User consent for generic bootstrapping architecture
It is disclosed a method and a bootstrapping client ( 33 ) for assuring that a particular user ( 31 ) is present at local user authentication. It is also disclosed a method and a network application function ( 36 ) for authenticating a generic authentication architecture, GAA, client ( 34 ) to network application function, NAF ( 36 ). In addition, the NAF ( 36 ), requiring that the presence of the authorized user should be confirmed, sends a Nonce denoted as Nonce_UI, in which UI stands for “User Involvement”. The Nonce_UI indicates explicitly that the user involvement is required.
1. A method in a bootstrapping client of a terminal, for assuring that a particular user is present at local user authentication, enabling authentication of a generic authentication architecture (GAA) client to a network application function (NAF), the method comprising:
receiving from the GAA client a request for a NAF-specific credential, the request comprising a Nonce requiring user involvement (Nonce_UI);
requesting user authentication information;
receiving user authentication information;
deriving the NAF-specific credential based on the Nonce_UI, when the received user authentication information is correct; and
sending to the GAA client a response comprising said NAF-specific credential, so that the GAA client can calculate an authentication response using the NAF-specific credential, when local user authentication is given, and send said authentication response to the NAF.
2. The method according to claim 1 , wherein receiving user authentication information comprises receiving a personal identification number (PIN) code comprising any of: a password, a token, a one-time password received via short message service (SMS), or a parameter generated from a hard token.
3. The method according to claim 1 , wherein receiving user authentication information comprises receiving a screen swipe pattern defined by the user or a fingerprint.
4. A bootstrapping client of a terminal adapted to assure that a particular user is present at local user authentication, enabling authentication of a generic authentication architecture (GAA) client to a network application function (NAF), the bootstrapping client comprising:
a transceiver comprising a receiver and a transmitter;
a processor; and
a memory storing a computer program comprising computer program code which when run in the processor, causes the bootstrapping client to:
receive from the GAA client, via the transceiver, a request for a NAF-specific credential, the request comprising a Nonce requiring user involvement (Nonce_UI);
request user authentication information;
receive user authentication information;
derive the NAF-specific credential based on the Nonce_UI, when the received user authentication information is correct, and to send to the GAA client, via the transceiver, a response comprising said NAF-specific credential, so that the GAA client can calculate an authentication response using the NAF-specific credential, when local user authentication is given, and send said authentication response to the NAF.
5. The bootstrapping client according to claim 4 , wherein the bootstrapping client is comprised within a universal integrated circuit card (UICC).
6. The bootstrapping client according to claim 4 , further being trusted by the NAF to only derive the NAF-specific credential based on the Nonce_UI when the received user authentication information is correct.
7. The bootstrapping client according to claim 4 , belonging to a trusted open platform comprising the GAA client.
8. The bootstrapping client according to claim 4 , wherein the user authentication information comprises a personal identification number (PIN) code, comprising: a password, a token, a one-time password received via short message service (SMS), or a parameter generated from a hard token.
9. The bootstrapping client according to claim 4 , wherein the user authentication information comprises a screen swipe pattern defined by the user or a fingerprint.
10. The bootstrapping client according to claim 4 , wherein the bootstrapping client and the GAA client are located in separated entities.
11. A method in a network application function (NAF) node, for authentication of a generic authentication architecture (GAA) client to the NAF, the method comprising:
sending to the GAA client an authentication challenge comprising a Nonce requiring user involvement (Nonce_UI), such that the GAA client can send to a bootstrapping client a request for a NAF-specific credential, the request comprising the Nonce_UI;
receiving from the GAA client a Ua application request comprising an authentication response to the authentication challenge, the authentication response being based on the NAF-specific credential as derived by the bootstrapping client based on the Nonce_UI, when the bootstrapping client is assured during a local user authentication that a particular user is present;
sending to a bootstrapping server function (BSF) a request for the NAF-specific credential, the request comprising said Nonce_UI;
receiving from the BSF the NAF-specific credential, which is calculated based on the Nonce_UI; and
verifying the authentication response as received from the GAA client, based on the received NAF-specific credential.
12. The method according to claim 11 , wherein receiving the NAF-specific credential, comprises receiving the NAF-specific credential calculated using a key derivation function.
13. The method according to claim 11 , wherein receiving the NAF-specific credential comprises receiving the NAF-specific credential calculated based on user authentication information.
14. The method according to claim 13 , wherein the user authentication information comprises a personal identification number (PIN) code, a screen swipe pattern or a fingerprint.
15. The method according to claim 14 , wherein the PIN code comprises any of: a password, a token, a one-time password received via short message service (SMS), or a parameter generated from a hard token.
16. A network application function (NAF) node adapted to authenticate a GAA client to the NAF, the NAF comprising:
a receiver;
a transmitter;
a processor; and
a memory storing a computer program comprising computer program code which when run in the processor, causes the NAF to:
send to the GAA client, via the transmitter an authentication challenge comprising a Nonce requiring user involvement (Nonce_UI), such that the GAA client can send to a bootstrapping client a request for a NAF-specific credential, the request comprising the Nonce_UI;
receive from the GAA client, via the receiver, a Ua application request comprising an authentication response to the authentication challenge, the authentication response being based on the NAF-specific credential as derived by the bootstrapping client based on the Nonce_UI, when the bootstrapping client is assured during a local user authentication that a particular user is present;
send to a bootstrapping server function (BSF) via the transmitter, a request for the NAF-specific credential, the request comprising said Nonce_UI;
receive from the BSF, via the receiver, the NAF-specific credential, which is calculated based on the Nonce_UI; and
verify the authentication response as received from the GAA client, based on the received NAF-specific credential.
17. The NAF node according to claim 16 , wherein the NAF-specific credential is calculated using the Nonce_UI, as generated by the BSF.
18. The NAF node according to claim 16 , wherein the NAF-specific credential is calculated using a key derivation function.
19. The NAF node according to claim 16 , wherein the NAF-specific credential is calculated based on user authentication information.
20. The NAF node according to claim 19 , wherein the authentication information comprises a personal identification (PIN) code, a screen swipe pattern or a fingerprint.
21. The NAF node according to claim 20 , wherein the PIN code comprises any of: a password, a token, a one-time password received via short message service (SMS), or a parameter generated from a hard token.