METHOD AND APPARATUS FOR PROVIDING BOOTSTRAPPING PROCEDURES IN A COMMUNICATION NETWORK

• US 20160197922A1
• Filed: 03/15/2016
• Published: 07/07/2016
• Est. Priority Date: 02/11/2005
• Status: Active Grant

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: LAITINEN, Pekka, GINZBOORG, Philip, ASOKAN, Nadarajah, BAJKO, Gabor
• Granted Patent: US 9,906,528 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An approach is provided for performing authentication in a communication system. In one embodiment, a key is established with a terminal in a communication network according to a key agreement protocol. The agreed key is tied to an authentication procedure to provide a security association that supports reuse of the key. A master key is generated based on the agreed key. In another embodiment, digest authentication is combined with key exchange parameters (e.g., Diffie-Hellman parameters) in the payload of the digest message, in which a key (e.g., SMEKEY or MN-AAA) is utilized as a password. In yet another embodiment, an authentication algorithm (e.g., Cellular Authentication and Voice Encryption (CAVE)) is employed with a key agreement protocol with conversion functions to support bootstrapping.

Claims

1. A method comprising:

generating a message for authenticating communication with a network element configured to perform bootstrapping;

setting a password field of the message to a function of a secret key; and

specifying key establishment information within a payload of the message, wherein the message is transmitted according to a transport protocol for accessing information over a data network.

2. A method according to claim 1, wherein the transport protocol includes a hypertext transfer protocol.

3. A method according to claim 1, wherein the key establishment information includes Diffie-Hellman parameters.

4. A method according to claim 1, further comprising:

setting a username field of the message to an identifier of a terminal.

5. A method according to claim 1, wherein the function of the secret key is a checksum or a digest.

6. A method according to claim 1, wherein the secret key is a signaling message encryption key (SMEKEY) or a mobile node authentication, authorization and accounting (MN-AAA) key.

7. A method according to claim 1, further comprising:

communicating with a base station using spread spectrum via a transceiver, wherein the base station manages the communications between the transceiver and the network element.

8. A method comprising:

receiving a message from a terminal, according to a transport protocol for accessing information over a data network, requesting authentication, wherein the message includes a password field that is a function of a secret key and a payload containing key establishment information specifying parameters for determining another secret key; and

generating a master key based on the secret keys.

9. A method according to claim 8, wherein the transport protocol includes a hypertext transfer protocol.

10. A method according to claim 8, wherein the key establishment information includes Diffie-Hellman parameters.

11. A method according to claim 8, wherein the message includes a username field for specifying an identifier of a terminal.

12. A method according to claim 8, wherein the function of the secret key is a checksum or a digest.

13. A method according to claim 8, wherein the secret key is a signaling message encryption key (SMEKEY) or a mobile node authentication, authorization and accounting (MN-AAA) key.

14. An apparatus comprising:

an authentication module configured to generate a message for authenticating communication with a network element configured to perform bootstrapping, and to set a password field of the message to be a function of a secret key, the message having a payload that includes new key establishment information, wherein the message is transmitted according to a transport protocol for accessing information over a data network.

15. An apparatus according to claim 14, wherein the transport protocol includes a hypertext transfer protocol that supports secure communications over the data network.

16. An apparatus according to claim 14, wherein the key establishment information includes Diffie-Hellman parameters.

17. An apparatus according to claim 14, wherein the authentication module is further configured to set a username field of the message to an identifier of a terminal.

18. An apparatus according to claim 14, wherein the function of the secret key is a checksum or a digest.

19. An apparatus according to claim 14, wherein the secret key is a signaling message encryption key (SMEKEY) or a mobile node authentication, authorization and accounting (MN-AAA) key.

20. An apparatus according to claim 14, further comprising:

a transceiver configured to communicate with a base station using spread spectrum, wherein the authentication module is further configured to perform bootstrapping according to a generic authentication architecture.