Apparatus for and method of multi-factor authentication among collaborating communication devices

• US 8,806,205 B2
• Filed: 12/27/2012
• Issued: 08/12/2014
• Est. Priority Date: 12/27/2012
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Metke, Anthony R., Reitsma, Katrin, Upp, Steven D.
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US13/728,797
• Publication Number:
  US 20140189841A1
• Time in Patent Office: 593 Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Multi-factor authentication is enabled across a plurality of communication devices. A user performs authentication by using a first authentication factor on a first of the communication devices, and by using a second authentication factor on a second of the communication devices. A collaboration credential is shared among the devices to enable the devices to collaborate with each other. Both of the authentication factors are bound together. A multi-factor identification token is issued to each device, to support multi-factor authentication for the user across the devices.

Claims

1. An apparatus for multi-factor authentication among a plurality of communication devices, comprising:

a server having a processor that is configured to;

authenticate a user who uses a first authentication factor on a first of the communication devices, and who uses a second authentication factor on a second of the communication devices;

transmit a collaboration credential and a single factor identity token to the first communication device to enable the communication devices to collaborate with each other, wherein the collaboration credential gives permission for the first and second devices to share services among devices,

receive the collaboration credential from the second of the communication devices along with a second authentication factor; and

bind both of the authentication factors, and issue a multi-factor identification token to each of the communication devices, to support multi-factor authentication for the user across the plurality of communication devices to request access to a service.

2. The apparatus of claim 1, wherein one of the server and one of the communication devices is operative for generating the collaboration credential.

3. The apparatus of claim 1, wherein the processor is configured to send the multi-factor identification token to each of the communication devices after the collaboration credential has been shared by the communication devices.

4. The apparatus of claim 3, wherein the multi-factor identification token issued to each of the communication devices is the same.

5. The apparatus of claim 3, wherein the multi-factor identification token issued to each of the communication devices is different.

6. The apparatus of claim 1, wherein the processor is configured to issue and send a single factor identity token to one of the communication devices.

7. The apparatus of claim 1, wherein the processor is configured to issue and send single factor identity tokens to each of the communication devices.

8. The apparatus of claim 1, wherein the processor is configured to configure the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first communication device, an identification of which of the plurality of other communication devices are permitted to collaborate with the first communication device, an identification of the conditions under which the collaboration is permitted to be conducted, and an identification of the authentication factors.

9. A method of multi-factor authentication among a plurality of communication devices, comprising:

authenticating a user who uses a first authentication factor on a first of the communication devices, and who uses a second authentication factor on a second of the communication devices,

transmitting a collaboration credential and a single factor identity token to the first communication device to enable the communication devices to collaborate with each other, wherein the collaboration credential gives permission for the first and the second devices to share services among devices,

receiving the collaboration credential from the second of the communication devices along with a second authentication factor

binding both of the authentication factors, and

issuing a multi-factor identification token to each of the communication devices, to support multi-factor authentication for the user across the plurality of communication devices to request access to a service.

10. The method of claim 9, further comprising the step of generating the collaboration credential with one of the server and one of the communication devices.

11. The method of claim 9, further comprising the step of sending the multi-factor identification token to each of the communication devices after the collaboration credential has been shared by the communication devices.

12. The method of claim 11, further comprising the step of sending the same multi-factor identification token to each of the communication devices.

13. The method of claim 11, further comprising the step of sending different multi-factor identification tokens to each of the communication devices.

14. The method of claim 11, further comprising the step of issuing and sending a single factor identity token to one of the communication devices.

15. The method of claim 11, further comprising the step of issuing and sending single factor identity tokens to each of the communication devices.

16. The method of claim 9, further comprising the step of configuring the collaboration credential as a data structure comprising at least one of an identification of the user, an identification of the first communication device, an identification of which of the plurality of other communication devices are permitted to collaborate with the first communication device, an identification of the conditions under which the collaboration is permitted to be conducted, and an identification of the authentication factors.