Patent ID: 8887246

Claim:
A method of using a network element used by a user to authorise the user to a service provider in a communications network for accessing a service or group of services by generating and using a service credential associated with verifiable constraints, the method comprising: generating a random value for use as a the user credential; partially blinding the verifiable constraints and user credential to generate a partially blinded credential, the verifiable constraints being kept in clear and the user credential being blinded; sending the partially blinded credential towards an authentication server; receiving a partially blinded signature from the authentication server; unblinding the partially blinded signature to generate a user access signature; generating and storing an authorisation credential using the user access signature together with the user credential and a access profile; generating and storing an initial service credential from the authorisation credential; generating an initial access request message including the initial service credential; sending the access request message towards a service provider; and receiving authorisation from the service provider to access the service.