Authentication in secure user plane location (SUPL) systems
A particular method includes receiving, at a secure user plane location (SUPL) server, an indication from a mobile device of one or more transport layer security (TLS) cipher suites supported by the mobile device; determining whether the one or more TLS cipher suites include a TLS pre-shared key (TLS-PSK) cipher suite that is supported by the SUPL server; in response to determining whether the one or more TLS cipher suites include the TLS-PSK cipher suite that is supported by the SUPL server, performing a generic bootstrapping architecture (GBA)-based authentication process to authenticate the mobile device, or determining whether the SUPL server supports a certificate-based authentication method; and in response to determining that the SUPL server supports the certificate-based authentication method, performing the certificate-based authentication method that includes sending a server certificate to the mobile device and receiving a device certificate from the mobile device.
1. A method comprising:
receiving, at a secure user plane location (SUPL) server, an indication from a mobile device of one or more transport layer security (TLS) cipher suites supported by the mobile device;
determining whether the one or more TLS cipher suites include a TLS pre-shared key (TLS-PSK) cipher suite that is supported by the SUPL server;
in response to determining that the one or more TLS cipher suites include the TLS-PSK cipher suite that is supported by the SUPL server, performing a generic bootstrapping architecture (GBA)-based authentication process to authenticate the mobile device; and
in response to determining that the one or more TLS cipher suites do not include a TLS-PSK cipher suite that is supported by the SUPL server, determining whether the SUPL server supports a certificate-based authentication method; and
in response to determining that the SUPL server supports the certificate-based authentication method, performing the certificate-based authentication method that includes sending a server certificate to the mobile device and receiving a device certificate from the mobile device.
2. The method of claim 1 , further comprising in response to determining that the SUPL server does not support the certificate-based authentication method, performing an alternative client authentication (ACA)-based authentication method when the mobile device is connected to a 3rd Generation Partnership Project (3GPP) network or a 3GPP2 network.
3. The method of claim 1 , wherein the certificate-based authentication method is independent of an access network used by the mobile device.
4. An apparatus comprising:
a processor; and
a memory coupled to the processor, wherein the memory is configured to store instructions; and
wherein the instructions are executable by the processor to:
receive, at a secure user plane location (SUPL) server, an indication from a mobile device of one or more transport layer security (TLS) cipher suites supported by the mobile device;
determine whether the one or more TLS cipher suites include a TLS pre-shared key (TLS-PSK) cipher suite that is supported by the SUPL server;
in response to determining that the one or more TLS cipher suites include the TLS-PSK cipher suite that is supported by the SUPL server, perform a generic bootstrapping architecture (GBA)-based authentication process to authenticate the mobile device; and
in response to determining that the one or more TLS cipher suites do not include a TLS-PSK cipher suite that is supported by the SUPL server, determine whether the SUPL server supports a certificate-based authentication method; and
in response to determining that the SUPL server supports the certificate-based authentication method, perform a certificate-based authentication process that includes sending a server certificate to the mobile device and receiving a device certificate from the mobile device.
5. The apparatus of claim 4 , wherein the instructions are further executable by the processor to, in response to determining that the SUPL server does not support the certificate-based authentication method, perform an alternative client authentication (ACA)-based authentication method when the mobile device is connected to a 3rd Generation Partnership Project (3GPP) network or a 3GPP2 network.
6. The apparatus of claim 4 , wherein the certificate-based authentication process is independent of an access network used by the mobile device
7. An apparatus comprising:
means for receiving, at a secure user plane location (SUPL) server, an indication from a mobile device of one or more transport layer security (TLS) cipher suites supported by the mobile device;
means for determining whether the one or more TLS cipher suites include a TLS pre-shared key (TLS-PSK) cipher suite that is supported by the SUPL server;
in response to determining that the one or more TLS cipher suites include the TLS-PSK cipher suite that is supported by the SUPL server, means for performing a generic bootstrapping architecture (GBA)-based authentication process to authenticate the mobile device; and
in response to determining that the one or more TLS cipher suites do not include a TLS-PSK cipher suite that is supported by the SUPL server, means for determining whether the SUPL server supports a certificate-based authentication method; and
in response to determining that the SUPL server supports the certificate-based authentication method, means for performing the certificate-based authentication method that includes sending a server certificate to the mobile device and receiving a device certificate from the mobile device.
8. The apparatus of claim 7 , further comprising in response to determining that the SUPL server does not support the certificate-based authentication method, means for performing an alternative client authentication (ACA)-based authentication method when the mobile device is connected to a 3rd Generation Partnership Project (3GPP) network or a 3GPP2 network.
9. The apparatus of claim 7 , wherein the certificate-based authentication method is independent of an access network used by the mobile device.
10. A non-transitory processor-readable medium comprising instructions that, when executed by a processor, cause the processor to:
receive, at a secure user plane location (SUPL) server, an indication from a mobile device of one or more transport layer security (TLS) cipher suites supported by the mobile device;
determine whether the one or more TLS cipher suites include a TLS pre-shared key (TLS-PSK) cipher suite that is supported by the SUPL server;
in response to determining that the one or more TLS cipher suites include the TLS-PSK cipher suite that is supported by the SUPL server, perform a generic bootstrapping architecture (GBA)-based authentication process to authenticate the mobile device; and
in response to determining that the one or more TLS cipher suites do not include a TLS-PSK cipher suite that is supported by the SUPL server, determine whether the SUPL server supports a certificate-based authentication method; and
in response to determining that the SUPL server supports the certificate-based authentication method, perform a certificate-based authentication process that includes sending a server certificate to the mobile device and receiving a device certificate from the mobile device.
11. The non-transitory processor-readable medium of claim 10 , wherein the instructions are further executable by the processor to, in response to determining that the SUPL server does not support the certificate-based authentication method, perform an alternative client authentication (ACA)-based authentication method when the mobile device is connected to a 3 rd Generation Partnership Project (3GPP) network or a 3GPP2 network.
12. The non-transitory processor-readable medium of claim 10 , wherein the certificate-based authentication process is independent of an access network used by the mobile device.