Authenticating a Device in a Network

Patent metadata

Field	Value
Publication number	US-2016183091-A1
Application number	US-201615057809-A
Country	US
Kind code	A1
Filing date	Mar 1, 2016
Priority date	Apr 27, 2011
Publication date	Jun 23, 2016
Grant date	—

Abstract

A mobile device and an authentication server are configured to re-establish a security context that was previously established using an Authentication Key Agreement (AKA) procedure. The re-establishment advantageously uses re-use information saved from the preceding AKA procedure, including using synchronization information for each such re-establishment that occurs between AKA procedures. The synchronization information particularly identifies each instance of re-establishment and depends on a sequence number assigned to the preceding AKA procedure and on any previous instances of re-establishing the security context.

First claim

What is claimed is:

1 . A method at a mobile device configured for operation in a communication network comprising:
establishing Authentication and Key Agreement (AKA) based security contexts with the communication network from time to time, based on performing corresponding AKA procedures with the communication network, each AKA procedure involving the derivation of corresponding session keys at the mobile device and at the communication network according to a shared secret known a priori at the mobile device and at the communication network, said corresponding session keys used for securing data exchanged during the established security context; and at one or more instances after the performance of a preceding AKA procedure and before the performance of a next, succeeding AKA procedure, re-establishing the security context from the preceding AKA procedure using re-use information saved from the preceding AKA procedure, wherein the re-use information depends on a sequence number assigned by the communication network to identify the preceding AKA procedure, and wherein re-establishing the security context from the preceding AKA procedure comprises, for each instance of re-establishment:
forming a context regeneration request that includes synchronization information particularly identifying each instance of re-establishment and dependent on the sequence number assigned to the preceding AKA procedure and on any previous instances of re-establishing the security context;
sending the context regeneration request to the communication network;
receiving a nonce or other authentication value from the communication network in response to the context regeneration request; and
generating a new session key to use at the mobile device for securing data exchanged during the re-established security context, based on the received authentication value and the shared secret.

2 . The method of claim 1 , wherein at least the first instance of re-establishing the security context from the preceding AKA procedure using the re-use information saved from the preceding AKA procedure comprises determining that the security context requires refreshing, based on expiration of a timer or based upon signaling received from the communication network.

3 . The method of claim 1 , further comprising generating the synchronization information such that, for each instance of re-establishing the security context from the preceding AKA procedure, the synchronization information reflects how many times the security context has been re-established, or otherwise uniquely identifies each re-use of the re-use information to the communication network.

4 . The method of claim 1 , wherein the re-use information comprises a random value received from the communication network for use in establishing the security context during the preceding AKA procedure, along with the session key generated by the mobile device for the security context, and wherein the context regeneration request comprises a message authentication code that depends on the session key.

5 . A mobile device configured for operation in a communication network comprising:
a communication transceiver configured for sending signaling to and receiving signaling from the communication network; and processing circuitry configured to:
establish Authentication and Key Agreement (AKA) based security contexts with the communication network from time to time, based on performing corresponding AKA procedures with the communication network, each AKA procedure involving the derivation of corresponding session keys at the mobile device and at the communication network according to a shared secret known a priori at the mobile device and at the communication network, said corresponding session keys used for securing data exchanged during the established security context; and
at one or more instances after the performance of a preceding AKA procedure and before the performance of a next, succeeding AKA procedure, re-establish the security context from the preceding AKA procedure using re-use information saved from the preceding AKA procedure, wherein the re-use information depends on a sequence number assigned by the communication network to identify the preceding AKA procedure, and wherein the processing circuitry re-establishes the security context from the preceding AKA procedure for each instance of re-establishment, based on being configured to:
form a context regeneration request that includes synchronization information particularly identifying each instance of re-establishment and dependent on the sequence number assigned to the preceding AKA procedure and on any previous instances of re-establishing the security context;
send the context regeneration request to the communication network;
receive a nonce or other authentication value from the communication network in response to the context regeneration request; and
generate a new session key to use at the mobile device for securing data exchanged during the re-established security context, based on the received authentication value and the shared secret.

6 . The mobile device of claim 5 , wherein, for at least the first instance of re-establishing the security context from the preceding AKA procedure using re-use information saved from the preceding AKA procedure, the processing circuitry is configured to determine that the security context requires refreshing, based on expiration of a timer or based upon signaling received from the communication network.

7 . The mobile device of claim 5 , wherein the processing circuitry is configured to generate the synchronization information such that, for each instance of re-establishing the security context from the preceding AKA procedure, the synchronization information reflects how many times the security context has been re-established, or otherwise uniquely identifies each re-use of the re-use information to the communication network.

8 . The mobile device of claim 5 , wherein the re-use information comprises a random value received from the communication network for use in establishing the security context during the preceding AKA procedure, along with the session key generated by the mobile device for the security context, and wherein the context regeneration request comprises a message authentication code that depends on the session key.

9 . A method at an authentication server configured for operation in a communication network comprising:
establishing a security context with a mobile device, based on performing an Authentication and Key Agreement (AKA) procedure in dependence on a shared secret known a priori to the authentication server and the mobile device, including providing a session key generated by the authentication server to another network entity operative to secure communications between the mobile device and the communication network; saving a sequence number assigned to and identifying this particular performance of the AKA procedure with respect to the mobile device; and after establishing the security context and before performing another AKA procedure with the mobile device, re-establishing the security context for the mobile device at each of one or more instances, based on:
receiving from the other network entity a request to reestablish the security context, wherein the request includes synchronization information from the mobile device;
evaluate the synchronization information to determine whether or not the synchronization information includes or correctly derives from the sequence number assigned to the AKA procedure and correctly indicates this particular instance of re-establishment; and
responsive to verification of the synchronization information, generating a new session ke

Assignees

• Ericsson Telefon Ab L M

Inventors

• Norrman Karl
• Blom Rolf
• Näslund Mats

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title