Method and apparatus for providing peer authentication for an internet key exchange

• US 20030200433A1
• Filed: 04/18/2002
• Published: 10/23/2003
• Est. Priority Date: 04/18/2002
• Status: Active Grant

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Stirbu, Vlad Alexandru
• Granted Patent: US 7,269,730 B2
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A protocol for use as a phase 1 authentication (and key agreement) IKE protocol, similar to IKE phase 1 authentication with public key encryption, but using the IMS AKA trust infrastructure instead of the PKI trust infrastructure. The invention thus allows an initiator (11) having a secret long-term key stored on a smart cart (11a), to authenticate a responder (12), the responder (12) having in some cases a trusted interface with a Home Subscriber Server (14) that has a copy (14a) of the initiator'"'"'s long-term key (and in other cases having itself access to the initiator'"'"'s long-term key). The protocol includes a Diffie-Hellman exchange, and by authenticating the initiator (11) and responder (12), the protocol authenticates the exchange.

Claims

1. A method by which an initiator (11), having a secret key (K), authenticates a responder (12), and vice versa, the method including a public key exchange, the method characterized by:

a step (41) in which the initiator (11) sends the responder (12) a message (MM-3/AKA) claiming an identity (IMPI) of the client (11); and

a step (42-46) in which authentication of both the initiator (11) and the responder (12) is performed based on information derived from, but not revealing, the secret key (K).

2. The method of claim 1, further characterized in that in the step (42-46) in which authentication is performed, the information derived from, but not revealing, the secret key (K) is determined by the initiator (11) using the secret key (K) but is provided to the responder (12) by a third-party entity (14) distinct from the responder (12) and trusted by the responder (12).

3. The method of claim 2, further characterized in that the step (42-46) in which authentication is performed includes:

a step (44) in which the responder (12), in response to a message flow (MM-3/AKA) from the initiator (11) and also in response to an authentication field (AUTN) and a random number field (RAND) provided by the third-party entity (14), provides the authentication field (AUTN) and the random number field (RAND) to the initiator (11); and

a step (45) in which the initiator (11), in response to the authentication field (AUTN) and the random number field (RAND), tests whether the responder (12) is authentic based on information conveyed by the authentication field (AUTN) and also based on the random number field (RAND).

4. The method of claim 3, further characterized in that the step (42-46) in which authentication is performed also includes:

a step (43) in which the third-party entity (14) derives the authentication field (AUTN) from the secret key (K).

5. The method of claim 3, further characterized in that the step (42-46) in which authentication is performed also includes:

a step (43) in which the third-party entity (14) sends to the responder (12) a message including an expected result field (XRES); and

a step (46) in which the responder uses the result field (RES) to test whether the initiator is authentic by comparing the result field (RES) with the expected result field (XRES).

6. The method of claim 1, further characterized in that the step (42-46) in which authentication is performed also includes:

a step (45) in which if the initiator (11) determines that responder to be authentic, then the initiator calculates a result field (RES) based on the secret key (K) and the random number field (RAND).

7. The method of claim 1, further characterized in that in the step (42-46) in which authentication is performed, the information derived from, but not revealing, the secret key (K) is determined by the initiator (11) using the secret key (K) and also by the responder (12) using the secret key (K).

8. The method of claim 1, further characterized in that a shared secret (SKEYID) is obtained based on information derived from, but not revealing, the secret key (K).

9. An initiator apparatus (11), characterized in that it is operative according to the method of claim 1 in respect to the initiator (11).

10. A responder apparatus (12), characterized in that it is operative according to the method of claim 1 in respect to the responder (12).

11. A responder apparatus (12), characterized in that it is operative according to the method of claim 2 in respect to the responder (12).

12. A digital communication system including an initiator apparatus (11), a responder apparatus (12), and a third-party entity apparatus (14), characterized in that the initiator apparatus (11), the responder apparatus (12) and the third-party entity apparatus (14) are operative according to the method of claim 2 in respect to the initiator (11), the responder (12), and the third-party entity (14) respectively.

13. A digital communication system including an initiator apparatus (11) and a responder apparatus (12), characterized in that the initiator apparatus (11) and the responder apparatus (12) are operative according to the method of claim 1 in respect to the initiator (11) and the responder (12) respectively.