METHOD AND SYSTEM FOR SECURELY COMMUNICATING BETWEEN A USER NETWORK DEVICE, A PRIMARY SERVICE PROVIDER AND A PARTNER SERVICE PROVIDER

• US 20090161868A1
• Filed: 12/19/2007
• Published: 06/25/2009
• Est. Priority Date: 12/19/2007
• Status: Active Grant

• Current Assignee: DIRECTV, LLC (AT&T, Inc.)
• Original Assignee: The DIRECTV Group, Inc. (AT&T, Inc.)
• Inventors: Chaudhry, Kapil
• Granted Patent: US 8,453,251 B2
• Time in Patent Office: Days
• US Class Current: 380/258
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4751 for defining user accounts, e.g. accounts for children

Abstract

A system and method is set forth for communicating between a user network device, a partner service provider, a primary service provider and a user network device. The user network device initiates an account set-up page from the partner service provider, provides primary service account data in response to the account setup page and communicates the primary service account data to the primary service provider setup web service. The primary service provider validates the primary service account data and generates an encrypted token in response to validating the primary service account data. The user network device generates a request for data through a partner service provider. The partner service provider communicates the request for data with the encrypted token to the primary service provider. The primary service provider validates the request for data at the authentication web service and communicates data to the client device from a data web service through the partner service provider after validating.

Claims

1. A method comprising:

initiating an account set-up page from the partner service provider;

providing primary service account data from the user network device in response to the account setup page;

communicating the primary service account data to a primary service provider setup web service;

validating the primary service account data;

generating an encrypted token at the primary service provider in response to validating the primary service account data;

generating a request for data from a primary service provider data web service through a partner service provider from a user network device;

communicating the request for data with the encrypted token;

validating the request for data at the authentication web service; and

communicating data to the client device from the data web service after validating.

2. A method as recited in claim 1 wherein validating the primary service account data comprises validating the primary service account data at a billing web service.

3. A method as recited in claim 1 further comprising providing a partner site identifier in response to the account set up page.

4. A method as recited in claim 3 further comprising validating the partner site identifier.

5. A method as recited in claim 4 further comprising validating the partner site identifier at the set up module.

6. A method as recited in claim 5 wherein generating an encrypted token comprises generating the encrypted token at the primary service provider in response to validating the primary service account data and validating the partner site identifier.

7. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and an account phone number.

8. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and an account name.

9. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and last bill amount.

10. A method as recited in claim 1 wherein providing primary service account data comprises providing an account name, an account phone number and last bill amount.

11. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier, an account name, an account phone number and last bill amount.

12. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating the encrypted token from the primary service account data.

13. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a primary service account identifier.

14. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a primary service account identifier and a partner side identifier.

15. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a partner user identifier, a primary service account identifier and a partner side identifier.

16. A method as recited in claim 1 wherein generating and encrypted token comprises generating the encrypted token having an expiration time.

17. A method as recited in claim 1 wherein validating the request for data comprises validating the encrypted token.

18. A method comprising:

communicating a partner user identifier for a user associated with a primary service provider from a user network device to a partner service provider;

generating a request for a first encrypted token from a partner service provider including the partner user identifier;

communicating the request for the first encrypted token to an authentication web service;

authenticating the partner user identifier at the authentication web server;

generating a first encrypted token at the authentication web service;

communicating a request for primary service provider data using the first encrypted token including the partner user identifier to the primary service provider;

communicating the request for primary service provider data from a data web service of the primary service provider with the first encrypted token to the authentication web service;

validating the encrypted token at the authentication web service;

communicating a validation result to the data web service; and

communicating primary service provider data to the client device from the data web service after validating.

19. A method as recited in claim 18 wherein generating a first encrypted token comprises generating the first encrypted token having an expiration time.

20. A method as recited in claim 18 further comprising generating a second encrypted token at the authentication web service.

21. A method as recited in claim 20 wherein generating a first encrypted token comprises generating the first encrypted token having a first expiration time and wherein generating a second encrypted token comprises generating a second encrypted token in response to a second expiration time, later than the first expiration time.

22. A method as recited in claim 20 further comprising communicating the second encrypted token from the authentication web service to the partner service provider.

23. A method as recited in claim 20 further comprising communicating the second encrypted token from the partner service provider to the data web service with a second request for data.

24. A method as recited in claim 23 further comprising after communicating the second encrypted token, communicating the second encrypted token to the authentication server and authenticating the second encrypted token.

25. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token using the partner user identifier and the partner site identifier.

26. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier and the partner site identifier.

27. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, the partner site identifier and an expiration time for the first encrypted token.

28. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier and a primary service provider user account identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier and a primary service provider user account identifier.

29. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier and a primary service provider user account identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier, a primary service provider user account identifier and an expiration time for the first encrypted token.

30. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier, a primary service provider user account identifier, an account name, an account phone number and last bill amount and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier, a primary service provider user account identifier and an expiration time for the first encrypted token.

31. A method as recited in claim 18 further comprising communicating primary service provider data from the partner service provider to the client device.

32. A system comprising:

a user network device;

a partner service provider;

a primary service;

said user network device initiating an account set-up page from the partner service provider, providing primary service account data in response to the account setup page and communicating the primary service account data to the primary service provider setup web service;

said primary service provider validating the primary service account data and generating an encrypted token in response to validating the primary service account data;

said user network device generating a request for data through a partner service provider;

said partner service provider communicating the request for data with the encrypted token to the primary service provider;

said primary service provider validating the request for data at the authentication web service and communicating data to the client device from a data web service through the partner service provider after validating.

33. A system as recited in claim 32 wherein the primary service provider comprises a billing web service validating the primary service account data.

34. A system as recited in claim 32 wherein the partner service provider provides a partner site identifier in response to the account set up page.

35. A system as recited in claim 32 wherein the primary service provider validates the partner site identifier.

36. A system as recited in claim 32 wherein a set up module at the primary service provider validates the partner site identifier.

37. A system as recited in claim 36 wherein the primary service provider generates an encrypted token in response to validating the primary service account data and validating the partner site identifier.

38. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and an account phone number.

39. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and an account name.

40. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and last bill amount.

41. A system as recited in claim 32 wherein the primary service account data comprises an account name, an account phone number and last bill amount.

42. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier, an account name, an account phone number and last bill amount.

43. A system as recited in claim 32 wherein the encrypted token comprises the primary service account data.

44. A system as recited in claim 32 wherein the encrypted token comprises a primary service account identifier.

45. A system as recited in claim 32 wherein the encrypted token comprises a primary service account identifier and a partner side identifier.

46. A system as recited in claim 32 wherein the encrypted token comprises a partner user identifier, a primary service account identifier and a partner side identifier.

47. A system as recited in claim 32 wherein the encrypted token comprises an expiration time.

48. A system as recited in claim 32 wherein the primary service provider validates the request for data by validating the encrypted token.