Identity management on a wireless device
A wireless device may perform a local authentication to reduce the traffic on a network. The local authentication may be performed using a local web server and/or a local OpenID provider (OP) associated with the wireless device. The local web server and/or local OP may be implemented on a security module, such as a smartcard or a trusted execution environment for example. The local OP and/or local web server may be used to implement a provisioning phase to derive a session key, associated with a service provider, from an authentication between the wireless device and the network. The session key may be reusable for subsequent local authentications to locally authenticate a user of the wireless device to the service provider.
1. A method for provisioning, at a wireless device, a session key associated with a service provider for use in local authentication, the method comprising:
receiving a temporary key, wherein the temporary key is derived from a network authentication between the wireless device and a network entity;
generating, based on the temporary key, the session key associated with the service provider, wherein the session key is shared with the network entity, and wherein the session key is configured for use in a local authentication performed at the wireless device; and
storing the session key for use in the local authentication at the wireless device.
2. The method of claim 1 , wherein the network authentication comprises an authentication and key agreement protocol.
3. The method of claim 2 , wherein the authentication and key agreement protocol uses a shared secret between the wireless device and the network entity to derive the temporary key.
4. The method of claim 1 , wherein the network authentication comprises a bootstrapping procedure.
5. The method of claim 1 , wherein the session key is generated using an internal key derivation function.
6. The method of claim 1 , wherein the wireless device comprises a security module, and further comprising at least one of generating or storing the session key using the security module.
7. The method of claim 1 , wherein the network entity comprises an OpenID Server Function (OPSF).
8. The method of claim 1 , wherein the service provider comprises an OpenID Relying Party (RP).
9. The method of claim 1 , further comprising:
receiving a network authentication key, associated with the network authentication, from the network entity; and
deriving the temporary key from the network authentication key.