System, method and apparatus for federated single sign-on services

An Authentication Broker included in a telecommunication system providing Single Sign-On services to a user accessing selected Service Providers, the user having a subscription with a first mobile network operator, and each selected Service Provider being associated with a second mobile network operator, said Authentication Broker comprising:

• an Authentication Broker Web Front End that includes a first interfacing means and a second interfacing means for interfacing with said user and a selected Service Provider, respectively;
• the first interfacing means for communicating with a user having a subscription with a first mobile network operator;
• the second interfacing means for communicating with a Service Provider associated with a second mobile network operator;
• a broker channel formed from said first and second interfacing means for enabling the Authentication Broker to redirect said user to said user's Home network, and for resolving said user's Home network for said Service Provider, respectively.

A telecommunication system for providing Single Sign-On services to a first user for accessing at least one Service Provider, the user having a subscription with a first mobile network operator, said system comprising:

• a first mobile network operated by a first operator;
• an Authentication Provider belonging to said first mobile network is entitled to authenticate said first user towards said at least one Service Provider, said Authentication Provider generating an authentication assertion valid for said first user to access at least one Service Provider and returning an artifact with said assertion back to said first user;
• and
• wherein said at least one Service Provider is providing services to said first user once said first user is authenticated by said Authentication Provider, said at least one Service Provider redirecting an access request from said first user towards said Authentication Provider;
• wherein said at least one Service Provider is receiving the authentication assertion included in said artifact presented by said first user;
• wherein said at least one Service Provider is requesting verification of the authentication assertion towards said Authentication Provider;
• and
• wherein said Authentication Provider is directly accessed without involving an Authentication Broker.

A telecommunication system for providing Single Sign-On services to a first user for accessing at least one Service Provider, the user having a subscription with a first mobile network operator, said system comprising:

• a first mobile network operated by a first operator;
• an Authentication Provider belonging to said first mobile network is entitled to authenticate said first user towards said at least one Service Provider, said Authentication Provider generating an authentication assertion valid for said first user to access at least one Service Provider and returning an artifact with said assertion back to said first user;
• and
• means for issuing a Single Sign-On authentication request from said user towards said Authentication Provider, when said user accesses the selected Service Provider and is redirected towards the Authentication Provider for authentication;
• means for receiving the artifact with the authentication assertion;
• means for presenting the received authentication artifact to the at least one Service Provider;
• wherein said at least one Service Provider is providing services to said first user once said first user is authenticated by said Authentication Provider, said at least one Service Provider redirecting an access request from said first user towards said Authentication Provider;
• wherein said at least one Service Provider is receiving the authentication assertion included in said artifact presented by said first user;
• and
• wherein said at least one Service Provider is requesting verification of the authentication assertion towards said Authentication Provider.

A telecommunication system for providing Single Sign-On services to a first user for accessing at least one Service Provider, the user having a subscription with a first mobile network operator, said system comprising:

• a first mobile network operated by a first operator;
• an Authentication Provider belonging to said first mobile network is entitled to authenticate said first user towards said at least one Service Provider, said Authentication Provider generating an authentication assertion valid for said first user to access at least one Service Provider and returning an artifact with said assertion back to said first user;
• and
• wherein said at least one Service Provider is providing services to said first user once said first user is authenticated by said Authentication Provider, said at least one Service Provider redirecting an access request from said first user towards said Authentication Provider;
• wherein said at least one Service Provider is receiving the authentication assertion included in said artifact presented by said first user;
• wherein said at least one Service Provider is requesting verification of the authentication assertion towards said Authentication Provider;
• and
• wherein said user is identified between said Authentication Provider and the at least one Service Provider by means of a shared identity independently of the authentication identity used between said user and said Authentication Provider, and independently of the user identity used between said user and said at least one Service Provider.