User equipment credential system

Patent metadata

Field	Value
Publication number	US-9485232-B2
Application number	US-81973307-A
Country	US
Kind code	B2
Filing date	Jun 28, 2007
Priority date	Jul 6, 2006
Publication date	Nov 1, 2016
Grant date	Nov 1, 2016

Abstract

A user equipment in a communications system, the user equipment comprising: a memory arranged to store at least one identifier associated with the user equipment; a transceiver arranged to communicate with a node in the communication system, wherein the transceiver is arranged to receive the at least one identifier from the node in the communications system, wherein the at least one identifier is used by the user equipment to authenticate the user equipment to at least one further node in the communications system.

First claim

The invention claimed is:

1. An apparatus, comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
receive, from a first node in a communications system, at least one identifier associated with the apparatus for authenticating the apparatus at the first node, wherein the at least one identifier comprises a private identifier including at least one of a password value and a private encryption key, and wherein the private identifier is private to the apparatus and the first node;
store, at the apparatus, the at least one identifier associated with the apparatus;
generate an encryption key for communications with a second node in the communications system, wherein the encryption key is based, at least in part, on an authentication message associated with authenticating the apparatus at the second node and the at least one identifier; and
establish, using the encryption key, a trusted connection between the apparatus and an application hosted on one of a plurality of nodes, wherein the plurality of nodes includes the second node, and wherein the encryption key enables communications with other nodes within the plurality of nodes, without requiring further authentication by the apparatus.

2. The apparatus as claimed in claim 1 , wherein the at least one identifier further comprises a first identifier including a publicly known identifier.

3. The apparatus as claimed in claim 2 , wherein the first identifier is at least one of a user name, a public encryption key, an internet protocol address, and a caller line identification value.

4. The apparatus as claimed in claim 2 , wherein the apparatus is further configured to at least:
send, by the apparatus, the at least one identifier to the second node to initiate authentication of the apparatus at the second node.

5. The apparatus as claimed in claim 4 , wherein the apparatus is further configured to at least:
receive, from the second node, the authentication message.

6. The apparatus as claimed in claim 5 , wherein the apparatus is further configured to process the authentication message.

7. The apparatus as claimed in claim 6 , wherein the encryption key is further based on an identification value associated with the apparatus that is not pre-stored at the apparatus.

8. The apparatus as claimed in claim 6 , wherein the encryption key for encrypting communications between the apparatus and second node depends on the processed authentication message and a result of a one way function of the at least one identifier.

9. A method, comprising:
receiving, at a user equipment from a first node in a communications system, at least one identifier associated with the user equipment for authenticating the user equipment at the first node, wherein the at least one identifier comprises a private identifier including at least one of a password value and a private encryption key, and wherein the private identifier is private to the apparatus and the node;
storing, at the user equipment, the at least one identifier;
generating, by the user equipment, an encryption key for communications with a second node, wherein the encryption key is based, at least in part, on an authentication message associated with authenticating the apparatus at the second node and the at least one identifier; and
establishing, using the encryption key, a trusted connection between the user equipment and an application hosted on one of a plurality of nodes, wherein the plurality of nodes includes the second node, and wherein the encryption key enables communications with other nodes within the plurality of nodes, without requiring further authentication by the user equipment.

10. The method as claimed in claim 9 , wherein the at least one identifier further comprises a first identifier including a publicly known identifier.

11. A method as claimed in claim 10 , wherein the first identifier is at least one of a user name, a public encryption key, an internet protocol address, and a caller line identification value.

12. The method as claimed in claim 9 , further comprising at least:
sending, by the user equipment to the second node, the at least one identifier to initiate authentication of the apparatus at the second node.

13. The method as claimed in claim 12 , further comprising at least:
receiving, at the user equipment from the second node, the authentication message.

14. The method as claimed in claim 13 , further comprising at least:
processing the authentication message received at the user equipment.

15. The method as claimed in claim 14 , wherein the encryption key is further based on an identification value associated with the user equipment that is not pre-stored at the user equipment.

16. The method as claimed in claim 14 , wherein the encryption key for encrypting communications between the user equipment and the second node depends on the processed authentication message and a result of a one way function of the second identifier.

17. A non-transitory computer-readable storage medium encoded with instructions that, when executed by at least one processor perform at least the following:
receiving, at a user equipment from a first node in a communications system, at least one identifier associated with the user equipment for authenticating the user equipment at the first node in the communications system, wherein the at least one identifier comprises a private identifier including at least one of a password value and a private encryption key, and wherein the private identifier is private to the apparatus and the node;
storing, at the user equipment, the at least one identifier;
generating, by the user equipment, an encryption key for communications with a second node, wherein the encryption key is based, at least in part, on an authentication message associated with authenticating the apparatus at the second node and the at least one identifier; and
establishing, using the encryption key, a trusted connection between the user equipment and an application hosted on one of a plurality of nodes, wherein the plurality of nodes includes the second node, and wherein the encryption key enables communications with other nodes within the plurality of nodes, without requiring further authentication by the user equipment.

18. An apparatus, comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
send, from the apparatus to a user equipment, at least one identifier associated with the user equipment for authenticating the user equipment at a second node, wherein the at least one identifier comprises a private identifier including at least one of a password value and a private encryption key, and wherein the private identifier is private to the apparatus and the user equipment; and
store the at least one identifier associated with the user equipment,
wherein, an encryption key generated by the user equipment for communications with the second node is based, at least in part, on an authentication message associated with authenticating the user equipment at the second node and the at least one identifier, wherein a trusted connection between the user equipment and an application hosted on one of a plurality of nodes is established using the encryption key, wherein the plurality of nodes includes the second node,

Assignees

• Holtmanns Silke
• Laitinen Pekka
• Nokia Technologies Oy

Inventors

• Holtmanns Silke
• Laitinen Pekka

Classifications

• H04L2209/80

  Wireless · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W12/06

  Authentication · CPC title