Module for authenticity verification of authentication messages

• US 9,344,884 B2
• Filed: 12/20/2012
• Issued: 05/17/2016
• Est. Priority Date: 06/14/2010
• Status: Active Grant

• Current Assignee: Koninklijke KPN NV, Nederlandse Organisatie Voor Toegepast-Natuurwetenschappelijk Onderzoek Tno
• Original Assignee: Koninklijke KPN NV, Nederlandse Organisatie Voor Toegepast-Natuurwetenschappelijk Onderzoek Tno
• Inventors: Muller, Frank, Fransen, Frank
• Primary Examiner(s): Cumming, William D
• Application Number:
  US13/722,828
• Publication Number:
  US 20130157621A1
• Time in Patent Office: 1,244 Days
• Field of Search: 455/411, 455/456.3, 455/456.1, 713/171, 370/395.5
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/104 Location integrity, e.g. secure geotagging
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

At least a method for verifying the authenticity of one or more authentication messages in an authentication procedure between a network and a mobile device is described wherein the method comprises: sending an authentication request through a first radio access node to a said mobile device, said radio access node being associated with first location information; said mobile device generating second location information associated with the location of said mobile device; and, verifying the authenticity of the origin of said authentication request by checking if said second location information comprises said first location information.

Claims

1. A hardware module for a mobile device, said hardware module comprising:

a radio interface;

a location detector; and

an interface controller;

wherein said hardware module is configured to communicate with a network for verifying an authenticity of one or more authentication messages in an authentication procedure between said network and said mobile device, wherein verifying said authenticity comprises checking whether second location information comprises first location information;

wherein said radio interface is configured to provide a radio connection between said mobile device and a radio access node associated with said network;

wherein said radio interface is further configured to receive an authentication request through said radio access node, said radio access node being associated with said first location information;

wherein said location detector is configured to generate said second location information, wherein said second location information is associated with one or more radio access nodes which are within the radio reception range of said mobile device;

wherein said radio interface is further configured to receive said first location information from said radio access network or to transmit said second location information to said radio access node; and

wherein said interface controller is configured to connect a smart card to said hardware module, said smart card configured for generating authentication information in response to said authentication request.

2. The hardware module of claim 1, wherein the hardware module further comprises a microprocessor configured to check whether said second location information comprises said first location information.

3. A smart card for connecting to a hardware module according to claim 1, said smart card configured to generate an authentication response on the basis of said second location information and authentication information in said authentication request received by said radio interface of said hardware module.

4. The hardware module of claim 1, wherein the hardware module further comprises a microprocessor configured to generate a digital signature associated with said second location information.

5. A smart card, wherein the smart card is configured to connect to a hardware module for a mobile device, wherein said hardware module comprises:

a radio interface;

a location detector; and

an interface controller;

wherein said hardware module is configured to communicate with a network for verifying an authenticity of one or more authentication messages in an authentication procedure between said network and said mobile device, wherein verifying said authenticity comprises checking whether second location information comprises first location information;

wherein said radio interface is configured to provide a radio connection between said mobile device and a radio access node associated with said network;

wherein said radio interface is further configured to receive an authentication request through said radio access node, said radio access node being associated with said first location information;

wherein said location detector is configured to generate said second location information, wherein said second location information is associated with one or more radio access nodes which are within the radio reception range of said mobile device;

wherein said radio interface is further configured to receive said first location information from said radio access network or to transmit said second location information to said radio access node;

wherein said smart card is further configured to generate an authentication response on the basis of said second location information and authentication information in said authentication request received by said radio interface of said hardware module.

6. A hardware module for a mobile device, said hardware module comprising:

a radio interface;

a location detector; and

an interface controller;

wherein said hardware module is configured to verify an authenticity of one or more authentication messages in an authentication procedure between a network and said mobile device;

wherein said radio interface is configured to provide a radio connection between said mobile device and a radio access node associated with said network;

wherein said radio interface is further configured to receive an authentication request through said radio access node, said radio access node being associated with first location information;

wherein said location detector is configured to generate second location information associated with one or more radio access nodes which are within the radio reception range of said mobile device;

wherein said hardware module is configured to verify an authenticity of said authentication request by checking whether said second location information comprises said first location information; and

wherein said interface controller is configured to connect a smart card to said hardware module, said smart card configured to generate authentication information in response to said authentication request.

7. The hardware module of claim 6, wherein said radio interface is further configured to receive said first location information from said radio access node.