Kerberized handover keying

• US 20080175393A1
• Filed: 01/10/2008
• Published: 07/24/2008
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: Four Batons Wireless LLC
• Original Assignee: Telcordia Technologies Incorporated (Telefonaktiebolaget LM Ericsson), Toshiba Corporation
• Inventors: DAS, Subir, OBA, Yoshihiro
• Granted Patent: US 8,332,923 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 36/005 involving radio access media independent information, e.g. MIH [Media independent Hand-off]
• CPC Class Codes: H04W 36/12 Reselecting a serving backbone network switching or routing node
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A media-independent handover key management architecture is disclosed that uses Kerberos for secure key distribution among a server, an authenticator, and a mobile node. In the preferred embodiments, signaling for key distribution is based on re-keying and is decoupled from re-authentication that requires EAP (Extensible Authentication Protocol) and AAA (Authentication, Authorization and Accounting) signaling similar to initial network access authentication. In this framework, the mobile node is able to obtain master session keys required for dynamically establishing the security associations with a set of authenticators without communicating with them before handover. By separating re-key operation from re-authentication, the proposed architecture is more optimized for a proactive mode of operation. It can also be optimized for reactive mode of operation by reversing the key distribution roles between the mobile node and the target access node.

Claims

1. A method for media-independent handover key management for secure key distribution among a server, an authenticator and a mobile node employing Kerberized Handover Keying, comprising:

a) having a mobile node transmit an AS-REQ to a Key Distribution Center, and having the mobile node receive an AS-REP from the Key Distribution Center with a Ticket Granting Ticket (TGT);

b) having the mobile node discover at least one authenticator;

c) having the mobile node transmit a TGS-REQ to said Key Distribution Center, and having the mobile node receive a TGS-REP from the Key Distribution Center to obtain a ticket (T) for said at least one authenticator;

d) during handover to a target authenticator of said at least one authenticator, having the mobile node transmit an AP-REQ to the target authenticator.

2. The method of claim 1, further including establishing a secure association between the mobile node and the target authenticator using the ticket (T).

3. The method of claim 1, further including after having the mobile node transmit an AP-REQ to the target authenticator having the target authenticator transmit an AP-REP message to the mobile node.

4. The method of claim of claim 1, further including after said step d), having the mobile node exchange at least one KRB-SAFE message or link-layer specific SAP messages with the target authenticator to establish a link-layer security association between the mobile node and the authenticator.

5. The method of claim 1, wherein said step of having the mobile node discover at least one authenticator includes having said mobile node employ I.E.E.E. 802.21 Information Service discovery mechanisms.

6. The method of claim 1, further including having authorization information embedded in ticket authorization data such that the target authenticator performs access control without AAA signaling after handover for authorization.

7. The method of claim 1, further including performing the following authorization method:

a) having a node that implements the Key Distribution Center also implement an AAA client that communicates with an MA server for authorization purposes; and

b) having said AAA client obtain authorization information from the AAA server using an AAA protocol and return the obtained information to the Key Distribution Center.

8. The method of claim 7, further including having the Key Distribution Center indirectly pass the authorization information to the target authenticator via the mobile node in a proactive mode.

9. The method of claim 1, further including establishing inter-realm keys for different Kerberos realms, such that said mobile node is able to obtain a Ticket Granting Ticket for a remote Kerberos realm'"'"'s ticket granting service from a local Kerberos realm.

10. The method of claim 9, further including pre-establishing Kerberos cross-realm keys between plural MA domains, such that when said mobile node moves from an initial authenticator to a target authenticator across MA domains, the mobile node acquires a cross-realm Ticket Granting Ticket valid for a remote Key Distribution Center in a visited target AAA domain by contacting a local Key Distribution Center in a home MA domain.

11. The method of claim 8, further including having one or more intermediate realms between the local realm and the remote realm, and the mobile node iterating the Ticket Granting Ticket procedure along an authentication path between the realms.

12. The method of claim 9, further including having cross-realm operation within a single MA domain, wherein there are one or more intermediate realms between a local realm and a remote realm in the same MA domain, and the mobile node iterates the Ticket Granting Ticket procedure along the authentication path between the realms, and wherein the authentication path is constructed based on a DNS domain hierarchy to facilitate traversal of the authentication path.

13. A media-independent handover key management architecture for secure key distribution among a server, an authenticator and a mobile node, comprising:

a) a mobile node having an EAP peer that is configured to communicate with an EAP server;

b) said mobile node further having a Kerberos client or server that is configured to communicate with at least one authenticator for at least one target network that has a respective Kerberos client or server; and

c) said mobile node being configured to perform security signaling during handover to said at least one target network via said at least one authenticator, including network access authentication and key management signaling to obtain master session keys using Kerberos to dynamically establish a security association via said at least one authenticator without re-authentication using EAP and AAA signaling.

14. The media-independent handover key management architecture of claim 13, wherein said mobile node has a Kerberos client.

15. The media-independent handover key management architecture of claim 13, wherein said at least one authenticator includes a plurality of authenticators and said mobile node is configured to proactively obtain per-authenticator keys for said plurality of authenticators.

16. The media-independent handover key management architecture of claim 13, wherein said plurality of authenticators includes at least one access point or base station.

17. A method for media-independent handover key management for secure key distribution among a server, an authenticator and a mobile node, comprising:

a) having a mobile node obtain the identity of a Key Distribution Center and a secret key shared with an Application Server during initial network access authentication via bootstapping Kerberos from network access authentication credentials using an EAP method; and

b) having said mobile node establish security associations with a set of authenticators using Kerberos prior to handover.

18. The method of claim 17, further including having said mobile node include a Kerberos client that communicates with respective Kerberos servers of said authenticators.

19. The method of claim 17, further including delivering a Ticket Granting Ticket to an authenticator prior to handover of the mobile node thereto.

20. The method of claim 17, further including having the authenticator not create a state for the mobile node before handover.

21. The method of claim 17, wherein for said bootstrapping, an EAP server and the Key Distribution Center are implemented on the same node using a same identifier for the EAP server identity and the Key Distribution Center.