Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/062—Pre-authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/069—Authentication using certificates or pre-shared keys
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless

Definitions

• the invention relates to an authentication method between a mobile radio terminal and a routing subsystem, generally called a fixed network, in a digital cellular radiotelephone network. More particularly, the invention improves uthentification through the radio interface between a microprocessor card or module, known as a SIM (Subscriber Identity Module) smart card, removable from the terminal, and a center for uthentification of the radiotelephony network.
• SIM Subscriber Identity Module
• a digital cellular radiotelephony network of the GSM type mainly comprises several mobile radiotelephone terminals MS and a fixed network where signaling, control, data and voice messages circulate as described in FIG. 1.
• the RR network are represented main entities through which data intended for the SIM card of a mobile radiotelephone terminal MS located in a location area pass.
• a mobile service switch MSC connected to at least one autonomous telephone switch CAA of the switched PSTN network manages communications for visiting mobile terminals, including the terminal MS, which are located at a given time in the location area. served by the MSC switch.
• a VLR visitor location recorder is connected to the MSC switch and contains characteristics, such as identity and subscription profile of the mobile terminals located in the location area.
• a base station controller BSC connected to the switch MSC manages in particular the allocation of channels to mobile terminals.
• a base station BTS connected to the controller BSC covers the radio cell where the terminal MS is located at the given time.
• the RR radiotelephone network also includes a nominal location register HLR cooperating with an AUC authentication center and connected to the mobile service switches through the signaling network of the RR radiotelephone network.
• the HLR recorder is essentially a database, which contains for each MS terminal the international identity IMSI (International Mobile Subscriber Identity) of the SIM card inserted in the terminal, i.e. the subscriber owning the SIM card, the directory number, the subscriber's subscription profile, and the number of the VLR recorder to which the mobile terminal is attached at a given time. This number is updated during transfers between localization zones.
• IMSI International Mobile Subscriber Identity
• the AUC authentication center ensures the authentication of subscribers prior to any communication with the terminal or when the terminal is operational or during an intercellular transfer. It also participates in the confidentiality of the data passing through the radio interface IR between the terminal MS and the base station BTS to which it is attached at a given time.
• the AUC authentication center manages an A3 authentication algorithm and an A8 encryption key determination algorithm, sometimes merged into a single A3A8 algorithm, according to the GSM standard. These algorithms are also present in the SIM card of the mobile terminal MS.
• the AUC authentication center also stores an authentication key Ki allocated only to the subscriber. This key corresponds to the subscriber's IMSI identity stored in the HLR nominal location register when the subscriber subscribes. To be able to recognize the subscriber, it is necessary to authenticate the mobile radiotelephone terminal MS.
• the authentication center does not authenticate the MS mobile terminal itself but the SIM card it contains. This card contains the key Ki assigned to the subscriber and proves by means of the authentication algorithm A3 that it knows the key without revealing it. As described in FIG.
• the fixed network sends a random RAND number to the card and requests it to calculate by means of the authentication algorithm a result depending on the key and the random number.
• This result is returned to the network in the form of a signed SRES response (Signed RESponse).
• SRES response Signed RESponse
• the size of the random number prevents an “attacker” from keeping in memory all the values of the signed random number-response pair in a dictionary.
• the new technologies used in recent generations of mobile radiotelephones make it possible to load programs through the radiotelephony network and to execute them.
• a Trojan horse loaded into a subscriber's mobile radio could, for example, allow the subscriber's radiotelephone MS to return a signed response SRES2 not to the radiotelephone network, but to a second mobile radiotelephone MS2 (of an malicious person) in response to a request for authentication issued by this second radiotelephone.
• the second radiotelephone returns the response signed SRES2 (thus recovered) to the radiotelephony network during an authentication request, and the attacker can use the second mobile radio to make communications on behalf of the subscriber.
• an authentication method between a first entity and a second entity in a communication network comprising steps of applying authentication keys stored in the first and second entities respectively and a random number produced by the second entity and transmitted by the second entity to the first entity respectively to first identical algorithms stored in the first and second entities, and compare in the second entity a response produced by the first algorithm stored in the first entity and transmitted to the second entity with a response result produced by the first algorithm stored in the second entity, said method is characterized in that the step of applying the random number to the first algorithm is carried out by means of a prior step of transforming said random number to obtain a random number transformed to applied to said first algorithm, said preliminary transformation step consisting in applying the random number and the response result of the previous one authentication to identical second algorithms stored respectively in the first and second entities, and in that said method further comprises the step of storing respectively in the first and second entities the response produced
• the first and second entities are respectively a radiotelephone terminal and a fixed network in a radiotelephone network.
• the step of applying to the second algorithms the random number and the response result of the previous authentication makes it possible to cancel any risk of attack of the “virtual cloning” type of the SIM card as described previously.
• the response result delivered by the subscriber's radiotelephone to the malicious person's radiotelephone will not allow the latter to be authenticated to the network as being a subscriber's radiotelephone.
• the response result delivered by the malicious person's radiotelephone depends on the signed response corresponding to the previous authentication request submitted to the mobile radiotelephone whereas the response result calculated by the authentication center depends on the last response result corresponding to the last authentication of the subscriber by the fixed network.
• the request for authentication of the malicious person's radiotelephone is rejected by the network.
• the invention also relates to an identity module, such as a subscriber identity card, in a first entity, such as a mobile radiotelephone terminal which is characterized in that it comprises means for storing at least a second algorithm, means for memorizing the result of response to the previous authentication and means for executing at least the steps of applying to the second algorithm and to the first algorithm according to the invention.
• an identity module such as a subscriber identity card
• FIG. 1 is a schematic block diagram of a digital cellular radiotelephony network
• FIG. 2 shows the steps for authenticating a radiotelephone according to the prior art
• FIG. 3 shows the steps allowing an "attacker” to virtually clone the identity card of a subscriber
• FIG. 4 shows steps of an authentication method according to the invention
• FIG. 5 shows the failure of an attack of the “virtual cloning” type by the implementation of the authentication method according to the invention.
• a VLR / HRL-AUC fixed network is considered to be the chain of entities attached to the mobile radio terminal MS from the IR radio interface, comprising the base station BTS, the station controller BTS, the MSC switch with the VLR visitor location recorder and the HLR-AUC pair.
• a mobile radiotelephone terminal MS comprises a microprocessor module, such as a SIM chip card.
• the SIM smart card essentially comprises a ROM read-only memory, known as a program memory generally including an operating system and application algorithms, a non-volatile EEPROM memory which contains in particular all the data characterizing the subscription of the card holder, a directory of telephone numbers, secret codes or authentication keys or even programs and algorithms, a RAM memory for processing data used by the operating system, in particular during exchanges between the card and the mobile radiotelephone terminal which 1 'welcome.
• FIG. 2 illustrates the main steps of the authentication method between a mobile radiotelephone terminal MS and a fixed network as it operates today.
• the VLR / HLR-AUC radiotelephone network transmits an E12 authentication request to the mobile radiotelephone terminal in response to the transmission Eli by the mobile radiotelephone MS of the identity of the IMSI subscriber.
• the request for authentication is accompanied by a transmission of a random RAND number from the fixed network to the mobile radiotelephone terminal MS.
• the latter commands the SIM card to generate a response signed SRES to the request for authentication of the fixed network.
• this response is developed using the authentication algorithm AA to which the authentication key Ki and the random number RAND are applied, transmitted by the fixed network.
• the Ki key is previously stored in the smart card and assigned when the subscription is taken out.
• the terminal collects the SRES response generated by the card and transmits it in El 5 in turn to the fixed network.
• the fixed network VLR / HLR-AUC prepares an RSRES response result using an algorithm AA, the key Ki, stored in the authentication center AUC in correspondence with the IMSI of the maid.
• the response result RSRES is compared by the authentication center AUC to the signed response SRES returned by the mobile radiotelephone terminal MS. If the RSRES response result corresponds to the signed SRES response, the subscriber's authentication request is satisfied and the subscriber can use his terminal to communicate. Otherwise, the request for authentication fails and the subscriber cannot use his mobile radio.
• FIG. 3 depicts an attack of the “virtual cloning” type of the SIM card of a subscriber.
• the new technologies employed in mobile radiotelephones make it possible to download via the radiotelephony network programs in radiotelephones.
• An attacker or "attacker” wants to be able to communicate using a second MS2 mobile radio on the account of a subscriber without his knowledge.
• a Trojan horse downloaded into a subscriber's radiotelephone MS, The malicious person makes the subscriber's radiotelephone capable of responding to an authentication request originating not from the network but from a second radiotelephone mobile.
• the mobile radiotelephone MS of a subscriber is legitimately authenticated, in accordance with steps Elll to El 1 7
• the second mobile radiotelephone MS2 requests authentication E121 from the fixed network VLR2 / HLR-AUC on behalf of the subscriber.
• the second mobile radio MS2 communicates the IMSI of the subscriber to said fixed network VLR2 / HLR-AUC which in return requests it to authenticate itself by transmitting to it a random number RAND2 in step E122.
• the malicious person's radiotelephone MS2 submits an authentication request E123 to the first mobile radiotelephone MS, communicating to it the random number RAND2, transmitted beforehand by the fixed network.
• the mobile radio MS of the subscriber requests the SIM card to generate at step E124 a response signed SRES2 using the authentication algorithm AA of the SIM card, with the key Ki stored in the SIM card as inputs. the random number RAND2.
• the radiotelephone collects in step E125 the response SRES2 and transmits it in step E126 in turn to the mobile radiotelephone MS2 of the malicious person.
• the latter returns to the fixed network VLR2 / HLR-AUC the response signed SRES2 in step E127.
• the fixed network VLR2 / HLR-AUC generates in step E131 the response result RSRES2 by applying within the authentication center AUC to the authentication algorithm AA the random number RAND2 and the authentication key Ki of the maid.
• the RSRES2 response result is equivalent to the signed SRES2 response.
• the fixed network therefore authenticates the second mobile radiotelephone MS2 as being the property of the subscriber in step E132. The attacker can thus use his radiotelephone and communicate on the subscriber’s account.
• FIG. 4 describes an authentication method according to the invention in which after reception E21 of the IMSI of a subscriber by the fixed network VLR / HLR-AUC, the latter submits an authentication request E22 to the mobile radiotelephone MS.
• Said radiotelephone requests, in step E23, the SIM card to calculate a signed response on the basis of the authentication key Ki stored in the SIM card and the random number RANDn.
• the SIM card applies, in step E24, to a second transformation algorithm AT, algorithm stored in the SIM card, the random number RANDn and the signed response SRESn-1 corresponding to the previous one request for authentication of the MS mobile radio.
• the result TRANDn from the transformation of the random number RANDn is applied, in step E25, to the authentication algorithm AA stored in the SIM card.
• the response thus calculated SRESn is stored (step not shown in FIG. 4) in the SIM card to be used during the next authentication.
• Said response SRESn is returned to the fixed network VLR / HLR-AUC by the mobile radiotelephone MS in step E26.
• the fixed network VLR / HLR-AUC calculates, in step E28, a response result RSRESn using the AA authentication algorithm stored in the AUC authentication center to which the key is applied. Ki of the subscriber and the random number TRANDn resulting from a transformation algorithm AT, also stored in the authentication center AUC, to which are applied the number RANDn transmitted to the mobile radio in step E22, and the response result RSRESn-1 corresponding to the previous request for authentication.
• the new response result thus calculated is stored (step not shown in FIG. 4) in the AUC authentication center to be used during the next authentication.
• AUC Authentication Center compares in step E29, said response result RSRESn to the signed response SRESn transmitted by the mobile radiotelephone MS in step E26. If the result RSRESn corresponds to the signed response SRESn, the authentication of the subscriber is satisfied and the subscriber can use the mobile radiotelephone MS to communicate. Otherwise, authentication fails and the subscriber cannot communicate with his mobile radio. In the case of a first authentication, it is not possible to use respectively the response and the response result of the previous authentication. A number whose value is established by convention is then applied to the transformation algorithm together with the random number. In a preferred variant the value of this number is zero.
• the SIM card can for example use the value of the random number which is transmitted to it via the radiotelephone terminal MS by the fixed network VLR / HLR-AUC.
• the null value of the most significant bit of the random number can indicate that it is a first authentication.
• a non-zero value of said most significant bit indicates to the SIM card that it is at least a second authentication.
• Other configurations or technical solutions can also be used to deal with the specific case of a first authentication.
• the nature of the AT transformation algorithm can have an influence on the robustness of the authentication method according to the invention.
• the transformation algorithm will preferably be carried out by means of a so-called one-way function.
• the use of a so-called collisionless function to carry out the AT transformation algorithm should preferably be considered.
• Such a function does not make it easy to find couples (RAND1, SRES1) and (RAND2, SRES2) such that
• the transformation algorithm AT is carried out using a hash function which satisfies both the properties of a one-way function and of a collision-free function.
• the hash function corresponds to the SHA-1 algorithm (Secure Hash Algorithm - version 1) defined by the FIPS standard (Federal Information
• the 128 most significant bits could be kept to conform to the specifications of the algorithm.
• said radiotelephone MS accepts an authentication request E223 from the subscriber from the second mobile radiotelephone MS2 with as data a random number RANDm transmitted by the fixed network in step E222 to the mobile radiotelephone MS2.
• the subscriber's radiotelephone requests, in step E224, the subscriber's SIM card to generate a signed response SRESm.
• the SIM card applies, in step E225, the random number RANDm and the signed response SRESn corresponding to the previous authentication to the transformation algorithm AT.
• the number TRANDm thus obtained and the authentication key Ki are applied, in step E226, to the authentication algorithm AA of the SIM card to develop the signed response SRESm.
• the subscriber's mobile radiotelephone MS returns, in step E227, said signed response to the second mobile radiotelephone, which is transmitted, in step E228, to the fixed network VLR2 / HLR-AUC.
• the fixed network works out by the authentication center AUC, in step E231, the response result RSRESm to be compared, in step E233 with the signed response SRESm.
• the response result RSRESm is obtained following step E232 consisting in applying to the transformation algorithm AT stored in the authentication center AUC, the random number RANDm and the response result RSRESm-1 stored in said center authentication following the previous request for legal authentication of the subscriber.
• the number TRANDm thus obtained is applied, in step E231, with the authentication key Ki of the subscriber to the authentication algorithm AA stored in the authentication center AUC.
• the response result obtained is compared, in step E233, with the signed response SRESm transmitted by the second mobile radiotelephone MS2.
• the comparison obviously fails and the attacker cannot communicate on the subscriber's account.
• the authentication method according to the invention thus perfectly defeats the so-called “virtual cloning” attack on the subscriber's SIM card.
• the authentication method according to the invention can be implemented in a network telecommunications in relation to two entities, one of which needs to authenticate the other, each entity being able to be a set of predetermined and linked entities.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Mobile Radio Communication Systems (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34307559

Family Applications (1)

Country Status (4)

Families Citing this family (2)

Family Cites Families (1)

• 2003
  • 2003-10-02 FR FR0350638A patent/FR2860672B1/fr not_active Expired - Fee Related
• 2004
  • 2004-10-01 CN CNA2004800359339A patent/CN1890919A/zh active Pending
  • 2004-10-01 WO PCT/EP2004/052394 patent/WO2005032195A2/fr active Application Filing
  • 2004-10-01 EP EP04766873A patent/EP1668944A2/fr not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events