GSM-like and UMTS-like authentication in a CDMA2000 network environment

• US 20050251681A1
• Filed: 03/09/2005
• Published: 11/10/2005
• Est. Priority Date: 03/10/2004
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Madour, Lila, Robles, Luis Ramos
• Granted Patent: US 7,546,459 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/04 Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

An authentication server (e.g., AAA server) is described herein which is located in a CDMA2000 network and used to authenticate a user terminal that is connected to a non-CDMA2000 network. The authentication server receives an access request for authenticating the user terminal connected to the non-CDMA2000 network. Then, it obtains a root secret key shared between the user terminal and the CDMA2000 network and generates a GSM or UMTS-like authentication vector which is used to authenticate the user terminal according to a GSM or UMTS-like authentication method. The access of the terminal to the non-CDMA2000 network is granted upon successful authentication. According to embodiments of the invention, the non-CDMA2000 network can be a WLAN network, and the authentication methods used can be EAP SIP or EAP AKA. The present invention allows one to use authentication servers that were originally intended for WLAN-3GPP interworking scenarios also in WLAN-CDMA2000 network interworking.

Claims

1. An authentication server used in a CDMA2000 network for authenticating a user terminal connected to a non-CDMA2000 network by using a root secret key in a GSM/UMTS-like authentication method, wherein said root secret key is shared between said user terminal and said CDMA2000 network.

2. The authentication server of claim 1, wherein the GSM/UMTS-like authentication method is an authentication method selected from an EAP AKA authentication method, and a EAP SIM authentication method.

3. The authentication server of claim 1, wherein the non-CDMA2000 network is a WLAN network.

4. A system comprising:

an user side located in a non-CDMA2000 network;

a network side, located in a CDMA2000 network, including an authentication server for authenticating a user terminal connected to the non-CDMA2000 network by using a root secret key in a GSM/UMTS-like authentication method;

said user side including an authenticating peer that uses the root secret key in the GSM/UMTS-like authentication method; and

wherein said root secret key is shared between said user side and said network side.

5. The system of claim 4, wherein said network side and said user side do not need to have a GSM or UMTS infrastructure to perform the GSM/UMTS-like authentication method.

6. The system of claim 4, wherein the GSM/UMTS-like authentication method is an authentication method selected from an EAP AKA authentication method, and an EAP SIM authentication method.

7. The system of claim 4, wherein the non-CDMA2000 network is a WLAN network.

8. The system of claim 4, wherein said network side and said user side achieve network authentication with protection against replay attacks by using a different username for each authentication attempt.

9. The system of claim 8, wherein said username includes:

a permanent username;

a pseudonym username; and

a fast re-authentication username.

10. The system of claim 4, wherein said network side and said user side each use the root secret key to generate GSM-like triplets or UMTS-like quintets.

11. An authentication server used in a CDMA2000 network to authenticate a user terminal connected to a non-CDMA2000 network, said authentication server comprising:

a processor for receiving an access request to authenticate the user terminal;

said processor for obtaining a root secret key shared between said user terminal and said CDMA2000 network; and

said processor for using the root secret key to derive a GSM/UMTS-like authentication vector used to authenticate the user terminal according to a GSM/UMTS-like authentication method.

12. The authentication server of claim 11, wherein the GSM/UMTS-like authentication vector is an authentication vector selected from at least one of a GSM-like triplet, and an UMTS-like quintet.

13. The authentication server of claim 11, wherein the non-CDMA2000 network is a WLAN network.

14. The authentication server of claim 11, wherein the GSM/UMTS-like authentication method is an authentication method selected from an EAP AKA authentication method, and an EAP SIM authentication method.

15. An authenticating peer used in a non-CDMA2000 network to authenticate a user terminal connected to the non-CDMA2000 network, said authenticating peer comprising:

a processor for receiving a GSM/UMTS-like authentication challenge from an authentication server in a CDMA2000 network;

said processor for obtaining a root secret key shared with the CDMA2000 network; and

said processor for using the root secret key to generate a GSM/UMTS-like authentication response to the received GSM/UMTS-like authentication challenge.

16. The authenticating peer of claim 15, wherein the non-CDMA2000 network is a WLAN network.

17. The authenticating peer of claim 15, wherein the GSM/UMTS-like authentication challenge and response are conveyed in a GSM/UMTS-like authentication method selected from an EAP AKA authentication method, and an EAP SIM authentication method.

18. A method used in a CDMA2000 network for authenticating a user terminal connected to a non-CDMA2000 network, said method comprising the steps of:

a) receiving, at an authentication server in said CDMA2000 network, an access request for authenticating said user terminal;

b) obtaining, at the authentication server, a root secret key shared between said user terminal and said CDMA2000 network; and

c) using, at the authentication server, the root secret key to derive a GSM/UMTS-like authentication vector for authenticating the user terminal according to a GSM/UMTS-like authentication method.

19. The method of claim 18, wherein the step “

c”

comprises the steps of;

c1) sending, from said authentication server, a GSM/UMTS-like authentication challenge derived from said authentication vector to said user terminal;

c2) receiving, at said authentication server from said user terminal, a GSM/UMTS-like authentication response to said GSM/UMTS-like challenge; and

c3) granting, from said authentication server, the access of the user terminal to the non-CDMA2000 network if said authentication response is satisfactory.

20. The method of claim 18, wherein the non-CDMA2000 network is a WLAN network.

21. The method of claim 18, wherein the GSM/UMTS-like authentication challenge and response are conveyed in a GSM/UMTS-like authentication method selected from an EAP AKA authentication method, and an EAP SIM authentication method.

22. A method for using an EAP AKA authentication mechanism to enable WLAN-CDMA2000 network interworking, said method comprising the steps of:

on a network side;

receiving an access-request message from a WLAN at an authentication server;

generating at the authentication server an EAP AKA authentication vector including RAND and AUTN using a CDMA2000 root secret key; and

sending from the authentication server an access-challenge message which contains the RAND, the AUTN and a MAC to the WLAN; and

on a user side;

receiving an access-challenge message which contains the RAND, the AUTN and a MAC from the WLAN;

generating RES, IK and CK using the CDMA2000 root secret key;

sending a response to the access-challenge message which contains the RES and the MAC to the WLAN; and

on the network side;

receiving at the authentication server a response to the access-challenge message which contains the RES and the MAC from the WLAN; and

checking at the authentication server the response to the access-challenge message and if the authentication is successful then sending an access-accept message to the WLAN; and

on the user side;

receiving an access-accept message from the WLAN.