Method and systems for protecting subscriber identification between service and content providers

• US 20040117430A1
• Filed: 10/08/2003
• Published: 06/17/2004
• Est. Priority Date: 10/10/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cresp, Jacques, Livigni, Fabrice, Bazot, Philippe, Sert, Richard
• Granted Patent: US 7,480,935 B2
• Time in Patent Office: Days
• US Class Current: 709/200
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A method and systems for protecting the identification of a subscriber when a service provider transmits a subscriber request to a content provider in a distributed network environment, such as Internet. After the user sends a request to a service provider to which he has subscribed, the service provider encrypts the user identifier before transmitting this request with the encrypted user identifier to the content provider. Upon reception, the content provider uses an authentication Web Service supplied by the service provider for certifying the user identifier. If the user identifier is certified, the content provider transmits the requested content to the service provider, which formats it before sending it to the user. The content provider may charge the user through the service provider.

Claims

1. A method for protecting an identifier of a subscriber, during data transfer between a service provider and a content provider, when said subscriber sends a request to said service provider to obtain data belonging to said content provider, said method comprising the steps of:

upon reception of said subscriber request by said service provider;

computing an encrypted token using said identifier of said subscriber; and

,

transmitting said subscriber request and said encrypted token to said content provider;

upon reception by said service provider of a certification request comprising an encrypted token, sent by said content provider;

extracting said encrypted token from said certification request;

decrypting said extracted encrypted token to determine said subscriber identifier;

checking said determined subscriber identifier; and

,

transmitting a success or failure indication to said content provider in response to said certification request;

upon reception of said data belonging to said content provider by said service provider, transmitting said data belonging to said content provider to said subscriber.

2. The method of claim 1, further comprising the step of verifying rights of said subscriber, wherein said steps of computing an encrypted token and transmitting said subscriber request and said encrypted token to said content provider are done only if said subscriber holds corresponding rights.

3. The method of claim 1 further comprising the step of memorizing said encrypted token so that it can be reused without having to be recomputed.

4. The method of claim 1 further comprising the step of charging said subscriber if said determined subscriber identifier is certified.

5. The method of claim 1 further comprising the step of formatting said data belonging to said content provider.

6. The method of claim 1 wherein said step of computing an encrypted token using the identifier of said subscriber comprises the steps of:

concatenating said identifier of said subscriber with a random or time varying value using a separator; and

,

encrypting said concatenation using either a symmetric or an asymmetric encryption algorithm.

7. The method of claim 1 wherein said certification request is a SOAP request.

8. The method of claim 1 implemented using web service technology.

9. An apparatus comprising means adapted for carrying out the method according to claim 2.

10. A computer-like readable medium comprising instructions for carrying out the method according to claim 2.