Method and apparatus for accessing a computer application program

• US 8,006,288 B2
• Filed: 11/02/2005
• Issued: 08/23/2011
• Est. Priority Date: 11/05/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan L.
• Primary Examiner(s): Arani; Taghi T
• Assistant Examiner(s): Rahman; Mahfuzur
• Application Number:
  US11/265,732
• Publication Number:
  US 20060101507A1
• Time in Patent Office: 2,120 Days
• Field of Search: 726/5, 726/9, 726/18, 726/19, 726/20
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates

Abstract

In some embodiments, a request may be generated to register a computing device of a user to a registration issuer, and in response a device related credential for the computing device may be obtained, the device related credential being for exclusive use of that computing device and being related to a unique identifier of the user. A request for a credential for an application program may be generated, and in response an application credential for the application program may be obtained, the application credential being related to the unique identifier of the user. A request for access to the application program may be generated, the request comprising the application credential and the device related credential. In response to the request for access, access to the application may be granted if the device related credential and the application credential relate to the same unique user identifier.

Claims

1. A method for obtaining access to an application program, comprising the steps of:

obtaining an application credential for an application program for a first computing device, the application credential generated from a first device related credential, the first device related credential being for exclusive use of the first computing device, the application credential being related to the application program and comprising a unique identifier of a user;

obtaining a second device related credential for a second computing device of the user, the second device related credential being for exclusive use of the second computing device, and the second device related credential being related to the unique identifier of the user, the obtaining comprising receiving a device related credential from a registration issuer and incorporating the unique identifier of the user into the received device related credential;

storing the application credential from the first computing device on the second computing device;

submitting proof of validity of the unique identifier of the user that was incorporated into the device related credential;

generating a request for access to the application program, the request comprising the application credential stored on the second computing device and the second device related credential;

and

receiving access to the application program in response to determining that the second device related credential and the application credential stored on the second computing device comprise the same unique identifier of the user.

2. The method according to claim 1, wherein obtaining the second device related credential comprises reading the second device related credential from a memory in the second computing device.

3. The method according to claim 1, wherein obtaining the application credential for the application program comprises submitting a request for the application credential to an application issuer computer.

4. The method according to claim 3, wherein obtaining the application credential further comprises receiving the application credential from the application issuer computer, the application credential being issued by the application issuer computer and being related to the unique identifier of the user at the device to be registered.

5. The method according to claim 3, wherein obtaining the application credential further comprises receiving at the first computer device the application credential from the application issuer computer, and incorporating at the first computing device the unique identifier of the user into the received application credential.

6. The method according to claim 5, wherein obtaining the application credential further comprises submitting proof of the validity of the unique identifier of the user that was incorporated into the application credential.

7. The method according to claim 1, wherein the determining that the second device related credential and the application credential stored on the second computing device relate to the same unique identifier of the user is performed by means of a zero knowledge proof protocol.

8. A method for granting access to an application based on the use of credentials, comprising the steps of:

receiving from a first computing device a request for access to an application, the request comprising an application credential and a device related credential, the device related credential being exclusive for use in connection with the first computing device and comprising a unique identifier of the user, and the application credential being related to the application and comprising a unique identifier of the user;

verifying that the device related credential and the application credential relate to the same unique identifier;

granting access to the application on the first computing device based on the verification that the device related credential and the application credential relate to the same unique identifier;

storing the application credential from the first computing device to a second computing device, the second computing device comprising a second device related credential, the second device related credential contained in a memory in the second computing device, and received from a registration issuer and incorporating the unique identifier of the user into the device related credential;

submitting proof of validity of the unique identifier of the user that was incorporated into the device related credential; and

granting access to the application to the second computing device in response to determining that the application credential of the first computing device and the second device related credential relate to the same unique identifier.

9. The method according to claim 8, wherein verifying that the device related credential and the application credential relate to the same unique identifier is performed by means of a zero knowledge proof protocol.

10. A computer program product comprising computer executable instructions stored on a non-transitory computer usable medium which when loaded in a computer device of a user is able to carry out the steps of:

obtaining at a first computing device an application credential for an application program, the application credential generated from a first device related credential, the first device related credential being for exclusive use of the first computing device, the application credential being related to the application program and comprising a unique identifier of the user, the obtaining comprising receiving at the computer device of the user an application credential from a application issuer computer, and incorporating the unique identifier of the user into the received application credential at the computer device of the user;

storing the application credential from the computer device on a second computing device;

submitting proof of validity of the unique identifier of the user that was incorporated into the application credential;

generating a request for access to the application program, the request comprising the application credential and a device related credential, the device related credential being for exclusive use of the second computing device and being related to the unique identifier of the user; and

providing access to the application to the second computing device, in response to determining that the application credential and the device related credential of the second computing device relate to the same unique identifier of the user.

11. The computer program product according to claim 10, wherein obtaining the application credential for the application program comprises submitting a request for the application credential to an application issuer computer.

12. The computer program product according to claim 11, wherein obtaining the application credential further comprises receiving the application credential from the application issuer computer, the application credential being issued by the application issuer computer and being related to the unique identifier of the user.

13. The computer program product according to claim 10, wherein the determining that the second device related credential and the application credential stored on the second computing device relate to the same unique identifier of the user is performed by means of a zero knowledge proof protocol.

14. The computer program product according to claim 10, wherein obtaining the second device related credential comprises reading the second device related credential from a memory in the second computing device.

15. The computer program product according to claim 10, wherein obtaining the second device related credential comprises receiving a device related credential from a registration issuer and incorporating the unique identifier of the user into the received device related credential.