Low cost packet originator verification for intermediate nodes

• US 20030093687A1
• Filed: 10/25/2002
• Published: 05/15/2003
• Est. Priority Date: 10/25/2001
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Westhoff, Dirk, Lamparter, Bernd
• Granted Patent: US 7,343,489 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/108 Source integrity

Abstract

A technique to transmit data from a sender to a receiver via a network, preferably a LAN and/or the Internet etc., where the sender transmits the data to a base station, and where the sender is verified by a server, in particular a AAA-server etc. In order to prevent the transmission of data from an illegitimate sender at the expense of a legitimate sender to the greatest extent possible, the server transmits verification data from the server to the sender and/or base station.

Claims

1. A technique for the transmission of data from a sender to a receiver via a network where the sender transmits the data to a base station and where the sender is verified via a server, wherein the server transmits verification data to the sender and/or base station.

2. The technique according to claim 1, wherein the server authenticates and/or authorizes and/or accounts the access of the sender to the base station.

3. The technique according to claim 1, wherein the sender and the base station are located in the same cell.

6. The technique according to claim 1, wherein the verification data is transmitted from the server to the base station after a successful authentication.

7. The technique according to claim 1, wherein the server transmits the verification data via the base station to the sender.

8. The technique according to claim 1, wherein the verification data is transmitted in encrypted form from the server to the base station and/or from the base station to the sender.

9. The technique according to claim 1, wherein the server generates and/or transmits new verification data for each authentication.

10. The technique according to claim 1, wherein the verification data includes an initial generating key.

11. The technique according to claim 1, wherein the verification data includes a random bit array b₁, . . . b_n.

12. The technique according to claim 1, wherein the data is divided into IP packets.

13. The technique according to claim 12, wherein the sender sends a proof (p), which is based on the verification data, to the base station.

14. The technique according to claim 13, wherein the sender sends an index (i) to the base station.

15. The technique according to claim 14, wherein the proof for the packet with index (i) is calculated as b_(I−

1)|p|+1,−

−

b_l|p|.

16. The technique according to claim 15, wherein the proof (p) and/or the index (i) is integrated into an additional IP header field or extension header.

17. The technique according to claim 16, wherein the proof (p) and/or the index (i) is integrated into an additional IP header field or extension header.

18. The technique according to claim 17, characterized by the fact that the bases station compares the received proof (p_l) with a proof (p_lBS), which is calculated from the verification data.

19. The technique according to claim 18, wherein the base station, if the comparison between (p₁) and (p_lBS) shows that they are unequal, reads the index (i) and/or recalculates the proof (p_iBS).

20. The technique according to claim 19, wherein the base station, if (p_i) is not equal to the proof (p_lBS) calculated by the base station, initiates a re-authentication.

5. The technique according to claim 5, wherein the server is located in a different domain.

4. The technique according to claim 5, wherein the server is located in the same domain as sender and base station.