User equipment credential system

• US 20080016230A1
• Filed: 06/28/2007
• Published: 01/17/2008
• Est. Priority Date: 07/06/2006
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Laitinen, Pekka, Holtmanns, Silke
• Granted Patent: US 9,485,232 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A user equipment in a communications system, the user equipment comprising: a memory arranged to store at least one identifier associated with the user equipment; a transceiver arranged to communicate with a node in the communication system, wherein the transceiver is arranged to receive the at least one identifier from the node in the communications system, wherein the at least one identifier is used by the user equipment to authenticate the user equipment to at least one further node in the communications system.

Claims

1. A user equipment, comprising:

a memory arranged to store at least one identifier associated with the user equipment in a communications system; and

a transceiver arranged to communicate with a node in a communication system, wherein the transceiver is arranged to receive the at least one identifier from the node in the communications system,

wherein the at least one identifier is used by the user equipment to authenticate the user equipment to at least one further node in the communications system.

2. The user equipment as claimed in claim 1, wherein the at least one identifier comprises a first identifier, wherein the first identifier is a publicly known identifier.

3. The user equipment as claimed in claim 2, wherein the first identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address and a caller line identification value.

4. The user equipment as claimed in claim 2, wherein the at least one identifier comprises a second identifier, wherein the second identifier is a private identifier known to the user equipment and node only.

5. The user equipment as claimed in claim 4, wherein the second identifier is at least one of a password value and a private cryptographic key.

6. The user equipment as claimed in claim 5, wherein the transceiver is arranged to transmit the first identifier to the further node to initiate the authentication of the user equipment at the further node.

7. The user equipment as claimed in claim 6, wherein the transceiver is arranged to receive an authentication message from the further node.

8. The user equipment as claimed in claim 7, wherein the user equipment further comprises a processor, the processor being arranged to process the authentication message.

9. The user equipment as claimed in claim 8, wherein the processor is arranged to generate a cryptographic key for encrypting communications between the user equipment and the further node in dependence on the processed authentication message and the second identifier.

10. The user equipment as claimed in claim 8, wherein the processor is arranged to generate a cryptographic key for encrypting communications between the user equipment and further node in dependence on the processed authentication message and a result of a one way function of the second identifier.

11. A method, comprising:

receiving at a user equipment from a node in a communications system at least one identifier associated with the user equipment for authenticating the user equipment in a communications system;

storing at the user equipment the at least one identifier; and

using, by the user equipment, the at least one identifier to authenticate the user equipment to at least one further node in the communications system.

12. The method as claimed in claim 11, wherein the at least one identifier comprises a first identifier, wherein the first identifier is a publicly known identifier.

13. A method as claimed in claim 12, wherein the first identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address and a caller line identification value.

14. The method as claimed in claim 12, wherein the at least one identifier comprises a second identifier, wherein the second identifier is a private identifier known to the user equipment and node only.

15. The method as claimed in claim 14, wherein the second identifier is at least one of a password value and a private cryptographic key.

16. The method as claimed in claim 15, further comprising transmitting the first identifier from the user equipment to the further node to initiate the authentication of the user equipment at the further node.

17. The method as claimed in claim 16, further comprising receiving at the user equipment an authentication message from the further node.

18. The method as claimed in claim 17, further comprising processing the authentication message received at the user equipment.

19. The method as claimed in claim 18, further comprising generating a cryptographic key for encrypting communications between the user equipment and further node in dependence on the processed authentication message and the second identifier.

20. The method as claimed in claim 18, further comprising generating a cryptographic key for encrypting communications between the user equipment and further node in dependence on the processed authentication message and a result of a one way function of the second identifier.

21. A computer program embodied on a computer readable medium, the computer program being configured to execute a method for authenticating a user equipment in a communications system, the method comprising:

receiving at a user equipment from a node in the communications system at least one identifier associated with the user equipment;

storing at the user equipment the at least one identifier; and

using, by the user equipment, the at least one identifier to authenticate the user equipment to at least one further node in the communications system.

22. A network, comprising:

a node;

at least one further node; and

at least one user equipment comprising memory arranged to store at least one identifier associated with the user equipment and a transceiver arranged to communicate with the node wherein the transceiver is arranged to receive the at least one identifier from the node,

wherein the at least one identifier is used by the user equipment to authenticate the user equipment to the at least one further node in the network.

23. The network as claimed in claim 22, wherein the at least one identifier comprises a publicly known identifier.

24. The network as claimed in claim 22, wherein the at least one identifier comprises a private identifier known to the user equipment, the node and further node only.

25. The network as claimed in claim 22, wherein the at least one identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address, a caller line identification value, a password value and a private cryptographic key.

26. The network as claimed in claim 22, wherein the node comprises a credential server.

27. The network as claimed in claim 22, wherein the further node comprises at least one of a network application function node and a bootstrapping function node.

28. A node, comprising:

a memory arranged to store at least one identifier associated with a user equipment; and

a transceiver arranged to communicate with the user equipment, wherein the transceiver is arranged to transmit the at least one identifier from the node to the user equipment,

wherein the at least one identifier is used by the user equipment to authenticate the user equipment to at least one further node in the communications system.

29. The node as claimed in claim 28, wherein the at least one identifier comprises a publicly known identifier.

30. The node as claimed in claim 28, wherein the at least one identifier comprises a private identifier known to the user equipment, the node and the further node only.

31. The node as claimed in claim 30, wherein the at least one identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address, a caller line identification value, a password value and a private cryptographic key.

32. The node as claimed in claim 28, wherein the node is a credential server.

33. The node as claimed in claim 28, wherein the further node is at least one of a bootstrapping server and a network application server.

34. A node, comprising:

a memory arranged to store at least one identifier associated with a user equipment providing a bootstrapping function; and

a transceiver arranged to communicate with the user equipment wherein the transceiver is arranged to receive the at least one identifier from the user equipment and wherein the at least one identifier is used by the user equipment to authenticate the user equipment.

35. The node as claimed in claim 34, wherein the at least one identifier comprises at least one of a publicly known identifier.

36. The node as claimed in claim 34, wherein the at least one identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address a caller line identification value a password value and a private cryptographic key.

37. The node as claimed in claim 34, wherein the transceiver is arranged to receive the at least one identifier from the user equipment, and wherein the node is arranged to initiate the authentication of the user equipment on receipt of the at least one identifier.

38. The node as claimed in claim 37, wherein the transceiver is arranged to transmit an authentication message to the user equipment.

39. The node as claimed in claim 38, wherein the node further comprises a processor, wherein the processor is arranged to generate a cryptographic key.

40. The node as claimed in claim 39, wherein the transceiver is arranged to transmit the cryptographic key to an application function server in dependence on a processed authentication message.

41. The node as claimed in claim 40, wherein the cryptographic key is arranged to secure communications between the user equipment and the application function server.

42. The node as claimed in claim 34, wherein the node comprises a bootstrapping function server.

43. A node, comprising:

a memory arranged to store at least one identifier associated with a user equipment providing an application function; and

a transceiver arranged to communicate with a further node to receive the at least one identifier from a further node, wherein the at least one identifier is used to authenticate the user equipment.

44. The node as claimed in claim 43, wherein the at least one identifier comprises at least one publicly known identifier.

45. The node as claimed in claim 43, wherein the at least one identifier is at least one of a user name, a public cryptographic key, an Internet Protocol address, a caller line identification value, a password value and a private cryptographic key.

46. The node as claimed in claim 43, wherein the transceiver is further arranged to communicate with the user equipment to receive at least one further identifier from the user equipment, and wherein the node is arranged to initiate the authentication of the user equipment on receipt of the at least one further identifier.

47. The node as claimed in claim 43, wherein the transceiver is further arranged to transmit an authentication message to the user equipment.

48. The node as claimed in claim 43, wherein the transceiver is further arranged to receive from the further node a cryptographic key.

49. The node as claimed in claim 48, wherein the cryptographic key is arranged to secure communications between the user equipment and the node.

50. The node as claimed in claimed in claim 43, wherein the node comprises a network application server.