Systems for protecting subscriber identification between service and content providers

• US 7,904,948 B2
• Filed: 10/10/2008
• Issued: 03/08/2011
• Est. Priority Date: 10/10/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cresp, Jacques, Livigni, Fabrice, Bazot, Philippe, Sert, Richard
• Primary Examiner(s): Patel; Nirav
• Application Number:
  US12/249,118
• Publication Number:
  US 20090094454A1
• Time in Patent Office: 879 Days
• Field of Search: 713168-170, 713181-185, 726/9, 726/10, 726/20, 726 27- 30, 726/2, 726/5, 726/6, 726/4, 380/255, 380/262, 380/268, 380/36, 380/43, 709/223, 709/225, 709/229, 705/50, 705/51
• US Class Current: 726/9
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A method and systems for protecting the identification of a subscriber when a service provider transmits a subscriber request to a content provider in a distributed network environment, such as Internet. After the user sends a request to a service provider to which he has subscribed, the service provider encrypts the user identifier before transmitting this request with the encrypted user identifier to the content provider. Upon reception, the content provider uses an authentication Web Service supplied by the service provider for certifying the user identifier. If the user identifier is certified, the content provider transmits the requested content to the service provider, which formats it before sending it to the user. The content provider may charge the user through the service provider.

Claims

1. An apparatus for protecting an identifier of a subscriber, during data transfer between a service provider and a content provider, when said subscriber sends a request to said service provider to obtain data belonging to said content provider comprising:

at least one computer for performing the following steps;

dynamically generating for each new session an encrypted token using said identifier of said subscriber, wherein a lifetime of the encrypted token is a user session lifetime, the generating using one of a symmetric and asymmetric encryption algorithm comprising;

determining a separator (S);

determining a time varying value (T);

concatenating the subscriber identifier with T in a string such that the subscriber identifier and T are separated with S;

encrypting the string with one of a symmetric and asymmetric encryption algorithm; and

,

transmitting said subscriber request and said encrypted token to said content provider;

extracting said encrypted token from said Simple Object Access Protocol (SOAP) certification request, wherein the encrypted token is in one of the SOAP body and a predefined SOAP header;

decrypting said extracted encrypted token using a decryption algorithm corresponding to the encryption algorithm;

retrieving the subscriber identifier using the separator;

checking said determined subscriber identifier; and

,

transmitting a success or failure indication to said content provider in a SOAP response to said certification request;

transmitting said data belonging to said content provider to said subscriber;

memorizing said encrypted token so that it can be reused during the user session lifetime without having to be recomputed; and

formatting said data belonging to said content provider in a format suitable and usable by the subscriber.

2. A method for enabling a computer system to protect an identifier of a subscriber, during data transfer between a service provider and a content provider, when said subscriber sends a request to said service provider to obtain data belonging to said content provider, the method comprising:

executing on at least one computer the steps including;

upon reception of said subscriber request by said service provider for each new subscriber session;

dynamically generating for each new session an encrypted token using said identifier of said subscriber, wherein a lifetime of the encrypted token is a user session lifetime, the generating using one of a symmetric and asymmetric encryption algorithm comprising;

determining a separator (S);

determining a time varying value (T);

concatenating the subscriber identifier with T in a string such that the subscriber identifier and T are separated with S;

encrypting the string with one of a symmetric and asymmetric encryption algorithm; and

,

transmitting said subscriber request and said encrypted token to said content provider;

upon reception by said service provider of a Simple Object Access Protocol (SOAP) certification request comprising an encrypted token, sent by said content provider;

extracting said encrypted token from said SOAP certification request, wherein the encrypted token is in one of the SOAP body and a predefined SOAP header;

decrypting said extracted encrypted token using a decryption algorithm corresponding to the encryption algorithm;

retrieving the subscriber identifier using the separator;

checking said determined subscriber identifier; and

,

transmitting a success or failure indication to said content provider in a SOAP response to said certification request;

upon reception of said data belonging to said content provider by said service provider, transmitting said data belonging to said content provider to said subscriber;

memorizing said encrypted token so that it can be reused during the user session lifetime without having to be recomputed; and

formatting said data belonging to said content provider in a format suitable and usable by the subscriber.