MEDIA INDEPENDENT HANDOVER PROTOCOL SECURITY

• US 20100281249A1
• Filed: 05/03/2010
• Published: 11/04/2010
• Est. Priority Date: 05/03/2009
• Status: Active Grant

• Current Assignee: Four Batons Wireless LLC
• Original Assignee: Telcordia Technologies Incorporated (Telefonaktiebolaget LM Ericsson), Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Oba, Yoshihiro, Das, Subir, Dutta, Ashutosh
• Granted Patent: US 8,341,395 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 36/005 involving radio access media independent information, e.g. MIH [Media independent Hand-off]
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

An apparatus for providing security to media independent handover service includes a point of service for providing the media independent handover services including an independent authenticator. The independent authenticator authenticates candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks, where each of the serving access networks and the candidate access networks belong to a plurality of heterogeneous access networks having the specific serving media. An access controller applies an access control through an access authentication with the point of service providing the media independent handover services through an authentication server, in which when the access authentication is established between the point of service and the authentication server, the mobile devices are authorized to access the media independent handover services through the point of service for the mobile devices attached between heterogeneous media.

Claims

1. An apparatus having a computer implemented protocol for providing security to media independent handover services, comprising:

a point of service for providing the media independent handover services that includes an independent authenticator, said independent authenticator to authenticate candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks, each of said serving access networks and said candidate access networks belong to a plurality of heterogeneous access networks having the specific serving media; and

an access controller to apply an access control through an access authentication with said point of service providing the media independent handover services through an authentication server;

wherein when the access authentication is established between the point of service and the authentication server, said mobile devices are authorized to access said media independent handover services through said point of service for the mobile devices attached between heterogeneous media.

2. The apparatus as set forth in claim 1, wherein:

said access authentication includes a key establishment protocol for establishing keys between mobile devices and said authentication server; and

at least one key is delivered to the point of service for deriving a session key to protect media independent handover messages transmitted between the point of service and the mobile devices.

3. The apparatus as set forth in claim 2, comprises:

a transport layer security (TLS) for the access authentication and the key establishment protocol is employed to carry out a TLS handshake between the point of service and the mobile devices over media independent handover protocol,

wherein said TLS handshake establishes a security association or secure session between the peers (mobile devices and the Point of Service) to protect messages of said media independent handover protocol.

4. The apparatus as set forth in claim 3, wherein:

the security association or secure session is bound to the peers (mobile device and Point of Service) within the media independent handover protocol in that said media independent handover messages are not encapsulated when said transport level security is added.

5. The apparatus as set forth in claim 1, wherein:

said media independent handover services for authenticating the mobile devices and the serving access networks and candidate access networks having the same said authentication server.

6. The apparatus as set forth in claim 5, wherein:

a media independent handover keying material is bootstrapped from a keying material that is established during a proactive authentication for network access, said proactive authentication comprising authenticating said candidate access networks prior to the network access for the handover of the mobile devices from said serving access networks to the candidate access networks.

7. The apparatus as set forth in claim 1, wherein:

said media independent handover services for authenticating the mobile devices and the serving access networks and candidate access networks having different authentication servers.

8. The apparatus as set forth in claim 7, wherein:

a media independent handover keying material is bootstrapped from a keying material that is established during a proactive authentication for said media independent handover services, said proactive authentication comprising authenticating said candidate access networks prior to the handover of the mobile devices from said serving access networks to the candidate access networks.

9. The apparatus as set forth in claim 1, wherein:

the authentication server is an extensible authentication protocol (EAP) server.

10. The apparatus as set forth in claim 1, wherein:

the authentication server is an authentication, authorization and accounting (AAA) server.

11. The apparatus as set forth in claim 1, wherein:

said independent authenticator being a single point of service for managing bilateral communication among each of the plurality of heterogeneous access networks via an interface.

12. An apparatus having a computer implemented protocol for providing security to media independent handover services, comprising:

a point of service for providing media independent handover services that includes an independent authenticator, said independent authenticator to authenticate candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks, each of said serving access networks and said candidate access networks belong to a plurality of heterogeneous access networks having the specific serving media,

wherein said point of service and said mobile devices conduct a mutual authentication and a key establishment.

13. The apparatus as set forth in claim 12, wherein:

said mobile devices and said point of service conduct said mutual authentication and said key establishment of specific keys to assuredly provide an identity of the mobile devices to the point of service or vice versa residing in the network; and

said specific keys bind a pair of said identity to protect media independent handover messages.

14. The apparatus as set forth in claim 13, comprises:

a transport layer security (TLS) for the mutual authentication and the key establishment is employed to carry out a TLS handshake between the point of service and the mobile devices over media independent handover protocol,

wherein said TLS handshake establishes a security association or a secure session between the peer mobile devices to protect messages of said media independent handover protocol.

15. The apparatus as set forth in claim 14, wherein:

the security association or secure session is bound to the peers (mobile device and Point of service) within the media independent handover protocol in that said media independent handover messages are not encapsulated when the transport level security is added.

16. The apparatus as set forth in claim 13, wherein:

said mutual authentication may be based on a pre-shared key or a trusted third party.

17. The apparatus as set forth in claim 16, wherein:

said trusted third party is a certificate authority.

18. A system for providing security to media independent handover services, comprising:

a point of service having media independent access functions;

a plurality of heterogeneous networks each having media specific access functions, said plurality of heterogeneous networks include serving access networks and candidate access networks;

mobile devices connected to said plurality of heterogeneous networks, said point of service to authenticate said candidate access networks prior to the handover of the mobile devices from the serving access networks to the candidate access networks;

an authentication server; and

an access controller to apply an access control through an access authentication with said point of service providing the media independent handover services through said authentication server;

wherein when the access authentication is established between the point of service and the authentication server, said mobile devices are authorized to access said media independent handover services through said point of service for the mobile devices attached between heterogeneous media.

19. The system as set forth in claim 18, wherein:

said access authentication includes a key establishment protocol for establishing keys between mobile devices and said authentication server; and

at least one key is delivered to the point of service for deriving a session key to protect media independent handover messages transmitted between the point of service and the mobile devices.

20. The system as set forth in claim 19, comprises:

a transport layer security (TLS) for the access authentication and the key establishment protocol is employed to carry out a TLS handshake between the point of service and the mobile devices over media independent handover protocol,

wherein said TLS handshake establishes a security association or a secure session between the peers (mobile device and Point of Service) to protect messages of said media independent handover protocol.

21. The system as set forth in claim 20, wherein:

the security association or secure session is bound to the peers within the media independent handover protocol in that said media independent handover messages are not encapsulated when the transport level security is added.

22. The system as set forth in claim 18, wherein:

said media independent handover services for authenticating the mobile devices and the serving access networks and candidate access networks having the same said authentication server.

23. The system as set forth in claim 22, wherein:

a media independent handover keying material is bootstrapped from a keying material that is established during a proactive authentication for network access, said proactive authentication comprising authenticating said candidate access networks prior to the network access for the handover of the mobile devices from said serving access networks to the candidate access networks.

24. The system as set forth in claim 18, wherein:

said media independent handover services for authenticating the mobile devices and the serving access networks and candidate access networks having different authentication servers.

25. The system as set forth in claim 24, wherein:

a media independent handover keying material is bootstrapped from a keying material that is established during a proactive authentication for said media independent handover services, said proactive authentication comprising authenticating said candidate access networks prior to the handover of the mobile devices from said serving access networks to the candidate access networks.

26. A system for providing security to media independent handover services, comprising:

a point of service having media independent access functions;

a plurality of heterogeneous networks each having media specific access functions, said plurality of heterogeneous networks include serving access networks and candidate access networks; and

mobile devices connected to said plurality of heterogeneous networks, said point of service to authenticate said candidate access networks prior to the handover of the mobile devices from the serving access networks to the candidate access networks,

wherein said point of service and said mobile devices conduct a mutual authentication and a key establishment.

27. The system as set forth in claim 26, wherein:

said mobile devices and said point of service conduct said mutual authentication and said key establishment of specific keys to assuredly provide an identity of the mobile devices to the point of service or vice versa residing in the network; and

said specific keys bind a pair of said identity to protect media independent handover messages.

28. The apparatus as set forth in claim 27 comprises:

a transport layer security (TLS) for the mutual authentication and the key establishment is employed to carry out a TLS handshake between the point of service and the mobile devices over media independent handover protocol, wherein said TLS handshake establishes a security association or a secure session between the peers (mobile device and point of service) to protect messages of said media independent handover protocol.

29. The apparatus as set forth in claim 27, wherein:

said mutual authentication may be based on a pre-shared key or a trusted third party, said trusted third party being a certificate authority.

30. An article of manufacture, comprising:

a machine-accessible medium having instructions encoded thereon for enabling a processor to execute an operation for providing security to media independent handover services, comprising the steps of;

providing the media independent handover services that includes an independent authenticator, said independent authenticator to authenticate candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks, each of said serving access networks and said candidate access networks belong to a plurality of heterogeneous access networks having the specific serving media; and

applying an access control through an access authentication with a point of service providing the media independent handover services through an authentication server; and

establishing between the point of service and the authentication server the access authentication so that the mobile devices are authorized to access the media independent handover services through the point of service for the mobile devices attached between heterogeneous media.