System, apparatus, and method for providing generic internet protocol authentication

• US 20040225878A1
• Filed: 05/05/2003
• Published: 11/11/2004
• Est. Priority Date: 05/05/2003
• Status: Active Grant

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Costa-Requena, Jose, Hietasarka, Juha, Aholainen, Markus, Immonen, Jukka, Korhonen, Ossi, Ruutu, Jussi
• Granted Patent: US 7,421,732 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Generic Internet Protocol (IP) authentication is provided by authentication server (134). Application Programming Interface (API) (310) detects the protocol type of an incoming authentication request and invokes one of a number of authentication mechanisms (318-326) depending on the protocol type detected. A localized repository (520) is provided to store Subscriber Identity Module (SIM) information and other algorithm data as required to facilitate the authentication session.

Claims

1. A method for providing generic authentication within an Internet Protocol (IP) network, comprising:

receiving an authentication request;

detecting an authentication mechanism associated with the received authentication request;

selecting one of a plurality of authentication modules in response to the detected authentication mechanism; and

accessing data that is required to support the authentication module.

2. The method according to claim 1, wherein detecting the authentication mechanism is supported by an Application Programming Interface (API).

3. The method according to claim 2, wherein the API is arranged to detect all authentication mechanisms supported by the IP network.

4. The method according to claim 3, wherein the API is further arranged to invoke the authentication module to be used in support of the authentication mechanism.

5. The method according to claim 4, wherein the authentication module supports Hyper Text Transfer Protocol (HTTP), Session Initiation Protocol (SIP), Extensible Authentication Protocol (EAP), and Real-Time Transport Protocol (RTP).

6. The method according to claim 1, further comprising:

configuring the authentication modules;

registering the authentication modules; and

loading the data required to support the authentication modules.

7. The method according to claim 6, wherein loading the data comprises transferring Subscriber Identification Module (SIM) information to a location that is co-located with the authentication modules.

8. An authentication system, comprising:

a plurality of network elements each employing a different authentication protocol;

an authentication server arranged to provide authentication service in response to received authentication requests from the network elements; and

a data server arranged to provide data to the authentication server to support the authentication service, wherein the authentication service performed depends upon the authentication protocol employed by the requesting network element.

9. The authentication system according to claim 8, wherein the network elements are coupled via a common Internet Protocol stack.

10. The authentication system according to claim 8, wherein the authentication server comprises:

an Application Programming Interface (API) coupled to receive the authentication requests; and

an authentication module comprising a number of authentication mechanisms coupled to service the authentication requests.

11. The authentication system according to claim 10, wherein the authentication mechanisms include Hyper Text Transfer Protocol (HTTP), Session Initiation Protocol (SIP), Extensible Authentication Protocol (EAP), and Real-Time Transport Protocol (RTP).

12. The authentication system according to claim 8, wherein the data server is co-located with the authentication server.

13. The authentication system according to claim 8, wherein the data server comprises an interface coupled to receive Subscriber Identity Module (SIM) data.

14. The authentication system according to claim 8, wherein the data server provides a centralized repository for the SIM data.

15. A server used to authenticate network elements within an Internet Protocol (IP) network, comprising:

means for receiving authentication requests having various protocol types from the network elements;

means for detecting the various protocol types;

means for invoking an authentication mechanism depending upon the protocol type of the authentication request; and

means for accessing data in support of the authentication of the network elements.

16. The server according to claim 15, wherein the various protocol types include Hyper Text Transfer Protocol (HTTP), Session Initiation Protocol (SIP), Extensible Authentication Protocol (EAP), and Real-Time Transport Protocol (RTP).

17. The server according to claim 15, wherein the server further comprises means for transferring the data in support of the authentication into a central repository.

18. The server according to claim 17, wherein the central repository is co-located with the server.

19. A computer-readable medium having instructions stored thereon which are executable by an authentication server for facilitating authentication of network elements by performing steps comprising:

receiving authentication requests having various protocol types from the network elements;

detecting the various protocol types;

invoking an authentication mechanism depending upon the protocol type of the authentication request; and

accessing data in support of the authentication of the network elements.