Identity management with generic bootstrapping architecture
A federated management identity protocol may be used with various protocols such as, for example, the Generic Bootstrapping Architecture (GBA). For example, OpenID Connect may be integrated with GBA such that the GBA protocol implements the authentication functionality of OpenID Connect. In various example embodiments, functionality of the OpenID Connect protocol and GBA may be implemented locally, such as by a secure module within a user equipment.
1. A method performed by user equipment (UE) in a system comprising the UE a service provider (SP), and an authentication endpoint (AEP), which communicate with each other via a network, the method comprising:
requesting access to a service that is provided by the SP;
in response to requesting access to the service, receiving a request for a token;
receiving a request that the UE use a generic bootstrapping architecture (GBA) protocol for authentication of the UE;
in response to the request for the token, creating an identity (ID) token; and
signing the ID token using a token key in accordance with the GBA protocol to create a signature of the ID token,
wherein the signature is verified to provide the UE access to the service, and the ID token includes a header indicating that the ID token was created locally at the UE.
2. The method of claim 1 , the method further comprising:
deriving the token key from a master session key that is bootstrapped in accordance with the GBA protocol, wherein the token key is an application specific key.
3. The method of claim 1 , the method further comprising:
calculating an authentication digest in accordance with the GBA protocol; and
using the calculated authentication digest as the token key.
4. The method of claim 1 , the method further comprising:
calculating an application specific key from a master session key that is bootstrapped in accordance with the GBA protocol; and
when the application specific key is calculated correctly, retrieving the token key from a module that resides within the UE, wherein the token key is a private key with a corresponding public key available to the AEP.
5. The method of claim 4 , the method further comprising:
building a universal resource locator (URL) for the corresponding public key, wherein the signature is verified by retrieving the public key from the URL.
6. The method of claim 1 , the method further comprising:
deriving a first key from a master session key that is bootstrapped in accordance with the GBA protocol, wherein the first key is an application specific key;
generating a random seed value; and
deriving a key pair from the application specific key and the random seed value, the key pair including a private key and a public key, wherein the private key is the token key.
7. The method of claim 1 , the method further comprising:
in response to the request for the token, creating an access token comprising information indicative of a location of a user information endpoint, wherein the user information endpoint provides at least one requested user attribute to the SP upon verification of the access token.
8. The method of claim 7 , wherein the user information endpoint is located on at least one of the UE or a network entity that communicates with the SP via the network.
9. The method of claim 1 , wherein the AEP comprises a network access function (NAF) and an OpenID identity provider that are co-located with each other.
10. A wireless transmit/receive unit (WTRU) comprising:
a memory comprising executable instructions; and
a processor in communications with the memory, the instructions, when executed by the processor, cause the processor to effectuate operations comprising:
requesting access to a service that is provided by the SP;
in response to requesting access to the service, receiving a request for a token;
receiving a request that the UE use a generic bootstrapping architecture (GBA) protocol for authentication of the UE;
in response to the request for the token, creating an identity (ID) token; and
signing the ID token using a token key in accordance with the GBA protocol to create a signature of the ID token,
wherein the signature is verified to provide the UE access to the service, and the ID token includes a header indicating that the ID token was created locally at the WTRU.
11. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform operations comprising:
deriving the token key from a master session key that is bootstrapped in accordance with the GBA protocol, wherein the token key is an application specific key.
12. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform operations comprising:
calculating an authentication digest in accordance with the GBA protocol; and
using the calculated authentication digest as the token key.
13. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform operations comprising:
calculating an application specific key from a master session key that is bootstrapped in accordance with the GBA protocol; and
when the application specific key is calculated correctly, retrieving the token key from a module that resides within the UE, wherein the token key is a private key with a corresponding public key available to the AEP.
14. The WTRU as recited in claim 13 , wherein the processor is further configured to execute the instructions to perform operations comprising:
building a universal resource locator (URL) for the corresponding public key, wherein the signature is verified by retrieving the public key from the URL.
15. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform operations comprising:
deriving a first key from a master session key that is bootstrapped in accordance with the GBA protocol, wherein the first key is an application specific key;
generating a random seed value; and
deriving a key pair from the application specific key and the random seed value, the key pair including a private key and a public key, wherein the private key is the token key.
16. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform operations comprising:
in response to the request for the token, creating an access token comprising information indicative of a location of a user information endpoint, wherein the user information endpoint provides at least one requested user attribute to the SP upon verification of the access token.
17. The WTRU as recited in claim 16 , wherein the user information endpoint is located on at least one of the UE or a network entity that communicates with the SP via the network.
18. The WTRU as recited in claim 10 , wherein the AEP comprises a network access function (NAF) and an OpenID identity provider that are co-located with each other.