Method and apparatus for providing bootstrapping procedures in a communication network

• US 9,300,641 B2
• Filed: 02/10/2006
• Issued: 03/29/2016
• Est. Priority Date: 02/11/2005
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Laitinen, Pekka, Ginzboorg, Philip, Asokan, Nadarajah, Bajko, Gabor
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US11/352,058
• Publication Number:
  US 20060182280A1
• Time in Patent Office: 3,700 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An approach is provided for performing authentication in a communication system. In one embodiment, a key is established with a terminal in a communication network according to a key agreement protocol. The agreed key is tied to an authentication procedure to provide a security association that supports reuse of the key. A master key is generated based on the agreed key. In another embodiment, digest authentication is combined with key exchange parameters (e.g., Diffie-Hellman parameters) in the payload of the digest message, in which a key (e.g., SMEKEY or MN-AAA) is utilized as a password. In yet another embodiment, an authentication algorithm (e.g., Cellular Authentication and Voice Encryption (CAVE)) is employed with a key agreement protocol with conversion functions to support bootstrapping.

Claims

1. A method comprising:

establishing a key with a terminal in a communication network according to a key agreement protocol, wherein the terminal is configured to operate using spread spectrum;

tying the agreed key to an authentication procedure to provide a security association that supports reuse of the key;

and generating a master key based on the agreed key;

wherein the key agreement protocol is performed over a transport security (TLS) tunnel.

2. The method according to claim 1, further comprising:

generating a challenge message from the agreed key according to the authentication procedure.

3. The method according to claim 1, further comprising:

generating a challenge message from a key agreement message exchanged with the terminal according to the key agreement protocol.

4. The method according to claim 1, wherein the key agreement protocol includes a Diffie-Hellman key exchange scheme.

5. The method according to claim 4, wherein the terminal is configured to communicate using spread spectrum and to perform bootstrapping according to a generic authentication architecture.

6. The method according to claim 1, wherein the authentication procedure includes a challenge handshake authentication protocol (CHAP).

7. A method for authenticating comprising:

establishing a shared key with a network element in a communication network according to a key agreement protocol, wherein the network element is configured to tie the agreed key to an authentication procedure to provide a security association that supports reuse of the key;

and generating a master key based on the agreed key;

wherein the key agreement protocol is performed over a transport layer security (TLS) tunnel.

8. The method according to claim 7, wherein the key agreement protocol includes a Diffie-Hellman key exchange scheme.

9. The method according to claim 7, further comprising:

communicating with the network element using Code Division Multiple Access (CDMA);

and bootstrapping according to a generic authentication scheme.

10. The method according to claim 7, wherein the authentication procedure includes a challenge handshake authentication protocol (CHAP).

11. An apparatus comprising:

an authentication module configured to establish a shared key with a network element in a communication network according to a key agreement protocol, wherein the agreed key is tied to an authentication procedure to provide a security association that supports reuse of the key, the authentication module being further configured to generate a master key based on the agreed key;

wherein the key agreement protocol is performed over a transport layer security (TLS) tunnel.

12. The apparatus according to claim 11, wherein the key agreement protocol includes a Diffie-Hellman key exchange scheme.

13. The apparatus according to claim 11, further comprising:

a transceiver configured to communicate with the network element using spread spectrum, wherein the authentication module being further configured to perform bootstrapping according to a generic authentication architecture.

14. The apparatus according to claim 11, wherein the authentication procedure includes a challenge handshake authentication protocol (CHAP).