WO2001037477A1 - Cryptographic techniques for a communications network - Google Patents

Cryptographic techniques for a communications network Download PDF

Info

Publication number
WO2001037477A1
WO2001037477A1 PCT/US2000/031103 US0031103W WO0137477A1 WO 2001037477 A1 WO2001037477 A1 WO 2001037477A1 US 0031103 W US0031103 W US 0031103W WO 0137477 A1 WO0137477 A1 WO 0137477A1
Authority
WO
WIPO (PCT)
Prior art keywords
station
service network
key
network
authentication
Prior art date
Application number
PCT/US2000/031103
Other languages
French (fr)
Inventor
Christopher Paul Carroll
Original Assignee
Verizon Laboratories Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Verizon Laboratories Inc. filed Critical Verizon Laboratories Inc.
Priority to AU27245/01A priority Critical patent/AU2724501A/en
Publication of WO2001037477A1 publication Critical patent/WO2001037477A1/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06Authentication
    • H04W12/062Pre-authentication
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80Wireless

Definitions

  • the present invention relates generally to cryptographic techniques for use in a communications network such as a wireless communications network.
  • First generation wireless communications networks were based on analog technologies such as the Advanced Mobile Phone Service (AMPS) .
  • Second generation wireless communications networks introduced digital communications technologies such as the Global System Mobile (GSM) , IS-136 Time Division Multiple Access
  • TDMA Time Division Multiple Access
  • CDMA Code Division Multiple Access
  • AKA Authentication and Key Agreement
  • FIG. 1 illustrates a typical cellular telephone or Personal Communication Services (PCS) network.
  • a subscriber using a Mobile Station (MS) 130 (e.g., a cellular phone) , can roam outside of the area covered by their Home Environment (HE) 110 network and obtain wireless communications service from a Serving Network (SN) 120.
  • the HE 110 and SN 120 networks typically include a switch, base station, and other components (not shown) , as is known in the art.
  • the HE 110, SN 120, and MS 130 are controlled by software, firmware, and/or hardware instructions.
  • the MS 130 often features a removable Universal Subscriber Identity Module (USIM) that resides in the MS 130 to store subscriber information such as a subscriber's identity, secret key information, and so forth. To simplify descriptions herein, the USIM is considered part of MS 130. However, a subscriber can transfer their USIM into other MS-s 130 to obtain service .
  • USIM Universal Subscriber Identity Module
  • An AKA protocol for second generation wireless communication networks provides MS 130 to SN 120 authentication.
  • the HE 110 and MS 130 share a common 128-bit secret key K.
  • K 128-bit secret key
  • HE 110 passes an authentication vector including three pieces of cryptographic data to a SN 120. Each vector includes a random challenge, response, and privacy key.
  • SN 120 transmits the random challenge over the air to the MS 130.
  • MS 130 combines the random challenge with the secret key K using a cryptographic primitive (e.g., a hash function) to generate the response.
  • MS 130 transmits the response to SN 120 which compares the response value received from MS 130 with the response value provided by HE 110. If the response values are equal, SN 120 provides system access to MS 130.
  • MS 130 also uses the random challenge and K to create a privacy key that is identical to the privacy key sent from HE 110 to SN 120 as part of the cryptographic triplet. With the same privacy key, SN 120 and MS 130 can securely communicate. In this scheme, the SN 120 need not implement a cryptographic primitive (e.g., a hash function).
  • a third generation AKA mechanism adopted by the Third Generation Project Partners (3GPP) enhances the original GSM AKA mechanism by enabling mutual authentication between SN 120 and MS 130.
  • the 3GPP AKA mechanism replaces the GSM crypto-triplet vector with a crypto-quintet authentication vector (AV) to facilitate MS/SN mutual authentication.
  • AV crypto-quintet authentication vector
  • FIG. 2 illustrates formation of an AV by an HE 110.
  • the AV includes five components concatenated together: (1) the random challenge (RAND), (2) an expected response (XRES) , (3) a cipher key (CK) , (4) an integrity key (IK), and (5) an authentication token (AUTN) .
  • AUTN includes three components: (1) an exclusive-or of a sequence number (SQN) and anonymity key (AK) , (2) a MODE value, and (3) a message authentication code (MAC) .
  • the sequence number indicates the AVs position in a sequence of AVs.
  • Functions fl through f5 are derived using a cryptographic primitive shared between HE 110 and MS 130. Different values of primitive constants or parameters control which function, fl through f5, the primitive provides.
  • a MS 130 may be authenticated each time a MS 130 owner places a call.
  • an HE 110 sends multiple AVs to SN 120 to enable multiple authentications between SN 120 and MS 130.
  • FIG. 3 illustrates SN 120 authentication in 3GPP AKA.
  • the MS 130 and HE 110 keep track of counters SQN MS and SQN HE - When HE 110 generates an AV, SQN HE is incremented.
  • MS 130 authentication of SN 120 is performed by ensuring that SQN in each new AV is greater than SQN in the previous AV.
  • the MS 130 also verifies that SQN HE originated from the HE 110 by verifying the MAC in the AUTN.
  • SQN counter in HE 110 and MS 120 It is possible for the SQN counter in HE 110 and MS 120 to lose synchronization. For this reason, the 3GPP AKA mechanism has SQN re-synchronization procedures. If K is reset or replaced for a particular USIM, SQN can be reset at the HE 110 and MS 130.
  • FIG. 4 illustrates the flow of a typical 3GPP AKA mechanism.
  • SN 120 sends (step 202) an authentication request to HE 130.
  • HE 110 Upon receiving the request associated with a particular MS 130, HE 110 generates (step 204) an array of AVs for that particular MS 130.
  • HE 110 sends (step 206) the AVs to SN 120 which, in turn, stores (step 208) the AVs in its Visitor Location Register (VLR) .
  • VLR Visitor Location Register
  • MS 130 verifies (step 214) AUTN(i) and computes RES(i). If SQN(i) is greater than SQN MS , MS 130 successfully authenticates SN 120. MS 130 sends (step 216) RES(i) to SN 120. SN 120 compares (step 218) RES(i) with XRES ( i ) . If RES and XRES are equal, SN 120 has successfully authenticated MS 130. Finally, MS 130 computes (step 220) CK(i) and IK(i) while SN 120 selects CK(i) and IK(i) .
  • FIG. 5 illustrates a cryptographic key hierarchy of the 3GPP AKA mechanism.
  • a secret key K is the root secret shared only between the HE 110 and MS 130.
  • CK cipher key
  • IK integrity key
  • the North American Telecommunications Industry Association (TIA) TR-45 standards group has based AKA on a shared secret between HE 110, SN 120, and MS 130.
  • HE 110 sends Shared Secret Data (SSD) to SN 120 to enable MS 130 to SN 120 authentication.
  • SSD is derived from an Authentication key (A-key) , shared between HE 110 and MS 130 only.
  • A-key Authentication key
  • the A-key is analogous to the GSM secret key K.
  • SSD consists of SSD-A, used for MS 130 challenge-response authentication, and SSD-B, used for SN/MS voice and data privacy.
  • MS 130 requests service from SN 120 HE 110 sends SSD to SN 120.
  • SN 120 can authenticate MS 130 until SSD is updated between HE 110 and MS 130.
  • SN 120 in a TR-45 network acquires unique SSD from HE 110 and uses SSD for the duration that MS 130 operates within the SN 120 area.
  • SSD update is performed between HE 110 and MS 130 after MS 130 leaves the SN 120 area to establish a new SSD, preventing SN 120 from knowing an SSD used by another service network.
  • many service providers do not update SSD frequently, allowing many service providers to know SSD-A which is the authentication secret for TR-45 cellular telephones.
  • the TIA TR-45 is considering adoption of the 3GPP AKA for TR-45 networks to support global harmonization of wireless communication standards. To retain the advantages of using a shared secret like SSD, the TR-45 is considering using the 3GPP IK key as SSD for third generation TR-45 wireless networks. Additionally, the TR-45 is considering the adoption of the Long-term Enhanced Subscriber Authentication (LESA) AKA. in which interlocking challenges provide mutual authentication between SN 120 and MS 130.
  • LESA AKA mechanism SN 120 sends a random number R N to MS 130.
  • MS 130 generates a second random number R M .
  • MS 130 computes a response to SN 120 by combining R N , R M , and SSD in a cryptographic primitive.
  • MS 130 sends the response and random number R M to SN 120.
  • R M SN 120 computes the same response, authenticating MS 130.
  • SN 120 computes a second response for MS 130 by combining R M and SSD in the cryptographic primitive.
  • SN 120 sends the second response to MS 130.
  • MS 130 verifies the second response, authenticating SN 120.
  • 3GPP has considered an AKA mechanism similar to the LESA AKA, known as Authentication based on a Temporary Key (A-TK) .
  • the A-TK AKA mechanism uses a procedure of interlocking challenges between HE 110 and MS 130 to establish a temporary key (KT) . Once KT is established, SN 120 uses traditional challenge- response to authenticate MS 130.
  • MS 130 authentication of SN 120 is not performed explicitly, but is implicitly achieved by the establishment of CK and IK based on random numbers provided by SN 120 and MS 130.
  • the techniques described herein can include the negotiation and use of a cryptographic primitive shared between a service network and a home environment of a station.
  • the techniques described also include use of a key usage indicator, such as a sequence number, maintained by the service network and a station. Comparison of the key usage indicators can, for example, permit efficient authentication of the service network by the station without undue burden on a home environment network of the station.
  • the invention features a method for use in authenticating a service network to a station.
  • the method includes storing a key at the service network and transmitting information to the station that enables the station to compute the key stored at the service network.
  • the method also includes receiving a request for service at the service network from the station, adjusting a value corresponding to key usage, and transmitting information corresponding to the value to the station.
  • Embodiments may include one or more of the following features.
  • the method may include receiving a vector of authentication information from the home environment network of the mobile station.
  • the vector includes an indication of the vector's position in a sequence of vectors .
  • the information transmitted to the station that enables the station to compute the key stored at the service network may include one or more portions of the received vector of authentication information.
  • the received vector of authentication information can include the key stored by the service network.
  • the method may further include computing, at the service network, the key stored by the service network based on information included in the received vector .
  • Adjusting a value indicating use of the key can include incrementing a sequence number corresponding to a number of times the key has been used.
  • the method may further include using the key to compute a cipher key for encrypting communication between the service network and the station.
  • the method may also include negotiating use of a cryptographic primitive between the service network and the home environment network.
  • the invention features a method for use in authenticating a service network to a station.
  • the method includes computing a key, stored by the service network, based on information received at the station from the service network.
  • the station maintains an indicator of key usage.
  • the method includes receiving at the station an indicator of key usage maintained by the service network and comparing the key usage indicator maintained by the service network with the key usage indicator maintained by the station.
  • Embodiments may include one or more of the following features.
  • the method may further include maintaining an authentication vector sequence number at the station, receiving at the station from the service network an indication of an authentication vector sequence number maintained by the home environment network, and comparing the authentication vector sequence number maintained by the home environment network with the received authentication vector sequence number maintained by the station.
  • the method may include receiving from the service network identification of a cryptographic primitive.
  • the method may include using the key to compute a cipher key for encrypting communication between the service network and the station.
  • the invention features a method for use in authentication in a communications network including a home environment network, a service network, and a station. The method includes determining at the home environment network a cryptographic primitive offered by the service network and transmitting to the service network at least one vector of authentication information corresponding to a particular station.
  • the vector of authentication information may include an indication of an authentication vector sequence number maintained by the home environment network.
  • the invention features a method for use by a mobile station that can communicate with different service networks .
  • the method includes storing different sets of cryptographic information for the different respective service networks, selecting a set of cryptographic information for one of the service networks, and using the selected set of cryptographic information to communicate with the service network.
  • Embodiments may include one or more of the following.
  • the sets of cryptographic information may include a key shared by the station and the service network.
  • the method may include computing the key shared by the station and the service network based on information received from the service network.
  • the sets of cryptographic information may include an indicator of usage of the key.
  • Using the selected set of cryptographic information may include using the selected set of cryptographic information in encrypting communication between the station and the service network.
  • the invention features a method of handling authentication and key agreement in a system including a home environment network, a service network, and a mobile station in which the home environment network and the mobile station share a secret key K.
  • the method includes determining whether the home environment and the service network share a cryptographic primitive. If it is determined that the home environment and the service network do not share a cryptographic primitive, the method handles authentication and key agreement between the mobile station and the service network using 3GPP (Third Generation Project Partners) AKA (authentication and key agreement) .
  • 3GPP hird Generation Project Partners
  • AKA authentication and key agreement
  • FIG. 1 is a block diagram of a communications network according to the prior art
  • FIG. 2 illustrates generation of an authentication vector according to the prior art
  • FIG. 3 illustrates authentication of a service network according to the prior art
  • FIG. 4 is a flow-chart of an authentication and key agreement process according to the prior art
  • FIG. 5 illustrates a cryptographic key hierarchy according to the prior art
  • FIG. 6 is a flowchart of an initial authentication and key agreement process used to generate a shared secret K
  • FIG. 7 is a flowchart of a mutual authentication mechanism using a shared secret K
  • FIG. 8 illustrates generation of an authentication token
  • FIG. 9 illustrates authentication of a service network using a temporary sequence number
  • FIG. 10 illustrates generation of a shared secret
  • FIG. 11 illustrates a cryptographic key hierarchy
  • FIG. 12 illustrates generation of a shared secret authentication vector by a home environment
  • FIG. 13 illustrates a cryptographic key hierarchy
  • FIG. 14 illustrates a mobile station straddling bordering cells of different service networks
  • FIG. 15 is a flowchart of a mobile station process for handling communication with a service network.
  • Described herein are techniques that can securely, efficiently, and robustly handle authentication and key agreement in a communications network such as a wireless communications network.
  • the techniques described herein can enhance traditional 3GPP AKA by giving service providers the option to use traditional 3GPP AKA or an optional AKA mechanism.
  • the present invention is not limited to wireless applications, and can also be used in other networks such as electronic toll systems, internet access terminals, cable TV and data networks, and other networks in which a service provider allows subscribers to use another service provider's network.
  • the techniques are described with respect to a wireless communications network. However, the description should be understood as applying to other networks or devices, such as the ones discussed above.
  • the invention features an optional 3GPP AKA mechanism that can be used in conjunction with the traditional 3GPP AKA.
  • a HE 110 and SN 120 share at least one common cryptographic primitive.
  • HE 110 and SN 120 may both use SHA-1 or MD-5 as a cryptographic hash function .
  • the optional 3GPP AKA can include procedures that allow for primitive negotiation, for example, between the HE 110 and SN 120.
  • a one byte MODE field can store data identifying the AKA cryptographic primitive or set of AKA cryptographic primitives offered by an HE 110, SN 120, or MS 120.
  • a MODE field value of "S" can represent a request for communication using a shared SHA-1 primitive.
  • the SN 120 authentication data requests can also include a primitive version identifier.
  • a field other than the MODE field may be used to facilitate AKA primitive negotiation between elements of the communication network.
  • a wide variety of alternate information exchanges can be used to negotiate a shared primitive. For example, either the HE 110 or SN 120 may initiate negotiation. Similarly, either the HE 110 or SN 120 may initially identify the cryptographic primitive (s) it offers.
  • HE 110 and SN 120 do not share a common AKA primitive (e.g., if HE 110 determines that it does not provide the primitive identified in an SN 120 request for AVs), standard 3GPP AKA is performed instead of the optional 3GPP AKA mechanism described below. If HE 110 and SN 120 share a common AKA primitive, the optional 3GPP AKA mechanism, may be used to increase the efficiency of mutual authentication between the MS 130 and SN 120.
  • FIG. 6 illustrates the flow of an optional AKA mechanism that can reduce the amount of Authentication Vector (AV) traffic by establishing a Shared Secret K (SSK) between the MS 130 and SN 120 using one AV.
  • SN 120 sends (step 602) an authentication request to HE 130 indicating that a common primitive is available.
  • HE 110 Upon receiving the request associated with a particular MS 130 and noting the indication of a shared primitive (e.g., HE 110 offers the same primitive as indicated by the MODE field), HE 110 generates (step 604) at least one AV associated with that particular MS 130.
  • the HE 110 sends (step 606) the AV to SN 120.
  • SN 120 stores the AV in its Visitor Location Register (VLR) and generates (step 608) SSK(i). After initial communication, communication between the SN 120 and MS 130 will depend on both computing the same SSK(i) .
  • VLR Visitor Location Register
  • SN 120 After selecting (step 610) an AV ( i ) , SN 120 sends (step 612) RAND(i) and AUTN(i) of AV(i) to MS 130.
  • MS 130 verifies AUTN ( i ) and computes (step 614) RES(i) (see FIG. 3). If SQN(i) is greater than SQN MS , MS 130 successfully authenticates SN 120.
  • MS 130 sends (step 616) RES(i) to SN 120.
  • SN 120 then compares (step 618) RES(i) with XRES(i). If RES and XRES are equal, SN 120 has successfully authenticated MS 130.
  • MS 130 computes CK ( i ) and IK(i) while SN 120 selects (step 620) CK(i) and IK ( i ) .
  • the standard AKA protocol between SN 120 and MS/USIM 130 is modified by replacing Ki with SSKj_ for AKA calculations between the SN 120 and MS 130 for the duration of MS roaming.
  • the protocol is further modified by using a Temporary SQN (TSQN) established between the SN 120 and MS/USIM 130 for the duration of MS 130 roaming in the SN 120 network area.
  • TQN Temporary SQN
  • FIG. 7 illustrates how subsequent authentications are performed between SN 120 and MS 130, for example, in response to a MS 130 request for service from SN 120.
  • SN 120 generates (step 702) RAND(i) and generates TAUTN(i) using SSK(i) (see FIG. 8) .
  • MS 130 verifies (step 706) TAUTN(i) and computes RES ( i ) (see FIG. 9). If TSQN SN (i) is greater than TSQN MS/U ⁇ IM / MS 130 successfully authenticates SN 120.
  • MS 130 sends (step 708) RES(i) to SN 120.
  • SN 120 compares (step 710) RES(i) with XRES(i). If RES and XRES are equal, SN 120 has successfully authenticated MS 130.
  • MS 130 computes (step 712) CK(i) and IK(i). SN 120 computes (step 714) CK ( i ) and IK ( i ) .
  • TSQNj uniquely increments for an SSKi .
  • the MS 130 maintains a uniquely incrementing TSQN to facilitate mutual authentication between the MS 130 and SN 120.
  • TSQN increments each time the same SSK is used for communication between an SN and MS TSQN increments for a relatively short period of time compared with SQN, lessening the chance mis- synchronization.
  • TSQN need not impact the maintenance of SQN within the HE 110 and MS/USIM 130.
  • TSQN can automatically reset when a new SSK (associated with a particular SN 120 is formed. This approach can eliminate the TR-45 problem of having to update SSD.
  • TSQN is a sequence number.
  • other values indicating key usage may be featured. For example, adjusting the value may feature decrementing instead of incrementing a numeric value. Additionally, the value need not be restricted to numbers but may instead feature a character or boolean value .
  • a HE/SN pair, sharing a common primitive can choose to utilize this scheme if they desire. However, even if HE 110 and SN 120 share a common AKA primitive, the HE 110 can utilize the standard 3GPP AKA mechanism and pass multiple AVs to SN 120.
  • the HE 110 may pass one or more AVs to SN 120 with the MODE value indicating standard 3GPP AKA.
  • the SN 120 can use a common AKA primitive MODE value (e.g. SHA-1) to notify the MS 130 to use SSK and TSQN when utilizing the modified 3GPP AKA.
  • a common AKA primitive MODE value e.g. SHA-1
  • the SN 120 may determine if the MS 130 supports (e.g., includes instructions for) the optional scheme, for example, based on MS 130 identification information transmitted by the MS 120. Additionally, the MS 130 can transmit a message to the SN 120 declining use of the optional scheme, for example, if the MS 130 does not provide the primitive identified by the SN 120 in the MODE field.
  • FIG. 11 illustrates a cryptographic key hierarchy for the optional 3GPP AKA mechanism.
  • a secret key K is the root secret shared between the HE 110 and MS 130.
  • a CK is generated to facilitate voice and data privacy and an IK is generated to facilitate message authentication.
  • SSK can be derived from IK using function f3. For all subsequent SN 120 network accesses, CK and IK are derived from SSK.
  • FIG. 12 illustrates a different optional AKA mechanism.
  • SSK can be generated by HE 110.
  • HE 110 can include the generated SSK in the AV.
  • the AV is defined as Shared Secret AV (SSAV) .
  • SSAV Shared Secret AV
  • a SN 120 receiving SSAV can simply extract SSK instead of independently computing SSK.
  • the MS 130 still independently determines SSK from AV information transmitted by SN 120 to the MS 130.
  • the SN 120 and MS/USIM 130 use SSK and TSQN for subsequent authentications as shown in Figure 7. Resynchronization of TSQN is not necessary because SN 120 can query HE 110 for a new SSAV, perform standard 3GPP AKA and establish a new SSK with a TSQN reset.
  • the SN 130 may request multiple AVs from the HE 110 initially to allow for new SSK formation and TSQN reset.
  • FIG. 13 illustrates the cryptographic key hierarchy when SSK is formed by HE 110 using RAND and K.
  • FIG. 14 illustrates another aspect of the invention that provides support for border cell operations.
  • the MS 130 can store different cryptographic elements (e.g., SSK/TSQN pairs) for different SNs 120. By storing multiple SSK/TSQN pairs with each pair associated with a different SN 120, the MS 130 can straddle the border between multiple systems without requiring VLR-to-VLR AV sharing, SSD sharing, or SSD update .
  • MS 130 straddles between areas served by two different serving networks.
  • MS 130 uses SSK SNrough A for service from serving network A (SN-A) and SSK SN - B for service from serving network B (SN-B) .
  • the MS 130 may store identification of a SN and the respective SSK/TSQN pair being used. Thereafter, the 130 may identify the SN providing service to retrieve the appropriate pair.
  • SSK freshness depends on the SN 120 VLR and MS 130 rules. For example, the SN 120 may chose to store SSK for up to a week of inactivity.
  • the MS 130 may store multiple SSK/TSQNs in a queue (five pairs or more) using first-in-first-out (FIFO) .
  • FIFO first-in-first-out
  • This technique may be ideal for travelers moving between multiple systems and countries within a brief period of time.
  • the MS 130 deletes SSK SN - A before SN-A deletes SSK SN-A
  • FIG. 15 is a flowchart of a process for using cryptographic data associated with different cells.
  • a MS stores (step 1502) cryptographic data, such as SSK/TSQN pairs, for different service networks.
  • the MS can access and use the associated cryptographic data, for example, for authentication and encryption.
  • the techniques described above can, potentially, offer significant benefits for networks such as 3GPP and TR-45 (3GPP2) networks.
  • the techniques can allow for standard 3GPP AKA or modified 3GPP AKA at a service provider's discretion.
  • the techniques can offer mutual authentication based on a publicly scrutinized cryptographic primitive. Potentially, techniques can reduce HE/SN AV traffic when a common A ⁇ CA primitive is shared between HE and SN. The techniques can reduce the probability of SQN re-synchronization problem by using TSQN.
  • the techniques can also reduce the need for SSD update in TR-45 networks, can reduce the vulnerability of fixed SSD by ensuring new SSK formation between MS and SN, can reduce cryptographic export/import concerns for the United States and other countries interested in adopting TR-45 standards, and can reduce the need for VLR-to-VLR AV sharing, SSD sharing, and SSD update for border cell operations.

Abstract

Techniques are described for enabling authentication (602) and/or key agreement (620) between communications network stations and service networks. The techniques described include negotiation and use of a cryptographic primitive (608) shared between a service network and a home environment of a station. The techniques described also feature a key usage indicator, such as a sequence number, maintained by the service network and a station. Comparison of the key usage indicators can, for example, permit efficient authentication of the service network.

Description

CRYPTOGRAPHIC TECHNIQUES FOR A COMMUNICATIONS NETWORK
Technical Field The present invention relates generally to cryptographic techniques for use in a communications network such as a wireless communications network.
Background Art First generation wireless communications networks were based on analog technologies such as the Advanced Mobile Phone Service (AMPS) . Second generation wireless communications networks introduced digital communications technologies such as the Global System Mobile (GSM) , IS-136 Time Division Multiple Access
(TDMA) , and IS-95 Code Division Multiple Access (CDMA) . Authentication and Key Agreement (AKA) protocols were developed for first and second generation networks to prevent theft of cellular telephone service, to provide subscriber voice privacy, and provide other security features .
FIG. 1 illustrates a typical cellular telephone or Personal Communication Services (PCS) network. A subscriber, using a Mobile Station (MS) 130 (e.g., a cellular phone) , can roam outside of the area covered by their Home Environment (HE) 110 network and obtain wireless communications service from a Serving Network (SN) 120. The HE 110 and SN 120 networks typically include a switch, base station, and other components (not shown) , as is known in the art. As is known in the art, the HE 110, SN 120, and MS 130 are controlled by software, firmware, and/or hardware instructions. The MS 130 often features a removable Universal Subscriber Identity Module (USIM) that resides in the MS 130 to store subscriber information such as a subscriber's identity, secret key information, and so forth. To simplify descriptions herein, the USIM is considered part of MS 130. However, a subscriber can transfer their USIM into other MS-s 130 to obtain service .
An AKA protocol for second generation wireless communication networks provides MS 130 to SN 120 authentication. In a typical GSM system, the HE 110 and MS 130 share a common 128-bit secret key K. To enable roaming privacy and authentication, HE 110 passes an authentication vector including three pieces of cryptographic data to a SN 120. Each vector includes a random challenge, response, and privacy key.
When MS 130 requests service, SN 120 transmits the random challenge over the air to the MS 130. MS 130 combines the random challenge with the secret key K using a cryptographic primitive (e.g., a hash function) to generate the response. MS 130 transmits the response to SN 120 which compares the response value received from MS 130 with the response value provided by HE 110. If the response values are equal, SN 120 provides system access to MS 130. MS 130 also uses the random challenge and K to create a privacy key that is identical to the privacy key sent from HE 110 to SN 120 as part of the cryptographic triplet. With the same privacy key, SN 120 and MS 130 can securely communicate. In this scheme, the SN 120 need not implement a cryptographic primitive (e.g., a hash function). A third generation AKA mechanism adopted by the Third Generation Project Partners (3GPP) enhances the original GSM AKA mechanism by enabling mutual authentication between SN 120 and MS 130. The 3GPP AKA mechanism replaces the GSM crypto-triplet vector with a crypto-quintet authentication vector (AV) to facilitate MS/SN mutual authentication.
FIG. 2 illustrates formation of an AV by an HE 110. As shown, the AV includes five components concatenated together: (1) the random challenge (RAND), (2) an expected response (XRES) , (3) a cipher key (CK) , (4) an integrity key (IK), and (5) an authentication token (AUTN) . AUTN includes three components: (1) an exclusive-or of a sequence number (SQN) and anonymity key (AK) , (2) a MODE value, and (3) a message authentication code (MAC) . The sequence number indicates the AVs position in a sequence of AVs. Functions fl through f5 are derived using a cryptographic primitive shared between HE 110 and MS 130. Different values of primitive constants or parameters control which function, fl through f5, the primitive provides.
When roaming, a MS 130 may be authenticated each time a MS 130 owner places a call. Thus, typically, an HE 110 sends multiple AVs to SN 120 to enable multiple authentications between SN 120 and MS 130.
FIG. 3 illustrates SN 120 authentication in 3GPP AKA. To authenticate SN 120, the MS 130 and HE 110 keep track of counters SQNMS and SQNHE- When HE 110 generates an AV, SQNHE is incremented. MS 130 authentication of SN 120 is performed by ensuring that SQN in each new AV is greater than SQN in the previous AV. The MS 130 also verifies that SQNHE originated from the HE 110 by verifying the MAC in the AUTN.
It is possible for the SQN counter in HE 110 and MS 120 to lose synchronization. For this reason, the 3GPP AKA mechanism has SQN re-synchronization procedures. If K is reset or replaced for a particular USIM, SQN can be reset at the HE 110 and MS 130.
FIG. 4 illustrates the flow of a typical 3GPP AKA mechanism. When MS 130 requests service from SN 120, SN 120 sends (step 202) an authentication request to HE 130. Upon receiving the request associated with a particular MS 130, HE 110 generates (step 204) an array of AVs for that particular MS 130. HE 110 sends (step 206) the AVs to SN 120 which, in turn, stores (step 208) the AVs in its Visitor Location Register (VLR) . SN 120 selects (step 210) the first sequential AV(i) (e.g., i = 1) and sends (step 212) RAND(i) and AUTN(i) to MS 130. MS 130 verifies (step 214) AUTN(i) and computes RES(i). If SQN(i) is greater than SQNMS, MS 130 successfully authenticates SN 120. MS 130 sends (step 216) RES(i) to SN 120. SN 120 compares (step 218) RES(i) with XRES ( i ) . If RES and XRES are equal, SN 120 has successfully authenticated MS 130. Finally, MS 130 computes (step 220) CK(i) and IK(i) while SN 120 selects CK(i) and IK(i) .
FIG. 5 illustrates a cryptographic key hierarchy of the 3GPP AKA mechanism. A secret key K is the root secret shared only between the HE 110 and MS 130. Whenever mutual authentication is performed, a cipher key (CK) is generated to facilitate voice and data privacy. Additionally, an integrity key (IK) is generated to facilitate message authentication. The North American Telecommunications Industry Association (TIA) TR-45 standards group has based AKA on a shared secret between HE 110, SN 120, and MS 130. In a TR-45 cellular/PCS network, HE 110 sends Shared Secret Data (SSD) to SN 120 to enable MS 130 to SN 120 authentication. SSD is derived from an Authentication key (A-key) , shared between HE 110 and MS 130 only. The A-key is analogous to the GSM secret key K. SSD consists of SSD-A, used for MS 130 challenge-response authentication, and SSD-B, used for SN/MS voice and data privacy. When MS 130 requests service from SN 120, HE 110 sends SSD to SN 120. With SSD, SN 120 can authenticate MS 130 until SSD is updated between HE 110 and MS 130. Unlike a GSM network where SN 120 continuously requests new vectors of crypto-triplets to perform MS 130 authentication, SN 120 in a TR-45 network acquires unique SSD from HE 110 and uses SSD for the duration that MS 130 operates within the SN 120 area. Ideally, SSD update is performed between HE 110 and MS 130 after MS 130 leaves the SN 120 area to establish a new SSD, preventing SN 120 from knowing an SSD used by another service network. Unfortunately, many service providers do not update SSD frequently, allowing many service providers to know SSD-A which is the authentication secret for TR-45 cellular telephones.
The TIA TR-45 is considering adoption of the 3GPP AKA for TR-45 networks to support global harmonization of wireless communication standards. To retain the advantages of using a shared secret like SSD, the TR-45 is considering using the 3GPP IK key as SSD for third generation TR-45 wireless networks. Additionally, the TR-45 is considering the adoption of the Long-term Enhanced Subscriber Authentication (LESA) AKA. in which interlocking challenges provide mutual authentication between SN 120 and MS 130. In the LESA AKA mechanism, SN 120 sends a random number RN to MS 130. MS 130 generates a second random number RM. MS 130 computes a response to SN 120 by combining RN, RM, and SSD in a cryptographic primitive. MS 130 sends the response and random number RM to SN 120. With RM, SN 120 computes the same response, authenticating MS 130. Then SN 120 computes a second response for MS 130 by combining RM and SSD in the cryptographic primitive. SN 120 sends the second response to MS 130. MS 130 verifies the second response, authenticating SN 120. Finally, 3GPP has considered an AKA mechanism similar to the LESA AKA, known as Authentication based on a Temporary Key (A-TK) . The A-TK AKA mechanism uses a procedure of interlocking challenges between HE 110 and MS 130 to establish a temporary key (KT) . Once KT is established, SN 120 uses traditional challenge- response to authenticate MS 130. MS 130 authentication of SN 120, however, is not performed explicitly, but is implicitly achieved by the establishment of CK and IK based on random numbers provided by SN 120 and MS 130.
Disclosure of Invention
Techniques are described for enabling authentication, key agreement, and/or encrypted communication between communications network stations and service networks . The techniques described herein can include the negotiation and use of a cryptographic primitive shared between a service network and a home environment of a station. The techniques described also include use of a key usage indicator, such as a sequence number, maintained by the service network and a station. Comparison of the key usage indicators can, for example, permit efficient authentication of the service network by the station without undue burden on a home environment network of the station.
In general, in one aspect, the invention features a method for use in authenticating a service network to a station. The method includes storing a key at the service network and transmitting information to the station that enables the station to compute the key stored at the service network. The method also includes receiving a request for service at the service network from the station, adjusting a value corresponding to key usage, and transmitting information corresponding to the value to the station.
Embodiments may include one or more of the following features. The method may include receiving a vector of authentication information from the home environment network of the mobile station. The vector includes an indication of the vector's position in a sequence of vectors . The information transmitted to the station that enables the station to compute the key stored at the service network may include one or more portions of the received vector of authentication information. The received vector of authentication information can include the key stored by the service network. The method may further include computing, at the service network, the key stored by the service network based on information included in the received vector .
Adjusting a value indicating use of the key can include incrementing a sequence number corresponding to a number of times the key has been used. The method may further include using the key to compute a cipher key for encrypting communication between the service network and the station. The method may also include negotiating use of a cryptographic primitive between the service network and the home environment network. In general, in another aspect, the invention features a method for use in authenticating a service network to a station. The method includes computing a key, stored by the service network, based on information received at the station from the service network. The station maintains an indicator of key usage. The method includes receiving at the station an indicator of key usage maintained by the service network and comparing the key usage indicator maintained by the service network with the key usage indicator maintained by the station.
Embodiments may include one or more of the following features. The method may further include maintaining an authentication vector sequence number at the station, receiving at the station from the service network an indication of an authentication vector sequence number maintained by the home environment network, and comparing the authentication vector sequence number maintained by the home environment network with the received authentication vector sequence number maintained by the station. The method may include receiving from the service network identification of a cryptographic primitive. The method may include using the key to compute a cipher key for encrypting communication between the service network and the station. In general, in another aspect, the invention features a method for use in authentication in a communications network including a home environment network, a service network, and a station. The method includes determining at the home environment network a cryptographic primitive offered by the service network and transmitting to the service network at least one vector of authentication information corresponding to a particular station.
Embodiments may include one or more of the following features. Determining may include receiving identification of the cryptographic primitive from the service network, for example, as a value of a MODE field. The vector of authentication information may include an indication of an authentication vector sequence number maintained by the home environment network.
In general, in another aspect, the invention features a method for use by a mobile station that can communicate with different service networks . The method includes storing different sets of cryptographic information for the different respective service networks, selecting a set of cryptographic information for one of the service networks, and using the selected set of cryptographic information to communicate with the service network.
Embodiments may include one or more of the following. The sets of cryptographic information may include a key shared by the station and the service network. The method may include computing the key shared by the station and the service network based on information received from the service network. The sets of cryptographic information may include an indicator of usage of the key. Using the selected set of cryptographic information may include using the selected set of cryptographic information in encrypting communication between the station and the service network.
In general, in another aspect, the invention features a method of handling authentication and key agreement in a system including a home environment network, a service network, and a mobile station in which the home environment network and the mobile station share a secret key K. The method includes determining whether the home environment and the service network share a cryptographic primitive. If it is determined that the home environment and the service network do not share a cryptographic primitive, the method handles authentication and key agreement between the mobile station and the service network using 3GPP (Third Generation Project Partners) AKA (authentication and key agreement) . If it is determined that the home environment and the service network share a cryptographic primitive, handling authentication and key agreement by computing a shared secret key (SSK) , transmitting information from the service network to the station that enables the station to compute the SSK, and replacing the use of K in the 3GPP AKA with SSK. Advantages will become apparent in view of the following description, including the figures and the claims .
Brief Description of Drawings
FIG. 1 is a block diagram of a communications network according to the prior art;
FIG. 2 illustrates generation of an authentication vector according to the prior art; FIG. 3 illustrates authentication of a service network according to the prior art;
FIG. 4 is a flow-chart of an authentication and key agreement process according to the prior art;
FIG. 5 illustrates a cryptographic key hierarchy according to the prior art;
FIG. 6 is a flowchart of an initial authentication and key agreement process used to generate a shared secret K;
FIG. 7 is a flowchart of a mutual authentication mechanism using a shared secret K;
FIG. 8 illustrates generation of an authentication token;
FIG. 9 illustrates authentication of a service network using a temporary sequence number; FIG. 10 illustrates generation of a shared secret;
FIG. 11 illustrates a cryptographic key hierarchy;
FIG. 12 illustrates generation of a shared secret authentication vector by a home environment;
FIG. 13 illustrates a cryptographic key hierarchy; FIG. 14 illustrates a mobile station straddling bordering cells of different service networks; and FIG. 15 is a flowchart of a mobile station process for handling communication with a service network.
Best Mode for Carrying Out the Invention Described herein are techniques that can securely, efficiently, and robustly handle authentication and key agreement in a communications network such as a wireless communications network. In particular, the techniques described herein can enhance traditional 3GPP AKA by giving service providers the option to use traditional 3GPP AKA or an optional AKA mechanism. The present invention is not limited to wireless applications, and can also be used in other networks such as electronic toll systems, internet access terminals, cable TV and data networks, and other networks in which a service provider allows subscribers to use another service provider's network. For purposes of the following description, the techniques are described with respect to a wireless communications network. However, the description should be understood as applying to other networks or devices, such as the ones discussed above. In one aspect, the invention features an optional 3GPP AKA mechanism that can be used in conjunction with the traditional 3GPP AKA. In the optional 3GPP AKA, a HE 110 and SN 120 share at least one common cryptographic primitive. For example, HE 110 and SN 120 may both use SHA-1 or MD-5 as a cryptographic hash function .
The optional 3GPP AKA can include procedures that allow for primitive negotiation, for example, between the HE 110 and SN 120. For example, a one byte MODE field can store data identifying the AKA cryptographic primitive or set of AKA cryptographic primitives offered by an HE 110, SN 120, or MS 120. For example, a MODE field value of "S" can represent a request for communication using a shared SHA-1 primitive. The SN 120 authentication data requests can also include a primitive version identifier.
As will be appreciated by those of skill in the art, a field other than the MODE field may be used to facilitate AKA primitive negotiation between elements of the communication network. Additionally, as those of skill in the art will appreciate, a wide variety of alternate information exchanges can be used to negotiate a shared primitive. For example, either the HE 110 or SN 120 may initiate negotiation. Similarly, either the HE 110 or SN 120 may initially identify the cryptographic primitive (s) it offers.
If HE 110 and SN 120 do not share a common AKA primitive (e.g., if HE 110 determines that it does not provide the primitive identified in an SN 120 request for AVs), standard 3GPP AKA is performed instead of the optional 3GPP AKA mechanism described below. If HE 110 and SN 120 share a common AKA primitive, the optional 3GPP AKA mechanism, may be used to increase the efficiency of mutual authentication between the MS 130 and SN 120.
FIG. 6 illustrates the flow of an optional AKA mechanism that can reduce the amount of Authentication Vector (AV) traffic by establishing a Shared Secret K (SSK) between the MS 130 and SN 120 using one AV. As shown, when MS 130 requests service from SN 120, SN 120 sends (step 602) an authentication request to HE 130 indicating that a common primitive is available. Upon receiving the request associated with a particular MS 130 and noting the indication of a shared primitive (e.g., HE 110 offers the same primitive as indicated by the MODE field), HE 110 generates (step 604) at least one AV associated with that particular MS 130. After generating (step 604) the AV, the HE 110 sends (step 606) the AV to SN 120. SN 120 stores the AV in its Visitor Location Register (VLR) and generates (step 608) SSK(i). After initial communication, communication between the SN 120 and MS 130 will depend on both computing the same SSK(i) .
After selecting (step 610) an AV ( i ) , SN 120 sends (step 612) RAND(i) and AUTN(i) of AV(i) to MS 130. MS 130 verifies AUTN ( i ) and computes (step 614) RES(i) (see FIG. 3). If SQN(i) is greater than SQNMS, MS 130 successfully authenticates SN 120. MS 130 sends (step 616) RES(i) to SN 120. SN 120 then compares (step 618) RES(i) with XRES(i). If RES and XRES are equal, SN 120 has successfully authenticated MS 130. Finally, MS 130 computes CK ( i ) and IK(i) while SN 120 selects (step 620) CK(i) and IK ( i ) .
After establishing SSK and performing the initial AKA, the standard AKA protocol between SN 120 and MS/USIM 130 is modified by replacing Ki with SSKj_ for AKA calculations between the SN 120 and MS 130 for the duration of MS roaming. The protocol is further modified by using a Temporary SQN (TSQN) established between the SN 120 and MS/USIM 130 for the duration of MS 130 roaming in the SN 120 network area. FIG. 7 illustrates how subsequent authentications are performed between SN 120 and MS 130, for example, in response to a MS 130 request for service from SN 120. SN 120 generates (step 702) RAND(i) and generates TAUTN(i) using SSK(i) (see FIG. 8) . SN 120 sends (step 704) RAND(i) and TAUTN ( i ) to MS 130, for example, with MODE = SHA-1. MS 130 verifies (step 706) TAUTN(i) and computes RES ( i ) (see FIG. 9). If TSQNSN(i) is greater than TSQNMS/UΞIM/ MS 130 successfully authenticates SN 120. MS 130 sends (step 708) RES(i) to SN 120. SN 120 compares (step 710) RES(i) with XRES(i). If RES and XRES are equal, SN 120 has successfully authenticated MS 130. MS 130 computes (step 712) CK(i) and IK(i). SN 120 computes (step 714) CK ( i ) and IK ( i ) .
Just as SQNi uniquely increments for a Ki , TSQNj. uniquely increments for an SSKi . Thus for a unique SSK, the MS 130 maintains a uniquely incrementing TSQN to facilitate mutual authentication between the MS 130 and SN 120. While TSQN increments each time the same SSK is used for communication between an SN and MS, TSQN increments for a relatively short period of time compared with SQN, lessening the chance mis- synchronization. Additionally, TSQN need not impact the maintenance of SQN within the HE 110 and MS/USIM 130. TSQN can automatically reset when a new SSK (associated with a particular SN 120 is formed. This approach can eliminate the TR-45 problem of having to update SSD. As described above, TSQN is a sequence number. However, other values indicating key usage may be featured. For example, adjusting the value may feature decrementing instead of incrementing a numeric value. Additionally, the value need not be restricted to numbers but may instead feature a character or boolean value . A HE/SN pair, sharing a common primitive, can choose to utilize this scheme if they desire. However, even if HE 110 and SN 120 share a common AKA primitive, the HE 110 can utilize the standard 3GPP AKA mechanism and pass multiple AVs to SN 120.
The HE 110 may pass one or more AVs to SN 120 with the MODE value indicating standard 3GPP AKA. The SN 120, however, after the initial standard AKA setup, can use a common AKA primitive MODE value (e.g. SHA-1) to notify the MS 130 to use SSK and TSQN when utilizing the modified 3GPP AKA. Prior to initiating the optional AKA scheme, the SN 120 may determine if the MS 130 supports (e.g., includes instructions for) the optional scheme, for example, based on MS 130 identification information transmitted by the MS 120. Additionally, the MS 130 can transmit a message to the SN 120 declining use of the optional scheme, for example, if the MS 130 does not provide the primitive identified by the SN 120 in the MODE field. FIG. 10 illustrates an example of SSK generation. As shown, SSK can be generated using IK and RAND where f3 is the generating function (e.g. SSK = f3IK(RAND)). SSK may also be generated using a new function f6 derived from the shared cryptographic primitives (s) if desired.
FIG. 11 illustrates a cryptographic key hierarchy for the optional 3GPP AKA mechanism. A secret key K is the root secret shared between the HE 110 and MS 130. When mutual authentication is first performed between SN 120 and MS 130, a CK is generated to facilitate voice and data privacy and an IK is generated to facilitate message authentication. SSK can be derived from IK using function f3. For all subsequent SN 120 network accesses, CK and IK are derived from SSK.
FIG. 12 illustrates a different optional AKA mechanism. As shown, SSK may be generated using a new function f6 (e.g. SSK = f6K(RAND)). When using the new function, SSK can be generated by HE 110. HE 110 can include the generated SSK in the AV. With SSK included in the AV, the AV is defined as Shared Secret AV (SSAV) . A SN 120 receiving SSAV can simply extract SSK instead of independently computing SSK. The MS 130, however, still independently determines SSK from AV information transmitted by SN 120 to the MS 130.
After initial MS/SN mutual authentication and SSK generation, the SN 120 and MS/USIM 130 use SSK and TSQN for subsequent authentications as shown in Figure 7. Resynchronization of TSQN is not necessary because SN 120 can query HE 110 for a new SSAV, perform standard 3GPP AKA and establish a new SSK with a TSQN reset. The SN 130 may request multiple AVs from the HE 110 initially to allow for new SSK formation and TSQN reset.
FIG. 13 illustrates the cryptographic key hierarchy when SSK is formed by HE 110 using RAND and K. Although
SSAV is larger than AV, HE 110 and SN 120 traffic is reduced in comparison to the original 3GPP AKA mechanism because only one SSAV is sent to SN 120 for roaming authentication. By generating SSK from RAND and K, instead of from RAND and IK, AKA mechanism security is improved. Thus, SSK can be derived from IK for improved efficiency or from K for improved security. FIG. 14 illustrates another aspect of the invention that provides support for border cell operations. As shown, the MS 130 can store different cryptographic elements (e.g., SSK/TSQN pairs) for different SNs 120. By storing multiple SSK/TSQN pairs with each pair associated with a different SN 120, the MS 130 can straddle the border between multiple systems without requiring VLR-to-VLR AV sharing, SSD sharing, or SSD update .
As shown in FIG. 14, MS 130 straddles between areas served by two different serving networks. MS 130 uses SSKSNA for service from serving network A (SN-A) and SSKSN-B for service from serving network B (SN-B) . The MS 130 may store identification of a SN and the respective SSK/TSQN pair being used. Thereafter, the 130 may identify the SN providing service to retrieve the appropriate pair. SSK freshness depends on the SN 120 VLR and MS 130 rules. For example, the SN 120 may chose to store SSK for up to a week of inactivity. The MS 130 may store multiple SSK/TSQNs in a queue (five pairs or more) using first-in-first-out (FIFO) . This technique may be ideal for travelers moving between multiple systems and countries within a brief period of time. In the event the MS 130 deletes SSKSN-A before SN-A deletes SSKSN-A, the MS will recognize that SN-A is attempting the optional 3GPP AKA (e.g., MODE = SHA-1), issue a user authentication reject, and await standard 3GPP AKA to establish a new SSK with SN-A.
FIG. 15 is a flowchart of a process for using cryptographic data associated with different cells. As shown, a MS stores (step 1502) cryptographic data, such as SSK/TSQN pairs, for different service networks.
After determining (step 1504) a SN providing service, the MS can access and use the associated cryptographic data, for example, for authentication and encryption. The techniques described above can, potentially, offer significant benefits for networks such as 3GPP and TR-45 (3GPP2) networks. For example, the techniques can allow for standard 3GPP AKA or modified 3GPP AKA at a service provider's discretion. The techniques can offer mutual authentication based on a publicly scrutinized cryptographic primitive. Potentially, techniques can reduce HE/SN AV traffic when a common AϊCA primitive is shared between HE and SN. The techniques can reduce the probability of SQN re-synchronization problem by using TSQN. The techniques can also reduce the need for SSD update in TR-45 networks, can reduce the vulnerability of fixed SSD by ensuring new SSK formation between MS and SN, can reduce cryptographic export/import concerns for the United States and other countries interested in adopting TR-45 standards, and can reduce the need for VLR-to-VLR AV sharing, SSD sharing, and SSD update for border cell operations.

Claims

Claims :
1. A method for use in authenticating a service network to a station, the station having a home environment network, the method comprising: storing a key at the service network; transmitting information to the station from the service network that enables the station to compute the key stored at the service network; receiving a request for service at the service network from the station; adjusting a value corresponding to key usage; and transmitting information corresponding to the value to the station.
2. The method of claim 1, further comprising receiving a vector of authentication information from the home environment network of the station, the vector including an indication of the vector's position in a sequence of vectors; and wherein transmitting information to the station that enables the station to compute the key stored at the service network comprises transmitting portions of the received vector of authentication information.
3. The method of claim 2, wherein the received vector of authentication information comprises the key stored by the service network.
4. The method of claim 2, further comprising computing at the service network the key stored by the service network based on information included in the received vector.
5. The method of claim 1, wherein adjusting a value indicating use of the key comprises incrementing a sequence number corresponding to a number of times the key has been used.
6. The method of claim 5, wherein the value comprises a TSQN (Temporary Sequence Number) .
7. The method of claim 1, wherein the station comprises a cellular phone; and the service network and home environment networks comprise cellular networks.
8. The method of claim 1, further comprising using the key to compute a cipher key for encrypting communication between the service network and the station.
9. The method of claim 1, further comprising negotiating use of a cryptographic primitive between the service network and the home environment network.
10. The method of claim 1, further comprising transmitting a challenge to the station; receiving a challenge response from the station; and comparing the received challenge response with an expected response.
11. The method of claim 1, further comprising: computing the key stored by the service network at the s ation; receiving the information indicating the value corresponding to key usage at the station; and comparing the received value with a value corresponding to key usage maintained by the station.
12. A method for use in authenticating a service network to a station, the station having a home environment network, the method comprising: receiving information at the station from the service network; computing a key based on the information received at the station from the service network, the computed key also being stored by the service network; maintaining an indicator of key usage at the station; receiving at the station an indicator of key usage maintained by the service network; and comparing the key usage indicator maintained by the service network with the key usage indicator maintained by the station.
13. The method of claim 12, further comprising: maintaining an authentication vector sequence number at the station; receiving at the station from the service network an indication of an authentication vector sequence number maintained by the home environment network; and comparing the authentication vector sequence number maintained by the home environment network with the received authentication vector sequence number maintained by the station.
14. The method of claim 13 , further comprising receiving from the service network identification of a cryptographic primitive.
15. The method of claim 12, wherein the station comprises a cellular phone; and the service network and home environment network comprise cellular networks .
16. The method of claim 12, further comprising: using the key to compute a cipher key for encrypting communication between the service network and the station.
17. The method of claim 12, further comprising: receiving a challenge from the service network; determining a challenge response; and transmitting the challenge response to the service network.
18. The method of claim 12, wherein maintaining an indicator of key usage at the station comprises maintaining a key sequence number counter.
19. A method for use in authentication in a communications network including a home environment network, a service network, and a station, the method comprising: determining at the home environment network a cryptographic primitive offered by the service network; and based on the determined cryptographic primitive, transmitting to the service network at least one vector of authentication information corresponding to a particular station.
20. The method of claim 19, wherein determining comprises receiving identification of the cryptographic primitive from the service network.
21. The method of claim 20, wherein the identification comprises a value of a MODE field.
22. The method of claim 19, wherein the vector of authentication information comprises an indication of an authentication vector sequence number maintained by the home environment network.
23. The method of claim 22, wherein the vector of authentication information comprises a challenge and an expected response.
24. A method for use by a mobile station that can communicate with different service networks, the method comprising : storing different sets of cryptographic information for the different respective service networks ,- selecting a set of cryptographic information for one of the service networks; and using the selected set of cryptographic information to communicate with the service network.
25. The method of claim 24, wherein the sets of cryptographic information comprise a key shared by the station and the service network.
26. The method of claim 25, further comprising computing the key shared by the station and the service network based on information received from the service network.
27. The method of claim 25, wherein the sets of cryptographic information comprise an indicator of usage of the key.
28. The method of claim 27, wherein the indicator of usage comprises a sequence number.
29. The method of claim 27, further comprising: receiving from the service network an indicator of key usage; and comparing the received indicator of key usage with the indicator of key usage included in the selected set of cryptographic information.
30. The method of claim 25, wherein using the selected set of cryptographic information comprises using the selected set of cryptographic information to authenticate the service network.
31. The method of claim 25, wherein using the selected set of cryptographic information comprises using the selected set of cryptographic information in encrypting communication between the station and the service network.
32. A method of handling authentication and key agreement in a system including a home environment network, a service network, and a mobile station, the home environment network and the mobile station sharing a secret key K, the method comprising: determining whether the home environment and the service network share a cryptographic primitive; if it is determined that the home environment and the service network do not share a cryptographic primitive, handling authentication and key agreement between the mobile station and the service network using 3GPP (Third Generation Project Partners) AKA (authentication and key agreement); and if it is determined that the home environment and the service network share a cryptographic primitive, handling authentication and key agreement by: computing a shared secret key (SSK); transmitting information from the service network to the station that enables the station to compute the SSK; and replacing the use of K in the 3GPP AKA with SSK.
PCT/US2000/031103 1999-11-15 2000-11-13 Cryptographic techniques for a communications network WO2001037477A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU27245/01A AU2724501A (en) 1999-11-15 2000-11-13 Cryptographic techniques for a communications network

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US16553999P 1999-11-15 1999-11-15
US60/165,539 1999-11-15
US16781199P 1999-11-29 1999-11-29
US60/167,811 1999-11-29

Publications (1)

Publication Number Publication Date
WO2001037477A1 true WO2001037477A1 (en) 2001-05-25

Family

ID=26861476

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2000/031103 WO2001037477A1 (en) 1999-11-15 2000-11-13 Cryptographic techniques for a communications network

Country Status (2)

Country Link
AU (1) AU2724501A (en)
WO (1) WO2001037477A1 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1283618A2 (en) * 2001-08-07 2003-02-12 Siemens Aktiengesellschaft Method for transferring cipher information to members of a multicast group
EP1414260A1 (en) * 2002-10-21 2004-04-28 Swisscom Mobile AG Method, system and devices for subscriber authentication in a telecommunication network
WO2004080096A3 (en) * 2003-03-05 2005-03-03 Qualcomm Inc User plane-based location services (lcs) system, method and apparatus
KR101170029B1 (en) * 2004-06-04 2012-08-01 알카텔-루센트 유에스에이 인코포레이티드 A self-synchronizing authentication and key agreement protocol

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4888800A (en) * 1987-03-03 1989-12-19 Hewlett-Packard Company Secure messaging systems
US4941176A (en) * 1988-08-11 1990-07-10 International Business Machines Corporation Secure management of keys using control vectors
US4993069A (en) * 1989-11-29 1991-02-12 International Business Machines Corporation Secure key management using control vector translation
US5604802A (en) * 1993-10-29 1997-02-18 International Business Machines Corporation Transaction processing system
US5991407A (en) * 1995-10-17 1999-11-23 Nokia Telecommunications Oy Subscriber authentication in a mobile communications system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4888800A (en) * 1987-03-03 1989-12-19 Hewlett-Packard Company Secure messaging systems
US4941176A (en) * 1988-08-11 1990-07-10 International Business Machines Corporation Secure management of keys using control vectors
US4993069A (en) * 1989-11-29 1991-02-12 International Business Machines Corporation Secure key management using control vector translation
US5604802A (en) * 1993-10-29 1997-02-18 International Business Machines Corporation Transaction processing system
US5991407A (en) * 1995-10-17 1999-11-23 Nokia Telecommunications Oy Subscriber authentication in a mobile communications system

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1283618A2 (en) * 2001-08-07 2003-02-12 Siemens Aktiengesellschaft Method for transferring cipher information to members of a multicast group
EP1283618A3 (en) * 2001-08-07 2004-05-26 Siemens Aktiengesellschaft Method for transferring cipher information to members of a multicast group
EP1414260A1 (en) * 2002-10-21 2004-04-28 Swisscom Mobile AG Method, system and devices for subscriber authentication in a telecommunication network
WO2004080096A3 (en) * 2003-03-05 2005-03-03 Qualcomm Inc User plane-based location services (lcs) system, method and apparatus
US8023958B2 (en) 2003-03-05 2011-09-20 Qualcomm Incorporated User plane-based location services (LCS) system, method and apparatus
KR101170029B1 (en) * 2004-06-04 2012-08-01 알카텔-루센트 유에스에이 인코포레이티드 A self-synchronizing authentication and key agreement protocol

Also Published As

Publication number Publication date
AU2724501A (en) 2001-05-30

Similar Documents

Publication Publication Date Title
US7613299B2 (en) Cryptographic techniques for a communications network
Shin et al. Wireless network security and interworking
JP4634612B2 (en) Improved subscriber authentication protocol
ES2584862T3 (en) Authentication in data communication
EP1123603B1 (en) Subscription portability for wireless systems
JP4313515B2 (en) Authentication method
US7158777B2 (en) Authentication method for fast handover in a wireless local area network
JP3742772B2 (en) Integrity check in communication systems
EP1478204B1 (en) Method and apparatus for performing authentication in a communications system
CA2792490C (en) Key generation in a communication system
US7707412B2 (en) Linked authentication protocols
JP5597676B2 (en) Key material exchange
EP1001570A2 (en) Efficient authentication with key update
US20050271209A1 (en) AKA sequence number for replay protection in EAP-AKA authentication
WO2008021855A2 (en) Ad-hoc network key management
CN106921965A (en) A kind of method that EAP authentication is realized in wlan network
Zhu et al. Research on authentication mechanism of cognitive radio networks based on certification authority
WO2001037477A1 (en) Cryptographic techniques for a communications network
Lin et al. Performance Evaluation of the Fast Authentication Schemes in GSM-WLAN Heterogeneous Networks.
JP2006191429A (en) Authentication method and system in assembly type customer station network
Ja'afer et al. Formal analysis of a novel mutual authentication and key agreement protocol
Morioka et al. MIS protocol for secure connection and fast handover on wireless LAN
Parne et al. PASE-AKA: Performance and Security Enhanced AKA Protocol for UMTS Network
Matsunaka et al. An Effective Authentication Procedure Considering User Expiry Time During Handover

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP