Authentication in secure user plane location (SUPL) systems

• US 8,627,422 B2
• Filed: 11/03/2011
• Issued: 01/07/2014
• Est. Priority Date: 11/06/2010
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Hawkes, Philip Michael, Wachter, Andreas, Escott, Adrian Edward, Edge, Stephen William
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US13/288,949
• Publication Number:
  US 20130067552A1
• Time in Patent Office: 796 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A particular method includes storing, at a mobile device, at least one security credential that is specific to the mobile device. The method also includes transmitting the at least one security credential to a secure user plane location (SUPL) location platform (SLP) to authenticate the mobile device as associated with a SUPL user based on a comparison of the device identifier to a stored device identifier.

Claims

1. A method of authentication, comprising:

receiving, at a mobile device, a server certificate including a public key of a secure user plane location (SUPL) location platform (SLP);

storing, at the mobile device, at least one security credential that is specific to the mobile device, wherein the at least one security credential includes a device identifier of the mobile device; and

transmitting the at least one security credential to the SLP to authenticate the mobile device as associated with a SUPL user based on a comparison of the device identifier to a stored device identifier, wherein the at least one security credential is transmitted in a message configured to be decrypted by a secret key of the SLP.

2. The method of claim 1, wherein the at least one security credential includes a public key of the mobile device.

3. The method of claim 1, wherein the device identifier includes at least one of an international mobile equipment identity (IMEI), a mobile station identification (MSID), and a serial number of the mobile device.

4. The method of claim 1, wherein the at least one security credential includes a device certificate of the mobile device.

5. The method of claim 1, wherein the at least one security credential is stored at a universal integrated smart card (UICC) of the mobile device, a secure portion of a memory of the mobile device, or any combination thereof.

6. The method of claim 1, wherein the mobile device comprises a SUPL enabled terminal (SET).

7. The method of claim 1, wherein the mobile device transmits the at least one security credential to the SLP via a network that operates in accordance with an Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard.

8. An apparatus comprising:

a non-transitory memory configured to;

receive a server certificate including a public key of a secure user plane location (SUPL) location platform (SLP) and

store at least one security credential that is specific to a mobile device, wherein the at least one security credential includes a device identifier of the mobile device; and

a processor configured to cause the mobile device to transmit the at least one security credential to the SLP to authenticate the mobile device as associated with a SUPL user based on a comparison of the device identifier to a stored device identifier, wherein the at least one security credential is configured to be transmitted in a message configured to be decrypted by a secret key of the SLP.

9. The apparatus of claim 8, wherein the at least one security credential includes at least one of a device certificate of the mobile device, a public key of the mobile device, an international mobile equipment identity (IMEI), a mobile station identification (MSID), and a serial number of the mobile device.

10. An apparatus comprising:

means for receiving, at a mobile device, a server certificate including a public key of a secure user plane location (SUPL) location platform (SLP);

means for storing at least one security credential that is specific to a mobile device, wherein the at least one security credential includes a device identifier of the mobile device; and

means for causing the mobile device to transmit the at least one security credential to the SLP to authenticate the mobile device as associated with a SUPL user based on a comparison of the device identifier to a stored device identifier, wherein the at least one security credential is transmitted in a message configured to be decrypted by a secret key of the SLP.

11. The apparatus of claim 10, wherein the mobile device comprises a SUPL enabled terminal (SET).

12. A method comprising:

sending a server certificate including a public key of a web server to a secure user plane location (SUPL)-enabled mobile device;

receiving, at the web server, a message from the mobile device, wherein the message includes a security credential of the mobile device;

decrypting the message using a secret key of the web server;

receiving, at the web server, user identification information from the mobile device; and

authenticating the user identification information as identifying an authorized user of a SUPL service.

13. The method of claim 12, wherein the security credential includes a device certificate that includes a public key of the mobile device.

14. The method of claim 12, wherein the security credential includes at least one of an international mobile equipment identity (IMEI), a mobile station identification (MSID), and a serial number of the mobile device.

15. The method of claim 12, wherein the user identification information includes an identifier and a password.

16. An apparatus comprising:

a processor; and

a memory coupled to the processor, wherein the memory is configured to store instructions; and

wherein when the instructions are executed by the processor, the processor is configured to;

send a server certificate including a public key of a web server to a secure user plane location (SUPL)-enabled mobile device;

receive, at the web server, a message from the mobile device, wherein the message includes a security credential of the mobile device;

decrypt the message using a secret key of the web server;

receive, at the web server, user identification information from the mobile device; and

authenticate the user identification information as identifying an authorized user of a SUPL service.

17. The apparatus of claim 16, wherein the security credential includes a device certificate that includes a public key of the mobile device.

18. An apparatus, comprising:

means for sending a server certificate including a public key of a web server to a secure user plane location (SUPL)-enabled mobile device;

means for receiving, at the web server, a message from the mobile device, wherein the message includes a security credential of the mobile device;

means for decrypting the message using a secret key of the web server;

means for receiving, at the web server, user identification information from the mobile device; and

means for authenticating the user identification information as identifying an authorized user of a SUPL service.

19. The apparatus of claim 18, wherein the security credential includes a device certificate that includes a public key of the mobile device.

20. A non-transitory processor-readable medium comprising instructions that, when executed by a processor, cause the processor to:

send a server certificate including a public key of a web server to a secure user plane location (SUPL)-enabled mobile device;

receive, at the web server, a message from the mobile device, wherein the message includes a security credential of the mobile device;

decrypt the message using a secret key of the web server;

receive, at the web server, user identification information from the mobile device; and

authenticate the user identification information as identifying an authorized user of a SUPL service.

21. The non-transitory processor-readable medium of claim 20, wherein the security credential includes a device certificate that includes a public key of the mobile device.

22. A non-transitory processor-readable medium comprising instructions that, when executed by a processor, cause the processor to:

receive a server certificate including a public key of a secure user plane location (SUPL) location platform (SLP) and store at least one security credential that is specific to a mobile device, wherein the at least one security credential includes a device identifier of the mobile device; and

transmit the at least one security credential to the SLP to authenticate the mobile device as associated with a SUPL user based on a comparison of the device identifier to a stored device identifier, wherein the at least one security credential is configured to be transmitted in a message configured to be decrypted by a secret key of the SLP.