GB2407940A

GB2407940A - Providing secure authentication data in a wireless network

Info

Publication number: GB2407940A
Application number: GB0405492A
Authority: GB
Inventors: Robert Hancock
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2003-11-07
Filing date: 2004-03-12
Publication date: 2005-05-11
Also published as: GB0405492D0; GB0325978D0

Abstract

The present invention seeks to combine both an "open security" and "closed security" model to increase the security of an insecure network (e.g. WLANs). An "open security" model which allows a user to access the infrastructure before authentication occurs, which may take the form of a password and username, for example, is insecure as there is no access control on data entering the network. A "closed security" model however works at the radio level to restrict access to the network infrastructure until a successful authentication exchange has been carried out. A user can be connected to a "closed security" model network without their knowledge which is not necessarily desirable. Therefore, by combining both models the security of a network is improved.

Description

A METHOD OF PROVlDlNG SECURE AUTHENTICATION DATA IN AN

INSECURE NETWORK

This invention relates to a method of providing secure authentication data in an insecure network, such as a wireless network.

Conventiona] wireless loca] area network (WEAN) hotspot authentication allows users to access the hotspot infrastructure before authentication occurs. For example, a laptop wireless card detects that there is a wireless signal present and automatically connects to the system. Authentication commonly involves a user name and password, but hotspot access points (APB) do not implement any access control measures on user data entering the network. This is referred to as an 'open security' model or the Universal Access Method (UAM). This system is inherently insecure because it operates at the application level, so an eavesdropper can tap into the radio signal and glean information without the service provider being aware that this is 1 5 happening.

This model is slowly being rejected in favour of a 'closed security' model where the APs themselves implement access control, restricting user access to the network infrastructure until a successful authentication exchange has been carried out.

For the purpose of this description, this option is referred to as Wireless Protected Access (WPA). This is more secure because it works at the radio layer, so that when, for example, a laptop comes within range of the wireless signal, the system automatically demands security information from the laptop and prevents applications from starting until the security information has been processed.

One problem with this closed model, is that the user may not want his device to automatically connect every time he is within range. This applies particularly where the user is outside his usual environment, for example, at an overseas airport, and does not want his data to be passed through an unknown network, or where there are costs associated simply with connection and the user may not have any intention of making use of that particular connection. Another problem' is that having moved to a closed security system, there will be hotspots which have not been upgraded.

In accordance with the present invention, a method of providing secure authentication data in an insecure network comprises initializing a startup sequence when a mobile device comes within range of a wireless communication network; |. Id 'se e e e e c compiling authentication data; transmitting the authentication data to the network via a secure protocol; and preventing the mobile device from accessing the network until both open and closed security authentication is complete.

The present invcution enables a user to provide secure authentication data to their service provider before connecting up to a network, in circumstances where the network itself has not been upgraded to a secure system.

Preferably, authentication data is transferred using an application independent link layer protocol.

The mobile device may be any electronic communication device, but preferably, the mobile device is one of a laptop, personal digital assistant or mobile phone.

The method may be applied for any type of wireless network, but preferably, the network is a wireless local area network.

Preferably, the authentication data is one of a hardware token, credit card data, or a one-time scratch card.

A method of providing secure authentication data in an insecure network in accordance with the present invention will now be described with reference to the accompanying drawings in which: Figure 1 is one example of possible architecture for carrying out the method of the present invention; Figure 2 is a second example of possible architecture for carrying out the method of the present invention; and, Figure 3 is a third example of possible architecture for carrying out the method of the present invention; Within existing 'open security' hotspots, it is desirable to be able to use credentials from subscriber identity module (SIM), universal SIM (USIM) or hardware tokens, such as smart cards or PCMCIA standard cards, where there is no user intervention, to support authentication in an 'open security' network, which would normally rely on user input such as username and password, one time password (OTP) or generic token card ((]TP) type methods.

The present invention allows credentials from hardware tokens, e.g. from within the SIM card, to be accessed and sent to the backend authentication server using secure hypertext transfer protocol (HTTPS). Thus, transparent authentication exchanges, i.e. # r : : those that do not require user input, can be supported using a well-known user interaction pattern of 'open security' look and feel. The 'closed security' model user's credentials are passed across an 'open security' system, thus retaining the 'open security' model look and feel. The content handler can be a 'plugin' to the user's browser.

The 'open security' model assumes username and password style authentication procedures including other user input authentication mechanisms such as OTP and GTC. The presenting invention broadens this to include authentication mechanism types, more usually associated with closed security models, which are transparent to the user, so user credentials may be exchanged between the mobile terminal and the network via extendible markup language (XML) or multipurpose internet mail extension (MIME), but implementation of the method is not limited to these. It is also possible to use keying material generated as a side effect of this authentication exchange to secure the user data.

In each example illustrated, the system comprises a mobile terminal, the user equipment (UK) 1, an access point 2 by which the UE can connect to the network, a public access control gateway (PAC G/w) 3 and an authentication server (AS) 4.

The sequence of events is as follows. The user I associates with an AP 2 in a WEAN hotspot and opens a web browser. The PAC gateway 3 redirects the user to a login page which is processed internally within the user device, "transparent", i.e. not visible to the user. Part of this processing is to retrieve user data from the mobile device which may be, for example, by means of an XML based schema which retrieves credentials from a S1M card in the UE 1. An authentication exchange is carried out between the mobile terminal and the network to mutually authenticate and the user is provided with feedback as to the result of the authentication procedure. In the first example shown in Fig. 1, the PAC gateway 3 downloads authentication information 5, analogous to GSM triples, from the AS 4 to a visitor location register VLR.

In the example of Fig. 2, communication between the UE l and AS 4 is via HTTPS. An access accept indication 6 is provided between the AS 4 and the PAC gateway 3. There is a requirement for the access accept indication to correlate to the UE 1. In Fig. 3, an extensible authentication protocol (EAP) between the UE I and the AS 4 is achieved using HTTPS from the UEI to the PAC gateway and AAA backhaul from the gateway to the AS.

Claims

c.: : : : : : : CLAIMS

1. A method of providing secure authentication data in an insecure network; the method comprising initialising a start-up sequence when a mobile device comes within range of a wireless communication network; compiling authentication data; transmitting the authentication data to the network via a secure protocol; and preventing the mobile device from accessing the network until both open and closed security authentication is complete.

2. A method according to claim 1, wherein authentication data is transferred using an application independent link layer protocol.

3. A method according to claim I or claim 2, wherein the mobile device is one of a laptop' personal digital assistant or mobile phone.

4. A method according to any preceding claim, wherein the network is a wireless local area network.

5. A method according to any preceding claim, wherein the authentication data is one of a hardware token, credit card data, or a one-time scratch card.

6. A method as hereinbefore described with reference to the accompanying figures.