Systems, devices and methods for authorizing endpoints of a push pathway

• US 9,276,917 B2
• Filed: 09/11/2012
• Issued: 03/01/2016
• Est. Priority Date: 09/11/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: McColgan, Brian Edward Anthony
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): GRACIA, GARY S
• Application Number:
  US13/609,404
• Publication Number:
  US 20140075515A1
• Time in Patent Office: 1,267 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 12/1859 adapted to provide push services, e.g. data channels
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

An apparatus, system, and method for authorizing endpoints of a push pathway for push notifications are described herein. In one example embodiment, an identity provider element authenticates a first endpoint of the push pathway, determines an authentication token associated with the first endpoint, and determines a channel identifier in response to a successful validation of the authentication token associated with the first endpoint. In this embodiment, the identity provider element also authenticates a second endpoint of the push pathway, determines an authentication token associated with the second endpoint, and determines a handle for the push pathway in response to a successful validation of both the authentication token associated with the first endpoint and the authentication token associated with the second endpoint. The push pathway is established for transmission of push notifications from the first to the second endpoint upon establishing the handle for the push pathway.

Claims

1. A method of authorizing endpoints of a push pathway for push notifications, the endpoints comprising a push initiator element and a client device, the method to be performed by an identity provider element that operates independently of a push notification server configured to control transmission of push notifications from the push initiator element to the client device over the push pathway, the push pathway comprising a logical network connection amongst the push notification server, the push initiator element and the client device, the method comprising:

the identity provider element authenticating the client device based on one or more security credentials associated with the client device;

in response to a successful authentication of the client device, the identity provider element generating and transmitting to the client device a client authentication token associated with the client device;

the identity provider element determining validity of a test client authentication token purporting to be the client authentication token and providing to the push notification server a first indication of the validity of the test client authentication token;

the identity provider element authenticating the push initiator element based on one or more security credentials associated with the push initiator element; and

in response to a successful authentication of the push initiator element, the identity provider element generating and transmitting to the push initiator element a push initiator element authentication token associated with the push initiator element;

the identity provider element determining validity of a test push initiator element authentication token purporting to be the push initiator element authentication token and providing to the push notification server a second indication of the validity of the test push initiator element authentication token,

wherein, in the event that the identity provider element successfully validates the test client authentication token, the first indication permits the push notification server to determine a channel identifier, and

wherein, in the event that the identity provider element successfully validates the test client authentication token and the test push initiator element authentication token, the first indication and the second indication permit the push notification server to determine a handle for the push pathway, wherein the handle is associated with the channel identifier and is used to establish the push pathway for transmission of push notifications from the push initiator element to the client device.

2. The method of claim 1, wherein the validating of the test push initiator element authentication token is responsive to a client-initiated subscription request.

3. The method of claim 1, wherein at least one additional endpoint for the push pathway is to be successfully authenticated before the push pathway is established.

4. The method of claim 1, wherein at least one of the client authentication token or the push initiator element authentication token is configured to expire.

5. A system for authorizing endpoints of a push pathway for push notifications, the system comprising:

endpoints comprising a push initiator element and a client device;

an identity provider element that establishes endpoints of the push pathway, wherein the identity provider element is configured to;

authenticate the client device based on one or more security credentials associated with the client device;

in response to a successful authentication of the client device, generate and transmit to the client device a client authentication token associated with the client device;

determine validity of a test client authentication token purporting to be the client authentication token;

authenticate the push initiator element based on one or more security credentials associated with the push initiator element; and

in response to a successful authentication of the push initiator element, generate and transmit to the push initiator element a push initiator element authentication token associated with the push initiator element;

determine validity of a test push initiator element authentication token purporting to be the push initiator element authentication token; and

a push notification server that controls push notifications to be transmitted from the push initiator element to the client device over the push pathway, wherein the push notification server operates independently of the identity provider element, and wherein the push pathway comprises a logical network connection amongst the push notification server, the push initiator element and the client device, the push notification server configured to;

determine a channel identifier in response to a successful validation of the test client authentication token; and

determine a handle for the push pathway, wherein the handle is associated with the channel identifier and established in response to a successful validation of both the test client authentication token and the test push initiator element authentication token;

wherein the push pathway is established for transmission of push notifications from the push initiator element to the client device upon establishing the handle for the push pathway.

6. The system of claim 5, wherein validating the test push initiator element authentication token and establishing the handle is responsive to a client-initiated subscription request.

7. The system of claim 6, wherein the channel identifier is transmitted to the client device in response to the successful validation of the test client authentication token for a given port, and wherein the client device transmits, to the push initiator element, the client authentication token, and the channel identifier to the push initiator element in the client-initiated subscription request.

8. The system of claim 5, wherein the channel identifier is established in response to a channel creation request by the client device transmitted to the push notification server, and wherein the channel creation request comprises at least one of the client authentication token, a port identifier, or an identifier for the push initiator element.

9. The system of claim 5, wherein establishing the handle is not responsive to a client-initiated subscription request for push notifications transmitted from the client device to the push initiator element, and wherein the push initiator element transmits the channel identifier to the client device, and receives, from the client device, the client authentication token.

10. The system of claim 5, wherein the channel identifier is established in response to a channel creation request by the push initiator element transmitted to the push notification server, and wherein the channel creation request comprises at least one of:

the push initiator element authentication token, a port identifier, or an identifier of the push initiator element.

11. The system of claim 10, wherein the port identifier comprises a known port number associated with the client device.

12. The system of claim 5, wherein at least one additional endpoint for the push pathway is to be successfully authenticated before the push pathway is established.

13. The system of claim 5, wherein the push initiator element transmits data over the push pathway after establishing the push pathway.

14. The system of claim 5, wherein at least one of the client authentication token or the push initiator element authentication token is configured to expire.

15. Non-transitory computer-readable media comprising instructions for execution by a processor, wherein the instructions when executed, cause an identity provider element to authorize endpoints of a push pathway for push notifications, the endpoints comprising a push initiator element and a client device, the identity provider element operating independently of a push notification server configured to control transmission of push notifications from the push initiator element to the client device over the push pathway, the push pathway comprising a logical network connection amongst the push notification server, the push initiator element and the client device, the instructions comprising:

instructions for the identity provider element authenticating the client device based on one or more security credentials associated with the client device;

instructions for the identity provider element, in response to a successful authentication of the client device, generating and transmitting to the client device a client authentication token associated with the client device;

instructions for the identify provider element determining validity of a test client authentication token purporting to be the client authentication token and providing to the push notification server a first indication of the validity of the test client authentication token;

instructions for the identity provider element authenticating the push initiator element based on one or more security credentials associated with the push initiator element; and

instructions for the identity provider element, in response to a successful authentication of the push initiator element, generating and transmitting to the push initiator element a push initiator element authentication token associated with the push initiator element;

instructions for the identity provider element determining validity of a test push initiator element authentication token purporting to be the push initiator element authentication token and providing to the push notification server a second indication of the validity of the test push initiator element authentication token,

wherein, in the event that the identity provider element successfully validates the test client authentication token, the first indication permits the push notification server to determine a channel identifier, and

wherein, in the event that the identity provider element successfully validates the test client authentication token and the test push initiator element authentication token, the first indication and the second indication permit the push notification server to determine a handle for the push pathway, wherein the handle is associated with the channel identifier and is used to establish the push pathway for transmission of push notifications from the push initiator element to the client device.

16. The computer-readable media of claim 15, wherein the validating of the test push initiator element authentication token is responsive to a client-initiated subscription request.

17. An identity provider apparatus for authorizing endpoints of a push pathway for push notifications, the endpoints comprising a push initiator element and a client device, the identity provider apparatus operating independently of a push notification server configured to control transmission of push notifications from the push initiator element to the client device over the push pathway, the push pathway comprising a logical network connection amongst the push notification server, the push initiator element and the client device, the identity provider apparatus comprising:

a processor; and

a memory comprising instructions which, when executed by the processor, cause the identity provider apparatus;

to authenticate the client device based on one or more security credentials associated with the client device;

in response to a successful authentication of the client device, to generate and transmit to the client device a client authentication token associated with the client device;

to determine validity of a test client authentication token purporting to be the client authentication token and to provide to the push notification server a first indication of the validity of the test client authentication token associated;

to authenticate the push initiator element based on one or more security credentials associated with the push initiator element; and

in response to a successful authentication of the push initiator element, to generate and transmit to the push initiator element a push initiator element authentication token associated with the push initiator element;

to determine validity of a test push initiator element authentication token purporting to be the push initiator element authentication token and to provide to the push notification server a second indication of the validity of the test push initiator element authentication token,

wherein, in the event that the identity provider apparatus successfully validates the test client authentication token, the first indication permits the push notification server to determine a channel identifier, and

wherein, in the event that the identity provider apparatus successfully validates the test push initiator element authentication token, the second indication permits the push notification server to determine a handle, wherein the handle is associated with the channel identifier and is used to establish the push pathway for transmission of push notifications from the push initiator element to the client device.

18. The apparatus of claim 17, wherein the validating of the test push initiator element authentication token associated with the second endpoint is responsive to a client-initiated subscription request.

19. The apparatus of claim 18, wherein at least one additional endpoint for the push pathway is to be successfully authenticated before the push pathway is established.

20. The apparatus of claim 19, wherein at least one of the client authentication token or the push initiator element authentication token is configured to expire.