APPARATUS AND METHOD FOR DETECTING DUPLICATION OF PORTABLE SUBSCRIBER STATION IN PORTABLE INTERNET SYSTEM

• US 20090100262A1
• Filed: 03/14/2007
• Published: 04/16/2009
• Est. Priority Date: 03/15/2006
• Status: Abandoned Application

• Current Assignee: POSDATA Co., Ltd (Posco)
• Original Assignee: POSDATA Co., Ltd (Posco)
• Inventors: Yoo, Sung Ho
• Application Number:
  US12/282,820
• Publication Number:
  US 20090100262A1
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

An apparatus and method for detecting duplication of a portable subscriber station (PSS) in a portable Internet system are provided. A master key of a PSS and a master key of an AAA server are identically updated whenever the PSS succeeds in authentication. It is possible to determine whether the PSS is duplicated or not by comparing the master key of the PSS with the master key of the AAA server during an authentication procedure. In addition, it is possible to find out whether duplication for the corresponding PSS is made by a user'"'"'s own volition or by a third party by additionally performing an authentication procedure which requires an input of a password for a PSS which is doubted as duplicated.

Claims

1. A method for detecting duplication of a portable subscriber station (PSS) in a portable Internet system including an authentication authorization and accounting (AAA) server which performs authentication for the PSS and a radio access station (RAS) wirelessly connecting the PSS and the AAA server, the method comprising the steps of:

(a) performing a first authentication, at the AAA server, using a master key of a connected PSS;

(b) updating the master key of the connected PSS when the first authentication is successfully performed, and performing a second authentication using inherent information provided to an original PSS when the first authentication fails; and

(c) checking a duplication possibility bit value when the second authentication is successfully performed, authenticating the connected PSS as legitimate when there is no duplication possibility bit value and updating the master key of the connected PSS after assigning a duplication possibility bit value, and determining the connected PSS as duplicated when there is a duplication possibility bit value or the second authentication fails.

2. The method of claim 1, wherein in step (a), the first authentication is performed by comparing a first duplication confirmation value computed using the master key of the connected PSS with a second duplication confirmation value computed using a master key retained in the AAA server.

3. The method of claim 2, wherein the first duplication confirmation value is computed using the master key of the connected PSS and at least one of a random number generated in the RAS, a random number generated in the connected PSS and a MAC address of the connected PSS, and the second duplication confirmation value is computed using the master key of the AAA and at least one of the random number generated in the RAS, the random number generated in the connected PSS and the MAC address of the connected PSS.

4. The method of claim 1, wherein in step (a), the master key is a first master key assigned by the AAA server or an updated master key.

5. The method of claim 4, wherein the first master key is a master key assigned by the AAA server when authentication for the original PSS is performed for the first time, and the updated master key is a master key assigned by the AAA server whenever the first authentication or the second authentication is successfully performed.

6. The method of claim 1, wherein in step (a), the first authentication is performed using a USIM card-based EAP-AKA authentication method.

7. The method of claim 1, wherein in step (a), the PSS connected to the AAA server is an original PSS or a duplicated PSS which stores at least one of a MAC address, a master key, and a call count of the original PSS.

8. The method of claim 1, wherein in step (b), the second authentication is performed using an EAP-MD5 authentication method.

9. The method of claim 1, further comprising the step of, after step (c),

(d) rejecting access of the connected PSS to a network and reporting to a network operator the fact that the connected PSS is a duplicated PSS when the connected PSS is determined to be duplicated.

10. The method of claim 9, wherein in step (d), a duplication type is reported to the network operator such that it is determined that the connected PPS is duplicated by a user'"'"'s own volition when there is the duplication possibility bit value, and it is determined that the connected PSS is duplicated by a third party when the second authentication fails.

11. The method of claim 1, wherein in steps (b) and (c), the master key is updated such that the AAA server generates a new master key and transmits the new master key to the connected PSS, so that a master key of the connected PSS is identical to a master key of the AAA server.

12. A method for detecting duplication of a portable subscriber station (PSS) in a portable Internet system including an AAA server which performs authentication, the PSS including an original PSS and a duplicated PSS which store information including a MAC address, a master key, and a call count of the original PSS, the method comprising the steps of:

(a) performing a first authentication, at the AAA server, using a master key of a connected PSS;

(b) updating the master key of the connected PSS and allowing access of the connected PSS to a network when the first authentication is successfully performed, and performing a second authentication using inherent information provided to an original PSS when the first authentication fails; and

(c) updating the master key of the connected PSS and allowing access of the connected PSS to the network when the second authentication is successfully performed, and determining the connected PSS as duplicated and rejecting access of the connected PSS to the network when the second authentication fails.

13. The method of claim 12, wherein in step (c), when the second authentication is successfully performed, a duplication possibility bit value is checked, the duplication possibility bit value is assigned when there is no duplication possibility bit value, and the master key of the connected PSS is updated, so that access of the connected PSS to the network is allowed;

and even though the second authentication is successfully performed, when the duplication possibility bit value exists, the connected PSS is determined to be duplicated, so that access of the connected PSS to the network is rejected.

14. An apparatus for detecting duplication of a portable subscriber station (PSS) in a portable Internet system, comprising:

a memory including an authentication table for storing a master key and a duplication possibility bit value for each PSS;

a PSS duplication determining means for comparing the master key of the PSS connected through a radio access station (RAS) with the master key stored in the authentication table to determine whether the connected PSS is an original PSS or not, and determining whether the connected PSS is duplicated or not using the duplication possibility bit value stored in the authentication table;

a master key updating means for identically updating the master key of the connected PSS and the master key of the authentication table when the connected PSS is determined to be legitimate; and

an authentication controller for performing the whole operation related to authentication and duplication determination for the connected PSS.

15. The apparatus of claim 14, wherein the authentication table comprises the master key of the PSS, the duplication possibility bit value for the PSS, and information provided to an original PSS.

16. The apparatus of claim 14, wherein the authentication table comprises at least one of a random number generated in the RAS, a MAC address of the connected PSS, a random number generated in the connected PSS, a duplication confirmation value of the connected PSS, a duplication confirmation value computed in the PSS duplication determining means, a serial number of an authentication key, and expiry information of the authentication key.

17. The apparatus of claim 14, further comprising an authentication method selecting means for selecting an authentication method of the connected PSS according to the determination result of the PSS duplication determining means.

18. The apparatus of claim 17, wherein the authentication method selecting means, selects a first authentication method for authentication of the connected PSS when the connected PSS is determined to be legitimate by the PSS duplication determining means, and

selects a second authentication method which uses inherent information provided to the original PSS for authentication of the connected PSS when the connected PSS is determined to be duplicated by the PSS duplication determining means.

19. The apparatus of claim 14, wherein the PSS duplication determining means:

determines the connected PSS as legitimate by determining that the master key of the connected PSS is identical to the master key of the authentication table when the duplication confirmation value of the connected PSS is identical to the duplication confirmation value of the authentication table; and

determines the connected PSS as duplicated by determining that the master key of the connected PSS is not identical to the master key of the authentication table when the duplication confirmation value of the connected PSS is not identical to the duplication confirmation value of the authentication table.

20. The apparatus of claim 19, wherein the duplication confirmation value of the connected PSS is computed by a hash function which receives at least one of a random number generated in the RAS, a random number generated in the connected PSS, and a MAC address of the connected PSS in addition to the master key of the connected PSS as input values, and the duplication confirmation value of the authentication table is computed by a hash function which receives at least one of the random number generated in the RAS, the random number generated in the connected PSS, and the MAC address of the connected PSS in addition to the master key of the authentication table as input values.

21. The apparatus of claim 14, wherein the authentication controller performs the first authentication when the connected PSS is determined to be legitimate and performs the second authentication which uses inherent information provided to an original PSS when the connected PSS is determined to be duplicated.

22. The apparatus of claim 18, wherein the first authentication method is a USIM card-based EAP-AKA authentication method, and the second authentication method is an EAP-MD5 authentication method.

23. The apparatus of claim 21, wherein when the second authentication is successfully performed, the PSS duplication determining means checks the duplication possibility bit value of the connected PSS stored in the authentication table, determines the connected PSS as legitimate when the duplication possibility bit value does not exist, assigns the duplication possibility bit value, and stores the assigned duplication possibility bit value in the authentication table.

24. The apparatus of claim 21, wherein when the second authentication is successfully performed, the PSS duplication determining means checks the duplication possibility bit value of the connected PSS stored in the authentication table, and determines the connected PSS as duplicated when the duplication possibility bit value exists or the second authentication fails.

25. The apparatus of claim 21, wherein when the second authentication for the connected PSS is successfully performed, the PSS duplication determining means determines the connected PSS as duplicated by a user'"'"'s own volition when the duplication possibility bit value of the authentication table exists, and when the second authentication for the connected PSS fails, the PSS duplication determining means determines the connected PSS as duplicated by a third party.

26. The apparatus of claim 14, further comprising a PSS duplication notifying means for notifying the fact that the connected PSS is duplicated according to the determination result of the PSS duplication determining means.