Authentication method and apparatus for user equipment and LIPA network entities

• US 9,137,661 B2
• Filed: 07/03/2012
• Issued: 09/15/2015
• Est. Priority Date: 10/06/2011
• Status: Active Grant

• Current Assignee: Industrial Technology Research Institute
• Original Assignee: Industrial Technology Research Institute
• Inventors: Cheng, Ching-Wen, Lin, Yung-Chun, Wu, Jia-Wei, Yang, Shun-Ren
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Wilcox, James J
• Application Number:
  US13/541,123
• Publication Number:
  US 20130091552A1
• Time in Patent Office: 1,169 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 8/06 Registration at serving network Location Register, VLR or user mobility server

Abstract

An authentication method for user equipment (UE) and LIPA network entities is applicable to a cross-LIPA communication environment having an UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H). The UE end successfully registers to a core network (CN) via the LIPA_V, thereby attaining mutual trust relationship between the UE end and the LIPA_V. The UE end successfully registers to the CN via the LIPA_H, thereby attaining mutual trust relationship between the UE end and the LIPA_H. The LIPA_H requests the UE end via the LIPA_V for successfully re-authenticating the CN, thereby attaining mutual trust relationship between the LIPA_V and the LIPA_H.

Claims

1. An authentication method for local internet protocol access (LIPA) network entity and user equipment (UE), adapted to a cross-LIPA communication situation getting involved with a UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H), and comprising:

successfully registering to a CN by said UE end via said LIPA_V, to attain mutual trust relationship of said UE end and said LIPA_V;

successfully registering to said CN by said UE end via said LIPA_H, to attain mutual trust relationship of said UE end and said LIPA_H; and

requesting said UE end by said LIPA_H for re-authentication and successfully re-authenticating said UE end via said LIPA_V, to attain mutual trust relationship of said LIPA_V and said LIPA_H,

wherein a mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by a user end triggered authentication procedure,

wherein said mutual authentication procedure comprises;

sending a specific message to said LIPA_H by said LIPA_V to trigger said UE end to authenticate to said CN with said LIPA_V and said LIPA_H being involved, and said LIPA_H forwarding said specific message to said CN, to enable said CN to authenticate said UE end;

in an existing universal mobile telecommunications system authentication and key agreement procedure, adding forwarding functions to said LIPA_H and said LIPA_V, including sending a user authentication request message by said LIPA_V, forwarding a user authentication request message by said LIPA_H, and forwarding a user authentication response message by said LIPA_V; and

in an existing security mode control procedure, adding another forwarding function to said LIPA_H and said LIPA_V, including forwarding a security mode command message by said LIPA_H, and forwarding a security mode completion message by said LIPA_V.

2. The authentication method as claimed in claim 1, wherein said UE end represents one or more UEs, said LIPA_V represents one or more visiting LIPA network entities, said LIPA_H represents one or more home LIPA network entities.

3. The authentication method as claimed in claim 1, wherein the mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by an authentication procedure which is triggered by a RAU procedure in addition with a serving radio network subsystem (SRNS) relocation procedure.

4. An authentication method for local internet protocol access (LIPA) network entity and user equipment (UE), adapted to a cross-LIPA communication situation getting involved with a UE end, a visiting LIPA network entity end (LIPA_V), and a home LIPA network entity end (LIPA_H), and comprising:

successfully registering to a CN by said UE end via said LIPA_V to attain mutual trust relationship of said UE end and said LIPA_V;

successfully registering to said CN by said UE end via said LIPA_H, to attain mutual trust relationship of said UE end and said LIPA_H; and

requesting said UE end by said LIPA_H for re-authentication and successfully re-authenticating said UE end via said LIPA_V, to attain mutual trust relationship of said LIPA_V and said LIPA_H,

wherein a mutual authentication of said UE end, said LIPA_V, and said LIPA_H is attained by an authentication procedure which is triggered by a simplified routing area update (RAU) procedure,

wherein said authentication procedure triggered by said simplified RAU procedure comprises;

sending a specific message of a RAU request by said LIPA_V to said LIPA_H, to trigger said UE end to authenticate to said CN end with said LIPA_V and said LIPA_H being involved, forwarding said specific message of the RAU request to said CN by said LIPA_H, and verifying the content information of said specific message by said CN;

in an existing universal mobile telecommunications system authentication and key agreement procedure, adding forwarding functions to said LIPA_H and said LIPA_V, including forwarding a user authentication request message by said LIPA_H, forwarding a user authentication response message to said LIPA_H by said LIPA_V, and forwarding a user authentication response message to said CN by said LIPA_H;

in an existing security mode control procedure, adding another forwarding functions to said LIPA_H and said LIPA_V, including forwarding a security mode command message by said LIPA_H, and forwarding a security mode completion message by said LIPA_V; and

sending a RAU response to said LIPA_H by said CN, and forwarding said RAU response to said LIPA_V by said LIPA_H to complete said simplified RAU procedure.

5. The authentication method as claimed in claim 4, wherein said authentication procedure triggered by said RAU procedure with a serving radio network system (SRNS) relocation procedure comprises:

performing said SRNS relocation procedure, including requesting said LIPA_V for the communication service data of said UE end kept in said LIPA_V by said CN, sending to said CN said communication service data of said UE end kept in said LIPA_V by said LIPA_V, and requesting said LIPA_H by said CN to prepare corresponding communication service resources;

performing a security procedure by said UE end, said LIPA_V, said LIPA_H, and said CN for key generation, exchange, and storage; and

performing exchanging communication service data of said UE end between said LIPA_V and said LIPA_H, then forwarding a RAU response message to said LIPA_V by said LIPA_H to complete said RAU procedure.

6. The authentication method as claimed in claim 4, wherein said RAU response at least contains an updated UE ID, a valid location information of said updated UE ID, and a verification code for determining the legitimacy and the authenticity of said updated UE ID.

7. The authentication method as claimed in claim 4, wherein said RAU request message at least contains a temporary UE ID, a valid location of said temporary UE ID, and a verification code of said temporary UE ID.