Securing User Logins with Wv Bindings and Transports

• US 20080189773A1
• Filed: 09/29/2006
• Published: 08/07/2008
• Est. Priority Date: 09/30/2005
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Legault, Sylvain, Hebert, Patrice, Maiorano, Nick, Vachon, Gaetan
• Application Number:
  US12/088,456
• Publication Number:
  US 20080189773A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

There is disclosed a method and system for communicating a secure login request between a mobile client and a destination server providing access to a service, the method to be implemented by a disclosed gateway adapted to communicate with both the mobile client and the destination server. The gateway may also implement appropriate protocol conversions between otherwise incompatible client and server pairs. Wireless instant messaging, email and other such services are considered as exemplary services for the disclosed method, system and gateway.

Claims

1. A computer implemented method for communicating a secure login request between a mobile client and a destination server providing access to a service, the method to be implemented by a gateway adapted to communicate with both the mobile client and the destination server, the method comprising the steps of:

a) receiving a login request from the mobile client requesting access to the service, said request comprising login information required to gain access to the service;

b) extracting said login information from said login request;

c) determining a secure login procedure supported by the destination server; and

d) communicating said login information to the destination server in accordance with said secure login procedure.

2. The computer implemented method of claim 1, wherein said secure login procedure comprises at least one of a secure 4-way login procedure and a secure 2-way login procedure.

3. The computer implemented method of claim 2, wherein said secure 2-way login procedure comprises at least one of a 2-way login over HTTPS, a 2-way login over a VPN and a 2-way login over a leased line.

4. The computer implemented method of claim 1, wherein said receiving step comprises receiving said login request in accordance with a client-supported secure login procedure that is different from said secure login procedure supported by the destination server.

5. The computer implemented method of claim 4, wherein said client-supported secure login procedure comprises a secure 2-way login procedure, said secure 2-way login procedure comprising at least one of a 2-way login over HTTPS, a 2-way login over a VPN and a 2-way login over a leased line.

6. The computer implemented method of claim 4, the method further comprising the step after step d) of:

e) receiving a login result from the destination server in accordance with said secure login procedure and communicating said login result to the mobile client in accordance with said client-supported secure login procedure.

7. The computer implemented method of claim 1, the method further comprising the step after step a) of determining a protocol supported by the destination server and communicating said login information to the destination server in accordance with said protocol.

8. The computer implemented method of claim 7, wherein said protocol comprises a binding/transport combination selected from any one of SMS/SMPP, SMS/HTTP, SMS/HTTPS, XML/HTTP, XML/HTTPS, BXML/HTTP and BXML/HTTPS.

9. The computer implemented method of claim 8, said receiving step comprising receiving said login request over a client-supported protocol that is different from said protocol supported by the destination server.

10. The computer implemented method of claim 1, wherein the mobile client comprises an IM client and the destination server comprises an IM server.

11. The computer implemented method of claim 1, wherein the mobile client comprises an email client and the destination server comprises an email server.

12. The computer implemented method of claim 1, wherein said login information comprises a user password required to gain access to the service.

13. A computer implemented method for communicating a login request between a mobile client and a plurality of servers, each of the servers providing access to at least one of a plurality of services, the method to be implemented by a gateway adapted to communicate with both the mobile client and the servers, the method comprising the steps of:

a) receiving a login request from the mobile client requesting access to a service;

b) determining based on said request a destination server selected from said servers providing access to said service;

c) determining a secure login procedure supported by said destination server; and

d) communicating said login request to said destination server in accordance with said secure login procedure.

14. The computer implemented method of claim 13, wherein said secure login procedure comprises at least one of a secure 4-way login procedure and a secure 2-way login procedure.

15. The computer implemented method of claim 13, wherein said secure 2-way login procedure comprises at least one of a 2-way login over HTTPS, a 2-way login over a VPN and a 2-way login over a leased line.

16. The computer implemented method of claim 13, wherein said receiving step comprises receiving said login request in accordance with a client-supported secure login procedure that is different from said secure login procedure supported by said destination server.

17. The computer implemented method of claim 16, the method further comprising the step after step d) of:

e) receiving a login result from said destination server in accordance with said secure login procedure and communicating said login result to the mobile client in accordance with said client-supported secure login procedure.

18. The computer implemented method of claim 16, wherein said client-supported secure login procedure comprises a secure 2-way login procedure, said secure 2-way login procedure comprising at least one of a 2-way login over HTTPS, a 2-way login over a VPN and a 2-way login over a leased line.

19. The computer implemented method of claim 13, the method further comprising the step after step b) of determining a protocol supported by said destination server and communicating said login information to said destination server in accordance with said protocol.

20. The computer implemented method of claim 19, said receiving step comprising receiving said login request over a client-supported protocol that is different from said protocol supported by said destination server.

21. The computer implemented method of claim 13, wherein the mobile client comprises an IM client and said service comprises an IM service.

22. The computer implemented method of claim 13, wherein the mobile client comprises an email client and said service comprises an email service.

23. A gateway for communicating a login request between a mobile client and a plurality of servers, each of the servers providing access to at least one of a plurality of services, the gateway comprising:

a first interface for communicating with the mobile client and adapted to receive a login request therefrom for access to one of the services;

a gateway module in operative communication with said first interface, said module interpreting said login request to determine a destination server selected from said servers providing access to said one of the services and to establish a secure login procedure supported by said destination server; and

a second interface for communicating said login request to said destination server in accordance with said secure login procedure.

24. The gateway of claim 23, wherein said secure login procedure comprises at least one of a secure 4-way login procedure and a secure 2-way login procedure.

25. The gateway of claim 23, wherein said login request is received from the client via said first interface in accordance with a client-supported secure login procedure that is different from said secure login procedure supported by said destination server.

26. The gateway of claim 23, said gateway module further determining a protocol supported by said destination server and communicating said login request to said destination server via said second interface in accordance with said protocol.

27. The gateway of claim 26, wherein said login request is received from the client via said first interface in accordance with a client-supported protocol that is different from said protocol supported by said destination server.

28. The gateway of claim 23, wherein the mobile client comprises an IM client and said one of said services comprises an IM service.

29. The gateway of claim 28, wherein said IM client and said destination server are configured to comply with at least one of OMA IMPS 1.1 standards and OMA IMPS 1.2 standards.

30. The gateway of claim 23, wherein the mobile client comprises an email client and said one of said services comprises an email service.

31. A secure login system for providing access to at least one of a plurality of services, the system comprising:

a plurality of ground end systems each comprising at least one server for providing access to at least one of a plurality of services;

at least one mobile device comprising at least one mobile client for requesting access to at least one of said services; and

a gateway, said gateway comprising;

a first interface for communicating with said mobile client and adapted to receive a login request therefrom for access to one of the services;

a gateway module in operative communication with said first interface, said module interpreting said login request to determine a destination server selected from said servers providing access to said one of the services and to establish a secure login procedure supported by said destination server; and

a second interface for communicating said login request to said destination server in accordance with said secure login procedure.

32. The system of claim 31, wherein said secure login procedure comprises at least one of a secure 4-way login procedure and a secure 2-way login procedure.

33. The system of claim 31, wherein said login request is received from the client via said first interface in accordance with a client-supported secure login procedure that is different from said secure login procedure supported by said destination server.

34. The system of claim 31, said gateway module further determining a protocol supported by said destination server and communicating said login request to said destination server via said second interface in accordance with said protocol.

35. The system of claim 34, wherein said login request is received from the client via said first interface in accordance with a client-supported protocol that is different from said protocol supported by said destination server.