SYSTEM FOR THE DEFINITION AND APPLICATION OF SECURELY ACCESSIBLE GEOGRAPHICAL AREAS

• US 20120270521A1
• Filed: 08/12/2010
• Published: 10/25/2012
• Est. Priority Date: 09/11/2009
• Status: Abandoned Application

• Current Assignee: Telefonica SA
• Original Assignee: Telefonica SA
• Inventors: Garcia Garcia, Laura, Lopez Garcia, Jose Enrique, Bravo Fernandez, Maria del Rocio, Martin Garzon, Oscar, Munoz Organero, Pedro Luis
• Application Number:
  US13/395,350
• Publication Number:
  US 20120270521A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

The present invention relate to a method and a system applicable to telecommunications systems, providing an additional guaranteeing factor of the identity provided by a user when

• • he/she accesses a service provider based on the coincidence of the location of the user when the latter is carrying a device
  • susceptible to being located 10 by means of GSM, GPRS, UMTS, WIFI and GPS technologies, with at least one zone of reliable access
  • associated with said user.

Claims

1. Method of authentication by means of geographic zones of reliable access which comprises performing the following steps in an authentication module:

i) sending a request for verification of a user with identifier ID associated therewith to a location module, said location module returning a response to the authentication module made up of at least one location Boolean parameter and a security level associated with said location Boolean parameter, where the location Boolean parameter represents the location of the user with identifier ID with respect to at least one geographic zone of reliable access associated with said user with identifier ID, and where the security level represents the reliability of the location Boolean parameter;

ii) analyzing the at least one location Boolean parameter and the security level associated with said location Boolean parameter to establish a value of an authentication Boolean parameter, said value of the authentication Boolean parameter being “

true”

when the user with identifier ID is authenticated, and “

false”

when the user with identifier ID is not authenticated.

2. Method of authentication by means of geographic zones of reliable access according to claim 1, characterized in that step ii) additionally comprises:

checking the communication between the authentication module and the location module;

setting the value of the authentication Boolean parameter to “

false”

when at least one option selected from the location Boolean parameter being “

false” and

the existence of an error in the communication between the authentication module and the location module is met;

extracting the value of the security level associated with the location Boolean parameter from the response of the location module when the value of the location Boolean parameter is “

true” and

no error has occurred in the communication between the authentication module and the location module, and applying a predetermined security criterion, establishing the value of the authentication Boolean parameter; and

,

adding attributes to the user with identifier ID when the value of the authentication Boolean parameter is “

true”

.

3. Method of authentication according to claim 1, characterized in that step

i) additionally comprises:

a) receiving the request for verification of user with identifier ID to the location module from the authentication module;

b) obtaining data of the user with identifier ID by means of a query in a database contained in the location module;

c) obtaining, from the data of the user, the number of geographic zones of reliable access associated with said user with identifier ID registered in the database contained in the location module;

d) setting the value of the location Boolean parameter to “

false”

when the number of geographic zones of reliable access associated with said user with identifier ID is zero;

e) extracting all the reliable geographic zones associated with the user with identifier ID from the database located in the location module when the obtained number of geographic zones of reliable access associated with said user with identifier ID is greater than zero;

f) obtaining the location of the user with identifier ID, sending a request for a specific location solution which returns location data selected from a location zone and a location point associated with its error when the obtained number of geographic zones of reliable access associated with said user with identifier ID is greater than zero;

g) treating the location data obtained from the specific location solution to adapt it to the suitable format when the obtained number of geographic zones of reliable access associated with said user with identifier ID is greater than zero;

h) executing at least one predetermined verification algorithm the result of which comprises the at least one location Boolean parameter associated with its security level and at least one alphanumeric location code when the obtained number of geographic zones of reliable access associated with said user with identifier ID is greater than zero; and

,

i) sending the at least one location Boolean parameter associated with its security level and, optionally, the at least one alphanumeric location code to the authentication module.

4. Method of authentication by means of geographic zones of reliable access according to claim 3, characterized in that the at least one predetermined verification algorithm comprises:

calculating, by means of at least one mathematical location algorithm, at least one of the following parameters;

the distance between the location point associated with its error of the user with identifier ID and the central point of the geographic zone of reliable access associated with the user with identifier ID and comparing said distance with a predetermined threshold;

the cutoff points between the location zone of the user with identifier ID and the geographic zone of reliable access associated with the user with identifier ID;

assigning the value “

true”

to the location Boolean parameter and the value “

HIGH”

to the security level associated with the location Boolean parameter when the distance between the location point associated with its error of the user with identifier ID and the central point of the geographic zone of reliable access associated with the user with identifier ID is less than the predetermined threshold;

assigning the value “

true”

to the location Boolean parameter and the value “

LOW”

to the security level associated with the location Boolean parameter when there is at least one cutoff point between the location zone of the user with identifier ID and the geographic zone of reliable access associated with the user with identifier ID;

assigning the value “

false”

to the location Boolean parameter when the distance between the location point associated with its error of the user with identifier ID and the central point of the geographic zone of reliable access associated with the user with identifier ID is at least equal to the predetermined threshold;

assigning the value “

false”

to the location Boolean parameter when there is no cutoff point between the location zone of the user with identifier ID and the geographic zone of reliable access associated with the user with identifier ID;

assigning the value “

false”

to the location Boolean parameter and the value “

LOW”

to the security level associated when the user with identifier ID does not have any geographic zone of reliable access associated with the user with identifier ID.

5. Method of authentication by means of geographic zones of reliable access according to claim 3, characterized in that the at least one geographic zone of reliable access associated with the user with identifier ID and contained in the database defined in step b) is managed by a geographic zone management module by means of an option selected from registration or enlisting, modification and cancellation, and by means of a type of architecture selected from user-centric architecture and service provider-centric architecture, there being in both cases the user with identifier ID and a user administrator responsible for managing the data contained in the database;

in the case of user-centric architecture, user with identifier ID and user administrator coincide;

in the case of service provider-centric architecture, user with identifier ID and user administrator are different.

6. Method of authentication by means of geographic zones of reliable access according to claim 5, characterized in that step b) additionally comprises, for managing the at least one geographic zone of reliable access associated with the user with identifier ID according to the architecture selected from user-centric architecture and service provider-centric architecture, the following steps for managing modification and cancellation:

the user administrator selecting the option of consulting the geographic zones of reliable access associated with the user with identifier ID in a menu;

consulting the geographic zones of reliable access associated with said user with identifier ID stored in the database;

checking the number of geographic zones of reliable access associated with said user with identifier ID;

showing an error message when the number of geographic zones of reliable access associated with said user with identifier ID is zero;

showing a message with all the geographic zones of reliable access associated with said user with identifier ID when the number of geographic zones of reliable access associated with said user with identifier ID is greater than zero;

asking the user administrator if he/she wants to examine the characteristics of at least one of the geographic zones of reliable access associated with said user with identifier ID;

returning to the previous step if the desire of the user administrator is negative;

showing the characteristics of the at least one geographic zone of reliable access associated with said user with identifier ID and desired by same, by means of a form which allows modifications;

asking the user administrator if he/she wants to eliminate the at least one geographic zone of reliable access associated with said user with identifier ID;

updating the database eliminating the at least one geographic zone of reliable access associated with said user with identifier ID when the desire of the user administrator is affirmative;

checking if the user administrator wants to modify the at least one geographic zone of reliable access associated with said user with identifier ID when the desire of the user administrator is negative;

checking if the modifications of the at least one geographic zone of reliable access associated with said user with identifier ID are valid when the user administrator wants to modify the at least one geographic zone of reliable access associated with said user with identifier ID;

updating the database with the changes made in at least one attribute of the at least one geographic zone of reliable access associated with said user with identifier ID when the user administrator wants to modify the at least one geographic zone of reliable access associated with said user with identifier ID;

showing the final result of managing the modification or cancellation, including an error message when the modifications of the at least one geographic zone of reliable access associated with said user with identifier ID are not valid.

7. Method of authentication by means of geographic zones of reliable access according to claim 5, characterized in that step b) additionally comprises, for managing the at least one geographic zone of reliable access associated with the user with identifier ID according to the architecture selected from user-centric architecture and service provider-centric architecture, the following steps for managing registration or enlisting:

sending a user location request to the location module for the user with identifier ID;

consulting the number of geographic zones of reliable access associated with the user with identifier ID;

checking if the position of the user with identifier ID coincides with at least one of the geographic zones of reliable access associated with the user with identifier ID;

showing an error message to the user administrator when the position of the user with identifier ID coincides with at least one of the geographic zones of reliable access associated with the user with identifier ID;

showing geographic characteristics of the current location of the user with identifier ID which are registered in the database as geographic attributes of the at least one geographic zone of reliable access associated with the user with identifier ID to the user administrator when the user with identifier ID has no geographic zone of reliable access associated with the user with identifier ID registered in the database or when the current position of the user does not coincide with any of the geographic zones of reliable access associated with the user with identifier ID registered in the database;

the user administrator adding complementary attributes of the at least one geographic zone of reliable access associated with the user with identifier ID;

creating the at least one geographic zone of reliable access associated with the user with identifier ID and requesting confirmation of said creation from the user administrator;

storing the at least one geographic zone of reliable access associated with the user with identifier ID in the database;

showing an information message of the enlisting or registration to the user administrator.

8. System of authentication by means of geographic zones of reliable access comprising at least:

a geographic zone management module;

a authentication module; and

,

a location module.

9. System of authentication by means of geographic zones of reliable access according to claim 8, characterized in that:

the geographic zone management module comprising at least;

a graphic interface comprising at least;

means of displaying at least one geographic zone of reliable access;

means of displaying and capturing information;

means of treating location data;

means of managing the enlisting or registration, modification and cancellation of the at least one geographic zone of reliable access;

the authentication module comprising at least;

means of connecting and exchanging data with at least one standard authentication means;

means compatible with the at least one standard authentication means for integration thereof in said at least standard authentication means;

means of connecting and exchanging data with at least one service provider;

the location module comprising at least;

means of executing at least one mathematical location algorithm;

a database;

means of connecting and exchanging data with at least one specific location means;

means of connecting and exchanging data with at least the geographic zone management module and the authentication module;

a graphic administration interface.

10. System of authentication by means of geographic zones of reliable access according to claim 9, characterized in that the specific location means locates a user with identifier ID by means of at least one of the options selected from GSM, GPS, WiFi, GPRS and UMTS.

11. System of authentication by means of geographic zones of reliable access according to claim 10, characterized in that the specific location means define the location of the user with identifier ID by means of at least one option selected from a location zone and a location point associated with an error.

12. System of authentication by means of geographic zones of reliable access according to claim 9, characterized in that the at least one mathematical location algorithm is selected from Pythagoras, Haversine and spherical trigonometry.