Sponsored connectivity to cellular networks using existing credentials

• US 9,717,003 B2
• Filed: 08/03/2015
• Issued: 07/25/2017
• Est. Priority Date: 03/06/2015
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Palanigounder, Anand, Lee, Soo Bum, Horn, Gavin Bernard
• Primary Examiner(s): LE, DANH C
• Application Number:
  US14/817,123
• Publication Number:
  US 20160262021A1
• Time in Patent Office: 722 Days
• Field of Search: 455411, 4555501, 455418, 380270, 726 8
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and techniques are disclosed to facilitate the sponsored connectivity of a user equipment on a serving network so that the UE may access a service whose connectivity is sponsored by an application service provider. The application service provider provisions the serving network so that it is aware of the sponsored connectivity. In an attach attempt to the serving network, the UE provides a client token based on a pre-existing credential (established between the UE and the application service provider) instead of a subscriber identifier with the attach request. The application service provider'"'"'s server validates the access credential to authenticate the UE and provides information that the serving network uses to mutually authenticate with the UE. The UE may then use the serving network to access the service via the sponsored connection, even where the UE does not have a subscriber identity and subscription with a cellular network.

Claims

1. A method for accessing a service, comprising:

identifying, by a user equipment (UE), a network through which an application service provider server enables access to the service;

sending, from the UE, an attach request to the network with a client token based on a pre-existing credential associated with the UE and established with the application service provider server, the client token being unrecognizable as a cellular access credential to the network; and

authenticating, by the UE, to the network via the application service provider server for sponsored access to the service based on the pre-existing credential.

2. The method of claim 1, further comprising:

including, by the UE in the attach request, an identification of authentication type used by the UE for authentication to utilize the sponsored access to the service,

wherein the sending further comprises including, by the UE in the attach request, information identifying how to locate the application service provider.

3. The method of claim 1, wherein the pre-existing credential is based on a password established with the application service provider server generated via an out-of-band channel, the sending further comprising:

including, by the UE with the attach request, a user name associated with the password and the application service provider server;

hashing, by the UE, the password with a first value to generate the pre-existing credential; and

hashing, by the UE, the pre-existing credential with a second value to generate the client token that is sent from the UE in the attach request.

4. The method of claim 3, further comprising:

receiving, at the UE, an authentication token from the application service provider server via the network, wherein the network stores authentication information comprising a session key determined by the application service provider server based on the pre-existing credential, the session key enabling the network to authenticate with the UE;

validating, by the UE, the authentication token; and

in response to the validation, determining by the UE a UE-based key based on the pre-existing credential generated by the UE.

5. The method of claim 1, wherein the sending further comprises:

including, by the UE, the client token as a proof of possessing the pre-existing credential, wherein the pre-existing credential is established between the UE and the application service provider server prior to the sending the attach request.

6. The method of claim 1, further comprising:

performing, by the UE after the sending, a handshake between the UE and the application service provider server to agree upon a shared secret key;

determining, by the UE, a base key based on the shared secret key that is valid for a duration of an authentication session between the UE and the application service provider server; and

validating, by the UE, authentication information received in response to the attach request after the handshake based on the base key.

7. The method of claim 1, wherein the identifying further comprises:

receiving, by the UE, an advertisement of the sponsored access from the network.

8. The method of claim 1, further comprising:

authorizing, by the UE, a network element from the network to retrieve, from the application service provider server, a user profile associated with the pre-existing credential.

9. The method of claim 1, wherein the UE at least one of:

lacks a subscription to a cellular service provider; and

operates without a subscriber identity module (SIM) card.

10. A user equipment (UE) for accessing a service, comprising:

a transceiver configured to;

assist in identifying a network through which an application service provider server enables access to the service; and

send an attach request to the network with a client token based on a pre-existing credential associated with the UE and established with the application service provider server, the client token being unrecognizable as a cellular access credential to the network; and

a processor configured to authenticate to the network via the application service provider server for sponsored access to the service based on the pre-existing credential.

11. The user equipment of claim 10, wherein the processor is further configured to:

include, in the attach request, an identification of authentication type used by the UE for authentication to utilize the sponsored access to the service; and

include, in the attach request, information identifying how to locate the application service provider.

12. The user equipment of claim 10, wherein the pre-existing credential is based on a password established with the application service provider server generated via an out-of-band channel, the processor being further configured to:

include, with the attach request, a user name associated with the password and the application service provider server;

hash the password with a first value to generate the pre-existing credential; and

hash the pre-existing credential with a second value to generate the client token that is sent from the UE in the attach request.

13. The user equipment of claim 12, wherein:

the transceiver is further configured to receive an authentication token from the application service provider server via the network, wherein the network stores authentication information comprising a session key determined by the application service provider server based on the pre-existing credential, the session key enabling the network to authenticate with the UE; and

the processor is further configured to validate the authentication token and, in response to the validation, determine a UE-based key based on the pre-existing credential generated by the UE.

14. The user equipment of claim 10, wherein:

the client token represents a proof of possessing the pre-existing credential, and

the pre-existing credential is established between the UE and the application service provider server prior to sending the attach request.

15. The user equipment of claim 10, wherein:

the transceiver is further configured to perform, after sending the attach request, a handshake between the UE and the application service provider server to agree upon a shared secret key; and

the processor is further configured to determine a base key based on the shared secret key, that is valid for a duration of an authentication session between the UE and the application service provider server, and validate authentication information received in response to the attach request after the handshake based on the base key.

16. The user equipment of claim 10, wherein the transceiver is further configured to receive an advertisement of the sponsored access from the network.

17. The user equipment of claim 10, wherein the processor is further configured to:

authorize a network element from the network to retrieve, from the application service provider server, a user profile associated with the pre-existing credential.

18. The user equipment of claim 10, wherein the UE operates without a subscriber identity module (SIM) card.

19. A non-transitory computer-readable medium having program code recorded thereon, the program code comprising:

code for causing a user equipment (UE) to identify a network through which an application service provider server enables access to a service;

code for causing the UE to send an attach request to the network with a client token based on a pre-existing credential associated with the UE and established with the application service provider server, the client token being unrecognizable as a cellular access credential to the network; and

code for causing the UE to authenticate to the network via the application service provider server for sponsored access to the service based on the pre-existing credential.

20. The computer-readable medium of claim 19, further comprising:

code for causing the UE to include, in the attach request, an identification of authentication type used by the UE for authentication to utilize the sponsored access to the service; and

code for causing the UE to include, in the attach request, information identifying how to locate the application service provider server.

21. The computer-readable medium of claim 19, wherein the pre-existing credential is based on a password established with the application service provider server generated via an out-of-band channel, the computer-readable medium further comprising:

code for causing the UE to include, with the attach request, a user name associated with the password and the application service provider server;

code for causing the UE to hash the password with a first value to generate the pre-existing credential; and

code for causing the UE to hash the pre-existing credential with a second value to generate the client token that is sent from the UE in the attach request.

22. The computer-readable medium of claim 21, further comprising:

code for causing the UE to receive an authentication token from the application service provider server via the network, wherein the network stores authentication information comprising a session key determined by the application service provider server based on the pre-existing credential, the session key enabling the network to authenticate with the UE;

code for causing the UE to validate the authentication token; and

code for causing the UE, in response to the validation, to determine a UE-based key based on the pre-existing credential generated by the UE.

23. The computer-readable medium of claim 19, further comprising:

code for causing the UE to include the client token as a proof of possessing the pre-existing credential, wherein the pre-existing credential is established between the UE and the application service provider server prior to the sending the attach request.

24. The computer-readable medium of claim 19, further comprising:

code for causing the UE to perform, after the sending, a handshake between the UE and the application service provider server to agree upon a shared secret key;

code for causing the UE to determine a base key based on the shared secret key that is valid for a duration of an authentication session between the UE and the application service provider server; and

code for causing the UE to validate authentication information received in response to the attach request after the handshake based on the base key.

25. The computer-readable medium of claim 19, further comprising:

code for causing the UE to receive an advertisement of the sponsored access from the network.

26. The computer-readable medium of claim 19, further comprising:

code for causing the UE to authorize a network element from the network to retrieve, from the application service provider server, a user profile associated with the pre-existing credential.

27. The computer-readable medium of claim 19, wherein the UE operates without a subscriber identity module (SIM) card.