Network Operator Identity Service for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communication networks face challenges in providing efficient identity services, particularly in authenticating users across different service providers and mitigating denial-of-service attacks, while ensuring security and compatibility with existing infrastructure.
Innovation Solution
A method where a network operator's server assists in authenticating client devices by correlating OpenID identifiers with subscriber identifiers, using authentication challenge-response protocols and security mechanisms like AKA and OpenID, and monitoring for denial-of-service conditions to ensure secure and uninterrupted service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a network operator's server assists in authentication by correlating OpenID identifiers with subscriber identifiers, then authentication security and service reliability are improved, but system complexity and processing time increase
Solution Approach 1:
The patent introduces an identity service server as an intermediary component that mediates between the application server and the authentication management server. This server receives authentication requests, correlates OpenID identifiers with subscriber identifiers, and manages the authentication process. By adding this intermediary layer, the system achieves improved authentication security through proper identifier correlation while maintaining manageable system complexity through clear separation of concerns and standardized interfaces.
2Reliability
If authentication challenge-response protocols are implemented, then authentication reliability is improved, but processing time and service delay increase
Solution Approach 1:
The patent implements preliminary action by having the identity service server pre-correlate OpenID identifiers with subscriber identifiers before actual authentication requests are processed. The server maintains ready-made correlations and can quickly retrieve matching subscriber information when authentication is needed. This pre-processing approach ensures authentication reliability through proper identifier matching while minimizing processing time during actual authentication events.
3Reliability
If monitoring for denial-of-service conditions is implemented, then service reliability is improved, but system resource consumption and processing overhead increase
Solution Approach 1:
The patent implements feedback mechanisms where the identity service server continuously monitors authentication requests and system conditions for signs of denial-of-service attacks. The server analyzes patterns in authentication requests, identifies abnormal conditions, and can trigger appropriate responses such as rate limiting or blocking suspicious sources. This feedback-based monitoring improves service reliability by detecting and mitigating attacks while managing resource consumption through intelligent analysis rather than exhaustive monitoring of all system operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are disclosed for enabling operators of communication networks to provide one or more identity services such as, for example, an authentication service. For example, in a communication network, assume that a first computing device is a client device, a second computing device is an application server, and a third computing device is a server under control of an operator of the communication network. A method may comprise the following steps. In response to the first computing device issuing a resource request to the second computing device and the first computing device providing a first identifier to the second computing device for use in authenticating the first computing device to the second computing device, and in response to the second computing device being unable to authenticate the first computing device, the third computing device assisting in the authentication of the first computing device to the second computing device when a correlation exists between the first identifier sent by the first computing device and a second identifier used by the first computing device to access the communication network as a subscriber, wherein the second computing device is able to reply to the resource request sent by the first computing device upon a successful authentication assisted by the third party computing device.