GSM A3/A8 authentication in an IMS network

Patent metadata

Field	Value
Publication number	US-9526005-B2
Application number	US-201514683483-A
Country	US
Kind code	B2
Filing date	Apr 10, 2015
Priority date	Apr 17, 2014
Publication date	Dec 20, 2016
Grant date	Dec 20, 2016

Abstract

A telecommunication network comprises an ICS GW configured to receive an access request from a UE; an HSS FE configured to retrieve A3/A8 authentication vectors including an A3/A8 authentication response from an HLR, and further configured to encode the A3/A8 authentication vectors as AKA authentication vectors and send the AKA authentication parameters to an S-CSCF; the ICS GW configured to receive an authentication challenge from the S-CSCF with encoded A3/A8 authentication vectors, and further configured to detect the A3/A8 authentication vectors and issue an A3/A8 authentication challenge to the UE; and the ICS GW configured to receive an A3/A8 authentication response from the UE, and further to encode the A3/A8 authentication response into an AKA authentication response and sending it to the S-CSCF for comparison.

First claim

What is claimed is:

1. A method of subscriber identity authentication in an internet Protocol Multimedia Subsystem (IMS) core network, comprising:
receiving an access request from a User Equipment (UE) having a Subscriber Identity Module (SIM);
requesting Authentication and Key Agreement (AKA) authentication vectors from a Home Subscriber Server (HSS);
retrieving Global System for Mobile Communications (GSM) A3 (authentication algorithm)/A8 (confidentiality key creation) authentication vectors (A3/A8 authentication vectors) including an A3/A8 authentication response from a Home Location Register (HLR);
encoding the A3/A8 authentication vectors by adding at least one filler bit of a known value or adding at least one 0 bit to achieve required bit lengths of AKA authentication vectors and transmitting the AKA authentication vectors to a node in the IMS core network;
receiving an authentication challenge from the node in the IMS core network with encoded A3/A8 authentication vectors;
detecting A3/A8 authentication vectors and issuing an A3/A8 authentication challenge to the UE;
receiving an A3/A8 authentication response from the UE;
encoding the A3/A8 authentication response into an AKA authentication response; and
transmitting the AKA authentication response to the node in the IMS core network for comparing the A3/A8 authentication response from the HLR with the A3/A8 authentication response from the UE.

2. The method of claim 1 , wherein transmitting the AKA authentication vectors to a node in the IMS core network comprises transmitting the AKA authentication vectors to a Serving Call Session Control Function (S-CSCF).

3. The method of claim 1 , wherein encoding the A3/A8 authentication vectors comprises embedding the A3/A8 authentication vectors within AKA authentication vectors.

4. The method of claim 1 , wherein retrieving A3/A8 authentication vectors comprises retrieving a Signed Response (SRES) and a Confidentiality Key (KC).

5. The method of claim 1 , wherein encoding the A3/A8 authentication vectors as AKA authentication vectors comprises:
embedding a Signed Response (SRES) parameter in an Expected Response (XRES) parameter of the AKA authentication vector; and
embedding a Confidentiality Key (KC) parameter in an Confidentiality Key (CK) parameter of the AKA authentication vector.

6. The method of claim 5 , further comprising:
composing an Integrity Key (IK) parameter of the AKA authentication vector by adding filler bits of a known value to achieve its required bit length; and
composing an Authentication Token (AUTN) parameter of the AKA authentication vector by adding filler bits of a known value to achieve its required bit length.

7. A telecommunication network comprising:
a gateway node configured to receive an access request from a mobile device having a Subscriber Identity Module (SIM);
an interface node configured to retrieve A3 (authentication algorithm)/A8 (confidentiality key creation) authentication vectors (A3/A8 authentication vectors) including an A3/A8 authentication response from a Home Location Register (HLR), and further configured to encode the A3/A8 authentication vectors by adding at least one filler bit of a known value or adding at least one 0 bit to achieve required bit lengths of Authentication and Key Agreement (AKA) authentication vectors and send the AKA authentication parameters to an internet Protocol Multimedia Subsystem (IMS) network node;
the gateway node configured to receive an authentication challenge from the IMS network node with encoded A3/A8 authentication vectors, and further configured to detect the A3/A8 authentication vectors and issue an A3/A8 authentication challenge to the mobile device; and
the gateway node configured to receive an A3/A8 authentication response from the mobile device, and further to encode the A3/A8 authentication response into an AKA authentication response and sending it to the IMS network node for comparison.

8. The telecommunication network of claim 7 , wherein the gateway node comprises an IMS Centralized Services Gateway (ICS GW).

9. The telecommunication network of claim 7 , wherein the interface node comprises a Home Subscriber Server Front End (HSS FE).

10. The telecommunication network of claim 7 , wherein the IMS network node comprises an S-CSCF.

11. The telecommunication network of claim 7 , wherein the interface node is configured to embed A3/A8 authentication parameters in AKA authentication parameters and send the AKA authentication parameters to the IMS network node.

12. A telecommunication network comprising:
an internet Protocol Multimedia Subsystem (IMS) Centralized Services Gateway (ICS GW) configured to receive an access request from a User Equipment (UE);
a Home Subscriber Server Front End (HSS FE) configured to retrieve A3 (authentication algorithm)/A8 (confidentiality key creation) authentication vectors (A3/A8 authentication vectors) including an A3/A8 authentication response from a Home Location Register (HLR), and further configured to encode the A3/A8 authentication vectors by adding at least one filler bit of a known value or adding at least one 0 bit to achieve required bit lengths of Authentication and Key Agreement (AKA) authentication vectors and send the AKA authentication parameters to a Serving Call Session Control Function (S-CSCF);
the ICS GW configured to receive an authentication challenge from the S-CSCF with encoded A3/A8 authentication vectors, and further configured to detect the A3/A8 authentication vectors and issue an A3/A8 authentication challenge to the UE; and
the ICS GW configured to receive an A3/A8 authentication response from the UE, and further to encode the A3/A8 authentication response into an AKA authentication response and sending it to the S-CSCF for comparison.

Assignees

• Mavenir Systems Inc
• Mitel Mobility Inc

Inventors

• Wallis Michael Brett

Classifications

• H04W12/06 Primary

  Authentication · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L65/1016

  IP multimedia subsystem [IMS] · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title