GBA Key Management for Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current Generic Bootstrapping Architecture (GBA) does not adequately ensure separate security associations for multiple Web applications using the same server, leading to potential security vulnerabilities, especially with the increased usage of Web applications in mobile devices.
Innovation Solution
Enhancements to the GBA include generating a generic bootstrapping architecture key based on a network application function identifier's uniform resource locator, using a fully qualified domain name, and extending the NAF_ID construction to include the entire URL for granular key management, along with Ua security protocol identifiers for Web programming, to ensure distinct security associations for each service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the same GBA key is used for multiple Web applications hosted on the same server, then the key management is simplified, but the security is compromised because separate security associations cannot be ensured
Solution Approach 1:
The patent segments the GBA key management by introducing service-specific key identifiers (Ks_ext_NAF) that are derived from the combination of the base GBA key and the NAF identifier. This segmentation allows multiple Web applications hosted on the same server to have distinct security associations while maintaining a unified key derivation mechanism, thus resolving the contradiction between simplified key management and security separation.
Solution Approach 2:
The patent applies local quality by making the security association properties specific to each NAF (Network Application Function). The Ks_ext_NAF key is locally customized for each service based on the NAF_ID, which includes the service identifier. This ensures that each Web application has its own security context while using the same underlying GBA infrastructure, balancing simplicity and security.
2Device complexity
If the NAF_ID construction includes only the domain name, then the key management is simpler, but it cannot provide granular key management for different services on the same server
Solution Approach 1:
The NAF_ID is segmented into multiple components: the base domain name and additional service-specific identifiers. This segmentation allows the system to maintain simplicity at the domain level while adding granularity through service identifiers, enabling different Web applications on the same server to have distinct security associations without overcomplicating the overall structure.
Solution Approach 2:
The patent adds another dimension to the NAF_ID by incorporating service identifiers alongside the domain name. This transforms the NAF_ID from a single-dimensional domain-based identifier to a multi-dimensional identifier that includes both the server location (domain) and the specific service (NAF identifier), enabling granular key management while preserving the simplicity of domain-based addressing.
3Loss of time
If Web applications use the same GBA security association, then authentication is faster, but security vulnerabilities arise from lack of isolation between services
Solution Approach 1:
The patent performs preliminary action by pre-derived service-specific keys (Ks_ext_NAF) from the base GBA key during the initial authentication phase. This allows Web applications to use pre-computed service-specific keys for subsequent transactions, maintaining fast authentication while ensuring security isolation. The service identifier is incorporated into the key derivation process in advance, creating distinct security contexts without adding authentication overhead.
Solution Approach 2:
The service-specific key identifier (Ks_ext_NAF) acts as an intermediary between the base GBA key and the actual service authentication. This intermediary layer provides security isolation by ensuring that each service has its own derived key, preventing cross-service vulnerabilities while maintaining the efficiency of the underlying GBA authentication mechanism. The intermediary key derivation process is transparent and does not add significant time overhead.
Data Source
Figure 1~2
Figure 3~7
Figure 4
AI summary
A method includes receiving at a network application function a request related to a generic bootstrapping architecture key originated from a user equipment (1 ). The received request includes a network application function identifier that includes a uniform resource locator, where the network application function has a fully qualified domain name. The method further includes causing a generic bootstrapping architecture key to be generated for the user equipment based at least in part on the uniform resource locator that is part of the network application function identifier (5). Apparatus and computer programs for performing the method are also disclosed.