Method and system for the provision of services for terminal devices

Patent metadata

Field	Value
Publication number	US-9444814-B2
Application number	US-45020808-A
Country	US
Kind code	B2
Filing date	Mar 3, 2008
Priority date	Mar 16, 2007
Publication date	Sep 13, 2016
Grant date	Sep 13, 2016

Abstract

Services are provided for terminal devices, each having a TPM module. The TPM module of a terminal device transmits a service request with an ID assertion signed by a configurable credential to a server for the purpose of accessing the services of the server.

First claim

The invention claimed is:

1. A method for provision of services for terminal devices, each of which has a trusted platform module, comprising:
configuring, by a network operator in a trusted platform module of a terminal device, an access control list containing credentials associated with different servers for different services; and
sending, by the trusted platform module of the terminal device, a service request with an identification assertion, signed by a configurable credential, to a server for access to the services thereof, if the configurable credential exists as an entry in the access control list.

2. The method as claimed in claim 1 , further comprising by the server on receipt of the service request with the identification assertion,
validating the credential; and
verifying a signature included in the identification assertion.

3. The method as claimed in claim 1 , further comprising configuring the credential by the network operator in the trusted platform module of the terminal device.

4. The method as claimed in claim 1 , further comprising forming the credential using a certificate of the network operator.

5. The method as claimed in claim 1 , wherein the identification assertion includes user identity information data, a certificate of the network operator, a time stamp and service-specific access restrictions.

6. The method as claimed in claim 1 , further comprising the terminal device regularly sending a useful service usage report to a network operator.

7. The method as claimed in claim 1 , wherein the credential becomes invalid after a predetermined lifetime.

8. The method as claimed in claim 1 , further comprising forming the identification assertion based on a security assertion mark-up language identification assertion.

9. The method as claimed in claim 1 , further comprising initially registering the trusted platform module with the respective server.

10. A terminal device communicating with a server, comprising:
a trusted platform module sending a service request with an identification assertion, signed by a configurable credential, to the server for access to services provided by the server, if the configurable credential exists as an entry in an access control list containing credentials associated with different servers for different services and being configured by a network operator in the trusted platform module of the terminal device.

11. The terminal device as claimed in claim 10 , further comprising a single sign-on module.

12. A server for provision of services for at least one terminal device having a trusted platform module, comprising:
a receiver receiving from the at least one terminal device a service request with an identification assertion, signed by a configurable credential, for access to services provided by the server, if the configurable credential exists as an entry in an access control list containing credentials associated with different servers for different services and being configured by a network operator in the trusted platform module of the at least one terminal device; and
a processor programmed to perform operations following receipt of the service request with the identification assertion signed by a configurable credential, including validating the credential for the provision of at least one service for the at least one terminal device and verifying a signature included in the identification assertion.

13. A system for provision of services, comprising:
terminal devices, each having a trusted platform module with a network operator configuring credentials and sending service requests with identification assertions, signed by a configured credential, for access to a service if the configurable credential exists as an entry in an access control list containing credentials associated with different servers for different services and being configured by the network operator therein; and
a server validating the credential for the provision of at least one service for one of the terminal devices and verifying a signature included in the identification assertion.

14. The method as claimed in claim 1 , wherein the identification assertion signed by the configurable credential obtained from the access control list by the trusted platform module of the terminal device is sent by the trusted platform module of the terminal device to the server to obtain access to the services provided by the server after verification of the configurable credential by the server.

15. The terminal device as claimed in claim 10 , wherein the identification assertion signed by the configurable credential obtained from the access control list by the trusted platform module of the terminal device is sent by the trusted platform module of the terminal device to the server to obtain access to the services provided by the server after verification of the configurable credential by the server.

16. The server as claimed in claim 12 , wherein the identification assertion signed by the configurable credential obtained from the access control list by the trusted platform module of the at least one terminal device is sent by the trusted platform module of the at least one terminal device to the server to obtain access to the services provided by the server after verification of the configurable credential by the server.

17. The system as claimed in claim 13 , wherein the identification assertion signed by the configurable credential obtained from the access control list by the trusted platform module of the one of the terminal devices is sent by the trusted platform module of the one of the terminal devices to the server to obtain access to the services provided by the server after verification of the configurable credential by the server.

Assignees

• Moeller Wolf-Dietrich
• Shanmugam Murugaraj
• Tschofenig Hannes
• Siemens Ag

Inventors

• Moeller Wolf-Dietrich
• Shanmugam Murugaraj
• Tschofenig Hannes

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title