Identification and access control of users in a disconnected mode environment

A method, using a mobile device, to enable a mobile device user to perform a mobile device-aided operation, comprising:

• with the mobile device in a connected mode of operation, receiving and storing at the mobile device a data string, the data string useable to obtain an authentication of the mobile device user, wherein the data string is a security token that includes a time dependency that defines when the token is valid for use and is one of:
• a defined time period, and a timeframe that is defined relative to a given future date and time;
• and
• with the mobile device in an identity provider-disconnected mode of operation distinct from the connected mode of operation, having the mobile device present the data string to an application to enable the mobile device to attempt to obtain the authentication;
• upon obtaining the authentication, and upon verifying the mobile device is operating in the identity provider-disconnected mode of operation, performing the mobile device-aided operation using the application.

A method, using a mobile device, to enable a mobile device user to perform a mobile device-aided operation, comprising:

• with the mobile device in a connected mode of operation, receiving and storing at the mobile device a token, the token useable to assert an identity or privilege associated with the mobile device user, wherein the token includes a time dependency that defines when the token is valid for use and is one of:
• a defined time period, and a timeframe that is defined relative to a given future date and time;
• and
• with the mobile device in an identity provider-disconnected mode of operation, causing the mobile device to present the token to an application to enable the mobile device user to perform the mobile device-aided operation using the application, wherein presenting the token also verifies that the mobile device is operating in the identity-provider disconnected mode.

A mobile device, comprising:

• a radio;
• a man-machine interface;
• a network interface;
• a processor;
• a computer-readable medium having processor-executable instructions for performing the following method steps:
• with the mobile device in a connected mode, receiving and storing a token that is useable to assert an identity or privilege associated with a user of the mobile device;
• and
• with the mobile device verified as operating in an identity provider-disconnected mode of operation, and provided the token is valid, causing the mobile device to present the token to enable the mobile device user to perform a mobile device-aided operation, wherein validity of the token is determined by evaluating a time dependency associated with the token that defines when the token is valid for use and is one of:
• a defined time period, and a timeframe that is defined relative to a given future date and time.

An access control system having an associated token issuing device, the system comprising:

• an application;
• and
• software executable in a mobile device at a first time when the mobile device is operating in a first mode of operation to receive and store in the mobile device a token, wherein the token is generated by the token issuing device and is useable, at a second time distinct from the first time, to obtain an authentication of a mobile device user, wherein the token includes a time dependency that defines when the token is valid for use and is one of:
• a defined time period, and a timeframe that is defined relative to a given future date and time;
• the software being further executable at the second time when the mobile device is verified as operating in an identity provider-disconnected mode of operation to cause the mobile device to present the token to attempt to obtain the authentication;
• the software being further executable upon obtaining the authentication, and with the mobile device in the identity provider-disconnected mode of operation, to enable the mobile device user to perform a mobile device-aided operation.