Characteristics of security associations
Authentication of a user or a wireless transmit/receive unit may be based on an obtained measure of authentication strength, which may referred to as an assurance level. For example, a user, via a WTRU, may request access to a service controlled by an access control entity (ACE). The user may be authenticated with a user authenticator and assertion function (UAAF), producing a result. A user assertion may be provided that includes the user authentication result, a user assurance level, and/or a user freshness level. The WTRU may be authenticated with a device authenticator and assertion function (DAAF), producing an associated result. A device assertion may be provided that may include the device authentication result, a device assurance level, and/or a device freshness level. The assertions may be bound together to receive access to a service or resource.
1. A method of authenticating a subscription for access to a service from a service provider, the method comprising:
sending an access request to the service provider from a user device;
in response to the access request, receiving, from the service provider, a request for a subscription authentication;
in response to the request for the subscription authentication, generating an authentication response, wherein the authentication response comprises a subscription identity associated with the subscription; and
sending the authentication response to the service provider to receive access to the service via the user device,
wherein the authentication response comprises an indication of a freshness of the subscription authentication, and an indication of a strength of the subscription authentication, the indication of the freshness based on a time that the authentication of the subscription occurred.
2. The method as recited in claim 1 , wherein the user device comprises an universal integrated circuit card (UICC), and generating the authentication response further comprises:
performing, by the UICC, an authentication of the user device;
based on the authentication of the user device, generating an assertion comprising a result of the authentication of the user device;
generating a response associated with the request for the subscription authentication; and
sending the assertion and the response associated with the request for the subscription authentication.
3. The method as recited in claim 1 , wherein generating the authentication response comprises:
performing an authentication of the subscription associated with the subscription identity;
based on the authentication of the subscription, generating an assertion comprising a result of the authentication of the subscription;
generating a response associated with a request for a device authentication; and
sending the assertion and the response associated with the request for the device authentication.
4. The method as recited in claim 1 , wherein the request for the subscription authentication comprises a request for a service subscription authentication.
5. The method as recited in claim 2 , wherein the subscription authentication and the authentication of the user device are bound together.
6. The method as recited in claim 2 , the method further comprising:
receiving a request for a user authentication; and
in response to the request for the user authentication, performing an authentication of a user of the user device.
7. The method as recited in claim 6 , wherein the subscription authentication, the authentication of the user device, and the user authentication are bound together.
8. The method as recited in claim 1 , the method further comprising:
obtaining an assurance level associated with a device authentication strength that is required to access the service; and
generating the authentication response based on the assurance level that is obtained.
9. The method as recited in claim 2 , wherein the authentication response comprises an indication of a freshness of the authentication of the user device, and an indication of a strength of the authentication of the user device, the indication of the freshness based on a time that the authentication of the user device occurred.
10. A wireless transmit/receive unit (WTRU), the WTRU comprising:
a memory comprising executable instructions; and
a processor in communications with the memory, the instructions, when executed by the processor, cause the processor to effectuate operations comprising:
sending an access request to access a service from a service provider;
in response to the access request, receiving, from the service provider, a request for an authentication of a subscription;
in response to the request for the subscription authentication, generating an authentication response, wherein the authentication response comprises a subscription identity associated with the subscription; and
sending the authentication response to the service provider to receive access to the service via the WTRU,
wherein the authentication response comprises an indication of a freshness of the subscription authentication, and an indication of a strength of the subscription authentication, the indication of the freshness based on a time that the authentication of the subscription occurred.
11. The WTRU as recited in claim 10 , wherein the WTRU further comprises an universal integrated circuit card (UICC), and generating the authentication response further comprises:
performing, by the UICC, an authentication of the WTRU;
based on the authentication of the WTRU, generating an assertion comprising a result of the authentication of the WTRU;
generating a response associated with the request for the subscription authentication; and
sending the assertion and the response associated with the request for the subscription authentication.
12. The WTRU as recited in claim 10 , wherein generating the authentication response further comprises:
performing an authentication of the subscription associated with the subscription identity;
based on the authentication of the subscription, generating an assertion comprising a result of the authentication of the subscription;
generating a response associated with a request for a WTRU authentication; and
sending the assertion and the response associated with the request for the WTRU authentication.
13. The WTRU as recited in claim 10 , wherein the request for the subscription authentication comprises a request for a service subscription authentication.
14. The WTRU as recited in claim 11 , wherein the subscription authentication and the authentication of the WTRU are bound together.
15. The WTRU as recited in claim 11 , wherein the processor is further configured to execute the instructions to perform further operations comprising:
receiving a request for a user authentication; and
in response to the request for the user authentication, performing an authentication of a user of the WTRU.
16. The WTRU as recited in claim 15 , wherein the subscription authentication, the authentication of the user device, and the user authentication are bound together.
17. The WTRU as recited in claim 10 , wherein the processor is further configured to execute the instructions to perform further operations comprising:
obtaining an assurance level associated with a WTRU authentication strength that is required to access the service; and
generating the authentication response based on the assurance level that is obtained.
18. The WTRU as recited in claim 10 , wherein the subscription authentication is carried out using an asymmetric key based authentication mechanism or a symmetric key based authentication mechanism.