The MODRNA working group was created by the OpenID Foundation to support the evolution of GSMA's Mobile Connect standard for secure digital authentication using mobile phones. MODRNA is developing an OpenID Connect profile and extensions for use by mobile network operators providing identity services. This includes specifications for mobile operator discovery, client registration, and authentication to enable the Mobile Connect framework. The working group involves participants from OpenID and mobile operators to ensure specifications can be freely implemented.

1. MODRNA
Torsten Lodderstedt, John Bradley, Bjorn
Hjelm

2. The Mobile Profile
• GSMA created Mobile Connect for secure universal digital
authentication leveraging OpenID Connect.
• OpenID Foundation MODRNA WG created to support this
evolution.
– Stands for Mobile Operator Discovery, Registration, aNd
Authentication
– Developing (1) a profile of and (2) an extension to OpenID
Connect for use by MNOs providing identity services.
– Serve as technical input to Mobile Connect development.
– OIDFs IPR framework ensures that all specifications can can be
freely implemented.
– WG members from OpenID community as well as MNOs.
• Deutsche Telekom, Ping Identity, Orange, Verizon Wireless, Telefonica,
Telenor, Telstra, GlobalSign.

3. Mobile Connect
• Mobile phone number as user identifier
• Mobile phone as authenticator
• MNO as authentication/identity provider
• Replace passwords and hardware security
tokens

4. Mobile Connect
Reference Architecture
2. The service provider requests the
authenticating operator from the API
Exchange.
3. The service provider makes a
request for authentication.
4. The operator selects the appropriate
authenticator depending on the request for
assurance and capabilities
1. The user clicks on a Mobile
Connect button to access a
service.
• SIM Applet
• USSD
• SMS
• Smartphone App
• FIDO
MNO
Service access request
Authentication
Service Provider
Authentication
request
Authentication
server
Identity
Gateway
MNO Discovery

5. MODRNA WG
2. The service provider requests the
authenticating operator from the API
Exchange.
3. The service provider makes a
request for authentication.
4. The operator selects the appropriate
authenticator depending on the request for
assurance and capabilities
1. The user clicks on a Mobile
Connect button to access a
service.
• SIM Applet
• USSD
• SMS
• Smartphone App
• FIDO
MNO
Service access request
Authentication
Service Provider
Authentication
request
Authentication
server
Identity
Gateway
MNO Discovery
1
2 3
Set up
credentials

6. MODRNA Specifications
• Discovery (draft-mobile-discovery) - Editors: John Bradley, Torsten
Lodderstedt
– Dedicated discovery service
– Account Chooser integration
• Client registration (draft-mobile-registration) – Editor: Bjorn Hjelm
– OIDC Dynamic Client Registration with software statements (RFC 7591)
– Mandatory claims in the statements
– Signature algorithms
– Lifecycle management, e.g. revocation of statements/blocking of RPs
• Authentication (draft-mobile-authentication) – Editor: Jörg
Connotte
– ACR values
– Additional parameters: login_token_hint, context

7. Auxiliary MODRNA Work
• Client Initiated Backchannel Authentication (CIBA) - Editors:
Gonzalo Fernandez Rodriguez, Florian Walter
– Mechanism to perform authentication (out-of-band) when there is no
user agent available (such as Call Center) and the authentication
process needs to initiated via server-to-server communication.
• User Questioning API – Editors: Charles Marais, Nicola Aillery
– Mechanism to perform transaction authorizations.
– Define additional OpenID Connect endpoint (UserInfo) that RP would
use (server-to-server) to initiate transaction authorization processes.
• Account migration (draft-account-migration) – Editor: James
Manger, Torsten Lodderstedt, Arne Gleditsch
– Mechanism to allow the migration of user account from old to new OP.
– Protocol allowing new OP to obtain the necessary user data from the
old OP and provide every RP with the necessary data to migrate the
RP's local user account data in a secure way.

8. The Onion
OpenID Connect 1.0
OAuth2.0
MODRNA 1.0
Mobile Connect Profile 1.2

9. MODRNA - GSMA Status
• Mobile Connect Profile 1.2 partly incorporate Authentication spec.
• Collaboration identified and resolved security issue with original
GSMA account migration proposal resulting in MODRNA Account
Migration spec.
• Discovery/Credential Management:
– Mobile Connect Release 2 now utilizes and favors OIDC
openid_configuration over endpoint URLs from OneAPI Exchange.
– MODRNA input to ongoing discussions about architecture evolutions
towards more distributed approach based on security, privacy, and
operational considerations.
• New specs for transaction authorization and server-initiated
authentication (for later adoption by GSMA).
• Regular technical workshops with GSMA CPAS group significantly
improved collaboration.

10. Thanks!