US 11,601,413 B2Granted

Single sign-on control function (SOF) for mobile networks

AssigneeNetsia, Inc.

InventorsBeytullah Yigit, Can Altay, Burak Gorkemli, Seyhan Civanlar

Life of this patent

Estimating the term…

Loading patent…

Abstract

A new control function is defined for the control plane of a 5G mobile network to enable the operator's mobile user, who is using a premium network slice, to access application services on the public Internet, by operator sign-on only when accessing the application on said slice. This unique single sign-on capability allows the user to bypass the service authentication after operator authenticates the mobile device by the user session establishment procedure. The new function registers a plurality of service applications, which sign-up for single sign-on capability. It also coordinates the mapping and storage of credentials of the user across the mobile operator's service and the service provider's application for each of said plurality of service applications, and transfers user credentials to the application so that the user's sign-in step is bypassed.

Claims20

Dependent claims

(a) computer readable program code implementing a first communication interface to communicate with a session management function (SMF) component, the first communication interface communicating user's mobile network-specific authentication information;
(b) computer readable program code implementing a second communication interface to communicate with a Unified Data Management (UDM) component, the second communication interface communicating registry information and service application-specific user authentication information to the UDM;
(c) computer readable program code implementing a third communication interface to communicate with a User Plane Function (UPF) controller, the third communication interface communicating specific routing policies based on an IP address of one or more data packets originating from a User Equipment (UE) to enable a single sign on (SSO) service with the UPF controller;
(d) computer readable program code implementing a fourth communication interface to communicate with at least one application authentication server, the fourth communication interface:
(1) communicating with the at least one application authentication server to register at least one application service and, after registering, (2) communicating with the at least one application authentication server to receive a digitally signed SSO ticket assigned to the UE that is connected to a mobile network,
wherein the SOF is implemented in a control plane and the UE is associated with at least one premium network slice, and a unique private IP address (user_IP_address) is assigned to the UE;
and
wherein the SOF sends a special packet forwarding instruction to the UPF Controller to route the one or more packets received by UPF that is sourced by the user_IP_address of the UE to a service_IP_address of the at least one application authentication server.

5 more elements

A method as implemented in a Single Sign-On Function (SOF), the SOF comprising (i) a first communication interface to communicate with a session management function (SMF) component, the first communication interface communicating user's mobile network-specific authentication information;

(ii) a second communication interface to communicate with a Unified Data Management (UDM) component, the second communication interface communicating registry information and service application-specific user authentication information to the UDM;
(iii) a third communication interface to communicate with a User Plane Function (UPF) controller, the third communication interface communicating specific routing policies based on an IP address of one or more data packets originating from a User Equipment (UE) to enable a single sign on (SSO) service with the UPF controller;
(iv) a fourth communication interface to communicate with at least one application authentication server, the fourth communication interface:
communicating with the at least one application authentication server to register at least one application service and, after registering, communicating with the at least one application authentication server to receive a digitally signed SSO ticket assigned to the UE that is connected to a mobile network, the SOF is implemented in a control plane and the UE is associated with at least one premium network slice, the method comprising:
(a) securely registering the at least one application authentication server, wherein the registering comprises receiving the following information from the at least one application authentication server:
(1) a unique service-ID or name, and (2) an IP address(es) or hostname;
(b) sending received information in (a) to the UDM;
(c) receiving the digitally signed SSO ticket and a telephone number of the UE;
(d) sending the digitally signed SSO ticket and a telephone number of the UE to the UDM for storage;
(e) assigning a unique private IP address (user_IP_address) to the UE when the UE connects to the mobile network;
and
(f) sending a special packet forwarding instruction to the UPF Controller to route the one or more packets received by UPF that is sourced by the user_IP_address of the UE to a service_IP_address of the at least one application authentication server.

9 more elements

An article of manufacture comprising non-transitory computer storage medium storing computer readable program code which, when executed by a computer, implements a method as implemented in a Single Sign-On Function (SOF), the SOF comprising (i) a first communication interface to communicate with a session management function (SMF) component, the first communication interface communicating user's mobile network-specific authentication information;

(ii) a second communication interface to communicate with a Unified Data Management (UDM) component, the second communication interface communicating registry information and service application-specific user authentication information to the UDM;
(iii) a third communication interface to communicate with a User Plane Function (UPF) controller, the third communication interface communicating specific routing policies based on an IP address of one or more data packets originating from a User Equipment (UE) to enable a single sign on (SSO) service with the UPF controller;
(iv) a fourth communication interface to communicate with at least one application authentication server, the fourth communication interface:
communicating with the at least one application authentication server to register at least one application service and, after registering, communicating with the at least one application authentication server to receive a digitally signed SSO ticket assigned to the UE that is connected to a mobile network, the SOF is implemented in a control plane and the UE is associated with at least one premium network slice, the article of manufacture comprising:
(a) computer readable program code securely registering the at least one application authentication server, wherein the registering comprises receiving the following information from the at least one application authentication server:
(1) a unique service-ID or name, and (2) an IP address(es) or hostname;
(b) computer readable program code sending received information in (a) to the UDM;
(c) computer readable program code receiving the digitally signed SSO ticket and a telephone number of the UE;
(d) computer readable program code sending the digitally signed SSO ticket and a telephone number of the UE to the UDM for storage;
(e) computer readable program code assigning a unique private IP address (user_IP_address) to the UE when the UE connects to the mobile network;
and
(f) computer readable program code sending a special packet forwarding instruction to the UPF Controller to route the one or more packets received by UPF that is sourced by the user_IP_address of the UE to a service_IP_address of the at least one application authentication server.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/070,896Filed 14 Oct 2020 · us provisional application
Priority: 14 Oct 2019
Published: US 2021/0112049 A115 Apr 2021
Granted: 7 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/0815
For authentication of entities: providing single-sign-on or federations
G06F 21/41
User authentication: where a single sign-on provides access to a plurality of computers
H04L 63/0807
For authentication of entities: using tickets, e.g. Kerberos
H04W 12/06
Security arrangements; Authentication; Protecting privacy or anonymity: authentication