EAP/SIM authentication for Mobile IP to leverage GSM/SIM authentication infrastructure

• US 20070091843A1
• Filed: 10/25/2005
• Published: 04/26/2007
• Est. Priority Date: 10/25/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Leung, Kent, Patel, Alpesh, Salowey, Joseph, Shao, Yu-Cheng
• Granted Patent: US 7,626,963 B2
• Time in Patent Office: Days
• US Class Current: 370/331
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

Methods and apparatus for dynamically generating a set of Mobile IP keys are disclosed. The set of Mobile IP keys is dynamically generated using an existing HLR/AuC authentication infrastructure. This is accomplished, in part, by obtaining an International Mobile Subscriber Identity (IMSI) that uniquely identifies a particular Mobile Node. Once a set of Mobile IP keys is generated from authentication information associated with the IMSI, the Mobile Node may register with its Home Agent using the set of Mobile IP keys.

Claims

1. A method of generating a set of Mobile IP keys, comprising:

obtaining an International Mobile Subscriber Identity;

generating at least one Mobile IP key from authentication information associated with the International Mobile Subscriber Identity; and

registering a Mobile Node supporting Mobile IP with a Home Agent supporting Mobile IP using the at least one Mobile IP key.

2. The method as recited in claim 1, wherein generating at least one Mobile IP key comprises:

obtaining information derived from the authentication information associated with an International Mobile Subscriber Identity from a Home Location Register, thereby enabling the at least one Mobile IP key to be generated from the information.

3. The method as recited in claim 2, wherein generating at least one Mobile IP key further comprises:

obtaining a nonce from a mobile nonce, thereby enabling a message authentication code to be generated for authenticating a message as originating from a valid network.

4. In a Mobile Node supporting Mobile IP, a method of registering with a Home Agent supporting Mobile IP, comprising:

sending a bootstrap request to the Home Agent to initiate generation of at least one Mobile IP key from the authentication information associated with an International Mobile Subscriber Identity;

receiving a bootstrap reply including one or more random numbers from the Home Agent; and

generating the at least one Mobile IP key from the authentication information associated with the International Mobile Subscriber Identity and the random numbers received in the bootstrap reply.

5. The method as recited in claim 4, wherein generating the at least one Mobile IP key from the authentication information associated with the International Mobile Subscriber Identity and the random number received in the bootstrap reply comprises:

generating a MN-AAA key shared between the Mobile Node and a AAA server.

6. The method as recited in claim 5, further comprising:

generating a registration request including the MN-AAA key.

7. The method as recited in claim 6, further comprising:

generating a MN-HA key from the MN-AAA key to authenticate a registration reply including a MHAE; and

authenticating the MHAE using the MN-HA key.

8. The method as recited in claim 5, further comprising:

deriving a MN-HA key from the MN-AAA key to authenticate the bootstrap reply, wherein the bootstrap reply includes a MHAE.

9. The method as recited in claim 8, further comprising:

deleting the MN-HA key after the bootstrap reply is authenticated.

10. The method as recited in claim 5, wherein generating the MN-AAA key comprises:

generating a set of SIM triplets via a SIM card from the authentication information associated with the International Mobile Subscriber Identity and the random number.

11. The method as recited in claim 4, wherein the bootstrap request includes the International Mobile Subscriber Identity.

12. The method as recited in claim 4, further comprising:

registering with the Home Agent using the at least one Mobile IP key.

13. In a Home Agent supporting Mobile IP, a method of registering a Mobile Node supporting Mobile IP with the Home Agent, comprising:

receiving a bootstrap request from the Mobile Node, the bootstrap request initiating generation of at least one Mobile IP key from authentication information associated with an International Mobile Subscriber Identity;

transmitting a bootstrap reply including one or more random numbers to the Mobile Node, thereby enabling the Mobile Node to generate the at least one Mobile IP key from the authentication information associated with the International Mobile Subscriber Identity and the random numbers; and

obtaining the at least one Mobile IP key, the at least one Mobile IP key being derived from the authentication information associated with the International Mobile Subscriber Identity and the random numbers.

14. The method as recited in claim 13, wherein the random number is obtained from a Home Location Register.

15. The method as recited in claim 13, wherein the at least one Mobile IP key comprises a MN-HA key.

16. The method as recited in claim 15, further comprising:

receiving a registration request including a MN-AAA key from the Mobile Node;

authenticating the Mobile Node using the MN-AAA key;

obtaining the MN-HA key, wherein the MN-HA key has been derived from the MN-AAA key;

generating a MHAE using the MN-HA key;

appending the MHAE to a registration reply; and

sending the registration reply to the Mobile Node.

17. The method as recited in claim 16, wherein authenticating is performed using a AAA server and wherein obtaining the MN-HA key comprises obtaining the MN-HA key from the AAA server.

18. The method as recited in claim 17, further comprising:

providing the MN-AAA key to the AAA server, thereby enabling the AAA server to generate the MN-HA key.

19. The method as recited in claim 15, wherein the MN-HA key is obtained from a AAA server.

20. The method as recited in claim 15, further comprising:

generating a MHAE from the MN-HA key; and

composing the bootstrap reply, the bootstrap reply including the MHAE.

22. The method as recited in claim 13, wherein the bootstrap request includes the International Mobile Subscriber Identity.

21. The method as recited in clam 20, further comprising:

deleting the MN-HA key after the MHAE is generated.

23. In a AAA server, a method of generating at least one Mobile IP key, comprising:

receiving a request message from a Home Agent, the request message including an International Mobile Subscriber Identity;

transmitting a second request message including the IMSI to a Home Location Register;

receiving a reply message from the Home Location Register, the reply message including one or more random numbers and information derived from both the authentication information associated with the International Mobile Subscriber Identity and the random numbers; and

generating the at least one Mobile IP key from the information derived from both the authentication information associated with the International Mobile Subscriber Identity and the random number.

24. The method as recited in claim 23, wherein the at least one Mobile IP key comprises a MN-HA key.

25. The method as recited in claim 24, further comprising:

sending a reply message including the MN-HA key to the Home Agent.

26. The method as recited in claim 25, wherein the reply message further includes the one or more random numbers, thereby enabling the Home Agent to provide the random numbers to a Mobile Node to enable the Mobile Node to generate the at least one Mobile IP key.

27. The method as recited in claim 23, further comprising:

converting the request message to a MAP formatted message by a network device; and

transmitting the converted request message by the network device to the Home Location Register.

28. The method as recited in claim 23, wherein transmitting and receiving each comprise:

communicating with the Home Location Register via a network device adapted for converting between a AAA formatted message and a MAP formatted message.

29. The method as recited in claim 23, wherein the at least one Mobile IP key comprises a MN-AAA key.

30. The method as recited in claim 29, further comprising:

receiving a second request message including the MN-AAA key; and

authenticating the Mobile Node using the MN-AAA key.

31. The method as recited in claim 30, further comprising:

storing the MN-AAA key if authentication of the Mobile Node is successful.

32. The method as recited in claim 29, wherein the at least one Mobile IP key further comprises a MN-HA key.

33. The method as recited in claim 32, further comprising:

providing the MN-HA key to the Home Agent, thereby enabling the Home Agent to generate a MHAE during Mobile IP registration.

34. The method as recited in claim 32, wherein the MN-HA key is generated from the MN-AAA key.

35. The method as recited in claim 34, further comprising:

providing the MN-HA key to the Home Agent, thereby enabling the Home Agent to generate a MHAE during Mobile IP registration.

36. A Home Agent supporting Mobile IP and adapted for registering a Mobile Node supporting Mobile IP with the Home Agent, comprising:

means for receiving a bootstrap request from the Mobile Node, the bootstrap request initiating generation of at least one Mobile IP key from authentication information associated with an International Mobile Subscriber Identity;

means for transmitting a bootstrap reply including one or more random numbers to the Mobile Node, thereby enabling the Mobile Node to generate the at least one Mobile IP key from the authentication information associated with the International Mobile Subscriber Identity and the random numbers; and

means for obtaining the at least one Mobile IP key, the at least one Mobile IP key being derived from the authentication information associated with the International Mobile Subscriber Identity and the random numbers.

37. A Home Agent supporting Mobile IP and adapted for registering a Mobile Node supporting Mobile IP with the Home Agent, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a bootstrap request from the Mobile Node, the bootstrap request initiating generation of at least one Mobile IP key from authentication information associated with an International Mobile Subscriber Identity;

transmitting a bootstrap reply including one or more random numbers to the Mobile Node, thereby enabling the Mobile Node to generate the at least one Mobile IP key from the authentication information associated with the International Mobile Subscriber Identity and the random numbers; and

obtaining the at least one Mobile IP key, the at least one Mobile IP key being derived from the authentication information associated with the International Mobile Subscriber Identity and the random numbers.