Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack

• US 20050044365A1
• Filed: 08/18/2004
• Published: 02/24/2005
• Est. Priority Date: 08/22/2003
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Niemi, Aki, Haukka, Tao
• Granted Patent: US 7,908,484 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Disclosed is a method and system to discourage a MITM attacker in a data communications system that includes client and a server. The method includes, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an “algorithm” field to ‘algorithm=“AKAv1-HMAC-MD5”’ for directing the client to use the HMAC-MD5 keyed hash function when producing Digest credentials; and using at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.

Claims

1. A method to discourage a MITM attacker in a data communications system that includes a client and a server, comprising:

directing the client to use a HMAC-MD5 keyed hash function when producing Digest credentials; and

using at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.

2. A method as in claim 1, where directing includes, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an “

algorithm”

field to ‘

algorithm=“

AKAv1-HMAC-MD5”

’

.

3. A method as in claim 1, where directing includes, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an “

algorithm”

field to ‘

algorithm=“

AKAv2-HMAC-MD5”

’

.

4. A method as in claim 1, where when using IK, the HMAC-MD5 hash for the Digest AKA is as follows:

HMAC-MD5(data)=MD5(IK XOR opad, MD5(IK XOR ipad, data)).

5. A method as in claim 1, where when using CK, the HMAC-MD5 hash for the Digest AKA is as follows:

HMAC-MD5(data)=MD5(CK XOR opad, MD5(CK XOR ipad, data)).

6. A method as in claim 1, where the Digest is defined as follows:

Digest=HMAC-MD5(concat.(HMAC-MD5(A1),nonces,HMAC-MD5(A2))).

7. A method to discourage a MITM attacker in a data communications system that includes client and a server, comprising:

in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an algorithm field to indicate an algorithm=“

AKAv2-HMAC-MD5”

or “

AKAv1-HMAC-MD5”

, where in AKAv2 a value A1′

is defined as follows;

Let A1′

=K∥

opad∥

MD5(K∥

ipad∥

A1),

so that A1′

is the contents of the HMAC part, and the result is;

$\begin{array}{c}\mathrm{Digest}=<br><br>\mathrm{MD5}<br><br>\left(\mathrm{concat}.\left(\mathrm{MD5}<br><br>\left({\mathrm{A1}}^{\mathrm{\prime <br><br>}}\right),\mathrm{nonces},\mathrm{MD5}<br><br>\left(\mathrm{A2}\right)\right)\right)\\ =<br><br>\mathrm{MD5}<br><br>\left(\mathrm{concat}.\left(\mathrm{HMAC}-\mathrm{MD5}<br><br>\left(\mathrm{A1}\right),\mathrm{nonces},\mathrm{MD5}<br><br>\left(\mathrm{A2}\right)\right)\right),\end{array}$

where K is composed of an AKA Integrity Key (IK), an AKA Cipher Key (CK), a concatenation of IK and CK, or a cryptographic combination of IK and CK.

8. A method to discourage a MITM attacker in a data communications system that includes client and a server, comprising:

in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an algorithm field to indicate an algorithm=“

AKAv2-HMAC-MD5”

, where a value A1′

is defined as follows;

Let A1′

=K∥

opad∥

MD5(K∥

ipad∥

A1),

so that A1′

is the contents of the HMAC part, and the result is;

$\begin{array}{c}\mathrm{Digest}=<br><br>\mathrm{MD5}<br><br>\left(\mathrm{concat}.\left(\mathrm{MD5}<br><br>\left({\mathrm{A1}}^{\mathrm{\prime <br><br>}}\right),\mathrm{nonces},\mathrm{MD5}<br><br>\left(\mathrm{A2}\right)\right)\right)\\ =<br><br>\mathrm{MD5}<br><br>\left(\mathrm{concat}.\left(\mathrm{HMAC}-\mathrm{MD5}<br><br>\left(\mathrm{A1}\right),\mathrm{nonces},\mathrm{MD5}<br><br>\left(\mathrm{A2}\right)\right)\right),\end{array}$

where K is composed of one of an AKA Integrity Key (IK), an AKA Cipher Key (CK), a concatenation of IK and CK, or a cryptographic combination of IK and CK.

9. A data communications system that includes a client and a server, comprising in said server a function to direct the client to use a HMAC-MD5 keyed hash function when producing Digest credentials;

and said server comprising a function, in response to said server, to use at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.

10. A system as in claim 9, where said server function, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, sets an “

algorithm”

field to ‘

algorithm=“

AKAv1-HMAC-MD5”

’

.

11. A system as in claim 9, where said server function, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, sets an “

algorithm”

field to ‘

algorithm=“

AKAv2-HMAC-MD5”

’

.

12. A system as in claim 9, where when using IK, a HMAC-MD5 hash for a Digest AKA is as follows:

HMAC-MD5(data)=MD5(IK XOR opad, MD5(IK XOR ipad, data)).

13. A system as in claim 9, where when using CK, a HMAC-MD5 hash for a Digest AKA is as follows:

HMAC-MD5(data)=MD5(CK XOR opad, MD5(CK XOR ipad, data)).

14. A system as in claim 9, where the Digest is defined as follows:

Digest=HMAC-MD5(concat.(HMAC-MD5(A1),nonces,HMAC-MD5(A2))).

15. A wireless communications system comprising functionality to authenticate User Equipment using a Digest Authentication and Key Agreement (AKA) authentication procedure, comprising in a server a function to direct the User Equipment to employ a HMAC-MD5 keyed hash function when producing Digest credentials;

and said User Equipment, responsive to said server, using at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.

16. A system as in claim 15, where said server, in a Digest AKA challenge sent to the User Equipment, sets an “

algorithm”

field to ‘

algorithm=“

AKAv1-HMC-MD5”

’

.

17. A system as in claim 15, where said server, in a Digest AKA challenge sent to the User Equipment, sets an “

algorithm”

field to ‘

algorithm=“

AKAv2-HMAC-MD5”

’

.

18. In a wireless communications system comprising a server and user equipment and operating to authenticate the user equipment using a Digest Authentication and Key Agreement (AKA) authentication procedure, said server comprising a function to direct the User Equipment to employ a HMAC-MD5 keyed hash function when producing Digest credentials through the use of at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK).

19. A server as in claim 18, where said server, in a Digest AKA challenge sent to the user equipment, sets an “

algorithm”

field to ‘

algorithm=“

AKAv1-HMAC-MD5”

’

.

20. A server as in claim 18, where said server, in a Digest AKA challenge sent to the user equipment, sets an “

algorithm”

field to ‘

algorithm=“

AKAv2-HMAC-MD5”

’

.

21. In a wireless communications system comprising a server and user equipment and operating to authenticate the user equipment using a Digest Authentication and Key Agreement (AKA) authentication procedure, said user equipment comprising a function that is responsive to receipt of a message from the server to employ a HMAC-MD5 keyed hash function when producing Digest credentials through the use of at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK).

22. User equipment as in claim 21, responsive to a Digest AKA challenge received from the server having an “

algorithm”

field set to ‘

algorithm=“

AKAv1-HMAC-MD5”

’

.

23. User equipment as in claim 21, responsive to a Digest AKA challenge received from the server having an “

algorithm”

field set to ‘

algorithm=“

AKAv2-HMAC-MD5”

’

.