# US 2013/0252583 A1 · Authentication server and methods for granting tokens comprising location data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0252583 A1 - Document ID: US20130252583A1 - Status: Published application - Kind: A1 - Application number: 13/427,333 - Filed: 2012-03-22 - Published: 2013-09-26 - Earliest claimed: 2012-03-22 - Assignees: Research In Motion Limited - Inventors: Andrew James Guy Brown; Christopher M. Fogel; Thomas Owen Parry - Web page: https://patentgrep.com/patent/US20130252583A1 ## CPC - H04W 12/06: Authentication - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 4/029: Location-based management or tracking services - H04W 12/08: Access security - H04W 4/02: Services making use of location information - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authentication server and methods of generating a token for use by a mobile device to establish authorization for the mobile device to access a service provided by a service server, the method comprising receiving a request for the token from the mobile device, generating the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server, and transmitting the token to the mobile device. ## Claims ### Claim 1 A method of generating a token for use by a mobile device to establish authorization for the mobile device to access a service provided by a service server, the method comprising: receiving, at an authentication server, a request for the token from the mobile device; generating the token at the authentication server, the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server; and transmitting the token to the mobile device. ### Claim 2 (depends on 1) The method of claim 1, wherein the request received from the mobile device comprises data on which the location data of the token generated at the authentication server is based. ### Claim 3 (depends on 1) The method of claim 1, further comprising receiving, at the authentication server, data, from at least one of a location services server or a network provider, on which the location data of the token generated at the authentication server is based. ### Claim 4 (depends on 1) The method of claim 1, wherein the location data identifies a geographical location of the mobile device. ### Claim 5 (depends on 1) The method of claim 1, wherein the location data identifies a geographical location in which the mobile device is registered. ### Claim 6 (depends on 1) The method of claim 1, wherein the location data identifies a geographical location in which the mobile device operates at a time the request is transmitted from the mobile device to the authentication server. ### Claim 7 (depends on 1) The method of claim 1, further comprising receiving, at the authentication server, policy data from a policy server, and wherein authentication data of the token generated at the authentication server is generated based on the policy data. ### Claim 8 (depends on 1) The method of claim 1, wherein the authentication data of the token generated at the authentication server indicates that the service server is to control access by the mobile device to the service based on the location data of the token generated at the authentication server. ### Claim 9 (depends on 1) The method of claim 1, wherein the authentication data of the token generated at the authentication server indicates that the service server is to control access by the mobile device to the service based on the location data of the token generated at the authentication server and on a location of the mobile device at a time that the mobile device requests access to the service from the service server. ### Claim 10 (depends on 1) The method of claim 1, further comprising encrypting at least one of the location data or the authentication data of the token generated at the authentication server using a secret shared between the authentication server and the service server, prior to transmitting the token to the mobile device. ### Claim 11 (depends on 1) The method of claim 1, wherein the request for the token from the mobile device is received by the authentication server via a relay, and wherein the token is generated in response to the relay successfully authenticating the mobile device. ### Claim 12 (depends on 1) The method of claim 1, wherein the request comprises a device identifier, and wherein the method further comprises, prior to generating the token, verifying that the device identifier corresponds to a source address of a message containing the request for the token. ### Claim 13 (depends on 1) The method of claim 1, wherein the service server comprises a browsing proxy server. ### Claim 14 An authentication server comprising: a receiver capable of receiving a request for a token from a mobile device, the token for use by the mobile device to establish authorization for the mobile device to access a service provided by a service server; a transmitter capable of transmitting the token to the mobile device; a memory; and a processor capable of generating the token, the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server, and causing the token to be transmitted to the mobile device. ### Claim 15 (depends on 14) The authentication server of claim 14, wherein the request received from the mobile device comprises data on which the location data of the token generated at the authentication server is based. ### Claim 16 (depends on 14) The authentication server of claim 14, wherein the processor is capable of receiving data, from at least one of a location services server or a network provider, on which the location data of the token generated at the authentication server is based. ### Claim 17 (depends on 14) The authentication server of claim 14, wherein the location data identifies a geographical location of the mobile device. ### Claim 18 (depends on 14) The authentication server of claim 14, wherein the location data identifies a geographical location in which the mobile device is registered. ### Claim 19 (depends on 14) The authentication server of claim 14, wherein the location data identifies a geographical location in which the mobile device operates at a time the request is transmitted from the mobile device to the authentication server. ### Claim 20 (depends on 14) The authentication server of claim 14, wherein the processor is capable of receiving policy data from a policy server, and wherein authentication data of the token generated at the authentication server is generated based on the policy data. ### Claim 21 (depends on 14) The authentication server of claim 14, wherein the authentication data of the token generated at the authentication server indicates that the service server is to control access by the mobile device to the service based on the location data of the token generated at the authentication server. ### Claim 22 (depends on 14) The authentication server of claim 14, wherein the authentication data of the token generated at the authentication server indicates that the service server is to control access by the mobile device to the service based on the location data of the token generated at the authentication server and on a location of the mobile device at a time that the mobile device requests access to the service from the service server. ### Claim 23 (depends on 14) The authentication server of claim 14, wherein the processor is capable of encrypting at least one of the location data or the authentication data of the token generated at the authentication server using a secret shared between the authentication server and the service server, prior to causing the token to be transmitted to the mobile device. ### Claim 24 (depends on 14) The authentication server of claim 14, wherein the receiver receives the request for the token via a relay, and wherein the processor is capable of generating the token in response to the relay successfully authenticating the mobile device. ### Claim 25 (depends on 14) The authentication server of claim 14, wherein the request comprises a device identifier, and the processor is capable of verifying, prior to generating the token, that the device identifier corresponds to a source address of a message containing the request for the token. ### Claim 26 (depends on 14) The authentication server of claim 14, wherein the service server comprises a browsing proxy server. ### Claim 27 A mobile device comprising: a processor; and a memory; wherein the processor is capable of transmitting a request to an authentication server for a token, the token for use by the mobile device to establish authorization for the mobile device to access a service provided by a service server; and wherein the processor is capable of receiving the token from the authentication server, the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server. ### Claim 28 (depends on 27) The mobile device of claim 27, wherein the processor is capable of transmitting a request to the service server to access the service, wherein the request comprises the token received from the authentication server, and wherein the token is usable by the service server to authorize the mobile device to access the service. ### Claim 29 A computer-readable medium having computer-readable instructions stored thereon that, when executed by a processor on a mobile device, cause the mobile device to obtain a token for establishing authorization to access a service provided from a service server by: transmitting a request to an authentication server a request for a token, the token for use by the mobile device to establish authorization for the mobile device to access a service provided by a service server; and receiving the token from the authentication server, the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server. ### Claim 30 A method of authorizing a mobile device to access a service provided by a service server, the method comprising: receiving, at the service server, a request from the mobile device to access the service, wherein the request comprises a token generated by an authentication server, the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server; determining, at the service server,'whether the mobile device is authorized to access the service based on both the authentication data and the location data in the token generated by the authentication server; and controlling access by the mobile device to the service based on the determining. ### Claim 31 (depends on 30) The method of claim 30, wherein the authentication data of the token generated at the authentication server indicates that the service server is to control access by the mobile device to the service based on the location data of the token generated at the authentication server and on a location of the mobile device at a time that the mobile device requests access to the service from the service server. ### Claim 32 (depends on 30) The method of claim 30, wherein the determining comprises: comparing the location data in the token generated by the authentication server to policy data associated with the service; if the policy data indicates that access to the service is authorized based on the location data, authorizing the mobile device to access to the service; and if the policy data indicates that access to the service is denied based on the location data, denying the mobile device access to the service. ### Claim 33 (depends on 31) The method of claim 31, wherein the determining comprises: comparing the location data in the token generated by the authentication server to a location of the mobile device at the time the request to access the service was made; if the authentication data indicates that access to the service is authorized based on the comparing, authorizing the mobile device to access to the service; and if the authentication data indicates that access to the service is denied based on the comparing, denying the mobile device access to the service.