Method off-line authentication on a limited-resource device
One feature provides a method for granting authenticated access to off-line, limited-resource mobile devices. A public-private key pair is generated by a service provider and the public key is used to digitally sign a username and (possibly) access privileges to obtain a password for technician. The public key is securely distributed to mobile devices. When off-line, a mobile device may authenticate access to restricted functions of the mobile device by a technician. The technician provides its username, access privileges and password to the mobile device. The mobile device then uses the public key, username and access privileges to verify the password. To invalidate an old username and password, the service provider replaces the public-private key pair with a new public-private key pair.
1. A method operational on a mobile device for authenticating off-line access to the mobile device, comprising:
obtaining a public key associated with a service provider for the mobile device, wherein the public key has a corresponding private key and the public key and private key are used for asymmetric cryptography;
storing the public key for authenticating access requests when the mobile device is off-line;
receiving an access request to restricted functions of the mobile device while the mobile device is off-line, wherein the access request includes username, an access privilege, and a password, the password derived from the username and access privilege digitally signed by the private key; and
authenticating the access request by using the public key to validate the password;
wherein the password is a message authentication code of the username and access privilege signed by the private key.
2. The method of claim 1 , further comprising:
denying the requested access if the validation is unsuccessful; and
granting the requested access if the validation is successful.
3. The method of claim 1 , wherein the username, access privilege, and password are manually inputted into the mobile device.
4. The method of claim 1 , wherein the username, access privilege, and password are inputted via another device coupled to the mobile device.
5. The method of claim 1 , further comprising:
receiving a second public key associated with the service provider; and
replacing the public key with the second public key for off-line authentication.
6. The method of claim 5 , further comprising:
denying an access request if a received password was generated using a different key than the second public key.
7. A mobile device comprising:
means for obtaining a public key associated with a service provider for the mobile device, wherein the public key has a corresponding private key and the public key and private key are used for asymmetric cryptography;
means for storing the public key for authenticating access requests when the mobile device is off-line;
means for receiving an access request to restricted functions of the mobile device while the mobile device is off-line, wherein the access request includes username, an access privilege, and a password, the password derived from the username and access privilege digitally signed by the private key; and
means for authenticating the access request by using the public key to validate the password;
wherein the password is a message authentication code of the username and access privilege signed by the private key.
8. The device of claim 7 , further comprising:
means for denying the requested access if the validation is unsuccessful; and
means for granting the requested access if the validation is successful.
9. The device of claim 7 , further comprising:
means for receiving a second public key associated with the service provider, wherein the second public key has a corresponding second private key;
means for replacing the public key with the second public key for off-line authentication; and
means for denying an access request if a received password was generated using a different key than the second private key.
10. A mobile device, comprising:
a communication component for receiving a public key associated with a service provider for the mobile device, wherein the public key has a corresponding private key and the public key and private key are used for asymmetric cryptography;
a storage device coupled to the communication module, the storage device for storing the public key for authentication access requests when the mobile device is off-line; and
a processor coupled to the storage device and communication module, the processor configured to receive an access request to restricted functions of the mobile device while the mobile device is off-line, wherein the access request includes username, an access privilege, and a password, the password derived from the username and access privilege digitally signed by the private key, and authenticate the access request by using the public key to validate the password;
wherein the password is a message authentication code of the username and access privilege signed by the private key.
11. The device of claim 10 , wherein the processor is further configured to:
deny the requested access if the validation is unsuccessful; and
grant the requested access if the validation is successful.
12. The device of claim 10 , wherein the processor is further configured to:
receive a second public key associated with the service provider, wherein the second public key has a corresponding second private key;
replace the public key with the second public key for off-line authentication; and
deny an access request if a received password was generated using a different key than the second private key.
13. A machine-readable medium having one or more instructions for authenticating off-line access to a mobile device, which when executed by a processor causes the processor to:
obtain a public key associated with a service provider for the mobile device, wherein the public key has a corresponding private key and the public key and private key are used for asymmetric cryptography;
store the public key for authenticating access requests when the mobile device is off-line; receive an access request to restricted functions of the mobile device while the mobile device is off-line, wherein the access request includes username, an access privilege, and a password, the password derived from the username and access privilege digitally signed by the private key; and
authenticate the access request by using the public key to validate the password;
wherein the password is a message authentication code of the username and access privilege signed by the private key.
14. The machine-readable medium of claim 13 having one or more instructions which when executed by a processor causes the processor to further:
deny the requested access if the validation is unsuccessful; and
grant the requested access if the validation is successful.