Identification of a terminal with a server

• US 20060141987A1
• Filed: 09/26/2003
• Published: 06/29/2006
• Est. Priority Date: 09/26/2002
• Status: Abandoned Application

• Current Assignee: Gemplus (Thales SA)
• Original Assignee: Gemplus (Thales SA)
• Inventors: De Groot, Max
• Application Number:
  US10/529,213
• Publication Number:
  US 20060141987A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

A chip card in a terminal such as a mobile radiotelephone is identified by a first identifier with a server including for example the nominal locating recorder in a cellular radiotelephone network, without the first identifier being transmitted in a clear form or substituted by a provisional identifier. An anonymous identifier is determined in the card on the basis of a generated random number, the first identifier and the result of a public key asymmetric algorithm to which at least the random number is applied. The anonymous identifier is transmitted to the server which recovers the first identifier at least by executing the asymmetric algorithm to which a private key and at least partly the anonymous identifier are applied.

Claims

1. A process to identify a user terminal resource or a user of the terminal resource by a server resource in a telecommunication network, using a first identifier, where an asymmetrical algorithm with public key is implemented in the terminal resource, comprising the following steps:

generating a random number in the user terminal resource,

determining in the terminal resource a second identifier as a function of the random number, at least from part of the first identifier and from the result of executing the asymmetrical algorithm to which at least the random number is applied,

transmitting the second identifier to the server resource, and

in the server resource, retrieving the first identifier at least by executing the asymmetrical algorithm to which a private key and, at least partially, the second identifier are applied, so that the server resource verifies that the first retrieved identifier is written into a memory of the server resource.

2. A process according to claim 1, further including the step of authenticating the terminal resource by the server resource subsequent to the steps of claim 1.

3. A process according to claim 1, in which the determination in the terminal resource includes application of the generated random number to the asymmetrical algorithm with the public key to produce an encrypted random number, application of the generated random number as a key, and the first identifier to a symmetrical algorithm implemented in the terminal resource, to produce an encrypted identifier, and concatenation of the encrypted random number and of the encrypted identifier in the second identifier to be transmitted to the server resource, and wherein the retrieval in the server resource includes application of the encrypted random number to the asymmetrical algorithm with the private key, in order to retrieve the generated random number, and application of the retrieved random number and the encrypted identifier to the symmetrical algorithm, in order to retrieve the first identifier.

4. A process in accordance with claim 1, wherein the determination in the terminal resource includes application of the generated random number concatenated to the first identifier, to the asymmetrical algorithm with the public key to produce the second identifier to be transmitted to the server resource, and wherein the retrieval in the server resource includes application of the second identifier to the asymmetrical algorithm with the private key in order to retrieve the first identifier.

5. A process according to claim 1, further including the steps of changing the public key and the private key for the asymmetrical algorithm in the server resource, and downloading the changed public key from the server resource to the terminal resource.

6. A process according to claim 1, wherein the generation of the random number is periodic in the terminal resource.

7. A process according to claim 1, wherein the generation of the random number occurs following at least one of the following events in the terminal resource:

switching on the terminal resource, setting-up a call, setting-up a session between the terminal resource and the server resource, substitution of the server resource for another server resource, or activation of a service application.

8. A user terminal resource identifying itself, or identifying a user of the latter, to a server resource, through a telecommunication network, using a first identifier, an asymmetrical algorithm with a public key implemented in the terminal resource, comprising:

a resource to generate a random number, and

a resource to determine a second identifier as a function of the random number, at least from part of the first identifier and from the result of executing the asymmetrical algorithm to which at least the random number is applied in order to transmit the second identifier to the server resource, which retrieves the first identifier at least by executing the asymmetrical algorithm to which a private key and, at least partially, the second identifier are applied, and which verifies that the first retrieved identifier is written into a memory of the server resource.

9. A user terminal resource according to claim 8, wherein the resource to generate a random number (GA) and the resource to determine a second identifier are included in a portable electronic object of the chip card type.