Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
  • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
  • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
  • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/60—Context-dependent security
  • H04W12/69—Identity-dependent
  • H04W12/72—Subscriber identity
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W48/00—Access restriction; Network selection; Access point selection
  • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
  • H04W48/10—Access restriction or access information delivery, e.g. discovery data delivery using broadcasted information
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
  • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
  • H04W88/16—Gateway arrangements

Definitions

• the present invention relates to a method and an apparatus for authenticating a subscriber and a network, by which the subscriber and the network are provided with mutual authentication and share a key in a wireless Internet system.
• Subscriber authentication is usually performed using an ID and a password in wireless Internet.
• This method has two problems. Firstly, since a password is transmitted without being coded, the method is fatally vulnerable in terms of security. Secondly, the method just allows a network to authenticate a subscriber but does not provide a function that allows the subscriber to authenticate the network. That is, the method does not provide mutual authentication. Accordingly, a subscriber is always exposed to the danger of malicious use of an ID/password and the danger of revealing personal information to fake servers. Disclosure of Invention Technical Problem
• the present invention provides a method and an apparatus for enabling mutual authentication between a network and a user under an existing subscriber identity module (SIM) structure in a wireless Internet system with a minimuri nutrber of messages between the subscriber and the network.
• SIM subscriber identity module
• a method of authenticating a subscriber and a network in a wireless Internet system includes a wireless Internet gateway broadcasting an agent advertisement to its subnetwork; a mobile station transmitting a network access identifier containing a first random nutrber and a mobile subscriber identity to the gateway, when entering the sub-network of the gateway ; the gateway transmitting the mobile subscriber identity and the first random n rber to an authentication server; the authentication server extracting a private key using the mobile subscriber identity, generating RES1 using the private key and the first random number, and generating XRES2 using the private key and a second random nurber; the authentication server transmitting the RES1, the second random nurber, and the XRES2 to the gateway; the gateway storing the XRES2 and transmitting the RES 1 and the second random nurber to the mobile station; the mobile station generating XRES1 using the private key and the first random number that are stored therein and comparing the X
• an apparatus for authenticating a subscriber and a network in a wireless Internet system includes a mobile station which transmits a network access identifier containing a first random nurber and a mobile subscriber identity to a gateway when entering a sub- network of the gateway, generates XRES1 using a private key and the first random number that are stored therein, compares the XRES1 with RES1 received from the gateway to authenticate the network, generates RES2 using the private key and a second random nurber received from the gateway, and transmits the RES2 to the gateway; the gateway which broadcasts an agent advertisement to the sub-network, extracts the mobile subscriber identity and the first random nurber from the network access identifier received from the mobile station entering the sub-network, transmits the mobile subscriber identity and the first random nurber to an authentication server, stores XRES2 received from the authentication server, transmits the RES 1 and the second random nurber to the mobile station, and compares the
• a n authentication server including a private key extractor which fetches a private key from a DB using a received mobile subscriber identity; a first signal generator which generates a first encryption key and RES1, which is used by a mobile station for network authentication, using the private key and a received first random nurber; a random number generator which generates a second random nutrber; a second signal generator which generates a second encryption key and XRES2, which is used for subscriber authentication, using the private key and the second random nurber; and an encryption key generator which generates a third encryption key by combining the first encryption key and the second encryption key.
• an apparatus for authenticating a network in a mobile station receives RES 1 and a second random number and includes a random number generator which generates a first random number; a first signal generator which generates a first encryption key and network authentication information XRES 1 using a private key stored therein and the first random nurber; a comparator which compares the XRES 1 with the received RES 1 to authenticate the network; a second signal generator which generates a second encryption key and subscriber authentication information XRES2 using the private key and the received second random number; and an encryption key generator which generates a third encryption key by combining the first encryption key and the second encryption key.
• a subscriber and a network can mutually authenticate each other using only two pairs of request and reply messages. Also, the subscriber and the network can share a 128-bit encryption key for secure communication using an authentication algorithm used in a conventional SIM-type mobile communication network without any change. Accordingly, security of a wireless Internet network is enhanced at a rninii im cost, and mobile c ⁇ rmunication network and wireless Internet network co-work effectively.
• FIG. 1 illustrates an entire system including a mobile ccxrmunication network and a wireless Internet network , according to an errbodiment of the present invention
• FIG. 2 illustrates a protocol for mutual authentication between a mobile station and a wireless Internet network
• FIG. 3 illustrates a data format of a temporary network access identifier (TNAI);
• FIG. 4 is a block diagram of an authentication, authorization & accounting server in home side (AAAH).
• FIG. 5 is a block diagram of an apparatus for authenticating a network in a mobile station. Best Mode [15]
• errbodiments of the present invention will be described in detail with reference to the accompanying drawings.
• FIG. 1 illustrates an entire system including a mobile c ⁇ rmunication network and a wireless Internet network , according to an errbodiment of the present invention.
• a subscriber identity module (SIM) 11 shown in FIG. 1 is inserted into a mobile station (MS) 10.
• MS mobile station
• the MS 10 When using the mobile c ⁇ rmunication network, the MS 10 is authenticated by a home location register (HLR) 14 via a base station (BS) 12 and a mobile switching center (MSC) 13.
• HLR home location register
• MSC mobile switching center
• the MS 10 is authenticated by an authentication, authorization & accounting server in home side (AAAH) 18 connected to an access point (AP) 15 via a home agent (HA) 17 and a foreign agent (FA) 16.
• AAAH authentication, authorization & accounting server in home side
• AP access point
• HA home agent
• FA foreign agent
• the HLR 14 and the AAAH 18 should be able to access a database (DB) storing a private key corresponding to the SIM 11.
• DB database
• a wireless c ⁇ rmunication system e.g., a 3G packet network supporting a mobile Internet protocol (IP)
• IP mobile Internet protocol
• two types of Internet access gateways are present as network devices that can allocate an IP address to the MS 10.
• One is a packet data service node (PDSN) referred to as an FA
• the other is an HA.
• the FA allocates an IP address to an MS requesting a simple IP service
• the HA allocates an IP address to an MS requesting a mobile IP service.
• the IP address allocated by the FA is discarded after the service ends while the IP address allocated by the HA is valid as far as the MS does not move to an area of another HA.
• Packet c ⁇ rmunication systems supporting a dynamic IP service are configured based on a domain and are connected to each other through the Internet.
• Each domain includes a mobile c ⁇ rmunication system and network devices for a packet call service.
• the mobile c ⁇ rmunication system includes a base transceiver system (BTS) and a base station controller (BSC), which are used in a digital cellular network, a personal c ⁇ rmunications service (PCS) network, and a next generation of a mobile communication network, International Mobile Teleccmnunications (IMT)-2000 (e.g., CDMA2000 or UMTS).
• the network devices for a packet call service include an HA supporting a dynamic IP service, a PDSN, an authentication, authorization & accounting (AAA) server, a domain name system (DNS) server, and a dynamic host configuration protocol (DHCP) server.
• AAA authentication, authorization & accounting
• DNS domain name system
• DHCP dynamic host configuration
• An MS accesses a PDSN through a wireless channel.
• the PDSN or an HA allocates an IP address to the MS requesting a packet call.
• the IP address allocated by the PDSN is changed when the MS moves to an area of another PDSN, but the IP address allocated by the HA is fixed within a current domain.
• An AAA server performs authentication, authorization, and accounting with respect to wireless c ⁇ rmunications network subscribers.
• a security channel is formed between AAA servers.
• An AAA server identifies a subscriber using a network access identifier (NAI), associates the NAI with a DNS server, and updates a DNS server through the security channel when an IP address is allocated dynamically.
• NAI network access identifier
• a host wanting c ⁇ rmunication with a mobile host cannot know a dynamically allocated IP address of the mobile host, and therefore, the DNS server needs to be updated dynamically.
• a DNS server is a distributed naming system that maps a domain name to an IP address.
• the DNS server dynamically updates domain names at the requests of network devices so that a fixed domain name is mapped to a changing IP address.
• a domain name is an address expressed in text to identify a host accessing the Internet and is easier to memorize and more intuitive than an IP address configured with numerals.
• FIG. 2 illustrates a protocol for mutual authentication between an MS 10 and a wireless Internet network.
• An FA 16 connected to the wireless Internet network continuously broadcasts an agent advertisement (AA) 20 to its sub-network according to a mobile IP protocol. If the MS 10 enters the sub-network of the FA 16, the MS 10 recognizes the AA 20. Then, the MS 10 generates a first random nurber (RAND1) in step 211 and transmits a registration request (R_Req) 21 to the FA 16.
• the R_Req 21 contains a care-of-address (Co A) received from the FA 16 and an NAI corresponding to a subscriber's ID.
• the FA 16 transmits the R_Req 21 as an R_Req 22 to an HA 17.
• a new type of NAI i.e., a temporary NAI (TNAI)
• TNAI temporary NAI
• FIG. 3 illustrates a data format of a TNAI contained in an R_Req message that is generated by the MS 10 and then transmitted sequentially to the FA 16 and HA 17.
• the TNAI includes an international mobile subscriber identity (IMSI) 31, a first random number (RAND1) that has a length of 128 bits and is generated by an SIM 11 for network authentication, and a Realm 34 indicating a domain to which a subscriber belongs.
• IMSI international mobile subscriber identity
• RAND1 first random number
• Realm 34 indicating a domain to which a subscriber belongs.
• a tag 30 indicates the authentication method which is intended to be used, and a separator 33 is a mark that separates the IMSI 31 from the Realm 34.
• the tag 30 and the separator 33 are encoded into, for example, 1-byte ASCII codes corresponding to 9 and @, respectively.
• the IMSI 31 is encoded into a 15-byte text string where each byte is composed of one of ASCII codes 0x30-0x39 corresponding to 0-9.
• the RAND1 32 is set by encoding a 128-bit random number to a length of 22 bytes using BASE-64 encoding.
• the Realm 34 is encoded into a text string corresponding to the domain name.
• the HA 17 having received the R_Req 22 from the FA 16 extracts the IMSI 31 and the RAND1 32 from the TNAI, generates and transmits an authentication request (A_Req) 23 to an AAAH 18.
• the AAAH 18 extracts subscriber information and a private key Ki from a DB using the IMSI 31, generates RESl, RAND2, XRES2, and Kc in step 231, and transmits them as an authentication reply (A_Reply) 24 to the HA 17.
• the HA 17 transmits the A_Reply 24, received from the AAAH 18 as a registration reply (R_Reply) 25 to the FA 16.
• RESl indicates information used by the MS 10 to authenticate the network
• XRES2 indicates information used by the FA 16 to authenticate the subscriber.
• RAND2 is a second random number randomly generated to have 128 bits in length by the AAAH 18.
• Kc is a 128-bit encryption key generated by combining a 64-bit encryption key Kcl generated using Ki and RAND1 and a 64-bit encryption key Kc2 generated using Ki and RAND2.
• FIG. 4 is a block diagram illustrating operations of the AAAH 18 while the above- described authentication protocol is performed.
• Subscriber information and a private key Ki are extracted from a DB 41 using an IMSI received from the HA 17.
• a first signal generator 42 generates a 64-bit encryption key Kcl in a block 421 and RESl in a block 422 based on the private key Ki and RAND1.
• a second signal generator 43 generates a 64-bit encryption key Kc2 in a block 431 and XRES2 in a block 432 based on the private key Ki and RAND2.
• the A8 algorithm used in the blocks 421 and 431 and the A3 algorithm used in the blocks 422 and 432 are predefined authentication/ encryption algorithms in a mobile c ⁇ rmunication network.
• the RAND2 is a random number generated by a random nurber generator 45.
• FIG. 5 is a block diagram of an apparatus for authenticating a network in the MS 10 while the authentication protocol is performed.
• the SIM 11 shown in FIG. 1 included within the MS 10 receives the RESl and the RAND2 from the FA 16. Then, a first signal generator 52 generates authentication information XRES 1 in a block 522 using the private key Ki and the RAND1 that have been stored in the MS 10 in step 213.
• a comparator 54 compares the XRES1 with the RESl received from the FA 16 in step 215 to authenticate the network.
• the RAND1 is a random nurber that have been generated by a random number generator 51.
• the first signal generator 52 generates a 64-bit encryption key Kcl in a block 521.
• a second signal generator 53 generates subscriber authentication information RES2 in a block 532 and a 64-bit encryption key Kc2 in a block 531 using the RAND2 received from the FA 16 and the private key Ki. Then, in step 217, the RES2 is transmitted to the FA 16, and the encryption keys Kcl and Kc2 are combined to generate a 128-bit encryption key Kc.
• the RES2 generated by the SIM 11 of the MS 10 is errbedded into an A_Req 27 and transmitted to the FA 16.
• the FA 16 compares the RES2 received from the MS 10 with the XRES2 stored therein in step 221 to authenticate the subscriber. If authentication succeeds, a SUCCESS message is embedded into an A_Reply 28 and transmitted to the MS 10.
• an MS 10
• the MS transmits an NAI containing a first random nurber and an IMSI to the gateway, generates XRES1 using a private key and the first random number that are stored therein, compares the XRES 1 with RES 1 received from the gateway to authenticate a network, generates RES2 using the private key and a second random nurber received from the gateway, and transmits the RES2 to the gateway.
• a gateway (16, 17) broadcasts an AA to its sub-network, extracts an IMSI and a first random number from an NAI received from an MS entering the sub-network, transmits the IMSI and the first random number to an AAAH (or an authentication server), stores XRES2 received from the AAAH, transmits RESl and a second random number to the MS, and compares RES2 received from the MS with XRES2 stored therein to authenticate a subscriber.
• AAAH or an authentication server
• the AAAH ( 18) fetches a private key from a DB using IMSI, generates RES 1 using the private key and a first random nutrber, generates XRES2 using the private key and a second rand n nurber, and transmits the RESl, the second randan number, and the XRES2 to a gateway.
• the AAAH (18) generates a first encryption key using the private key and the first randan nurber, generates a second encryption key using the private key and the second random nurber, generates a third encryption key by combining the first and second encryption keys, and transmits the third encryption key to the gateway.
• the gateway stores the third encryption key
• the MS generates a fourth encryption key using the private key and the first random nurber stored therein, generates a fifth encryption key using the private key and the second random nurber, and generates a sixth encryption key by combining the fourth and fifth encryption keys.
• the third encryption key generated by the AAAH (18) and the sixth encryption key generated by the MS (10) share the same value.
• messages transferred between the MS 10 and the FA 16 for mutual authentication between a subscriber and a network include the A A 20 periodically broadcasted by the FA 16 and two pairs of request and reply messages, i.e., R_Req 21, R_Reply 26, A_Req 27, and A_Reply 28.
• the MS 10 and the FA 16 share the 128-bit encryption key Kc.
• the mutual authentication between the subscriber and the network can be accomplished using only two pairs of request and reply messages transferred between the MS 10 and the FA 16 in addition to the A A periodically broadcasted by the FA 16 in a wireless Internet network.
• an algorithm of generating an encryption key is repeated two times in the SIM 11, an effective encryption key is lengthened.
• the invention can also be embodied as computer readable codes on a computer readable recording medium.
• the computer readable recording medium is any data storage device that can store data which can be thereafter read by a computer system. Examples of the computer readable recording medium include read-only memory (ROM), random-access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet).
• ROM read-only memory
• RAM random-access memory
• CD-ROMs compact discs
• magnetic tapes magnetic tapes
• floppy disks optical data storage devices
• carrier waves such as data transmission through the Internet
• a subscriber and a network can mutually authenticate each other using only two pairs of request and reply messages. Also, the subscriber and the network can share a 128-bit encryption key for secure c ⁇ rmunication using an authentication algorithm used in a conventional SIM- type mobile c ⁇ rmunication network without any change. Accordingly, security of a wireless Internet network is enhanced at a minimun cost, and mobile communication network and wireless Internet network co-work effectively.
• the present invention provides mutual authentication between a subscriber and a network using an SIM and a means for allowing a key to be shared by the subscriber and the network.
• the subscriber and the network in a wireless Internet system exchange miniinum nurber of request and reply messages and can use an authentication algorithm used in a conventional SIM-type mobile c ⁇ rmunication network.
• the present invention modifies a subscriber authentication method based on an SIM in a second generation mobile communication network, thereby enabling network authentication, and enhances security by increasing the nurber of effective bits of an encryption key shared by a subscriber and a network after authentication. According to the present invention, an unauthorized user is prevented fr ⁇ n using a network through subscriber authentication, and a subscriber's personal information is protected from being revealed to a fake server through authentication of a network and a server.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (2)

Applications Claiming Priority (2)

Publications (1)

Family

ID=36693406

Family Applications (1)

Country Status (4)

Cited By (5)

Families Citing this family (5)

Citations (6)

Family Cites Families (3)

• 2003
  • 2003-12-17 KR KR1020030092564A patent/KR100546778B1/ko not_active IP Right Cessation
• 2004
  • 2004-08-23 EP EP04774379A patent/EP1695480A4/de not_active Withdrawn
  • 2004-08-23 CN CN2004800417230A patent/CN1918843B/zh not_active Expired - Fee Related
  • 2004-08-23 WO PCT/KR2004/002118 patent/WO2005060150A1/en not_active Application Discontinuation

Patent Citations (6)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events