Network access system which is adapted for the use of a simplified signature method, and server used to implement same

• US 7,823,188 B2
• Filed: 09/07/2004
• Issued: 10/26/2010
• Est. Priority Date: 09/23/2003
• Status: Expired due to Fees

• Current Assignee: Orange France (Orange S.A.)
• Original Assignee: Orange France (Orange S.A.)
• Inventors: Goutard, Cédric, Sahnoun, Rym, Boutroux, Anne, Annic, Etienne, Bauban, Patrick
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US10/572,949
• Publication Number:
  US 20070056021A1
• Time in Patent Office: 2,240 Days
• Field of Search: 726/2, 726/9, 713/172, 380/229
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A system for accessing a packet-switching network (4), which is adapted for the use of a simplified signature method. The system includes a supplementary server (60) which is independent of a proxy server (50) of an access provider (12) and a simplified signature module (66) which is provided in the supplementary server (60). The proxy server (50) is equipped with an interface (64) which enables the connection of the proxy server to the supplementary server (60) and the transmission of at least the authentication requests sent by contacted service providers to the supplementary server (60) in order for the requests to be processed by the simplified signature module (66).

Claims

1. A system for access to a packet switching network suitable for implementing a simplified signature method, the system comprising:

a proxy server through which all data flows pass which are exchanged between a user and the network,

a plurality of service providers which are connected to the network, each service provider being capable of transmitting, through the network, an authentication request to the user who contacts the service provider, through the network, in order to identify and/or authenticate the user before providing him with personalized and/or secure services, the response to be provided by same user to the authentication request being able to be different in accordance with the service provider contacted,

at least one authentication server which is capable of storing at least one item of authentication data for each user and transmitting, in response to an authentication request, an authentication response which contains an item of authentication data in accordance with both the service provider who transmitted the authentication request and identity of the user who contacted the service provider, and

a simplified signature module which is capable of automatically processing on behalf of the user the authentication requests transmitted by the service providers contacted, the module being capable for each user;

of directing the authentication requests to the appropriate authentication server, and

of transmitting to the service provider the corresponding authentication response transmitted by the appropriate authentication server,

wherein the system further comprises a supplementary server which is independent from the proxy server, the simplified signature module being implemented in the supplementary server, and wherein the proxy server is provided with an interface which allows the proxy server to be connected to the supplementary server and allows at least the authentication requests transmitted by the service providers contacted to be transmitted to the supplementary server in order to process these requests using the simplified signature module.

2. The system according to claim 1, wherein the simplified signature module comprises a sub-module which is capable of identifying the user from his network address and adding an identifier of the user to the authentication requests directed to the authentication servers.

3. The system according to claim 1, wherein the at least one item of authentication data stored for each user comprises an item of data relating to a level of authentication available for the user, wherein each authentication request transmitted by a service provider specifies features relating to the authentication level required by the service provider in order to be able to access the services the service provider provides, wherein the or each authentication server is capable of comparing the features relating to the required authentication level specified by the authentication request with the data relating to the authentication level available in order to determine whether the authentication level required corresponds to the authentication level available for the user, and wherein the or each authentication server is capable of transmitting to the user an active authentication request which is capable of activating an interactive process for identification and/or authentication of the user if the authentication level required does not correspond to the authentication level available.

4. The system according to claim 3, wherein the supplementary server comprises a sub-module which is capable of directing the response of the user to the active authentication requests to the authentication server which has transmitted the active authentication requests.

5. The system according to claim 3, wherein the supplementary server comprises a sub-module which is capable of directing the active authentication request to the user.

6. The system according to claim 1, wherein the simplified signature module comprises a sub-module which is capable of adding, to the requests transmitted by the user to a service provider, an identification signal of a simplified signature service, in response to which the service provider transmits the authentication request.

7. The system according to claim 1, wherein the supplementary server and the proxy server are capable of communicating with each other using a Hyper Text Transfer Protocol (HTTP).

8. The system according to claim 7, wherein the Hyper Text Transfer Protocol is the iCAP protocol (Internet Content Adaptation Protocol) or the OCP protocol (OPES Call Out Protocol).

9. The system according to claim 7, wherein the supplementary server is capable of communicating with the service providers only by means of the Hyper Text Transfer Protocol used between the supplementary server and the proxy server.

10. The system according to claim 1, wherein the supplementary server also implements an HTTP (Hyper Text Transfer Protocol) server and/or client in order to communicate directly with the or each service provider and/or the or each authentication server using only the HTTP protocol.

11. The system according to claim 1, wherein the system further comprises a provider of access to the network to which the user must be connected in order to be able to access the network, the access provider being provided with the proxy server.

12. The system according to claim 1, wherein the network is the World Wide Web.

13. A server for use in a system according to claim 1 as the supplementary server, wherein the supplementary server comprises the simplified signature module which is capable of automatically processing on behalf of the user the authentication requests transmitted by the or each service provider contacted, and is capable of communicating with a proxy server in order to receive at least the authentication requests transmitted by the service providers.