SIM based authentication mechanism for DHCPv4/v6 messages

• US 6,704,789 B1
• Filed: 05/03/2000
• Issued: 03/09/2004
• Est. Priority Date: 05/03/1999
• Status: Expired due to Term

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Ala-Laurila, Juha, Asokan, Nadarajah, Flykt, Patrik
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Halim, Sahera
• Application Number:
  US09/564,635
• Time in Patent Office: 1,406 Days
• Field of Search: 713/201, 713/202, 709/230, 709/219, 709/231
• US Class Current: 709/230
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The invention is a method of providing a user (12) a terminal network address (14) in a first network (16) through which the user communicates with a data network (18) and authenticating connection of the user to the first network. The invention includes transmitting to at least one server in the first network a request to obtain the terminal network address in the first network to provide connection of the user to the data network and an identification of the user in a second network (20) through which the user communicates to the first network; transmitting the identification of the user to the second network; transmitting from the second network to the first network authentication information of the user stored in the second network associated with the identification of the user; transmitting from the first network to the user at least one advertisement of the terminal network address and information within the authentication information; and processing the received at least one advertisement and the received information within the authentication information and determining if the authentication information is correct.

Claims

1. A method of providing a user a terminal network address in a first network through which the user communicates with a packet data network and authenticating connection of the user to the first network comprising:

transmitting to at least one server in the first network a request to obtain the terminal network address in the first network which provides connection of the user to the packet data network;

transmitting from the first network to the user at least one advertisement of the terminal network address;

transmitting an identification of the user in a wireless second network through which the user communicates to the first network to the at least one server;

transmitting to the user information within authentication information stored in the first network which is identified by the identification of the user; and

the user processes the received at least one advertisement and the received information within the authentication information and determines if the authentication information is correct.

2. A method of providing a user a terminal network address in a first network through which the user communicates with a data network and authenticating connection of the user to the first network comprising:

transmitting to at least one server in the first network a request to obtain the terminal network address in the first network which provides connection of the user to the data network and an identification of the user in a wireless second network through which the user communicates to the first network;

transmitting the identification of the user to the wireless second network;

transmitting from the wireless second network to the first network authentication information of the user stored in the wireless second network associated with the identification of the user;

transmitting from the first network to the user at least one advertisement of the terminal network address and information within the authentication information; and

processing the received at least one advertisement and the received information within the authentication information and determining if the authentication information is correct.

3. A method in accordance with claim 2 further comprising:

transmitting a request message from the user to the first network which selects a server to provide connection of the user to the data network and which requests configuration parameters of the first network, an authentication and a signed response which is a function of a secret parameter associated with the user and a random number contained in the received authentication information.

4. A method in accordance with claim 3 further comprising:

determining with the first network if the signed response is correct and if the signed response is correct replying to the user with configuration parameters of the first network and an acknowledgment which is a function of a ciphering key; and

wherein

the authentication transmitted to the first network is a function of the ciphering key.

5. A method in accordance with claim 4 wherein:

after the reply with the acknowledgment, which is a function of the ciphering key, transmitting communications between the user and the first network, which are authenticated with the ciphering key.

6. A method in accordance with claim 5 wherein:

each transmitted communication contains an IPSEC authentication header.

7. A method in accordance with claim 5 wherein:

each transmitted communication is encrypted and/or authenticated with an encapsulating security payload.

8. A method in accordance with claim 2 wherein:

the authentication information comprises a random number RAND, a signed response SRES, which is a function of the random number, and a secret identifier of the user and a ciphering key Kc.

9. A method in accordance with claim 2 wherein:

authentication of the user in the first network is performed before providing the user with the terminal network address.

10. A method in accordance with claim 2 wherein:

the authentication information is stored in the second wireless network in a register which stores information of the location of a user mobile in the second wireless network.

11. A method in accordance with claim 2 wherein:

the data network is a packet data network.

12. A method in accordance with claim 2 wherein:

the user is in the second wireless network which is an access network.

13. A method in accordance with claim 12 further comprising:

transmitting a request message from the user to the first network which selects a server to provide connection of the user to the packet data network and which requests configuration parameters of the first network, an authentication and a signed response which is a function of a secret parameter associated with the user and a random number contained in the received authentication information.

14. A method in accordance with claim 13 further comprising:

determining with the first network if the signed response is correct and if the signed response is correct replying to the user with configuration parameters of the first network and an acknowledgment which is a function of a ciphering key; and

wherein

the authentication transmitted to the first network is a function of the ciphering key.

15. A method in accordance with claim 14 wherein:

after the reply with the acknowledgment, which is a function of the ciphering key, transmitting communications between the user and the first network, which are authenticated with the ciphering key.

16. A method in accordance with claim 15 wherein:

each transmitted communication contains an IPSEC authentication header.

17. A method in accordance with claim 15, wherein:

each transmitted communication is encrypted and/or authenticated with an encapsulating security payload.

18. A method in accordance with claim 2 wherein:

the user is in the second wireless network which is an access network.

19. A method of providing a user a terminal network address in a first network through which the user communicates with a packet data network and authenticating connection of the user to the first network comprising:

transmitting to at least one server in the first network a request to obtain the terminal network address in the first network which provides connection of the user to the packet data network and an identification of the user in a wireless second network through which the user communicates to the first network;

transmitting from the first network to the user at least one advertisement of the terminal network address and information within authentication information stored in the first network which is identified by the identification of the user; and

processing the received at least one advertisement and the received information within the authentication information and determining if the authentication information is correct.

20. A method in accordance with claim 19 wherein:

the authentication information comprises a random number RAND, a signed response SRES which is a function of the random number, and a secret identifier of the user and a ciphering key Kc.