System and method for implementing fast reauthentication

• US 8,356,171 B2
• Filed: 04/26/2006
• Issued: 01/15/2013
• Est. Priority Date: 04/26/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Shatzkamer, Kevin, Oswal, Anand K., Grayson, Mark, Iyer, Jayaraman, Narang, Navan
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US11/411,482
• Publication Number:
  US 20070256120A1
• Time in Patent Office: 2,456 Days
• Field of Search: 726/12, 726/15, 713/155
• US Class Current: 713/155
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A system for efficiently reauthenticating a client of a network. In a specific embodiment, the system includes an authentication server and a Security GateWay (SGW) in communication with the client. The SGW includes reauthentication information associated with the client. In a more specific embodiment, the authentication server includes an Authentication, Authorization, and Accounting (AAA) server. The SGW further includes one or more routines for employing the reauthentication information to reauthenticate the client. The AAA server performs initial authentication of the client to enable client access to the network, which yields the reauthentication information. The reauthentication information includes one or more keys and/or counters, such as an authorization key, an encryption key, and a master key, which is/are predetermined by the AAA server.

Claims

1. A system comprising:

an authentication server that includes a processor and a memory and that is configured to perform an initial authentication of a mobile station, and to provide reauthentication information associated with the mobile station, wherein the initial authentication is performed using an A3/A8 algorithm routine, and wherein the reauthentication information comprises an authorization key, an encryption key, a master key, pseudo International Mobile Scriber Identity (IMSI) information, and an authorization counter, which is configured for identifying an upper limit of successive attempts by the mobile station to employ fast reauthentication within a predetermined time interval; and

a security gateway that includes a processor and a memory and that is configured to provide an encrypted link with both the mobile station and the authentication server, wherein the security gateway is configured to cache and to use the reauthentication information previously received from the authentication server to perform a subsequent fast reauthentication of the mobile station in response to a request via an Internet protocol security (IPSec) tunnel, the fast reauthentication being performed by the security gateway without communicating with the authentication server, and without using the A3/A8 algorithm routine.

2. The system of claim 1, wherein the reauthentication information further comprises additional information over information used in the initial authorization.

3. The system of claim 1, wherein the authentication server comprises an Authentication, Authorization, and Accounting (AAA) server.

4. The system of claim 1, wherein the security gateway comprises a cache memory for storing the reauthentication information.

5. The system of claim 1, wherein the security gateway is adapted to manage a connection between the mobile station and a network.

6. The system of claim 2, wherein the additional information comprises reauthentication identification information for the mobile station.

7. The system of claim 1, wherein the reauthentication information is embedded in an authentication response message sent from the authorization server to the security gateway.

8. The system of claim 1, wherein the reauthentication information comprises an International Mobile Subscriber Identity (IMSI).

9. An apparatus comprising:

one or more processors; and

logic encoded in one or more non-transitory tangible media for execution by the one or more processors, and when executed operable to;

receive in a security gateway, reauthentication information from an authentication server that performed an initial authentication of a mobile station, wherein the initial authentication is performed using an A3/A8 algorithm routine;

store the reauthentication information on the security gateway, wherein the security gateway is adapted to manage an encrypted connection between the mobile station and a network, wherein the reauthentication information comprises an authorization key, an encryption key, a master key, pseudo International Mobile Scriber Identity (IMSI) information, and an authorization counter, which is configured for identifying an upper limit of successive attempts by the mobile station to employ fast reauthentication within a predetermined time interval, and wherein the security gateway comprises a cache memory for storing the reauthentication information; and

access the reauthentication information to perform a subsequent fast reauthentication of the mobile station in response to a request via an Internet protocol security (IPSec) tunnel, wherein the fast reauthentication is performed by the security gateway without communicating with the authentication server and without using the A3/A8 algorithm routine.

10. The apparatus of claim 9, wherein the authentication server comprises an Authentication, Authorization, and Accounting (AAA) server.

11. The apparatus of claim 9, wherein the reauthentication information comprises information identifying services that the mobile station is subscribed to or otherwise authorized to access.

12. The apparatus of claim 9, wherein the reauthentication information comprises an International Mobile Subscriber Identity (IMSI).

13. The apparatus of claim 9, wherein the reauthentication information includes password information.

14. The apparatus of claim 9, wherein the reauthentication information comprises all requisite keys and numbers for implementing the fast reauthentication for the mobile station.

15. A method comprising:

receiving in a security gateway, reauthentication information from an authentication server that performed an initial authentication of a mobile station, wherein the initial authentication is performed using an A3/A8 algorithm routine;

storing the reauthentication information on the security gateway, wherein the security gateway is adapted to manage an encrypted connection between the mobile station and a network, wherein the reauthentication information comprises an authorization key, an encryption key, a master key, pseudo International Mobile Scriber Identity (IMSI) information, and an authorization counter, which is configured for identifying an upper limit of successive attempts by the mobile station to employ fast reauthentication within a predetermined time interval, wherein the storing of the authentication information comprises using a cache memory on the security gateway; and

accessing the reauthentication information to perform a subsequent fast reauthentication of the mobile station in response to a request via an Internet protocol security (IPSec) tunnel, wherein the fast reauthentication is performed by the security gateway without communicating with the authentication server and without using the A3/A8 algorithm routine.

16. The method of claim 15, wherein the authentication server comprises an Authentication, Authorization, and Accounting (AAA) server.

17. The method of claim 15, wherein the reauthentication information further comprises additional information over information used in the initial authorization.

18. The method of claim 15, wherein the reauthentication information comprises a remote authentication dial in user service (RADIUS) class attribute.

19. The method of claim 15, wherein the reauthentication information comprises identification information for the mobile station.

20. The method of claim 15, wherein the reauthentication information is embedded in an authentication response message received in the security gateway from the authorization server.

21. The method of claim 15, wherein the reauthentication information comprises an International Mobile Subscriber Identity (IMSI).