Certificate-based authentication

1. A method for authentication, operational in a device configured to communicate with a Long-Term Evolution (LTE) network, comprising:

provisioning the device with a device certificate at a time the device is manufactured, wherein the device certificate uniquely identifies the device, and wherein the device certificate is based on at least one or a combination of a serial number, a media access control (MAC) address, an international mobile station equipment identity (IMEI), or an international mobile subscriber identity (IMSI);

receiving a system information broadcast (SIB) message from the LTE network that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of subscriber identity module (SIM)-based authentication;

communicating one or more messages with the LTE network to execute certificate-based authentication; and

establishing the LTE security context based on keys derived from the certificate-based authentication.

2. The method of claim 1 , further comprising receiving a second message from the LTE network that indicates one or more authentication methods and one or more service providers supported by the LTE network.

3. The method of claim 2 , further comprising receiving the second message in response to sending a request from a device.

4. The method of claim 1 , wherein the one or more messages are communicated using one or more LTE non-access stratum (NAS) signaling messages.

5. The method of claim 1 , wherein the one or more messages include one or more Extensible Authentication Protocol (EAP) messages.

6. The method of claim 5 , wherein the one or more EAP messages are communicated using one or more LTE NAS signaling messages.

7. The method of claim 5 , wherein the certificate based authentication is performed using EAP—Transport Layer Security (EAP-TLS) or EAP—Tunneled Transport Layer Security (EAP-TTLS).

8. The method of claim 1 , wherein communicating the one or more messages with the LTE network to execute the certificate-based authentication comprises:

receiving a network certificate from an authentication server; and

validating the network certificate.

9. The method of claim 8 , wherein validating the network certificate comprises one or more of:

determining whether the network certificate is signed by a trusted certificate authority;

determining whether the network certificate is expired;

determining whether the network certificate is revoked; or

determining whether the authentication server owns the network certificate.

10. The method of claim 9 , wherein determining whether the network certificate is revoked comprises:

verifying the network certificate is not in a certificate revocation list (CRL); or

querying an Online Certificate Status Protocol (OCSP) server.

11. The method of claim 9 , wherein communicating the one or more messages with the LTE network to execute the certificate-based authentication further comprises sending a device certificate to the authentication server, wherein the device certificate is encrypted based on information in the network certificate.

12. The method of claim 1 , further comprising:

receiving a request for user credentials; and

sending user credentials to the LTE network.

13. The method of claim 1 , further comprising:

receiving a pseudonym from the LTE network; and

sending the pseudonym to the LTE network instead of a device certificate in subsequent attempts to gain access to the LTE network.

14. The method of claim 1 , further comprising:

receiving a request to accept a service agreement; and

sending a message accepting the service agreement.

15. The method of claim 1 , further comprising provisioning a device with a device certificate using an enterprise certificate enrollment process.

16. The method of claim 15 , wherein the enterprise certificate enrollment process utilizes Simple Certificate Enrollment Protocol (SCEP).

17. The method of claim 1 , further comprising generating a self-signed device certificate on a device using public and private key pairs specific to the device.

18. The method of claim 17 , further comprising generating the public and private key pairs on the device using a secret key programmed into a system-on-chip (SoC), wherein the secret key is shared with a trusted entity.

19. The method of claim 17 , further comprising generating the public and private key pairs by running a key-provisioning protocol between the device and a trusted entity.

20. An apparatus configured to communicate with a Long-Term Evolution (LTE) network, comprising:

a device certificate generator configured to provision the device with a device certificate at a time the device is manufactured, wherein the device certificate uniquely identifies the device, and wherein the device certificate is based on at least one or a combination of a serial number, a media access control (MAC) address, an international mobile station equipment identity (IMEI), or an international mobile subscriber identity (IMSI);

a transceiver configured to:

receive a system information broadcast (SIB) message from the LTE network that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication; and

communicate one or more messages with the LTE network to execute certificate-based authentication; and

a security-context establisher configured to establish the LTE security context based on keys derived from the certificate-based authentication.

21. An apparatus configured to communicate with a Long-Term Evolution (LTE) network, comprising:

means for provisioning the device with a device certificate at a time the device is manufactured, wherein the device certificate uniquely identifies the device, and wherein the device certificate is based on at least one or a combination of a serial number, a media access control (MAC) address, an international mobile station equipment identity (IMEI), or an international mobile subscriber identity (IMSI);

means for receiving a system information broadcast (SIB) message from the LTE network that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication;

means for communicating one or more messages with the LTE network to execute certificate-based authentication; and

means for establishing the LTE security context based on keys derived from the certificate-based authentication.

22. A non-transitory computer-readable medium comprising codes for causing a computer to:

provision the device with a device certificate at a time the device is manufactured, wherein the device certificate uniquely identifies the device, and wherein the device certificate is based on at least one or a combination of a serial number, a media access control (MAC) address, an international mobile station equipment identity (IMEI), or an international mobile subscriber identity (IMSI);

receive a system information broadcast (SIB) message from an LTE network that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication;

communicate one or more messages with the LTE network to execute certificate-based authentication; and

establish the LTE security context based on keys derived from the certificate-based authentication.

23. A method for authentication in a Long-Term Evolution (LTE) network, comprising:

sending a system information broadcast (SIB) message that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of subscriber identity module (SIM)-based authentication;

receiving an indication from a device that the device supports establishment of the LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication;

communicating one or more messages with the device to execute certificate-based authentication, wherein the one or more messages include one or more Extensible Authentication Protocol (EAP) messages, and wherein the certificate-based authentication is performed using EAP—Transport Layer Security (EAP-TLS) or EAP—Tunneled Transport Layer Security (EAP-TTLS); and

establishing the LTE security context based on keys derived from the certificate-based authentication.

24. The method of claim 23 , wherein the indication is received in an Attach message.

25. The method of claim 23 , wherein the indication is received as part of an EAP message.

26. The method of claim 23 , wherein the one or more messages are communicated using one or more LTE non-access stratum (NAS) signaling messages.

27. The method of claim 23 , wherein the one or more EAP messages are communicated using one or more LTE NAS signaling messages.

28. The method of claim 23 , wherein communicating the one or more messages with the device to execute the certificate-based authentication comprises:

receiving a device certificate from the device; and

validating the device certificate.

29. The method of claim 28 , wherein validating the device certificate comprises:

determining that the device certificate is a self-signed device certificate;

obtaining a public key for the device from a trusted entity; and

verifying the self-signed device certificate is signed by the device based on the public key.

30. The method of claim 28 , wherein validating the device certificate comprises one or more of:

determining whether the device certificate is signed by a trusted certificate authority;

determining whether the device certificate is expired; or

determining whether the device owns the device certificate.

31. The method of claim 30 , wherein validating the device certificate further comprises determining whether the device certificate is revoked.

32. The method of claim 31 , wherein determining whether the device certificate is revoked comprises one or a combination of:

verifying the device certificate is not in a certificate revocation list (CRL); or

querying an Online Certificate Status Protocol (OCSP) server.

33. The method of claim 30 , wherein validating the device certificate further comprises one or a combination of:

determining whether the device is in a list of devices that are allowed access to the LTE network; or

determining whether the device is not in a list of devices that are not allowed access to the LTE network.

34. The method of claim 23 , further comprising sending the device a network certificate.

35. The method of claim 23 , further comprising:

sending the device a request for user credentials;

receiving user credentials from the device;

validating the user credentials; and

granting the device access to the LTE network based on the user credentials.

36. The method of claim 23 , further comprising:

sending the device a pseudonym; and

receiving the pseudonym from the device instead of a device certificate in subsequent requests to gain access to the LTE network.

37. The method of claim 23 , further comprising:

sending the device a request to accept a service agreement;

receiving from the device a message accepting the service agreement; and

granting the device access to the LTE network based on the message accepting the service agreement.

38. An apparatus for authentication in a Long-Term Evolution (LTE) network, comprising:

a transceiver configured to:

send a system information broadcast (SIB) message that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of subscriber identity module (SIM)-based authentication;

receive an indication from a device that the device supports establishment of the LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication; and

communicate one or more messages with the device to execute certificate-based authentication, wherein the one or more messages include one or more Extensible Authentication Protocol (EAP) messages, and wherein the certificate-based authentication is performed using EAP—Transport Layer Security (EAP-TLS) or EAP—Tunneled Transport Layer Security (EAP-TTLS); and

a security-context establisher configured to establish the LTE security context based on keys derived from the certificate-based authentication.

39. An apparatus for authentication in a Long-Term Evolution (LTE) network, comprising:

means for sending a system information broadcast (SIB) message that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of subscriber identity module (SIM)-based authentication;

means for receiving an indication from a device that the device supports establishment of the LTE security context based on executing certificate-based authentication in lieu of SIM-based authentication;

means for communicating one or more messages with the device to execute certificate-based authentication, wherein the one or more messages include one or more Extensible Authentication Protocol (EAP) messages, and wherein the certificate-based authentication is performed using EAP—Transport Layer Security (EAP-TLS) or EAP—Tunneled Transport Layer Security (EAP-TTLS); and

means for establishing the LTE security context based on keys derived from the certificate-based authentication.

40. A non-transitory computer-readable medium comprising codes for causing a computer to:

send a system information broadcast (SIB) message that indicates the LTE network supports establishment of an LTE security context based on executing certificate-based authentication in lieu of subscriber identity module (SIM)-based authentication;

receive an indication from a device that the device supports establishment of a Long-Term Evolution (LTE) security context based on executing certificate-based authentication in lieu of SIM-based authentication;

communicate one or more messages with the device to execute certificate-based authentication, wherein the one or more messages include one or more Extensible Authentication Protocol (EAP) messages, and wherein the certificate-based authentication is performed using

EAP—Transport Layer Security (EAP-TLS) or EAP—Tunneled Transport Layer Security (EAP-TTLS); and

establish the LTE security context based on keys derived from the certificate-based authentication.