Granted Patent B2

US 8,705,720 · App. 12/028,781 · Granted Apr 22, 2014

Abstract

Claims (56)

1. A method for authenticating an Internet Protocol (IP) phone and a user of the IP phone comprising the steps of:

determining by a security server whether the IP phone is an authorized device;

after determining by the security server whether the IP phone is an authorized device, whenever the IP phone is an authorized device and a trigger condition occurs, authenticating the user of the IP phone by initiating a first call to the IP phone by the security server and sending a request for a passcode to the IP phone as part of the first call;

in response to the security server receiving an invalid passcode, sending a message to disable the IP phone, and terminating the first call;

in response to the security server receiving a valid passcode, enabling access by the IP phone to resources protected by the security server, and terminating the first call; and

wherein the IP phone is not running a two factor authentication client application while the security server is determining whether the IP phone is an authorized device and while the first call is active, and wherein an in-band channel established by the first call initiated by the security server is used to authenticate the user of the IP phone.

2. The method as recited in claim 1 , wherein:

control messages and voice prompts are used to set up the first call to the IP phone; and

the IP phone comprises a dual mode phone, a wireless phone, a soft phone, a web phone, a personal data assistant or an IP-based telecommunications device.

3. The method as recited in claim 1 , wherein:

the trigger condition comprises a time-based condition, an event-based condition or a combination thereof;

the time-based condition comprises a requirement to authenticate the IP phone daily, weekly, bi-weekly, monthly, quarterly, yearly or some other specified time; and

the event-based condition comprises receiving a registration request from the IP phone, a switch-over to standby, a challenge from an authentication manager, a request for a specified service, or a request for access to a specified device.

4. The method as recited in claim 3 , wherein the trigger condition is any one of receiving a switch-over to standby, receiving a challenge from an authentication manager, or receiving a request for a specified service.

5. The method as recited in claim 1 , wherein the IP phone is authenticated by determining that the IP phone is included in a “white-list”.

6. The method as recited in claim 1 , further comprising the step of generating a security incidence whenever the IP phone is determined not to be an authorized device.

7. The method as recited in claim 1 , wherein:

the request for the passcode comprises one or more display prompts, one or more voice prompts or a combination thereof; and

the passcode comprises a personal identification code, a token code, a physical key, an electronic key, a biometric identifier, a magnetic signature, an electronic signature, one or more numbers, one or more symbols, one or more alphabet characters, one or more keystrokes, or a combination thereof.

8. The method as recited in claim 1 , further comprising the step of resending the request for the passcode after a specified period of time whenever the user does not answer the first call.

9. The method as recited in claim 1 , further comprising the step of sending a message to disable the IP phone after a specified number of consecutive of authentication attempts have failed.

10. The method as recited in claim 1 , further comprising the step of notifying the user that the IP phone has been disabled using one or more display messages, audio messages, voice mail messages, electronic mail messages, text messages, or a combination thereof.

11. The method as recited in claim 1 , further comprising the steps of initiating another call to the IP phone and sending another request for a passcode to the IP phone after a specified period of time.

12. The method as recited in claim 1 , further comprising the step of enabling the IP phone after the IP phone has been disabled using a clearing process executed by the user, a technician, a security person, a supervisor or a combination thereof.

13. The method as recited in claim 1 , further comprising the step of requesting authentication of the received passcode from an authentication server.

14. The method as recited in claim 1 , further comprising the step of delaying registration of the IP phone with a call manager until the IP phone and the user are authenticated.

15. The method as recited in claim 1 , further comprising the steps of:

receiving a request for a configuration file from an IP-phone;

retrieving the configuration file;

sending the configuration file to the IP-phone;

requesting the configuration file from a call manager;

receiving the requested configuration file; and

saving the requested configuration file and sending a reset message to the IP-phone whenever the requested configuration file is different than the configuration file.

16. The method as recited in claim 15 , further comprising the steps of:

receiving another request for the configuration file in response to the reset message; and

sending the requested configuration file to the IP-phone.

17. An apparatus for authenticating an Internet Protocol (IP) phone and a user of the IP phone comprising:

a security server comprising a communications interface, a memory, and a processor;

wherein the processor is communicably coupled to the communications interface and the memory, wherein the processor is configured to determine whether the IP phone is an authorized device, and wherein the processor is further configured to determine whether the user of the IP phone is authorized, and after determining by the processor whether the IP phone is an authorized device, and whenever the IP phone is authorized and a trigger condition occurs;

the processor authenticates the IP phone by:

initiating a call to the IP phone via the communications interface;

sending a request for a passcode to the IP phone via the communications interface as part of the call;

receiving a passcode entry from the user;

sending a message to disable the IP phone via the communications interface whenever the passcode entry is invalid;

enabling access to a resource protected by the apparatus whenever the passcode entry is valid;

terminating the call after either disabling the IP phone or enabling access to a resource; and

wherein the IP phone is not running a two factor authentication client application, and wherein an in-band channel established by the call initiated by the processor is used to authenticate the user of the IP phone.

18. A system comprising:

one or more Internet Protocol (IP) phones;

a security server comprising a communications interface, a memory and a processor communicably coupled to the communications interface and the memory; and

an Internet Protocol network communicably coupling the one or more IP phones to the security server;

wherein the processor is configured to determine whether at least a first IP phone included in the one or more IP phones is an authorized device, and to determine whether the user of the first IP phone is authorized, and after determining by the processor whether the IP phone is an authorized device, and whenever the first IP phone is authorized and a trigger condition occurs,

wherein the processor of the security server determines whether the user of the first IP phone is authenticated by initiating a call to the first IP phone via the communications interface, sending a request for a passcode to the first IP phone via the communications interface as part of the call, sending a message to disable the IP phone via the communications interface whenever the passcode is invalid, and terminating the call; and

wherein the IP phone is not running a two factor authentication client application during the authentication process and an in-band channel established by the call initiated by the processor is used to authenticate the user of the IP phone.

19. The system as recited in claim 18 , further comprising an authentication server communicably coupled to the Internet Protocol network.

20. The system as recited in claim 18 , further comprising a call manager communicably coupled to the Internet Protocol network.

Assignments (22)