METHOD AND SYSTEM FOR USER AUTHENTICATION BY MEANS OF A CELLULAR MOBILE RADIO NETWORK

• US 20120157052A1
• Filed: 09/08/2010
• Published: 06/21/2012
• Est. Priority Date: 09/08/2009
• Status: Active Grant

• Current Assignee: Deutsche Telekom AG
• Original Assignee: Deutsche Telekom AG
• Inventors: Quade, Michael
• Granted Patent: US 8,526,912 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B

Abstract

The invention relates to a method and system for authentication of a user (11) at an access device by means of a cellular mobile radio network (17). The access device gives access to a facility or a service different from the mobile radio network (17). The cellular mobile radio network (17) comprises a base station (12) defining a mobile radio cell (16) with a unique identifier. A mobile radio terminal (14) having a unique identifier books into the mobile radio network (17) via said base station (12), and the authentication is carried out by means of the identifier of the mobile radio cell (16) and the identifier of the mobile radio terminal (14). The base station (12) is arranged at the location of the access device so that the access device has its own mobile radio cell (16) serviced by the base station (12), this mobile radio cell (16) defining an authentication cell (16) of the mobile radio network (17). The mobile radio terminal (14) is caused to book into the mobile radio network (17) via said base station (12) of said authentication cell (16) for the purpose of authentication at the access device whereupon the identifiers are sent to an authentication entity (18) that checks whether the user (11) is permitted to get access at the access device. Access is granted or denied depending on the permission of the user (11).

Claims

1. A method for authentication of a user at an access device by means of a cellular mobile radio network comprising a base station defining a mobile radio cell with a unique identifier, the method comprising the steps of:

giving access via an access device to a facility or a service different from the mobile radio network,

booking a mobile radio terminal having a unique identifier into the mobile radio network via said base station,

carrying out an authentication by means of the identifier of the mobile radio cell and the identifier of the mobile radio terminal,

providing the base station at the location of the access device so that the access device has its own mobile radio cell serviced by the base station,

defining with this mobile radio cell an authentication cell of the mobile radio network,

booking the mobile radio terminal into the mobile radio network via said base station of said authentication cell for the purpose of authentication at the access device and then sending the identifiers are sent to an authentication entity that checks whether the user is permitted to get access at the access device,

granting or denying access depending on the permission of the user,

requesting the user to make a user input or provide identification data that are contactlessly transmitted to the access or another device, and

for authentication verifying the user input or identification data.

2. The method according to claim 1, wherein the mobile radio terminal books into the mobile radio network immediately when it enters the geographic coverage area of the authentication cell.

3. The method according to claim 1, wherein the mobile radio terminal books into the mobile radio network after an authentication process is initiated and the base station broadcasts a certain signal for authentication.

4. The method according to claim 1, wherein the base station is activated after an authentication process is initiated.

5. The method according to claim 1, wherein the user is identified by the identifier of the mobile terminal and the access device is identified by the identifier of the authentication cell on the basis of its assignment to each other.

6. The method according to claim 1, wherein after permission of the user is checked a positive or negative feedback message is generated and submitted to the access device, in particular via the authentication cell.

9. The method according to claim 1, wherein the user input or identification data is contactlessly transmitted to the access device or another device, in particular by means of RFID.

10. The method according to claim 1, wherein a positive performed authentication approves the access to an automatic teller machine, a door, a room, a safety gate, a vehicle, a terminal, computer system, an application on a computer, or a government agency, or services of a government agency.

11. The method according to claim 1, wherein the base station broadcasts a special neutral mobile radio network operator identification.

12. The method according to claim 11, wherein the base station broadcasts several of the mobile radio network operator identifications.

19. An access device giving access to a facility or a service different from the mobile radio network the device comprising its own base station defining a mobile radio cell of a cellular mobile radio network with a unique identifier, the access device being arranged to carry out the method for authentication of a user according to claim 1.

7-8. -8. (canceled)

13. A system for authentication of a user at an access device by means of a cellular mobile radio network, comprising an access device and a cellular mobile radio network, the access device giving access to a facility or a service different from the mobile radio network, the cellular mobile radio network comprising a base station defining a mobile radio cell with a unique identifier, the system further comprising a mobile radio terminal having a unique identifier and being able to book into the mobile radio to network via said base station, the system being able to carry out the authentication by means of the identifier of the mobile radio cell and the identifier of the mobile radio terminal, wherein the base station is arranged at the location of the access device so that the access device has its own mobile radio cell serviced by the base station, this mobile radio cell defining an authentication cell of the mobile radio network, and that the system is arranged to cause the mobile radio terminal to book into the mobile radio network via said base station of said authentication cell for the purpose of authentication at the access device, the system further comprising an authentication entity for receiving the identifiers and checking whether the user is permitted to get access at the access device and a receiving device for receiving a user input or for recording identification data of a user, the receiving device serving to contactlessly transmit the user input or the identification data to the access device or another device for further authentication.

14. The system according to claim 13, wherein the base station of the authentication cell is arranged within an electromagnetically encapsulated area.

15. The system according to claim 13, wherein the authentication cell is a pico-cell or femto-cell being spatially much smaller than an ordinary macro-cell of a cellular mobile radio network.

16. The system according to claim 13, wherein the base station of the authentication cell is connected to the mobile radio network via a cable connection or as repeater or via radio communication.

17. The system according to claim 13, wherein the identification data are biometric data of the user, the receiving device being arranged to transmit the user input or the identification data to the access device or to the other device by means of RFID.

18. The System according to claim 13, wherein the access device is integral part of an automatic teller machine, an admission control at an entrance or a door, a safety gate, a vehicle, a computer system, an application on a computer, or a government agency.