Authentication key management system and method

• US 6,128,389 A
• Filed: 12/15/1998
• Issued: 10/03/2000
• Est. Priority Date: 01/31/1997
• Status: Expired due to Fees

• Current Assignee: Synacom Technology, Inc.
• Original Assignee: Synacom Technology, Inc.
• Inventors: Snyder, Randall A., Lee, Ming J., Chan, Yick Man
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US09/211,980
• Time in Patent Office: 658 Days
• Field of Search: 380/4, 380/9, 380/21, 380/23, 380/25, 380/44, 380/45, 380/46, 380/47, 380/49, 380/50, 380/52, 380/59, 380/247-250, 380/255, 380/258-266, 380/270-273, 380/277, 380/278 , 380/279, 380/287, 713/150, 713/182, 713/189, 713/200, 713/201
• US Class Current: 380/247
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/71 Hardware identity

Abstract

A system and method for enabling sensitive authentication information to be under the control of the service provider and transmitting only non-sensitive authentication information to the AC, and for providing a secure technique for generating sensitive authentication information and for securely transmitting to and storing the information in the mobile system (MS) and a storage device controlled by the service provider. The present invention utilizes a secure authentication center (SAC) and a secure A-key management system (SAMS) to perform authentication. The present invention automatically and securely generates and programs an MS and SAMS with the sensitive authentication information while significantly reducing the risk of misappropriation of the sensitive authentication information. The risk of misappropriation is reduced since the sensitive authentication information (or other sensitive information) need not be pre-programmed into the MS, or if it is pre-programmed, the sensitive authentication information can be re-programmed, thereby reducing the potential access to the information by unauthorized people before the MS is sold. In addition, the risk of misappropriation is reduced since the generation and programming system and method is performed automatically using a secured communication technique.

Claims

1. A method for securely programming a mobile system with sensitive authentication information, comprising the steps of:

electrically connecting the mobile system to a first unit;

initiating a connection between said first unit and an authentication management system unit via a data network;

identifying a second sensitive authentication signal;

encrypting said second sensitive authentication signal;

transmitting said encrypted second sensitive authentication from said first unit to said authentication management system unit;

wherein said authentication management system unit uses said second sensitive authentication signal to generate first sensitive authentication information;

generating said first sensitive authentication information signal in the authentication management system unit;

encrypting said first sensitive authentication information;

transmitting said first encrypted sensitive authentication information signal from the authentication management system unit to a validation unit via the data network;

unencrypting said first encrypted sensitive authentication information signal in the validation unit; and

automatically programming said mobile system with said first sensitive authentication information.

2. The method of claim 1, wherein said first sensitive authentication information is an authentication key.

3. The method of claim 2, wherein said second sensitive authentication information is an electronic serial number of said mobile system.

4. The method of claim 1, wherein said step of automatically programming said mobile system is performed with said first sensitive authentication information only being accessible to said mobile unit and said first unit and not by a third party.

5. The method of claim 4, wherein said third party is one of a person or a computer.

6. A system for securely programming a mobile system with sensitive authentication information, comprising:

a first unit, capable of securely communicating with a mobile system having a unique identifier, comprising;

a receiver, for receiving said unique identifier and a first sensitive authentication information signal, and

a programming unit, for automatically programming the mobile system with said first sensitive authentication information signal; and

an authentication management system unit for communicating with said first unit over a wide area network, comprising;

a first data generator for generating said first sensitive authentication information signal; and

an encryption unit for encrypting said first sensitive authentication information signal.

7. The system of claim 6, wherein said encryption unit receives said unique identifier from said first unit and generates said first sensitive authentication information signal using said unique identifier.

8. The system of claim 7, wherein said first sensitive authentication information is an authentication key.

9. The system of claim 8, wherein said unique identifier is an electronic serial number of said mobile system.

10. The system of claim 6, wherein said first unit automatically programs said mobile system when the mobile system is activated.

11. The system of claim 6, further comprising:

the mobile system having a memory device wherein said memory device stores a unique identifier and a first sensitive authentication information signal.