Use of AKA methods and procedures for authentication of subscribers without access to SIM credentials
View Patent ↗Systems and methods which enable an authentication procedure to be used within the standard network security architecture to authenticate third party applications that are forbidden access to a particular secret key are disclosed. Third party smartphone applications that are unable to use SIM-based authentication due to being forbidden access to a SIM-based key are provided an alternate secret key for use in an EAP-AKA or EAP-SIM type procedure according to embodiments. An authentication server or other backend authentication infrastructure of embodiments requests authentication vectors from a backend system sharing the alternative secret key. Accordingly, the backend authentication platform of embodiments is adapted to know or detect that an application is using an alternative secret key (e.g., a secret key other than the SIM-based secret key) and to perform the appropriate procedure for the key type.
1. A method comprising:
storing a first instance of an alternate secret key, used in authentication of a third party application accessing a service over a network, in a secure network in association with a user device hosting the third party application, wherein an instance of a particular secret key to which the third party application is forbidden access to is also stored in the secure network in association with the user device;
receiving an authentication request from the user device via the network for authenticating the third party application;
determining that an authentication process implemented in response to the authentication request is to use the alternate secret key rather than the particular secret key;
performing authentication processing for the third party application using the first instance of the alternate secret key in response to the determining;
wherein said determining that an authentication process implemented in response to the authentication request is to use the alternate secret key rather than the particular secret key includes: detecting, by a security element or a backend authentication system of the secure network, whether a native application or a third party application is being authenticated based upon: (i) a variant of a username portion of a Network Address Identifier (NAI) included in the authentication request or (ii) a variant of a realm portion of the Network Address Identifier included in the authentication request; and
wherein the first instance of the alternative secret key is stored in a user database (UDB) of the secure network, and wherein a second instance of the alternative secret key is stored in a configuration database for the third party application in the user device.
2. The method of claim 1 , further comprising:
generating the alternate secret key during activation processing of the third party application for use on the user device; and
providing the second instance of the alternate secret key during the activation processing of the third party application for storage by the user device, wherein the storing the first instance of the alternate key in the secure network is also performed during the activation processing of the third party application for use on the user device.
3. The method of claim 2 , wherein the authentication processing comprises an extensible authentication protocol-authentication key agreement (EAP-AKA) process or extensible authentication protocol-(GSM) subscriber identity module (EAP-SIM) process performed by network elements in the secure network operable to perform the EAP-AKA or EAP-SIM process using the particular secret key.
4. The method of claim 3 , wherein the instance of the particular secret key to which the third party application is forbidden access to is stored in a subscriber identity module (SIM) of the user device.
5. The method of claim 1 , wherein the receiving the authentication request and the determining that the authentication process is to use the alternate secret key are performed by the security network element of the secure network, and wherein the performing authentication processing is performed by an authentication, authorization, and accounting (AAA) server included in the backend authentication system of the secure network, said AAA server also operable to authenticate native applications using the particular secret key to which the third party application is forbidden access to.
6. The method of claim 5 , wherein the security network element comprises an evolved Packet Data Gateway (ePDG) using at least one of an EAP-AKA protocol or an EAP-SIM protocol for SIM-based devices, or a Security Gateway (SeGW) using at least one of an EAP-AKA protocol or EAP-SIM protocol for SIM-based devices.
7. The method of claim 1 , wherein the receiving the authentication request is performed by the security network element of the secure network, and wherein the determining that the authentication process is to use the alternate secret key and the performing authentication processing are performed by an authentication, authorization, and accounting (AAA) server included in the backend authentication system of the secure network.
8. The method of claim 7 , wherein the security network element comprises an ePDG or SeGW using an EAP-AKA or EAP-SIM protocol for SIM-based devices.
9. A method comprising:
storing a first instance of an alternative secret key, used in authentication of a third party application accessing a service over a network, in a user device hosting the third party application, wherein an instance of a particular secret key to which the third party application is forbidden access to is also stored in the user device;
requesting authentication of the third party application via the network, wherein the requesting authentication comprises an authentication request having information for facilitating a determination that an authentication process implemented in response to the authentication request is to use the alternate secret key rather than the particular secret key, said information for facilitating a determination that an authentication process implemented in response to the authentication request is to use the alternate secret key rather than the particular secret key being (i) a variant of a username portion of a Network Address Identifier (NAI) included in the authentication request or (ii) a variant of a realm portion of the Network Address Identifier included in the authentication request; and
wherein the first instance of the alternative secret key is stored in a configuration database for the third party application in the user device, and wherein a second instance of the alternative secret key is stored in a user database (UDB) of the secure network.
10. The method of claim 9 , further comprising:
activating the third party application for use on the user device; and
receiving the first instance of the alternate secret key for the storing in the user device during the activating the third party application, wherein the second instance of the alternate secret key is provided for storage in the secure network during the activating of the third party application.
11. The method of claim 10 , wherein the authentication process comprises an extensible authentication protocol-authentication key agreement (EAP-AKA) process or extensible authentication protocol-(GSM) subscriber identity module (EAP-SIM) process performed by network elements in the secure network operable to perform the EAP-AKA or EAP-SIM process using the particular secret key.
12. The method of claim 11 , wherein the instance of the particular secret key to which the third party application is forbidden access to is stored in a subscriber identity module (SIM) of the user device.
13. A system comprising:
a user database (UDB) of a secure network storing a first instance of an alternate secret key, used in authentication of a third party application accessing a service over a network, in association with a user device hosting the third party application, wherein an instance of a particular secret key to which the third party application is forbidden access to is also stored in the secure network in association with the user device;
a security network element adapted to receive an authentication request from the user device via the network and to determine that the authentication process is to use the alternate secret key rather than the particular secret key, said determine that an authentication process is to use the alternate secret key rather than the particular secret key including: detecting, by the security element of the secure network, whether a native application or a third party application is being authenticated based upon: (i) a variant of a username portion of a Network Address Identifier (NAI) included in the authentication request or (ii) a variant of a realm portion of the Network Address Identifier included in the authentication request;
a backend authentication server adapted to perform authentication processing for the third party application using the first instance of the alternate secret key in response to a determination by the security network element that the authentication process is to use the alternate secret key; and
wherein a second instance of the alternative secret key is stored in a configuration database for the third party application in the user device.
14. The system of claim 13 , wherein the security network element is further adapted to route information of the authentication request to the backend authentication server based on the determination, wherein the backend authentication server comprises a backend authentication server of a plurality of backend authentication servers in communication with the security network element, wherein the backend authentication server is adapted to authenticate the third party application using the first instance of the alternative secret key, and wherein another backend authentication server of the plurality of backend authentication servers comprises a backend authentication server operable to authenticate native applications using an instance of the particular secret key to which the third party application is forbidden access to.
15. The system of claim 13 , wherein the security network element comprises an evolved Packet Data Gateway (ePDG) or Security Gateway (SeGW) using an EAP-AKA or EAP-SIM protocol for SIM-based devices.
16. The method of claim 1 , wherein said backend authentication system is an authentication, authorization, and accounting (AAA) server, said AAA server performing the following steps: the step of receiving an authentication request from the user device via the network for authenticating the third party application, the step of determining that an authentication process implemented in response to the authentication request is to use the alternate secret key rather than the particular secret key; and the step of performing authentication processing for the third party application using the first instance of the alternate secret key in response to the determining.
17. The method of claim 1 , wherein the authentication request includes the variant of a username portion of a Network Address Identifier (NAI), said variant of a username portion of the NAI being a username with prepended or appended values that designate whether the authorization request is from a native application or a third party application.
18. The method of claim 1 , wherein the authentication request includes the variant of a realm portion of a Network Address Identifier (NAI), said variant of the realm portion of the NAI being a realm value which is included in authentication requests for the third party application which is different than a realm value which is included in authentication requests for a native application that has access to the particular secret key.
19. The system of claim 13 ,
wherein the alternate secret key is generated during activation processing of the third party application for use on the user device;
wherein the second instance of the alternate secret key is provided to the user device during the activation processing of the third party application for storage by the user device; and
wherein the first instance of the alternate key is stored in the secure network during the activation processing of the third party application for use on the user device.
20. The system of claim 13 , wherein the authentication processing comprises an extensible authentication protocol-authentication key agreement (EAP-AKA) process or extensible authentication protocol-(GSM) subscriber identity module (EAP-SIM) process performed by network elements in the secure network operable to perform the EAP-AKA or EAP-SIM process using the particular secret key.