Means and method for controlling service progression between different domains

• US 20070117548A1
• Filed: 10/24/2003
• Published: 05/24/2007
• Est. Priority Date: 10/24/2003
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Fernandez-Alonso, Susana, Avila Gonzalez, Victor
• Granted Patent: US 8,064,891 B2
• Time in Patent Office: Days
• US Class Current: 455/414.100
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

At present, the existing mechanisms for authorising a user of a service network operator to access a service provided by a third party service provider are valid for most of the existing services based on a request and an answer, but for transactional services, those where a service delivery implies several transactions, the existing techniques present serious limitations for the operators to fully control the progression of services. To overcome this limitation, the invention provides means and methods to control the progression of a service, service which requires a plurality of transactions, at a first domain where the service has been authorised while the user is using said service provided by a second domain, as well as a verification mechanism for verifying the use of the service between the service network operator and the service provider.

Claims

1. An Application Gateway Module suitable for use in a telecommunication system wherein a service network authenticates a user and authorizes the user for accessing a service offered by a service provider, the Application Gateway Module arranged for intercepting application messages between the user and the service and for identifying said user and said service, and including:

means for obtaining an authorization decision on whether the user is allowed to access the service;

the Application Gateway Module comprising;

means for assigning a service session identifier intended to identify those application messages exchanged between the user and the service and that belong to a same service delivery authorized for said user;

means for configuring a first finite-state machine with a number of status intended to identify specific events in service delivery where service progression can be controlled; and

means for activating service policies applicable to said specific events and resulting in a state transition.

2. The Application Gateway Module of claim 1, wherein the means for assigning a service session identifier include means for initiating a specific instance of the first finite-state machine, said specific instance being identified by the assigned service session identifier.

3. The Application Gateway Module of claim 2, wherein the means for activating service policies include means for setting at least one element selected from a non-exhaustive list of references and attributes that comprises:

a number of message field values to match, a number of specific actions to carry out on matching, a number of timer values to run, and a number of transactions to supervise.

4. The Application Gateway Module of claim 2, wherein the means for activating service policies include means for activating a global service policy independently of any service delivery in progress.

5. The Application Gateway Module of claim 2, wherein the means for activating service policies include means for initiating an instance of a global service policy to apply as an individual service policy within a specific instance of the first finite-state machine, the individual service policy inheriting references and attributes from the global service policy.

6. The Application Gateway Module of claim 5, further comprising means for overwriting references and attributes of an individual service policy with new references and attributes during a service progression handled within a specific instance of the first finite-state machine.

7. The Application Gateway Module of claim 5, wherein a particular state is associated with a number of individual service policies within a specific instance of the first finite-state machine, said instance identified by a given service session identifier.

8. The Application Gateway Module of claim 2, wherein the means for obtaining an authorization decision include means for requesting a service authorization from an Authorization Module.

9. The Application Gateway Module of claim 8, wherein the means for activating service policies include means for receiving from the Authorization Module at least one element applicable to set a service policy, the element selected from a non-exhaustive list of references and attributes that comprises:

a number of message field values to match, a number of specific actions to carry out on matching, a number of timer values to run, and a number of transactions to supervise.

10. The Application Gateway Module of claim 8, wherein the means for activating service policies includes means for receiving a global service policy from the Authorization Module.

11. The Application Gateway Module of claim 8, further comprising means for receiving references and attributes from the Authorization Module applicable to overwrite an individual service policy with new references and attributes during a service progression handled within a specific instance of the first finite-state machine.

12. The Application Gateway Module of claim 8, further comprising means for notifying to the Authorization Module a specific event in service progression.

13. The Application Gateway Module of claim 8, further comprising means for requesting from the Authorization Module a further processing to determine an appropriate action to go on with the service progression.

14. The Application Gateway Module of claim 13, further comprising means for receiving from the Authorization Module an instruction selected from:

access granted without restriction, another service to substitute a previous service requested, forced logout, and indication of a state transition.

15. An Authorization Module suitable for use in a telecommunication system wherein a service network authenticates a user and authorizes the user for accessing a service offered by a service provider, the Authorization Module arranged for deciding whether a user is allowed to access a service and having:

means for receiving a service authorization request from an Application Gateway Module; and

means for returning to the Application Gateway Module a response on whether the user is granted access to the requested service;

the Authorization Module comprising;

means for generating a service session identifier intended to correlate those application messages exchanged between the user and the service and that belong to a same service delivery authorized for said user;

means for configuring a second finite-state machine with a number of status intended to identify specific events in service progression where the Authorization Module can act over the Application Gateway Module to control the service progression; and

means for determining service policies applicable to said specific events and resulting in a state transition.

16. The Authorization Module of claim 15, wherein the means for generating a service session identifier comprise means for including said service session identifier in the response to be returned to the Application Gateway Module on whether the user is granted access to the requested service.

17. The Authorization Module of claim 16, wherein the means for generating a service session identifier includes means for initiating a specific instance of the second finite-state machine, said specific instance being identified by said service session identifier.

18. The Authorization Module of claim 17, wherein a particular state is associated with a number of service policies within a specific instance of the second finite-state machine, said instance identified by a given service session identifier.

19. The Authorization Module of claim 15, wherein the means for determining service policies comprise means for including in the response towards the Application Gateway Module at least one information element to activate a service policy within a specific state in the Application Gateway Module, said at least one information element selected from a non-exhaustive list of references and attributes that comprises:

a number of message field values to match;

a set of actions to carry out on matching a given message field value;

a number of new timer values to run; and

a number of transactions to supervise.

20. The Authorization Module of claim 19, wherein the means for including in the response towards the Application Gateway Module at least one information element to activate a service policy include means for indicating that this is a global service policy to apply independently of any service delivery in progress.

21. The Authorization Module of claim 16, further comprising means for receiving a notification, from an Application Gateway Module indicating a specific event detected in service progression.

22. The Authorization Module of claim 16, further comprising means for receiving a request, from an Application Gateway Module, asking for an instruction to proceed with a service progression.

23. The Authorization Module of claim 22, further comprising means for sending towards the Application Gateway Module an instruction selected from:

access granted without restriction, another service to substitute a previous service requested, forced logout, and indication of a state transition.

24. The Authorization Module of claim 16, further comprising means for receiving an application message from at least one entity selected from a number of application servers and provisioning systems, the application message including a given service session identifier intended to identify a specific instance of the second finite-state machine in the Authorisation Module.

25. A method for authorizing a user of a service network to access a service offered by a service server of a service provider, the user already authenticated by the service network, the server arranged to deliver a service that comprises a plurality of transactions by exchanging a plurality of application messages with the user the method comprising the steps of:

obtaining a first authorization decision on whether the user is allowed to access the service;

generating and assigning a service session identifier intended to identify those application messages exchanged between the user and the service and that belong to a same service delivery authorized for said user;

configuring at least one finite-state machine with a number of status intended to identify specific events in service delivery where service progression can be controlled; and

activating service policies applicable to said specific events and resulting in a state transition.

26. The method of claim 25, wherein the step of generating and assigning a service session identifier includes a step of initiating a specific instance of the at least one finite-state machine, said specific instance being identified by the assigned service session identifier.

27. The method of claim 26, wherein a particular state within the specific instance of the at least one finite-state machine is associated with a number of service policies.

28. The method of claim 25, wherein the step of activating service policies includes a step of setting at least one element selected from a non-exhaustive list of references and attributes that comprises:

a number of message field values to match, a number of specific actions to carry out on matching, a number of timer values to run, and a number of transactions to supervise.

29. The method of claim 25, further comprising a step of receiving at the service network an application message originated at an entity selected from:

a number of service servers of a service provider and a number of entities of a provisioning system, the application message including a given service session identifier intended to identify a specific instance of the at least one finite-state machine.

30. The method of claim 25, wherein the step of configuring at least one finite-state machine further comprises configuring a first finite-state machine in an Application Gateway Module and configuring a second finite-state machine in an Authorization Module.