Identity management on a wireless device

• US 9,185,560 B2
• Filed: 11/10/2014
• Issued: 11/10/2015
• Est. Priority Date: 09/20/2010
• Status: Expired due to Fees

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Inventors: Schmidt, Andreas U., Meyerstein, Michael V., Leicher, Andreas, Shah, Yogendra C., Guccione, Louis J., Cha, Inhyok
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/537,226
• Publication Number:
  US 20150065093A1
• Time in Patent Office: 365 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A wireless device may perform a local authentication to reduce the traffic on a network. The local authentication may be performed using a local web server and/or a local OpenID provider (OP) associated with the wireless device. The local web server and/or local OP may be implemented on a security module, such as a smartcard or a trusted execution environment for example. The local OP and/or local web server may be used to implement a provisioning phase to derive a session key, associated with a service provider, from an authentication between the wireless device and the network. The session key may be reusable for subsequent local authentications to locally authenticate a user of the wireless device to the service provider.

Claims

1. A wireless device comprising a processor, a memory, and communication circuitry, the wireless device configured to connect to a communications network via the communication circuitry, the wireless device including computer-executable instructions stored in the memory of the wireless device which, when executed by the processor of the wireless device, perform operations comprising:

receiving a temporary key, wherein the temporary key is derived from a network authentication between the wireless device and a network entity;

generating, based on the temporary key, a session key associated with a service provider, wherein the session key is shared with the network entity, and wherein the session key is configured for use in a local authentication performed at the wireless device; and

storing the session key for use in the local authentication at the wireless device.

2. The wireless device of claim 1, wherein the network authentication comprises an authentication and key agreement protocol.

3. The wireless device of claim 2, wherein the authentication and key agreement protocol uses a shared secret between the wireless device and the network entity to derive the temporary key.

4. The wireless device of claim 1, wherein the network authentication comprises a bootstrapping procedure.

5. The wireless device of claim 1, wherein the session key is generated using an internal key derivation function.

6. The wireless device of claim 1, wherein the wireless device further comprises a security module, the operations further comprising at least one of generating or storing the session key using the security module.

7. The wireless device of claim 1, wherein the network entity comprises an OpenID Server Function and the service provider comprises an OpenID Relying Party.

8. The wireless device of claim 1, the operations further comprising:

receiving a network authentication key associated with the network authentication, from the network entity; and

deriving the temporary key from the network authentication key.

9. A wireless device comprising a processor, a memory, and communication circuitry, the wireless device configured to connect to a communications network via the communication circuitry, the wireless device including computer-executable instructions stored in the memory of the wireless device which, when executed by the processor of the wireless device, perform operations comprising:

receiving an association handle from a service provider, wherein the association handle indicates that the service provider has performed an association with a network entity;

receiving authentication information associated with a user of the wireless device;

locally verifying the authentication information at the wireless device;

generating a signature key based on the association handle and a session key associated with the service provider, wherein the session key is derived from a network authentication between the network entity and the wireless device, and wherein the session key is configured for use in performing a local authentication at the wireless device; and

signing an identity assertion, using the signature key, to indicate that the wireless device has locally verified the authentication information.

10. The wireless device of claim 9, wherein the session key is shared with the network entity for validation of the identity assertion.

11. The wireless device of claim 9, wherein the session key is configured for use in a plurality of local authentications at the wireless device.

12. The wireless device of claim 9, wherein the association handle is received in an authentication request from the service provider.

13. The wireless device of claim 9, wherein the network entity comprises an OpenID Server Function, and the service provider comprises an OpenID Relying Party.

14. The wireless device of claim 9, wherein the identity assertion is configured to be validated at the network entity using the signature key.

15. The wireless device of claim 9, wherein the wireless device comprises a security module, and wherein the session key is generated using the security mode and stored on the security module.

16. The wireless device of claim 9, wherein the wireless device comprises a local web server, and wherein the authentication information is received via the local web server.

17. The wireless device of claim 9, wherein the association handle is received via a local DNS lookup performed by an application on the wireless device.

18. The wireless device of claim 9, wherein the session key is derived from a network authentication key associated with the network entity.

19. The wireless device of claim 9, the operations further comprising:

communicating, via a local link, with another wireless device that has requested access to services from the service provider;

receiving, via the local link, a request for authentication from the other wireless device; and

sending the signed identity assertion to the other wireless device.