OpenID Provider Segmentation for Mobile Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for mobile devices, such as username and password combinations, are cumbersome due to their compact size and limited keyboard capabilities, and existing standards like OpenID and Generic Bootstrapping Architecture (GBA) require significant changes across the telecommunications network ecosystem, which has limited their adoption.
Innovation Solution
Integrating OpenID with a telecommunications network by splitting the OpenID provider into an internal and external system, where the internal provider resides within the carrier's private network and is connected to the Gateway GPRS Support Node (GGSN), allowing device credentials-based authentication, reducing the need for username and password entry by leveraging the telecom carrier's trust relationship.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username and password authentication is used for mobile devices, then security can be maintained, but user convenience deteriorates due to compact device size and limited keyboard capabilities
Solution Approach 1:
The OpenID provider is segmented into two distinct systems: an external OpenID provider in the public network for initial authentication requests, and an internal OpenID provider in the carrier's private network for credential verification. This segmentation allows the system to leverage device credentials automatically rather than requiring manual username/password entry, resolving the contradiction between security and convenience
Solution Approach 2:
The internal OpenID provider acts as an intermediary between the GGSN and the external OpenID provider. It receives authentication requests from the external OP, validates them against device credentials stored in the HLR/HSS, and returns verification results. This intermediary enables automatic credential-based authentication without requiring users to manually enter passwords on mobile devices
2Adaptability or versatility
If OpenID is integrated with GBA using existing standards, then authentication functionality can be achieved, but system complexity increases requiring additional network hardware, code modifications, and handset changes
Solution Approach 1:
The invention merges the OpenID authentication framework with the existing GBA infrastructure by having the internal OpenID provider communicate with the GGSN, which already has access to device credentials through the HLR/HSS. This integration leverages existing network components rather than requiring additional hardware or extensive modifications to handsets and application code
Solution Approach 2:
The internal OpenID provider serves multiple functions: it validates OpenID authentication requests, communicates with the GGSN to verify device credentials, and returns authentication results to the external OpenID provider. This multi-functional component enables credential-based authentication without requiring separate systems for each function, reducing overall system complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A solution is described which allows mobile devices to specify that certain sites are allowed to be logged into based on the device credentials alone. The solution integrates OpenID with a telecommunications network in order to verify the user's identity. This verification is based on the trust that the telecom carrier has to identify the subscriber at the GGSN. The solution splits the OpenID Provider (OP) into two systems - an internal OP and an external OP. The external OP can reside in the public network and can allow the user to authenticate with a password. The internal OP resides in the private network of the carrier and is directly connected to the GGSN such that it is only reachable from the GGSN.