Concatenated authentication and authorization to multiple networks
In order to facilitate access to multiple networks, an electronic device may first authorize a portable electronic device to access a radio-access network associated with a network operator. In particular, the electronic device may provide a request with a first identifier for a portable electronic device to an authentication/authorization server for access to the radio-access network. After receiving first authorization information from the authentication/authorization server for the portable electronic device to access the radio-access network, the electronic device may provide a second request with a second identifier of the portable electronic device to a second server for access to a second network associated with the second server and an entity. Based on the subsequent response from the second server, the electronic device may provide access information to a radio node that allows the portable electronic device to access the radio-access network, or radio-access network and the second network.
1. An electronic device, comprising:
an interface circuit configured to communicate with a radio node, a portable electronic device, an authentication/authorization server and a second server, wherein the electronic device is configured to:
receive, via the interface circuit, a first identifier associated with a radio node for the portable electronic device, which is associated with a user;
provide, via the interface circuit, a request intended for the authentication/authorization server with the first identifier to request access to a radio-access network associated with a network operator;
receive, via the interface circuit, a response associated with the authentication/authorization server with first authorization information that indicates that the portable electronic device is allowed to access the radio-access network;
hold the first authorization information;
provide, via the interface circuit, a second request intended for the second server with a second identifier of the portable electronic device to request access to a second network associated with the second server and an entity;
receives, via the interface circuit, a second response associated with the second server with second authorization information, wherein the second request is provided after the response is received so that the first authorization information provides enhanced security to the second authorization information; and
provides, via the interface circuit, access information intended for the radio node and based on the second authorization information that allows the portable electronic device to access one of: the radio-access network, or the radio-access network and the second network.
2. The electronic device of claim 1 , wherein, when the second authorization information indicates that the user is allowed to access the second network, the access information allows the portable electronic device to access the radio-access network and the second network.
3. The electronic device of claim 1 , wherein, when the second authorization information indicates that the user is not allowed to access the second network, the access information allows the portable electronic device to access the radio-access network.
4. The electronic device of claim 1 , wherein the first identifier comprises one of: an International Mobile Subscriber Identity (IMSI) of the portable electronic device, a Mobile Subscriber International Subscriber Directory Number (MS-ISDN) of the user of the portable electronic device, or information specifying the user of the portable electronic device.
5. The electronic device of claim 1 , wherein the second identifier is different than the first identifier.
6. The electronic device of claim 1 , wherein the authentication/authorization server comprises a home subscriber server and the network operator comprises a mobile network operator.
7. The electronic device of claim 1 , wherein the electronic device provides a mobility management entity (WE) in an evolved packet core (EPC).
8. The electronic device of claim 1 , wherein the electronic device further comprises:
a processor; and
a memory, coupled to the processor, which stores program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform at least some of the operations performed by the electronic device.
9. A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions to authenticate and authorize a user in multiple networks, wherein, when executed by the electronic device, the program instructions cause the electronic device to perform operations comprising:
receiving, via an interface circuit in the electronic device, a first identifier associated with a radio node for a portable electronic device, which is associated with a user;
providing, via the interface circuit, a request intended for an authentication/authorization server with the first identifier for to request access to a radio-access network associated with a network operator;
receiving, via the interface circuit, a response associated with the authentication/authorization server with first authorization information that indicates that the portable electronic device is allowed to access the radio-access network;
holding the first authorization information;
providing, via the interface circuit, a second request intended for a second server with a second identifier of the portable electronic device to request access to a second network associated with the second server an entity;
receiving from the second server, via the interface circuit, a second response associated with the second server with second authorization information, wherein the second request is provided after the response is received so that the first authorization information provides enhanced security to the second authorization information; and
providing, via the interface circuit, access information intended for the radio node based on the second authorization information that allows the portable electronic device to access using the radio node one of: the radio-access network, or the radio-access network and the second network.
10. The computer-readable storage medium of claim 9 , wherein, when the second authorization information indicates that the user is allowed to access the second network, the access information allows the portable electronic device to access the radio-access network and the second network.
11. The computer-readable storage medium of claim 9 , wherein, when the second authorization information indicates that the user is not allowed to access the second network, the access information allows the portable electronic device to access the radio-access network.
12. The computer-readable storage medium of claim 9 , wherein the first identifier comprises one of: an International Mobile Subscriber Identity (IMSI) of the portable electronic device, a Mobile Subscriber International Subscriber Directory Number (MS-ISDN) of the user of the portable electronic device, or information specifying the user of the portable electronic device.
13. The computer-readable storage medium of claim 9 , wherein the second identifier is different from the first identifier.
14. The computer-readable storage medium of claim 9 , wherein the authentication/authorization server comprises a home subscriber server and the network operator comprises a mobile network operator.
15. The computer-readable storage medium of claim 9 , wherein the electronic device provides a mobility management entity (WE) in an evolved packet core (EPC).
16. A method for authenticating and authorizing a user in multiple networks, wherein the method comprises:
by an electronic device:
receiving, via an interface circuit in the electronic device, a first identifier associated with a radio node for a portable electronic device, which is associated with a user;
providing, via the interface circuit, a request intended for an authentication/authorization server with the first identifier for to request access to a radio-access network associated with a network operator;
receiving, via the interface circuit, a response associated with the authentication/authorization server with first authorization information that indicates that the portable electronic device is allowed to access the radio-access network;
holding the first authorization information;
providing, via the interface circuit, a second request intended for a second server with a second identifier of the portable electronic device to request access to a second network associated with an entity;
receiving, via the interface circuit, a second response associated with the second server with second authorization information, wherein the second request is provided after the response is received so that the first authorization information provides enhanced security to the second authorization information; and
providing, via the interface circuit, access information intended for the radio node based on the second authorization information that allows the portable electronic device to access using the radio node one of: the radio-access network, or the radio-access network and the second network.
17. The method of claim 16 , wherein, when the second authorization information indicates that the user is allowed to access the second network, the access information allows the portable electronic device to access the radio-access network and the second network.
18. The method of claim 16 , wherein, when the second authorization information indicates that the user is not allowed to access the second network, the access information allows the portable electronic device to access the radio-access network.
19. The method of claim 16 , wherein the first identifier comprises one of: an International Mobile Subscriber Identity (IMSI) of the portable electronic device, a Mobile Subscriber International Subscriber Directory Number (MS-ISDN) of the user of the portable electronic device, or information specifying the user of the portable electronic device.
20. The method of claim 16 , wherein the second identifier is different than the first identifier.