Single sign-on process

• US 7,058,180 B2
• Filed: 07/29/2002
• Issued: 06/06/2006
• Est. Priority Date: 02/08/2000
• Status: Expired due to Term

• Current Assignee: VL Collective IP, LLC (VideoLabs, Inc.)
• Original Assignee: Swisscom Mobile AG (Government of Switzerland)
• Inventors: Lauper, Eric, Ferchichi, Azim
• Primary Examiner(s): Barrón, Jr., Gilberto
• Assistant Examiner(s): Gurshman, Grigory
• Application Number:
  US10/207,513
• Publication Number:
  US 20030012382A1
• Time in Patent Office: 1,408 Days
• Field of Search: 380/247, 713/185, 713/172
• US Class Current: 380/247
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

Single sign-on process allowing a mobile user with a mobile phone or with a laptop to remote-access a remote server, comprising the steps of:

• • (1) sending a first authenticator over a first communication layer to a first intermediate equipment between said mobile equipment and said remote server,
  • (2) verifying in said first intermediate equipment said first authenticator sent by said mobile equipment,
  • (3) if said first authenticator is accepted by said first intermediate equipment, completing the communication layer between said mobile equipment and said intermediate equipment,
  • (4) repeating steps (1) to (3) with a plurality of successive intermediate equipment and over a plurality of successive communication layers, until a communication has been completed at the last requested communication layer between said mobile equipment and said remote server,
  • wherein at least a plurality of said authenticators are furnished by a smart-card in said mobile equipment.

Claims

1. A smart-card for use in a mobile equipment connected to a first communication network for authenticating a user of said mobile equipment connected to a second communication network in order to remote-access a remote location, said smart card comprising processing means for delivering a plurality of authenticators each for authenticating the user in one or more of a plurality of intermediate equipment connected to both the first network and the second network between the mobile equipment and the remote location in order to establish a plurality of successive communication layers between the mobile equipment and the remote location.

2. The smart-card of claim 1, wherein said mobile equipment comprises a cellular phone equipment.

3. The smart-card of claim 2, which is a SIM card.

4. The smart-card of claim 1, wherein at least one of said authenticators is stored in said smart-card.

5. The smart-card of claim 1, wherein at least one of said authenticators is computed in said smart-card.

6. The smart-card of claim 5, wherein at least one of said authenticators is computed in said smart-card using a cryptographic function using at least one key.

7. The smart-card of claim 6, wherein said at least one key is stored in said smart-card.

8. The smart-card of claim 1, wherein at least one authenticator can be used by an ISP for verifying the identity of said user and granting him access to the internet.

9. The smart-card of claim 1, wherein at least one authenticator can be used by an IPSEC gateway for verifying the identity of said user and granting him access to a corporate network.

10. The smart-card of claim 1, wherein at least one authenticator can be used by a remote location in a corporate network for verifying the identity of said user and granting him access to a remote domain.

11. The smart-card of claim 1, further comprising:

a synchronization private key for decrypting an old and a new secret encrypted with a corresponding synchronization public key,

comparison means for comparing said old decrypted secret with the secret stored in said mobile equipment, and comparing said decrypted new secret with a new secret entered in said mobile equipment,

means for replacing said secret stored in said mobile equipment with said decrypted new secret when both comparisons are positive.

12. A smart-card comprising:

a synchronization private key for decrypting an old and a new secret encrypted with a corresponding synchronization public key,

comparison means for comparing said old decrypted secret with the secret stored in said mobile equipment, and comparing said decrypted new secret with a new secret entered in said mobile equipment,

means for replacing said secret stored in said mobile equipment with said decrypted new secret when both comparisons are positive.

13. The smart-card of claim 12, which is a SIM card.

14. A smart-card for use in a mobile device communicating with a remote device through an intermediate device connected to the mobile device via a first communication network, said intermediate device connected to the remote device via a second communication network, said smart card comprising:

processing means; and

a memory for providing data to said processing means, wherein

an authenticator is provided by said processing means to the intermediate device for authenticating the mobile equipment in the intermediate device to establish a communication layer between the mobile device and the intermediate device, and wherein

communication between the mobile device and the remote device is established when the mobile device has been authenticated in the intermediate device.

15. The smart-card of claim 14, wherein said authenticator is computed in said smart-card using data stored in said memory.

16. The smart-card of claim 15, wherein said authenticator is computed in said smart-card using a cryptographic function executed by said processing means using at least one key.

17. The smart-card of claim 16, wherein said at least one key is stored in said memory.

18. The smart-card of claim 14, wherein said authenticator is stored in said memory.

19. A smart-card for use in a mobile device communicating with a remote device through a plurality of intermediate equipment between the mobile device and the remote device, said smart card comprising:

processing means; and

a means for storing a plurality of authenticators, wherein

each of said authenticators is provided by said processing means to a corresponding one of the plurality of intermediate equipment for authenticating said mobile equipment in the corresponding one of the intermediate equipment to establish a corresponding communication layer between the mobile device and the corresponding one of the intermediate equipment, and wherein

communication between the mobile device and the remote device is established when the mobile device has been authenticated in each of the plurality of intermediate equipment thereby resulting in a communication channel including the plurality of the corresponding communication layers each between said mobile device and the corresponding one of the intermediate equipment.

20. The smart-card of claim 19, wherein at least one of said authenticators is computed in said smart-card using data stored in said memory.

21. The smart-card of claim 20, wherein said at least one of said authenticators is computed in said smart-card using a cryptographic function executed by said processing means using at least one key.

22. The smart-card of claim 21, wherein said at least one key is stored in said memory.

23. The smart-card of claim 19, wherein at least one of said authenticators is stored in said memory.