Security methods for use in a wireless communications system
View Patent ↗Signal, e.g., message, security techniques are described for wireless systems. A first signal is received by an access node via a wireless link. The signal includes a first authenticator that was generated by the transmitting device, e.g., wireless terminal. The access node determines from an attribute of the signal at least some information known to both the access node and transmitting device but which was not transmitted as part of the message content. The determined information was used by the wireless terminal in generating the first authenticator. The access node sends at least a portion of the first signal including the first authenticator and the determined information to another entity. The entity compares the first authenticator to a second authenticator it generates from the determined information and a secure key which it shares with the transmitting device to determine if the first and second authenticators match.
1. An end node for generating an authenticated location update to an access node, comprising:
a processor; and
circuitry coupled to the processor configured to:
access a communication system via the access node;
retrieve an end node identification information and a shared security key;
receive an access node information from the access node;
provide the end node identification information, the shared security key and the access node information as an input to a secure hash function;
generate a hash output based on the input to the secure hash function; and
transmit the hash output to the access node, wherein the hash output is configured for use in authentication by the access node.
2. The end node of claim 1 wherein the circuitry is further configured to generate a location update request signal based on the hash output.
3. The end node of claim 2 wherein the circuitry is further configured to include the end node identification information with the hash output to generate the location update request signal.
4. The end node of claim 3 wherein the circuitry is further configured to truncate the hash output to a prescribed length.
5. The end node of claim 2 wherein the access node information includes an access node identification information and a location update transmission time.
6. The end node of claim 1 wherein the access node is configured to broadcast the access node information periodically.
7. The end node of claim 1 wherein the access node is configured to broadcast the access node information asynchronously in response to the end node.
8. The end node of claim 1 wherein the secure hash function is either HMAC-MD5 or HMAC-SHA-1.
9. The end node of claim 1 wherein the shared security key contains information known also to a tracking agent within the access node.
10. The end node of claim 9 wherein the shared security key is a pseudo-random string of bytes.
11. An end node for generating an authenticated location update to an access node, the end node comprising:
means for accessing a communication system via the access node;
means for retrieving an end node identification information and a shared security key;
means for receiving an access node information from the access node;
means for providing the end node identification information, the shared security key and the access node information as an input to a secure hash function;
means for generating a hash output based on the input to the secure hash function; and
means for transmitting the hash output to the access node, wherein the hash output is configured for use in authentication by the access node.
12. The end node of claim 11 further comprising means for generating a location update request signal based on the hash output.
13. The end node of claim 12 further comprising means for including the end node identification information with the hash output to generate the location update request signal.
14. The end node of claim 13 further comprising means for truncating the hash output to a prescribed length.
15. The end node of claim 12 wherein the access node information includes an access node identification information and a location update transmission time.
16. The end node of claim 11 wherein the access node is configured to broadcast the access node information is periodically.
17. The end node of claim 11 wherein the access node is configured to broadcast the access node information asynchronously in response to the end node.
18. The end node of claim 11 wherein the secure hash function is either HMAC-MD5 or HMAC-SHA-1.
19. The end node of claim 11 wherein the shared security key contains information known also to a tracking agent within the access node.
20. The end node of claim 19 wherein the shared security key is a pseudo-random string of bytes.
21. A method for generating an authenticated location update comprising:
accessing a communication system via an access node;
retrieving an end node identification information and a shared security key;
receiving an access node information from the access node;
providing the end node identification information, the shared security key and the access node information as an input to a secure hash function;
generating a hash output based on the input to the secure hash function; and
transmitting the hash output to the access node, wherein the hash output is configured for use in authentication by the access node.
22. The method of claim 21 further comprising generating a location update request signal based on the hash output.
23. The method of claim 22 further comprising including the end node identification information with the hash output to generate the location update request signal.
24. The method of claim 23 further comprising truncating the hash output to a prescribed length.
25. The method of claim 22 wherein the access node information includes an access node identification information and a location update transmission time.
26. The method of claim 21 wherein the access node is configured to broadcast the access node information periodically.
27. The method of claim 21 wherein the access node is configured to broadcast the access node information asynchronously in response to the end node.
28. The method of claim 21 wherein the secure hash function is either HMAC-MD5 or HMAC-SHA-1.
29. The method of claim 21 wherein the shared security key contains information known also to a tracking agent within the access node.
30. The method of claim 29 wherein the shared security key is a pseudo-random string of bytes.
31. A computer-readable medium including program code stored thereon, comprising:
program code for accessing a communication system via an access node;
program code for retrieving an end node identification information and a shared security key;
program code for receiving an access node information from the access node;
program code for providing the end node identification information, the shared security key and the access node information as an input to a secure hash function;
program code for generating a hash output based on the input to the secure hash function; and
program code for transmitting the hash output to the access node, wherein the hash output is configured for use in authentication by the access node.
32. The computer-readable medium of claim 31 further comprising program code for generating a location update request signal based on the hash output.
33. The computer-readable medium of claim 32 further comprising program code for including the end node identification information with the hash output to generate the location update request signal.
34. The computer-readable medium of claim 33 further comprising program code for truncating the hash output to a prescribed length.
35. The computer-readable medium of claim 32 wherein the access node information includes an access node identification information and a location update transmission time.
36. The computer-readable medium of claim 31 wherein the access node is configured to broadcast the access node information periodically.
37. The computer-readable medium of claim 31 wherein the access node is configured to broadcast the access node information asynchronously in response to the end node.
38. The computer-readable medium of claim 31 wherein the secure hash function is either HMAC-MD5 or HMAC-SHA-1.
39. The computer-readable medium of claim 31 wherein the shared security key contains information known also to a tracking agent within the access node.
40. The computer-readable medium of claim 39 wherein the shared security key is a pseudo-random string of bytes.