Security of mobile terminals, such as portable communication devices (PCDs) (e.g., cellular telephones), portable digital assistants (PDAs), laptop computers, or any suitable device that is capable of communicating with a wireless network, is increasingly important to mobile terminal users. Security algorithms are often employed to achieve security between a mobile terminal and another network entity. These security algorithms often rely upon a secret that is shared between the mobile terminal and the other network entity that permits the mobile terminal to be authenticated. Typically, this shared secret is embodied in the form of a cryptographic key or username/password combination.
A Generic Bootstrapping Architecture (GBA) is a framework architecture that allows bootstrapping of a security key between a mobile terminal and the home network, which can then be used to further derive security keys for use between the mobile terminal and a network application server. The network application server or the network node using the shared secret with the mobile terminal can reside in any kind of network, e.g., visited network, open Internet, or it can even be another device. Recently, GBA has been thought of for use in combination with identity management systems such as, for example, the Liberty Alliance. Accordingly, Third Generation Partnership Project (3GPP) Generic Authentication Architecture (GAA), which may, for example, be based on mobile algorithms AKA (authentication and key agreement) for 3GPP or CHAP (challenge-handshake authentication protocol) and CAVE (cellular authentication and voice encryption) for 3GPP 2, may be employed to provide single sign on access to multiple services or websites after an initial sign on and authentication of the user. With the deployment of GBA, other protocols may also be used for bootstrapping such as, for example, protocols developed by CableLabs or the Open Mobile Alliance. The main difference between those variants lies in the actual method used to generate the shared secret. The deployment, usage and handling of the service specific shared secrets remain the same for all the above mentioned variants of GBA. This allows network operators with heterogeneous network infrastructures, e.g., if a network operator owns a fixed and a mobile network, to allow users to use the same service independent of how they want to access the service (e.g., via PC, phone etc). Additionally, for the operator, backend servers can be re-used to a large extent.
When accessing protected resources such as services or websites over a network, particularly for the first time, it is often necessary to fill out an often extensive form that includes a multitude of routine personal information. A username and password are often entered to be associated with the personal information in an “account” such that future request for services or visits to a particular website only require a user to enter their username and password to authenticate a user. A single user may have a plethora of accounts with different services and/or websites and each time a change is made to their personal information, each account would have to be updated separately. Further, different services may have different requirements for usernames and passwords and may result in different usernames and passwords for each service or website. Accordingly, certain mechanisms have been developed to mediate access to protected resources or provide an open authentication mechanism. OpenID is a shared identity service that allows Internet users to log on to different web sites using a single digital identity. Thus, users may not need a different user name and password for each site and all personal information can be updated in one location. OpenID is a decentralized, free and open standard that lets users control the amount of personal information they provide. OpenID is an example of a protocol that has been developed for use in connection with open authentication. This protocol is based on the redirection feature of current web browsers, but does not address authorization. It should be noted, that the service channel might be different from the connection used to authenticate.