Internet key exchange protocol using security associations

Patent metadata

Field	Value
Publication number	US-9231759-B2
Application number	US-201313933543-A
Country	US
Kind code	B2
Filing date	Jul 2, 2013
Priority date	Dec 1, 2005
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

The invention relates to a method of authenticating a user equipment in a communications network. The method involves sending a message from a network entity to the user equipment. This message includes a set of options for an authentication procedure for authenticating an internet protocol communication over a first interface between the user equipment and the network entity; said options including a “shared key”-based authentication procedure. The method also involves selecting an option from the set. In the event that the “shared-key”-based authentication procedure is selected, a shared secret from a security key established in a generic bootstrapping architecture (GBA) is generated over a second interface between the user equipment and a bootstrapping service function. The shared secret is then used to compute and verify authentication payloads in the key-based authentication procedure for the communication over the first interface.

First claim

The invention claimed is:

1. A method of authenticating a user equipment in a communications network, the method comprising:
sending a message from a network entity to the user equipment including a set of options for an authentication procedure for authenticating an internet protocol communication over a first interface between the user equipment and the network entity said options including a “shared key”-based authentication procedure;
selecting an option from the set and in the event that the “shared-key”-based authentication procedure is selected, generating a shared secret from a security key established in a generic bootstrapping architecture (GBA) over a second interface between the user equipment and a bootstrapping service function; and
using the shared secret to compute and verify authentication payloads in the key-based authentication procedure for the communication over the first interface.

2. A method according to claim 1 , wherein the user equipment transmits a notification to the network entity indicating its capability of supporting authentication procedures.

3. A method according to claim 1 , wherein the set of options is in the form of a preference list.

4. A method according to claim 1 , wherein the step of selecting is carried out at the user equipment.

5. A method according to claim 1 , wherein the set of options includes a certificate based authentication procedure.

6. A method according to claim 1 , wherein the communication over the first interface uses the internet key exchange protocol.

7. A method according to claim 1 , wherein the first interface is wireless.

8. A method according to claim 1 , wherein the second interface is wireless.

9. A method according to claim 1 , comprising the step of transmitting a network entity identifier from the network entity to the user equipment, and using the network entity identifier to generate the shared secret from the security key.

10. A method according to claim 1 , wherein the step of computing the authentication payload is carried out at the user equipment.

11. A method according to claim 1 , wherein the step of verifying the authentication payload using the shared secret is carried out at the network entity.

12. A method according to claim 1 , wherein the user equipment transmits a bootstrapping transaction identifier to the network entity as part of said authentication procedure.

13. A method according to claim 1 , when used to mutually authenticate the user equipment and the network entity wherein the network entity performs the step of computing the authentication payload using the shared secret.

14. A method according to claim 1 , wherein the network entity sends a message including a digital signature and wherein the user equipment verifies the digital signature.

15. A network entity for use in a communications network comprising:
means for establishing an internet protocol communication with a user equipment over an interface;
means for accessing a shared secret to be used in a key-based authentication procedure for authenticating communication with the user equipment, said shared secret having been established in a generic bootstrapping architecture (GBA);
means for dispatching a message to a user equipment including a set of options for the key-based authentication procedure, the set of options including at least the option of using the shared secret derived from GBA in the “shared-key”-based authentication procedure; and means operable when the “shared-key”-based authentication procedure is selected for validating an authorization payload received from the user equipment over the interface and computed using the shared secret.

16. A network entity as claimed in claim 15 , wherein communication over the interface uses the internet key exchange protocol.

17. A network entity according to claim 15 , wherein said means for accessing the shared secret comprises means for dispatching a user equipment identifier with a network entity identifier to a bootstrapping service function in the network.

18. A user equipment for using a communications network comprising:
means for establishing a communication channel with a network entity in the communications network;
means for receiving a message which includes a set of options for the authentication procedure, the set of options including at least the option of using the shared secret derived from GBA in the “shared-key”-based authentication procedure for authenticating communication over the channel;
means for selecting one of the set of options;
means operable when the “shared-key”-based authentication procedure is selected for using a security key derived from a generic bootstrapping architecture to generate the shared secret;
means for computing an authentication payload for transmission to a network entity using the shared secret; and
means for transmitting the payload in a message over the channel according to an internet protocol.

19. A user equipment according to claim 18 , wherein the internet protocol is the internet key exchange protocol.

20. A user equipment according to claim 18 , which comprises means for transmitting a notification indicating that the user equipment supports the “shared-key”-based authentication procedure using shared secrets derived from GBA.

Assignees

• Core Wireless Licensing Sarl

Inventors

• Chan Tat Keung
• Bajko Gabor

Classifications

• H04L9/0838 Primary

  Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061) · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title