Arranging data ciphering in a wireless telecommunication system

• US 8,259,942 B2
• Filed: 04/07/2008
• Issued: 09/04/2012
• Est. Priority Date: 06/30/2000
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Ala-Laurila, Juha, Honkanen, Jukka-Pekka, Rinnemaa, Jyri
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Hailu, Teshome
• Application Number:
  US12/098,835
• Publication Number:
  US 20110058670A1
• Time in Patent Office: 1,611 Days
• Field of Search: 380/247, 380/249, 380/270, 380/255
• US Class Current: 380/247
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Arranging data ciphering in a telecommunication system comprising at least one wireless terminal, a wireless local area network and a public land mobile network. At least one first ciphering key according to the mobile network is calculated in the mobile network and in the terminal for a terminal identifier using a specific secret key for the identifier. Data transmission between the mobile network and the terminal is carried out through the wireless local area network. A second ciphering key is calculated in the terminal and in the mobile network using said at least one first ciphering key. The second ciphering key is sent from the mobile network to the wireless local area network. The data between the terminal and the network is ciphered using said second ciphering key.

Claims

1. A non-transitory computer-readable medium having instructions stored thereon, the instructions comprising:

instructions to calculate, at a wireless terminal, a first ciphering key using a secret key stored in a subscriber identity module of the wireless terminal and a challenge code associated with the secret key and sent by a mobile network and transferred via a wireless local area network to the wireless terminal;

instructions to calculate, in the wireless terminal, a second ciphering key using the first ciphering key;

instructions to transmit, from the wireless terminal, an authentication request message to the mobile network, wherein the authentication request message includes the second ciphering key; and

instructions to, in response to successful authentication of the wireless terminal, decipher, in the wireless terminal, the data between the wireless terminal and an access point of the wireless local area network using the second ciphering key,

wherein the subscriber identity module is configured to support a GSM system, the wireless local area network is configured to support an IEEE 802.11 standard, and the mobile network is configured to support the GSM standard.

2. The non-transitory computer-readable medium of claim 1, further comprising:

instructions to calculate an authentication response on the basis of the challenge code and the secret key;

instructions to calculate a check response on the basis of the authentication response and the first ciphering key; and

instructions to send the check response to the mobile network.

3. The non-transitory computer-readable medium of claim 1, wherein the wireless terminal is configured to support an IEEE 802.11 standard, and wherein the wireless terminal is configured to encipher data using a WEP algorithm.

4. The non-transitory computer-readable medium of claim 1, wherein the instructions to calculate the second ciphering key comprise instructions to calculate the second ciphering key on the basis of the first ciphering key, a random number, a subscriber identity of the wireless terminal, and the challenge code.

5. A non-transitory computer-readable medium having instructions stored thereon, the instructions comprising:

instructions to encipher and decipher, at an access point, data between a wireless terminal and the access point;

instructions to receive, at the access point, a terminal-specific second ciphering key from a public land mobile network, wherein the terminal-specific second ciphering key is calculated by the public land mobile network according to information received from the wireless terminal, and wherein the terminal-specific second ciphering key is received in response to a successful authentication of the wireless terminal by the public land mobile network;

instructions to encipher, at the access point, data sent and decipher data received using the terminal-specific second ciphering key; and

instructions to calculate, at the access point, the terminal-specific second ciphering key using a first ciphering key calculated in the public land mobile network using a secret key specific for the wireless terminal and a challenge code selected for the first ciphering key,

wherein the wireless terminal comprises a subscriber identity module (SIM) configured to support a GSM system, the wireless local area network is configured to support an IEEE 802.11 standard, and the public land mobile network is configured to support a GSM standard.

6. The non-transitory computer-readable medium of claim 5, wherein the access point is configured to support an IEEE 802.11 standard, and wherein the instructions to encipher and decipher data further comprise instructions to encipher and decipher data using a WEP algorithm.

7. A method comprising:

calculating, at a wireless terminal, a first ciphering key using a secret key stored in a subscriber identity module of the wireless terminal and a challenge code associated with the secret key and sent by a mobile network and transferred via a wireless local area network to the wireless terminal;

calculating, in the wireless terminal, a second ciphering key using the first ciphering key;

transmitting, from the wireless terminal, an authentication request message to the mobile network, wherein the authentication request message includes the second ciphering key; and

in response to successful authentication of the wireless terminal, deciphering, in the wireless terminal, the data between the wireless terminal and an access point of the wireless local area network using the second ciphering key,

wherein the subscriber identity module is configured to support a GSM system, the wireless local area network is configured to support an IEEE 802.11 standard, and the mobile network is configured to support the GSM standard.

8. The method of claim 7, further comprising:

calculating an authentication response on the basis of the challenge code and the secret key;

calculating a check response on the basis of the authentication response and said the first ciphering key; and

sending the check response to the mobile network.

9. The method of claim 7, wherein the wireless terminal is configured to support an IEEE 802.11 standard.

10. The method of claim 7, wherein the wireless terminal is configured to encipher data using a WEP algorithm.

11. A method comprising:

enciphering and deciphering, at an access point, data between a wireless terminal and the access point;

receiving, at the access point, a terminal-specific second ciphering key from a public land mobile network, wherein the terminal-specific second ciphering key is calculated by the public land mobile network according to information received from the wireless terminal, and wherein the terminal-specific second ciphering key is received in response to a successful authentication of the wireless terminal by the public land mobile network;

enciphering, at the access point, data sent and deciphering data received using the terminal-specific second ciphering key; and

calculating, at the access point, the terminal-specific second ciphering key using a first ciphering key calculated in the public land mobile network using a secret key specific for the wireless terminal and a challenge code selected for the first ciphering key,

wherein the wireless terminal comprises a subscriber identity module (SIM) configured to support a GSM system, the wireless local area network is configured to support an IEEE 802.11 standard, and the public land mobile network is configured to support a GSM standard.

12. The method of claim 11, wherein the access point is configured to support an IEEE 802.11 standard.

13. The method of claim 11, wherein the enciphering and deciphering data further comprises enciphering and deciphering data comprises using a WEP algorithm.

14. A method comprising:

receiving, at a public land mobile network, an authentication request from a wireless terminal;

in response to receiving the authentication request, generating, at the public land mobile network, a first ciphering key and a challenge code;

transmitting, from the public land mobile network, an acknowledgement message including the challenge code;

receiving, at the public land mobile network, an authentication response message from the wireless terminal, wherein the authentication response message includes a check response and a protection code from the wireless terminal;

verifying, at the public land mobile network, the check response;

in response to a successful verification of the check response, calculating, at the public land mobile network, a second ciphering key using the first ciphering key; and

transmitting the second ciphering key from the public land mobile network to an access point for enciphering and deciphering of data transmitted between the access point and the wireless terminal.

15. The method of claim 14, wherein the challenge code comprises a random number, an authentication response, and the first ciphering key.

16. The method of claim 14, wherein the access point is part of a wireless local area network.