Generic Bootstrapping Architecture: Difference between revisions

Revision as of 00:00, 20 April 2014

Latest revision as of 07:10, 25 May 2024

(17 intermediate revisions by 15 users not shown)

Line 1:

'''Generic Bootstrapping Architecture''' ('''GBA''') is a technology that enables the authentication of a user. This authentication is possible if the user owns a valid identity on aan HLR ([[GSM core network#Home ___location register .28HLR.29|Home Location Register]]) or on aan HSS ([[Home Subscriber Server]]).

GBA is standardized at the [[3GPP]] (http://www.3gpp.org/ftp/Specs/html-info/33220.htm) . The user authentication is instantiated by a shared secret, one in the [[smartcard]], for example a [[SIM card]] inside the mobile phone and the other is on the HLR/HSS.

GBA authenticates by making a network component challenge the [[SIM card]]smartcard and verify that the answer is similar by the one predicted by the HLR/HSS.

Instead of asking the service provider to trust the [[Bootstrapping Server Function|BSF]] and relying on it for every authentication request, the [[Bootstrapping Server Function|BSF]] establishes a shared secret between the [[simcard]] card and the service provider. This shared secret is limited in time and for a specific ___domain.

[[Image:GBAGeneric Bootstrapping Architecture.JPGjpg]]

==Strong points==

This solution has some strong points of certificate and shared secrets without having some of their weaknesses:

- There is no need for user enrollment phase nor secure deployment of keys, making this solution a very low cost one when compared to [[Public key infrastructure|PKI]].

- Another advantage is the ease with which the authentication method may be integrated into terminals and service providers, as it is based on [[HTTP]]'s well known "[[Digest access authentication]]". Every Web server already implement HTTP [[digest authentication]] and the effort to implement GBA on top of digest authentication is minimal. For example, it could be implemented on SimpleSAMLPhP http://rnd.feide.no/simplesamlphp {{Webarchive|url=https://web.archive.org/web/20081219004332/http://rnd.feide.no/simplesamlphp |date=2008-12-19 }} with 500 PHP lines of code and only a few tens of lines of code are Service Provider specific making it really easy to port it to another Web site.

- On device side is needed:

Line 21:

== Technical overview ==

Actually, contents in this section are from external literature.<ref>[{{Cite web |url=http://www.tml.tkk.fi/Publications/C/22/papers/Olkkonen_final.pdf |title=Generic Authentication Architecture by Timo Olkkonen, Helsinki University of Technology] |access-date=2010-07-05 |archive-date=2016-07-05 |archive-url=https://web.archive.org/web/20160705130421/http://www.tml.tkk.fi/Publications/C/22/papers/Olkkonen_final.pdf |url-status=dead }}</ref>

There are two ways to use GAA (Generic Authentication Architecture).

Line 33:

Figure above shows the network GAA entities and interfaces between them. Optional entities are drawn with lines

network and borders dotted the scoreboard. The User Equipment (UE) is, for example, the user's mobile phone. The UE and

'''Bootstrapping functionServer serverFunction''' ('''BSF''') mutually authenticate themselves during the Ub (number [2] above) interface, using the [[Digest access authentication]] [[AKA (security)|AKA]] protocol. The UE also communicates with the '''Network Application Functions''' ('''NAF'''), which are the implementation servers, over the Ua [4] interface, which can use any specific application protocol necessary.

BSF retrieves data from the subscriber from the Home Subscriber Server (HSS) during the Zh [3] interface, which uses the

Line 41:

== Uses ==

* The SPICE project developed an extended Use Case named "split terminal" where a user on a PC can authenticate with hertheir mobile phone: http://www.ist-spice.org/demos/demo3.htm {{Webarchive|url=https://web.archive.org/web/20090324084359/http://www.ist-spice.org/demos/demo3.htm |date=2009-03-24 }}. The NAF was developed on SimpleSAMLPhP and a Firefox extension was developed to process the GBA digest authencation request from the BSF. Bluetooth SIM Access Profile was used between the Firefox browser and the mobile phone. Later a partner developed a "zero installation" concept.

* The research institute [[Fraunhofer FokusInstitute http://www.fokus.fraunhofer.defor Open Communication Systems|Fraunhofer FOKUS]] developed an OpenID extension for Firefox which uses GBA authentication.[https://web.archive.org/web/20150217142539/http://www.icin.biz/files/2008papers/Session5A-2.pdf%20 Presentation at ICIN 2008 by Peter Weik]

* The Open Mobile Terminal Platform http://www.omtp.org references GBA in its Advanced Trusted Environment: OMTP TR1<ref>[{{Cite web |url=http://www.omtp.org/Publications/Display.aspx?Id=24ad518b-6dba-4155-ad51-3143bd43a234 |title=OMTP Advanced Trusted Environment: OMTP TR1] |access-date=2009-01-04 |archive-url=https://web.archive.org/web/20081021071602/http://www.omtp.org/Publications/Display.aspx?Id=24ad518b-6dba-4155-ad51-3143bd43a234 |archive-date=2008-10-21 |url-status=dead }}</ref> recommendation, first released in May 2008.

Sadly, despite many advantages and potential uses of GBA, its implementation in handsets has been limited since GBA standardization in 2006. Most notably, GBA was implemented in Symbian-based handsets.

== References ==