Manipulation and restoration of authentication challenge parameters in network authentication procedures

• US 9,537,663 B2
• Filed: 06/20/2012
• Issued: 01/03/2017
• Est. Priority Date: 06/20/2012
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Mizikovsky, Semyon, Broustis, Ioannis, Cakulev, Violeta
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US13/528,802
• Publication Number:
  US 20130343538A1
• Time in Patent Office: 1,658 Days
• Field of Search: 380/277, 380/270, 713/168, 455/410, 455/411
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

A challenge manipulation and restoration capability is provided for use during network authentication. A mobile device (MD) and a subscriber server (SS) each have provisioned therein a binding key (B-KEY) that is associated with a subscriber identity of a network authentication module (NAM) of the MD. The SS obtains an authentication vector (AV) in response to a request from a Radio Access Network (RAN) when the MD attempts to attach to the RAN. The AV includes an original authentication challenge parameter (ACP). The SS encrypts the original ACP based on its B-KEY, and updates the AV by replacing the original ACP with the encrypted ACP. The MD receives the encrypted ACP, and decrypts the encrypted ACP based on its B-KEY to recover the original ACP. The MD provides the original ACP to the NAM for use in computing an authentication response for validation by the RAN.

Claims

1. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

receive an equipment identity of a mobile device and a subscriber identity associated with a network authentication module of the mobile device;

determine, based on the subscriber identity associated with the network authentication module of the mobile device and the equipment identity of the mobile device, whether the network authentication module of the mobile device is authorized to be used with the mobile device;

obtain an authentication vector (AV) for the mobile device, the AV including an original authentication challenge parameter;

obtain, based on the equipment identity of the mobile device, a binding key associated with the network authentication module of the mobile device;

encrypt the original authentication challenge parameter of the AV, based on the binding key, to form an encrypted authentication challenge parameter;

replace the original authentication challenge parameter of the AV with the encrypted authentication challenge parameter;

propagate the AV including the encrypted authentication challenge parameter toward a wireless access network supporting the mobile device;

receive, from the wireless access network, a synchronization failure message including an authentication token and the encrypted authentication challenge parameter;

decrypt the encrypted authentication challenge parameter of the synchronization failure message, based on the binding key, to recover the original authentication challenge parameter; and

regenerate the AV for the mobile device based on the original authentication challenge parameter recovered from the synchronization failure message.

2. The apparatus of claim 1, wherein the processor is configured to:

in response to an AV request being received from the wireless access network;

retrieve the AV including the encrypted authentication challenge parameter; and

propagate the AV including the encrypted authentication challenge parameter toward the wireless access network.

3. The apparatus of claim 1, wherein, to obtain the AV including the original authentication challenge parameter, the processor is configured to:

generate the AV including the original authentication challenge parameter;

or

retrieve the AV including the original authentication challenge parameter.

4. The apparatus of claim 1, wherein the processor is configured to:

propagate the AV including the encrypted authentication challenge parameter toward the wireless access network.

5. The apparatus of claim 1, wherein the equipment identity of the mobile device comprises an International Mobile Equipment Identity (IMEI) or a Mobile Equipment Identifier (MEID).

6. The apparatus of claim 1, wherein the binding key comprises one of a pre-provisioned random number or string, a string provisioned during a bootstrapping procedure, an output of a hash function, or a string or number.

7. The apparatus of claim 1, wherein the processor is configured to:

receive, from the wireless access network, the encrypted authentication challenge parameter; and

decrypt the encrypted authentication challenge parameter based on the binding key.

8. A method, comprising:

receiving, via a processor, an equipment identity of a mobile device and a subscriber identity associated with a network authentication module of the mobile device;

determining, based on the subscriber identity associated with the network authentication module of the mobile device and the equipment identity of the mobile device, whether the network authentication module of the mobile device is authorized to be used with the mobile device;

obtaining an authentication vector (AV) for the mobile device, the AV including an original authentication challenge parameter;

obtaining, based on the equipment identity of the mobile device, a binding key associated with the network authentication module of the mobile device;

encrypting the original authentication challenge parameter of the AV, based on the binding key, to form an encrypted authentication challenge parameter;

replacing the original authentication challenge parameter of the AV with the encrypted authentication challenge parameter;

propagating the AV including the encrypted authentication challenge parameter toward a wireless access network supporting the mobile device;

receiving, from the wireless access network, a synchronization failure message including an authentication token and the encrypted authentication challenge parameter;

decrypting the encrypted authentication challenge parameter of the synchronization failure message, based on the binding key, to recover the original authentication challenge parameter; and

regenerating the AV for the mobile device based on the original authentication challenge parameter recovered from the synchronization failure message.