Method and arrangement for authentication procedures in a communication network

• US 7,865,173 B2
• Filed: 12/22/2006
• Issued: 01/04/2011
• Est. Priority Date: 07/10/2006
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Barriga, Luis, Fernandez-Alonso, Susana
• Primary Examiner(s): Patel; Ajit
• Application Number:
  US11/615,362
• Publication Number:
  US 20080009265A1
• Time in Patent Office: 1,474 Days
• Field of Search: 455/441
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The present invention is related to an authentication method and arrangements in a communication system including a Subscriber (50) with a terminal (51), an Operator Node (52) and a Service Provider Node (53), which authentication method is based on an SLA agreement between the Operator (OP) and the Service Provider (SP). The method includes that the Subscriber (50) with terminal (51) performs (5) strong authentication with the Operator Node (52) acting as Registration Authority OP(RA). After the strong authentication is performed by the Operator Node (52) a Mobile Strong Authentication Assertion MSAA is generated (6) and transmitted to the Service Provider Node (53) for validation. By this method the authentication is being delegated from the Service Provider to the Mobile Operator.

Claims

1. An authentication method in a communication system including a Subscriber with a terminal, an Operator Node and a Service Provider Node, which authentication method is based on an SLA agreement between the Operator and the Service Provider, the method comprising the following steps:

sending a service request to the Service Provider Node from the terminal, the request includes the Operator Node identity;

checking in the Service Provider Node that the Operator node identity relates to an Operator having an SLA agreement with the Service Provider and

if there is an SLA agreement then sending the Service Provider node Identity to the terminal and

sending a Request for strong authentication from the terminal to the Operator Node, the request includes the Service Provider Node Identity;

the Subscriber with terminal performing strong authentication with the Operator Node acting as Registration Authority;

generating by the Operator Node a Mobile Strong Authentication Assertion MSAA;

transmitting the generated MSAA to the Service Provider Node; and

validating in the Service Provider node the MSAA.

2. The authentication method according to claim 1 further comprising the following steps prior to the performing step:

sending a propose to subscribe for a service from the Operator Node to the terminal; and

sending accept information on the propose from the terminal to the Operator Node.

3. The authentication method according to claim 1 further comprising in that the transmitting of the generated MSAA to the Service Provider Node is done via the terminal.

4. The authentication method according to claim 1 further comprising in that the strong authentication is performed in accordance with the authentication context according to the SLA agreement with the Service Provider.

5. The authentication method according to claim 1 further comprising the following steps if the MSAA is valid then

registering in the Service Provider Node the subscriber;

and

delivering the service from the Service Provider Node to the terminal of the subscriber.

6. The authentication method according to claim 5 further comprising that the registering is followed by

generating in the Service Provider Node a user certificate which user certificate is being transmitted to the terminal and stored in the terminal.

7. An authentication method in an Operator Node within a communication system including a subscriber having a trust relation with the operator and a Service Provider Node, which authentication method is based on an SLA agreement between the Operator OP and the Service Provider, the method comprising the following steps:

receiving a Request for authentication, the request includes the Service Provider Node Identity;

checking what authentication context is used for the received Service Provider Node;

performing authentication in accordance with the authentication context for the received Service Provider Node;

generating a Mobile Strong Authentication Assertion MSAA and

transmitting the generated MSAA to the Service Provider node, whereby the Operator Node is acting as Registration Authority for the Service Provider.

8. An authentication method in a Service Provider Node within a communication system including also a subscriber with a terminal and an Operator Node, the method is based on an SLA agreement with the Operator comprising the following steps:

receiving a service request from the terminal, the request includes the Operator Node identity;

checking in the Service Provider node that the Operator node identity relates to an operator having an agreement with the Service Provider;

if there is an agreement then;

sending information to the terminal about the Service Provider;

receiving an MSAA generated by the Operator;

validating of the received MSAA;

registering the user; and

delivering the service to the terminal.

9. An authentication method in a Service Provider Node according to claim 8 further comprising that the service is a certificate and the registering of the user is followed by generation of a user certificate which is delivered to the terminal.

10. An authentication method in a Service Provider Node according to claim 8 further comprising that the service is a subscription.