Mobile user location privacy solution based on the use of multiple identities

• US 7,088,989 B2
• Filed: 05/07/2003
• Issued: 08/08/2006
• Est. Priority Date: 05/07/2003
• Status: Active Grant

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Guo, Yile
• Primary Examiner(s): Eng, George
• Assistant Examiner(s): DOAN, KIET M
• Application Number:
  US10/431,283
• Publication Number:
  US 20040224664A1
• Time in Patent Office: 1,189 Days
• Field of Search: 340/5.25, 340/5.61, 707/1, 370/449, 713/200, 713/193, 713/201, 713/171, 455/456.1, 455/426, 455/433, 455/436, 455/434, 455/456, 455/457, 455/413, 455/411, 455/404.2, 455/435, 701/213, 342/357.09, 342/357.14, 342/357.1, 342/357.9, 705/18, 726/3
• US Class Current: 455/411
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 8/16 selectively restricting mobility data tracking
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A mobile device (10) includes a wireless network adapter (13) for communication with a wireless access network (24), and further includes a memory (23) in the mobile device for securely storing at least one pseudo-identification (IDp) of a mobile device user in conjunction with an actual identification (ID1) of the mobile device user. The mobile device further includes a mobile device identity manager (22), coupled to the memory, for transmitting ID1 from the mobile device to a trusted wireless access network for associating ID1 with a location of the mobile device (12), and for transmitting IDp from the mobile device to an untrusted wireless access network for associating IDp with a location of the mobile device (18).

Claims

1. A method to use a location service in a wireless access network, comprising:

transmitting a pseudo-identification (IDp) from a mobile device to an Authentication Module of the wireless access network;

over a first link of the wireless access network, forwarding the IDp from the Authentication Module to a wireless access network location server;

in the wireless access network location server, associating the IDp with the location of the mobile device; and

over a second link of the wireless access network, forwarding the IDp in association with the location of the mobile device from the wireless access network location server to a location-based application.

2. A method as in claim 1, where the IDp is transmitted to an Authentication Module of the wireless access network, further comprising forwarding the IDp from the Authentication Module to the location server.

3. A method as in claim 1, further comprising forwarding the IDp in association with the location of the mobile device to a location-based application.

4. A method as in claim 1, where the IDp is securely stored in the mobile device in conjunction with an actual identification of the mobile device.

5. A method to use a location service in a wireless access network, comprising:

securely storing in a mobile device at least one pseudo-identification (IDp) of a mobile device user in conjunction with an actual identification (ID1) of the mobile device user;

when operating with a trusted wireless access network, transmitting ID1 from the mobile device to the trusted wireless access network and associating ID1 with a location of the mobile device; and

when operating with an untrusted wireless access network, transmitting IDp from the mobile device to an Authentication Module coupled to the untrusted wireless access network and associating IDp with a location of the mobile device, forwarding over a first link of the wireless access network the IDp from the Authentication Module to a wireless access network location server of the untrusted wireless access network, the location server associating IDp with the location of the mobile device, and forwarding over a second link of the wireless access network the IDp in association with the location of the mobile device from the location server to a location-based application.

6. A wireless access network comprising in a mobile device a transmitter for transmitting a pseudo-identification (IDp) from the mobile device to an Authentication Module of the wireless access network, and in a wireless access network location server, means for associating the IDp with the location of the mobile device, further comprising means for forwarding over a first link of the wireless access network the IDp from the Authentication Module to the wireless access network location server, and further comprising means for forwarding over a second link of the wireless access network the IDp in association with the location of the mobile device from the location server to a location-based application.

7. A wireless access network as in claim 6, where the IDp is transmitted to the Authentication Module of the wireless access network, further comprising the first link for forwarding the IDp from the Authentication Module to the location server.

8. A wireless access network as in claim 6, further comprising a memory in said mobile device for securely storing the IDp in conjunction with an actual identification of the mobile device.

9. A wireless access network comprising in a mobile device a transmitter for transmitting a pseudo-identification (IDp) from the mobile device to the wireless access network, and in a wireless access network location server, means for associating the IDp with the location of the mobile device, where the IDp is transmitted to an Authentication Module of the wireless access network, the wireless access network further comprising a first link for forwarding the IDp from the Authentication Module to the location server and further comprising a second link for forwarding the IDp in association with the location of the mobile device from the location server to a location-based.

10. A mobile device comprising a wireless network adapter for communication with a wireless access network, further comprising a memory in the mobile device for securely storing at least one pseudo-identification (IDp) of a mobile device user and an actual identification (ID1) of the mobile device user, and an Identity Manager, coupled to the memory, for transmitting ID1 from the mobile device to a trusted wireless access network for associating ID1 with a location of the mobile device, and for transmitting IDp from the mobile device to an Authentication Module coupled to an untrusted wireless access network for associating IDp with a location of the mobile device, the wireless access network further comprising the Authentication Module and a location server, the Authentication Module for forwarding over a first link of the wireless access network the IDp from the Authentication Module to the location server of the untrusted wireless access network, the location server associating the IDp with the location of the mobile device, and the location server for forwarding over a second link of the wireless access network the IDp in association with the location of the mobile device from the location server to a location-based application.

11. A method to use a location service in a wireless access network, comprising:

storing in a mobile device an actual identification (ID1) of a mobile device user;

when registering with a non-trusted wireless access network, one of generating a pseudo-identification (IDp) or accessing a stored IDp;

transmitting IDp from the mobile device to an Authentication Module of the non-trusted wireless access network;

authenticating the mobile device user based on IDp; and

providing a location of the mobile device and IDp to an application, wherein providing further comprises;

over a first link of the wireless access network forwarding the IDp from the Authentication Module to a location server; and

over a second link of the wireless access network forwarding the IDp in association with the location of the mobile device from the location server to the application.

12. A method as in claim 11, further comprising:

when registering with a trusted wireless access network, transmitting ID1 from the mobile device to an Authentication Module of the trusted wireless access network;

authenticating the mobile device user based on ID1; and

providing a location of the mobile device and ID1 to an application.

13. A mobile device operable for using a location service in a wireless access network, comprising:

means for authenticating the mobile device comprising means for transmitting a pseudo-identification (IDp) from the mobile device to a location server of the wireless access network for associating the IDp with a location of the mobile device, where the IDp is transmitted to an Authentication Module of the wireless access network, where the wireless access network further comprises means for forwarding over a first link of the wireless access network the IDp from the Authentication Module to the location server and further comprises means for forwarding over a second link of the wireless access network the IDp in association with the location of the mobile device from the location server to a mobile application; and

means, responsive to the mobile device being authenticated, for executing the mobile application in cooperation with an application server.

14. A mobile device as in claim 13, where the means for forwarding the IDp comprises the Authentication Module.

15. A mobile device as in claim 13, where the application server is a mobile device location-based application server, and where the means for forwarding the IDp forwards the IDp in association with the location of the mobile device to the location-based application server.

16. A mobile device as in claim 13, where the IDp is securely stored in a memory means of the mobile device in conjunction with an actual identification of the mobile device.

17. A computer medium program product comprising program code readable by at least one data processor for using a location service in a wireless access network, comprising:

a program code segment for authenticating the mobile device comprising computer program code for transmitting a pseudo-identification (IDp) from the mobile device to a location server of the wireless access network for associating the IDp with a location of the mobile device, where the program code for transmitting transmits the IDp to an Authentication Module of the wireless access network, and forwards over a first link of the wireless access network the IDp from the Authentication Module to the location server;

a program code segment for forwarding over a second link of the wireless access network the IDp in association with the location of the mobile device from the location server to a mobile application; and

a program code segment, responsive to the mobile device being authenticated for executing the mobile application in cooperation with a mobile device location-based application server.

18. A computer medium program product comprising program code readable by at least one data processor, comprising program code operable for reading a memory in the mobile device, the memory securely storing at least one pseudo-identification (IDp) of a mobile device user and an actual identification (ID1) of the mobile device user, said program code implementing an Identity Manager function for transmitting ID1 from the mobile device to a trusted wireless access network for associating ID1 with a location of the mobile device, and for transmitting IDp from the mobile device to an untrusted wireless access network for associating IDp with a location of the mobile device, the program code operable for transmitting IDp to an Authentication Module coupled to the untrusted wireless access network, the program code also operable for forwarding over a first link of the wireless access network the IDp from the Authentication Module to a location server and operable for forwarding over a second link of the untrusted wireless access network the IDp in association with the location of the mobile device from the location server to a location-based application.

19. A computer medium program product comprising program code readable by at least one data processor comprising part of a wireless network location server coupled to a mobile device through a wireless access network, comprising program code, responsive to a receipt of a pseudo-identification (IDp) from the mobile device, for associating the IDp with a determined location of the mobile device, where the IDp is received at the wireless network location server from an Authentication Module coupled to the wireless network location server and to the mobile device, the program code also for forwarding over a first link of the wireless access network the IDp from the Authentication Module to the wireless network location server and for forwarding over a second link of the wireless access network the IDp in association with the determined location of the mobile device from the wireless network location server to a location-based application.

20. A computer medium program product as in claim 19, where the IDp is received by the program code via the Authentication Module.