System and method for identity management for mobile devices

• US 8,644,800 B2
• Filed: 02/15/2012
• Issued: 02/04/2014
• Est. Priority Date: 02/15/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: McBride, Brian Everett, Lambert, Kenneth Jason William
• Primary Examiner(s): Nguyen, David Q
• Application Number:
  US13/397,348
• Publication Number:
  US 20120214444A1
• Time in Patent Office: 720 Days
• Field of Search: 455/411, 455/410, 713/158, 713/166, 709/219, 709/248
• US Class Current: 455/411
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

Systems and methods for managing a user identity on a mobile device are provided. The system comprises the mobile device comprising a user agent and a client application, the user agent and the client application in communication with each other. The system further comprises an identity provider in communication with the mobile device, and a client service in communication with the mobile device. The user agent is configured to communicate with the identity provider and retrieve the user identity for the client application, and the client application is configured to transmit the user identity to the client service.

Claims

1. A system for managing user identity information on a mobile device, the system comprising:

the mobile device comprising a user agent and a client application, the user agent and the client application in communication with each other;

an identity provider in communication with the mobile device, the user identity information stored on the identity provider; and

a client service in communication with the mobile device;

wherein the user agent is configured to;

send user credentials to the identity provider for verification;

if the user credentials are verified, receive a token from the identity provider;

receive a request for the user identity information from the client service;

send the request and the token to the identity provider;

receive the user identity information from the identity provider; and

transmit the user identity information to the client service, via the client application.

2. The system of claim 1 wherein, if the user credentials are verified, the user agent is further configured to create a credential store on the mobile device to store the user credentials and the token, the credential store in communication with the user agent;

and wherein the credential store is further configured to store credentials for the client application; and

wherein, to sign into the client application, the user agent is further configured to retrieve from the credential store the credentials for the client application and send the credentials for the client application to the client application; and

the client application is further configured to use the credentials for the client application to log into the client application.

3. The system of claim 1 wherein the identity provider is configured to authenticate the token, and if authenticated, the identity provider is further configured to send the user identity information to the identity provider.

4. A method performed by a mobile device for managing user identity information, the method comprising:

a user agent on the mobile device sending user credentials to an identity provider for verification, the mobile device in communication with the identity provider;

if the user credentials are verified, the user agent receiving a token from the identity provider;

receiving a request for the user identity information from a client service;

sending the request and the token to the identity provider;

retrieving the user identity information from the identity provider; and

the user agent sending the user identity information to the client service, via a client application on the mobile device.

5. The method of claim 4 wherein the identity provider comprises a server, and the client service comprises another server.

6. The method of claim 4 wherein the mobile device comprises an operating system, and the method further comprises the operating system invoking the user agent when turning on the mobile device.

7. The method of claim 4 wherein the mobile device comprises multiple client applications, and the method further comprises the mobile device, upon signing into the user agent, signing into the multiple client applications.

8. The method of claim 4 further comprising, if the user credentials are verified, creating a credential store on the mobile device to store the user credentials and the token.

9. The method of claim 4 wherein the user credentials comprise a username and a password.

10. The method of claim 4 further comprising:

displaying a graphical user interface on the mobile device, and receiving through the GUI the user credentials.

11. The method of claim 8 wherein the credential store stores credentials for the client application.

12. The method of claim 11 wherein, to sign into the client application, the method further comprises the user agent retrieving from the credential store the credentials for the client application and sending the credentials for the client application to the client application;

and the client application using the credentials for the client application to log into the client application.

13. A mobile device configured to manage user identity information, the mobile device comprising a processor, memory, a communication device, a user agent and a client application in communication with the user agent, wherein the mobile device is in communication with a client service and an identity provider;

and

the mobile device is configured to at least;

send user credentials to the identity provider for verification using the user agent;

if the user credentials are verified, receive a token from the identity provider using the user agent;

receive a request for the user identity information from the client service;

send the request and the token to the identity provider;

retrieve the user identity information from the identity provider; and

send the user identity information to the client service, via a client application on the mobile device.

14. The mobile device of claim 13 wherein the mobile device comprises an operating system that is configured to at least invoke the user agent when turning on the mobile device.

15. The mobile device of claim 13 further comprising multiple client applications, and the mobile device is further configured to at least, upon signing into the user agent, sign into the multiple client applications.

16. The mobile device of claim 13 wherein the mobile device is configured to at least create a credential store on the mobile device to store the user credentials and the token, if the user credentials are verified.

17. The mobile device of claim 13 wherein the user credentials comprise a username and a password.

18. The mobile device of claim 13 wherein the mobile device is further configured to at least display a graphical user interface on the mobile device, and receive through the GUI the user credentials.

19. The mobile device of claim 16 wherein the credential store is configured to store credentials for the client application.

20. The mobile device of claim 19 wherein, to sign into the client application, the mobile device is further configured to at least:

retrieve from the credential store the credentials for the client application using the user agent and send the credentials for the client application to the client application; and

use the credentials for the client application to log into the client application.