Automated Authentication Process for Application Clients
One aspect of the invention defines a process which allows application providers to remotely activate and authenticate logins from an application client. In one implementation, this is achieved through a three step approach. First, the application client notifies the application service of its successful installation (e.g. by accessing a unique URL). Second, it leverages the built-in security features of a mobile network (e.g. security mechanisms of GSM or IMS access security) to securely deliver a message containing authentication information to the application client. Examples of message transports are SMS or SIP with IPsec as specified by IMS. Third, this information is used to authenticate the application client when accessing the remote application service (e.g. via the Internet).
1 . A method for automated authentication of an application client on a mobile communications device comprising:
receiving a notification from a mobile communications device via a mobile transport network, the notification conditioned upon successful installation on the mobile communications device of an application client for an application service;
contacting an authentication server for the mobile transport network to determine a communications address of the mobile communications device;
validating the communications address in a registration database that contains registrations of communications addresses for the application service;
conditioned upon successful validation, storing a unique access key in the registration database in a manner that associates the unique access key with the communications address; and
sending the unique access key to a message delivery server for the mobile transport network, for delivery to the application client.
2 . The method of claim 1 further comprising:
completing a login process for the application client to access the application service, the application client accessing the delivered unique access key as part of the login process.
3 . The method of claim 2 wherein completing the login process comprises:
establishing a data connection with the application client;
receiving the unique access key from the application client via the data connection;
validating the unique access key in the registration database; and
conditioned upon successful validation, granting the application client access to the application service.
4 . The method of claim 3 further comprising:
the application client and the application service using the data connection to exchange data.
5 . The method of claim 3 wherein the data connection is an encrypted data connection.
6 . The method of claim 3 wherein completing the login process further comprises:
contacting an authentication server for the mobile transport network to determine a communications address of the mobile communications device; and
validating the communications address in the registration database, the granting the application client access to the application service further conditioned upon successful validation of the communications address.
7 . The method of claim 1 further comprising:
registering a communications address for the application service in the registration database.
8 . The method of claim 1 wherein the notification is received via the mobile transport network using HTTP.
9 . The method of claim 1 wherein the notification is received via the mobile transport network using SMS.
10 . The method of claim 1 wherein the notification is received via the mobile transport network using SIP.
11 . The method of claim 1 wherein the notification is received via the mobile transport network using a custom protocol over TCP/IP.
12 . The method of claim 1 wherein the communications address comprises a phone number.
13 . The method of claim 1 wherein the communications address comprises an email address.
14 . The method of claim 1 wherein the communications address comprises a SIP URI.
15 . The method of claim 1 wherein the communications address is determined using an IP address of the mobile communications device.
16 . The method of claim 1 wherein the unique access key has a defined expiry time.
17 . The method of claim 1 wherein the message delivery server comprises SMSC.
18 . The method of claim 1 wherein the message delivery server comprises SMS-Gateway.
19 . The method of claim 1 wherein the message delivery server comprises MMSC.
20 . The method of claim 1 wherein the message delivery server comprises e-mail server.
21 . The method of claim 1 wherein the message delivery server comprises SIP/IMS application server.
22 . The method of claim 1 wherein sending the unique access key to a message delivery server comprises sending the unique access key directly to the message delivery server.
23 . The method of claim 1 wherein sending the unique access key to a message delivery server comprises sending the unique access key indirectly to the message delivery server.
24 . An authentication platform for automated authentication of an application client on a mobile communications device comprising:
a registration database that contains registrations of communications addresses for the application service; and
a security server in communication with the registration database, the security server performing the steps of:
receiving a notification from a mobile communications device via a mobile transport network, the notification conditioned upon successful installation on the mobile communications device of an application client for an application service;
contacting an authentication server for the mobile transport network to determine a communications address of the mobile communications device;
validating the communications address in a registration database;
conditioned upon successful validation, storing a unique access key in the registration database in a manner that associates the unique access key with the communications address; and
sending the unique access key to a message delivery server for the mobile transport network, for delivery to the application client.
25 . The authentication platform of claim 24 wherein the security server further performs the step of:
completing a login process for the application client to access the application service, the application client accessing the delivered unique access key as part of the login process.
26 . The authentication platform of claim 25 wherein the step of completing the login process comprises:
establishing a data connection with the application client;
receiving the unique access key from the application client via the data connection;
validating the unique access key in the registration database; and
conditioned upon successful validation, granting the application client access to the application service.
27 . The authentication platform of claim 26 wherein completing the login process further comprises:
contacting an authentication server for the mobile transport network to determine a communications address of the mobile communications device; and
validating the communications address in the registration database, the granting the application client access to the application service further conditioned upon successful validation of the communications address.