EP1762037A2

EP1762037A2 - Method and system for certifying a user identity

Info

Publication number: EP1762037A2
Application number: EP05778769A
Authority: EP
Inventors: Frédéric DELMOND; Jean-Michel Crom
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2004-06-29
Filing date: 2005-06-21
Publication date: 2007-03-14
Also published as: WO2006010810A2; WO2006010810A3; FR2872363A1; US20080052771A1

Abstract

The invention relates to a system for certifying the identity of at least one user of a terminal (10) after at least one access control to a packet network (20). The inventive system comprises an access server (11) for receiving at least one correlation element transmitted from said terminal (10) along with a request of connection to said packet network, an identity server (14) for transmitting at least one connection indicator to the terminal (10), a proxy server (12) for transmitting said correlation element and at least one user identifier transmitted from the access server (11) to a data base (13) connected to the identity server (14), wherein the terminal (10) transmits said connection indicator along with a request of connection to a service provider (30) in order to retrieve said user identifier transmitted along with the access control to the packet network (20). Said invention can be used for certifying the identity of a terminal user along with a request for identifying said user after at least one access control to a packet network.

Description

METHOD AND SYSTEM FOR CERTIFYING IDENTITY

FROM A USER

The present invention relates to a method and system for certifying the identity of a user.

The invention applies more particularly to the certification of the identity of a user of a terminal during a request for authentication of said user, after at least one access control to a packet network.

This packet network may be a public packet network for IP (Internet Protocol) transmission, in particular the Internet network, or a private network for IP transmission packets, such as the intranet network of a company, or well any other network of packets for which the access of the users is controlled by a protocol of the AAA type (Authentication, Authorization and Accounting, ie authentication, authorization and accounting). In general, the access control to a packet network is achieved by an identification and authentication procedure, with at least one identifier and a password. After validation of the access control, the user receives an authorization to transmit information on the network to which he has connected.

Currently, after an access control has been made to establish a connection to a packet network, the user must re-authenticate and authenticate each time he wishes to access a personal or confidential service, available through the Internet. intermediate of said packet network. The personalization and the confidentiality of the services proposed becoming more and more important, it is often necessary that the user is identified and authenticated by a control of access to these services. Given the increase in the number of services accessible by an access control, the user must successively identify himself with identifiers and passwords that are mostly different, after having already identified himself to access the packet network. In the case of access control to the Internet, the user generally identifies with his Internet Service Provider (or FAl) via a connection kit. When connecting to the network, a public or private IP address is assigned to the user's terminal to route the traffic to the terminal.

In the case of intranet access control, a public IP address is first assigned to the user's terminal. Then, when the connection to the intranet is actually active, the terminal uses a private IP address corresponding to the addressing domain of the intranet. In the case of the use of a protocol of the type Mobile IP (protocol of mobility management on IP networks, IP Mobility Support), protocol defined by the organization IETF (Internet Engineering Task Force), the terminal of the user uses his own permanent IP address regardless of access to the network. Gold ₁ processes and existing identification and authentication systems rely on the IP address assigned to the user terminal via the packet network to carry identification while in some configurations (private intranet, Mobile IP, ...) the terminal uses an IP address different from that assigned by the packet network to which the user accesses.

Also, the technical problem to be solved by the object of the present invention is to propose a method and a system for certifying the identity of at least one user of a terminal, after at least one access control to a terminal. Packet network, which would allow the user to avoid the multiplication of identification and authentication procedures, after performing access control to a packet network.

The solution to the technical problem posed consists, according to the present invention, in that said method comprises the steps of:

storing at least one correlation element with at least one identifier of said user, transmitted by said terminal during a connection request to the packet network, in a database connected to an identity server,

transmitting a request from the terminal to said identity server, said request including said correlation element, transmitting by the identity server to the terminal at least one connection indicator, stored in the terminal,

storing said connection indicator by the identity server in the database associated with said correlation element; transmitting the connection indicator by the terminal to a service provider when requesting a connection to said provider of a connection; services,

transmitting the connection indicator by the service provider to the identity server,

recognizing the connection indicator by the identity server to retrieve said identifier of the user stored in the database,

- certify the identity of the user by the identity server to the service provider by using the certification of the user's identity performed during the access control to the packet network.

In the remainder of this memo, the term "connection cookie", also known as "cookie", a set of information from the identity server and automatically stored in the terminal when a connection to said identity server.

Similarly, according to the invention, a system for certifying the identity of at least one user of a terminal, after at least one access control to a packet network, is remarkable in that said system comprises:

an access server able to receive at least one correlation element from said terminal during a connection request to said packet network,

an identity server capable of transmitting a connection indicator to the terminal after receiving a request from said terminal,

a proxy server capable of transmitting said correlation element and at least one identifier of said user, from the access server, to at least one database linked to the identity server, the terminal being able to transmit said control witness; connection during a connection request to a service provider to retrieve said user identifier transmitted during access control to the packet network.

Thus, the technical result obtained, as implemented in the system and method according to the invention, aims at reusing the identity certification, already performed by the user during access control to the packet network when accessing a service provider accessible only after a new access control.

The system and the method according to the invention thus provide a simplification of access to a service provider through the use of the certification of the identity of the user already made during the access control to a network packets, for example the Internet network or a private IP network. To provide a technical solution to the identity certification of a user during access to said service provider, the information initially received during access control to said packet network is reused.

In this way, the multiplication of the identification and authentication procedures by the user is avoided with each connection request, which makes it possible to carry out only one identity certification procedure during the access control at the packet network. The authentication of the user, already carried out, is then recognized when accessing service providers for whom it is necessary to carry out a new identity certification.

When requesting the connection to the packet network, the terminal includes at least one correlation element in a request to an access server. The access server relays the packet network access control procedure to an authentication server using an Authentication, Authorization and Accounting (AAA) type protocol (authentication, authorization, and accounting). During the access control procedure to a service provider, said correlation element will make it possible to retrieve at least the user's identifier, stored in a database connected to the identity server.

Then, the identity server manages the deposit of a connection indicator on the terminal, when the latter issues a request after the first access control is made.

Finally, the identity server responds to the identity certification requests of the user who wishes to connect to a service provider. The said connection indicator serves as a reference key for the database of data connected to the identity server to know the authentication already performed by the user when connecting to the packet network.

In addition, said method and system for certifying the identity of a user, in accordance with the invention, allow identification and authentication independently of the IP address assigned to the user's terminal by said packet network, unlike existing systems.

According to the invention, said correlation element is an indifferently random or pseudo-random number provided by the terminal to at least one authentication server located in the packet network. During the packet network connection request, the terminal transmits a correlation element to the access server, which relays it to an authentication server. Said correlation element, with the user's identifier, is then stored in a database connected to the identity server. According to the invention, at least one authentication request from the service provider is transmitted to the identity server using a redirection mechanism.

The user accesses a service, provided by a service provider, that requires identity certification. The service provider issues an authentication request. This request is transmitted to the identity server using a redirection mechanism, which allows the transmission of the latter to the identity server. The connection indicator, received during the connection request to said service provider, is thus transmitted by the service provider to the identity server. The redirection mechanism towards the identity server avoids the realization of a second access control for the connection to the service provider and allows the use of the certification of the identity of the user, already carried out during the control d ^: access for connection to the packet network. According to the invention, the said connection indicator is used as a key for consulting the said database by the identity server in order to know the identifier of the user. The identity server has transmitted a connection cookie to the terminal which, in turn, transmits this cookie upon a connection request to a service provider.

On receipt of the known connection indicator, thanks to the redirection mechanism, the identity server consults the database with the connection indicator used as a consultation key. In return, the identity server obtains the user's ID (or User ID).

According to the invention, said terminal is configured to store at least one correlation element transmitted during a connection request to said packet network, to transmit at least one request including said correlation element to at least one server of identity, to store at least one connection indicator from said identity server and to transmit said connection indicator during a connection request to a service provider. The terminal includes an application for storing a correlation element, which is transmitted to an identity server by remission of an http request.

Said application of the terminal also allows processing related to the response of said identity server and the filing of a connection indicator, stored by the terminal and transmitted during the connection request to a service provider requiring a certification of 'identity.

The following description with reference to the accompanying drawings, given as non-limiting examples, will make it clear what the invention consists of and how it can be achieved. FIG. 1 represents the general architecture of a system for certifying the identity of a user, according to the invention, during a connection to a packet network.

Figure 2 shows the general architecture of said certification system of the identity of a user, when connecting to a service provider.

A user wishes to access a service provider 30 through a packet network 20 with which he connects via a terminal 10. The terminus 10 of the user can be of any kind, for example a personal computer or PC, a mobile terminal or any other terminal equipped to control a connection request to said packet network, and called UE (User Equipment) on the FIG. 1. The user is subscribed to a telecommunications operator and, depending on the nature of said terminal 10, is connected to a telecommunications network of said indifferently fixed or mobile operator.

The packet network 20 may be a public packet network for IP (Internet Protocol) transmission, in particular the Internet network, or a private network of IP transmission packets ₁ such as a corporate intranet network. or any other packet network for which user access is controlled by an Authentication, Authorization and Accounting (AAA) protocol, defined by NETF. The service provider 30 provides various services 31,

31 ', 31 ", of any kind, requiring access control, for example, a service for the management of vacation days on an intranet of a private company or for access to a bank account by the intermediary of the Internet network, etc. The terminal 10 transmits a connection request to a packet network access server 11, which relays it to at least one authentication server 21, in particular a Radius server (Remote Authentication Dial-ln User Service), located in the packet network to which the connection has been requested Depending on the nature of the access to which the user is subscribed by his telecommunications operator, the access server 11 may for example be a Network Access Server (NAS) or Broadband Access Server (BAS) type device. 10 and the access server 11 s are therefore carried out indifferently at low bit rate or broadband and use for example a PPP transmission protocol (point-to-point protocol). During the request for connection to the packet network, the terminal 10 also transmits at least one identifier of the user (or User ID), as well as at least one correlation element, to the access server 11 and to the user. authentication server 21. The correlation element is, in particular, an indifferently random or pseudo-random number, provided by the terminal 10 to an authentication server 21 located in the packet network.

By way of example, the correlation element can be supplied to the terminal 10 by the access server 11 during the connection request to the packet network 20, at the opening of the PPP protocol (LCP layer) dialogue, or the terminal 10 may use data provided by the access server 11 to constitute said correlation element.

The terminal 10 includes an application for managing at least one PPP (point-to-point protocol) stack. In this way, the terminal 10 is configured to store a data received during the packet network connection request and transmitted by the access server 11. Said correlation element is also stored by the terminal 10.

The access server 11 transmits the connection request to a proxy server 12, for example of the Radius type, through which the information exchanged between each user terminal and the authentication server 21 flows. Said proxy server 12 then transmits the connection request to the authentication server 21, in particular a Radius server. After a connection request, at least one packet network access control is provided, which is performed by an identification and authentication procedure, for example with at least one identifier (known as "login"). ") And a password. When the access control is validated (login and password correct), the authentication server 21 transmits a packet network connection authorization for the terminal 10. The connection request is stored in a database data (BdD) connected to the authentication server 21.

The protocol Radius, specific for authentications, is defined by NETF and standardized by the organization ETSI (European Telecommunications Institute Standards, ie European Telecommunications Standardization Institute).

Once the connection authorization has been given, the proxy server 12 transmits the identifier of the user (or User ID) and the correlation element, from the access server 11, to a database 13 connected to to an identity server 14. Said base data 13 memorizes ^"IElement correlation with the user identifier transmitted by the terminal 10 when the connection request to the packet network.

In addition, the proxy server 12 acknowledges the connection request from the terminal 10 to the network 20 of packets.

The terminal 10 then transmits a request, including the correlation element, to the identity server 14 via the access server 11 and a router equipment 22 located in the network 20 of packets.

In particular, the request may be a request implementing a hyper text transfer protocol (http) type transfer protocol, usually used to transmit information, in particular to include said correlation element.

After receiving the request, the identity server 14 transmits a connection indicator to the terminal 10, intended to be automatically stored by said terminal 10.

The terminal 10 is configured for sending at least one request, for example a request implementing an http flow transfer protocol, to the identity server 14, as well as for processing linked to the server's response. 14 the receipt and storage of a cookie.

In addition, the identity server 14 contacts the database 13, in which the user identifier (or User ID) and the associated correlation element are already stored. With the received and known correlation element, the identity server 14 updates the database 13 by adding the connection indicator, transmitted to the terminal 10, associated with the correlation element.

The connection indicator is stored in the database 13, associated with the correlation element. The database 13 may or may not be physically included in the identity server. Once the connection is established with the packet network, the user orders a connection request from a service provider, which provides at least one service 31, 31 ', 31 ", requiring a new access control. for example to access a personalized service or a confidential service, such as a banking service or a private business service, as shown in Figure 2.

Upon the request to connect to the service provider, the terminal 10 also transmits at least the connection cookie to the service provider. The connection indicator will make it possible to retrieve the identifier of the user, stored during the packet network access control in said database 13 connected to the identity server 14. The transmission is performed via the access server 11 and the router equipment 22. As the service 31, 31 ', 31 "is accessible only after an access control, the service provider 30 issues an authentication request.

The request is transmitted to the identity server 14 using a redirection mechanism, which allows the transmission thereof to the identity server 14. In this way, the received connection indicator is transmitted by the service provider to the identity server. The redirection mechanism can, for example, be similar to those implemented from the recommendations defined by the consortium of companies called Liberty Alliance, whose purpose is the development of transactions on the Internet.

The redirection mechanism towards the identity server 14 avoids the realization of a second access control for the connection to the service 31,

31 ', 31 "and allows the use of the user identity certification, already performed during access control for connection to the packet network.

The identity server 14 will recognize the connection indicator allowing to find the identifier of the user stored in the database 13. On receipt of the known connection indicator, the identity server 14 consults the database 13 with the connection indicator used as the consultation key. In return, the identity server 14 obtains the user identifier (or User ID). The connection cookie is used as a key for consulting the database 13 by the identity server 14 to know the identifier of the user.

The identity server 14 transmits said user identifier to the service provider 30 avoiding new authentication of the user, after the authentication already performed during access control to the packet network.

Thanks to the user's identifier, the certification of the user's identity is carried out. The service provider 30 therefore recognizes the user and obtains a certification of his identity by the identity server 14. The identity server 14 certifies the identity of the user to the service provider 30 by using the certification of the identity of the user performed during access control to said packet network.

In addition, the identity server 14 may also specify the type of authentication used by said user, so as to indicate (if necessary) the reliability of the certification transmitted by the identity server 14 to the service provider 30. The service provider 30 then transmits the connection authorization to the terminal 10.

Depending on the level of security required or desired, for simplicity, it is technically possible to use the user identifier (or User ID) as a correlation element. To avoid fraud and to increase security, it is recommended to use a random or pseudo random correlation element, as described above.

With the redirection mechanism, the service provider 30 receives the certification of the identity of the user by the identity server 14. In general, this identity certification is performed from the user ID (or User ID). This can also be done from an equivalent identity, contained in said database 13. For this, the user has previously transmitted the information corresponding to said equivalent identity. The user also indicates his preference as to the use by the identity server 14 of either the identifier of the user (or User Id) ₁ or the equivalent identity.

Claims

A method of certifying the identity of at least one user of a terminal (10), after at least one access control to a network (20) of packets, characterized in that said method comprises the steps of at :

storing at least one correlation element with at least one identifier of said user, transmitted by said terminal (10) during a connection request to the network (20) of packets, in a database (13) connected to an identity server (14),

- transmitting a request from the terminal (10) to said identity server (14), said request including said correlation element, - transmitting by the server (14) of identity to the terminal (10) at least one witness connection, stored in the terminal (10),

storing said connection indicator by the identity server (14) in the data base (13) associated with said correlation element,

transmitting the connection indicator by the terminal (10) to a service provider (30) during a connection request to said service provider (30),

transmitting the connection indicator by the service provider (30) to the identity server (14),

recognizing the connection indicator by the identity server (14) to retrieve said identifier of the user stored in the data base (13),

- certify the identity of the user by the identity server (14) to the service provider (30) using the certification of the user's identity performed during the access control to the network (20) packets.

2. Method according to claim 1, characterized in that said correlation element is an indifferently random or pseudo-random number provided by the terminal (10) to at least one authentication server (21) located in the network (20). packets.

3. Method according to one of claims 1 or 2, characterized in that said request transmitted from the terminal (10) to the server (14) of identity is a request implementing an http flow transfer protocol for include said correlation element.

4. Method according to any one of claims 1 to 3, characterized in that at least one authentication request from the provider (30) of services is transmitted to the server (14) of identity using a mechanism redirection.

5. Method according to any one of claims 1 to 4, characterized in that said connection indicator is used as a key for consulting said database (13) data by the server (14) identity to know the User ID.

6. System for certifying the identity of at least one user of a terminal (10), after at least one access control to a network (20) of packets, characterized in that said system comprises:

an access server (11) adapted to receive at least one correlation element from said terminal (10) during a connection request to said packet network (20),

an identity server (14) capable of transmitting a connection indicator to the terminal (10) after receiving a request from said terminal

(10)

a proxy server (12) able to transmit said correlation element and at least one identifier of said user, from the access server (11), to a database (13) connected to the identity server (14) , the terminal (10) being able to transmit said connection indicator during a connection request to a service provider (30) to retrieve said identifier of the user transmitted during the access control to the network (20) of packets.

7. System according to claim 6, characterized in that said terminal (10) is connected to a telecommunications network indifferently fixed or mobile.

8. System according to one of claims 6 or 7, characterized in that said network (20) packet is a network for IP transmission.

9. Access server (11) adapted to be implemented in a system according to any one of claims 6 to 8, characterized in that it is configured to receive and transmit at least one connection request to said network (20) packets from the terminal (10), receiving at least one correlation element to the terminal (10) during said connection request, receiving and transmitting to an identity server (14) ^* at least one request from the terminal (10), receiving and transmitting to a service provider (30) at least one connection indicator from the terminal (10).

10. Access server (11) according to claim 9, characterized in that the exchange of information between the terminal (10) and the server (11) access are made indifferently at low speed or high speed.

11. Proxy server (12) adapted to be implemented in a system according to any one of claims 6 to 8, characterized in that it is configured to receive and transmit to a server (21) authentication at least one request for connection to said network (20) of packets from said access server (11), receiving and transmitting to a database (13) of data, connected to an identity server (14), at least one identifier said user and a correlation element from the terminal (10), to acknowledge said connection request from the terminal (10) to the packet network (20).

12. Proxy server (12) according to claim 11, characterized in that it is of the Radius type, through which the information exchanged between each user terminal (10) and said authentication server (21) flows.

13. Identity server (14) adapted to be implemented in a system according to any one of claims 6 to 8, characterized in that it is configured to receive at least one request from said terminal (10). ) including at least one correlation element, for transmitting at least one connection indicator to the terminal (10) and to a data base (13) connected to said identity server (14) to receive at least one request for authentication from a service provider (30) for transmitting at least one identifier of said user to the service provider (30) from said data base (13).

14. Terminal (10) adapted to be implemented in a system according to any one of claims 6 to 8, characterized in that said terminal is configured to store in memory at least one correlation element transmitted during a requesting connection to said packet network (20), for transmitting at least one request including said correlation element to an identity server (14), for storing at least one connection cookie from said server (14) d identity and to transmit said connection cookie during a connection request to a service provider (30).