Method of carrying out an authentication check between a base station and a mobile station in a mobile radio system

• US 5,282,250 A
• Filed: 05/27/1993
• Issued: 01/25/1994
• Est. Priority Date: 03/09/1990
• Status: Expired due to Term

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Dahlin, Jan E. S., Dent, Paul W., Raith, Alex K.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/068,234
• Time in Patent Office: 243 Days
• Field of Search: 340/825.31, 340/825.34, 379/59, 379/62, 379/63, 379/95, 455/33.1, 455/34.1, 455/34.2, 455/54.1, 455/54.2, 455/56.1
• US Class Current: 380/247
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Methods for carrying out an authentication check in a mobile telephone system in which an authentic base station serves a plurality of mobile stations. A prior method carried out a unidirectional check from the base to a calling mobile, permitting a false base to carry out a false authentication check by collecting a number of so-called RAND-Response pairs. To avoid this problem, another unidirectional, base-to-mobile, authentication check and an authentication check from the mobile to the base are carried out. In one embodiment, only the bi-directional authentication check is carried out.

Claims

1. A method for carrying out an authentication check between a base station and a mobile station in a mobile radio system, authentication of the mobile station being established when the base station determines that the mobile station should be given service and authentication of the base station being established when the mobile station determines that it should accept service from the base station, the method comprising the steps of:

prior to establishing a connection, sending from the base station an interrogative message concerning the authentication of the mobile station;

requiring the mobile station to send a first response signal;

using the first response signal in the base station to establish the authentication of the mobile station;

subsequent to establishing the authentication of the mobile station, sending from the base station a second response signal to the mobile station;

using the second response signal in the mobile station to form a corresponding second response signal, thereby establishing the authentication of the base station; and

when authentication of the base station has been established, sending from the mobile station a third response signal and using the third response signal in the base station to establish the authentication of the mobile station prior to the service connection being established.

2. A method according to claim 1, wherein said second response signal is formed from a pseudo-random number produced in the base station and from an identification number of the mobile station, and the authentication of the base station is established by comparing said second response signal with the corresponding second response signal produced in the mobile station based on the received pseudo-random number and the identification number of the mobile station.

3. A method according to claim 2, wherein said third response signal sent to the base station is formed from said pseudo-random number and from an identification number of said mobile station, and said base station forms a corresponding third response signal from said pseudo-random number and the identification number of the mobile station, and the base station compares the third response signal and the corresponding third response signal such that when agreement is found between said signals, a speech connection can be established between the base station and the mobile station.

4. A method of carrying out an authentication check between a base station and a mobile station in a mobile radio system, authentication of the mobile station being established when the base station determines that the mobile station should be given service and authentication of the base station being established when the mobile station determines that it should accept service from the base station, the method comprising the steps of:

the mobile station requesting a connection;

the base station assigning the mobile station a connection over a given channel;

forming in the base station a first response signal and sending said first response signal to the mobile station;

forming in the mobile station a corresponding response signal, thereby establishing the authentication of the base station;

subsequent to establishing the authentication of the base station, sending a second response signal from the mobile station to the base station; and

forming in the base station a corresponding response signal, thereby establishing the authentication of the mobile station prior to establishing a service connection.

5. A method according to claim 4, wherein said first response signal is formed from a pseudo-random number produced in the base station and from an identification number of the mobile station, and the authentication of the base station is established by comparing said first response signal with a signal produced in the mobile station based on the received pseudo-random number and the identification number of the mobile station.

6. A method according to claim 5, wherein said second response signal sent to the base station is formed from said pseudo-random number and from an identification number of the mobile station, the base station forms a corresponding second response signal from said pseudo-random number and from the identification number of the mobile station, and the base station compares the corresponding second response signal and the second response signal and establishes a speech connection with the mobile station when the second response signal and the corresponding second response signal coincide.

7. A method for the authentication of a network and a mobile station in a mobile radio system, authentication of the mobile station being established when the network determines that the mobile station should be given service and authentication of the network being established when the mobile station determines that it should accept service from the network, the method comprising the steps of:

forming in each of the network and the mobile station first and second response signals which depend on a pseudo-random number transmitted from the network to the mobile station;

transmitting the first response signal formed in the network to the mobile station;

comparing in the mobile station the first response signal formed in the mobile station with the first response signal received from the network;

transmitting the second response signal formed in the mobile station to the network; and

comparing the network the second response signal formed in the network with the second response signal received from the mobile station.

8. A method according to claim 7 wherein the first and second response signals depend on other data in addition to the pseudo-random number.

9. A method according to claim 8 wherein the other data includes a personal identification number of the mobile station.

10. A method according to claim 8 wherein the other data includes an electronic serial number of the mobile station.

11. A method according to claim 8 wherein the other data includes a number dialled from the mobile station.

12. A method according to claim 7 wherein the second response signal formed in the mobile station is transmitted to the network only if the first response signal formed in the mobile station is identical to the first response signal received from the network.

13. A method according to claim 7 further including a step of establishing voice communication between the network and the mobile station if the second response signal formed in the network is identical to the second response signal received from the mobile station.

14. A method according to claim 7 further including the step of terminating voice communication between the network and the mobile station if the second response signal formed in the network is not identical to the second response signal received from the mobile station.

15. A method for controlling call set up between a network and a mobile station within an area covered by the network, said method comprising the steps of:

sending a first pseudo-random signal from the network to the mobile station;

computing in the mobile station a first mobile value which is dependent on the first pseudo-random signal received from the network;

sending the first mobile value from the mobile station to the network;

computing in the network a first network value corresponding to the first mobile value;

comparing the first mobile value to the first network value;

allocating to the mobile station a speech channel if the first mobile value coincides with the first network value;

computing in the network a second network value which is dependent on a second pseudo-random signal;

sending the second network value and the second pseudo-random signal from the network to the mobile station;

computing in the mobile station a second mobile value corresponding to the second network value;

comparing the second network value to the second mobile value;

computing in the mobile station a third mobile value which is dependent on the second pseudo-random signal;

sending the third mobile value from the mobile station to the network; and

computing in the network a third network value corresponding to the third mobile value;

comparing the third mobile value to the third network value; and

setting up the call between the network and the mobile station if the third mobile value coincides with the third network value.

16. A method according to claim 15 wherein the third mobile value is computed in the mobile station and sent to the network only if the second network value coincides with the second mobile value.

17. A method according to claim 16 wherein the first pseudo-random signal and the first mobile value are sent on a control channel.

18. A method according to claim 17 wherein the second pseudo-random signal, the second network value and the third mobile value are sent on the allocated speech channel.

19. A method for carrying out an authentication check between a network and a mobile station in a mobile radio system comprising the steps of:

selecting a first pseudo-random value;

providing the first pseudo-random value to each of the network and the mobile station;

computing in each of the network and the mobile station a first authentication value from the first pseudo-random value;

sending the first authentication value computed in the mobile station to the network;

comparing the first authentication value computed in the network with the first authentication value received from the mobile station;

selecting a second pseudo-random value;

providing the second random value to each of the network and the mobile station;

computing in each of the network and the mobile station a second authentication value from the second pseudo-random value;

sending the second authentication value computed in the network to the mobile station; and

comparing the second authentication value computed in the mobile station with the second authentication value received from the network.

20. A method according to claim 19 wherein the first authentication value is sent on a control channel and the second authentication value is sent on a speech channel.