TW200303147A - Authentication of a mobile telephone - Google Patents

Abstract

A method for enabling a mobile telephone to operate in a communications network, including: generating a random authentication number and an expected response to the random authentication number, and transmitting a forward short message service (SMS) message incorporating the random authentication number to the mobile telephone. The method further includes generating at the mobile telephone, responsive to the random authentication number, an authentication response, and receiving from the mobile telephone a return SMS message incorporating the authentication response. The method also includes performing a comparison between the authentication response in the return SMS message and the expected response, and authenticating the mobile telephone to operate in the communications network responsive to the comparison.

Description

200303147 玖 玖, description of the invention (the description of the invention should state: the technical field, prior art, content, implementation, and drawings of the invention are briefly explained) Related Applications Cross Reference This application claims the application of November 21, 2001 U.S. Provisional Patent Application No. 60 / 332,117 has priority and is hereby incorporated by reference. FIELD OF THE INVENTION The present invention relates to a method of authentication and is specific to a mobile phone for authenticating operation in a cellular communication network. BACKGROUND OF THE INVENTION A mobile phone operating in a cellular communication network undergoes a process of authentication before being able to make or receive calls. In particular, the authentication prevents fraudulent use of the mobile phone. Among them, the second type of network that is authenticated is a code division multiple access (CDMA) network and a Global System for Mobile communications (GSM) network, which operate in a time division multiple access (TDMA) format. FIG. 1 illustrates a procedure for authentication in a cellular network 10, as the related art is known. A mobile phone 12 on the network 10 transmits a start signal to a mobile switching center (MSC) 16 in communication with a base station system (BSS) 14. In order to be authenticated for operation within the network, the MSC 16 instructs an authentication center (AUC) 18 to generate a random authentication number 20, usually an array of three. The authentication number 20 is transmitted to the mobile phone 12 in an authentication packet 22. The generation is performed using data derived from the home location register (HLR) 29. MSC 16, AUC 18 and HLR 29 are included in the backbone of the network 10 to which BSS 14 is coupled. The mobile phone processes the authentication number via an authentication algorithm included in the mobile phone to generate a response value of 24. The reply value is 26 packets with an acknowledgement response 200303147

(2) Loss to the MSC. The MSC checks with the AUC 18 and HLR 29 whether the random number 20 and the reply 24 meet the authentication criteria of the network. If the criteria are met, the mobile phone is allowed to continue operating within the network. The network 10 also includes a short message service center (SMS-C) 28 in the network backbone, which can transmit and receive short text messages. The mobile phone 12 can be made to receive and transmit this SMS message. Generally, although a higher number of characters can be transmitted, a message transmitted and received by an SMS-C consists of about 128 characters.

If the network 10 includes a CDMA network and operates according to an industry standard agreement, such as the TIA / EIA / IS-2000-A-1 standard publicly issued by the Telecommunications and Communications Industry Association, Arlington, Virginia, The mobile phone 12 includes a CDMA mobile phone. AUC 18 implements an ANSI-41 agreement, which was released publicly by the Third Generation Partnership Project 2 and can be found at http://www.3gpp2.org, which agreement is incorporated herein by reference. In this case, the random authentication number 20 transmitted by the authentication center is a 32-bit number, and the response value 24 generated by the CDMA mobile phone is an 18-bit number. To perform this authentication, the CDMA mobile phone therefore needs to be able to transmit its authentication response as an 18-bit number. If the network 10 includes a GSM network, according to an industry standard agreement, such as the European Telecommunications Standards Institute in Sophia Antipolis Cedex, one of the publicly issued ETSI TS 100 940 V7.8.0 technical specifications, the mobile phone 12 includes a GSM mobile phone. Section 4.3 of the specification is incorporated herein by reference, describing the authentication procedures to be followed within a GSM network. In this case, the random authentication number 20 200303147 (3) I sent by the authentication center is zero, which is a 128-bit number, and the response value generated by the GSM mobile phone is a 32-bit number . In order to perform the authentication in the GSM network, the GSM mobile phone therefore needs to be able to transmit its authentication response as a 32-bit number.

However, if a CDMA mobile phone is to operate in a GSM network, the CDMA mobile phone needs to generate a 32-bit number of authentication responses, which is greater than the 18-bit capability of the CDMA mobile phone. In order to overcome the limited capabilities of the CDMA mobile phone, methods known in the art include modifying software for both the GSM authentication center and the CDMA mobile phone. When the CDMA mobile phone will operate in its native CDMA environment, the software is replaced by its original software. Another procedure known in the art is to modify the software of the GSM center, so that only "CDMA-type" authentication is performed on CDMA mobile phones that are operable in the GSM network. These two methods will be realized Summary of the invention One of the features of the present invention is to provide a method and system for identifying a mobile phone for operation in a communication network.

In a preferred embodiment of the invention, a mobile phone will operate within a cellular communication network. A base station or a switching center of the network authenticates the mobile phone by transmitting an authentication request in the form of a message to the mobile phone. The message is usually a short message system (SMS) message. The SMS message includes a first identifier defining the SMS message as an authentication request, along with a random number used as part of the authentication procedure. By analyzing the first identifier, the mobile phone recognizes the SMS message as the authentication request and processes the accompanying random number through an authentication algorithm included in the mobile phone to generate an authentication response. The response was sent to the network by the mobile phone 200303147 (4) I Expenses: Material: One of the transmitted SMS messages. The return SMS message includes a second identifier, defining the return message as including the authentication response. The network routes the return message to reply to the response, and compares the response of the reply with an expected response to authenticate the mobile phone. The use of SMS messages as the delivery system for authentication requests and responses avoids the random number size and response limitations of systems known in the art. In some preferred embodiments of the invention, the mobile phone is capable of operating in at least two communication networks. Each network includes a different authentication protocol, each protocol defining the random number and the different sizes of the response. The mobile phone can be authenticated within its "native" network or operate under a different protocol without the need to modify software or hardware when moving from one network to another. In another preferred embodiment of the present invention, the network support data cluster messages (DBMs) operated by the mobile phone, the authentication request message transmitted to the mobile phone, and the authentication response message transmitted by the mobile phone are Transfer as DBMs. Optimally, the DBMs are a type that is already supported by a communication protocol that is being operated by the network. The present invention will be better understood by using the detailed description of these preferred embodiments together with the accompanying drawings, in which: a brief description of the drawings FIG. 1 is a schematic diagram illustrating an authentication process of a cellular communication network As the related art is known; FIG. 2 is a schematic diagram explaining an authentication process of a mobile phone; FIG. 3 is a preferred embodiment of the present invention; and FIG. The mobile phone authentication institute 200303147 (5) \ mmm: a sequence diagram of steps, such as a preferred embodiment of the present invention. Detailed description of the schema

Reference is now made to Fig. 2, which is a schematic diagram explaining an authentication process of a mobile phone 32; as a preferred embodiment of the present invention. The mobile telephone 32 is adapted to operate within a cellular communication network 30, which functions according to a first industry standard cellular communication protocol. The mobile phone includes a circuit 35 to enable the mobile phone to operate. More preferably, the mobile phone 32 is adapted to operate in accordance with a first protocol and is operable in accordance with a second industry standard cellular communication protocol. For example, the first protocol includes a Global System for Mobile Communications (GSM) protocol, such as one of the ETSI TS 100 940 V7.8.0 technical specifications referred to in the background of the present invention, and the second protocol includes a code division multiple access (CDMA) ) Agreement, such as the background of the present invention, also refer to one of the TIA / EIA / IS-2000-A-1 standards. In addition, the mobile phone 32 is operable according to a GSM or a CDMA industry standard protocol, or another protocol known in the art.

A base station system (BSS) 34 is coupled to a mobile switching center (MSC) 40, which is sequentially coupled to an authentication center (AUC) 36 and a home location register (HLR) 38. Alternatively, a short message service center (SMS-C) 42 may also be coupled to the MSC 40. At least one of the BSS 34, AUC 36, HLR 38, and MSC 40 functions as a network control center 37 to control the transmission within the network 30. In addition to the differences described below, AUC 36, HLR 38, MSC 40, and SMS-C 42 generally operate as AUC 18, HLR 29, MSC 16, and SMS-C 28, respectively, with reference to Figure 1 of the background of the present invention. The mobile phone 32 desires to operate within the network 30 and transmit a start signal to the BSS 34. To identify the mobile phone, the BSS 34 transmission was encapsulated in a -10- 200303147 ⑹

One of the random identification numbers 44 in the forwarding message 48 is to the mobile phone 32. Unless stated otherwise below, message 48 is assumed to include an SMS message. The message 48 is combined with an identifier 46 in the message, so the mobile phone 32 can recognize the SMS message 48 as a special message for transporting the random authentication number. Upon receiving the SMS message 48, the mobile phone 32 decodes the message, responds to the value of the random authentication number 44, and applies the value of the reply to the authentication algorithm included in the mobile phone to generate an authentication response. Preferably, the software for decoding the message 48, the reply number 44 and the authentication algorithm are combined into a separate replaceable element 31, most preferably as a user identification module in the mobile phone 32 Group (SIM). In addition, the software is fully integrated into a memory 33 of the mobile phone.

The mobile phone 32 combines the authentication response with a second return message 54 as a reply value 50, and transmits the message to the BSS 34. Except as described below, the message 54 is assumed to include an SMS message. The mobile phone 32 incorporates an identifier 52 in the message 54, so the message can be recognized as a special message for transporting the authentication reply. The SMS message 54 is routed from the BSS 34 to the MSC 40, and the identifier 52 recognizes the message as including the authentication reply, and retrieves a reply value 50 from the message. The MSC 40 checks the expected response corresponding to the value 50 and the random authentication number 44 and, if there is a correspondence, authenticates the mobile phone 32. By combining the random authentication number and the response value 50 in the SMS message, the size limitation of the random authentication number and the response value is defined by different protocols under the operation of the mobile phone 32 and is overcome. These limitations are overcome because SMS messages can transmit 128 or more 8-bit characters. Figure 3 shows the steps involved in the authentication of a mobile phone 3 operating within the network 30 -11-200303147

One of the steps is shown in FIG. 60, which is a preferred embodiment of the present invention. By way of example, the network 30 is assumed to operate according to a GSM protocol. The sequence diagram 60 illustrates the steps that the mobile phone 32 has issued an initial transmission, received by the BSS 34, and waiting to be performed before and after authentication. The initiation transmission is combined with an International Mobile Subscriber Identity (IMSI), usually the phone number of mobile phone 32, which was assigned to the mobile phone when it was initially registered on the network, and is also stored in the AUC 36. Also at the time of registration, the mobile phone 32 is assigned a user authentication key (Ki), which is stored in both the mobile phone and AUC 36.

In a first step 62, the AUC 36 generates a random number (RAND) and uses RAND to calculate an identification parameter, which is designated as a signal response (SRES), which is a function of RAND and Ki. AUC 36 also calculates a cryptographic key (Kc), which is a function of Ki and RAND. IMSI, Kc, RAND and SRES are transmitted and stored in HLR38. In the second step 骡 64, the HLR 38 transmits the values of IMSI, Kc, RAND and SRES to the MSC 40 after the MSC has received the initial transmission via the BSS 34. The MSC 40 stores IMSI, Kc, RAND, and SRES for later comparison purposes.

In the third step 66, the MSC 40 combines the RAND value and corresponds to the random authentication number 44 (Fig. 2) into the SMS message 48. The SMS message is transmitted to the BSS 34 via a traffic or a control channel. In addition, if the network 30 includes a CDMA 2000 network, the transmission can be performed using an application data delivery service (ADDS). In a fourth step 68, the BSS 34 adds an identifier 46 to the message and transmits the message to the mobile phone 32. In the fifth step 70, the mobile phone 32 recognizes the SMS message 48 as one of the bracketed code 44 by using the software identifier 46 of the SIM 31 or the memory 33 included in the mobile phone -12- 200303147. The mobile phone uses the number 44 and the IMSI and Ki values stored by the mobile phone to generate a response value of 50 as one of the signals of the response number 44. The mobile phone then constructs an SMS message 54 combining the response value 50 and the identifier 52. In a sixth step 74, the mobile phone transmits an SMS message 54 to the BSS 34.

In a final step 76, the BSS 34 sends an SMS message 54 to the MSC 40, which is identified by the identifier 52 as a response to one of the authenticated SMS messages 48. The MSC 40 then returns the value of the reply value 50 from the message 54 as a signal response and compares the reply value with the expected value of the SRES received by the HLR 38 in the second step 64. If the two signal responses match, the MSC 40 authenticates the mobile phone; if the responses do not match, the mobile phone is not authenticated. It will be appreciated that the above description with reference to Figs. 2 and 3 applies to virtually any mobile transceiver operating within a cellular communication network, wherein the transceiver is capable of transmitting and receiving SMS messages. Therefore, the scope of the present invention is not limited to any particular protocol or method utilized by the transceiver and / or the network.

In other preferred embodiments of the present invention, the BSS 34 and the mobile phone 32 can pass a spread spectrum system such as a code division multiple access (CDMA) system, messages 48 and 54 (FIG. 2), including short data cluster messages. communication. The data cluster information is described and characterized in TIA / EIA / IS-2000-A-1, with reference to the inventive background of the present invention. The data cluster information is preferably produced based on one of the predefined categories incorporated in the standard, or is otherwise produced through a custom-defined category. If the messages 48 and 54 are in the form of a data cluster message, in the sixth step 74 and the final step 76, the BSS 34 identifies the information -13-

200303147 (9) Cluster news MSC 40. Comparison. With these numbers in mind, that is, the Pi specific agreement, so that the action will be changed as described, as well as the embodiment. Such a combination description will not be represented in the previous drawing. 10, 30 12, 32 16, 40 14, 34 18, 36 20, 44 22 29 '38 The MSC performs a random authentication number between the response value and the expected value of the SRES and responds to the SMS or data cluster message code. Limitations on the size of the number and response are avoided. This size limit is usually defined by the unit identification number and the number of individual bits in the response. Using SMS or data cluster messaging as a delivery system Mobile phones can be authenticated in a variety of protocols without the need to modify the phone's software or hardware. The preferred embodiments described above are cited by way of example. The invention is not limited to the specifics that have been specifically shown and described above. The scope of the invention includes the various states and sub-sets described above, and Changes and amendments are disclosed in Reading previously occurred to those familiar with the relevant art, and these changes and amendments are revealed. Symbol description Cellular network Mobile phone Mobile switching center Base station system Authentication center Authentication number Authentication packet Local location register

-14- 200303147 (ίο) 24, 50 reply value 26 authentication response packet 28, 42 SMS service center 35 circuit 37 network control center 48, 54 message 46, 52 identifier 31 replaceable component 33 memory

Claims (1)

200303147 Patent application scope 1. A method for enabling a mobile phone to operate in a communication network, comprising: generating a random authentication number and expecting a response from one of the random authentication numbers; transmitting and combining the random authentication number One sends a short message service (SMS) message to the mobile phone; the mobile phone responds to a random authentication number to generate an authentication response; the mobile phone receives an SMS message back in conjunction with one of the authentication responses; A comparison between the authentication response of the returned SMS message and the expected response; and a response comparison to authenticate the mobile phone for operation within the communication network. 2. The method of claim 1 in which the mobile phone is adapted to be operable in a plurality of different communication protocols. 3. The method according to item 2 of the scope of patent application, wherein the authentication number includes a random authentication number size and the expected response, and the authentication response each includes an expected response size, and wherein the random authentication number size and The expected response size has the value of individual agreements that can be responded to included in the multiple agreements. 4. The method of claim 1 in the scope of patent application, which comprises: combining a prior identifier in the forwarding SMS so that the mobile phone can recognize the forwarding SMS message as an authentication request; and combining the mobile phone with an Reverse identifier in the returned SMS message 200303147 , So that the returned SMS message is recognized as an authentication response. 5. A device for enabling a mobile phone to operate in a communication network, comprising: a network control center, which is adapted to: generate a random authentication number and expect one of the random authentication numbers, Combining the random authentication number into a forwarding short message service (SMS) message, and transmitting the forwarding SMS message to the mobile phone; and a circuit included in the mobile phone, which is adapted to: respond to random authentication An authentication response is generated from the number, combined with the authentication response in a backhaul SMS message, and transmitting the backhaul SMS message to the network control center, the network control center is still adapted to perform the authentication between A comparison between the response and the expected response; and a response comparison to identify the mobile phone operating within the communication network. 6. The device according to item 5 of the patent application, wherein the network control center includes at least one of a base station (BSS), a mobile switching center (MSC), and an authentication center (AUC). 7. The device of claim 5 in which the circuit is adapted to operate the mobile phone within a plurality of different communication protocols. 8. The device according to item 7 of the scope of patent application, wherein the random identification number packet 200303147 The small and the expected response size has the value of individual agreements that can be responded to included in the multiple agreements. 9. The device according to item 5 of the patent application, wherein the network control center is adapted to enable the circuit to recognize that the forwarded SMS message is a forward identifier incorporated in the forwarded SMS message, and The circuit is adapted to enable the network control center to recognize that the returned SMS message is a reverse identifier of an authentication response and to be incorporated in the returned SMS message. 10. A method for enabling a mobile phone to operate in a communication network that transmits and receives data cluster messages, which includes: generating a random authentication number and expecting a response from one of the random authentication numbers; and combining the transmission with the random One of the authentication numbers forwards the data cluster message to the mobile phone; the mobile phone responds to the random authentication number to generate an authentication response; the mobile phone receives a data cluster message back in combination with one of the authentication responses; A comparison between the authentication response of the returned data cluster message and the expected response; and a response comparison to authenticate the mobile phone for operation within the communication network. 11. A device for enabling a mobile phone to call and operate in a communication network that transmits and receives data cluster messages, comprising: a network control center that calls: generating a random authentication number and the random authentication number One looking forward to 200303147 In response, combining the random authentication number into a forwarding data cluster message server and transmitting the forwarding data cluster message to the mobile phone; and a circuit included in the mobile phone, which is adapted to: respond to the random authentication Number and generate an authentication response, Combining the authentication response in a backhauled data cluster message and transmitting the backhauled data cluster message to the network control center, the network control center is still adapted to execute a response between the authentication response and the expected response. A comparison; and a response comparison to verify that the mobile phone is operating within the communication network. 12. A device for enabling a mobile phone to operate in a communication network, comprising: a network control device, which is called: generating a random authentication number and expecting a response from one of the random authentication numbers, Combining the random authentication number into a forwarding short message service (SMS) message and transmitting the forwarding SMS message to the mobile phone; and a circuit device included in the mobile phone, which is adapted to: respond to the random authentication An identification response is generated, combining the authentication response in a backhaul SMS message, and transmitting the backhaul SMS message to the network control device, the network control device is still adapted to perform the authentication between the authentication Acknowledge response with 200303147 A comparison between the expected response; and a response comparison to identify the mobile phone operating within the communication network. 13. The device of claim 12 in which the circuit device is adapted to operate the mobile phone within a plurality of different communication protocols. 14. For the device in the scope of application for patent item 13, wherein the random authentication number includes a random authentication number size and the expected response, and the authentication response each includes an expected response size, and wherein the random authentication number size The size of the response to that expectation has the value of an individual agreement that can be responded to included in the multiple agreements. 15. The device of claim 12 wherein the network control device is adapted to enable the circuit to recognize that the forwarded SMS message is a forward identifier incorporated in the forwarded SMS message, and The circuit is adapted to enable the network control center to recognize that the returned SMS message is a reverse identifier of an authentication response and to be incorporated in the returned SMS message.