Subscriber authentication for unlicensed mobile access signaling

• US 7,200,383 B2
• Filed: 04/26/2004
• Issued: 04/03/2007
• Est. Priority Date: 04/26/2004
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Eronen, Pasi
• Primary Examiner(s): Gelin; Jean
• Assistant Examiner(s): Nguyen; Khai
• Application Number:
  US10/831,352
• Publication Number:
  US 20050239441A1
• Time in Patent Office: 1,072 Days
• Field of Search: 455/411, 455/410, 455/422.1, 455/432.1, 455/432.2, 455/403, 379/161, 379/156, 379/194, 379/188, 380247-250
• US Class Current: 455/411
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

A system for ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from a mobile station to a core network. The system comprises authenticating means for authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, and thereafter, for authenticating the mobile station to a core network. The system also includes a mobile station with a subscriber identity module that includes an identifying means for identifying the mobile station. The system further includes a unlicensed mobile access network for connecting the mobile station to the core network and for relaying signals between the mobile station and the core network. The unlicensed mobile access network comprises checking means for ensuring that higher-layer messages passing through the unlicensed mobile access network to the core network are from the mobile station that authenticated with the unlicensed mobile access network. The system also includes the core network for implementing transaction control and user services. During authentication between the mobile station and the unlicensed mobile access network, the unlicensed mobile access network stores the identifying means that is associated with the mobile station and after authentication between the mobile station and the core network, the unlicensed mobile access network uses the checking means to examine higher-layer messages that are sent from the mobile station to the core network and to ensure that the identifying means associated with mobile station is stored in the higher-layer message.

Claims

1. An unlicensed mobile access network, comprising:

a authentication unit configured to authenticate a mobile station to the unlicensed mobile access network before higher-layer messages are sent from the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

a connecting unit configured to connect the mobile station to the core network and for relaying signals between the mobile station and the core network; and

a checking unit configured to ensure that higher-layer messages passing through the unlicensed mobile access network from the mobile station to the core network are from the mobile station that is authenticated with the unlicensed mobile access network,

wherein during authentication between the mobile station and the unlicensed mobile access network, the unlicensed mobile access network stores an identifying means that is associated with the mobile station and after authentication between the mobile station and the core network, the unlicensed mobile access network uses the checking unit to examine the higher-layer messages that are sent from the mobile station to the core network and to ensure that the identifying means associated with mobile station is stored in the higher-layer message.

2. A unlicensed mobile access network, comprising:

a authentication unit configured to authenticate a mobile station to the unlicensed mobile access network before higher-layer messages are sent from the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network; and

a connecting unit configured to connect the mobile station to the core network and for relaying signals between the mobile station and the core network,

wherein during authentication between the mobile station and the core network, the unlicensed mobile access network includes authentication information in a command message from the core network to the mobile station and in response to the command message, the mobile station includes a code that is encrypted with the authentication information and a key that is calculated in the mobile station.

3. An unlicensed mobile access network, comprising:

a authentication unit configured to authenticate a mobile station to the unlicensed mobile access network before higher-layer messages are sent from the mobile station to a core network, wherein the mobile station comprises a subscriber identity module that includes an identifying means for identifying the mobile station and a key, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

a connecting unit configured to connect the mobile station to the core network; and

a relaying unit configured to relay signals between the mobile station and the core network,

wherein during authentication between the mobile station and the core network, the mobile station passes the key to a IP security or Transport Layer Security layer to the unlicensed mobile access network, thereby ensuring that all further messages sent from the mobile station are protected with the key or keys derived from key.

4. A mobile station in communications with an unlicensed mobile access network, comprising:

a authentication unit configured to authenticate the mobile station to the unlicensed mobile access network before higher-layer messages are sent from the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network,

a subscriber identity module that includes an identifying unit configured to identify the mobile station and a key;

a connecting unit configured to connect the mobile station to the core network; and

a relaying unit configured to relay signals between the mobile station and the core network,

wherein during authentication between the mobile station and the core network, the mobile station passes the key to a IP security or Transport Layer Security layer, thereby ensuring that all further messages sent from the mobile station are protected with the key or keys derived from key.

5. A system, comprising:

a authentication unit configured to authenticate a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, and thereafter, for authenticating the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

a mobile station including a subscriber identity module that includes an identifying unit configured to identify the mobile station;

an unlicensed mobile access network configured to connect the mobile station to the core network and for relaying signals between the mobile station and the core network, the unlicensed mobile access network comprising a checking unit configured to ensure that higher-layer messages passing through the unlicensed mobile access network to the core network are from the mobile station that authenticated with the unlicensed mobile access network; and

a core network configured to implement transaction control and user services,

wherein during authentication between the mobile station and the unlicensed mobile access network, the unlicensed mobile access network stores the identifying means that is associated with the mobile station and after authentication between the mobile station and the core network, the unlicensed mobile access network uses the checking unit to examine higher-layer messages that are sent from the mobile station to the core network and to ensure that the identifying means associated with mobile station is stored in the higher-layer message.

6. The system of claim 5, wherein the unlicensed mobile access network comprises:

mapping means for mapping a International Mobile Subscriber Identity for identifying the mobile station, the unlicensed mobile access network obtains the International Mobile Subscriber Identity from a authentication process between the mobile station and the unlicensed mobile access network, with the International Mobile Subscriber Identity of the mobile station sending the higher layer message to the core network; and

storing means for storing the International Mobile Subscriber Identity from the authentication process in the higher layer message if the International Mobile Subscriber Identity already in the higher layer message is different from the International Mobile Subscriber Identity obtained from the authentication process.

7. The system of claim 6, wherein the unlicensed mobile access network comprises fetching means for fetching the International Mobile Subscriber Identity from a subscriber profiler, if the unlicensed mobile access network did not save the International Mobile Subscriber Identity during the authentication process.

8. The system of claim 5, wherein the mobile station provides dual mode radios and an access mode switch to enable the mobile station to switch between the dual mode radios.

9. The system of claim 5, wherein the mobile station is included in a customer premise, the system further comprises:

a broadband Internet Protocol network for connecting the customer premise and the unlicensed mobile access network; and

an access point in the customer premise for providing unlicensed radio link to the mobile station and for connecting to the unlicensed mobile access network through the broadband Internet Protocol network,

wherein the mobile station supports an Internet Protocol transport interface that enables an Internet Protocol network to extend from the unlicensed mobile access network to the mobile station through the access point, and

wherein the Internet Protocol transport network enables a single interface, to be defined between the unlicensed mobile access network and the mobile station.

10. The system of claim 9, wherein the single interface comprises a relay component for relaying Global System for Mobile communications/General Packet Radio Service signaling from a Public Land Mobile Network Core Network towards the mobile station, wherein the single interface enables protocols at or above the GSM Mobility Management level to be carried transparently between the mobile station and a mobile switching center in the core network thereby allowing the mobile station to derive all GSM services as if the mobile station were communicating with a Global System for Mobile Communication Base Station Subsystem.

11. The system of claim 9, wherein the access point is a standard access point.

12. The system of claim 9, wherein the unlicensed mobile access network comprises a mapping component for mapping voice from the customer premise to Pulse Coded Modulation voice when a Mobile Switching Center in the Core Network is not implementing certain features.

13. The system of claim 9, further comprising protocol means for enabling a transport and multiplexing protocol to transport messages that are associated with a radio resources protocol over a secure tunnel between the mobile station and the unlicensed mobile access network, wherein the secure tunnel uses Secure Socket Layer/Transmission Control Protocol over Internet Protocol and is responsible for managing the unlicensed radio link with the access point and wherein the mobile station uses standard Internet Protocol technology to access the unlicensed radio link.

14. The system of claim 5, wherein the unlicensed mobile access network includes communication means for enabling the unlicensed mobile access network to communicate with the mobile station via the standard Global System for Mobile communications A-interface and General Packet Radio Service G_b-interface.

15. The system of claim 5, further wherein the authentication means is used for enabling the mobile station to authenticate with the unlicensed mobile access network via at least one of a password, a certificate or an subscriber identity module card.

16. The system of claim 5, further comprising encryption means for encrypting signaling traffic between the mobile station and the unlicensed mobile access network.

17. A system, comprising:

authenticating means for authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, and thereafter, for authenticating the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

a mobile station including a subscriber identity module that includes an identifying means for identifying the mobile station and a key;

an unlicensed mobile access network for connecting the mobile station to the core network and for relaying signals between the mobile station and the core network; and

a core network for implementing transaction control and user services,

wherein during authentication between the mobile station and the core network, the unlicensed mobile access network includes authentication information in a command message from the core network to the mobile station and in response to the command message, the mobile station includes a code that is encrypted with the authentication information and the key.

18. The system of claim 17, wherein the authentication information includes at least a randomly selected challenge.

19. The system of claim 17, wherein the code includes a International Mobile Subscriber Identity associated with the mobile station and the identity of the unlicensed mobile access network, wherein the mobile station obtains the identity of the unlicensed mobile access network during authentication between the mobile station and the unlicensed mobile access network.

20. The system of claim 17, wherein the code includes messages related to a secure tunnel that was established between the mobile station and the unlicensed mobile access network during authentication between the mobile station and the unlicensed mobile access network.

21. A system, comprising:

authenticating means for authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, and thereafter, for authenticating the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

a mobile station including a subscriber identity module that includes an identifying means for identifying the mobile station and a key;

an unlicensed mobile access network for connecting the mobile station to the core network and for relaying signals between the mobile station and the core network; and

a core network for implementing transaction control and user services,

wherein during authentication between the mobile station and the core network, the mobile station passes the key to a IP security or Transport Layer Security layer, thereby ensuring that all further messages sent from the mobile station are protected with the key or keys derived from the key.

22. A method in an unlicensed mobile access network, comprising:

authenticating, in an unlicensed mobile access network, a mobile station before higher-layer messages are sent from the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

forwarding, in the unlicensed mobile access network, a service request from the mobile station to the core network, wherein a International Mobile Subscriber Identity for the mobile station is included in the service request;

transmitting, in the unlicensed mobile access network, an authentication request from the core network to the mobile station;

forwarding, in the unlicensed mobile access network, an authentication response in response to the authentication request; and

examining, by the unlicensed mobile access network, higher-layer messages from the mobile station to the core network to ensure that identifying means associated with mobile station is stored in the higher-layer message.

23. A method in an unlicensed mobile access network, comprising:

authenticating, in an unlicensed mobile access network, a mobile station before higher-layer messages are sent from the mobile station to a core network, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

forwarding, in the unlicensed mobile access network, a service request from the mobile station to the core network, wherein a International Mobile Subscriber Identity for the mobile station is included in the service request;

transmitting, in the unlicensed mobile access network, an authentication request from the core network to the mobile station;

forwarding, in the unlicensed mobile access network, an authentication response in response to the authentication request, wherein the mobile station creates a key in response to the authentication request;

forwarding, in the unlicensed mobile access network, a Cipher Mode Command message created by the core network to the mobile station;

including, by the unlicensed mobile access network, authentication information in the Cipher Mode Command message from the core network to the mobile station and forwarding the modified Cipher Mode Command message to the mobile station; and

receiving, by the unlicensed mobile access network from the mobile station, a code that is encrypted with the authentication information and the key.

24. A method in an arrangement implementing an unlicensed mobile access network, comprising:

authenticating a mobile station to the unlicensed mobile access network before higher-layer messages are sent from the mobile station, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

requesting service, by the mobile station, from the core network and including a International Mobile Subscriber Identity for the mobile station in the request message;

forwarding, by the unlicensed mobile access network, the request message to the core network without examination of the message by the unlicensed mobile access network;

sending an authentication request from the core network to the mobile station through the unlicensed mobile access network;

creating an authentication response, by the mobile station, in response to the authentication request and forwarding the authentication response to the core network through the unlicensed mobile access network;

verifying the authentication response, by the core network, and sending a Cipher Mode Command message to the unlicensed mobile access network;

forwarding a list of permitted algorithms in the Cipher Mode Command message, by the unlicensed mobile access network, to the mobile station; and

examining higher-layer messages from the mobile station, by the unlicensed mobile access network, to ensure that the identifying means associated with mobile station is stored in the higher-layer message.

25. The method of claim 24, further comprising the steps of:

mapping a International Mobile Subscriber Identity for identifying the mobile station from a authentication process between the mobile station and the unlicensed mobile access network, by the unlicensed mobile access network, with the International Mobile Subscriber Identity of the mobile station sending the higher layer message to the core network; and

storing the International Mobile Subscriber Identity from the authentication process in the higher layer message if the International Mobile Subscriber Identity already in the higher layer message is different from the International Mobile Subscriber Identity obtained from the authentication process.

26. The system of claim 25, further comprising the step of fetching the International Mobile Subscriber Identity from a subscriber profiler, if the unlicensed mobile access network did not save the International Mobile Subscriber Identity during the authentication process.

27. A method in an arrangement implementing an unlicensed mobile access network, comprising:

authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

requesting service, by the mobile station, from the core network and including a International Mobile Subscriber Identity for the mobile station in the request message;

forwarding, by the unlicensed mobile access network, the request message to the core network without examination of the message by the unlicensed mobile access network;

sending an authentication request from the core network to the mobile station through the unlicensed mobile access network;

creating an authentication response, by the mobile station, in response to the authentication request and forwarding the authentication response to the core network through the unlicensed mobile access network;

verifying the authentication response, by the core network, and sending a Cipher Mode Command message to the unlicensed mobile access network;

including authentication information in a Cipher Mode Command message from the core network to the mobile station and forwarding in the Cipher Mode Command message, by the unlicensed mobile access network, to the mobile station; and

in response to the command message, including, by the mobile station, a code that is encrypted with the authentication information and the key and forwarding the response to the unlicensed mobile access network.

28. The method of claim 27, further comprising storing at least a randomly selected challenge in the authentication information.

29. The method of claim 27, further comprising storing a International Mobile Subscriber Identity associated with the mobile station and the identity of the unlicensed mobile access network in the code, wherein the mobile station obtains the identity of the unlicensed mobile access network during authentication between the mobile station and the unlicensed mobile access network.

30. The method of claim 27, further comprising storing messages related to a secure tunnel that was established between the mobile station and the unlicensed mobile access network during authentication between the mobile station and the unlicensed mobile access network, in the code.

31. A method in an arrangement implementing an unlicensed mobile access network, comprising:

authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

requesting service, by the mobile station, from the core network and including a International Mobile Subscriber Identity for the mobile station in the request message;

forwarding, by the unlicensed mobile access network, the request message to the core network without examination of the message by the unlicensed mobile access network;

sending an authentication request from the core network to the mobile station through the unlicensed mobile access network;

creating an authentication response, by the mobile station, in response to the authentication request and forwarding the authentication response to the core network through the unlicensed mobile access network;

verifying the authentication response, by the core network, and sending a Cipher Mode Command message to the unlicensed mobile access network;

forwarding, by the unlicensed mobile access network, the Cipher Mode Command Message to the mobile station; and

passing a key to a IP security or Transport Layer Security layer, by the mobile station, thereby ensuring that all further messages sent from the mobile station are protected with the key or keys derived from key.

32. A method in an arrangement implementing an unlicensed mobile access network, comprising:

authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, thereby ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber'"'"'s identity when the first subscriber requests services from the mobile station to the core network;

requesting service, by the mobile station, from the core network and including a International Mobile Subscriber Identity for the mobile station in the request message;

creating an authentication response, by the mobile station, in response to the authentication request from the core network and forwarding the authentication response to the core network through the unlicensed mobile access network; and

passing a key to a IP security or Transport Layer Security layer, by the mobile station, thereby ensuring that all further messages sent from the mobile station are protected with the key or keys derived from key.