Method and system for anonymous operation of a mobile node

• US 8,478,266 B1
• Filed: 03/07/2006
• Issued: 07/02/2013
• Est. Priority Date: 03/07/2006
• Status: Expired due to Fees

• Current Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Original Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Inventors: Schnellbacher, George Jason, Zhou, Tong
• Primary Examiner(s): Edouard, Patrick
• Assistant Examiner(s): HEIBER, SHANTELL LAKETA
• Application Number:
  US11/370,069
• Time in Patent Office: 2,674 Days
• Field of Search: 455/410, 455/411, 455/433, 713/155, 713/159, 713/161, 713/164, 713168-172, 713/178, 713/179, 713/185, 380/232, 380/258, 380/277
• US Class Current: 455/433
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 8/12 between location registers or mobility servers

Abstract

A mobile node and its home system generate synchronized time-based codes at periodic time intervals. Each time-based code is valid for a predetermined time period. To facilitate anonymous operation when roaming, the mobile node identifies itself with a coded identifier instead of a public identifier. The coded identifier used at a given time includes the time-based code that is valid for that given time. To authenticate the mobile node, a serving system receives authentication information from the mobile node and forwards the authentication information to a home system. The authentication information includes the current time-based code and a timestamp. The home system identifies the mobile node from the current time-based code and the timestamp. The home system then uses the authentication information to authenticate the mobile node.

Claims

1. A method for mobile node authentication, said method comprising:

storing a plurality of time-based codes for each of a plurality of time periods;

a home system receiving from a serving system a request to authenticate a mobile node, wherein said serving system is configured to provide a packet-data service to said mobile node, and wherein said authentication request includes authentication information provided by said mobile node, said authentication information including a coded mobile node identifier and a timestamp associated with said coded mobile node identifier;

said home system referring to those of said stored time-based codes that are valid for a time period that encompasses a time indicated by said timestamp and comparing said coded mobile node identifier to those time-based codes to find a matching time-based code; and

said home system identifying said mobile node based on said matching time-based code;

said home system authenticating said mobile node; and

said home system transmitting an authentication response to said serving system, said authentication response including a plurality of time-based codes that are valid for said mobile node for a plurality of future time periods.

2. The method of claim 1, wherein storing a plurality of time-based codes for each of a plurality of time periods comprises:

generating a first plurality of time-based codes that are valid for a first time period;

generating a second plurality of time-based codes that are valid for a second time period; and

storing said first plurality of time-based codes and said second plurality of time-based codes in a data store.

3. The method of claim 1, wherein said authentication request further includes a mobile-node hash value.

4. The method of claim 3, wherein said home system authenticating said mobile node comprises:

determining hash input for said mobile node;

generating an expected hash value for said mobile node by applying a hashing algorithm to said hash input;

comparing said mobile-node hash value to said expected hash value; and

determining that said mobile-node hash value matches said expected hash value.

5. A system for a plurality of subscriber mobile nodes, said system comprising:

a data store, wherein said data store stores current time-based codes that are valid for said subscriber mobile nodes for a current time period and previous time-based codes that are valid for said subscriber mobile nodes for a previous time period;

an authentication server communicatively coupled to said data store, said authentication server being configured to (i) authenticate a particular mobile node in said plurality of subscriber mobile nodes based on authentication information provided by said particular mobile node, said authentication information including a time-based code and a timestamp, and (ii) transmit to a serving system configured to provide a packet-data service to said particular mobile node a plurality of future time-based codes that are valid for said particular mobile node in future time periods, upon successful authentication of said particular mobile node; and

a code generation engine communicatively coupled to said data store, wherein said code generation engine is configured to generate time-based codes that are valid for said subscriber mobile nodes, including said plurality of future time-based codes that are valid for said particular mobile node.

6. The system of claim 5, wherein said data store is configured to store time-based codes as they are generated by said code generation engine.