Method and apparatus for mutual authentication at handoff in a mobile wireless communication network

• US 20050278532A1
• Filed: 05/28/2004
• Published: 12/15/2005
• Est. Priority Date: 05/28/2004
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Smith, Aaron M., Fu, Zhi, Cox, Gregory W.
• Granted Patent: US 7,421,582 B2
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method for mutual authentication in a mobile wireless communication network (100) that includes the steps of: verifying a second authenticating device (20) by a mobile node (30) based on a first authentication between the mobile node and a first authenticating device (10); and verifying the mobile node by the second authenticating device based on the first authentication, whereby the mobile node and the second authenticating device perform a second authentication.

Claims

1. A method for mutual authentication in a mobile wireless communication network comprising the steps of:

verifying a second authenticating device by a mobile node based on a first authentication between said mobile node and a first authenticating device; and

verifying said mobile node by said second authenticating device based on said first authentication, whereby said mobile node and said second authenticating device perform a second authentication.

2. The method of claim 1, wherein said mobile node and said second authenticating device are verified based on a first shared secret obtained during said first authentication.

3. The method of claim 2, wherein said step of verifying said second authenticating device comprises the steps of:

generating a first random value;

encrypting said random value using said first shared secret;

forwarding said encrypted value to said first authenticating device via said second authenticating device;

receiving an encrypted second value from said first authenticating device via said second authenticating device; and

decrypting said second value, wherein said second authenticating device is verified if said second value is equal to a first predetermined value.

4. The method of claim 3, wherein said first predetermined value is a function of said first random value.

5. The method of claim 3, wherein said second value is encrypted and decrypted using said first shared secret.

6. The method of claim 2, wherein said step of verifying said mobile node comprises the steps of:

generating a first random value;

encrypting said first random value using a second shared secret between said first authenticating device and said second authenticating device;

forwarding said encrypted first random value to said first authenticating device;

receiving a second value from said first authenticating device that is encrypted using said second shared secret;

forwarding said encrypted second value to said mobile node;

receiving a decrypted second value from said mobile node; and

further decrypting said second value, wherein said mobile node is verified if said second value is equal to a first predetermined value.

7. The method of claim 6, wherein said first predetermined value is a function of said first random value.

8. The method of claim 6, wherein said second value is encrypted by said first authenticating device and decrypted by said mobile node using said first shared secret.

9. The method of claim 1 further comprising the step of requesting said second authenticating device to tunnel traffic to and from said mobile node using said first authenticating device.

10. The method of claim 9, wherein said step of requesting is performed before the second authentication is complete.

11. The method of claim 9, wherein said traffic is tunneled until the occurrence of at least one of the expiration of a timer and the completion of said second authentication.

12. The method of claim 1, wherein said steps of verifying said mobile node and said second authenticating device are further based on a mutual trust between said first and second authenticating devices.

13. The method of claim 12, wherein the mutual trust between said first and second authenticating devices is based on a shared secret between said first and second authenticating devices.

14. The method of claim 1, wherein said method is performed at at least one of a link layer, a network layer and an applications layer of the communication network.

15. The method of claim 1, further comprising establishing a shared secret between said mobile node and said second authenticating device based on said first authentication and based on a mutual trust between said first and second authenticating devices.

16. A method for authentication in a mobile wireless communication network comprising the steps of:

sending a first message to a first authenticating device via a second authenticating device, said first message based on a first authentication between a mobile node and said first authenticating device; and

receiving a second message from said first authenticating device via said second authenticating device, said second message being based on a said first authentication, wherein said second message is used to verify said second authenticating device.

17. A mobile node adapted for performing the method of claim 16.

18. A method for authentication in a mobile wireless communication network comprising the steps of:

sending a first message to a first authenticating device;

receiving a second message from said first authenticating device, said second message being based on a first authentication between said first authenticating device and a mobile node;

forwarding said second message to said mobile node; and

receiving a third message from said mobile node, wherein said third message is used to verify said mobile node.

19. An authenticating device adapted for performing the method of claim 18.

20. Apparatus for mutual authentication in a mobile wireless communication network comprising:

means for verifying a second authenticating device by a mobile node based on a first authentication between said mobile node and a first authenticating device; and

means for verifying said mobile node by said second authenticating device based on said first authentication, whereby said mobile node and said second authenticating device perform a second authentication.