Authentication method and system

1. A method, comprising:

establishing a first trust relationship between an authentication provider and at least one service provider; and

establishing a second trust relationship between the authentication provider and at least one authentication application installed in a first user terminal;

the method further comprising the following steps for each authenticated session between a second user terminal and the at least one service provider, wherein the steps are performed by an authentication provider distinct from the at least one service provider and the at least one authentication application:

receiving a request for an access code from the second user terminal, along with connection information of the second user terminal;

generating the requested access code and storing the generated access code and the connection information of the second user terminal;

sending the generated access code to the second user terminal;

receiving the access code from the authentication application with which the authentication provider has the second trust relationship and which is installed in the first user terminal, wherein the first user terminal is distinct from the second user terminal to which the authentication provider generated and sent the access code;

indicating a positive verification of the access code to the authentication application installed in the first user terminal

and to the second user terminal;

receiving, from the authentication application, a request to grant access to the second user terminal;

instructing the service provider to grant the requested access to the second user terminal; and

sending a confirmation of the granted access to the second user terminal;

wherein an authenticated session between the second user terminal and the at least one service provider can be set up for providing the set of services to the second user terminal.

2. The method of claim 1 , further comprising:

the authentication provider receiving a nickname for the authentication application installed in the first user terminal;

the authentication provider receiving the nickname in the request for an access code from the second user terminal; and

the authentication provider accepting the access code from the authentication application only if the access code is received from the authentication application to which the nickname has been assigned.

3. The method of claim 1 , wherein said establishing the first trust relationship comprises mutual authentication by means of one or more public key infrastructure certificates.

4. The method of claim 1 , wherein said establishing the second trust relationship comprises provisioning a public key infrastructure certificate from the authentication provider to the authentication application.

5. The method of claim 1 , wherein said establishing the second trust relationship comprises using a shared secret key and authentication application private key.

6. The method of claim 1 , wherein said instructing the service provider to grant the requested access comprises directly contacting the service provider from the authentication provider and passing an identification of the second user terminal or a user of the second user terminal.

7. The method of claim 1 , wherein said instructing the service provider to grant the requested access comprises indirectly passing service grant information from the authentication provider via the second user terminal to the service provider, wherein the service grant information identifies the second user terminal or a session established for the second user terminal.

8. The method of claim 1 , wherein the step of sending a confirmation of the granted access to the second user terminal comprises sending a session cookie or token to the second user terminal from the authentication provider or the service provider.

9. The method of claim 1 , wherein the authentication provider distinct from the at least one service provider performs the steps recited in claim 2 in respect of multiple service providers for each of multiple user terminals.

10. A method, comprising:

establishing a first trust relationship between an authentication provider and at least one service provider; and

establishing a second trust relationship between the authentication provider and at least one authentication application installed in a first function of a user terminal;

the method further comprising the following steps for each authenticated session between a second function of the user terminal and the at least one service provider, wherein the steps are performed by an authentication provider distinct from the at least one service provider and the at least one authentication application:

receiving a request for an access code from the second function of the user terminal, along with connection information of the second function of the user terminal;

generating the requested access code and storing the generated access code and the connection information of the second function of the user terminal;

sending the generated access code to the second function of the user terminal;

receiving the access code from the authentication application with which the authentication provider has the second trust relationship and which is comprised in the first function of the user terminal, wherein the first function of the user terminal is distinct from the second function of the user terminal to which the authentication provider generated and sent the access code;

indicating a positive verification of the access code to the authentication application comprised in the first user terminal

and to the second function of the user terminal;

receiving, from the authentication application, a request to grant access to the second function of the user terminal;

instructing the service provider to grant the requested access to the second function of the user terminal; and

sending a confirmation of the granted access to the second function of the user terminal;

wherein an authenticated session between the second function of the user terminal and the at least one service provider can be set up for providing the set of services to the second function of the user terminal.

11. The method of claim 10 , further comprising:

the authentication provider receiving a nickname for the authentication application installed in the first function of the user terminal;

the authentication provider receiving the nickname in the request for an access code from the second function of the user terminal; and

the authentication provider accepting the access code from the authentication application only if the access code is received from the authentication application to which the nickname has been assigned.

12. The method of claim 10 , wherein said establishing the first trust relationship comprises mutual authentication by means of one or more public key infrastructure certificates.

13. The method of claim 10 , wherein said establishing the second trust relationship comprises provisioning a public key infrastructure certificate from the authentication provider to the authentication application.

14. The method of claim 10 , wherein said establishing the second trust relationship comprises using a shared secret key and authentication application private key.

15. The method of claim 10 , wherein said instructing the service provider to grant the requested access comprises directly contacting the service provider from the authentication provider and passing an identification of the second function of the user terminal or a user of the second function of the user terminal.

16. The method of claim 10 , wherein said instructing the service provider to grant the requested access comprises indirectly passing service grant information from the authentication provider via the second function of the user terminal to the service provider, wherein the service grant information identifies the second function of the user terminal or a session established for the second function of the user terminal.

17. The method of claim 10 , wherein the step of sending a confirmation of the granted access to the user terminal comprises sending a session cookie or token to the user terminal from the authentication provider or the service provider.

18. The method of claim 10 , wherein the authentication provider distinct from the at least one service provider performs the steps recited in claim 11 in respect of multiple service providers for each of multiple user terminals.

19. A processor, wherein the processor is configured to perform as an authentication provider for at least one service provider with which the authentication provider has a first trust relationship, and for at least one first user terminal having an authentication application installed therein, with which the authentication provider has a second trust relationship;

the processor comprising:

at least one processing unit and memory for storing applications and data;

wherein the memory comprises program code instructions for instructing the at least one processing unit to carry out the following steps when the program code instructions are executed in the at least one processing unit;

receiving a request for an access code from the second user terminal, along with connection information of the second user terminal;

generating the requested access code and storing the generated access code and the connection information of the second user terminal;

sending the generated access code to the second user terminal;

receiving the access code from the authentication application with which the authentication provider has the second trust relationship and which is installed in the first user terminal, wherein the first user terminal is distinct from the second user terminal to which the authentication provider generated and sent the access code;

indicating a positive verification of the access code to the authentication application installed in the first user terminal and to the second user terminal;

receiving, from the authentication application, a request to grant access to the second user terminal;

instructing the service provider to grant the requested access to the second user terminal; and

sending a confirmation of the granted access to the second user terminal;

wherein an authenticated session between the second user terminal and the at least one service provider can be set up for providing the set of services to the second user terminal.

20. A processor, wherein the processor is configured to act perform as an authentication provider for at least one service provider with which the authentication provider has a first trust relationship, and for at least one user terminal having an authentication application installed in a first function of the user terminal, with which the authentication provider has a second trust relationship;

the processor comprising:

at least one processing unit and memory for storing applications and data;

wherein the memory comprises program code instructions for instructing the at least one processing unit to carry the following steps when the program code instructions are executed in the at least one processing unit:

receiving a request for an access code from the second function of the user terminal, along with connection information of the second function of the user terminal;

generating the requested access code and storing the generated access code and the connection information of the second function of the user terminal;

sending the generated access code to the second function of the user terminal;

receiving the access code from the authentication application with which the authentication provider has the second trust relationship and which is comprised in the first function of the user terminal, wherein the first function of the user terminal is distinct from the second function of the user terminal to which the authentication provider generated and sent the access code;

indicating a positive verification of the access code to the authentication application comprised in the first function of the user terminal and to the second function of the user terminal;

receiving, from the authentication application, a request to grant access to the second function of the user terminal;

instructing the service provider to grant the requested access to the second function of the user terminal; and

sending a confirmation of the granted access to the second function of the user terminal;

wherein an authenticated session between the second function of the user terminal and the at least one service provider can be set up for providing the set of services to the second function of the user terminal.

21. The method of claim 2 , wherein said establishing the first trust relationship comprises exchanging a shared cryptographic secret.

22. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to carry out the following steps when the program code instructions are executed in the at least one processing unit:

receiving a nickname for the authentication application installed in the first user terminal;

receiving the nickname in the request for an access code from the second function of the user terminal; and

accepting the access code from the authentication application only if the access code is received from the authentication application to which the nickname has been assigned.

23. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the first trust relationship by exchanging a shared cryptographic secret.

24. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the first trust relationship by mutual authentication using one or more public key infrastructure certificates.

25. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the second trust relationship by provisioning a public key infrastructure certificate from the authentication provider to the authentication application.

26. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the second trust relationship by using a shared secret key and authentication application private key.

27. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to grant the requested access by directly contacting the service provider from the authentication provider and passing an identification of the second user terminal or a user of the second user terminal.

28. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to instruct the service provider to grant the requested access by indirectly passing service grant information from the authentication provider via the user second terminal to the service provider, wherein the service grant information identifies the second user terminal or a session established for the second user terminal.

29. The processor of claim 19 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to send a confirmation of the granted access to the second user terminal by sending a session cookie or token to the second user terminal from the authentication provider or the service provider.

30. The processor of claim 19 , wherein the processor is configured to perform as the authentication provider distinct from the at least one service provider in respect of multiple service providers for each of multiple user terminals.

31. The method of claim 11 , wherein said establishing the first trust relationship comprises exchanging a shared cryptographic secret.

32. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to carry out the following steps when the program code instructions are executed in the at least one processing unit:

receiving a nickname for the authentication application installed in the first function of the user terminal;

receiving the nickname in the request for an access code from the second function of the user terminal; and

accepting the access code from the authentication application only if the access code is received from the authentication application to which the nickname has been assigned.

33. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the first trust relationship by mutual authentication with one or more public key infrastructure certificates.

34. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the second trust relationship by provisioning a public key infrastructure certificate from the authentication provider to the authentication application.

35. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to establish the second trust relationship by using a shared secret key and authentication application private key.

36. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to grant the requested access by directly contacting the service provider from the authentication provider and passing an identification of the second function of the user terminal or a user of the second function of the user terminal.

37. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to instruct the service provider to grant the requested access by indirectly passing service grant information from the authentication provider via the user second function of the terminal to the service provider, wherein the service grant information identifies the second function of the user terminal or a session established for the second function of the user terminal.

38. The processor of claim 20 , wherein the memory further comprises program code instructions for instructing the at least one processing unit to send a confirmation of the granted access to the second function of the user terminal by sending a session cookie or token to the second function of the user terminal from the authentication provider or the service provider.

39. The processor of claim 20 , wherein the processor is configured to perform as the authentication provider distinct from the at least one service provider in respect of multiple service providers for each of multiple user terminals.