication channel, wherein said response includes said security token.

15. The method of claim 14, further including transmitting authentication credentials to said host web server over said secure communication channel.

16. The method of claim 14, further including transmitting authentication credentials to said host web server over said secure communication channel and receiving said security token from said host web server when authentication credentials from said communications device have been authenticated by said host web server.

17. The method of claim 14, further including receiving an authentication request from said host web server when no security token is present in said response.

18. The method of claim 14, said response is an HTTP response.

19. The method of claim 14, wherein said response includes client agent data and communication device model data.

20. A host web server for establishing a secure communication channel between a communication device and said host web server, said host web server configured to:

receive a request from said communication device to communicate with said host web server;

transmit a security token to said communication device within an HTML tag; and

,

determine when a response from said communication device includes said security token sent over said secure communication channel.