WO2001093528A2

WO2001093528A2 - Method for secure communication between a network and a terminal smart card

Info

Publication number: WO2001093528A2
Application number: PCT/FR2001/001623
Authority: WO
Inventors: Pierre Girard
Original assignee: Gemplus
Priority date: 2000-05-31
Filing date: 2001-05-25
Publication date: 2001-12-06
Also published as: AU2001264027A1; FR2809897B1; FR2809897A1; WO2001093528A3

Abstract

The invention concerns a method which sets up a secure transmission between two entities in a telecommunication network, and particularly between a mobile terminal (MS) and the stationary network, in particular visitor locating and home location registers (VLR, HLR) and an authenticating centre (AUC), in a cellular radiotelephone network. During authentication (E9, E9', E10) of a terminal, and more precisely of the SIM card therein, the data DATA are transmitted by the stationary network with a random number (NA) produced by the stationary network. The data DATA, the random number NA and a key (Ki) are applied in the first and second entities to an algorithm (AA) to proceed with authentication.

Description

Method of secure communication between a network and a smart card of a terminal

The present invention relates to a secure communication method between a smart card of a mobile radiotelephone terminal MS and a routing subsystem, often called a fixed network, in a digital cellular radiotelephone network. More particularly, the invention establishes a secure communication channel through the radio interface between a microprocessor card or module, known as a SIM (Subscriber Identify Module) chip card, removable from the terminal, and a network authentication center. radio.

A digital cellular radiotelephony network RR of GSM type, to which reference will be made hereinafter by way of example, mainly comprises several mobile radiotelephone terminals MS and a fixed network proper in which circulates signaling, control and data messages and voice as shown schematically in Figure 1.

In the RR network shown in FIG. 1 are represented in particular the main entities through which data intended for the SIM card of a mobile terminal MS located in a location area at an instant pass. These entities are a switch of the mobile service MSC connected to at least one telephone switch with autonomy of routing CAA of the switched telephone network PSTN and managing communications for visiting mobile terminals, among which the terminal MS, which are located at a given time. in the respective location area served by the switch MSC. A visitor location recorder

VLR is connected to the MSC switch and contains ι characteristics, such as identity and subscription profile of mobile terminals, in fact SIM cards in these, located in the location area. A base station controller BSC connected to the switch MSC manages in particular the allocation of channels to mobile terminals, the power of base station (s) and the handovers of mobile terminals. A base station BTS connected to the controller BSC covers the radio cell where the terminal MS is located at the given time.

The RR radiotelephony network also includes • a nominal location register HLR cooperating with an authentication center AUC and connected to the switches of the mobile service through the network of

. RR radiotelephony network signaling.

The HLR recorder is essentially a database, like a VLR recorder, which contains for each MS terminal the international identity IMSI

(International Mobile Subscriber Identity) of the SIM card of the terminal, i.e. of the subscriber owning the SIM card, the directory number and subscription profile of the subscriber, and the number of the VLR recorder to which the mobile terminal is attached and updated during transfers between location zones.

The AUC authentication center authenticates subscribers and participates in the confidentiality of data passing through the IR radio interface between the terminal MS and the base station BTS to which it is attached at the given time. It manages an A3 authentication algorithm and an A8 algorithm of encryption key determination, sometimes merged into a single algorithm A38, according to the GSM standard, which are redundant in the SIM card of the mobile terminal MS, prior to any communication with the terminal, or when the terminal is in operation or during a handover. In particular, the authentication center AUC stores an authentication key Ki allocated only to the subscriber in correspondence with the subscriber identity IMSI stored in the nominal location register HLR during subscription subscription by 1 subscriber.

In a GSM type digital radiotelephone network, shown in Figure 1, it is very important to authenticate the mobile radiotelephone terminal MS in order, among other things, to be able to recognize the subscriber. In order to ensure maximum flexibility, the authentication center does not authenticate the mobile terminal MS itself but the SIM chip card it contains. This card contains the key Ki assigned to the subscriber and proves by means of the authentication algorithm A3 that it knows the key without revealing it. The fixed network sends a random number RAD (challenge) to the card and asks the card to enter the random number and the key in the authentication algorithm for a cryptographic calculation and to return the result in the form of a response signed SRES

(Signed RESponse) for the GSM standard. It is very difficult for an "attacker", a malicious third party wishing to establish radiotelephone communications debited on the account of the owner of the SIM card, to predict the value of the random number. Without knowing the key, The attacker cannot counterfeit an answer. The size of the random number prevents the attacker from keeping in memory all the values of the signed random number-response pair in a dictionary. The authentication procedure in the radiotelephony network thus authenticates the SIM card containing a key.

The authentication procedure, shown in Figure 2, briefly includes the following steps:

beforehand, the authentication center AUC chooses several random numbers RAND and determines on the one hand several signature responses RSRES respectively according to the chosen numbers RAND and the key Ki assigned to the subscriber applied to the authentication algorithm A3 , and on the other hand several encryption keys respectively as a function of the chosen numbers RAND and of the key Ki applied to the key determination algorithm A8, in order to provide triplets [random number RAND, signature response SRES, key of encryption Kc] to the HLR location recorder, upon subscription to the mobile radio service, then each time the HLR recorder has exhausted its reserve of triplets, corresponding to the IMSI identity of the SIM card of 1 subscriber;

- each time the VLR visitor location recorder to which the SIM card is temporarily attached requests authentication of the card, the HLR recorder chooses and supplies at least one triplet to the VLR recorder in order to transmit the random number of the triplet chosen on the SIM card through the fixed network and the mobile terminal MS;

the SIM card performs a cryptographic calculation by applying the random number transmitted and the key Ki to the authentication algorithm A3 producing the signed response

SRES and returns it to the VLR recorder;

- the VLR recorder compares the response signed SRES to that contained in the chosen triplet, and in case of equality of responses, the ^' card is authenticated.

Existing digital cellular telephone networks of the GSM type do not have a secure data transmission channel ensuring the confidentiality and integrity of the data transmitted while simultaneously ensuring the denial of service is impossible.

Indeed, SMS message sending services

(Short Message Services) have been defined, but they do not provide any certainty as to the reception of data, and therefore do not guarantee the impossibility of a denial of service.

In many cases, it is necessary to be able to transmit DATA data while ensuring its integrity, confidentiality and the impossibility of a denial of service, most of the time for security reasons.

The invention aims to remedy the drawbacks set out above, without modifying the equipment of the radiotelephony network and with a few software modifications mainly related to authentication.

To this end, a method of secure data transmission (DATA) between a first entity

(MS) and a second entity (VLR, HLR, AUC) in a telecommunications network (RR), comprising a step of authentication of the first entity (MS) by the second entity (VLR, HLR, AUC), said step authentication comprising steps (E6, E6 ') of applying a key (Ki) stored in the first and second entities and a random number (NA) produced by the second entity and transmitted by the second entity to the first entity to identical algorithms (AA) stored in the first and second entities, and compare (E7) in the second entity (VLR, HLR, AUC) a response (SRES) produced by the algorithm (AA) stored in the first entity and transmitted to the second entity and a response result (RSRES) produced by the algorithm (AA) stored in the second entity, is characterized by the steps of transmitting the data (DATA) with the random number from the second entity to the first entity (N / A) , apply the data (DATA) with the random number (NA) to the algorithm (AA) in the first entity and in the second entity.

When the authentication is complete, the RR network is certain that the DATA data has reached the SIM card. MS terminal. The validity of the SRES response provided by the card to the network attests that the integrity of the random number NA and the DATA data has been preserved, and prevents any denial of service. Confidentiality is ensured by associating DATA data with the random number NA, which makes their location difficult. The invention therefore makes it possible to solve the problems raised previously by involving only a modification of the software of the SIM cards, the first entities, and of the nominal recorders and authentication centers, included in the second entities, without having any impact on network infrastructure. These modifications can be made gradually without disruption of the fixed network.

In the method, the random number (NA) and the data (DATA) can respectively have Q bits and P-Q bits.s in length, P being a constant integer.

The method can include a step of encryption of the data (DATA) or of the pair formed by the random number (NA) and the data (DATA). In this case, the confidentiality of DATA data is increased, as well as the system's resistance to cryptanalysis attacks.

In the method, a terminal identity authentication and registration means (VLR, HLR, AUC) can determine several triplets each comprising a random number (NA), the data (DATA) and a response result (RSRES). corresponding to the random number (NA) and the data (DATA).

The method may include a step of determining (E8) an encryption key (Kc) as a function of the random number (NA), the data (DATA) and the key (Ki) in the second entity (VLR, HLR, AUC) . The method can also include a step of not determining (ElO) an encryption key (Kc) as a function of the random number (NA), the data (DATA) and the key (Ki) in the first entity (MS) only when the response (SRES) and the response result (RSRES) compared are identical.

Finally, in the method, the data (DATA) can be used in the first entity (MS) by a prepaid account management application, to update access rights to files (DF, EF) stored in the first entity or by an application to activate an additional key (Ki '), in the case where one or more additional keys Ki' have been stored in the first and second entities.

The invention also relates to an identity module (SIM) in a first entity (MS) which is characterized in that it comprises means (ROM, EEPROM) for storing an algorithm (AA) and a key (Ki), means for receiving a random number (NA) and data (DATA) and means (ROM, EEPROM, RAM) for executing at least step (E6) of applying the key (Ki) the random number (NA) and the data (DATA) to the algorithm (AA) according to the invention.

Finally, the invention also relates to an authentication center (AUC) in a telecommunications network (RR) which is characterized in that it comprises means for storing an algorithm (AA) and a key (Ki), means for select a random number (NA) and data (DATA) and means to execute at least step (E6 ') to apply the key (Ki) the random number (NA) and the data (DATA) to the algorithm (AA) according to the invention.

Other characteristics and advantages of the present invention will appear more clearly on reading the following description of several preferred embodiments of the invention with reference to the corresponding appended drawings in which:

- Figure 1 is a schematic block diagram of a digital cellular radio network;

- the _. FIG. 2 schematically shows steps of a method for authenticating a digital cellular radiotelephony network; and

Figure ^• 3 shows steps of a secure data transmission according to the invention;

The method of the invention is described below in the context of the RR radiotelephony network of GSM type, already presented with reference to FIG. 1, which undergoes only software modifications and additions essentially in the AUC authentication center. , as well as in the SIM cards of mobile terminals.

In the description below, a fixed network is considered to be the chain of entities attached to the mobile radiotelephone terminal considered MS from the radio interface IR, comprising the base station BTS, the station controller BSC, the switch MSC with the 'VLR visitor location recorder, and the HLR-AUC pair. It is recalled that a mobile radiotelephone terminal MS of a subscriber comprises a removable microprocessor module, known as a SIM chip card connected to a bus of the digital microprocessor circuit in the terminal, the bus serving the keyboard, the screen and device terminals of the mobile terminal. As shown in Figure 1, the SIM chip card mainly contains a microprocessor, a ROM memory including the operating system of the card and specific application algorithms, a non-volatile EEPROM memory which contains all the characteristics related to the subscriber such as the IMSI identity, the subscription profile, the list of called numbers with their names, security data such as key and confidential code, etc., and a RAM memory used for data processing to receive from and transmit to the digital circuit of the terminal. In particular, the authentication and encryption key determination algorithms and the keys and other parameters related to these algorithms are managed and written in the ROM and EEPROM memories.

With reference to FIG. 2, the secure information transmission method according to the invention succeeds in placing the SIM card of the radiotelephone terminal MS in communication with the sub-network BTS, BSC, MSC and VLR included in the network of radiotelephony RR and temporarily attached to the radiotelephone terminal MS, and precedes an encryption key determination.

The process shown in Figure 2 essentially comprises steps from E0 to Eli. In FIG. 2, steps E0, E2, E6 ', E60, E20, E8 and E81 are carried out essentially in the fixed network, independently of any request for authentication, .and at least prior to the request for authentication considered in step E3 according to the illustrated embodiment.

Initially, at a step E0, the mobile terminal is considered to have stored in the ROM and EEPROM memories of its SIM card, the IMSI identity of the latter, that is to say the identity of the subscriber possessing the SIM card, if applicable the temporary identity TMSI of the card allocated by the attachment switch MSC, an authentication key Ki with an authentication algorithm AA for authenticating the terminal MS over the network, an algorithm for determining AC encryption key, an encryption / decryption algorithm. These initial data and algorithms are also stored in the initial step EO in the fixed network. The keys Ki for each subscriber are stored in the authentication center AUC in correspondence with the subscriber identity IMSI, the temporary identity being only assigned by the visitor location register VLR connected to the switch of the mobile service. MSC to which the mobile terminal MS is attached. The authentication algorithm AA and the encryption key determination algorithm AC are stored in the authentication center AUC, and the encryption / decryption algorithm ^" is installed in the base station BTS. As will be seen in the following, the AUC authentication center supplies triplets [(NA, DATA), RSRES, Kc] to the nominal location register HLR.

When requesting access to the mobile service by the terminal, for example after the mobile terminal MS has started operating, or for a updating the location of the terminal, or prior to a telephone call, or periodically to authenticate the SIM card at the request of the VLR recorder, the terminal MS exchanges signals with the home subnet so as to dedicate to the terminal MS a communication channel and to declare by the terminal MS to the subnet the identity of the terminal by transmitting the IMSI identity of the SIM card of the terminal to the visitor location recorder VLR, or if appropriate 1 ' TMSI temporary identity with the identity of the LAI localization area relating to the last communication established. These exchanges for dedicating a channel to the terminal MS are illustrated in a simplified manner by step El in FIG. 2.

Beforehand, in the AUC center, a pseudo-random generator supplies several random numbers NA with Q bits. The DATA data to be transmitted securely according to the method of the invention is combined with each random number NA with Q bits and the pairs (NA, DATA) results of this combination are written in the HLR recorder in association with the identity IMSI of the SIM card, and at least one pair (NA, DATA) chosen by the HLR recorder is transmitted to the VLR recorder to which the terminal is attached in step E20.

The DATA data is transmitted to the SIM card according to the method of the invention when the VLR visitor location recorder decides to proceed to the authentication of the SIM card by the fixed network: the chosen pair (NA, DATA) is introduced successively in authentication request messages in step E3 transmitted respectively by the MSC switch, the controller BSC and finally the BTS base station to the mobile terminal MS through the IR radio interface.

If the pairs (NA, DATA) are P bits in length, the integer P, with P> Q, can be chosen so as not to modify the length of the authentication messages according to the standard in force in the radiotelephony network. RR, in this case the length of messages containing a RAND number. In this case the modifications made to the RR network and to the SIM cards will be further reduced. The integer P is typically equal to 128, i.e. a size of the couple

(NA, DATA) equal to 16 bytes. The integer Q denoting the number of bits in the random number NA can be greater or less than P / 2; however the integers P and Q can satisfy the equality P / 2 = Q.

In the SIM card of the mobile terminal MS, the random number NA and the data DATA are written to the RAM memory of the SIM card in step E4 in response to the authentication request messages transmitted by the home base station BTS.

At this time the SIM card has received the DATA data and can use it in a particular application, several examples of which will be provided below.

The random number NA and the data DATA received and the authentication key Ki are read in step E5 in order to apply them to the known authentication algorithm AA in step E6. At this stage, authentication continues substantially as in a known SIM card. The AA algorithm provides a signed response SRES (Signed RESponse) which is included in a message transmitted to the base station BTS, which retransmits it to the VLR through the BTS base station, the BCS controller and the MSC switch.

Beforehand, before the authentication request Ξ3 and therefore before carrying out steps E4 to E6 in the SIM card, the VLR and HLR recorders have stored for the subscriber the number NA and the DATA data, and the authentication center AUC applied, after step E20, and for each of said random numbers NA, the pair (NA, DATA) and the key Ki to the algorithm AA in step E6 '. The AA algorithm produces a response result signed RSRES for each pair (NA, DATA). Concomitantly with step E20, the RSRES results are written in the HLR recorder in a step E60 and the pair (NA, DATA) chosen by the recorder is

_ transmitted with the corresponding RSRES result to the VLR recorder which memorized them.

On receipt of the signed response SRES transmitted by the mobile terminal MS after step E6, the recorder VLR reads the response result signed RSRES in step E61 and compares it with the response received SRES in step E7. If these two variables are not identical, the VLR register commands the attachment switch MSC to disconnect the terminal and the fixed network in step E71, preventing the terminal from continuing its request for access to the mobile service.

Otherwise, the AUC authentication center validates the authentication of the SIM card in step E7, to authorize the encryption and decryption of the messages exchanged later between the mobile terminal MS and the BTS-BSC-MSC subnet.

At this point, the AUC authentication center has not only authenticated the SIM card, but also has proof that it has received the DATA data.

The association of the DATA data with the random number NA can result in a relative decrease in the resistance of the couple (NA,

DATA) to cryptanalysis attacks against a random number of the same dimension. In order to mitigate this effect, encryption of the DATA data or of the pair (NA, DATA) can be carried out by the AUC authentication center before their transmission to the SIM card. Such an encryption step will also have the consequence of significantly improving the confidentiality of the transmitted DATA data.

The signed response SRES that the SIM card sends to the network for authentication is generally ^'much shorter than the random number RAND or couple (NA DATA) transmitted by the network to the SIM card. However, data can also be associated with the response signed SRES or inserted into it, so as to allow the SIM card to communicate information to the RR network. Even if the amount of information transmitted is very limited, it is sufficient to report behavior revealing fraud to the network.

Once the DATA data has been received by the SIM card and the authentication of the SIM card has been verified by the AUC authentication center, a encryption Kc can then be determined: beforehand, the authentication center AUC has applied the pairs (NA, DATA) corresponding to said several random numbers NC and the key Ki to the algorithm for determining the encryption key AC in a step E8 in order to produce encryption keys Kc, which are stored in the recorder VLR in a step E81 concomitant with steps E20 and E60. Thus, several triples [(NA, DATA), RSRES, Kc] are stored beforehand in the nominal location register HRL, and at least one of them chosen is written in the VLR register in association with the identity IMSI / TMSI of the SIM card.

Following step E7, the switch MSC decides to switch to encrypted mode by transmitting an encryption authorization message with the key Kc, relayed by the entities BSC and BTS, to the mobile terminal MS, the key Kc being taken by the BTS base station.

Furthermore, following the execution of the authentication step E6, the SIM card reads in step E9 the couple random number NA and given DATA and also the authentication key Ki in order to apply them to the 'encryption algorithm AC to' determine an encryption key Kc in step ElO.

Finally at stages Eli and Eli ', the terminal MS and the attachment subnet, in particular the attachment base station BTS which contains an encryption and decryption algorithm identical to that contained in the SIM card and which has stored the key determined Kc, can exchange encrypted and decrypted messages with the Kc key.

First example of implementation of the method according to the invention: securing of radio-telecommunication networks operating in prepaid mode

Certain telecommunications networks use the following prepaid operating mode: each time the user of the mobile terminal MS wishes to fund his account, he goes to a payment terminal performs a transaction for a certain value. Once the transaction is validated by banking services, the network RR sends to the SIM card information in order to update the map ACM counter (Accumulated Gard Meter) and the value ^maximum ACMmax that this counter can reach, by means of an SMS message. Then during each communication, the network RR sends the mobile terminal MS pricing information ÇAI (Charge Advice Information), which the terminal MS uses to send to the SIM card commands to increment the ACM counter. Thanks to exchanges with the SIM card, the terminal MS regularly checks that the ACM counter does not exceed its maximum permitted value ACMmax.

Unfortunately, since the exchanges between the mobile terminal MS and the SIM card are not secure, such a system is fairly easy to hack.

Thanks to the method of secure data transmission according to the invention, it becomes possible to transmit to the SIM card, in a secure manner, information at the start and end of communication and / or data for estimating the frequency of ACM counter increases. The SIM card is then capable of detecting fraud attempts independently and taking appropriate measures.

Second example of implementation of the method according to the invention: modification of the SIM card.

A change to the SIM card may be necessary in many cases. For example, if the network detects fraud attempts, the network can send the card a temporary or permanent blocking command. When adding or removing services, the secure data transmission method according to the invention makes it possible to modify the access rights to elementary files EF (Elementary Files) or to dedicated files DF (Dedicated Files) containing by example of SIMToolkit or μcombo command scripts.

Third example of implementation of the method according to the invention: urgent modification of a key.

SIM cards contain many keys which can be used for different applications. These keys are generally stored in the SIM card during its personalization phase. By using the transmission method according to the invention, and by storing in the SIM card one or more spare keys, it suffices to send a key switching command to pass from the use of a compromised key, it ie made public, using an always secret spare key.

Although the invention has been described according to preferred embodiments with reference to a radiotelephony network between a radiotelephone terminal mobile and the fixed network of the radiotelephony network, the authentication method of the invention can be implemented in a telecommunication network in relation to any two entities in which the first entity authenticates the second by means of a mechanism random challenge / signed response.

Claims

1 - Method for the secure transmission of data (DATA) between a first entity (MS) and a second entity (VLR, HLR, AUC) in a telecommunications network (RR), comprising a step of authentication of the first entity (MS ) by the second entity (VLR, HLR, AUC), said authentication step comprising steps (E6, E6 ') of applying a key (Ki) stored in the first and second entities and a random number (NA) produced by the second entity and transmitted by the second entity to the first entity with identical algorithms (AA) stored in the first and second entities, and compare (E7) in the second entity (VLR, HLR, AUC) a response (SRES) produced by the algorithm (AA) stored in the first entity and transmitted to the second entity and a response result (RSRES) produced by the algorithm (AA) stored in the second entity, characterized by the steps of:

transmit the data (DATA) with the random number (NA) from the second entity to the first entity, apply the data (DATA) with the random number (NA) to the algorithm (AA) in the first entity and in the second entity.

2 - Method according to claim 1 according to which the random number (NA) and the data (DATA) have respectively Q bits and P-Q bits of length, P being a constant integer.

3 - Method according to claim 1 or 2 characterized by a data encryption step (DATA) or of the couple formed by the random number (NA) and the data (DATA).

4 - Method according to one of the preceding claims, characterized in that a means of authentication and terminal identity registration (VLR, HLR, AUC) determines several triplets each comprising a random number (NA) the data (DATA) and a response result (RSRES) corresponding to the random number (NA) and data (DATA).

5 - Method according to claim 4, comprising a step of determining (E8) an encryption key (Kc) as a function of the random number (NA), the data (DATA) and the key (Ki) in the second entity ( VLR, HLR, AUC).

6 - Method according to one of claims 4 or 5, comprising a step of not determining (ElO) an encryption key (Kc) based on the random number (NA), data (DATA) and the key (Ki ) in the first entity (MS) only when the compared response (SRES) and response result (RSRES) are identical.

^• 7 - Method according to one of the preceding claims, characterized in that the data (DATA) are used in the first entity (MS) by a prepaid account management application.

8 - Method according to one of the preceding claims, characterized in that the data (DATA) are used in the first entity (MS) to update access rights to files (DF, EF) stored in the first entity. 9 - Method according to one of the preceding claims, characterized in that one or more additional keys Ki 'are stored in the first and second entities, and in that the data (DATA) are used in the first entity (MS) by an application to activate an additional key (Ki ').

10 - Identity module (SIM) in a first entity (MS) characterized in that it comprises means (ROM, EEPROM) for storing an algorithm

(AA) and a key (Ki), means for receiving a random number (NA) and data (DATA) and means (ROM, EEPROM, RAM) for executing at. minus step (E6) of applying the key (Ki) the random number (NA) and the data (DATA) to the algorithm (AA).

11 - Authentication center (AUC) in a telecommunications network (RR) characterized in that it comprises means for storing an algorithm (AA) and a key (Ki), means for selecting a random number (NA) and data (DATA) and means for executing at least step (E6 ') of applying the key (Ki) the random number (NA) and the data (DATA) to the algorithm (AA).