Means and method for generating a unique user's identity for use between different domains

• US 20070130343A1
• Filed: 09/30/2003
• Published: 06/07/2007
• Est. Priority Date: 09/30/2003
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Pardo-Blazquez, Avelina, Walker, John, Monjas-Llorente, Miguel-Angel, de-Gregorio-Rodriguez, Jesus-Angel, Carretero Gomez, Miguel
• Application Number:
  US10/595,247
• Publication Number:
  US 20070130343A1
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 61/4547 for personal communications, i.e. using a personal identifier
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Mobile operators presently offer services on behalf of service providers where such services are really carried out for the users. Mobile operators act as identity providers in this scenario, wherein service provider and identity provider share a unique identity to identify each particular user accessing a number of services. As the number of users accessing these services, and the number of services offered from different service providers increase, the storage required at the operator'"'"'s network for such amount of user'"'"'s identities becomes a problem. To overcome this and other problems, the present invention provides an identity Generator device arranged to generate a user'"'"'s service indicator to identify the user between the service provider and the identity provider, the user'"'"'s service indicator comprising a master user'"'"'s identifier for identification of the user at the identity provider, and a service identifier indicating the services to be accessed at a given service provider.

Claims

1. An Identity Generator device arranged for generating a user'"'"'s service indicator for a user to access a number of services offered by a service provider through a network operator where user data for the user are accessible, this user'"'"'s service indicator being usable between the service provider domain and the network operator domain to unambiguously identify the user at each respective domain, the Identity Generator device comprising:

means for obtaining a master user'"'"'s identifier usable to identify the user at the operator'"'"'s network;

means for obtaining a service identifier, indicative of services to be accessed at the service provider; and

means for constructing a user'"'"'s service indicator that includes the master user'"'"'s identifier and the service identifier.

2. The Identity Generator device of claim 1, wherein the service identifier, indicative of services to be accessed at the service provider, comprises at least one element selected from:

a service provider indicator, and a number of service indicators.

3. The Identity Generator device of claim 1, further comprising:

means for obtaining at least one element selected from;

network operator identifier, auxiliary value, expiry time, and integrity code; and

means for including the at least one element into the user'"'"'s service indicator.

4. The Identity Generator device of claim 1, wherein the master user'"'"'s identifier is built up as a function of a real user identity.

5. The Identity Generator device of claim 1, further comprising means for carrying out a symmetric cipher of the user'"'"'s service indicator using a ciphering key.

6. The Identity Generator device of claim 5, wherein the ciphering key is unique for all the applicable service providers.

7. The Identity Generator device of claim 5, wherein the ciphering key is different per each service provider.

8. The Identity Generator device of claim 1, further comprising a Decomposer component having means for carrying out a reverse generation to obtain a master user'"'"'s identifier from a given user'"'"'s service indicator.

9. A Decomposer component having means for carrying out a reverse generation to obtain a master user'"'"'s identifier from a given user'"'"'s service indicator, the Decomposer component arranged for integration in, or co-operation with, at least one entity selected from:

the Identity Generator device and other entities at the identity provider domain or at the service provider domain.

10. The Decomposer component of claim 9, wherein the means for carrying out a reverse generation includes means for obtaining the service identifier used to generate the given user'"'"'s service indicator.

11. The Decomposer component of claim 9, wherein the means for carrying out a reverse generation further comprises:

means for obtaining at least one element selected from;

network operator identifier, and ciphering key used to generate the given user'"'"'s service indicator.

12. The Decomposer component of claim 9, wherein the means for carrying out a reverse generation further comprises:

means for obtaining applicable expiry time criteria; and

means for verifying the validity of a given temporary user'"'"'s service indicator against said expiry time criteria.

13. The Decomposer component of claim 9, further comprising means for verifying the validity of a given user'"'"'s service indicator by making use of the master user'"'"'s identifier as a search key towards a user directory system.

14. A method for generating a user'"'"'s service indicator intended for a user to access a number of services offered by a service provider through a network operator where user data for the user are accessible, this user'"'"'s service indicator being usable between the service provider domain and the network operator domain to unambiguously identify the user at each respective domain, the method comprising the steps of:

obtaining a master user'"'"'s identifier usable to identify the user at the operator'"'"'s network;

obtaining a service identifier, indicative of services to be accessed at the service provider, and

constructing a user'"'"'s service indicator that includes the master user'"'"'s identifier and the service identifier.

15. The method of claim 14, wherein the step of obtaining a service identifier includes obtaining at least one element selected from:

a service provider indicator, and a number of service indicators.

16. The method of claim 14, further comprising:

obtaining at least one element selected from;

network operator identifier, auxiliary value, expiry time, and integrity code; and

including the at least one element into the user'"'"'s service indicator.

17. The method of claim 14, wherein the step of obtaining a master user'"'"'s identifier includes a step of applying a function to a real user identity.

18. The method of claim 14, further comprising carrying out a symmetric cipher of the user'"'"'s service indicator using a ciphering key.

19. The method of claim 18, wherein the ciphering key is unique for all the applicable service providers.

20. The method of claim 18, wherein the ciphering key is different per each service provider.

21. The method of claim 20, further comprising determining a service provider issuing a communication based on a given user'"'"'s service indicator.

22. The method of claim 14, further comprising carrying out a reverse generation to obtain the master user'"'"'s identifier from a given user'"'"'s service indicator.

23. An Identity Generator device for generating a user'"'"'s service indicator for a user to access a number of services offered by a service provider through a network operator where user data for the user are accessible, this user'"'"'s service indicator being usable between the service provider domain and the network operator domain to unambiguously identify the user at each respective domain, the Identity Generator device comprising:

means for obtaining a master user'"'"'s identifier usable to identify the user at the operator'"'"'s network;

means for obtaining a service identifier, indicative of services to be accessed at the service provider; and

means for constructing a user'"'"'s service indicator that includes the master user'"'"'s identifier and the service identifier, wherein said Identity Generator device is integrated in, or in close cooperation with, and entity of an identity provider network.

24. The Identity Generator device use of claim 23, wherein the identity provider network is an operator'"'"'s network where the user data are accessible.

25. The Identity Generator device use of claim 24, wherein the entity is a Central Provisioning Entity responsible for provisioning tasks in the operator'"'"'s network.

26. The Identity Generator device of claim 24, wherein the entity is a User Directory System storing user data.

27. The Identity Generator device of claim 24, wherein the entity is a Border Gateway placed at the border of the operator domain.

28. The Identity Generator device of claim 27, wherein the Border Gateway is an entity selected from:

an HTTP Proxy, a WAP Gateway, and a Messaging Gateway.

29. (canceled)