Security of data connections

• US 7,542,569 B1
• Filed: 05/17/2000
• Issued: 06/02/2009
• Est. Priority Date: 11/26/1997
• Status: Expired due to Fees

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Leiwo, Jussipekka
• Primary Examiner(s): Revak, Christopher A
• Assistant Examiner(s): Moorthy, Aravind K
• Application Number:
  US09/571,572
• Time in Patent Office: 3,303 Days
• Field of Search: 380/247, 380/270, 713/200, 713/201
• US Class Current: 380/247
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

The invention concerns the security of the data connections of a telephone user. The basic idea of the invention is to forward the authentication of a telephone system to the leg between two private data networks connected via an arbitrating network. When establishing the connection, the private network connected to the telephone system forwards the authenticated subscriber identity to the other private network. To provide the identity forwarded with authenticity, the message containing the identity is signed. To provide encryption of the subscriber identity, the message is encrypted using a public key method. In response the second private network generates a session key to be used in the connection. This key is signed and encrypted using a public key method and sent to the first private network. During the connection, a symmetrical encryption method with the session key is used.

Claims

1. A method, comprising:

providing security of data connections in an arrangement comprising

a telecommunication network comprising subscribers,

a first private data network connected to the telecommunication network,

a second private data network connected to the telecommunication network via the first private network, the second private data network comprising a server providing data services;

authenticating the subscriber between the telecommunication network and the first private data network using an authentication procedure provided by the telecommunication network;

forming, in the first private network, a message comprising the identification of the subscriber received from the telecommunication network and an authenticity code of the message;

determining, in the first private data network, the identity of the server of the second private data network based on the received identification of the subscriber;

sending said message to the server of the second private data network; and

in response to having received the message in the second private data network;

verifying the authenticity code,

checking the identified user'"'"'s right to the requested service, and

when the user is entitled to the requested service, generating and sending a reply to the first private data network.

2. The method according to claim 1, further comprising:

configuring the telecommunication network to be a mobile telecommunication network.

3. The method according to claim 1, wherein the forming the message comprising the subscriber identification comprises including a mobile station international integrated services digital network number of the subscriber in the message.

4. The method according to claim 1, wherein the authenticity code is a message authentication code medium access control.

5. The method according to claim 1, wherein forming the message comprising the authenticity code comprises including a digital signature in the message.

6. The method according to claim 5, further comprising:

digitally signing the identification of the subscriber in an authentication server installed in the first private data network.

7. The method according to claim 6, wherein the digitally signing the identification comprises using the private key of the authentication server.

8. The method according to claim 7, further comprising:

storing the key in a key database attached to the authentication server.

9. The method according to claim 1, further comprising:

encrypting the subscriber identity using a public key encryption method before it is sent from the first private data network to the second private data network.

10. The method according claim 9, wherein the encrypting the subscriber identity comprises encrypting the subscriber identity in an authentication server installed in the first private data network.

11. The method according to claim 1, further comprising:

installing an authentication server in the second private data network; and

encrypting the identity of the subscriber using the public key of the authentication server of the second private data network.

12. The method according claim 11, further comprising:

storing the key in a key database attached to the authentication server of the first private network.

13. The method according claim 1, further comprising:

installing an authentication server in the second private data network; and

in the authentication server, verifying the authenticity code, checking the user'"'"'s right to the requested service, and generating a reply.

14. The method according claim 13, further comprising:

installing an authentication server in the first private data network; and

verifying the authenticity code using the public key of the authentication server of the second private data network.

15. The method according claim 14, further comprising:

storing the public key of the authentication server of the first private data network in a key database attached to the authentication server of the second private data network.

16. The method according claim 1, wherein the sending the reply comprises sending a session key to be used to encrypt the data traffic on the leg between the first and the second private data networks in a connection to be established between the subscriber and the server.

17. The method according claim 16, further comprising:

digitally signing the reply comprising the session key in the second private data network.

18. The method according claim 17, further comprising:

installing an authentication server in the second private data network; and

signing the reply comprising the session key using the private key of the authentication server.

19. The method according to claim 1, further comprising:

installing an authentication server in the first private data network; and

encrypting the reply using a public key of the authentication server of the first private data network.

20. The method according claim 19, further comprising:

installing an authentication server in the second private data network; and

encrypting the reply comprising the session key in the authentication center of the second private data network.

21. An authentication server, comprising:

a receiver unit configured to receive a subscriber identity from a telecommunication network connected to a data network for which the authentication service is provided;

a determination unit configured, responsive to the receiver unit, to determine the identity of a second authentication server in a second data network based on the identity of the subscriber, wherein the second data network is connected to the telecommunication network via the data network;

a signer unit configured, responsive to the receiver unit, to generate a digital signature; and

a sender unit configured, responsive to the receiver unit, the determination unit, and the signer unit, to send the identity and the signature to the second authentication server.

22. The authentication server according to claim 21, further comprising:

an encryption unit configured, responsive to the receiver unit and the determination unit, to encrypt the identity using the public key of the second authentication server.

23. The authentication server according to claim 21, further comprising:

a second receiver unit configured to receive an encrypted session key from the second authentication server; and

a decryption unit configured, responsive to the second receiver unit, to decrypt the encrypted session key.

24. The authentication server according to claim 23, further comprising:

a verification unit configured, responsive to the second receiver unit, to verify a digital signature calculated based on the session key.

25. An authentication server, comprising:

a receiver unit configured to receive a subscriber identity, an identification of a service request by the subscriber, and a digital signature calculated by another authentication server from the subscriber identity and the identification of the service requested by the subscriber;

a verification unit configured, responsive to the receiver unit, to verify the digital signature;

a checker unit configured, responsive to the receiver unit, to check the subscriber'"'"'s right to the requested service;

a generation unit configured, responsive to the checker unit, to generate a session key;

an encryption unit configured, responsive to the generation unit, to encrypt the session key; and

a sender unit configured, responsive to the encryption unit, to send an encrypted message comprising the session key to the another authentication server.

26. The authentication server according to claim 25, further comprising:

a decryption unit configured, responsive to the receiver unit, to decrypt the subscriber identity using a private key of the authentication server.

27. The authentication server according to claim 25, further comprising:

a signer unit configured, responsive to the generation unit, to sign the session key using a private key of the authentication server.

28. An authentication server, comprising:

receiving means for receiving a subscriber identity from a telecommunication network connected to a data network for which the authentication service is provided;

determining means responsive to the receiving means for determining the identity of a second authentication server in a second data network based on the identity of the subscriber, wherein the second data network is connected to the telecommunication network via the data network;

signing means responsive to the receiving means for generating a digital signature; and

sending means, responsive to the receiving means, the determining means, and the signing means, for sending the identity and the signature to the second authentication server.

29. An authentication server, comprising:

receiving means for receiving a subscriber identity, an identification of a service request by the subscriber, and a digital signature calculated by another authentication server from the subscriber identity and the identification of the service requested by the subscriber;

verification means responsive to the receiving means for verifying the digital signature;

checking means responsive to the receiving means for checking the subscriber'"'"'s right to the requested service;

generation means responsive to the checking means for generating a session key;

encryption means responsive to the generation means for encrypting the session key; and

sending means responsive to the encryption means for sending an encrypted message comprising the session key to the another authentication server.