Mobile Provided Identity Authentication on the Web by Jonas … · 2011-05-25 · Slide title minimum 48 pt Slide subtitle minimum 30 pt Mobile Provided Identity Authentication on

Slide title minimum 48 pt

Slide subtitle minimum 30 pt

Mobile Provided Identity Authentication on the Web

by Jonas Högberg, Ericsson

for W3C’s WS on Identity in the Browser

24-5th May ‘11 Mountain View, CA, USA


(32 pt makes 2 rows

Text and bullet level 1 minimum 24 pt

Bullets level 2-5 minimum 20 pt

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~¡¢£¤¥¦§¨©ª«¬®¯°±²³´¶·¸¹º»¼½ÀÁÂÃÄÅÆÇÈËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀāĂăąĆćĊċČĎďĐđĒĖėĘęĚěĞğĠġĢģĪīĮįİıĶķĹĺĻļĽľŁłŃńŅņŇňŌŐőŒœŔŕŖŗŘřŚśŞşŠšŢţŤťŪūŮůŰűŲųŴŵŶŷŸŹźŻżŽžƒȘșˆˇ˘˙˚˛˜˝ẀẁẃẄẅỲỳ–—‘’‚“”„†‡•…‰‹›⁄€™−≤≥fifl

ĀĀĂĂĄĄĆĆĊĊČČĎĎĐĐĒĒĖĖĘĘĚĚĞĞĠĠĢĢĪĪĮĮİĶĶĹĹĻĻĽĽŃŃŅŅŇŇŌŌŐŐŔŔŖŖŘŘŚŚŞŞŢŢŤŤŪŪŮŮŰŰŲŲŴŴŶŶŹŹŻŻȘș

ΆΈΉΊΌΎΏΐΑΒΓΕΖΗΘΙΚΛΜΝΞΟΠΡΣΤΥΦΧΨΪΫΆΈΉΊΰαβγδεζηθικλνξορςΣΤΥΦΧΨΩΪΫΌΎΏ

ЁЂЃЄЅІЇЈЉЊЋЌЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯЁЂЃЄЅІЇЈЉЊЋЌЎЏѢѢѲѲѴѴҐҐəәǽẀẁẂẃẄẅỲỳ№

Do not add objects or text in the footer area

Ericsson Internal | 2011-05-23 | Page 2


› SSO with OpenID – OpenID is becoming the framework of choice for Identity Management in web-based

services. Many well-known service providers support OpenID. – OpenID is therefore of interest to telecoms operators enabling them to offer Single

Sign-On (SSO) to their users for a wide range of applications. – Operators are particularly interested in leveraging their subscriber databases and

SIM credentials (i.e. GBA) for providing OpenID-based SSO to their users.


(32 pt makes 2 rows









Mobile Provided Identity Authentication on the Web › OpenID – Quick Recap

Relying Party (RP)

OpenID Provider (OP)

1) Login 5) HTTP Redirect (user identity, signature)

4) User authenticates (out of scope)

User-Agent (browser)

3) HTTP Redirect

6) Verify signature

End-User

2) Discover OpenID Provider

Appstore, OAuth authorization server, or some other service provider

OpenID intentionally leaves the authentication protocol between client and OP unspecified (step 4).


(32 pt makes 2 rows










› OpenID and GBA Inter-working – OpenID intentionally leaves the authentication protocol between client and the

OpenID Provider OP unspecified. – Possible to use GBA (Generic Bootstrapping Architecture) for client authentication – The inter-working of OpenID and GBA is specified in 3GPP TS 33.924 – Basically, OP assumes the role of a NAF and the client authenticates using HTTP

Digest with B-TID as username and Ks_NAF as password


(32 pt makes 2 rows









Mobile Provided Identity Authentication on the Web ›  Combined Architecture of OpenID and GBA

HSS

Ub

Zh

Zn

BSF

OpenID Provider OP (NAF)

HTTP (Ua)SIM

Operator

(IMSI, K)

(IMSI, K)

RelyingParty

HTTP

Operator, WAC, or outside party

Operator or WAC

GBA

OpenID


(32 pt makes 2 rows









Mobile Provided Identity Authentication on the Web › Benefits

– OpenID serves as a bridge between the Telco world (AKA, GBA, Diameter, etc) and the web world

– Easy for the service provider (relying party) to integrate with the OpenID provider

– The combination with GBA gives high security and seamless user experience

– Based on industry standards: ›  GBA specified in 3GPP TS 33.220 ›  GBA and OpenID inter-working specified in 3GPP TS 33.924 ›  OpenID specified by OpenID Foundation (OIDF)

– The service provider could be the Operator, WAC, or perhaps most interesting, an outside party


(32 pt makes 2 rows










› OpenID and GBA inter-working UC to logon to a service that is not provided by the operator/carrier.

Internet

SIM

Mobile TV


(32 pt makes 2 rows










› Open Issues: – The browser must be GBA enabled: how can we add this

functionality? Plug-in? Passing of cookies? – How does the Relying Party (i.e. service provider) discover the

OpenID Provider? ›  If the OpenID provider is hosted by the Operator:

-  Use extra HTTP header with an operator ID (MNC + MCC) -  User selects his operator from a list -  User enters the URL of the OpenID provider

– Terminal support for GBA


(32 pt makes 2 rows










› Simple Network Architecture for GBA


(32 pt makes 2 rows










› Simple OpenID Network Architecture


(32 pt makes 2 rows










› Combined OpenID and GBA Network Architecture


(32 pt makes 2 rows









Mobile Provided Identity Authentication on the Web ›  Signaling:

RP OP (NAF)

1) Login

4) HTTP 302 Redirect https://op.operator.com

2) Discover OP

5) HTTP 401 Unauthorizedrealm="[email protected]”

7) HTTP GET (username = B-TID, digest)

10) HTTP 302 Redirect https://rp.com (identifier, signature)

11) Verify signature

9) Possibly further interaction

3) (optional) A security association is established between OP and RP

BSF

6) If no valid Ks is available within the UE, bootstrapping is performed [details are omitted]

8) Look up Ks_NAF using B-TID and verify digest

UE

Documents

Mobile Provided Identity Authentication on the Web by Jonas … · 2011-05-25 · Slide title minimum 48 pt Slide subtitle minimum 30 pt Mobile Provided Identity Authentication on