Authentication in secure user plane location (SUPL) systems

Patent metadata

Field	Value
Publication number	US-9706408-B2
Application number	US-201615217880-A
Country	US
Kind code	B2
Filing date	Jul 22, 2016
Priority date	Nov 6, 2010
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

A particular method includes generating, at a secure user plane location (SUPL) server, a message to be sent to a mobile device, the message including: a server certificate including an identifier of the SUPL server and a public key of the SUPL server; and a request for a device certificate of the mobile device. The method also includes receiving a reply from the mobile device that includes a device certificate of the mobile device; and authenticating the mobile device as associated with a SUPL user based on the device certificate.

First claim

What is claimed is:

1. A method comprising:
receiving, at a mobile device, a session re-initiation message from a secure user plane location (SUPL) server to continue a SUPL session between the SUPL server and the mobile device; and
based on the mobile device receiving a valid session initiation message key from the SUPL server prior to the mobile device receiving the session re-initiation message:
authenticating the session re-initiation message using the valid session initiation message key; and
continuing the SUPL session with the SUPL server in response to successful authentication of the session re-initiation message.

2. The method of claim 1 , wherein the session re-initiation message includes a SUPL REINIT message.

3. The method of claim 1 , further comprising in response to the mobile device not receiving the valid session initiation message key:
transmitting a message to the SUPL server; and
receiving a session initiation message key from the SUPL server in response to the message.

4. The method of claim 1 , further comprising:
receiving, at a mobile device from a secure user plane location (SUPL) server, a SUPL END message that includes a SUPL INIT Key Response parameter.

5. The method of claim 4 , wherein the SUPL INIT Key Response parameter includes at least one of a Mode A Key Identifier, a Temporary Mode A Key Identifier, a SUPL_INIT_ROOT_KEY, and a Mode A Key Lifetime.

6. An apparatus comprising:
a memory; and
at least one processor coupled to the memory, the at least one processor configured to:
receive, at a mobile device, a session re-initiation message from a secure user plane location (SUPL) server to continue a SUPL session between the SUPL server and the mobile device; and
based on the mobile device receiving a valid session initiation message key from the SUPL server prior to the mobile device receiving the session re-initiation message:
authenticate the session re-initiation message using the valid session initiation message key; and
continue the SUPL session with the SUPL server in response to successful authentication of the session re-initiation message.

7. The apparatus of claim 6 , wherein the session re-initiation message includes a SUPL REINIT message.

8. The apparatus of claim 6 , wherein the valid session initiation message key includes a SUPL_INIT_ROOT_KEY.

9. The apparatus of claim 6 , wherein the at least one processor is further configured to receive, at a mobile device from a secure user plane location (SUPL) server, a SUPL END message that includes a SUPL INIT Key Response parameter.

10. The apparatus of claim 9 , wherein the SUPL INIT Key Response parameter includes at least one of a Mode A Key Identifier, a Temporary Mode A Key Identifier, a SUPL_INIT_ROOT_KEY, and a Mode A Key Lifetime.

11. A non-transitory processor-readable medium comprising instructions that, when executed by a processor, cause the processor to:
receive, at a mobile device, a session re-initiation message from a secure user plane location (SUPL) server to continue a SUPL session between the SUPL server and the mobile device; and
based on the mobile device receiving a valid session initiation message key from the SUPL server prior to the mobile device receiving the session re-initiation message:
authenticate the session re-initiation message using the valid session initiation message key; and
continue the SUPL session with the SUPL server in response to successful authentication of the session re-initiation message.

12. The non-transitory processor-readable medium of claim 11 , wherein the session re-initiation message includes a SUPL REINIT message.

13. The non-transitory processor-readable medium of claim 11 , wherein in response to the mobile device not receiving the valid session initiation message key, the instructions further cause the processor to:
transmit a message to the SUPL server; and
receive a session initiation message key from the SUPL server in response to the message.

14. The non-transitory processor-readable medium of claim 11 , wherein the instructions further cause the processor to:
receive, at a mobile device from a secure user plane location (SUPL) server, a SUPL END message that includes a SUPL INIT Key Response parameter.

15. The non-transitory processor-readable medium of claim 14 , wherein the SUPL INIT Key Response parameter includes at least one of a Mode A Key Identifier, a Temporary Mode A Key Identifier, a SUPL_INIT_ROOT_KEY, and a Mode A Key Lifetime.

16. An apparatus, comprising:
means for receiving, at a mobile device, a session re-initiation message from a secure user plane location (SUPL) server to continue a SUPL session between the SUPL server and the mobile device; and
means for authenticating the session re-initiation message using valid session initiation message key, based on the mobile device receiving the valid session initiation message key from the SUPL server prior to the mobile device receiving the session re-initiation message; and
means for communicating with the SUPL server using the continued SUPL session in response to successful authentication of the session re-initiation message.

17. The apparatus of claim 16 , wherein the session re-initiation message includes a SUPL REINIT message.

18. The apparatus of claim 16 , further comprising:
means for transmitting a message to the SUPL server in response to the mobile device not receiving the valid session initiation message key; and
means for receiving a session initiation message key from the SUPL server in response to the message.

19. The apparatus of claim 16 , further comprising:
means for receiving, at a mobile device from a secure user plane location (SUPL) server, a SUPL END message that includes a SUPL INIT Key Response parameter.

20. The apparatus of claim 19 , wherein the SUPL INIT Key Response parameter includes at least one of a Mode A Key Identifier, a Temporary Mode A Key Identifier, a SUPL_INIT_ROOT_KEY, and a Mode A Key Lifetime.

Assignees

• Qualcomm Inc

Inventors

• Hawkes Philip Michael
• Wachter Andreas Klaus
• Escott Adrian Edward
• Edge Stephen William

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04W12/08 Primary

  Access security · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title