AUTHENTICATING NETWORK ELEMENTS IN A COMMUNICATION SYSTEM

• US 20120230488A1
• Filed: 03/13/2011
• Published: 09/13/2012
• Est. Priority Date: 03/13/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: De Los Reyes, Gustavo
• Granted Patent: US 8,559,636 B2
• Time in Patent Office: Days
• US Class Current: 380/247
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A system that incorporates teachings of the present disclosure may include, for example, a computer-readable storage medium in a communication device having computer instructions to establish communications with a cellular base station, generate a message request, and transmit to an authentication device by way of the cellular base station the message request. The computer-readable storage medium can also have computer instructions to receive from the authentication device by way of the cellular base station a message response, authenticate the message response, and determine from the authenticated message response whether the cellular base station is an approved network element of a cellular communication system. Other embodiments are disclosed.

Claims

1. A communication device, comprising a wireless transceiver coupled to a processor, the processor operable to:

establish communications with a wireless base station;

generate an encrypted message request;

transmit to a server by way of the wireless base station the encrypted message request;

receive from the server by way of the wireless base station an encrypted message response;

decrypt the encrypted message response; and

determine that the wireless base station is an approved network element of a communication system providing communication services to the communication device based on at least two conditions comprising information included in the decrypted message response and an ability of the wireless base station to deliver to the communication device the encrypted message response transmitted by the server.

2. The communication device of claim 1, wherein the controller is operable to generate the encrypted message request with a first private key stored in the communication device, and wherein the encrypted message request is transmitted to the server to cause the server to generate the encrypted message response with a second private key stored in the server, and to cause the server to transmit the encrypted message response to the communication device by way of the wireless base station.

3. The communication device of claim 1, wherein the controller is operable to:

establish communications with a second wireless base station;

generate a second encrypted message request;

transmit the second encrypted message request to the server by way of the second wireless base station;

detect a communication fault based on a failure to receive from the server by way of the second wireless base station an expected second encrypted message response; and

determine from the communication fault that the second wireless base station is not an approved network element of the communication system.

4. The communication device of claim 3, wherein the controller is operable to detect that the second wireless base station is operated by a law enforcement agency.

5. The communication device of claim 4, wherein the controller is operable to detect that the second wireless base station is operated by the law enforcement agency responsive to receiving an encrypted law enforcement message from the second wireless base station.

6. The communication device of claim 4, wherein the controller is operable to maintain communications with the second wireless base station responsive to detecting that the second wireless base station is operated by the law enforcement agency.

7. The communication device of claim 3, wherein the controller is operable to detect that the second wireless base station is not operated by a legitimate party after at least one attempt to prompt the server to transmit to the communication device the expected second encrypted message response.

8. The communication device of claim 7, wherein the controller is operable to:

establish communications with a third wireless base station responsive to detecting that the second wireless base station is not operated by a legitimate party;

validate that the third wireless base station is an approved network element of the communication system by receiving by way of the third wireless base station a third encrypted message from the server;

transmit a notice to the server that the second wireless base station is not a valid network element of the communication system.

9. The communication device of claim 1, wherein the controller is operable to transmit to the server by way of the wireless base station a first public key associated with the communication device.

10. The communication device of claim 9, wherein the controller is operable to receive from the server by way of the wireless base station a second public key associated with the server.

11. The communication device of claim 10, wherein the controller is operable to encrypt the message request with the second public key of the server and sign the encrypted message request with a first private key associated with the communication device, and wherein the server is operable to encrypt the message response with the first public key of the communication device and sign the encrypted message response with a second private key associated with the server.

12. The communication device of claim 10, wherein the controller is operable to decrypt the encrypted message response with the first private key of the communication device and decrypt the signature of the server with the second public key of the server, and wherein the server is operable to decrypt the encrypted message request with the second private key of the server and decrypt the signature of the communication device with the first public key of the communication device.

13. The communication device of claim 1, wherein the communication device is a cellular telephone, wherein the wireless base station is a cellular base station, and wherein the communication system is one of a cellular communication network and an internet protocol multimedia subsystem communication network.

14. A computer-readable storage medium in a communication device, comprising computer instructions to:

establish communications with a cellular base station;

generate a message request;

transmit to an authentication device by way of the cellular base station the message request, wherein the authentication device is communicatively coupled to the cellular base station, and wherein the authentication device is remotely located from the cellular base station;

receive from the authentication device by way of the cellular base station a message response;

authenticate the message response; and

determine from the authenticated message response whether the cellular base station is an approved network element of a cellular communication system.

15. The computer-readable storage medium of claim 14, comprising computer instructions to:

receive a request to initiate a communication session with a second communication device; and

perform one of;

transmit a call origination request to the cellular base station to initiate the communication session with the second communication device upon determining from the authenticated message response that the cellular base station is an approved network element of the cellular communication system;

reject the request to initiate the communication session with the second communication device upon determining from the authenticated message response that the cellular base station is not an approved network element of the cellular communication system; and

transmit the call origination request to a second cellular base station authenticated by the communication device, wherein the communication device establishes communications with the second cellular base station responsive to determining from the authenticated message response that the cellular base station is not an approved network element of the cellular communication system.

16. The computer-readable storage medium of claim 14, wherein the message request and message response are encrypted messages, and wherein the computer-readable storage medium comprises one of a subscriber identity module and re-usable identification module.

17. An authentication device, comprising a memory coupled to a controller, the controller operable to:

receive by way of a cellular base station a message request from a communication device;

generate a message response; and

transmit to the communication device by way of the cellular base station the message response to enable the communication device to determine whether the cellular base station is an approved network element of a cellular communication system.

18. The authentication device of claim 17, wherein the message request and message response are encrypted messages.

19. The authentication device of claim 17, wherein the controller is operable to receive a message alert from the communication device identifying the wireless base station as an unapproved network element of the cellular communication system responsive to the communication device failing to receive by way of the cellular base station the message response transmitted by the authentication device.

20. The authentication device of claim 19, wherein the controller is operable to receive the message alert from one of the cellular base station and a second cellular base station communicatively, and wherein the communication device establishes communications with the second cellular base station upon the communication device determining that the wireless base station is an unapproved network element of the cellular communication system.