Method and apparatus for mutual authentication at handoff in a mobile wireless communication network

• US 7,421,582 B2
• Filed: 05/28/2004
• Issued: 09/02/2008
• Est. Priority Date: 05/28/2004
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Fu, Zhi, Cox, Gregory W., Smith, Aaron M.
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US10/857,462
• Publication Number:
  US 20050278532A1
• Time in Patent Office: 1,558 Days
• Field of Search: 713/150, 713/168, 713/169, 455/410, 726/5
• US Class Current: 713/169
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method for mutual authentication in a mobile wireless communication network (100) that includes the steps of: verifying a second authenticating device (20) by a mobile node (30) based on a first authentication between the mobile node and a first authenticating device (10); and verifying the mobile node by the second authenticating device based on the first authentication, whereby the mobile node and the second authenticating device perform a second authentication.

Claims

1. A method for mutual authentication in a mobile wireless communication network comprising the steps of:

verifying a second access point by a mobile node based on a first mutual authentication between said mobile node and a first access point; and

verifying said mobile node by said second access point based on said first mutual authentication, whereby said mobile node and said second access point perform a second mutual authentication.

2. The method of claim 1, wherein said mobile node and said second access point are verified based on a first shared secret obtained during said first mutual authentication.

3. The method of claim 2, wherein said step of verifying said second access point comprises the steps of:

generating a first random value;

encrypting said random value using said first shared secret;

forwarding said encrypted value to said first access point via said second access point;

receiving an encrypted second value from said first access point via said second access point; and

decrypting said second value, wherein said second access point is verified if said second value is equal to a first predetermined value.

4. The method of claim 3, wherein said first predetermined value is a function of said first random value.

5. The method of claim 3, wherein said second value is encrypted and decrypted using said first shared secret.

6. The method of claim 2, wherein said step of verifying said mobile node comprises the steps of:

generating a first random value;

encrypting said first random value using a second shared secret between said first access point and said second access point;

forwarding said encrypted first random value to said first access point;

receiving a second value from said first access point that is encrypted using said second shared secret;

forwarding said encrypted second value to said mobile node;

receiving a decrypted second value from said mobile node; and

further decrypting said second value, wherein said mobile node is verified if said second value is equal to a first predetermined value.

7. The method of claim 6, wherein said first predetermined value is a function of said first random value.

8. The method of claim 6, wherein said second value is encrypted by said first access point and decrypted by said mobile node using said first shared secret.

9. The method of claim 1 further comprising the step of requesting said second access point to tunnel traffic to and from said mobile node using said first access point.

10. The method of claim 9, wherein said step of requesting is performed before the second mutual authentication is complete.

11. The method of claim 9, wherein said traffic is tunneled until the occurrence of at least one of the expiration of a timer and the completion of said second mutual authentication.

12. The method of claim 1, wherein said steps of verifying said mobile node and said second access point are further based on a mutual trust between said first and second access points.

13. The method of claim 12, wherein the mutual trust between said first and second access points is based on a shared secret between said first and second access points.

14. The method of claim 1, wherein said method is performed at least one of a link layer, a network layer and an applications layer of the communication network.

15. The method of claim 1, further comprising establishing a shared secret between said mobile node and said second access point based on said first mutual authentication and based on a mutual trust between said first and second access points.

16. A method for authentication in a mobile wireless communication network comprising the steps of:

sending a first message to a first access point via a second access point, said first message based on a first mutual authentication between a mobile node and said first access point; and

receiving a second message from said first access point via said second access point, said second message being based on said first mutual authentication, wherein said second message is used to verify said second access point by the mobile node.

17. A method for authentication in a mobile wireless communication network comprising the steps of:

sending a first message to a first access point;

receiving a second message from said first access point, said second message being based on a first mutual authentication between said first access point and a mobile node;

forwarding said second message to said mobile node; and

receiving a third message from said mobile node, wherein said third message is used to verify said mobile node by second access point.

18. Apparatus for mutual authentication in a mobile wireless communication network comprising:

means for verifying a second access point by a mobile node based on a first mutual authentication between said mobile node and a first access point; and

means for verifying said mobile node by said second access point based on said first mutual authentication, whereby said mobile node and said second access point perform a second mutual authentication.