Bootstrapping Mobile Phone Credentials using PIV/CAC/eID

If your organization is using smart cards for login and access control and you would like to maintain the same security level in the mobile device fleet, you are in for big problems because the mobile phone industry haven't done very much in general in this space except for telecom operators and SIM-cards. In theory SIM-cards could be an excellent choice but they are usually locked-down by the operator and also come in rather different flavors where only a fraction support PKI.

Some vendors have therefore come up with counter-measures like:

http://www.trustdigital.com/downloads/TD_EMM_CAC_Pack_101008.pdf
http://na.blackberry.com/eng/ataglance/security/products/smartcardreader

Although these solutions work, they add a sizable cost ($200+) and inconvenience as well as being non-standard.

Another solution which is piloted by the Swedish Police, is to use the existing PIV/CAC/eID cards to "enroll" mobile devices (from a PC), which should be on par with the original credentials with respect to user-identity assurance. This can be done by the end-user itself using an OTA-credential-bootstrap mechanism.

Due to the absence of any standards for on-line provisioning of credentials the described system is proprietary.

Will OASIS's KMIP change this? I don't see how; I can't even figure out if this use-case is in-scope based on the current charter. IMHO a scheme like above should in order to be generally applicable, use a provisioning system that can be invoked by a clickable URL delivered in an SMS or e-mail. The URL replaces the need for awkward enrollment user-ID/password distribution since it is generated from the PIV/CAC/eID-based enrollment request. What's lacking is secure method for binding the device to this authentication. The most reasonable method appears to be device certificates. Device certificates could also be used for bootstrapping MDM (Mobile Device Management) systems since these also suffer from clunky, unsecure, and error-prone authentication schemes.

Anders Rundgren

kmip-comment message