Identity management on a wireless device

• US 8,886,948 B2
• Filed: 08/12/2013
• Issued: 11/11/2014
• Est. Priority Date: 09/20/2010
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Inventors: Schmidt, Andreas U., Leicher, Andreas, Shah, Yogendra C., Guccione, Louis J., Cha, Inhyok, Meyerstein, Michael V.
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/964,751
• Publication Number:
  US 20140047528A1
• Time in Patent Office: 456 Days
• Field of Search: None
• US Class Current: 713/176
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A wireless device may perform a local authentication to reduce the traffic on a network. The local authentication may be performed using a local web server and/or a local OpenID provider (OP) associated with the wireless device. The local web server and/or local OP may be implemented on a security module, such as a smartcard or a trusted execution environment for example. The local OP and/or local web server may be used to implement a provisioning phase to derive a session key, associated with a service provider, from an authentication between the wireless device and the network. The session key may be reusable for subsequent local authentications to locally authenticate a user of the wireless device to the service provider.

Claims

1. A method for performing local authentication at a wireless device, the method comprising:

receiving an association handle from a service provider, wherein the association handle indicates that the service provider has performed an association with a network entity;

receiving authentication information associated with a user of the wireless device;

locally verifying the authentication information at the wireless device;

generating a signature key based on the association handle and a session key associated with the service provider, wherein the session key is derived from a network authentication between the network entity and the wireless device, and wherein the session key is configured for use in performing a local authentication at the wireless device; and

signing an identity assertion, using the signature key, to indicate that the wireless device has locally verified the authentication information.

2. The method of claim 1, wherein the session key is shared with the network entity for validation of the identity assertion.

3. The method of claim 1, wherein the session key is configured for use in a plurality of local authentications at the wireless device.

4. The method of claim 1, wherein the association handle is received in an authentication request from the service provider.

5. The method of claim 1, wherein the network entity comprises an OpenID Server Function (OPSF).

6. The method of claim 1, wherein the identity assertion is configured to be validated at the network entity using the signature key.

7. The method of claim 1, wherein the wireless device comprises a security module, and wherein the session key is stored on the security module.

8. The method of claim 7, wherein the signature key is generated using the security module.

9. The method of claim 1, wherein the wireless device comprises a local web server, and wherein the authentication information is received via the local web server.

10. The method of claim 9, further comprising sending, via the local web server, a request for the authentication information.

11. The method of claim 9, wherein a security module comprises the local web server.

12. The method of claim 1, wherein the association handle is received via a local DNS lookup performed by an application on the wireless device.

13. The method of claim 1, wherein the session key is derived from a network authentication key associated with the network entity.

14. The method of claim 1, wherein the service provider is an OpenID Relying Party (RP).

15. The method of claim 1, wherein the wireless device is in communication, via a local link, with another wireless device, and wherein the other wireless device has requested access to services from the service provider;

and

further comprising;

receiving, via the local link, a request for authentication from the other wireless device; and

sending the signed identity assertion to the other wireless device.