Methods, nodes, system, computer programs and computer program products for secure user subscription or registration

• US 8,750,506 B2
• Filed: 12/22/2008
• Issued: 06/10/2014
• Est. Priority Date: 07/31/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Blom, Rolf, Castellanos Zamora, David
• Primary Examiner(s): Poltorak, Peter
• Application Number:
  US13/056,393
• Publication Number:
  US 20110126017A1
• Time in Patent Office: 1,996 Days
• Field of Search: 455/410
• US Class Current: 380/247
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Methods and apparatus facilitate secure user subscription or registration to a service at least partly enabled in a network. The network comprises user equipment adapted to perform generic bootstrapping. A network application function provides the service. A bootstrapping server function generates a bootstrapping transaction identifier. A home subscriber system stores a user profile, comprising information relating to the user and at least one service provided by the network application function.

Claims

1. A method for secure user subscription or registration to a service at least partly enabled in a network, the network comprising a user equipment configured to perform generic bootstrapping, a network application function for providing the service, and a bootstrapping server function for storing a service profile, the service profile comprising information relating to particular details for enabling the execution of the service provided by the network application function for the user equipment, the method comprising:

responsive to receiving a bootstrapping service request from the user equipment that comprises a user identity, sending an authentication request from the bootstrapping server function to a home subscriber system based on the user identity;

responsive to receiving the authentication request from the bootstrapping server function, retrieving the service profile at the home subscriber system based on the user identity and transmitting an authentication answer from the home subscriber system to the bootstrapping server function, the authentication answer comprising the service profile;

responsive to receiving the authentication answer from the home subscriber system, generating at the bootstrapping server function a bootstrapping transaction identifier and a privacy protected identifier that identifies the user equipment in communications between the bootstrapping server function and the network application function, and communicating the bootstrapping transaction identifier to the user equipment;

storing the service profile and the bootstrapping transaction identifier at the bootstrapping server function, wherein the stored service profile further comprises a privacy indicator;

responsive to receiving a secure application request from the user equipment that comprises the bootstrapping transaction identifier, transmitting a bootstrapping information request from the network application function to the bootstrapping server function, the bootstrapping information request comprising the bootstrapping transaction identifier;

responsive to receiving the bootstrapping information request from the network application function, generating at the bootstrapping server function a network application key for the network application function, and providing the network application key and service-related information from the stored service profile to the network application function, the service-related information required by the network application function to actually execute the service after the user equipment is at least one of authenticated and authorized for the service;

storing the network application key and the service-related information at the network application function;

completing the secure user subscription or registration to the service at the network application function based on the received network application key;

executing the service for the user equipment based on the received service-related information; and

including the privacy protected identifier in place of the user identity at the network authentication function when communicating with the bootstrapping server function.

2. The method according to claim 1, wherein the network further comprises a home subscriber system storing the service profile, and wherein the method further comprises:

responsive to receiving a bootstrapping service request from the user equipment that comprises a user identity, sending an authentication request from the bootstrapping server function to the home subscriber system based on the user identity;

responsive to receiving the authentication request from the bootstrapping server function, retrieving the stored service profile at the home subscriber system based on the user identity and transmitting an authentication answer from the home subscriber system to the bootstrapping server function, the authentication answer comprising the stored service profile;

responsive to receiving the authentication answer from the home subscriber system, generating the bootstrapping transaction identifier at the bootstrapping server function, communicating that bootstrapping transaction identifier to the user equipment, and storing the received service profile and the bootstrapping transaction identifier at the bootstrapping server function.

3. The method according to claim 1, further comprising, responsive to a user subscription or registration request received from the user equipment, determining at the network application function that the requested service requires additional information for enabling the execution of the service for the user equipment, and, responsive to said determination, initiating at the network application function retrieval of this additional information via a bootstrapping secured session by initiating the user subscription or registration, wherein initiating the user subscription or registration comprises transmitting a bootstrapping request to the user equipment.

4. The method according to claim 1, wherein the service is enabled by execution of Generic Bootstrapping Architecture (GBA)-Push.

5. The method according to claim 1, further comprising, responsive to receiving the bootstrapping information request from the network application function, determining, at the bootstrapping server function and from the service profile, if the user equipment is authorized for the requested service, and if so, transmitting a service authorization from the bootstrapping server function to the network application function.

6. The method according to claim 1, further comprising determining the user identity at the bootstrapping server function, if the bootstrapping server function receives a request from the network application function that includes a privacy protected identifier in place of the user identity.

7. The method according to claim 1, wherein the stored service profile is comprised in stored, user-related security settings.

8. The method according to claim 1, further comprising:

applying at the network application function a user'"'"'s stored service-related information for the initiation of a subsequent bootstrapping push service request for the same user towards the bootstrapping server function or a different bootstrapping server function.

9. The method according to claim 1, wherein the service is enabled by the execution of a bootstrapping push request and wherein the service-related information comprises information indicating at least one of the following:

a user identity for bootstrapping push service requests to a bootstrapping server function;

a user transport identifier for a bootstrapping push service delivery method to the user equipment; and

a bootstrapping server function address for the requested service; and

a UICC application to use for the requested service.

10. The method according to claim 9, wherein the stored service profile further comprises an application identifier.