Patent Publication Number: US-9432801-B2

Title: Location-based service system and serving method

Description:
CROSS-REFERENCES TO RELATED APPLICATIONS 
     This application claims under 35 U.S.C. §119(a) the benefit of Taiwanese Application No. 100141767, filed Nov. 16, 2011, the entire contents of which is incorporated herein by reference. 
     FIELD OF THE INVENTION 
     The present invention relates to location-based service systems and methods, and, more particularly, to a location-based service system and method for distributed authentication using international mobile subscriber identities of communication devices. 
     BACKGROUND OF THE INVENTION 
     With the widespread of network apparatuses, most telecommunication service providers offer location-based services equipped with a Global Positioning System (GPS) and an Assisted Global Positioning System (AGPS), so that communication devices are able to obtain a wide range of services via network. 
     For example, a location-based service may allow a user to search for events happening around his/her location using a mobile phone (a communication device), thereby increasing consumer options in areas such as food, clothing, housing, transportation, education, entertainment and etc. However, in the process of using the location-based service, illegal parties may obtain the location information of the user by exploiting system vulnerabilities, or other individual subscriber information stored in a cloud server, this will violate individual privacy. Even with the advent of “Amazon EC2” system or “SQL Azure” system, this shortcoming is still not eliminated. 
     Therefore, there is an urgent need to eliminate information leakage in existing location-based services. 
     SUMMARY OF THE INVENTION 
     In the light of forgoing drawbacks, an objective of the present invention is to provide a location-based service technique that reduces data leakage. 
     In accordance with the above and other objectives, the present invention provides a location-based service system for providing a location-based service result to a communication device connected thereto, the system comprising: a location-based service server for receiving a first account information and a first service authentication code transmitted by the communication device in a registration mode, the location-based service server including a user repository and an authentication module, wherein the authentication module authenticates the received first service authentication code, and upon authentication, stores the received first account information in the user repository, and generates a first cloud authentication code based on the received first service authentication code; and a cloud data server comprising a communication device repository for receiving the first cloud authentication code and storing the first cloud authentication code in the communication device repository, wherein the location-based service server receives a second account information and a second service authentication code transmitted by the communication device in a service mode, so as to make the authentication module authenticate the second account information based on the first account information stored in the user repository, and upon authentication, the authentication module generates a second cloud authentication code based on the received second service authentication code, and authenticates the second cloud authentication code based on the first cloud authentication code stored in the communication device repository, such that the location-based service server provides a specific location-based service result to the communication device. 
     The present invention further provides a location-based service method for allowing a communication device to connect with a location-based service and a cloud data server to obtain a specific location-based service result, the method comprising the following steps: having the location-based service server receive a first account information and a first service authentication code transmitted by the communication device in a registration mode; having the location-based service server authenticate the received first service authentication code, and upon authentication, store the first account information; having the location-based service server generate a first cloud authentication code based on the received first service authentication code, and store the first cloud authentication code in the cloud data server; having the location-based service server receive a second account information and a second service authentication code transmitted by the communication device in a service mode; having the location-based service server authenticate the received second account information based on the stored first account information, and upon authentication, generate the second cloud authentication code based on the received second service authentication code; and having the location-based service server authenticate the second cloud authentication code based on the first cloud authentication code stored in the cloud data server, and upon authentication, having the location-based service server provide a specific location-based service result to the communication device. 
     In an embodiment, the communication device performs a secure hash algorithm on an international mobile subscriber identity of the communication device to generate the first and the second service authentication codes, and the authentication module performs a secure hash algorithm on the first and the second service authentication codes to generate the first and the second cloud authentication codes. 
     Compared with the prior art, the present invention allows the communication device to generate the first and second service authentication codes applicable to the location-based service server using the international mobile subscriber identity of the communication device that cannot be easily modified or forged in the registration and service modes, and further allows the location-based service server to generate the first and second cloud authentication codes applicable to the cloud data server using the first and second service authentication codes. As a result, the location-based service server and the cloud data server may complete the predetermined registration authorization procedures and service authorization procedures, which not only reduces the risk of data theft, but also increases the flexibility and convenience in obtaining services. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present invention can be more fully understood by reading the following detailed description of the preferred embodiments, with reference made to the accompanying drawings, wherein: 
         FIG. 1  is a schematic diagram depicting a location-based service system according to an embodiment of the present invention; and 
         FIG. 2  is a flowchart illustrating a location-based service method according to an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
     The present invention is described by the following specific embodiments. Those with ordinary skills in the arts can readily understand the other advantages and functions of the present invention after reading the disclosure of this specification. The present invention can also be implemented with different embodiments. Various details described in this specification can be modified based on different viewpoints and applications without departing from the scope of the present invention. 
     Referring to  FIG. 1 , a schematic diagram depicting a location-based service system  1  according to the present invention is shown. As shown in the diagram, the location-based service system  1  provides location-based services to a communication device  2  connected thereto. The location-based service system  1  includes a location-based service server  11  and a cloud data server  12 . The location-based service server  11  includes a user repository  111  and an authentication module  112 . The cloud data server  12  includes a communication device repository  121 . In this embodiment, the location-based service server  11  may further include a service module  113  and a result interpretation module  114 . The cloud data server  12  may also include a service data repository  122  and a location information repository  123 . 
     The location-based service server  11  receives a first account information and a first service authentication code transmitted by the communication device  2  in a registration mode. The authentication module  112  authenticates the received first service authentication code, and upon authenticating the first service authentication code, stores the received first account information in the user repository  111 , and further produces a first cloud authentication code based on the received first service authentication code. In this embodiment, the communication device  2  may perform a secure hash algorithm on an international mobile subscriber identity of the communication device to generate the first service authentication code. This international mobile subscriber identity cannot be easily modified or forged. The first account information is inputted by the user via the communication device  2  during the registration mode. 
     The cloud data server  12  includes the communication device repository  121  for receiving and storing the first cloud authentication code generated by the authentication module  112 . The location-based service server  11  further receives a second account information and a second service authentication code transmitted by the communication device  2  in a service mode. The authentication module  112  then authenticates the received second account information based on the first account information stored in the user repository  111 , and the authentication module  112  further generates a second cloud authentication code based on the received second service authentication code in order to authenticate the second cloud authentication code based on the first cloud authentication code stored in the communication device repository  121 . Upon authentication, the location-based service server  11  provides a specific location-based service result to the communication device  2 . 
     In this embodiment, the communication device  2  may also perform a secure hash algorithm on the international mobile subscriber identity of the communication device that cannot be easily modified or forged to generate the second service authentication code, and the second account information can also be inputted by the user via the communication device  2  during application service mode. 
     More specifically, authenticating the received first service authentication code by the authentication module  112  involves analyzing the received first service authentication code to obtain a corresponding mobile country code and a mobile network code, and then connecting to an external mobile communication operation server of the telecommunication service provider to compare the mobile country code and the mobile network code. Furthermore, the authentication module  112  may further perform a secure hash algorithm on the first and second service authentication codes to produce the first and second cloud authentication codes. 
     Moreover, the location-based service server  11  also includes the service module  113  and result interpretation module  114 . The cloud data server  12  includes the service data repository  122  and location information repository  123 . In this embodiment, after the second cloud authentication code is authenticated using the first cloud authentication code stored in the communication device repository  121 , the service module  113  obtains real-time location information from the communication device  2  so as to provide an original service result from the service data repository  122  to the result interpretation module  114 . The result interpretation module  114  adjusts the original service result based on a privacy setting transmitted by the communication device  2  to produce a location-based service result corresponding to the location information, and return the generated location-based service result to the communication device  2 . The location-based service server  11  further processes the received location information by using the privacy setting of the communication device  2 , and stores the location information in the location information repository  123  using the first or second service authentication code as an identifier. 
     The location-based service method according to the present invention can be understood by referring to  FIG. 2  and the foregoing descriptions. 
     In step S 1 , a registration mode is initiated, so as for the location-based service server  11  to receive a first account information and a first service authentication code transmitted by the communication device  2 , then proceeds to step S 2 . In this embodiment, step S 1  further includes a step of performing a secure hash algorithm on an international mobile subscriber identity of the communication device  2  by the communication device  2  to generate the first service authentication code, and receiving the first account information inputted by a user via the communication device  2 . 
     In step S 2 , the location-based service server  11  authenticates the received first service authentication code, and upon authentication, stores the received first account information, then proceeds to step S 3 . In this embodiment, the location-based service server  11  analyzes the first service authentication code to obtain a corresponding mobile country code and a mobile network code, and connects to an external mobile communication operation server to determine whether the mobile country code and the mobile network code are legitimate, thereby completing the authentication procedures of the first service authentication code. 
     In step S 3 , the location-based service server  11  generates a first cloud authentication code based on the received first service authentication code and stores the first cloud authentication code in the cloud data server  12 , then proceeds to step S 4 . In this embodiment, the location-based service performs a secure hash algorithm on the first service authentication code to generate the first cloud authentication code. 
     In step S 4 , a service mode is initiated, so as for the location-based service server  11  to receive a second account information and a second service authentication code transmitted by the communication device  2 , then proceeds to step S 5 . In this embodiment, step S 4  further includes a step of performing a secure hash algorithm on the international mobile subscriber identity of the communication device  2  by the communication device  2  to generate the second service authentication code, and receiving the second account information inputted by the user via the communication device  2 . 
     In step S 5 , the location-based service server  11  authenticates the second account information received in step S 4  based on the first account information stored in step S 2 , and upon authentication, generates a second cloud authentication code based on the received second service authentication code, then proceeds to step S 6 . In this embodiment, the location-based service server  11  may perform a secure hash algorithm on the second service authentication code to generate the second cloud authentication code. 
     In step S 6 , the location-based service server  11  authenticates the second cloud authentication code generated in step S 5  based on the first cloud authentication code stored in the cloud data server  12  in step S 3 . Upon authentication, the location-based service server  11  provides a location-based service result to the communication device  2 . 
     In this embodiment, the step S 6  of providing a location-based service result via the location-based service server  11  to the communication device  2  can be further divided into the following steps. First, the location-based service server  11  obtains location information of the communication device  2  in order to obtain an original service result from the data of the cloud data server  12 . Then, the location-based service server  11  adjusts the original service result based on a privacy setting transmitted by the communication device  2  to generate a location-based service result. Finally, the location-based service server  11  provides the generated location-based service result to the communication device  2 . Then, after step S 6  is completed, the location-based service server  11  may further process the received location information based on the privacy setting transmitted by the communication device  2 , and store the processed location information in the cloud data server  12  using the first or second service authentication code as an identifier. 
     It should be noted that in the registration mode, if the authentication of the mobile country code or the mobile network code, or the authentication performed by the connected external mobile communication operation server fails, the method is returned to step S 1  in which the location-based service server  11  receives the first account information and the first service authentication code transmitted by the communication device  2 . In the service mode, if the authentication of the second account information or the second cloud authentication code fails, the method may return to step S 4  to receive the second account information and the second service authentication code from the communication device  2 . 
     In summary, the present invention allows the communication device to generate the first and second service authentication codes applicable to the location-based service server using the international mobile subscriber identity of the communication device that cannot be easily modified or forged in the registration and service modes, and further allows the location-based service server to generate the first and second cloud authentication codes applicable to the cloud data server using the first and second service authentication codes. As a result, the location-based service server and the cloud data server may complete the registration authorization procedures and the service authorization procedures that reduce the risk of data theft while increasing the flexibility and convenience in obtaining services. 
     The above embodiments are only used to illustrate the principles of the present invention, and they should not be construed as to limit the present invention in any way. The above embodiments can be modified by those with ordinary skill in the art without departing from the scope of the present invention as defined in the following appended claims.