Method, system and authentication centre for authenticating in end-to-end communications based on a mobile network

• US 7,984,298 B2
• Filed: 08/30/2007
• Issued: 07/19/2011
• Est. Priority Date: 01/24/2006
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Li, Chao, Fan, Xuyan, Wei, Jiwei
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/848,092
• Publication Number:
  US 20080178004A1
• Time in Patent Office: 1,419 Days
• Field of Search: 713/171, 726/5
• US Class Current: 713/171
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

The invention discloses a method for authenticating in end-to-end communications based on a mobile network, applied to a system including a first service entity requesting a service, a second service entity providing the service and an entity authentication centre, EAC; respectively performing a mutual authentication between the first service entity and the EAC and that between the second service entity and the EAC according to the negotiated authentication mode; if the first service entity requests the second service entity to provide the service, the EAC providing authentication inquiring for the first service entity and the second service entity according to the negotiated authentication mode, and generating a shared derived key according to the negotiated authentication mode; and the first service entity and the second service entity authenticating each other according to the shared derived key and the negotiated authentication mode, and generating a session key for protecting the service.

Claims

1. A method for authenticating in end-to-end communications based on a mobile network, applied to a system including a first service entity requesting a service, a second service entity providing the service and an Entity Authentication Centre, EAC, the method comprising:

negotiating an authentication mode between the first service entity and the EAC, wherein the negotiated authentication mode comprises;

an authentication mechanism between the first service entity and the EAC, an authentication mechanism between the second service entity and the EAC, a mechanism of authentication inquiring, a mechanism for generating a derived key, and an authentication mechanism between the first service entity and the second service entity;

performing a mutual authentication between the EAC and the first service entity according to the authentication mechanism between the first service entity and the EAC comprised in the negotiated authentication mode, and performing a mutual authentication between the EAC and the second service entity according to the authentication mechanism between the second service entity and the EAC comprised in the negotiated authentication mode;

if the first service entity requests the second service entity to provide the service, the EAC providing authentication inquiring for the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode, and generating a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the negotiated authentication mode; and

the first service entity and the second service entity authenticating each other according to the shared derived key and the authentication mechanism between the first service entity and the second service entity comprised in the negotiated authentication mode, and generating a session key for protecting the service.

2. The method according to claim 1, wherein negotiating, by the first service entity, an authentication mode with the EAC comprises:

sending, by the first service entity, an authentication request to the EAC, wherein the authentication request carries an identity of the first service entity and the type of the service currently requested; and

the EAC determining the second service entity for providing the service according to the type of the service currently requested, acquiring authentication capabilities of the first service entity and the second service entity, and selecting the authentication mode according to the authentication capabilities of the first service entity and the second service entity.

3. The method according to claim 2, wherein, the acquiring authentication capabilities of the service entity sending the authentication request and the service entity providing the service comprises:

the EAC acquiring the authentication capability of the service entity sending the authentication request from the authentication request; and

after determining the service entity providing the service, acquiring the authentication capability of the service entity providing the service according to the identity of the service entity providing the service by inquiring subscription data of the service entity providing the service;

or,

the EAC acquiring the authentication capability of the service entity sending the authentication request according to the identity of the service entity sending the authentication request by inquiring the subscription data of the service entity providing the service, and after determining the service entity providing the service, acquiring the authentication capability of the service entity providing the service by inquiring the subscription data of the service entity providing the service.

4. The method according to claim 1, wherein the authentication mode further comprises a mechanism for generating a session key between the first service entity and the second service entity;

and

generating the session key for protecting the service, comprises;

generating the session key according to the mechanism for generating the session key between the first service entity and the second service entity which is comprised in the negotiated authentication mode.

5. The method according to claim 1, wherein,

performing the mutual authentication between the EAC and the first service entity comprises:

authenticating, by the EAC and the first service entity, each other;

allocating, by the EAC, a temporary identity for the first service entity;

the EAC and the first service entity, respectively, acquiring a shared key material for protecting the communication between them, and storing the allocated temporary identity with the acquired shared key material;

performing the mutual authentication between the EAC and the second service entity comprises;

authenticating, by the EAC and the second service entity, each other;

allocating, by the EAC, a temporary identity for the second service entity;

the EAC and the second service entity, respectively, acquiring a shared key material for protecting the communication between them, and storing the allocated temporary identity with the acquired shared key material;

the EAC providing authentication inquiring for the first service entity and the second service entity and generating a shared derived key for protecting the communication between the first service entity and the second service entity, comprises;

the EAC authenticating the authorities of the first service entity and second service entity according to the temporary identities of the first service entity and second service entity, calculating the shared derived key for protecting the communication between the first service entity and second service entity according to the shared key material for protecting the communication between the EAC and the first service entity, the temporary identity of the first service entity, and the temporary identity of the second service entity, and transferring the shared derived key to the second service entity;

the second service entity associating the temporary identity of the first service entity, the shared derived key and the type of the service currently requested, and storing the associated temporary identity of the first service entity, the shared derived key and the type of the service currently requested;

and the first service entity calculating the shared derived key according to the shared key material for protecting the communication with the EAC, the temporary identity of the first service entity, and the temporary identity of the second service entity.

6. The method according to claim 5, wherein each of the shared derived key, the shared key material and the temporary identity has a lifetime, and the method further comprises:

notifying, by the EAC, the first service entity and/or second service entity corresponding to the shared key material or the temporary identity of which the lifetime is to expire or has expired that a re-authentication procedure should be initiated; and

/or

initiating, by the first service entity and/or second service entity corresponding to the shared key material or the temporary identity of which the lifetime is to expire or has expired, the re-authentication procedure to the EAC; and

/or

notifying, by the EAC, the first service entity corresponding to the shared derived key of which the lifetime is to expire or has expired that the re-authentication procedure should be initiated; and

/or

notifying, by the second service entity, the first service entity that the re-authentication procedure should be initiated if the lifetime of the shared derived key for protecting the communication between the first service entity and second service entity, or the lifetime of the temporary identity of the first service entity is to expire or has expired.

7. A method of authentication inquiring, applied to a system comprising a first service entity requesting a service, a second service entity providing the service and an Entity Authentication Centre (EAC), wherein, a mutual authentication between the first service entity and the EAC is performed and a mutual authentication between the second service entity and the EAC is performed, the EAC allocates temporary identities respectively for the first service entity and the second service entity and acquires the shared key materials respectively for protecting the communications with the first service entity and the second service entity, and with the EAC, the first service entity negotiates an authentication mode comprising a mechanism of authentication inquiring and a mechanism for generating a derived key;

the method comprising;

if the first service entity requests the service, authenticating, by the EAC, the authorities of the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode; and

generating, by the EAC, a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the negotiated authentication mode, wherein the shared derived key is used for authenticating each other between the first service entity and the second service entity.

8. The method according to claim 7, wherein if the first service entity requests the service, authenticating, by the EAC, the authorities of the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode;

and generating, by the EAC, a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the negotiated authentication mode, comprises;

the EAC respectively authenticating the authorities of the first service entity and the second service entity according to the temporary identities of the first service entity and the second service entity respectively according to the mechanism of authentication inquiring comprised in the negotiated authentication mode, calculating the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the first service entity, and the temporary identity of the first service entity, and the temporary identity of the second service entity, and transferring the calculated shared derived key to the second service entity;

the second service entity storing the temporary identity of the first service entity with the shared derived key and the type of the service currently requested; and

calculating, by the first service entity, the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the EAC, and the temporary identities of the first service entity and the second service entity.

9. The method according to claim 7, wherein if the first service entity requests the service, authenticating, by the EAC, the authorities of the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode;

and generating, by the EAC, a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the negotiated authentication mode, comprises;

providing for the second service entity, by the first service entity, the temporary identity of the first service entity if requesting the service from the second service entity;

providing for the EAC, by the second service entity, the temporary identity of the second service entity and the temporary identity of the first service entity;

the EAC respectively authenticating the authorities of the first service entity and the second service entity according to the temporary identities of the first service entity and the second service entity respectively according to the mechanism of authentication inquiring comprised in the negotiated authentication mode, calculating the shared derived key according to the shared key material for protecting the communication with the first service entity and the temporary identities of the first service entity and the second service entity, and transferring the calculated shared derived key to the second service entity;

storing, by the second service entity, the temporary identity of the first service entity with the shared derived key and the type of the service currently requested; and

calculating, by the first service entity, the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the EAC, and the temporary identities of the first service entity and the second service entity.

10. The method according to claim 7, further comprising:

providing with the EAC, by the first service entity, the temporary identity of the first service entity and a type of the service currently requested if requesting a service granted ticket, SGT, from the EAC;

the EAC authenticating the authority of the first service entity according to the temporary identity of the first service entity, acquiring the temporary identity of the second service entity according to the type of the service, authenticating the authority of the second service entity according to the temporary identity of the second service entity, calculating the shared derived key according to the shared key material for protecting the communication with the first service entity and the temporary identity of the first service entity, and the temporary identity of the second service entity, generating the SGT comprising the calculated shared derived key and the temporary identities of the first service entity and the second service entity, and sending the generated SGT to the first service entity;

the first service entity calculating the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the EAC, and the temporary identities of the first service entity and the second service entity, and providing the second service entity with the SGT sent from the EAC if requesting the service from the second service entity; and

the second service entity acquiring the shared derived key from the SGT provided by the first service entity, storing the temporary identity of the first service entity with the shared derived key and the type of the service currently requested.

11. The method according to claim 7, further comprising:

providing for the EAC, by the first service entity, the temporary identity of the first service entity and a type of the service currently requested if sending a service request to the EAC;

the EAC authenticating the authority of the first service entity according to the temporary identity of the first service entity, and forwarding the service request to the second service entity according to the type of the service currently requested;

returning, by the second service entity, the temporary identity of the second service entity to the EAC;

the EAC authenticating the authority of the second service entity according to the temporary identity of the second service entity, calculating the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the first service entity, and the temporary identity of the first service entity, and the temporary identity of the second service entity, and sending the calculated shared derived key to the second service entity;

storing, by the second service entity, the temporary identity of the first service entity with the shared derived key and the type of the service currently requested; and

calculating, by the first service entity, the shared derived key according to the mechanism for generating the derived key comprised in the negotiated authentication mode, the shared key material for protecting the communication with the EAC, and the temporary identities of the first service entity and the second service entity.

12. The method according to claim 7, when the EAC transfers the shared derived key to the second service entity, the method further comprising:

using, by the EAC, the shared key material for protecting the communication with the second service entity to protect the communication.

13. A system for authenticating in end-to-end communications based on a mobile network, comprising a first service entity requesting a service, a second service entity providing a service and an Entity Authentication Centre (EAC), wherein,

the first service entity is configured to negotiate with the EAC an authentication mode, wherein the authentication mode comprises:

an authentication mechanism between the first service entity and the EAC, an authentication mechanism between the second service entity and the EAC, a mechanism of authentication inquiring, a mechanism for generating a derived key, and an authentication mechanism between the first service entity and the second service entity, to perform a mutual authentication between the first service entity and the EAC according to the authentication mechanism between the first service entity and the EAC comprised in the negotiated authentication mode, to request a service from the second service entity, and to perform a mutual authentication between the first service entity and the second service entity according to the shared derived key for protecting the communication between the first service entity and the second service entity according to according to the authentication mechanism between the first service entity and the EAC comprised in the negotiated authentication mode;

the second service entity is configured to perform a mutual authentication between the second service entity and the EAC according to the authentication mechanism between the second service entity and the EAC comprised in the negotiated authentication mode, and to perform the mutual authentication between the second service entity and the first service entity according to the shared derived key for protecting the communication between the first service entity and the second service entity according to the authentication mechanism between the first service entity and the second service entity comprised in the negotiated authentication mode if the first service entity requests the service; and

the EAC is configured to respectively perform the mutual authentication between the EAC and the first service entity according to the authentication mechanism between the first service entity and the EAC comprised in the negotiated authentication mode, and perform the mutual authentication between the EAC and the second service entity according to the authentication mechanism between the second service entity and the EAC comprised in the negotiated authentication mode, to provide an authentication inquiring for the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode and to generate the shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the negotiated authentication mode.

14. The system according to claim 13, further comprising a database for storing subscription data of the first and second service entities;

wherein,

the EAC is further configured to, if negotiating the authentication mode, inquire the database according to the identities of the first service entity and the second service entity to acquire authentication capabilities of the first service entity and the second service entity, and to select the authentication mode according to the acquired authentication capabilities of the first service entity and the second service entity.

15. The system according to claim 13, wherein,

the EAC is configured to, when respectively performing the mutual authentication between the EAC and the first service entity and that between the EAC and the second service entity, respectively, allocate temporary identities for the first service entity and the second service entity, acquire the shared key materials for protecting communications with the first service entity and the second service entity, and when providing the authentication inquiring for the first service entity and the second service entity, to calculate the shared derived key for protecting the communication between the first service entity and the second service entity according to the temporary identities of the first service entity and the second service entity and the shared material key for protecting the communication with the first service entity according to the negotiated authentication mode, and to transfer the shared derived key to the second service entity;

the first service entity is configured to, when requesting the service, calculate the shared derived key according to the temporary identities of the first service entity and the second service entity and the shared material key for protecting the communication with the EAC according to the negotiated authentication mode; and

the second service entity is further configured to store the temporary identity of the first service entity with the shared derived key returned by the EAC and the type of the service requested by the first service entity.

16. A system of authentication inquiring, comprising a first service entity requesting a service, a second service entity providing the service and an Entity Authentication Centre (EAC), wherein,

the first service entity is configured to negotiate with the EAC an authentication mode which comprises a mechanism of authentication inquiring and a mechanism for generating a derived key;

and

the EAC is configured to, when the first service entity requests the service, authenticate the authorities of the first service entity and the second service entity according to the mechanism of authentication inquiring comprised in the negotiated authentication mode, and to generate a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating the derived key comprised in the negotiated authentication mode.

17. The system according to claim 16, wherein,

the EAC is configured to authenticate the authorities of the first service entity and the second service entity according to temporary identities of the first service entity and the second service entity, to calculate the shared derived key according to the shared key material for protecting the communication with the first service entity, the temporary identity of the first service entity, and the temporary identity of the second service entity, and to transfer the calculated shared derived key to the second service entity;

the first service entity is configured to calculate the shared derived key according to the shared key material for protecting the communication with the EAC and the temporary identities of the first service entity and the second service entity; and

the second service entity is configured to store the temporary identity of the first service entity with the shared derived key returned by the EAC and the type of the service requested.

18. An authentication centre, comprising:

a first module, configured to negotiate an authentication mode between a first service entity and the authentication centre, wherein the authentication mode comprises;

an authentication mechanism between the first service entity and the authentication centre, an authentication mechanism between a second service entity and the authentication centre, a mechanism of authentication inquiring, a mechanism for generating a serviced key, and an authentication mechanism between the first service entity and the second service entity;

a second module, configured to authenticate the first service entity and the second service entity respectively according to the corresponding authentication mechanism comprised in the authentication mode negotiated by the first module; and

a third module, configured to, when the service entity requests the service, provide authentication inquiring for the service entity requesting the service and the service entity providing the service according to the mechanism of authentication inquiring, and to calculate a shared derived key for protecting the communication between the first service entity and the second service entity according to the mechanism for generating a derived key comprised in the authentication mode negotiated by the first module.

19. The authentication centre according to claim 18, wherein the first module comprises:

a first sub-module, configured to inquire subscription data to respectively acquire authentication capabilities of the service entity requesting a service and the service entity providing the service; and

a second sub-module, configured to select an authentication mode according to the authentication capabilities of the service entity requesting the service and the service entity providing the service, the authentication capabilities being acquired by the first module.

20. The authentication centre according to claim 18, wherein,

the second module is configured to generate shared key materials and temporary identities for the two service entities;

and

the third module is configured to calculate the shared derived key according to the shared key materials and the temporary identities of the two service entities generated by the second module.