METHOD AND APPARATUS FOR PROVIDING AN AUTHENTICATION CONTEXT-BASED SESSION

• US 20110202988A1
• Filed: 02/17/2010
• Published: 08/18/2011
• Est. Priority Date: 02/17/2010
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Khushraj, Deepali, Tarkkala, Lauri, OTRANEN, Jari
• Granted Patent: US 8,850,554 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

An approach is provided for providing separation of authentication protocols and/or authentication contexts for client-server and server-server communication in network communication. A proxy server receives a request to initiate a service session. The request includes a first authentication context. The proxy server request verification of the first authentication context from an authentication server and validates the first authentication context based, at least in part, on the verification. The proxy server implements a second authentication context based, at least in part, on the verification of the first authentication context to initiate the service session.

Claims

1. A method comprising:

receiving a request to initiate a service session, wherein the request includes a first authentication context;

requesting verification of the first authentication context from an authentication server;

validating the first authentication context based, at least in part, on the verification; and

implementing a second authentication context based, at least in part, on the verification of the first authentication context to initiate the service session.

2. A method of claim 1, further comprising:

receiving another request to retrieve data over the service session;

authenticating the another request using the second authentication context; and

initiating retrieval of the data over the service session using the first authentication context.

3. A method of claim 2, wherein the first authentication context is implemented by the authentication server.

4. A method of claim 2, wherein the first authentication context is based, at least in part, on a single sign-on authentication protocol applicable to a plurality of services.

5. A method of claim 2, wherein the data is retrieved over the service session using a trusted domain.

6. A method of claim 1, further comprising:

determining whether to implement the second authentication context; and

using the first authentication context in place of the second authentication context if the determination is to not implement the second authentication context.

7. A method of claim 1, wherein the first authentication context includes a limited use key, a secret key, a consumer key, an access token, or a combination thereof.

8. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

receive a request to initiate a service session, wherein the request includes a first authentication context;

request verification of the first authentication context from an authentication server;

validate the first authentication context based, at least in part, on the verification; and

implement a second authentication context based, at least in part, on the verification of the first authentication context to initiate the service session.

9. An apparatus of claim 8, wherein the apparatus is further caused to:

receive another request to retrieve data over the service session;

authenticate the another request using the second authentication context; and

initiate retrieval of the data over the service session using the first authentication context.

10. An apparatus of claim 9, wherein the first authentication context is implemented by the authentication server.

11. An apparatus of claim 9, wherein the first authentication context is based, at least in part, on a single sign-on authentication protocol applicable to a plurality of services.

12. An apparatus of claim 9, wherein the data is retrieved over the service session using a trusted domain.

13. An apparatus of claim 8, wherein the apparatus is further caused to:

determine whether to implement the second authentication context; and

use the first authentication context in place of the second authentication context if the determination is to not implement the second authentication context.

14. An apparatus of claim 8, wherein the first authentication context includes a limited use key, a secret key, a consumer key, an access token, or a combination thereof.

15. A computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to at least perform the following steps:

receiving a request to initiate a service session, wherein the request includes a first authentication context;

requesting verification of the first authentication context from an authentication server;

validating the first authentication context based, at least in part, on the verification; and

implementing a second authentication context based, at least in part, on the verification of the first authentication context to initiate the service session.

16. A computer readable storage medium of claim 15, wherein the apparatus is caused to further perform:

receiving another request to retrieve data over the service session;

authenticating the another request using the second authentication context; and

initiating retrieval of the data over the service session using the first authentication context.

17. A computer readable storage medium of claim 16, wherein the first authentication context is implemented by the authentication server.

18. A computer readable storage medium of claim 16, wherein the first authentication context is based, at least in part, on a single sign-on authentication protocol applicable to a plurality of services.

19. A computer readable storage medium of claim 16, wherein the data is retrieved over the service session using a trusted domain.

20. A computer readable storage medium of claim 15, wherein the apparatus is caused to further perform:

determining whether to implement the second authentication context; and

using the first authentication context in place of the second authentication context if the determination is to not implement the second authentication context.