Method and system for managing network identity

[0001] This application claims the priority benefit of Taiwan application serial no. 97129549, filed on Aug. 4, 2008. The entirety of the above-mentioned patent application is hereby incorporated by reference herein and made a part of this specification.

[0002] 1. Field of the Invention

[0003] The present invention relates to an untrackable method and system for managing network identity.

[0004] 2. Description of Related Art

[0005] Currently, there are many wireless technologies, such as Worldwide Interoperability for Microwave Access (WiMax) and Wireless Local Area Network (WLAN), which utilize Extensible Authentication Protocol (EAP) structure. FIG. 1 is a schematic diagram of a conventional EAP authentication model including three roles, wherein a mobile device 101 is equivalent to a supplicant, an access point 102 (AP) is equivalent to an authenticator, and an authentication, authorization, and accounting server (abbreviated as AAA server) 103 is equivalent to an authentication server. When a user wishes to use the mobile device 101 to connect to a network, he has to provide an identification (ID) to the access point 102, and then the access point 102 transmits the ID to the AAA server 103 so as to perform authentication, authorization, and accounting operations based on the user's identity.

[0006] The authentication model in FIG. 1 assumes that the three roles are all on a same network operated by a same network operator or a same Internet Service Provider (ISP). However, EAP may in fact be applied on an inter-domain network, as shown in FIG. 2. Three networks are illustrated in FIG. 2, a home network 230 which the user originally established an account, a visited network 210 which the user wishes to connect, and a proxy network 220 between the said two networks. The above three networks are respectively operated by different network operators or ISPs.

[0007] When the user wishes to connect to the visited network 210, he has to use the mobile device 201 to provide an ID to the access point 211 of the visited network 210. The visited network 210 does not have data about the user's identity but the home network 230 does. Therefore, the access point 211 has to transmit the ID all the way to an AAA server 231 of the home network 230 for authentication, authorization, and accounting. The access point 211 and an AAA server 212 of the visited network 210 and an AAA server 221 of the proxy network 220 merely relay packets in between and do not participate in the process of authentication between the mobile device 201 and the AAA server 231.

[0008] With more and more emphasis being placed on privacy, users generally wish to use temporary IDs on an untrustworthy network environment to prevent network position and privacy (e.g. the websites which are visited) from being disclosed. The issue of privacy is more important in the abovementioned untrustworthy network environment which may refer in general to all the visited networks outside of the home network, especially a public wireless area network environment where malicious fake access points may exist.

[0009] The privacy issue in a same network domain may be solved by using Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS) or Protected Extensible Authentication Protocol (PEAP). However, in a cross-domain environment as shown in FIG. 2, the current EAP may not be enough to solve the problem. For privacy, the mobile device 201 may use an anonymous temporary ID and Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) or EAP-TTLS to establish a secure channel with the AAA server 231 of the home network and then transmit an encrypted real ID to the AAA server 231 for authentication. However, this way, the AAA server 212 of the visited network in between is not able to decode the encrypted real ID of the user and thus can not perform accounting and authorization.

[0010] Because the EAP structure can not provide functionalities of privacy protection, accounting, and authorization at the same time, Internet Engineering Task Force (IETF) proposed RFC 4372 standard to solve this problem. A chargeable user identity (CUI) is introduced in this standard to add a new field in an EAP packet to carry a temporary ID for ISP charges. However, the CUI still has a few problems. For example, the CUI is only for temporary use. If the CUI is used for a long period of time, it may still be used to identify the user. Only the ISP that issues the user's real ID knows the corresponding relationship between the CUI and the real ID. Thus, the CUI has to be transmitted in plain text so that the network operator of the visited network may use the CUI to charge a fee from the ISP of the user's home network. This is because EAP lacks an effective mechanism to manage the CUI.

[0011] Exemplary embodiments consistent with the present invention provide a method and system for managing network identity which are used to manage temporary IDs and real IDs of users and may provide functionalities of anonymity, accounting, and authorization at the same time.

[0012] Exemplary embodiments consistent with the present invention provide a method for managing network identity. The method includes the following steps. First, a mobile device applies for a first short-term certificate from an ID management server (IMS). The first short-term certificate includes a temporary ID of a user of the mobile device. Then, the mobile device uses the temporary ID to log into a visited network to which an authentication device belongs and uses the first short-term certificate to establish a secure channel with the authentication device. The mobile device uses the visited network through the secure channel. All network packets sent from the mobile device are relayed by the authentication device.

[0013] Exemplary embodiments consistent with the present invention further provide a system for managing network identity. The system includes a mobile device, an authentication device, and an ID management server. The mobile device applies for a first short-term certificate from the ID management server. The first short-term certificate includes a temporary ID of a user of the mobile device. The mobile device uses the temporary ID to log into a visited network to which the authentication device belongs and uses the first short-term certificate to establish a secure channel with the authentication device. The mobile device uses the visited network through the secure channel. All network packets sent from the mobile device are relayed by the authentication device.

[0014] In order to make the aforementioned features and advantages of the present invention more comprehensible, several embodiments accompanied with figures are described in detail below.

[0019] The method and system for managing network identity of the exemplary embodiments consistent with present invention realize a mechanism for managing temporary IDs and real IDs and provide functionalities such as anonymity, accounting, and authorization at the same time. In addition, the present invention may protect IDs from being falsely assumed, reduce risks of falsely incurred charges, lower the difficulty of integrating network operators, and speed up authentication of users.

[0020] In one exemplary embodiment, FIG. 3 illustrates a system for managing network identity and the flow of process of the method for managing network identity which the system executes. The system for managing network identity of the present embodiment includes a mobile device 301, an access point (authentication device) 311, AAA servers (also referred to as accounting servers) 312 and 321, an ID recorder (IDR) 322, and an ID management server (IMS) 323. The abovementioned six network apparatus are connected through a network. The access point 311 and the AAA server 312 belong to a visited network 310. The AAA server 321, the ID recorder 322, and the ID management server 323 belong to a home network 320 which the user originally established an account. The home network 320 and the visited network 310 are operated by different network operators or ISP providers.

[0021] The mobile device 301 is a device which the user uses to connect to a network and may be a mobile phone, a personal digital assistant (PDA), a notebook computer, or other mobile electronics that may connect to a wired or wireless network. The function of the access point 311 is to authenticate the user's identity and relay all network packets of the mobile device 301. In the present embodiment, the mobile device 301 connects to a wireless network so the access point 311 is used to authenticate the user. In another embodiment of the present invention, the mobile device 301 may connect to a wired network. Then, the access point 311 may be replaced with other authentication devices such as a switch or a router.

[0022] The visited network 310 uses the AAA server 312 to calculate charges. The home network 320 uses the AAA server 321 to confirm the user's identity and calculate charges. The ID recorder 322 is used to record corresponding relationship between temporary IDs and real IDs of users. The ID management server 323 is used to issue a short-term certificate of the user. The flow of process of the method for managing network identity in FIG. 3 is illustrated below step by step.

[0023] First, at step S301, the user may apply for the short-term certificate from the ID management server 323 of the home network 320 through the mobile device 301 before the user wishes to connect to the visited network 310. The short-term certificate includes a temporary ID of the user which enables the user to anonymously use the visited network 310. The temporary ID may be used to pay charges. The mobile device 301 may provide a user's original long-term certificate to apply for the short-term certificate from the ID management server 323. Alternatively, the mobile device 301 may provide the user's real ID and a password to apply for the short-term certificate from the ID management server 323.

[0024] The difference between the long-term certificate and the short-term certificate is the valid period. The long-term certificate has a longer valid period such as one or two years; the short-term certificate has a shorter valid period such as a half day or one day. The short-term certificate has to be re-applied periodically or every time before using the visited network. The long-term certificate is a certificate used in a conventional public key infrastructure (PKI) in which both parties not only have to authenticate each other but also have to look up a certificate revocation list (CRL) at a specific server to make sure that the other party's certificate is still valid. The short-term certificate is discarded after use and has a short valid period so it is relatively safe, has the effect of anonymity, and is not traceable. In addition, the valid period of the short-term certificate is very short so it is not required to look up the certificate revocation list when performing authentication, thereby simplifying management and maintenance.

[0025] After the mobile device 301 applies for the short-term certificate, at step S302, the ID management server 323 stores the temporary ID and the real ID of the user in the ID recorder 322 to prepare for future look-up.

[0026] Afterward, at step S303, the mobile device 301 uses the temporary ID in the short-term certificate to log into the visited network 310 through the access point 311. The access point 311 uses the short-term certificate the user obtained to authenticate the mobile device 301. The access point 311 also prepares a short-term certificate of itself for the mobile device to authenticate. The self-prepared short-term certificate of the access point 311 may be periodically issued to the access point 311 (i.e. the authentication device) by the AAA server 312 of the visited network 310 or may be periodically applied by the access point 311 from the AAA server 312. Then, the mobile device 301 and the access point 311 establish an encrypted secure channel using an Extensible Authentication Protocol—Transport Layer Security (abbreviated as EAP-TLS hereafter). Step S303 is similar to a conventional EAP-TLS but with two main differences. One difference is that the authentication process is moved from between the mobile device and the AAA server to between the mobile device and the access point. In other words, the access point 311 supports the authentication process of EAP-TLS such that the network transmission time may be reduced. The other difference is the use of the short-term certificate and not the conventional long-term certificate. The short-term certificate has a short valid period and hence does not have the concern of being deciphered and stolen. Both parties of the authentication process may directly trust each other without having to check the certificate revocation list, thereby reducing transmission time of the backbone network and authentication delay.

[0027] After establishing a secure channel, at step S304, the access point 311 transmits a charge message to the mobile device 301 to inform about the charge calculation schedule of using the visited network 310. Step S304 is for the user and the visited network 310 to negotiate a usage charge rate. For example, after the mobile device 301 receives the charge message, a dialog box explaining the charge calculation schedule may be displayed to inquire if the user accepts it. The mobile device 301 may also simultaneously display a plurality of charge calculation schedules in the dialog box for the user to choose or refuse.

[0028] At step S305, after the user accepts the usage charge rate of the visited network 310, the mobile device 301 transmits a responsive usage message to the access point 311. The usage message includes the user's short-term certificate and a digital signature indicating that the user accepts the charge calculation schedule. The access point 311 may use s public key in the user's short-term certificate to authenticate the user's digital signature. If the authentication passes, the user's identity may be confirmed. After the access point 311 authenticates the user's digital signature, as shown in step S307, the user may use the visited network 310 through the secure channel between the mobile device 301 and the access point 311. At step S306, the usage message is transmitted to the AAA server 312 through the access point 311. After the AAA server 312 authenticates the user's digital signature, a usage record may be established according to the usage message to record the time and charge of the user using the visited network 310.

[0029] Afterward, the AAA server 312 of the visited network 310 and the AAA server 321 of the home network 320 may perform a settlement regarding the abovementioned charge, as shown at step S308 to step S313. The settlement at step S308 to step S313 may be an online settlement or an off-line settlement. The online settlement is performed at the same time when the mobile device 301 uses the visited network 310, while the off-line settlement is performed after the mobile device 301 logs off the visited network 310. The off-line settlement may be performed periodically, for example, once a day or once a month.

[0030] As shown at step S308, the AAA server 312 transmits the usage message to the AAA server 321. The mobile device 301 generates and transmits the user's digital signature after the user accepts the usage charge of the visited network 310 so that the user can not deny having used the visited network 310. As a result, the visited network 310 may charge the home network 320 without needing to have a direct roaming agreement with the home network 320.

[0031] Next, at step S309, the AAA server 321 receives the usage message, wherein the short-term certificate includes the user's public key which is used by the AAA server 321 to authenticate the user's digital signature. If the digital signature does not pass the authentication, the AAA server 321 returns a failure message to the AAA server 312 at step S310-1.

[0032] If the digital signature passes the authentication, the AAA server 321, at step S311, inquires the user's real ID from the ID recorder 322 based on the user's temporary ID. If the real ID is looked up, the user's identity is confirmed. Next, the AAA server 321 establishes a record using the real ID at step S312 and then returns a success message to the AAA server 312 at step S310-2.

[0033] At step S313, the AAA server 312 of the visited network 310 may charge the AAA server 321 of the home network 320 for use of the visited network 310 after receiving the success message. The access point 311 may record the time that the user uses the visited network 310 based on the usage message transmitted by the mobile device 301. Then, the AAA server 312 may obtain the user's temporary ID and the time and charge that the user uses the visited network 310 from the access point 311 so as to charge the AAA server 321. The AAA server 321 has established a corresponding usage record at step S312 and may inquire the ID recorder 322 about the corresponding relationship between the temporary ID and the real ID so as to examine if the charge calculation schedule provided by the AAA server 312 is correct. The operator of the visited network must have the user's temporary ID and digital signature to calculate the charge and this prevents risks such as stolen IDs and overcharges.

[0034] In summary, the method and system for managing network identity of the present invention realize a mechanism for managing temporary IDs and real IDs and provide functionalities such as anonymity, accounting, and authorization at the same time.

[0035] A short-term certificate and a corresponding public/private key pair are used to protect a temporary ID usable for accounting. This protection prevents the temporary ID from theft.

[0036] In the present invention, the user generates a digital signature with respect to the usage charge explanation message from the visited network. This process incorporates the current EAP-TLS structure authentication method and achieves an undeniable accounting mechanism applicable in a cross domain network of multiple network operators. In addition, these operators do not need to have one-to-one business agreements and this reduces the difficulty of integrating network operators.

[0037] The method and system for managing network identity of the present invention do not require looking up the certificate revocation list. As a result, the authentication process only occurs between the mobile device of the user and the authentication device (e.g. an access point of a wireless area network). Therefore, the authentication time will not increase, which is advantageous for Voice over Internet Protocol (VoIP) or instant service of multimedia streaming.

[0038] It will be apparent to those of ordinary skills in the technical field that various modifications and variations can be made to the structure of the present invention without departing from the scope or spirit of the invention. In view of the foregoing, it is intended that the present invention covers modifications and variations of this invention provided they fall within the scope of the following claims and their equivalents.