AUTOMATED NEGOTIATION AND SELECTION OF AUTHENTICATION PROTOCOLS

• US 20130174241A1
• Filed: 06/28/2012
• Published: 07/04/2013
• Est. Priority Date: 06/28/2011
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Inventors: Leicher, Andreas, Schmidt, Andreas, Guccione, Louis J., Shah, Yogendra C., Targali, Yousif, Cha, Inhyok
• Granted Patent: US 8,914,636 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Wireless telecommunications networks may implement various forms of authentication. There are a variety of different user and device authentication protocols that follow a similar network architecture, involving various network entities such as a user equipment (UE), a service provider (SP), and an authentication endpoint (AEP). To select an acceptable authentication protocol or credential for authenticating a user or UE, authentication protocol negotiations may take place between various network entities. For example, negotiations may take place in networks implementing a single-sign on (SSO) architecture and/or networks implementing a Generic Bootstrapping Architecture (GBA).

Claims

1. In a system comprising a user equipment (UE), a service provider (SP), and an authentication end point (AEP) which communicate via a network, a method of authenticating the UE by the AEP, comprising, at the AEP:

determining one or more authentication protocols or credentials that may be used to authenticate the UE;

negotiating with the UE to select one of the authentication protocols or credentials that are acceptable to the SP; and

authenticating the UE using the selected authentication protocol or credentials.

2. The method recited in claim 1, further comprising:

determining one or more authentication protocols or credentials and that are acceptable to the SP, wherein determining the one or protocols or credentials acceptable to the SP comprises negotiating with the SP to determine the acceptable protocols or credentials.

3. The method recited in claim 2, wherein determining one or more authentication protocols or credentials acceptable to the SP comprises:

receiving one or more characteristics from the SP; and

determining the acceptable protocols or credentials that comprise the one or more characteristics.

4. The method recited in claim 2, wherein determining one or more authentication protocols or credentials acceptable to the SP comprises retrieving the acceptable protocols or credentials from a database accessible to the AEP that stores information concerning acceptable protocols or credentials for one or more service providers.

5. The method recited in claim 1, further comprising:

receiving from the UE an identification of one or more authentication protocols or credentials supported by the UE.

6. The method recited in claim 1, wherein the network implements an OpenID federated identity management architecture, and wherein the SP comprises a Relying Party (RP) and the AEP comprises an Identity Provider (IdP) within the federated identity management architecture.

7. The method recited in claim 1, wherein the network implements a Generic Bootstrapping Architecture (GBA), and wherein the SP comprises a Network Access Function (NAF) and the AEP comprises a Bootstrapping Server Function (BSF).

8. The method recited in claim 7, the method further comprising, at the BSF:

receiving, from the UE, a request to run a GBA digest protocol; and

in response to the request, requesting and retrieving an authentication vector from a policy server.

9. The method recited in claim 8, wherein the NAF comprises a policy indicating whether to accept subscribers using SIP Digest credentials.

10. The method recited in claim 1, wherein the network implements a Generic Bootstrapping Architecture (GBA) and an OpenID federated identity management architecture, and wherein the AEP comprises a Network Access Function (NAF) and an Identity Provider (IdP).

11. In a system comprising a user equipment (UE), a service provider (SP), and an authentication end point (AEP) which communicate via a network, a method of authenticating the UE by an AEP, comprising, at the SP:

receiving a request from the UE to access a service provided by the SP;

determining one or more authentication protocols or credentials to be used to authenticate the UE;

providing, to the AEP, information concerning the authentication protocols or credentials acceptable to the SP;

receiving from the UE a signed assertion message indicating authentication of the UE in accordance with a selected authentication protocol or credentials.

12. In a system comprising an user equipment (UE), a service provider (SP), and an authentication end point (AEP) which communicate via a network, a method of authenticating the UE, comprising, at the UE:

sending a request to the SP for access to a service provided by the SP;

negotiating with the AEP to select one of a plurality of authentication protocols or credentials that are acceptable to the SP and that are supported by the UE; and

receiving from the AEP an indication of the result of authentication of the UE in accordance with the selected authentication protocol or credentials.

13. The method recited in claim 12, wherein the indication comprises a signed assertion message comprising the result of authentication of the UE in accordance with the selected authentication protocol or credentials, the method further comprising:

forwarding, by the UE, the signed assertion message to the SP.

14. The method recited in claim 12, wherein the indication from the AEP comprises a key that results from an authentication of the UE in accordance with the selected authentication protocol and/or credentials.

15. The method recited in claim 12, wherein the network implements a Generic Bootstrapping Architecture (GBA), and wherein the SP comprises a Network Access Function (NAF) and the AEP comprises a Bootstrapping Server Function (BSF).

16. The method recited in claim 12, wherein the network implements a Generic Bootstrapping Architecture (GBA) and an OpenID federated identity management architecture, and wherein the AEP comprises a Network Access Function (NAF) and an Identity Provider (IdP).

17. The method recited in claim 15, further comprising:

receiving, via the NAF, a bootstrapping initiation message comprising a realm attribute to trigger the UE to run a bootstrapping protocol using the selected authentication protocol and/or credentials.

18. The method recited in claim 15, further comprising, at the UE:

providing an indication to the NAF that one or more GBA authentication protocols are supported by the UE; and

receiving an indication, from the NAF, that one of the one or more GBA authentication protocols are acceptable, wherein the acceptable GBA authentication protocol comprises a SIP Digest-based GBA security association.

19. The method recited in claim 17, further comprising:

if none of the one more GBA authentication protocols that are supported by the UE are acceptable to the NAF, receiving, at the UE, an error message, thereby terminating GBA bootstrapping.

20. The method of claim 18, wherein the request for access to a service comprises a product token in a user agent header, wherein the product token indicates that the UE requests the use of a GBA Digest protocol.

21. The method of claim 20, wherein, in response to the request for access,

receiving a code 401 response, wherein the code 401 response comprises a prefix in a header, wherein the prefix indicates that the UE is allowed to perform the GBA Digest protocol.