RU2589356C2 - Method for authentication of subscribers of cellular network operator - Google Patents

Abstract

FIELD: information technology; radio engineering and communication.

SUBSTANCE: invention relates to methods for authentication of subscribers of cellular networks for accessing external resources. Method comprises following steps: external application receives a request from unauthorised user to access resources requiring user authentication, said request is transmitted to authentication system, wherein in request is transmitted a key for external application and unauthorised subscriber identifier is added, authentication system checks rights external application to access resources and possibility of authentication by means of subscriber identifier and transmits to external application a temporary key by redirection of response through a user browser, then external application on temporary key receives a unique user identifier (MobileID) from authentication system.

EFFECT: higher safety when obtaining access to resources.

9 cl, 2 dwg

Description

FIELD OF TECHNOLOGY

This invention relates to systems and methods for authenticating subscribers of cellular networks of operators to gain access to external resources.

BACKGROUND

Issues related to the authentication of mobile subscribers are relevant today. During authentication, the subscriber must provide not only high security, but also the convenience of using these tools.

The prior art solution known as "Transparent access authentication in GPRS core networks", US patent US7770216, published 03.08.2010, applicant T-Mobile Deutschland Gmbh. This technical solution describes a method and system for transparent authentication in 2G and 2.5G mobile networks. The disadvantage of this technical solution is the lack of the possibility of additional authentication, the lack of flexible settings for the requirements of the mobile operator, as well as the requirements of the operator of an external resource.

SUMMARY OF THE INVENTION

This invention is aimed at eliminating the disadvantages inherent in existing technical solutions. The technical result of this invention is to increase the level of security and convenience in user authentication in mobile networks.

The method of authentication of subscribers of mobile operators for external applications includes the following steps: the external application receives a request from an unauthorized user to access resources that require user authentication, then the external application redirects the request to the authentication system through the user's browser, when redirecting the request, the key of the above external applications and when passing the request through the operator’s modules, the subscriber identifier is added for which authorization is performed, then the authentication system receives a redirected request and checks the rights of the external application to access resources, then checks the possibility of authentication using the subscriber’s identifier, and if it is denied, it performs additional authentication, otherwise it authenticates the subscriber, then the authentication system generates and transmits to an external application a temporary key by redirecting the response through the user's browser, then the external application receives a temporary key from ikalny user ID (MobileID) from the authentication system.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 - component diagram.

Figure 2 is a user authentication sequence diagram.

DETAILED DESCRIPTION OF THE DRAWINGS

Figure 1 - component diagram.

The diagram graphically shows an example of the composition of components and the protocols for their interaction:

1. The subscriber (using an electronic application or browser) interacts with the Authentication System and with the External Application using the HTTP (s) protocol, while interacting with the Authentication System, messages pass through the GGSN or P-GW gateway.

2. The external application interacts with the authentication system API using the HTTP (s) protocol.

Figure 2. User authentication sequence diagram.

This diagram graphically shows an example of the operation of this method.

1. The user accesses the login page of an external application using a subscriber browser;

2. The external application sends the user a response containing the login page;

3. The user clicks on the “Login from current number” button, and a request for external authentication / authorization occurs;

4. The external application redirects the user’s request, while the user’s browser navigates to the address of the authentication page (authentication system) specified in the redirect, and when the request passes through the operator’s module, a subscriber identifier is added, for example, MSISDN;

5. The authentication system checks the rights of the external application, checks the security settings of the subscriber, generates a temporary code (key), then generates a response message containing a redirect to the user's browser address of the external application and the temporary code;

6. When receiving a response message with a redirect, the subscriber browser carries out a request for an external application (the request contains the above temporary code (key));

7. An external application for obtaining a mobile subscriber identifier makes a request to the authentication system, while the request contains the above temporary code (key) and the secret key of the external application;

8. The authentication system generates a unique user identifier (MobileID), valid only for this application (if the mobile identifier has not been generated previously).

DETAILED DESCRIPTION OF THE INVENTION

Hereinafter, the terms used in the application will be described.

Subscriber - consumer of mobile operator services using a SIM card

Subscriber identifier - a unique subscriber identifier that allows you to uniquely identify it in the network of the mobile operator (for example, MSISDN or IMSI).

MobileID - the identifier of the user who is the subscriber of the mobile operator’s network, valid only for this external application, not the subscriber number MSISDN, the SIM card number of the IMSI subscriber or any other public subscriber identifier.

Authentication system - a hardware-software complex that authenticates users of an external application that are subscribers of cellular networks of operators to gain access to the resources of an external application.

External application profile - a data set containing information about an external application, including: application identifier, information about application resources, information about application roles and rights, network address of the application, and other technical information.

User profile - a data set containing information about the user of a specific external resource, including: user and resource identifier, information about user roles and rights, allowed authentication methods, and other technical information.

User - a consumer of external application resources using an electronic application or browser for this. A user can be a subscriber to a mobile operator’s network.

GGSN - Gateway GPRS Support Node (gateway GPRS node or routing node).

GGSN is a gateway (ordinary router) between the cellular network (its part for GPRS data transmission) and external Packet Data Networks: Internet, Intranet corporate networks, and other GPRS-systems. GGSN contains all the necessary information about networks where GPRS subscribers can access, as well as connection parameters.

MSISDN (Mobile Subscriber Integrated Services Digital Number) - the number of the mobile subscriber of the digital network with the integration of services for communication in GSM, UMTS, etc. This subscriber number is not contained on the SIM card, but is mapped to the SIM card IMSI in the HLR, and is intended to transfer the phone number to the designated party and to receive calls to the phone.

The present invention in its various embodiments can be implemented in the form of a method, including implemented on a computer, in the form of a system or computer-readable medium containing instructions for performing the above method.

In this invention, a system means a computer system, a computer (electronic computer), CNC (numerical control), PLC (programmable logic controller), computerized control systems and any other devices that can perform a given, well-defined sequence of operations (actions, instructions).

By a command processing device is meant an electronic unit or an integrated circuit (microprocessor) that executes machine instructions (programs).

The command processing device reads and executes machine instructions (programs) from one or more data storage devices. Hard disk drives (HDD), flash memory, ROM (read only memory), solid state drives (SSD), optical drives can be used as storage devices.

A program is a sequence of instructions intended for execution by a control device of a computer or a device for processing commands.

The method of authentication of subscribers of mobile operators for external applications includes the following steps:

Previously, an external application passes registration and receives a key (secret code), which is used later in the authentication process

An external application receives a request from an unauthorized user to access resources that require user authentication.

In some embodiments, a request for access to resources may be carried out using a browser or a mobile application.

As a resource of an external application, there may be a remote information system that interacts with an electronic application or a user's browser. In some implementations, the information system interacts using the http or https protocol, but not limited to them.

The external application receives a user-generated request. Next, the request is processed, the presence of authentication data and the rights of this user to provide the necessary resources or perform operations are checked.

The external application redirects the request, while the subscriber identifier received from the operator module and the key of the above external application are added to the request

Redirecting a request consists of several actions. Initially, the external application generates a response message to the user containing the user's initial request (data), the address of the redirect to the authentication system and the identification key of this external application. Then the user (browser or mobile application of the user) receives the generated message and redirects it to the address of the authentication system, while the request passes through the operator module (gateway) and the subscriber identifier is added to it.

In some implementations, the subscriber identifier may be MSISDN.

In some embodiments, the IMSI may be the subscriber identifier.

In some embodiments, the subscriber identifier further includes IMEI.

In some embodiments, a GGSN or P-GW is used as an operator module.

The authentication system receives a redirected request and checks the rights of an external application to access resources, then checks the possibility of authentication using a subscriber identifier, and if it is denied, it performs additional authentication, otherwise it authenticates the subscriber.

The authentication system receives the request, after which it searches for the profile of the external application using the identification key contained in the request. Next, the authentication system checks in the profile of the external system the availability of the necessary rights to access the requested operation. If this external application does not have rights, then the authentication system generates a response message about the impossibility of authentication. If the verification was successful, then the authentication system searches for the user profile and checks the possibility of authentication using the subscriber ID. If authentication by subscriber ID is prohibited (additional authentication methods are indicated), then the subscriber number is automatically determined by the operator, additional authentication scenarios and security policies specified by the operator are executed, and the user interface is formed in accordance with the operator’s corporate style.

In some embodiments, the subscriber identifier is obtained from the operator at the network address (IP) of the subscriber.

In some implementations, additional user authentication is performed using a login-password link.

In some implementations, additional user authentication is performed using a one-time password sent to the subscriber number.

The authentication system generates and transmits a temporary key to the external application.

After successful authentication of the user as a subscriber, the authentication system generates a short-term authorization code for the external application and transmits it in a response message to the user. The response message contains a redirect to the source address of the external application. Thus, the external application receives a short-term authorization code in the user request. Authorization code is randomly generated.

The external application receives a unique user identifier (MobileID) from the temporary key authentication system.

Upon receipt of a short-term authorization code from the user, the external application generates a request containing a short-term authorization code, as well as a secret code issued during registration of the external application.

Upon receipt of the request, the authentication system checks the short-term authorization code and secret code. As a result of authentication, the response message for the external application returns a unique user identifier (MobileID), valid only for this external application, which is not the MSISDN subscriber number, IMSI subscriber SIM card number or any other public subscriber identifier, which allows the user to authenticate with the external application without receiving personal data of the subscriber.

Claims (9)

1. A method of authenticating subscribers of mobile operators for external applications, comprising the following steps:
- An external application receives a request from an unauthorized user to access resources that require user authentication;
- The external application redirects the request, while the redirection in the request transfers the key of the above external application for which authorization is performed, and the identifier of the subscriber for which authorization is performed when the request passes through the operator modules;
- The authentication system receives a redirected request and checks the rights of the external application for access to resources, then checks the possibility of authentication using the subscriber’s identifier, and if it is denied, it performs additional authentication, otherwise it authenticates the subscriber;
- The authentication system generates and transmits a temporary key to the external application by redirecting the response through the user's browser;
- The external application receives a unique user identifier (MobileID) from the authentication system using a temporary key. 2. The method according to claim 1, in which MSISDN is used as the subscriber identifier. 3. The method of claim 1, wherein IMSI is used as the subscriber identifier. 4. The method of claim 2 or 3, wherein the subscriber identifier further includes IMEI. 5. The method according to claim 1, wherein GGSN or P-GW is used as the operator module. 6. The method according to claim 1, in which the subscriber ID is obtained from the operator at the network address of the user. 7. The method according to claim 1, in which additional authentication of the user is performed using the login-password link. 8. The method according to claim 1, in which additional user authentication is performed using a one-time password sent to the subscriber number. 9. The method according to claim 1, in which, if additional authentication is necessary, the subscriber number is automatically determined by the operator, a user interface is created that matches the corporate style of the operator, additional authentication scenarios and security policies specified by the operator are executed.

Images