Efficient security association establishment negotiation technique

• US 7,213,144 B2
• Filed: 08/08/2001
• Issued: 05/01/2007
• Est. Priority Date: 08/08/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Faccin, Stefano, Le, Franck
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US09/923,966
• Publication Number:
  US 20030033518A1
• Time in Patent Office: 2,092 Days
• Field of Search: 713/153, 713/201, 713/168, 455/410, 455/411, 455/422.1, 455/432.1, 455/436, 709218-219, 709/227, 709/225, 726/2, 726/11, 726/14, 380/247, 380/270, 380/255
• US Class Current: 713/153
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A Security Association establishment negotiation technique includes forwarding identifying information from a Mobile Node via a first interface to a first network element. Negotiations are then initiated between the first network element and a second network element serving as a proxy for the Mobile Node via a second interface to establish a Security Association between the Mobile Node and the first network element, the second network element utilizing previously stored Security Association parameters of the Mobile Node. Upon agreement between the first network element and the second network element with regard to the Security Association parameters, the first network element forwards the agreed-upon Security Association parameters to the Mobile Node via the first interface. The first network element may include a Home Agent, a Correspondent Node or a Agent, and the first interface may include a wireless interface to forward information between the Mobile Node and the first network element. The first network element may also include a first gateway connected to it. The first gateway may include a AAA (Authentication, Authorization, and Accounting) server. The second network element may include a second gateway and an Subscriber database/Authentication Center, and the second gateway may be connected to the Subscriber database/Authentication Center. The second gateway may also include a AAA server.

Claims

1. A security association establishment negotiation method comprising:

forwarding identifying information and a request for a security association from a mobile node via a first interface to a first network element;

forwarding the identifying information and the request for a security association from the first network element to a second network element via a second interface;

performing negotiations between the first network element and the second network element via the second interface to establish a security association between the mobile node and the first network element, the second network element utilizing previously stored security association parameters of the mobile node; and

upon agreement between the first network element and the second network element with regard to the security association parameters, the first network element forwarding the agreed-upon security association parameters negotiated between the first network element and the second network element to the mobile node via the first interface.

2. The method of claim 1, wherein performing negotiations between the first network element and the second network element via the second interface includes exchanging parameters for the establishment of the security association.

3. The method of claim 2, wherein the first interface comprises a wireless interface to forward information between the mobile node and the first network element.

4. The method of claim 2, wherein the first network element is connected to a first gateway.

5. The method of claim 4, wherein the first gateway comprises an authentication, authorization, and accounting (AAA) server.

6. The method of claim 1, wherein the second network element comprises a subscriber database and an authentication center.

7. The method of claim 6, wherein the second network element further comprises a second gateway connected to the subscriber database and authentication center.

8. The method of claim 7, wherein the second gateway comprises an authentication, authorization, and accounting (AAA) server.

9. A security association establishment negotiation apparatus for a mobile node, the apparatus comprising:

a first interface connected to a first network element to forward identifying information and the request for a security association from the mobile node to the first network element; and

a second interface connected between the first network element and a second network element, configured to forward the identifying information and the request for a security association from the first network element to the second network element, the first network element performing negotiations between the first network element and the second network element to establish a security association between the mobile node and the first network element utilizing security association parameters of the mobile node previously stored in the second network element;

wherein, upon agreement between the first network element and the second network element with regard to the security association parameters, the first network element forwarding the agreed-upon security association parameters negotiated between the first network element and the second network element to the mobile node via the first interface.

10. The apparatus of claim 9, wherein performing negotiations between the first network element and the second network element via the second interface includes exchanging parameters for the establishment of the security association.

11. The apparatus of claim 10, wherein the first interface comprises a wireless interface to forward information between the mobile node and the first network element.

12. The apparatus of claim 11, wherein the first network element is connected to a first gateway.

13. The apparatus of claim 12, wherein the first gateway comprises an authentication, authorization, and accounting (AAA) server.

14. The apparatus of claim 10, wherein the second network element comprises a subscriber database and an authentication center.

15. The apparatus of claim 14, wherein the second network element further comprises a second gateway connected to the subscriber database and authentication center.

16. The apparatus of claim 15, wherein the second gateway comprises an authentication, authorization, and accounting (AAA) server.