System and method for authentication of a roaming subscriber

• US 7,224,800 B1
• Filed: 11/28/2000
• Issued: 05/29/2007
• Est. Priority Date: 11/28/2000
• Status: Expired due to Fees

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Niemi, Aki, Niemi, Valtteri, Rajaniemi, Jaakko, Flykt, Patrik
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): ABYANEH, ALI S
• Application Number:
  US10/181,617
• Time in Patent Office: 2,373 Days
• Field of Search: 380/247, 380/270
• US Class Current: 380/247
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

A network system is proposed comprising a first network control element in a visited network, a second network control element in a home network and a communication device (UE) associated to a subscriber, wherein the first network control element is adapted to perform a first authentication (A9) of a roaming subscriber requesting authentication, and the second network control element is adapted to perform a second authentication (A11) of the same subscriber. By this measure, both network control elements are able to verify that the authentication was performed correctly. Also a corresponding method is proposed.

Claims

1. A network system comprising:

a first network control element configured to perform a first authentication of a subscriber requesting authentication;

a second network control element configured to perform a second authentication of the same subscriber; and

a communication device associated to a subscriber;

wherein the first network control element and the second network control element perform the first and second authentications independently from each other;

wherein a first predetermined number for the first authentication and a second predetermined number for the second authentication are transmitted to the communication device, and the communication device calculates a first result and a second result which are used for first and second authentication, respectively, and each authentication is performed by comparing the first and second results with a scheduled result, respectively; and

wherein the second network control element controls a home network of the subscriber and does not forward the scheduled result for the second authentication to the first network control element.

2. The network system according to claim 1, wherein the subscriber is authorized to access network services when the first and the second authentication are successful.

3. The network system according to claim 1, wherein the first network control element controls a first network, and the second network control element controls a second network.

4. The network system according to claim 1, wherein the communication device is adapted to calculate a result from a predetermined number supplied by the first network control element.

5. The network system according to claim 4, wherein the calculation is performed by using GSM or UMTS algorithms.

6. A network system, comprising:

a first network control element configured to perform a first authentication of a subscriber requesting authentication;

a second network control element configured to perform a second authentication of the same subscriber; and

a communication device associated to the subscriber;

wherein the first network control element and the second network control element perform the first and second authentications independently from each other;

wherein the communication device is configured to calculate a result from a predetermined number and to establish an authentication code from a part or all of a message sent to the network containing the predetermined number, the first network control element uses the result for authentication, and the second network control element uses the authentication code for the second authentication;

wherein the first authentication is performed by comparing the result received from the communication device with a scheduled result; and

wherein the second network control element controls a home network of the subscriber and does not forward a key code for the second authentication to the first network control element.

7. The network system according to claim 6, wherein the part of the message is a ciphering key.

8. The network system according to claim 6, wherein the part of the message is an integrity key.

9. The network system according to claim 6, wherein the part of the message consists of a ciphering key and an integrity key.

10. The network system according to claim 6, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

11. The network system according to claim 6, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.

12. A network system, comprising:

a first network control element configured to perform a first authentication of a subscriber requesting authentication;

a second network control element configured to perform a second authentication of the same subscriber; and

a communication device associated to subscriber;

wherein the first network control element and the second network control element perform the first and second authentications independently from each other;

wherein one predetermined number for the authentication is transmitted to the communication device, and the communication device calculates a result from the predetermined number, wherein a first part of the result is used for the first authentication by the first network control element and a second part of the result is used for the second authentication by the second network control element;

wherein each authentication is performed by comparing a respective part of the first and second results with a scheduled result; and

wherein the second network control element controls a home network of the subscriber and does not forward the scheduled result for the second authentication to the first network control element.

13. The network system according claim 12, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

14. The network system according claim 12, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.

15. The network system according to claim 12, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

16. The network system according to claim 12, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.

17. A method for performing authentication of a subscriber in a network system comprising a first network control element and a second network control element, the method including:

performing a first authentication of the subscriber by the first network control element;

performing a second authentication of the same subscriber by the second network control element;

transmitting a first predetermined number for the first authentication and a second predetermined number for the second authentication to a communication device;

calculating a first result and a second result by the communication device;

using the first result for the first authentication;

using the second result for the second authentication, wherein each authentication is performed by comparing the first and second results with a scheduled result; and

prohibiting the scheduled result for the second authentication from being forwarded to the first network control element;

wherein the first authentication step and the second authentication step are performed independently from each other.

18. The method according to claim 17, further comprising the step of:

authorizing the subscriber to access network services when the first and the second authentication are successful.

19. The method according to claim 17, wherein the first network control element controls a first network, and the second network control element controls a second network.

20. The method according to claim 17, comprising the steps of:

calculating a result from a predetermined number in the communication device.

21. The method according to claim 20, wherein the calculating step is performed by using GSM or UMTS algorithms.

22. The method according to claim 17, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

23. The method according to claim 17, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.

24. A method for performing authentication of a subscriber in a network system comprising a first network control element and a second network control element, the method including:

performing a first authentication of the subscriber by the first network control element;

performing a second authentication of the same subscriber by the second network control element, wherein the first authentication step and the second authentication step are performed independently from each other;

calculating a result from a predetermined number in a communication device;

establishing an authentication code from a part or all of the message sent to the network containing the predetermined number in the communication device;

performing the first authentication by using the result;

performing the second authentication by using the authentication code, wherein the first authentication value is performed by comparing the result received from the communication device with a scheduled result; and

prohibiting the key code for the second authentication from being forwarded to the first network control element.

25. The method according to claim 24, wherein the part of the message is a ciphering key.

26. The method according to claim 24, wherein the part of the message is an integrity key.

27. The method according to claim 24, wherein the part of the message consists of a ciphering key and an integrity key.

28. The method according to claim 24, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

29. The method according to claim 24, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.

30. A method for performing authentication of a subscriber in a network system comprising a first network control element and a second network control element, the method including:

performing a first authentication of the subscriber by the first network control element;

performing a second authentication of the same subscriber by the second network control element, wherein the first authentication step and the second authentication step are performed independently from each other;

transmitting one predetermined number for the authentication to a communication device;

calculating a result from the predetermined number in the communication device;

using a first part of the result for the first authentication;

using a second part of the result for the second authentication, wherein each authentication is performed by comparing a respective part of the first and second results with a scheduled result; and

prohibiting the scheduled result for the second authentication from being forwarded to the first network control element.

31. The method according to claim 30, wherein the predetermined numbers and the scheduled result are provided by a home subscriber database.

32. The method according to claim 30, wherein the predetermined numbers and the scheduled result are provided by an authentication center or an authentication authorization and accounting server.