| System, method and apparatus for federated single sign-on services -> Monitor Keywords |
|
|
 
System, method and apparatus for federated single sign-on servicesRelated Patent Categories: Telecommunications, Radiotelephone System, Security Or Fraud Prevention, Privacy, Lock-out, Or AuthenticationSystem, method and apparatus for federated single sign-on services description/claimsThe Patent Description & Claims data below is from USPTO Patent Application 20070184819, System, method and apparatus for federated single sign-on services. Brief Patent Description - Full Patent Description - Patent Application Claims
CROSS REFERENCE TO RELATED APPLICATIONS [0001] This application for patent claims the benefit of priority from, and hereby incorporates by reference the entire disclosure of co-pending U.S. provisional application for patent Ser. No. 60/361,382, filed Feb. 28, 2002, and co-pending U.S. provisional application for patent Ser. No. 60/377,059, filed May 1, 2002. FIELD OF THE INVENTION [0002] The present invention generally relates to Single Sign-On services that can be offered for a plurality of users. More particularly, the invention pertains to means, system and methods for offering Single Sign-On web-based services for a plurality of users that are subscribers of Mobile Network Operator networks. BACKGROUND OF THE INVENTION [0003] The advent of web services has brought with them a new service that allows users to access said web services in an easy and convenient manner, the so-called Single Sign-On (SSO). The current SSO principle states that users shall be able to authenticate once and shall be given access to all their subscribed services that accept such level of authentication. This principle focuses on end-user convenience while leaving open the capabilities of terminals and networks when implementing the SSO. Thus, the current trends address two approaches for carrying out the SSO principle. [0004] In a first approach, namely a "terminal-centric" approach, the user authenticates once to the terminal that in turn automatically tracks a service-oriented network access and transparently presents, that is, without further user involvement, the appropriate credentials to the service-oriented network that requests such credentials. [0005] In a second approach, namely a "network-centric" approach, the user authenticates once to an Authentication Provider (AP) in a network that in turn handles the appropriate credentials for the services. [0006] The so-called "network-centric" approach is suitable when domain trust relationships exist among authentication providers and service providers, whereas the terminal-centric approach is useful when such relationships do not exist and the terminal can track the authentication towards disparate domains or services. [0007] It is also possible to combine both approaches. A network operator may issue credentials such as digital certificates, short-time certificates, or temporary tickets or tokens that may be stored in the terminal or in an accessible read/write card. These are further used by the user upon authentication or authorization procedures. [0008] Conventional cellular operators use authentication services to grant subscribers accesses to voice and data services provided by such operators. As cellular operators move up in the value chain, they could leverage their mutual trust relationship with their own subscribers in order to play a new role of Authentication Providers for their respective subscriber population in emerging business models in which service domain and authentication services belong to different administrative entities. In this respect, an operator that is able to provide both accesses, namely IP connectivity and services, might additionally offer to its subscribers an "access authentication SSO" so that an authentication performed at the access level might be valid as authentication in a service domain. This is a relevant starting point for further disclosing the objects of the present invention. [0009] More precisely, the relationship between a service domain and an authentication provider, as well as the services that a user may be offered, must be taken into account for discussing advantages and disadvantages of the above approaches. Generally speaking, an Authentication Provider may belong to the same administrative domain as the Service Provider offering the service, or may be delegated to an external trusted party or to a distributed federation. [0010] A primary object of the present invention is the support of Single Sign-On (SSO) services for subscribers of a Federation of Mobile Network Operators (MNO), subscribers who are users of different Service Providers (SP). Said SSO services are supported in such a manner that users, Federation of Mobile Network Operators, and Service Providers holding agreements with at least one member of such Federation, all get additional advantages and value added services from a given architectural and business reference model in accordance with this invention. [0011] More specifically, the users have the advantage of the SSO service for accessing any service at any Service Provider (SP) within the reference model agreement. The Mobile Network Operators (MNO) may obtain revenues by offering SSO services, in particular authentication and authorization, to third parties as well as keeping subscribers loyalty by adding value to their respective mobile subscriptions. Eventually, the Service Providers may experience an increase of potential users, namely mobile subscribers, with a simpler and much safer authentication and authorization mechanisms minimizing the support for different such mechanisms depending on the different nature of users. In this scenario Authentication Provider and Service Provider belong to different administrative domains. At the same time, these distributed advantages favor an increase of a so-called mobile commerce (m-commerce), which can be regarded as a further object of the present invention. DESCRIPTION OF RELATED ART [0012] The "network-centric" approach, as above described, seems to be more suitable for scenarios involving users of Service Providers who are also subscribers of Mobile Network Operators, the latter wanting to play the role of Authentication Providers. However, the closest known prior art is herein discussed with reference to SSO services in a generic network-centric approach independently of the type of the network acting as Authentication Provider. [0013] For instance, U.S. Patent Application Publication US 2002/0010776 A1 to Lerner describes methods and systems for providing a Single Sign-On (SSO) distributed application services integration for authentication and authorization services. The relevant teaching in this application starts when a first indication from a user, who is pointing a browser of a first application, is received at a central server coupled to the user terminal. Then, a cookie file corresponding to the user is also received at the central server from the browser of the first application. The central server, then, updates the cookie file received from the browser. [0014] A cookie file is a data segment of variable length and typically including hundreds of bytes. These cookies are written, read and modified by an application interface library resident in each affiliated web server, whether local to the central server or residing in a remote partner's site. More specifically, the updating of a received cookie file includes the comparison of the cookie file with some predetermined parameters and the eventual modification of the cookie file based on this comparison. [0015] When a second indication from the user is received at the central server indicating that the user is pointing the server to a second application, the central server provides this updated cookie file to the second application. [0016] This patent application states that the above application interface library, which is responsible for writing, reading and modifying the cookie files, is configured for also authenticating users among other applications. Consequently, one of ordinary skill in the art would readily recognize that authentication data and corresponding functions for all the users reside in each affiliated web server, at local or remote partner's sites, what is an additional disadvantage for administration. Specifically, particular actions are taken at any application in an affiliated web server, which browser is pointed by the user, with regard to the authentication of such user even though the user has got the benefit of an SSO service. Thus, one may see this mechanism as an example of a scenario wherein Authentication Provider and Service Provider belong to the same administrative domain. [0017] The above teaching does not seem to be applicable for large telecommunication systems comprising a Federation of Mobile Network Operators, a plurality of different Service Providers that have likely signed agreements with at least one member of the Federation, and a huge amount of potential users who are mobile subscribers of any member of the Federation. [0018] Moreover, given that the subscriber authentication data and algorithms are quite sensitive information, the MNO are very reluctant to spread this information through entities outside their own premises. [0019] Another significant instance of methods and system for Single Sign-On user access is described in the European patent application EP-1089516 to Grandcolas et al. wherein users may gain access to multiple web servers. [0020] This application describes how a user is authenticated at a first web server that allows the user to select a second web server offering a desirable service. When the user effectively selects the second web server, the first web server constructs an encrypted authentication token, and transmits it to the second web server. The second web server authenticates the received token and allows the user to have a session at this second web server. Both first and second web server share, in accordance with this application, a sub-domain. That is, the scenario in this application is an instance where the Authentication Provider, namely the first web server, and the Service Provider, namely the second web server, both belong to the same administrative domain. Continue reading about System, method and apparatus for federated single sign-on services... Full patent description for System, method and apparatus for federated single sign-on services Brief Patent Description - Full Patent Description - Patent Application Claims Click on the above for other options relating to this System, method and apparatus for federated single sign-on services patent application. ###  How KEYWORD MONITOR works... a FREE service from FreshPatents1. Sign up (takes 30 seconds). 2. Fill in the keywords to be monitored. 3. Each week you receive an email with patent applications related to your keywords. Start now! - Receive info on patent apps like System, method and apparatus for federated single sign-on services or other areas of interest. ### Previous Patent Application: Method and system for enhanced security using location based wireless authentication Next Patent Application: Wireless connection system and wireless connection method Industry Class: Telecommunications ### FreshPatents.com Support Thank you for viewing the System, method and apparatus for federated single sign-on services patent info. IP-related news and info Results in 0.40632 seconds Other interesting Feshpatents.com categories: Qualcomm , Schering-Plough , Schlumberger , Seagate , Siemens , Texas Instruments , 174 |
 * Protect your Inventions * US Patent Office filing 
PATENT INFO |
|
