Identity management on a wireless device
A wireless device may perform a local authentication to reduce the traffic on a network. The local authentication may be performed using a local web server and/or a local OpenID provider (OP) associated with the wireless device. The local web server and/or local OP may be implemented on a security module, such as a smartcard or a trusted execution environment for example. The local OP and/or local web server may be used to implement a provisioning phase to derive a session key, associated with a service provider, from an authentication between the wireless device and the network. The session key may be reusable for subsequent local authentications to locally authenticate a user of the wireless device to the service provider.
1. A method for performing local authentication at a wireless device, the method comprising:
receiving an association handle from a service provider, wherein the association handle indicates that the service provider has performed an association with a network entity;
receiving authentication information associated with a user of the wireless device;
locally verifying the authentication information at the wireless device;
generating a signature key based on the association handle and a session key associated with the service provider, wherein the session key is derived from a network authentication between the network entity and the wireless device, and wherein the session key is configured for use in performing a local authentication at the wireless device; and
signing an identity assertion, using the signature key, to indicate that the wireless device has locally verified the authentication information.
2. The method of claim 1 , wherein the session key is shared with the network entity for validation of the identity assertion.
3. The method of claim 1 , wherein the session key is configured for use in a plurality of local authentications at the wireless device.
4. The method of claim 1 , wherein the association handle is received in an authentication request from the service provider.
5. The method of claim 1 , wherein the network entity comprises an OpenID Server Function (OPSF).
6. The method of claim 1 , wherein the identity assertion is configured to be validated at the network entity using the signature key.
7. The method of claim 1 , wherein the wireless device comprises a security module, and wherein the session key is stored on the security module.
8. The method of claim 7 , wherein the signature key is generated using the security module.
9. The method of claim 1 , wherein the wireless device comprises a local web server, and wherein the authentication information is received via the local web server.
10. The method of claim 9 , further comprising sending, via the local web server, a request for the authentication information.
11. The method of claim 9 , wherein a security module comprises the local web server.
12. The method of claim 1 , wherein the association handle is received via a local DNS lookup performed by an application on the wireless device.
13. The method of claim 1 , wherein the session key is derived from a network authentication key associated with the network entity.
14. The method of claim 1 , wherein the service provider is an OpenID Relying Party (RP).
15. The method of claim 1 , wherein the wireless device is in communication, via a local link, with another wireless device, and wherein the other wireless device has requested access to services from the service provider; and
further comprising:
receiving, via the local link, a request for authentication from the other wireless device; and
sending the signed identity assertion to the other wireless device.