User authentication in a communications system

• US 20060205387A1
• Filed: 06/07/2005
• Published: 09/14/2006
• Est. Priority Date: 03/09/2005
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Laitinen, Lauri
• Granted Patent: US 7,970,380 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability

Abstract

A method in a communication network wherein users are authenticated based on network originated user identities is disclosed. The authentication method comprising the steps of receiving a network originated identity from a user and associating the network originated identity with at least one non-network originated identity stored in a data storage. When a non-network originated identity is received from the user, the non-network originated identity from the user is compared with the at least one non-network originated identity from the data storage. The user is authenticated if the comparison is valid.

Claims

1. An authentication method in a communication network wherein users are authenticated based on network originated user identities, the authentication method comprising the steps of:

receiving a network originated identity from a user;

associating the network originated identity with at least one non-network originated identity stored in a data storage;

receiving a non-network originated identity from the user;

comparing the non-network originated identity from the user with the at least one non-network originated identity from the data storage; and

authenticating the user if the comparison is valid.

2. A method according to claim 1, wherein the step of associating comprises associating the network originated user identity with at least one non-network originated identity in an application server.

3. A method according to claim 1, wherein the step of authenticating comprises authenticating the user in the data storage.

4. A method according to claim 1, wherein the step of authenticating comprises authenticating the user in a bootstrapping function.

5. A method according to claim 1, wherein the step of authenticating comprises authenticating the user in an application server.

6. A method according to claim 1, wherein the step of associating comprises dispatching the network originated identity to a central data storage which stores associations between mobile identities and application specific identities.

7. A method according to claim 1, wherein the step of associating comprises retrieving an application specific identity based on a mobile identity and using the application specific identity to access the at least one non-network originated identity.

8. A method according to claim 1, wherein the step of comparing comprises comparing the non-network originated identity with the at least one non-network originated identity in an element providing a home subscriber database of the user.

9. A method according to claim 1, wherein the step of comparing comprises comparing the non-network originated identity from the user with at least one non-network originated identity in an application server.

10. A method according to claim 1, further comprising the steps of:

storing data for associating the non-network originated identity from the user with an intermediate identity; and

accessing the intermediate identity for verification.

11. A method according to claim 10, wherein the data for association between the intermediate identity and the non-network originated identity is held at an application server.

12. A method according to claim 10, wherein the step of comparing comprises comparing the at least one non-network originated identity having an association with the intermediate identity and the non-network originated identity received from the user at a network application function of a general authentication architecture.

13. A method according to claim 10, wherein the step of comparing comprises comparing the at least one non-network originated identity having an association with the intermediate identity and the non-network originated identity received from the user at an application specific server.

14. A method according to claim 1, comprising the steps of:

creating a temporary identifier in a bootstrapping function;

sending the temporary identifier to a user equipment; and

sending the temporary identifier from the user equipment to an application function when requesting for a service.

15. A method according to claim 1, comprising authentication by a generic authentication architecture in accordance with specifications of the third generation partnership project.

16. A computer program, embodied on a computer readable medium, said computer program controlling a computing system to perform the steps of:

receiving a network originated identity from a user;

associating the network originated identity with at least one non-network originated identity stored in a data storage;

receiving a non-network originated identity from the user;

comparing the non-network originated identity from the user with the at least one non-network originated identity from the data storage; and

authenticating the user if the comparison is valid.

17. An authentication apparatus for authenticating a user in a communications system, wherein the user provides a network originated identity and a non-network originated identity, the apparatus comprising:

means for receiving a network originated identity from a user;

means for associating the network originated identity with at least one non-network originated identity;

means for receiving a non-network originated identity from the user;

means for comparing the non-network originated identity from the user with the at least one non-network originated identity from the means for associating; and

means for authenticating the user if the comparison is valid.

18. An apparatus according to claim 17, wherein the means for receiving the network originated identity from the user comprises a bootstrapping function.

19. An apparatus according to claim 17, wherein the means for receiving the non-network originated identity from the user comprises a network application function.

20. An apparatus according to claim 17, wherein said comparing means is implemented in a bootstrapping function.

21. An apparatus according to claim 17, wherein said comparing means is implemented in a home subscriber server.

22. An apparatus according to claim 17, wherein said comparing means is implemented in an application specific server.

23. An apparatus according to claim 17, comprising a generic authentication architecture in accordance with the Third Generation Partnership Project (3GPP) standard.

24. An apparatus according to claim 17, comprising means for storing data regarding an association between intermediate verifiable identities and network originated identities.

25. An apparatus for providing a bootstrapping function for a user in a communications system, the apparatus being configured for comparing a non-network originated identity from the user with at least one non-network originated identity which is received from means for associating network originated identities with non-network originated identities, and for communication of authentication information if the comparison is valid.

26. A subscriber database for a communication system, the subscriber database being configured for comparing a non-network originated identity from a user with at least one non-network originated identity which is received from means for associating network originated identities with non-network originated identities, and for communicating the results of the comparison for use by an authentication function.

27. A server for providing at least a service for a user, the server being configured for comparing a non-network originated identity from the user with at least one non-network originated identity which is received from means for associating network originated identities with non-network originated identities.