System and method of authenticating a network gateway

Abstract

A method of network gateway authenticating involves a network gateway receiving an authentication request from a communications terminal. The communications terminal is in communication with an identity token. The authentication request includes a token cryptogram generated from a cryptographic key stored on the identity token. The network gateway transmits the authentication request to a communications network, and receives an authentication response from the communications network in accordance with a validity of the token cryptogram. The authentication response includes a gateway authentication certificate. The gateway authentication certificate is configured to authenticate the network gateway to a network device of the communications network.

1 . A method of network gateway authenticating, comprising:
 a network gateway receiving an authentication request from a communications terminal, the communications terminal being in communication with an identity token, the authentication request including a token cryptogram generated from a cryptographic key stored on the identity token;   the network gateway transmitting the authentication request to a communications network; and   the network gateway receiving an authentication response from the communications network in accordance with a validity of the token cryptogram, the authentication response including a gateway authentication certificate, the gateway authentication certificate being configured to authenticate the network gateway to a network device of the communications network.   
     
     
         2 . The method according to  claim 1 , wherein the authentication request includes a credential, the authentication response receiving comprises the network gateway associating the gateway authentication certificate with the credential, and the method further comprises the network gateway authenticating to the network device via the credential and the associated gateway authentication certificate. 
     
     
         3 . The method according to  claim 2 , further comprising the network gateway receiving a validation request from the communications terminal, and facilitating authentication of the communications terminal to the network device via the gateway authentication certificate and the validation request. 
     
     
         4 . The method according to  claim 3 , wherein the facilitating the authentication of the communications terminal comprises the network gateway using the validation request to locate the gateway authentication certificate associated with the credential, using the located gateway authentication certificate to establish an encrypted connection with the communications network, and transmitting the validation request to the communications network over the encrypted connection. 
     
     
         5 . The method according to  claim 4 , wherein the credential is associated with the communications terminal. 
     
     
         6 . The method according to  claim 1 , wherein the network device determines the validity of the token cryptogram. 
     
     
         7 . The method according to  claim 2 , further comprising the communications terminal generating a terminal activation request from the credential and from a private encryption key, and the network gateway generating an activation response from the terminal activation request, the activation response including a terminal authentication certificate, the terminal authentication certificate being configured to facilitate authentication of the communications terminal to the network gateway. 
     
     
         8 . The method according to  claim 7 , further comprising the communications terminal determining a validity of the terminal authentication certificate and, in accordance with an outcome of the terminal authentication certificate validity determining, authenticating to the network gateway by establishing an encrypted connection with the network gateway using the terminal authentication certificate. 
     
     
         9 . A computer-readable medium comprising computer processing instructions stored thereon for execution by a network gateway, the computer processing instructions, when executed by the network gateway, causing the network gateway to perform the method of  claim 1 . 
     
     
         10 . A network gateway, comprising:
 a gateway authenticator configured to communicate with a communications terminal and to (i) receive an authentication request from the communications terminal, the authentication request including a token cryptogram generated from a cryptographic key stored on an identity token interfaced with the communications terminal, (ii) transmit the authentication request to a communications network, and (iii) receive an authentication response from the communications network in accordance with a validity of the token cryptogram, the authentication response including a gateway authentication certificate, the gateway authentication certificate being configured to authenticate the network gateway to a network device of the communications network.   
     
     
         11 . The network gateway according to  claim 10 , wherein the network gateway is configured to associate the gateway authentication certificate with a credential received from the communications terminal, and to authenticate to the network device of the communications network via the credential and the associated gateway authentication certificate. 
     
     
         12 . The network gateway according to  claim 11 , wherein the network gateway is configured to receive a validation request from the communications terminal, and to facilitate authentication of the communications terminal to the network device of the communications network via the gateway authentication certificate and the validation request. 
     
     
         13 . The network gateway according to  claim 12 , wherein the network gateway is configured to facilitate the authentication of the communications terminal by (i) using the validation request to locate the gateway authentication certificate associated with the credential, (ii) using the located gateway authentication certificate to establish an encrypted connection with the communications network, and (iii) transmitting the validation request to the communications network over the encrypted connection. 
     
     
         14 . The network gateway according to  claim 13 , wherein the credential is associated with the communications terminal. 
     
     
         15 . The network gateway according to  claim 10 , wherein the network device determines the validity of the token cryptogram. 
     
     
         16 . An authentication network, comprising:
 a communications terminal including a token interface for interfacing an identity token with the communications terminal; and   a network gateway in communication with the communications terminal, the network gateway being configured to (i) receive an authentication request from the communications terminal, the authentication request including a token cryptogram generated from a cryptographic key stored on the identity token, (ii) transmit the authentication request to a communications network, and (iii) receive an authentication response from the communications network in accordance with a validity of the token cryptogram, the authentication response including a gateway authentication certificate, the gateway authentication certificate being configured to authenticate the network gateway to a network device of the communications network.   
     
     
         17 . The authentication network according to  claim 16 , wherein the network gateway is configured to associate the gateway authentication certificate with a credential received from the communications terminal, and to authenticate to the network device of the communications network via the credential and the associated gateway authentication certificate. 
     
     
         18 . The authentication network according to  claim 17 , wherein the network gateway is configured to receive a validation request from the communications terminal, and to facilitate authentication of the communications terminal to the network device of the communications network via the gateway authentication certificate and the validation request. 
     
     
         19 . The authentication network according to  claim 18 , wherein the network gateway is configured to facilitate the authentication of the communications terminal by (i) using the validation request to locate the gateway authentication certificate associated with the credential, (ii) using the located gateway authentication certificate to establish an encrypted connection with the communications network, and (iii) transmitting the validation request to the communications network over the encrypted connection. 
     
     
         20 . The authentication network according to  claim 16 , wherein the network device determines the validity of the token cryptogram.