AUTHENTICATION METHOD AND APPARATUS FOR USER EQUIPMENT AND LIPA NETWORK ENTITIES

• US 20130091552A1
• Filed: 07/03/2012
• Published: 04/11/2013
• Est. Priority Date: 10/06/2011
• Status: Active Grant

• Current Assignee: Industrial Technology Research Institute
• Original Assignee: Industrial Technology Research Institute
• Inventors: Cheng, Ching-Wen, Yang, Shun-Ren, Lin, Yung-Chun, Wu, Jia-Wei
• Granted Patent: US 9,137,661 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 8/06 Registration at serving network Location Register, VLR or user mobility server

Abstract

An authentication method for user equipment (UE) and LIPA network entities is applicable to a cross-LIPA communication environment having an UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H). The UE end successfully registers to a core network (CN) via the LIPA_V, thereby attaining mutual trust relationship between the UE end and the LIPA_V. The UE end successfully registers to the CN via the LIPA_H, thereby attaining mutual trust relationship between the UE end and the LIPA_H. The LIPA_H requests the UE end via the LIPA_V for successfully re-authenticating the CN, thereby attaining mutual trust relationship between the LIPA_V and the LIPA_H.

Claims

1. An authentication method for local internet protocol access (LIPA) network entity and user equipment (UE), adapted to a cross-LIPA communication situation getting involved with a UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H), and comprising:

successfully registering to a CN by said UE end via said LIPA_V, to attain mutual trust relationship of said UE end and said LIPA_V;

successfully registering to said CN by said UE end via said LIPA_H, to attain mutual trust relationship of said UE end and said LIPA_H; and

requesting said UE end by said LIPA_H for re-authentication and successfully re-authenticating said UE end via said LIPA_V, to attain mutual trust relationship of said LIPA_V and said LIPA_H.

2. The authentication method as claimed in claim 1, wherein said UE end represents one or more UEs, said LIPA_V represents one or more visiting LIPA network entities, said LIPA_H represents one or more home LIPA network entities.

3. The authentication method as claimed in claim 1, wherein a three-way mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by a user end triggered authentication procedure.

4. The authentication method as claimed in claim 1, wherein a three-way mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by an authentication procedure which is triggered by a simplified routing area update (RAU) procedure.

5. The authentication method as claimed in claim 1, wherein a three-way mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by an authentication procedure which is triggered by a RAU procedure in addition with a serving radio network subsystem (SRNS) relocation procedure.

6. The authentication method as claimed in claim 3, wherein said user end triggered authentication procedure comprises:

sending a specific message to said LIPA_H by said LIPA_V to trigger said UE end to authenticate to said CN with said LIPA_V and said LIPA_H being involved, and said LIPA_H forwarding said specific message to said CN, to enable said CN to authenticate said UE end;

in an existing universal mobile telecommunications system authentication and key agreement procedure, adding forwarding functions to said LIPA_H and said LIPA_V, including sending a user authentication request message by said LIPA_V, forwarding a user authentication request message by said LIPA_H, and forwarding a user authentication response message by said LIPA_V; and

in an existing security mode control procedure, adding another forwarding functions to said LIPA_H and said LIPA_V, including forwarding a security mode command message by said LIPA_H, and forwarding a security mode completion message by said LIPA_V.

7. The authentication method as claimed in claim 4, wherein said authentication procedure triggered by said simplified RAU procedure comprises:

sending a specific message of a RAU request by said LIPA_V to said LIPA_H, to trigger said UE end to authenticate to said CN end with said LIPA_V and said LIPA_H being involved, forwarding said specific message of the RAU request to said CN by said LIPA_H, and verifying the content information of said specific message by said CN;

in an existing universal mobile telecommunications system authentication and key agreement procedure, adding forwarding functions to said LIPA_H and said LIPA_V, including forwarding a user authentication request message by said LIPA_H, forwarding a user authentication response message to said LIPA_H by said LIPA_V, and forwarding a user authentication response message to said CN by said LIPA_H;

in an existing security mode control procedure, adding another forwarding functions to said LIPA_H and said LIPA_V, including forwarding a security mode command message by said LIPA_H, and forwarding a security mode completion message by said LIPA_V; and

sending a RAU response to said LIPA_H by said CN, and forwarding said RAU response to said LIPA_V by said LIPA_H to complete said simplified RAU procedure.

8. The authentication method as claimed in claim 5, wherein said authentication procedure triggered by said RAU procedure with said SRNS relocation procedure comprises:

sending a specific message of a RAU request to said LIPA_H by said LIPAv to trigger said UE end to authenticate to said CN with said LIPA_V and said LIPA_H being involved, forwarding said specific message to said CN by said LIPA_H, and verifying information content of said specific message by said CN;

performing an SRNS relocation procedure, including requesting said LIPA_V for the communication service data of said UE end kept in said LIPA_V by said CN, sending to said CN said communication service data of said UE end kept in said LIPA_V by said LIPA_V, and requesting said LIPA_H by said CN to prepare corresponding communication service resources;

performing a security procedure by said UE end, said LIPA_V, said LIPA_H, and said CN for key generation, exchange, and storage; and

performing exchanging communication service data of said UE end between said LIPA_V and said LIPA_H, then forwarding a RAU response message to said LIPA_V by said LIPA_H to complete said RAU procedure.

9. The authentication method as claimed in claim 7, wherein said RAU request at least contains a temporary UE ID, a valid location of said temporary UE ID, and a verification code of said temporary UE ID, said RAU response at least contains an updated UE ID, a valid location information of said updated UE ID, and a verification code for determining the legitimacy and the authenticity of said updated UE ID.

10. An authentication apparatus for local internet protocol access (LIPA) network entity and user equipment (UE), adapted to a cross-LIPA communication situation getting involved with a UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H), and comprising a state machine, wherein said state machine further includes:

a first sub-state machine configured to represent an authentication and communication protocol mechanism between said UE end and said LIPA_V, wherein said UE end performs a successful registration to a CN via said LIPA_V, to attain mutual trust relationship of said UE end and said LIPA_V;

a second sub-state machine configured to represent an authentication and communication protocol mechanism between said UE end and said LIPA_H, wherein said UE end performs a successful registration to said CN via said LIPA_H, to attain mutual trust relationship of said UE end and said LIPA_H; and

a third sub-state machine configured to represent a re-authentication and communication protocol mechanism between LIPA network entities, wherein said LIPA_H successfully requests and re-authenticates said UE with said LIPA_V being involved, to attain mutual trust relationship of said LIPA_V and said LIPA_H.

11. The authentication apparatus as claimed in claim 10, wherein said UE end represents one or more UEs, said LIPA_V represents one or more visiting LIPA network entities, said LIPA_H represents one or more home LIPA network entities.

12. The authentication apparatus as claimed in claim 10, wherein said state machine performs a three-way mutual authentication of said UE end, said LIPA_V, and said LIPA_H, based on a one time authentication to said CN and said LIPA_H via said LIPA_V.

13. The authentication apparatus as claimed in claim 12, wherein said third sub-state machine triggers a re-authentication request to said UE end by a user authentication request message.

14. The authentication apparatus as claimed in claim 12, wherein said third sub-state machine triggers a re-authentication request to said UE end by a RAU request message.

15. The authentication apparatus as claimed in claim 12, wherein said third sub-state machine triggers a re-authentication request to said UE end by a RAU request message in addition with a serving radio network subsystem (SRNS) relocation procedure.

16. The authentication apparatus as claimed in claim 14, wherein said RAU request message at least contains a temporary UE ID, a valid location of said temporary UE ID, and a verification code of said temporary UE ID.

17. The authentication apparatus as claimed in claim 15, wherein said third sub-state machine performs said SRNS relocation procedure, including requesting said LIPA_V for the communications service data of said UE end kept in said LIPA_V by said CN, transmitting to said CN the communications service data of said UE end kept in said LIPA_V by said LIPA_V, and requesting said LIPA_H by said CN to prepare corresponding communication service resources.

18. The authentication apparatus as claimed in claim 14, wherein said third sub-state machine further performs:

forwarding a RAU response message to said LIPA_V by said LIPA_H to complete a RAU procedure.

19. The authentication apparatus as claimed in claim 15, wherein said third sub-state machine further performs:

forwarding a RAU response message to said LIPA_V by said LIPA_H to complete a RAU procedure.