Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication

Definitions

• the present invention relates to a method and a system for increasing the security in a system comprising and communicating with a removable memory card, such as a SIM card or a smart card.
• a removable memory card such as a SIM card or a smart card.
• GSM Global System for Mobile communication
• SIM-cards Subscriber Identity Module
• the GSM system provides communication between a base station and one or several Mobile Stations (MS) .
• MS Mobile Station
• M Mobile Equipment
• SIM card for providing each Mobile Station with a unique identity.
• GSM 02.09 “Digital cellular telecommunications system; Security aspects”
• GSM 03.20 ETS 300 929) : “Digital cellular telecommunications system; Security related network functions”.
• the network sends a Random Number (RAND) to the Mobile Station (MS) .
• the Mobile Equipment (ME) passes the random number to the SIM card.
• a command "RUN GSM ALGORITHM” is given to the SIM card as described in GSM 03.20 (ETS 300 929) : "Digital cellular telecommunications system; Security related network functions”.
• the SIM returns the values Signed RESponse calculated by a SIM (SRES) and Cryptographic key (Kc) to the mobile equipment.
• SRES Signed RESponse calculated by a SIM
• Kc Cryptographic key
• the ME sends SRES to the network.
• the network compares this value with the value of SRES which it calculates for itself. The comparison of these SRES values provides the authentication.
• the value Kc is used by the ME in any future enciphered communications with the network until the next invocation of this mechanism.
• This object is obtained by means of adding a new function in the existing SIM card so that the SIM-card will challenge the system.
• the SIM-card will issue a random number towards the network and the network then has to respond with a correct result. If not the SIM-card will be automatically switched off.
• the method can also be used in other systems than the GSM system, where it is imperative that the removable memory card should not be cracked.
• An example is when money are stored on a card ("electronic money") and where the amount can be refilled.
• Other application areas are also possible.
• Means for executing the method can be provided in integrated circuits, mobile telephones, modems, etc.
• An authentication unit for providing additional security can in this manner easily be provided in existing systems.
• - Fig. 1 is a flow chart illustrating different steps carried out when verifying the authenticity of a SIM-card located in a Mobile Station (MS) communicating with a network.
• MS Mobile Station
• FIG. 2 is a flow chart illustrating an alternative scheme according to a second embodiments
• a flow chart illustrating different steps carried out during authentication in a GSM system is shown.
• MS Mobile Station
• ME Mobile Equipment
• the SIM card then returns a status condition indicating that the status is OK and that a challenge towards the system should be issued before the command "RUN GSM algorithm” can be issued again, step 105.
• the ME requests the response from the SIM card, step 107 and the SIM card returns the values Signed RESponse calculated by a SIM (SRES) and Cryptographic key (Kc) to the mobile equipment, step 109.
• SRES Signed RESponse calculated by a SIM
• Kc Cryptographic key
• the MS then returns the SRES and the Kc to the GSM network as an authentication of the SIM card as described above, step 111.
• the ME issues a request for a random number to the SIM card, step 113 as a response to the message in step 105, which indicated that a challenge should be transmitted to the GSM network.
• the SIM card then returns a random number and a status OK message, step 115.
• the MS issues a request towards the GSM network for authentication thereof by means of transmitting the random (RAND) number to the GSM network.
• the GSM network then has to respond to this request, preferably by means of returning an SRES, which then can be verified by the SIM, see below.
• the GSM network responds with a SRES value to the MS, step 119.
• the SRES received by the MS is the transmitted from the ME to the SIM card, step 121.
• the SIM card then verifies that the SRES value is the correct value and, if so, returns a status: OK message to the ME, step 123.
• the ME will start over again with the authentication process of the GSM system, thus starting the procedure with step 113.
• the ME will continue to execute this process until the system replies with a correct answer, or until a certain, pre-set random numbers have been issued, without the system replying with a correct number.
• the SIM will indicate when no more challenges can be issued in the response indication in step 115.
• the SIM card turns itself off, i.e. it does not respond to any requests sent to it.
• a Mobile Station receives a random number from the GSM network, step 201.
• the Mobile Equipment (ME) of the MS issues a command "RUN GSM- algorith ", step 203.
• the SIM card then returns a status condition indicating that the status is not OK and that a challenge towards the system should be issued, step 205. This could for example be carried out by adding a new code as a response to the command "RUN GSM algorithm" .
• the Mobile Equipment issues a request for a random number to the SIM card, step 207.
• the SIM card returns a random number (RAND2) together with a status: OK message, step 209.
• This random number is then transmitted towards the system by the mobile station, step 211.
• the GSM system then returns an SRES value (SRES2), step 213.
• the ME transmits the SRES value (SRES2) to the SIM card, step 215.
• the SIM card compares this value with the value of SRES2 which it calculates for itself. The comparison of these SRES values provides the system authentication and the SIM returns an acknowledge message (status: OK) to the Mobile Equipment if the compared SRES2 values match, step 217.
• the ME will start over again with the authentication process of the GSM system, thus starting the procedure with step 207.
• the ME will continue to execute this procedure, until the system replies with a correct answer, or until a certain, pre-set random numbers have been issued, without the system replying with a correct number.
• the SIM will indicate when no more challenges can be issued in the response indication in step 209.
• the SIM card turns itself off, i.e. it does not respond to any requests sent to it.
• the ME issues the command RUN GSM algorithm towards the SIM card, step 219.
• the SIM card the responds with a status: OK message, step 221.
• the ME issues a command GET RESPONSE towards the SIM card, step 223.
• the SIM card the responds with the SRES and the Kc as described above, step 225.
• the SRES and the Kc is then transmitted by the MS to the GSM system as authentication of the SIM card, step 227.
• the SIM card only challenges the system, i.e. sends a random number to the system, every N time, N being a positive integer > 1, that the system challenges the SIM card.
• the method and system as described herein can also be employed in other kinds of systems than the systems described above.
• the method is possible to use in any system provided with means for authenticating an electronic device connected to the system.
• the system will then comprise a first authentication unit which then communicates with a second authentication unit located in the electronic device using a method corresponding to the method described above.
• the method and system as described herein provides a significantly increased security for different kinds of removable memory card, such as SIM cards, smart cards, and other kinds of systems where a mutual authentication process between an electronic device and the system is required for ensuring an acceptable security.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)
• Telephone Function (AREA)

Priority Applications (3)

Applications Claiming Priority (2)

Publications (1)

Family

ID=20413006

Family Applications (1)

Country Status (6)

Cited By (9)

Families Citing this family (5)

Citations (3)

• 1998
  • 1998-10-19 SE SE9803569A patent/SE9803569L/sv not_active Application Discontinuation
• 1999
  • 1999-10-06 DE DE19983656T patent/DE19983656T1/de not_active Withdrawn
  • 1999-10-06 AU AU14222/00A patent/AU1422200A/en not_active Abandoned
  • 1999-10-06 JP JP2000577853A patent/JP2002528978A/ja active Pending
  • 1999-10-06 CN CN99812336A patent/CN1326654A/zh active Pending
  • 1999-10-06 WO PCT/SE1999/001786 patent/WO2000024218A1/en active Application Filing

Patent Citations (3)

Also Published As

Similar Documents

Legal Events