AUTHENTICATION IN A WIRELESS COMMUNICATIONS NETWORK

• US 20170223531A1
• Filed: 07/28/2014
• Published: 08/03/2017
• Est. Priority Date: 07/28/2014
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: HEDBERG, Tomas, MESTANOV, Filip, TEYEB, Oumer, NORRMAN, Karl, VIKBERG, Jari
• Application Number:
  US15/329,048
• Publication Number:
  US 20170223531A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/043 using a trusted network node as an anchor
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service

Abstract

A method and apparatus for authenticating a mobile device in a second network when the mobile device is already authenticated in a first network. An authentication device in the first network generates an authentication master key associated with the mobile device using a first nonce generated by the authentication device and a second nonce generated by the mobile device. The generated authentication master key is sent to a second authentication device in the second network, where is usable by the second authentication device to authenticate the mobile device in the second network.

Claims

1. A method of authenticating a mobile device in a second network, the mobile device already being authenticated in a first network, the method comprising, at an authentication device in the first network;

generating an authentication master key associated with the mobile device using a first nonce generated by the authentication device and a second nonce generated by the mobile device;

sending the generated authentication master key to a second authentication device in the second network; and

wherein the generated authentication master key is usable by the second authentication device to authenticate the mobile device in the second network.

2. The method according to claim 1, wherein the authentication master key is a Pairwise Master Key.

3. The method according to claim 1, further comprising:

prior to generating the authentication master key, receiving at the first authentication node a request for the authentication master key, the request including the second nonce generated by the mobile device; and

sending the generated authentication master key to the second authentication device.

4. The method according to claim 1, further comprising, at the mobile device:

receiving from the authentication device in the first network the first nonce;

generating the second nonce;

after generating the authentication master key using the first and second nonces, sending the second nonce to the authentication device in the first network, the second nonce being usable by the authentication device in the first network to generate the authentication master key.

5. The method according to claim 4, wherein the first nonce is received and the second nonce is sent using any of Extensible Authentication Protocol over Local Area Network, EAPOL, and Wireless Network Management, WNM, Notification signalling.

6. The method according to claim 1, further comprising, at the authentication device in the first network:

receiving from the second authentication device a request for the authentication master key;

generating the first nonce;

sending the first nonce towards the mobile device;

receiving from the mobile device the second nonce;

generating the authentication master key using the first and second nonces; and

sending the generated authentication master key to the second authentication device.

7. The method according to claim 1, wherein the first network is a 3GPP network and the second network is a Wireless Local Area Network.

8. The method according to claim 1, wherein the first network is a Wireless Local Area Network and the second network is a 3GPP network.

18. A computer program, comprising computer readable code which, when run on an authentication device, causes the authentication device to perform the method as claimed in claim 1.

19. A computer program, comprising computer readable code which, when run on a mobile device, causes the mobile device to perform the method as claimed in claim 1.

20. A computer program product comprising a non-transitory computer readable medium and a computer program according to claim 18, wherein the computer program is stored on the computer readable medium.

9. A method of authenticating a mobile device in a second network, the mobile device already being authenticated in a first network, the method comprising, at an authentication device in the second network;

receiving a generated authentication master key from a first network authentication device, the authentication master key having been generated using a first nonce generated by the first network authentication device and a second nonce generated by the mobile device;

using the generated authentication master key to authenticate the mobile device in the second network.

10. The method according to claim 9, wherein the authentication master key is a Pairwise Master Key.

11. The method according to claim 9, further comprising:

prior to receiving the generated authentication master key, sending to the first network authentication device a request for the authentication master key.

12. A device arranged to generate an authentication master key for authenticating a mobile device in a second network, the mobile device already being authenticated in a first network, the device comprising:

a processor arranged to generate the authentication master key associated with the mobile device using a first nonce generated by an authentication device in the first network, and a second nonce generated by the mobile device; and

13. The device according to claim 12, wherein the device is an authentication device in the first network, the authentication device comprising:

a receiver arranged to receive a request for the authentication master key, the request including the second nonce generated by the mobile device; and

a transmitter arranged to send the generated authentication master key to a second authentication device.

14. The device according to claim 12, wherein the device is the mobile device, the mobile device comprising:

a receiver arranged to receive from the authentication device in the first network the first nonce;

wherein the processor is further arranged to generate the second nonce; and

the transmitter is arranged to send the second nonce towards the authentication device in the first network, the second nonce being usable by the authentication device in the first network to generate the authentication master key.

15. The device according to claim 14, wherein the receiver and transmitter are arranged to receive and send signalling using any of Extensible Authentication Protocol over Local Area Network, EAPOL, and Wireless Network Management, WNM, Notification signalling.

16. The device according to claim 12, wherein the device is an authentication device in the first network, the authentication device comprising:

a receiver arranged to receive from the second authentication device a request for the authentication master key;

wherein the processor is arranged to generate the first nonce;

the transmitter is arranged to send the first nonce towards the mobile device;

the receiver is arranged to receive from the mobile device the second nonce;

the processor is arranged to generate the authentication master key using the first and second nonces; and

the transmitter is arranged to send the generated authentication master key to the second authentication device.

17. The device according to claim 12, wherein the authentication master key is a Pairwise Master Key.