Patent ID: 8528065

Claim:
A method for supporting Single Sign-On (SSO) services for a user with a user equipment arranged for accessing a telecommunication core network, where the user is a subscriber, and a service network, where services are provided, through an access network, the method comprising the steps of: identifying the user as the subscriber of the telecommunication core network at an entity of the access network where the user accesses; carrying out an authentication procedure for the user between an entity of the telecommunication core network and the user equipment; computing at the entity of the telecommunication core network a first secret user key usable as cryptographic material; computing at the user equipment a second secret user key usable as cryptographic material; deriving a first user shared key for SSO purposes from the cryptographic material at the entity of the telecommunication core network; deriving a second user shared key for SSO purposes from the cryptographic material at the user equipment; the entity of the telecommunication core network notifying an entity of the service network that an access session for the user through the access network has been initiated and including the first user shared key for SSO purposes; creating a master session for the user at the entity of the service network, the master session comprising a user identifier and the first user shared key; upon the user accessing a service of the service network for a first time, confirming the second user shared key from the user equipment towards the entity of the service network; verifying at the entity of the service network whether the second user shared key matches the first user shared key for the user; and granting access to the service in the service network on matching the first and second user shared keys.