METHOD AND APPARATUS FOR SUBSCRIPTION SHARING

• US 20130247161A1
• Filed: 03/19/2012
• Published: 09/19/2013
• Est. Priority Date: 03/19/2012
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Bajko, Gabor
• Granted Patent: US 9,338,159 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing
• CPC Class Codes: H04W 8/20 Transfer of user or subscriber data
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method, apparatus and computer program product are provided for enabling multiple mobile terminals to access a subscription service. The method may further include causing a client certificate to be issued to the first mobile terminal as a result of the certificate enrollment procedure. In some example embodiments, the client certificate comprises a subscription identifier and a flag indicating whether the client certificate is to be sharable with a second mobile terminal. The method may further include causing a certificate enrollment procedure to be initiated by a second mobile terminal with the first mobile terminal in an instance in which the first mobile terminal possesses one or more credentials that are configured to be shared with another mobile terminal. The method may further include the second mobile terminal receiving at least one credential in the form of a client certificate from the first mobile terminal.

Claims

1. A method comprising:

determining whether a first mobile terminal possesses one or more credentials that are configured to be shared with another mobile terminal, wherein the credentials comprise a subscription identifier issued by a server and the credentials are configured to grant access to one or more wireless network subscription services;

causing a certificate enrollment procedure to be initiated with the first mobile terminal in an instance in which the first mobile terminal possesses one or more credentials that are configured to be shared with another mobile terminal; and

receiving at least one credential in the form of a client certificate from the first mobile terminal, wherein the client certificate is signed by the first mobile terminal and comprises the subscription identifier.

2. A method according to claim 1, wherein the first mobile terminal is configured to initiate a subscription purchase procedure with the server such that the first mobile terminal enrolls in a certificate creation process.

3. A method according to claim 2, wherein the certificate creation process further comprises receiving a client certificate from the server, the client certificate comprising the subscription identifier and a flag indicating whether the server enables the client certificate to be shared with another mobile terminal and wherein the subscription identifier is a WiFiSubscriptionID.

4. A method according to claim 1 further comprising causing a message to be transmitted to the first mobile terminal, wherein the message is a Hypertext Transfer Protocol (HTTP) GET message that comprises a predefined uniform resource identifier.

5. A method according to claim 1, wherein the client certificate from the first mobile terminal enables access a subscription to the one or more wireless network subscription services belonging to the first mobile terminal.

6. An apparatus comprising:

at least one processor; and

at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least;

determine whether a first mobile terminal possesses one or more credentials that are configured to be shared with another mobile terminal, wherein the credentials comprise a subscription identifier issued by a server and are configured to grant access to one or more wireless network subscription services;

cause a certificate enrollment procedure to be initiated with the first mobile terminal in an instance in which the first mobile terminal possesses one or more credentials that are configured to be shared with another mobile terminal; and

receive at least one credential of the one or more credentials in the form of a client certificate from the first mobile terminal, wherein the client certificate is signed by the first mobile terminal and comprises a subscription identifier.

7. An apparatus according to claim 6, wherein the first mobile terminal is configured to initiate a subscription purchase procedure with the server such that the first mobile terminal enrolls in a certificate creation process.

8. An apparatus according to claim 7, wherein the certificate creation process further comprises receiving a client certificate from the server, the client certificate comprising the subscription identifier and a flag indicating whether the server enables the client certificate to be shared with another mobile terminal and wherein the subscription identifier is a WiFiSubscriptionID.

9. An apparatus according to claim 6 wherein the at least one memory including the computer program code is further configured to, with the at least one processor, cause the apparatus to cause a message to be transmitted to the first mobile terminal, wherein the message is a Hypertext Transfer Protocol (HTTP) GET message that comprises a predefined uniform resource identifier.

10. An apparatus according to claim 6, wherein the client certificate from the first mobile terminal enables access a subscription to the one or more wireless network subscription services belonging to the first mobile terminal.

11. A method comprising:

receiving a certificate enrollment procedure request from a first mobile terminal; and

causing a client certificate to be issued to the first mobile terminal as a result of the certificate enrollment procedure, wherein the client certificate comprises a subscription identifier and a flag indicating whether the client certificate is sharable with at least a second mobile terminal.

12. A method according to claim 11, further comprising:

receiving an authentication request for access to a wireless network subscription service from a second mobile terminal;

determining whether the authentication request comprises a client certificate having the subscription identifier belonging to that first mobile terminal that was previously issued and comprises a flag indicating that the client certificate is sharable with the second mobile terminal; and

causing the second mobile terminal to be authenticated on the wireless network subscription service based on the client certificate issued by the first mobile terminal containing the subscription identifier.

13. A method according to claim 12, further comprising:

causing the subscription identifier of the first mobile terminal to be authenticated by confirming a public key of the first mobile terminal in the client certificate.

14. A method according to claim 12 wherein the first mobile terminal is configured to operate as a certificate authority, wherein the second mobile terminal is authenticated based on credentials issued by the first mobile terminal.

15. A method according to claim 12, further comprising authenticating a second mobile terminal in an instance in which a subscription identifier in the client certificate is the same as the subscription identifier in a client certificate issued to the first mobile terminal, wherein the subscription identifier is a WiFiSubscriptionID.

16. A method according to claim 12, further comprising:

causing a challenge to be transmitted to the second mobile terminal, wherein the challenge is signed by a private key of the second mobile terminal; and

determining whether a public key of the second mobile terminal that is signed by a private key of the first mobile terminal is verified based on the challenge.

17. A method according to claim 12, further comprising:

causing the client certificate of the first mobile terminal to be revoked such that the client certificate issued to the second mobile terminal is revoked.

18. A method according to claim 12, further comprising:

determining data usage of the first mobile terminal based on data usage of the first mobile terminal and the second mobile terminal.

19. A method according to claim 12, wherein the authentication request is Hotspot 2.0 authentication request.

20. A method according to claim 12, wherein the second mobile terminal is authenticated on the wireless network subscription service based on a subscription of the first mobile terminal.