Authenticating users
A method of authenticating a user seeking access to a service from a service provider in a communication network, the method comprising: allocating to a user a plurality of service-specific identities for accessing respective services; issuing a request from the user, the request identifying the service to be accessed and including a public key of the user; at a certification authority, authenticating the request and issuing a public key certificate for binding the service-specific identity with the public key in the request, and returning the public key certificate to the user.
1. A method, comprising:
allocating to a user a plurality of service-specific identities to access respective services;
issuing a request from a user equipment, the request identifying the service to be accessed and including a public key of the user; and
at a certification authority, authenticating the request and issuing a public key certificate to bind a service-specific identity with the public key in the request, and returning the public key certificate to the user equipment.
2. The method according to claim 1 , wherein the request comprises a service identifier identifying the service to be accessed and a requester identifier identifying the user, the method comprising:
at the certification authority, mapping the service identifier and the requester identifier to the service-specific identity to be authenticated.
3. The method according to claim 1 , wherein the request identifies the service-specific identity and wherein the method comprises:
verifying by the certification authority that the user is authorized to use the service-specific identity.
4. The method according to claim 1 , comprising implementing the allocating, issuing, authenticating and returning in a wireless communications network.
5. An apparatus, comprising:
a processor configured to issue a request identifying a service to be accessed and including a public key;
a receiver configured to receive a public key certificate issued by a certification authority which associates a service-specific identity for the service to be accessed with the public key; and
a transmitter configured to forward the public key certificate to a service provider to authenticate the service-specific identity for the user which authorizes the access to the service.
6. The apparatus according to claim 5 , further comprising:
a controller configured to establish shared key material with the certification authority prior to issuing the request.
7. The apparatus according to claim 5 , further comprising:
a generator configured to generate an asymmetric key pair including the public key and a private key.
8. The apparatus according to claim 5 , wherein said request is issued over a wireless interface.
9. An apparatus, comprising:
a receiver configured to receive a request from a user equipment, the request identifying the service to be accessed and including a public key of a user; and
an authenticator configured to authenticate the request and issue a public key certificate for a service-specific identity of the service to be accessed and to return the public key certificate to the user equipment.
10. The apparatus according to claim 9 , wherein said receiver receives said request over a wireless interface.
11. A computer program embodied on a computer readable medium, said computer program configured to control a processor to perform:
issuing a request identifying a service to be accessed and including a public key;
receiving a public key certificate issued by a certification authority which associates a service-specific identity for the service to be accessed with the public key; and
forwarding the public key certificate to a service provider to authenticate the service-specific identity for the user which authorizes the access to the service.
12. A method comprising:
issuing a request identifying a service to be accessed and including a public key;
receiving a public key certificate issued by a certification authority which associates a service-specific identity for the service to be accessed with the public key; and
forwarding the public key certificate to a service provider to authenticate the service-specific identity for the user which authorizes the access to the service.
13. The method according to claim 12 , wherein the issuing comprises issuing the request comprising a message including a plurality of fields, one of said fields holding a service identifier to identify the service to be accessed.
14. The method according to claim 13 , wherein the field holding the service identifier is a subject field.
15. The method according to claim 13 , wherein the issuing comprises issuing the request comprising a public key certificate #10 message.
16. The method according to claim 13 , wherein the issuing comprises issuing the request comprising a certificate request message format message.
17. The method according to claim 13 , wherein the issuing comprises issuing the request comprising a hypertext transfer protocol message.
18. A system comprising:
apparatus configured to issue a request, the request identifying the service to be accessed and including a public key of the user; and
a certification authority configured to authenticate the request and issuing a public key certificate to bind a service-specific identity with the public key in the request, and returning the public key certificate to the user equipment.
19. The system according to claim 18 , further comprising:
an authentication server configured to authenticate the identity of the user issuing the request.
20. The system according to claim 18 , further comprising:
a federation database configured to map service and requester identifiers to service-specific identities to access respective services.