# US 8,782,759 B2 · Identification and access control of users in a disconnected mode environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,759 B2 - Document ID: US8782759B2 - Status: Granted - Kind: B2 - Application number: 12/029,006 - Filed: 2008-02-11 - Published: 2009-08-13 - Granted: 2014-07-15 - Earliest claimed: 2008-02-11 - Assignees: International Business Machines Corporation - Applicants: Heather Maria Hinton; Anthony Joseph Nadalin - Inventors: Heather Maria Hinton; Anthony Joseph Nadalin - Web page: https://patentgrep.com/patent/US8782759B2 ## CPC - H04W 12/06: Authentication - H04L 63/0815: {providing single-sign-on or federations} - H04W 12/082: using revocation of authorisation - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention provides identification and access control for an end user mobile device in a disconnected mode environment, which refers generally to the situation where, in a mobile environment, a mobile device is disconnected from or otherwise unable to connect to a wireless network. The inventive method provides the mobile device with a “long term” token, which is obtained from an identity provider coupled to the network. The token may be valid for a given time period. During that time period, the mobile device can enter a disconnected mode but still obtain a mobile device-aided function (e.g., access to a resource) by presenting for authentication the long term token. Upon a given occurrence (e.g., loss of or theft of the mobile device) the long term token is canceled to restrict unauthorized further use of the mobile device in disconnected mode. ## Claims ### Claim 1 A method to enable a mobile device user to perform a mobile device-aided operation, comprising: with the mobile device in a connected mode in which it is connected to an identity provider, receiving and storing at the mobile device a token that is useable by the mobile device to obtain an authentication when the mobile device is operating in an identity provider-disconnected mode in which it is disconnected from the identity provider, wherein the token includes a time dependency that defines when the token is valid for use and is one of: a defined time period, and a timeframe that is defined relative to a given future date and time; while the mobile device is operating in the identity provider-disconnected mode, causing the mobile device to present the token to enable the mobile device to obtain the authentication, wherein presenting the token also verifies that the mobile device is operating in the identity-provider disconnected mode; and upon receipt of the authentication, performing the mobile device-aided operation. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the mobile device operates in the identity provider-disconnected mode when the mobile device cannot access an identity provider. ### Claim 3 (depends on 2) The method as described in claim 2 wherein the mobile device can access a network provider. ### Claim 4 (depends on 1) The method as described in claim 1 wherein the token is a single sign-on (SSO) token is associated with a federated computing environment single sign-on (F-SSO). ### Claim 5 (depends on 1) The method as described in claim 1 further including canceling the token. ### Claim 6 (depends on 1) The method as described in claim 1 wherein the token is presented by the mobile device to a given application. ### Claim 7 (depends on 1) The method as described in claim 1 wherein the step of presenting the token also validates a digital signature associated with the token. ### Claim 8 (depends on 1) The method as described in claim 1 wherein the token is generated by an issuing device. ### Claim 9 A method, using a mobile device, to enable a mobile device user to perform a mobile device-aided operation, comprising: with the mobile device in a connected mode of operation, receiving and storing at the mobile device a data string, the data string useable to obtain an authentication of the mobile device user, wherein the data string is a security token that includes a time dependency that defines when the token is valid for use and is one of: a defined time period, and a timeframe that is defined relative to a given future date and time; and with the mobile device in an identity provider-disconnected mode of operation distinct from the connected mode of operation, having the mobile device present the data string to an application to enable the mobile device to attempt to obtain the authentication; upon obtaining the authentication, and upon verifying the mobile device is operating in the identity provider-disconnected mode of operation, performing the mobile device-aided operation using the application. ### Claim 10 (depends on 9) The method as described in claim 9 wherein the identity provider-disconnected mode of operation is a mode in which the mobile device cannot access an identity provider. ### Claim 11 (depends on 10) The method as described in claim 10 wherein the mobile device can access a network provider when the mobile device is operating in the identity provider-disconnected mode of operation. ### Claim 12 (depends on 9) The method as described in claim 9 wherein the security token enables a single sign-on operation. ### Claim 13 (depends on 9) The method as described in claim 9 wherein the authentication includes validating the data string. ### Claim 14 A method, using a mobile device, to enable a mobile device user to perform a mobile device-aided operation, comprising: with the mobile device in a connected mode of operation, receiving and storing at the mobile device a token, the token useable to assert an identity or privilege associated with the mobile device user, wherein the token includes a time dependency that defines when the token is valid for use and is one of: a defined time period, and a timeframe that is defined relative to a given future date and time; and with the mobile device in an identity provider-disconnected mode of operation, causing the mobile device to present the token to an application to enable the mobile device user to perform the mobile device-aided operation using the application, wherein presenting the token also verifies that the mobile device is operating in the identity-provider disconnected mode. ### Claim 15 (depends on 14) The method as described in claim 14 further including: upon a given occurrence, canceling the token. ### Claim 16 A mobile device, comprising: a radio; a man-machine interface; a network interface; a processor; a computer-readable medium having processor-executable instructions for performing the following method steps: with the mobile device in a connected mode, receiving and storing a token that is useable to assert an identity or privilege associated with a user of the mobile device; and with the mobile device verified as operating in an identity provider-disconnected mode of operation, and provided the token is valid, causing the mobile device to present the token to enable the mobile device user to perform a mobile device-aided operation, wherein validity of the token is determined by evaluating a time dependency associated with the token that defines when the token is valid for use and is one of: a defined time period, and a timeframe that is defined relative to a given future date and time. ### Claim 17 An access control system having an associated token issuing device, the system comprising: an application; and software executable in a mobile device at a first time when the mobile device is operating in a first mode of operation to receive and store in the mobile device a token, wherein the token is generated by the token issuing device and is useable, at a second time distinct from the first time, to obtain an authentication of a mobile device user, wherein the token includes a time dependency that defines when the token is valid for use and is one of: a defined time period, and a timeframe that is defined relative to a given future date and time; the software being further executable at the second time when the mobile device is verified as operating in an identity provider-disconnected mode of operation to cause the mobile device to present the token to attempt to obtain the authentication; the software being further executable upon obtaining the authentication, and with the mobile device in the identity provider-disconnected mode of operation, to enable the mobile device user to perform a mobile device-aided operation.