Multi-X key chaining for Generic Bootstrapping Architecture (GBA)

1. A method, performed by a subscriber device, for facilitating secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the method comprising:

obtaining a security identifier (ID) associated with the subscriber;

based on the security ID, establishing an identity hierarchy comprising a plurality of entities that include any combination of devices and profiles associated with the subscriber;

based on the security ID, establishing consents for one or more SPs to access data generated by the entities in the identity hierarchy;

in response to a first request comprising the security ID, receiving a public key (PK) usable to encrypt the generated data for sending to a particular SP, wherein the encrypted data is decryptable using a corresponding secret key (SK) associated with an established consent for the particular SP; and

encrypting the generated data using the PK and the identity hierarchy.

2. The method of claim 1 , wherein:

the identity hierarchy further comprises one or more applications associated with each of the entities in the identity hierarchy; and

establishing consents further comprises establishing consents for the one or more SPs to access data generated by the one or more applications associated with each of the entities in the identity hierarchy.

3. The method of claim 2 , wherein:

the identity hierarchy further comprises one or more time periods associated with at least a portion of the applications; and

establishing consents further comprises establishing consents for the one or more SPs to access data generated during the one or more time periods by the at least a portion of the applications.

4. The method of claim 1 , wherein:

the security ID comprises a bootstrap identifier (BTID); and

obtaining the security ID comprises performing an authentication key agreement (AKA) with a bootstrapping server (BSF) and receiving the BTID, wherein

performing the AKA with the BSF comprises:

sending a bootstrap request to the BSF;

receiving an authenticate challenge from the BSF;

sending an authentication response to the BSF; and

receiving the BTID.

5. The method of claim 1 , wherein establishing the identity hierarchy comprises:

sending an initialization request comprising the security ID, wherein the initialization request is encrypted using a second key derivable based on the security ID;

receiving a request for a first key derivable based on the security ID;

decrypting the initialization request using the second key; and

sending a response comprising the first key, wherein the response is encrypted using the second key.

6. The method of claim 1 , wherein establishing consents for one or more SPs comprises:

sending a second request comprising the security ID, wherein the second request is encrypted using a third key derivable based on the security ID;

receiving a list of entities including any combination of devices and profiles associated with the subscriber;

decrypting the list of entities using the third key;

associating consents, for each of the one or more SPs, with the entities of the list; and

sending a response comprising the consents, wherein the response is encrypted using the third key.

7. The method of claim 1 , wherein receiving the PK usable to encrypt data for sending to a particular SP comprises:

sending a second request for the PK, wherein the second request comprises the security ID and is encrypted using a second key derivable based on the security ID;

receiving a response comprising the PK; and

decrypting the response using the second key.

8. The method of claim 1 , further comprising sending the generated data, encrypted by the PK, to the SP in association with the security ID, wherein the encrypted data and the security ID are further encrypted by a fourth key derivable based on the security ID.

9. A subscriber device configured to facilitate secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the subscriber device comprising:

a communication transceiver;

at least one processor operatively coupled to the communication transceiver; and

at least one memory storing computer-executable instructions that, when executed by the at least one processor, configure the subscriber device to perform operations corresponding to the method of claim 1 .

10. A method, performed by a server, for facilitating secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the method comprising:

receiving, from a subscriber device, a first request comprising a security identifier (ID) associated with the subscriber;

based on the security ID, establishing an identity hierarchy comprising a plurality of entities that include any combination of devices and profiles associated with the subscriber;

generating a public key (PK) associated with the subscriber;

generating a hierarchy of secret keys (SKs) corresponding to the identity hierarchy; and

providing the PK to a particular device or profile in the identity hierarchy.

11. The method of claim 10 , further comprising sending the hierarchy of SKs to a key management system (KMS) for storage.

12. The method of claim 10 , wherein:

the identity hierarchy further comprises one or more applications associated with each of the entities in the identity hierarchy; and

the hierarchy of SKs comprises respective SKs for the one or more SPs to access data generated by the one or more applications associated with each of the entities in the identity hierarchy.

13. The method of claim 12 , wherein:

the identity hierarchy further comprises one or more time periods associated with at least a portion of the applications; and

the hierarchy of SKs comprises respective SKs for the one or more SPs to access data generated during the one or more time periods by the at least a portion of the applications.

14. The method of claim 10 , wherein establishing the identity hierarchy comprises:

sending a second request for a second key of a plurality of keys derivable based on the security ID, wherein the second request includes the security ID;

receiving the second key and subscriber identity information; and

authenticating the subscriber device based on the subscriber identity information.

15. The method of claim 14 , wherein establishing the identity hierarchy further comprises:

sending, to the authenticated subscriber device, a third request for a first key of the plurality of keys, wherein the third request is encrypted using the second key;

receiving, from the authenticated subscriber device, a response comprising the first key; and

decrypting the response using the second key, wherein the PK is generated based on the first key.

16. The method of claim 10 , wherein establishing the identity hierarchy further comprises:

receiving a list of entities including any combination of devices and profiles associated with the subscriber; and

generating the identity hierarchy based on the list of entities.

17. The method of claim 10 , wherein generating the hierarchy of SKs comprises:

receiving consents for one or more SPs to access data generated by the entities in the identity hierarchy; and

generating the hierarchy of SKs based on the consents and a master secret key (MSK).

18. The method of claim 10 , wherein receiving the request comprises:

receiving a first initialization request from the subscriber device;

sending a response instructing the subscriber device to perform bootstrapping; and

receiving, from the subscriber device, a further initialization request comprising the security ID.

19. The method of claim 10 , wherein providing the PK to a particular device or profile included in the identity hierarchy comprises:

receiving a second request for the PK from a first device, the second request comprising the security ID;

sending a request for a second key of a plurality of keys derivable based on the security ID, wherein the request for the second key includes the security ID;

receiving the second key; and

sending the PK to the first device, wherein the PK is encrypted using the second key.

20. The method of claim 19 , wherein:

the security ID comprises a bootstrap identifier (BTID);

the request for the second key is sent to a bootstrapping server (BSF); and

the second key is received from the BSF.

21. A server apparatus configured to facilitate secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the server apparatus comprising:

a communication transceiver;

at least one processor operatively coupled to the communication transceiver; and

at least one memory storing computer-executable instructions that, when executed by the at least one processor, configure the server apparatus to perform operations corresponding to the method of claim 10 .

22. A method, performed by a server, for facilitating secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the method comprising:

receiving, from a subscriber device, a request comprising a security identifier (ID) associated with the subscriber;

authenticating the subscriber based on subscriber information associated with the security ID;

sending, to the subscriber device, a list of entities including any combination of devices and profiles associated with the subscriber;

receiving, from the subscriber device, consents for one or more service providers (SPs) to access data generated by the entities in the list; and

mapping the received consents into an identity hierarchy that comprises the entities associated with the subscriber.

23. The method of claim 22 , wherein:

the identity hierarchy further comprises one or more applications associated with each of the entities in the identity hierarchy; and

mapping the received consents further comprises mapping consents for the one or more SPs to access data generated by the one or more applications associated with each of the entities in the identity hierarchy.

24. The method of claim 23 , wherein:

the identity hierarchy further comprises one or more time periods associated with at least a portion of the applications; and

mapping the received consents further comprises mapping consents for the one or more SPs to access data generated during the one or more time periods by the at least a portion of the applications.

25. The method of claim 24 , wherein authenticating the subscriber comprises:

sending a request for a second key derivable based on the security ID, wherein the request for the second key includes the security ID;

receiving the second key and subscriber identity information; and

authenticating the subscriber based on the subscriber identity information.

26. The method of claim 25 , wherein:

one or more of a first set of conditions and a second set of conditions applies;

the first set of conditions includes:

the list of entities sent to the subscriber device is encrypted with the second key, and

the consents received from the subscriber device are decrypted using the second key; and

the second set of conditions includes:

the security ID comprises a bootstrap identifier (BTID),

the request for the second key is sent to a bootstrapping server (BSF), and

the second key and subscriber identity information are received from the BSF.

27. A server apparatus configured to facilitate secure communication between a subscriber to a mobile communication network and one or more service providers (SPs), the server apparatus comprising:

a communication transceiver;

at least one processor operatively coupled to the communication transceiver; and

at least one memory storing computer-executable instructions that, when executed by the at least one processor, configure the server apparatus to perform operations corresponding to the method of claim 22 .