Method and system for securely communicating between a user network device, a primary service provider and a partner service provider

• US 8,453,251 B2
• Filed: 12/19/2007
• Issued: 05/28/2013
• Est. Priority Date: 12/19/2007
• Status: Active Grant

• Current Assignee: DIRECTV, LLC (AT&T, Inc.)
• Original Assignee: The DIRECTV Group, Inc. (AT&T, Inc.)
• Inventors: Chaudhry, Kapil
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Tolentino, Roderick
• Application Number:
  US11/960,526
• Publication Number:
  US 20090161868A1
• Time in Patent Office: 1,987 Days
• Field of Search: 726 1- 33, 380243-246, 700225-227, 713/187, 705 57- 58, 711/164
• US Class Current: 726/27
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4627 Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4751 for defining user accounts, e.g. accounts for children

Abstract

A system and method is set forth for communicating between a user network device, a partner service provider, a primary service provider and a user network device. The user network device initiates an account set-up page from the partner service provider, provides primary service account data in response to the account setup page and communicates the primary service account data to the primary service provider setup web service. The primary service provider validates the primary service account data and generates an encrypted token in response to validating the primary service account data. The user network device generates a request for data through a partner service provider. The partner service provider communicates the request for data with the encrypted token to the primary service provider. The primary service provider validates the request for data at the authentication web service and communicates data to the client device from a data web service through the partner service provider after validating.

Claims

1. A method comprising:

initiating an account setup page from a partner service provider;

providing primary service account data from a user network device to the partner service provider in response to the account setup page;

communicating the primary service account data from the partner service provider to a primary service provider setup web service;

validating the primary service account data at the primary service provider setup web service;

generating an encrypted token at the primary service provider in response to validating the primary service account data;

communicating the encrypted token to the partner service provider;

generating a request for data at the user network device and communicating the request for data to the partner service provider;

communicating the request for data with the encrypted token from the partner service provider to the primary service provider;

validating the request for data at an authentication web service using the encrypted token; and

communicating data to the user network device from a data web service associated with the primary service provider after validating.

2. A method as recited in claim 1 wherein validating the primary service account data comprises validating the primary service account data at a billing web service.

3. A method as recited in claim 1 further comprising providing a partner site identifier in response to the account set up page.

4. A method as recited in claim 3 further comprising validating the partner site identifier.

5. A method as recited in claim 4 further comprising validating the partner site identifier at the set up web service.

6. A method as recited in claim 5 wherein generating an encrypted token comprises generating the encrypted token at the primary service provider in response to validating the primary service account data and validating the partner site identifier.

7. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and an account phone number.

8. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and an account name.

9. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier and last bill amount.

10. A method as recited in claim 1 wherein providing primary service account data comprises providing an account name, an account phone number and last bill amount.

11. A method as recited in claim 1 wherein providing primary service account data comprises providing a primary service provider user account identifier, an account name, an account phone number and last bill amount.

12. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating the encrypted token from the primary service account data.

13. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a primary service account identifier.

14. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a primary service account identifier and a partner side identifier.

15. A method as recited in claim 1 wherein generating an encrypted token at the primary service provider comprises generating an encrypted token from a partner user identifier, a primary service account identifier and a partner side identifier.

16. A method as recited in claim 1 wherein generating and encrypted token comprises generating the encrypted token having an expiration time.

17. A method as recited in claim 1 wherein validating the request for data comprises validating the encrypted token.

18. A method comprising:

communicating a partner user identifier for a user associated with a primary service provider from a user network device to a partner service provider;

generating a request for a first encrypted token from a partner service provider including the partner user identifier;

communicating the request for the first encrypted token to an authentication web service;

authenticating the partner user identifier at the authentication web service;

generating a first encrypted token at the authentication web service;

communicating the first encrypted token from authentication web service provider to the user network device or partner service provider;

communicating a request for primary service provider data using the first encrypted token including the partner user identifier from the network device or the partner service provider to the primary service provider;

communicating the request for primary service provider data from a data web service of the primary service provider with the first encrypted token to the authentication web service;

validating the encrypted token at the authentication web service;

communicating a validation result to the data web service; and

communicating primary service provider data to the user network device from the data web service after validating.

19. A method as recited in claim 18 wherein generating a first encrypted token comprises generating the first encrypted token having an expiration time.

20. A method as recited in claim 18 further comprising generating a second encrypted token at the authentication web service.

21. A method as recited in claim 20 wherein generating a first encrypted token comprises generating the first encrypted token having a first expiration time and wherein generating a second encrypted token comprises generating a second encrypted token in response to a second expiration time, later than the first expiration time.

22. A method as recited in claim 20 further comprising communicating the second encrypted token from the authentication web service to the partner service provider.

23. A method as recited in claim 20 further comprising communicating the second encrypted token from the partner service provider to the data web service with a second request for data.

24. A method as recited in claim 23 further comprising after communicating the second encrypted token, communicating the second encrypted token to the authentication web server and authenticating the second encrypted token.

25. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token using the partner user identifier and the partner site identifier.

26. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier and the partner site identifier.

27. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier and a partner site identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, the partner site identifier and an expiration time for the first encrypted token.

28. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier and a primary service provider user account identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier and a primary service provider user account identifier.

29. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier and a primary service provider user account identifier and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier, a primary service provider user account identifier and an expiration time for the first encrypted token.

30. A method as recited in claim 18 wherein generating a request for a first encrypted token comprises generating the request for the first encrypted token including the partner user identifier, a partner site identifier, a primary service provider user account identifier, an account name, an account phone number and last bill amount and wherein generating the first encrypted token comprises generating the first encrypted token by encrypting the partner user identifier, a partner site identifier, a primary service provider user account identifier and an expiration time for the first encrypted token.

31. A method as recited in claim 18 further comprising communicating primary service provider data from the partner service provider to the user network device.

32. A system comprising:

a user network device;

a partner service provider; and

a primary service provider;

said user network device initiating an account setup page from the partner service provider, providing primary service account data in response to the account setup page and communicating the primary service account data to a primary service provider setup web service;

said primary service provider validating the primary service account data, generating an encrypted token in response to validating the primary service account data and communicating the encrypted token to the partner service provider;

said user network device generating a request for data through a partner service provider;

said partner service provider communicating the request for data with the encrypted token to the primary service provider;

said primary service provider validating the request for data at an authentication web service and communicating data to the client device from a data web service through the partner service provider after validating.

33. A system as recited in claim 32 wherein the primary service provider comprises a billing web service validating the primary service account data.

34. A system as recited in claim 32 wherein the partner service provider provides a partner site identifier in response to the account set up page.

35. A system as recited in claim 34 wherein the primary service provider validates the partner site identifier.

36. A system as recited in claim 35 wherein a set up module at the primary service provider validates the partner site identifier.

37. A system as recited in claim 36 wherein the primary service provider generates an encrypted token in response to validating the primary service account data and validating the partner site identifier.

38. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and an account phone number.

39. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and an account name.

40. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier and last bill amount.

41. A system as recited in claim 32 wherein the primary service account data comprises an account name, an account phone number and last bill amount.

42. A system as recited in claim 32 wherein the primary service account data comprises a primary service provider user account identifier, an account name, an account phone number and last bill amount.

43. A system as recited in claim 32 wherein the encrypted token comprises the primary service account data.

44. A system as recited in claim 32 wherein the encrypted token comprises a primary service account identifier.

45. A system as recited in claim 32 wherein the encrypted token comprises a primary service account identifier and a partner side identifier.

46. A system as recited in claim 32 wherein the encrypted token comprises a partner user identifier, a primary service account identifier and a partner side identifier.

47. A system as recited in claim 32 wherein the encrypted token comprises an expiration time.

48. A system as recited in claim 32 wherein the primary service provider validates the request for data by validating the encrypted token.