Network-based authentication and security services

Patent metadata

Field	Value
Publication number	US-10594696-B2
Application number	US-201816040302-A
Country	US
Kind code	B2
Filing date	Jul 19, 2018
Priority date	Dec 15, 2015
Publication date	Mar 17, 2020
Grant date	Mar 17, 2020

Abstract

A user device may request access to a service provided by an application server. The application server may request that an identity server authenticate the user device. The identity server may have a network authentication system assist with the authentication of the user device. Once authenticated by the network authentication system, the application server may be informed and may grant the user device access to the requested service. Additionally, the identity server may help determine whether the user device is a security threat by comparing user information from the network authentication system with user information from the application server. Additionally, the network authentication system may provide the application server with user information to enable the application server to automatically register the user device for a particular service.

First claim

What is claimed is:

1. A system, comprising:
a non-transitory computer-readable medium storing a set of processor-executable instructions; and
one or more processors configured to execute the set of processor-executable instructions, wherein executing the set of processor-executable instructions causes the one or more processors to:
receive an authentication request, from a user device registered to access a telecommunications network, to authenticate the user device, the authentication request including a callback universal resource locator (URL) of an identity server;
identify an Internet Protocol (IP) address used by the user device to send the authentication request;
authenticate the user device by determining that the telecommunications network has previously associated the IP address with a mobile device number (MDN) of the user device;
generate a temporary authorization code based on the MDN;
create a redirect message that includes the callback URL of the identity server and the temporary authorization code;
send the temporary authorization code, to the identity server, by sending the redirect message to the user device, wherein receipt of the redirect message, by the user device, causes the user device to use the callback URL to send the temporary authorization code to the identity server;
receive, from the identity server, a request for a token corresponding to the user device, the request for the token including authentication credentials of the identity server and the temporary authorization code;
validate the request for the token by:
validating the authentication credentials of the identity server, and
determining that the temporary authorization code, included in the request for the token, matches the temporary authorization code previously sent to the user device;

identify, after validating the request for the token, the MDN of the user device based on the temporary authentication code included in the request for the token;
create, after validating the request for the token, the token requested by the identity server, the token including the MDN of the user device;
provide the token to the identity server, wherein the identity server authenticates the user device based on receiving the token;
receive a request from the identity server for subscriber information corresponding to a user of the user device, the request for subscriber information including an identifier of an application server and the MDN;
identify, based on the identifier of the application server, one or more types of subscriber information that the application server is authorized to receive;
identify, based on the MDN and the one or more types of subscriber information that the application server is authorized to receive, that the application server is authorized to receive at least some of the subscriber information corresponding to the user of the user device; and
send, to the application server, via the identity server, the identified at least some of the subscriber information to the application server.

2. The system of claim 1 , further comprising one or more devices that are associated with a digital signature, wherein the token includes a digital signature associated with the one or more devices, the digital signature enabling the identity server to verify that the token was created by the one or more devices.

3. The system of claim 1 , further comprising a plurality of network servers of the telecommunications network,
wherein executing the processor-executable instructions, to determine that the telecommunications network has previously associated the IP address with the MDN of the user device, further causes the one or more processors to:
send, by a first network server, of the plurality of network servers, the IP address of the user device to a second network server, of the plurality of network servers, along with a request for the MDN associated with the IP address, and
receive, by the first network server and from a third server of the plurality of network servers, the MDN of the user device.

4. The system of claim 1 , further including a plurality of network servers of the telecommunications network, wherein executing the processor-executable instructions further causes the one or more processors to:
obtain, by a first network server of the plurality of network servers, an encryption key, from a second network server of the plurality of network servers, that is pre-selected for in-network communications;
encrypt, by the first network server, the MDN with the encryption key;
create, by the first network server, an authorization request message that includes an identifier and the callback URL of the identity server;
insert the encrypted MDN into a header of the authorization request message; and
send, by the first network server, the authorization request message to a third network server of the plurality of network servers for validation.

5. The system of claim 4 , wherein executing the processor-executable instructions further causes the one or more processors to:
receive, by the third network server, the authorization request message;
extract, by the third network server, from the authorization request message, the identifier and the callback URL of the identity server; and
validate, by the third network server, the authorization request message based on the identifier and the callback URL of the identity server.

6. The system of claim 4 , wherein executing the processor-executable instructions further causes the one or more processors to:
extract, by the third network server, the encrypted MDN from the header of the authorization request message;
obtain, by the third network server, the encryption key from the second network server; and
decrypt, by the third network server and based on the encryption key, the encrypted MDN to determine the MDN.

7. The system of claim 6 , wherein executing the processor-executable instructions further causes the one or more processors to:
generate, by the third network server, a second temporary authorization code based on the MDN that was determined based on the decrypting;
create, by the third network server, a second redirect message that includes the temporary authorization code; and
send, by the third network server, the second temporary authorization code, to the identity server, by sending the second redirect message to the user device.

8. The system of claim 1 , further comprising:
one or more regional server devices that each correspond to a particular portion of the telecommunications network,
a first centralized server device that manages and distributes encryption keys for the one or more regional server devices throughout the telecommunications network, and
a second centralized server device that provides validation and authentication services to the one or more regional server devices throughout the telecommunications network.

9. A method, comprising:
receiving, by one or more devices of a telecommunications network, an authentication request, from a user device registered to access the telecommunications network, to authenticate the user device, the authentication request including a callback universal resource locator (URL) of an identity server;
identifying, by the one or more devices, an Internet Protocol (IP) address used by the user device to send the authentication request;
authenticating, by the one or more devices, the user device by determining that the telecommunications network has previously associated the IP address with a mobile device number (MDN) of the user device;
generating, by the one or more devices, a temporary authorization code based on the MDN;
creating, by the one or more devices, a redirect message that

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Bao Guanqun
• Libonate Brian
• Counterman Raymond C

Classifications

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L9/3247

  involving digital signatures · CPC title