Method and apparatus for authentication of session packets for resource and admission control functions (RACF)
View Patent ↗The invention that addresses the problem of authentication of the transport packet stream (which constitutes a flow within a session), which has been admitted into a managed packet network. Authentication and the subsequent policing of the flows supporting an identified client's authorized service prevent a large class of denial of service attacks described below. Specifically, the invention addresses two different matters: 1) key distribution and management 2) various forms of using a shared key for the authentication of transport packets on the user-to-network-interface (UNI).
1. A method of authenticating a transport packet stream in a managed packet network comprising the steps of:
receiving at a RACF (Resource and Admission Control Function) a request for service from a client application transmitted through a service control function;
authenticating each packet of said transport packet stream, using a session key, based on session flow parameters associated with said transport packet stream without regard to identity of a client;
creating at said RACF a session key, K F , for a session flow F to be established; passing a quantity to the service control function from which another quantity X can be determined, wherein X is included in a token to be passed to said client application, wherein said session key is determined from X;
and creating a ticket, t, for a border gateway to be contacted, where t=K BGW (F, K F ), wherein K BGW is a key shared between the RACF and border gateway.
2. The method of claim 1 , wherein the quantity X which is passed to the client utilizes the ticket as part of an encrypted value.
3. The method of claim 1 , wherein a subscriber key, used to authenticate, is shared only between the RACF and client.
4. The method of claim 2 , wherein a token T is passed from the client application to a border gateway as part of a session initiation process, wherein T includes the quantity [t, K F (timestamp)].
5. The method of claim 4 , wherein the border gateway authenticates the session if the timestamp is within a given time.
6. The method of claim 5 , wherein the user equipment and border gateway store an initial timestamp value in order to protect against replay after a given time period has passed.
7. The method of claim 1 , wherein the method is applicable for use with Network Address Translation devices.
8. The method of claim 1 , wherein the session flow parameters are derived from the quintuple that contains the originating and terminating IP addresses and originating and terminating port numbers along with the protocol identifier.
9. A method of authenticating a transport packet stream in a managed packet network comprising the steps of: receiving at a RACF a request for service from a client application transmitted through a service control function, authorizing the request from the service control function; creating a key, K F , for a session flow to be established, K F being shared between said client application and a gateway; passing a quantity (X or Y, from which X can be determined) to the service control function, wherein X is included in a token to be passed to a client application, wherein a client determines a session flow key K F ; and creating a ticket, t, for a border gateway to be contacted, where t=K BGW (F, K F ), wherein the quantity X which is passed to the client utilizes the ticket as part of an encrypted value, wherein K BGW is a key shared between the RACF and border gateway.
10. A resource and control function apparatus comprising: a processor operable to receive a request for service from a client application transmitted through a service control function; and authenticating each packet of said transport packet stream, using a session key, based on session flow parameters associated with said transport packet stream without regard to identity of a client;
said apparatus is further operable to create a session key, K F , for a session flow to be established; pass a quantity to the service control function from which another quantity X can be determined, wherein X is included in a token to be passed to said client application, wherein said session key can be determined from X; create a ticket, t, for a border gateway to be contacted, where t=K BGW (F, K F ), wherein the quantity X which is passed to the client utilizes the ticket as part of an encrypted value, wherein K BGW is a key shared between the RACF and border gateway.
11. The method of claim 1 , further including a timer, T F , associated with the key, K F , at the time it is generated, wherein the key generation and distribution procedure is repeated, when the timer expires, further including a transition timer, Δ F , wherein the transition timer defines a time period when both the old and new keys are valid.
12. A method of authenticating a transport packet stream in a managed packet network comprising the steps of:
receiving at a RACF (Resource and Admission Control Function) a request for service from a client application transmitted through a service control function;
authenticating each packet of said transport packet stream, using a session key, based on session flow parameters associated with said transport packet stream without regard to identity of a client;
wherein the service control function passes an authorization to the client application, upon receiving which respective client application can start sending the packets within the flow, wherein a quantity X is included in a token to be passed to said client application, wherein a session key for authentication is determined from X;
and creating at said RACF a session key, K F , for a session flow F to be established; and creating a ticket, t, for a border gateway to be contacted, where t=K BGW (F, K F ), wherein t is used to determined the quantity X, wherein K BGW is a key shared between the RACF and border gateway.