Patent Application
20230245085
The invention relates to secondary authentication of online content access according to claims 1, 13, 14, and 15.
Payment Systems
For online shopping, various possibilities exist to pay for ordered goods. Online shops often request new users to register with their real name and email address. During the shopping process, the mail address for shipping non-digital goods and credit card information is requested before a purchase is finally accepted by the online-shop. For digital goods like audio or video media data, the process is very much the same without the mailing address.
Alternatives to providing a credit card are various other types of bank accounts. Another alternative is to transfer money to the online shop via bitcoins, the worldwide virtual currency.
There are payment systems established that offer a payment service to shops and customers that have benefits over the simple registration described above. Some services include a registration only at the payment service, usually trusted by customers. These services require an email address to be provided to the online shop or not even that. The shop then requests settlement of a bill from the payment service and based on the mail address or even anonymous for the shop and after a login of the customer at the payment service, the payment service finally provides the registered shipping address to the online shop.
These and other payment service have in common, that they require not only an agreement to pay before the purchase is actually finalized, but already the payment to have taken place. For digital goods this means, the credit card is debited or the payment service transfers the purchase amount to the online shop before the digital data is delivered to the customer.
Laterpay
An exception of this basic mechanism is introduced in WO 2011/029560 (A2). The patent application describes a payment system and methods for a plurality of payment processes. The solution is further described on https://www2.laterpay.net, and will further be referenced as LaterPay functionality. The system and methods are invoked for a buyer system making a purchase in an online shop for a certain purchase amount. The system:
Simplified, the patent application describes a system that allows a buyer to make purchases online with a buyer system for a purchase amount which the buyer firstly does not have to settle. The payment system accumulates the amounts of purchases from the buyer system and only when the total amount of due payments exceeds a predefined value, the buyer is requested to settle the total amount or a part of it. The buyer system can be a PC or a mobile phone or the like. The purchases and purchase amounts are stored by the payment system in relation to a buyer system identification which does not include an identification of the buyer nor does it need a registration or any other user interaction. In absence of a user login or any other user identification, the system depends on a reliable identification of the buyer system, e.g. the mobile phone in combination with the used browser. This identification is getting more difficult as modern operating systems have means implemented to prevent user tracking and thus also user identification.
5G Secondary Authentication
The next generation mobile communication system, often referred to as 5G, offers a broad variety of new features. The architecture of the 5G system is described in [3GPP TS 23.501]. A Public Land Mobile Network (PLMN) based on the 5G architecture comprises a core network providing services to user equipment (UE) devices and to service providers outside the PLMN. The UE devices access the core network via one or more access networks which can be either the 5G New Radio access network, a legacy mobile radio network like LTE or UMTS, or a wire-line or Wireless LAN access network. UE devices accessing the core network are authenticated based on a shared secret stored in a subscriber data base of the PLMN and on the Subscriber Identification Module (SIM or USIM) of the UE device.
Recently, a new type of network was developed which is also based on a core network and one or more access networks, but that is not a public network (PLMN), but a Non-Public Network (NPN) that usually serves a specific purpose, e.g. the communication of humans and machines in an industrial plant. An NPN can apply an authentication mechanism that is different from that of a PLMN in that it may use other credentials than those typically stored on a USIM, e.g. certificates stored in the non-volatile memory. In this invention, we use the term PLMN for any kind of network, public or non-public and regardless of the credentials used for (primary) authentication.
One of the new features of the 5G system is the secondary authentication/authorization by a AAA server outside the PLMN. The feature allows a service provider outside the PLMN to authenticate and/or authorize a connection of a UE device to the service provider network. For that purpose, the PLMN has a policy storage that has a service provider specific policy stored which indicates that a secondary authentication and/or authorization is required for a connection to the service provider network. When a UE device requests from the PLMN a connection to the service provider network, a session management function (SMF) in the PLMN looks up the policy and determines the respective requirement.
If secondary authentication is required, the UE devices needs to provide to the SMF authentication information e.g. a subscriber identification that is used with the service provider, i.e. a user name, and respective credentials. This may be done in a request by the UE device for a connection to the service provider network. Alternatively, this may be initiated by the SMF following the reception of such connection request from the UE device. The SMF then serves as an EAP authenticator and transmits an EAP request requesting the credentials to be sent subsequently by the UE device. Either way, the UE device provides credentials to the SMF as part of the requested connection setup to the service provider network. These are then passed by the SMF to a AAA server of the service provider network, which is known by the SMF. Based on this information, the AAA server will authenticate the UE device and reply to the SMF with a result. The connection is only set up, if the authentication was successful. The mechanism has several advantages, one being that a connection setup is prevented, if a UE device cannot authenticate with the service provider so that resources and activities of the PLMN are saved in that case.
If only authorization is required, the UE device may omit any authentication information and the SMF may provide a Generic Public Subscription Identifier (GPSI), e.g. a Mobile Station International Subscriber Directory Number (MSISDN), or any other persistent identification, to the AAA server to identify the subscriber of the UE device. Based on the GPSI, the AAA server of the service provider network will provide the SMF with authorization data, i.e. whether or not the UE device should be allowed to establish the requested connection and further attributes of the connection, e.g. QoS information.
Any combination of the above described authentication and authorization may be used. The UE device may provide authentication information and the SMF may pass this information together with an additional GPSI to the AAA server and the determination, whether the UE device is allowed to access the service offered by the provider, may be based on the GPSI, on a UE device subscriber identification and/or a password or a certificate or the like. The details of the secondary authentication are described in [3GPP TS 23.501 § 5.6.6].
The mentioned Extensible Authentication Protocol (EAP) is specified in IETF RFC 3748, it defines some of the messages and message exchanges used throughout this invention disclosure.
Known web-based payment systems are either based on a user authentication involving user interaction and a registration or they are based on an automatic and unreliable buyer system identification to account for pay content.
Prior art is lacking a payment system that reliably identifies the user of a device without any user interaction or pre-registration and that allows a user to purchase and consume digital content with a minimum of user interaction while ensuring a fee for the content is reliably accounted.
The current invention uses an amended secondary authentication. The secondary authentication/authorization as defined in the 5G system architecture is enhanced so that together with a payment service provider network it builds a payment system that overcomes the described lack of the prior art.
WO 2018/137873 (A1) describes a user equipment device receiving an EAP request from an SMF for secondary authentication of the UE device. The UE device replies with an EAP response. The secondary authentication is authentication of the UE device in addition to primary authentication. The patent application at most describes the basic mechanism currently specified for 5G secondary authentication.
The objectives of the present invention are achieved by the subject-matter of claims 1, 13, 14, and 15. In particular, the deficiencies are achieved by a method for providing paid access to online content, the method comprising:
Advantages include a content payment authentication with improved reliability without a need for prior payment system registration.
In one embodiment, step b) further includes receiving a security token by the user equipment from a/the web server of the content provider; wherein step e) further includes providing the authentication server with the security token as secondary authentication credentials; and wherein step f) includes authenticate, by the authentication server, the content provider and/or the web server, using the security token.
In one embodiment, step b) includes receiving from a/the web server of the content provider, by the user equipment, a script embedded in a web page, the script including an identification of the online content and instructions to set up the first session with the address of the payment system; wherein the user equipment connected to a/the public land mobile network comprising a 5G core network is connected via the public land mobile network to the web server; and wherein the script, when executed on the user equipment, downloads information and further executable code from a payment server of the payment system.
In one embodiment, the script comprises information for accessing the online content that is only presented on the user equipment if the payment system determines that the online content has already been purchased, and otherwise presents purchase options on the user equipment; and wherein when rendering the web page of the content provider including the code, the user equipment will either immediately or after user interaction, establish a connection to the payment system for download of the information and the further code.
In one embodiment, the user equipment receives a web session identification embedded in a web page from a/the web server of the content provider and some of the downloaded information, such as content that provides access to pay content, is not immediately presented to the user.
In one embodiment, a/the public land mobile network is aware of the payment system, such as through a service level agreement between an operator of the public land mobile network and an operator of the payment system; and wherein the 5G core network has a policy storage data base attached to the policy function in which one or more policies related to the payment system are stored.
In one embodiment, step g) includes determining, by the payment system, if the user equipment has paid for the online content based on the persistent ID and an ID of the online content, and: if so, provide access to online content to the user equipment; if not, provide at least one option to pay for the online content.
In one embodiment, the method further comprises, in response to successful authentication in step f): allocating an IP address to the user equipment for accessing the payment system; provide the payment system with the IP address of the user equipment; storing, by the payment system, a map between the IP address and the persistent ID of the user equipment; and wherein step g) further includes determining the persistent ID based on the IP address of the user equipment and the stored map.
In one embodiment, the persistent ID is a Generic Public Subscription Identifier, preferably a Mobile Station International Subscriber Directory Number.
In one embodiment, the method further comprises: storing, by the payment system, in response to successful completed payment of the online content, in the user equipment, a token or an identifier of completed purchase; wherein the user equipment, in step a), provides the content provider with the token or the identifier; wherein the content provider requests, from the payment system, authorization of the requested online content using the token or the identifier; and wherein the content provider allows access to the online content to the user equipment in response to successful authorization.
In one embodiment, no further registration and/or credentials are required by the user equipment for accessing the content.
In one embodiment, step g) further includes determine an account of the user equipment based on the persistent ID; and step h) further includes monitoring the total payable debit of the account of the user equipment, and to request, after a predetermined time interval and/or on exceeding a predetermined value of total payable, settlement of at least part of the total payable.
The objective is further achieved by system comprising: a user equipment connected to a public land mobile network including a policy function and a core network managing functions, a content provider including server, such as a web server; and a payment system including an authentication server, such as an AAA server and/or a secondary authentication server; wherein the system is configured to perform the herein described method.
The objective is further achieved by a computer program comprising instructions to cause a system, such as the system above, to execute the steps of the herein described method.
The objective is further achieved by a computer-readable medium having stored thereon the above computer program.
In the following, embodiments of the invention are described with respect to the figures, wherein:
Starting with
The PDU session establishment request may comprise the web session identity and a security token. The SMF receives from a subscriber data base of the PLMN a public subscriber identity (GPSI). The SMF receives from the PCF information that requests the SMF to perform a secondary authentication and/or authorization with a AAA server of the payment system before the requested connection can be established (also ref 226 of
In a second step 902, the SMF transmits a request for authentication and/or authorization to a AAA server of the payment system and includes the received GPSI (also ref 228 of
In a third step 903, the payment system receives the request for authentication and/or authorization and determines, based on the received GPSI, an account in a data base of the payment system (also ref 230 and 240 of
It should be understood that the usage of the credentials provided by the UE device does not identify nor authenticate the UE device but the content provider and/or the web session between the UE device and the content provider. This is an enhancement of the current secondary authentication.
In a fourth step 904, the payment system transmits a reply to the request for authentication and/or authorization to the SMF which comprises an indication that the subscriber has been authenticated and/or authorized to access the payment system (also ref 242 of
In a fifth step 905 the SMF establishes the PDU session as requested (also ref 250 of
In a sixth step 906, the payment system determines information and/or code that is specific for the associated account and transmits, as a reply to the request for information and/or executable code, the information and/or code that is specific for the associated account. Specific in this step means that the functions, the number and the appearance of text elements and control elements transmitted to the UE device may be adapted to show information that is part of the account data or to present control elements only if they apply to the current status of the account. The payment system may for example determine from the account information, whether the pay content should be accessible to the user because the pay content is already purchased or whether options for purchasing the content should be provided to the user (also ref 310, 320, 322, 330, 340, and 342 of
In a seventh step 907, the UE device presents to the user information and/or one or more control elements that are specific to the account associated with the subscriber in the above-mentioned way. Access to pay content may for example be provided if it is determined from the account information, that the pay content is already purchased. In that case, code for rendering control elements for accessing the content, e.g. a play, read or download button, may be transmitted to the UE device. Otherwise, code for rendering control elements for purchasing the content with account dependent purchase options may be transmitted to the UE device (also ref 344 of
Depending on the presented control elements, the user of the UE device may select and activate one of the one or more control elements to purchase digital content based on the way of purchase associated with the control element (also ref 346 of
The payment system will then execute the payment according to the selected way of purchase, i.e. add the amount to the account's total due, settle (a part of) the account or settle the purchase or a part of the account for the right to forward personal information to a third party (also ref 350 of
The web session identification may be any kind of information associated by the UE device with the content provider, the content provider web service or the connection between the UE device and the content provider web server, e.g. an address used by the UE device or the web server. The web session identification may be received from the content provider web server as a cookie or as an information embedded in a script relating to the payment system or determined by the UE device in any other way. In a preferred embodiment, the web session identifier may be an identifier of pay content the subscriber of the UE device may have access to or may purchase access to. The web session identification may then identify specific content offered to the user via the content provider web server. The content is the subject of the purchasing activity enabled by the present invention.
The security token may be any kind of token generated by the content provider, e.g. in relation to the web session identification, based on a cryptographic algorithm and transmitted to the UE device to authenticate the web session towards the payment system. The security token may alternatively be information generated by the payment system, provided to the content provider and transmitted to the UE device.
The inventive steps of above method are mainly executed by the payment system, which is described in the following for better understanding of above method:
A payment system that offers executable code and/or information for download by a UE device via a PLMN that comprises a 5G core network, the payment system
And further, the payment system performing one or more of
The web session identification and/or the security token may be sent by the UE device to the SMF in a request for PDU session establishment, e.g. as a message part foreseen for username and password or as an authentication information container passed to the SMF in the PDU session establishment message.
In all cases, the 5G core network subscriber identification (GPSI) is not generated or sent by the UE device, it is stored in a subscriber data base, provided to the SMF and sent from the SMF to the AAA server so that the GPSI provides to the payment system a trusted identification of the subscriber of the PLMN.
The UE device 101 is connected to the PLMN 110 via an access network (AN) 111. The access network may be a 5G New Radio network, an LTE network, a WLAN access network or any other access network that provides access to the PLMN's core network. The core network comprises
The above-mentioned entities may be present in a core network multiple time, e.g. there may be multiple AMFs while for each UE device a single AMF is usually selected and there may be multiple SMFs and UPFs even for a single UE device, e.g. for different PDU sessions.
The first data network (Data Network 1) 115 may connect a UE device 101 to a content provider network 120 comprising a content provider web server 121 and a media repository (Media) 122. The Content provider offers a freely accessible web page providing information about the content in offer. In this example, the content may be streaming music offered by the content provider. A UE device 101 connecting to the content provider web server 121 via the PLMN 110 will setup a PDU session with the core network of the PLMN first to Data Network 1115 in order to be able to connect to the content provider web server. During setup of the PDU session, the UE device will receive a first IP-address that may be specific for the data network and that will be used by the UE device 101 when connecting to the content provider web server.
When a user of the UE device 101 selects from the content offered by the Web Server content to be streamed, a purchase mechanism according to the current invention will be executed that will result in a fee for the content being accounted for and the web server streaming the purchased content from its media data base. Obviously, similar setups are supported by this invention, i.e. the media data base does not have to be part of the same network as the content provider web server and the media may be streamed by another entity than the web server that is not shown in
The second data network (Data Network 2) may connect a UE device to a payment System comprising a server, e.g. a web server or an information and script server, a AAA server and an account data base (DB). The payment system may or may not be freely accessible, but when accessed through the PLMN 110, a connection needs to be authorized and the subscriber connecting to the content provider may need to be authenticated. Again, for connecting to the payment system via the PLMN 110, the UE device 101 will setup a PDU session to Data Network 2116 and received a second IP-address that may be different from the first IP-address.
For a secondary authentication between the PLMN 110, specifically an SMF 113 of the PLMN, and the AAA server 131 of the payment system, the SMF and the AAA server establish a connection and keep that connection as long as the UE device has the related connection to the payment system server. The connection between SMF 113 and AAA server 131 is shown as dashed line because the logically direct connection may in fact be established through the UPF and Data Network 2, which is omitted in
In a first embodiment of the present invention, the UE device may be registered 210 in the PLMN 110, a primary authentication based on credentials stored on a USIM of the UE device has been performed and a web session has been established between the UE device 101 and the content provider 120, i.e. a PDU session between the UE device 101 and DN 1115 has been established.
The web page or web content of the content provider is requested by the UE device, typically in a HTTP-request 212 comprising the resource locator of the content that is requested. As part of the HTTP-response 214 comprising the web page, a script is downloaded that comprises a link to or a source information linking to a payment system. The script, when executed on a mobile device, loads more information, text and/or executable code from a payment system server referenced by the link or source information. Within the script or as another part of the web page download, the UE device receives a content identity of media content the user of the UE device seeks to stream (Content ID) and a security token.
The Content ID could, for example, be constructed from known address information, e.g. an IP-addresses of the content provider web server 121 and the UE device 101, a URL to the content resource in the content provider network. The Content ID may otherwise identify more than one piece of content, e.g. it may identify the content provider as a whole. It could otherwise be a random number generated by the content provider web server identifying the content. The Content ID in this example may be a URL providing access to the content on a content provider server.
In this example, the security token may be a cryptographic signature of the Content ID, calculated with a private key of the content provider. The security token may be used by the UE device to authenticate the content provider based on an available public key, e.g. as part of a certificate downloaded in addition. In this embodiment. the security token will be used for authenticating the content provider and/or the content by the payment system in a later step.
When rendering the downloaded web page content, the script is executed, and a link or a source information in the script triggers a connection setup to the payment system. It may be that the browser application triggers the modem of the UE device 101 to setup a new connection to the linked address via an API of the operating system (OS) of the UE device 101, providing the Content ID and the security token with the request. It may be that the code in the script comprises information that triggers the delivery of the Content ID and the security token. Alternatively, the browser application determines that the two parameters need to be delivered to the connection setup. The modem in the UE device will then determine 220 that a new connection needs to be setup which requires a new PDU session targeted to the payment system address provided by the link information in the script. The UE device, that is the cellular modem in the UE device, will transmit a PDU Session setup request message 222 to the Core Network Managing Functions (CNMF) 140 via the AN 111 comprising the Content ID and the security token.
It is one of the inventive aspects of this invention that a UE device uses a Content ID and a security token as authentication credentials provided to the CNMF 140, as these parameters differ from the parameters currently foreseen to be used. The currently known usage of the 5G secondary authentication requires the UE device to provide credentials that identify and authenticate the subscriber or the UE device towards a service provider. However, the Content ID does not identify the UE device and the security token does not authenticate the UE device towards the payment system. Thus, one of the inventive steps in this invention is to base the authentication of the UE device 101 in the payment system 130 on the GPSI received from the 5G core network and using the transport of credentials in the secondary authentication for identifying the content provider, the web session to the content provider, or pay content of the content provider and authenticating the content provider, the web session or the content in the payment system.
When the message is received by the SMF 113, which is a part of the CNMF 140 of
In an alternative embodiment, the UE device or its cellular modem will request a PDU session at the CNMF without providing the Content ID or the security token. In this alternative, after the SMF determined from a policy that a secondary authentication is required before setup of the connection to the payment system can be pursued, the SMF acts as an EAP authenticator as described in the EAP specification and transmits an EAP request to the UE device requesting missing credentials for authentication of the UE device at the payment system. The UE device will then provide these credentials in an EAP response. The method of this alternative embodiment is otherwise identical with the described method. The credentials, as stated above, may be for identifying the content provider, and not for identifying the UE device.
In yet another alternative embodiment, the UE device or its cellular modem will request a PDU session at the CNMF without providing the Content ID or the security token and the SMF determines from a policy that a secondary authorization but no authentication is required before setup of the connection to the payment system can be pursued. This leads to the SMF not providing any credentials for authentication to the AAA server but only the GPSI.
The PCF 117 will now look up policies in its policy storage (data base 118) and determine related policies. It is assumed that the operator of the payment system 130 and the operator of the PLMN 110 have a service level agreement and the PLMN has stored policies related to PDU session targeting the payment system. One rule of such policy may be that for PDU sessions targeting the payment system, a secondary authentication/authorization has to be performed successfully before the PDU session can be set up. The PCF will provide the policy 226 to the SMF (CNMF) including the address of the AAA server of the payment system against which the authentication/authorization has to be performed.
The SMF now requests authentication and/or authorization from the AAA server indicated in the policy. The SMF sets up a communication session with the AAA server which is assumed to be done by transmitting a SMF/AAA Session Request message 228 to the AAA server. This message may include a request for authentication or authorization which includes a Global Public Subscriber Identity (GPSI), the Content ID and a security token. The GPSI may be an MSISDN or a similar identity of the subscriber of the UE device. Alternatively, the GPSI may be a target specific subscriber identifier, i.e. the PLMN generates a unique ID for the subscriber for each target network, to which the PLMN provides an ID. This will enable target networks to identify and recognize subscribers without receiving a globally unique number that allows tracking over multiple services. The unique ID may be a cryptographic hash of a combination of the GPSI and a target network ID, preferably with a secret number sufficient large to prevent brute-force search.
The AAA server 131 in the payment system 130 may first authenticate 230 the content provider to ensure that the connection that is requested by the SMF to be authorized is setup in relation to a web session with the correct content provider. It may do so by verifying the signature of the Content ID provided via the security token using a known, i.e. stored, certificate or public key of the content provider.
After the content provider and thus the web session between the UE device and the web server is authenticated, the AAA server of the payment system will query the GPSI in its data base to determine an account 240 related to the GPSI. If such an account is found, it is associated with the connection to the SMF. If such an account is not found, a new account is created, stored in the data base and associated with the GPSI and the connection to the SMF. The payment system AAA server 131 then sends a SMF/AAA Session Accept message 242 to the SMF to confirm authentication of the subscriber and/or authorization of the connection. The AAA server may include the GPSI in the message to ensure the SMF associates the message to the correct PDU session setup procedure. Obviously, in other embodiments, the session request and accept and the authentication/authorization may be performed in separate messages.
The core network will then finalize the PDU session setup and allocate an appropriate IP-address to the PDU session to be used by the UE device 250. Further it will notify the AAA server of the payment system about the newly allocated IP-address in an SMF/AAA Session Modification message 252 and the AAA server will store this address to associate all communication to and from that address with the determined or newly created account. A message may optionally be sent by the AAA server to the SMF acknowledging the modification, the optionality being indicated with a dashed line 254 in
The SMF will now inform the UE device about the finalized and accepted PDU session setup and the related IP-address 256. This information may alternatively be sent to the UE device as part of the PDU session establishment before or during the AAA server is informed about the new IP-address. In general, the steps of the described method do not necessarily need to be performed in the described order but any order that leads to the same basic functionality will be an embodiment of the inventive method.
The message sequence chart of
The payment system will now determine 310 from the account information whether the subscriber has already access to the pay content. This is done based on a content identification, e.g. the Content ID, and information stored as part of the account information in a data base of the payment system. If the UE has access 320, the payment system will determine information for transmission 322 to the UE device that renders control elements for accessing the content, otherwise 330 it will determine 340 account specific information and code to be transmitted 342 to the UE device that renders 344 purchasing options as a response to the request.
Now switching the description to
The buttons are different for the two devices. UE 1 is offered a purchase of the album for 99ct with advertisements being included, e.g. between songs of the album, without immediate payment, a total due of 1.98 USD is shown for information. Alternative, the album is offered for 1.99 USD without ads and without immediate payment. Both these options may involve LaterPay functionality of deferred payment as explained above. In another alternative a purchase is offered for allowing the payment system to provide personal information to a sponsor, the sponsor paying for the purchase in reply. This example might not include LaterPay functionality. UE 2 is offered a purchase for the same price but requires an immediate settlement of the total due, since it is over a pre-set threshold (in the example, the total due is 5.73 USD). The alternative purchase method for UE 2 is similar to the one offered to the user of UE 1 but with a different, UE specific sponsor. The sponsor may be determined by the payment system based on account information, e.g. based on past purchases, settlement methods, age, gender or other personal information of the subscriber of the respective UE devices.
Switching now back to
When the user selects 346 a method for purchasing the album, user interaction with the respective control button triggers a message 348 from the UE device to the payments system which will then execute the payment 350 according to the selected method. The execution is not shown in
After the payment is executed, the UE device is given access to the content. This may be done in several ways. One way of doing so is to refer the browser of the UE device to the content provider's web page which reloads the web page. In this case, the repeated check for the Content ID against the account information will result in immediate access 320 to the pay content as shown for UE 3 in
In an alternative embodiment, that is not shown in the figures, the payment system provides after execution of the payment to the UE device a replacement of the code and information previously transmitted to the UE device, e.g. to change the offered control buttons into text elements acknowledging the purchase of the content and providing the new balance of the account and/or providing control elements for playing the content just purchased.
In alternative embodiments, a web session identification is transmitted in the web page information, e.g. in the downloaded script, from the content provider to the UE device and the web session identification is used by the UE device replacing the Content ID in the PDU session establishment request and by the SMF in the request to the AAA server of the payment system for authentication of the connection. Identifying the web session instead of specific content may be used by the payment system to authenticate the content provider and ensure, the accounting and purchasing is for real content and the subscriber has not accessed a fake web page. In some embodiments it may be foreseen that the payment system and the content provider system have a direct connection and the web session identification received from the UE device may be used by the payment system as a reference in communication with the content provider.
In a different embodiment of the current invention, a subscriber accesses via his UE device and via a PLMN a social media platform. An artist may provide information and/or content for users to look at, stream or download. The social media platform may enable contribution buttons on the web appearance for artists which offer content for free. Users are offered these to donate small amounts to the artists of they like their content.
The embodiment is using a similar setup and method as explained with relation to
The UE is registered in a PLMN that comprises a 5G core network with the elements shown in
A policy in the core network will trigger the SMF to request authentication and/or authorization from the AAA server of the payment system based on a GPSI and optionally taken into account the Content ID and the security token. The payment system will determine an account, or generate a new account, and acknowledge the connection setup. The payments system will receive the IP address of the UE device to associate it with the account. The UE device will connect to the payment system via the new established connection and request the additional information and/or executable code.
Now, the payment system will determine, based on a total due of the account, whether a donation may be done without immediate payment and what the amount of the total due. The payment system will then generate code and information for transfer to the UE device for rendering controls offering donation options without immediate payment. The payment system may in addition or instead generate code to rendering controls offering donation options combined with a settlement of the current total due or a part thereof. The payment system may in addition or instead generate code for presenting information to the subscriber of how much the total donation of the subscriber to this artist is. The code and information are transmitted to the UE device and rendered so that the subscriber may activate a donation button of his choice. No choice has to be done in the payment system in this embodiment as to whether immediate access to content should be given to the subscriber, but account specific controls are identified based on the account information identified from the GPSI received from the 5G core network.
A selection and activation by the subscriber of a control button will cause the payment system to execute the donation including a potential settlement and refer the browser back to the social media platform to reload the web page and refresh the donation and account information.
A message flow of a further embodiment is shown in
In this embodiment, a UE device 101 may have a connection via a PLMN to a content provider web server 120 (710 of
The content provider web server then transmits to the payment system AAA server 131 a request for authorizing access 714 to the content offered on the web page of the content provider for the subscriber identified by the token. The AAA server of the payment system determines an account based on the token and further determines whether access to the content identified in the request has been purchase by the subscriber previously 720. If so, the payment system authorizes the access to the content by replying to the content provider with the information that the content should be accessible by the subscriber. In that case, the web server of the content provider can adapt the web content transmitted to the UE device so that it comprises means for accessing the content, e.g. a download, play or read button. This case is not shown in
If the payments system does not have stored an account matching the subscriber identification given by the token or it determines from an account of an identified subscriber that the content has not yet been purchased, a negative reply is provided in the authentication response 722 to the content provider. This case is shown in
When the user activates the purchasing buttons, they trigger a PDU session setup including a secondary authentication as in the previous embodiments. The UE device will send a PDU session establishment request 742 to the core network and include the token from the cookie identifying the UE device. The token may have been stored on the UE device in a previous web session over another network than the 5G core network by the payments system. In that case, the token is associated by the payment system with an account which is not yet associated with the subscriber identification provided to the payment system by the 5G core network in the secondary authentication (GPSI). The transmission of the token in the request from the UE device to the core network and the subsequent transmission 748 from the core network to the AAA server 131 of the payment system together with a GPSI thus allows an association of a previous account, yet unrelated to the 5G subscriber identity, with the GPSI. This is an advantage of the current invention that may also be used in the previous embodiments.
The payments system will determine 760 the account, either associated with the provided GPSI, if any, or associated with the provided token or cookie-based identity, and it will merge accounts, if multiple accounts are found. If no account is found, a new account is created. The payments system will acknowledge the authentication and/or authorization of the connection to the UE device and the core network will finalize 810 the PDU session setup and it may inform 812 the payment system about the newly assigned IP-address (now continued on
The UE device can now request 818 the account specific code and/or information for purchase options which are then presented 830 to the user, similar to the previous embodiments yet without the direct access options provided by the browser at this stage of the procedure as this option has been eliminated by the content provider web server during the initial web page request.
All of the embodiments described herein are described to use a browser on the UE device side to access a web server at the content provider or social media platform side. It should be understood that the embodiments basically work the same or very similar of a native application on the UE device side access an application server on the content provider or social media platform side. The referral to the original web page to refresh the presented information may then be replaced by a similar application specific trigger to render the shown content anew but the inventive steps basically stay the same.
To further increase security, an encrypted secret may be generated by the content provider. The payment system may have a key to decrypt the secret as proof of completed purchase. The User Equipment may not have this key. Encrypted secret may be a random number. The encrypted secret may be encrypted using a symmetric key, known by both the Content Provider and the Payment System. The encrypted secret may also be encrypted by a public key of the Payment System, e.g. using certificates. The encrypted secret may be decrypted by the Payment System and may be provided decrypted to the User Equipment only after completion of payment procedure. The payment procedure may include a selection of pay the content later, or allowing a third party to pay the content, e.g. in return for sharing of information. The User Equipment may provide the decrypted secret to the Content Provider as a proof of payment or selected options of gaining access to the paid content. The User Equipment may be allowed access to the content only if successful decrypted secret is provided to the content provider. The encrypted secret may be valid for a limited period of time. In such case, when the time limit expires, the User Equipment may be re-directed to the payment system to decrypt a new secret for the same content. The Content Provider may track secrets and corresponding access to content. The encrypted secret may be part of the Security Token, or separate from the Security Token. The decrypted secret may be provided to the User Equipment together with code for accessing the requested content.
| Number | Date | Country | Kind |
|---|---|---|---|
| 20181449.8 | Jun 2020 | EP | regional |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2021/064840 | 6/2/2021 | WO |
