Network-based authentication and security services

Patent metadata

Field	Value
Publication number	US-10084780-B2
Application number	US-201615059217-A
Country	US
Kind code	B2
Filing date	Mar 2, 2016
Priority date	Dec 15, 2015
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

A user device may request access to a service provided by an application server. The application server may request that an identity server authenticate the user device. The identity server may have a network authentication system assist with the authentication of the user device. Once authenticated by the network authentication system, the application server may be informed and may grant the user device access to the requested service. Additionally, the identity server may help determine whether the user device is a security threat by comparing user information from the network authentication system with user information from the application server. Additionally, the network authentication system may provide the application server with user information to enable the application server to automatically register the user device for a particular service.

First claim

What is claimed is:

1. A method, comprising:
receiving, by one or more devices of a telecommunications network, an authentication request, from a user device registered to access the telecommunications network, to authenticate the user device, the authentication request including a callback universal resource locator (URL) of an identity server;
identifying, by the one or more devices, an Internet Protocol (IP) address used by the user device to send the authentication request;
authenticating, by the one or more devices, the user device by determining that the telecommunications network has previously associated the IP address with a mobile device number (MDN) of the user device;
generating, by the one or more devices, a temporary authorization code based on the MDN;
creating, by the one or more devices, a redirect message that includes the callback URL of the identity server and the temporary authorization code;
sending, by the one or more devices, the temporary authorization code, to the identity server, by sending the redirect message to the user device, wherein receipt of the redirect message, by the user device, causes the user device to use the callback URL to send the temporary authorization code to the identity server;
receiving, by the one or more devices and from the identity server, a request for a token corresponding to the user device, the request for the token including authentication credentials of the identity server and the temporary authorization code;
validating, by the one or more devices, the request for the token by:
validating the authentication credentials of the identity server, and
determining that the temporary authorization code, included in the request for the token, matches the temporary authorization code previously sent to the identity server;

identifying, by the one or more devices and after validating the request for the token, the MDN of the user device based on the temporary authentication code included in the request for the token;
creating, by the one or more devices and after validating the request for the token, the token requested by the identity server, the token being based on the MDN of the user device;
enabling, by the one or more devices, the identity server to authenticate the user device by sending the token to the identity server;
receiving, by the one or more devices, a request from the identity server for subscriber information corresponding to the user device, the request for subscriber information including an identifier of an application server and the MDN;
identifying, by the one or more devices and based on the identifier of the application server, types of subscriber information that identity server is registered to receive;
identifying, by the one or more devices and based on the MDN and the types of subscriber information that the application server is authorized to receive, first subscriber information that the application server should receive; and
sending, by the one or more devices and to the identity server, the first subscriber information to enable the identity server to determine whether the user device is a security threat to the application server, wherein to determine whether the user device is the security threat to the application server, the identity server:
obtains second subscriber information from the application server;
compares the first subscriber information to the second subscriber information;
determines a security score, based on the comparison of the first subscriber information to the second subscriber information, the security score representing a likelihood of the user device being the security threat to the application server; and
sends the security score to the application server.

2. The method of claim 1 , wherein the token includes a digital signature of the one or more devices, the digital signature enabling the identity server to verify that the token was created by the one or more devices.

3. The method of claim 1 , wherein:
the one or more devices include a plurality of network servers of the telecommunications network, and
the determining that the telecommunications network has previously associated the IP address with the MDN of the user device includes:
sending, by a first network server, of the plurality of network servers, the IP address of the user device to a second network server, of the plurality of network servers, along with a request for the MDN associated with the IP address, and
receiving, by the first network server and from a third server of the plurality of network servers, the MDN of the user device.

4. The method of claim 1 , wherein:
the one or more device include a plurality of network servers of the telecommunications network, and
the method further comprises:
obtaining, by a first network server of the plurality of network servers, an encryption key, from a second network server of the plurality of network servers, that is pre-selected for in-network communications;
encrypting, by the first network server, the MDN with the encryption key;
creating, by the first network server, an authorization request message that includes an identifier and the callback URL of the identity server;
inserting the encrypted MDN into a header of the authorization request message; and
sending, by the first network server, the authorization request message to a third network server of the plurality of network servers for validation.

5. The method of claim 4 , further comprising:
receiving, by the third network server, the authorization request message;
extracting, by the third network server, from the authorization request message, the identifier and the callback URL of the identity server;
validating, by the third network server, the authorization request message based on the identifier and the callback URL of the identity server;
extracting, by the third network server, the encrypted MDN from the header of the authorization request message;
obtaining, by the third network server, a copy of the encryption key from the second network server;
decrypting, by the third network server, the encrypted MDN to determine the MDN;
generating, by the third network server, a second temporary authorization code based on the MDN that was determined based on the decrypting;
creating, by the third network server, a second redirect message that includes the callback URL of the identity server and the temporary authorization code; and
sending, by the third network server, the second temporary authorization code, to the identity server, by sending the second redirect message to the user device.

6. The method of claim 1 , wherein:
a first network server includes a regional server device that corresponds to a particular portion of the telecommunications network,
a second network server includes a centralized server device that manages and distributes encryption keys for server devices throughout the telecommunications network, and
a third network server includes another centralized server device that provides validation and authentication services to the server devices throughout the telecommunications network.

7. The method of claim 1 , further comprising:
sending, to the application server, via the identity server, the first subscriber information to the application server.

8. The method of claim 1 , further comprising:
automatically creating, by the application server, a service account, for a user of the user device, based on the subscriber information.

9. One or more devices, comprising:
a non-transitory memory device storing a plurality of processor-executable instructions; and
a processor configured to execute the processor-executable instructions, wherein executing the processor-executa

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Bao Guanqun
• Libonate Brian
• Counterman Raymond C

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/126

  the source of the received data · CPC title