Granted Patent B2

US 8,379,854 · App. 12/285,336 · Granted Feb 19, 2013

Abstract

Claims (55)

1. A method performed by mobile equipment to authenticate communication with a network, the method comprising:

receiving, at the mobile equipment, authentication information from a network;

obtaining, at the mobile equipment, a first random number from the received authentication information, the first random number being a random number that the mobile equipment had sent the network;

generating, at the mobile equipment, at least one mobile equipment key based on the first random number using cellular authentication and voice encryption;

obtaining, at the mobile equipment, a second random number from the received authentication information, the second random number being associated with the network;

generating, at the mobile equipment, at least one network key from the second random number using the cellular authentication and voice encryption;

generating, at the mobile equipment, an authentication key that includes hashing together the mobile equipment key and the network key;

generating, at the mobile equipment, an expected network message authentication code based on the authentication key and at least a portion of the received authentication information according to authentication and key agreement security protocol; and

authenticating the network based on the expected network message authentication code.

2. The method of claim 1 , wherein the authenticating step comprises:

obtaining a message authentication code from the received authentication information; and

comparing the expected message authentication code to the obtained message authentication code.

3. The method of claim 2 , wherein the authenticating step further comprises:

comparing the first random number with a third random number stored in the mobile equipment; and

sending a resynchronization message to the network if the first random number does not match the third random number.

4. The method of claim 3 , wherein the resynchronization message includes at least a portion of the third random number.

5. The method of claim 2 , wherein the received authentication information includes a sequence number field, an authentication management field, and an authentication key agreement random number field, and further comprising:

determining if a sequence number in the sequence number field is within a permissible range; and

sending a resynchronization message if the sequence number is determined not to be within the permissible range.

6. The method of claim 5 , wherein the resynchronization message includes a sequence number stored in the mobile equipment.

7. The method of claim 1 , wherein the received authentication information includes a sequence number field, an authentication management field, and an authentication key agreement random number field, and further comprising:

obtaining a message authentication code from the received authentication information;

comparing the expected message authentication code to the obtained message authentication code;

comparing the first random number with a third random number stored in the mobile equipment; and

determining if a sequence number in the sequence number field is within a permissible range; and

sending an authentication response to the network if the expected message authentication code matches the obtained message authentication code, the first random number matches the third random number, and the sequence number field is within the permissible range.

8. The method of claim 1 , wherein

the received authentication information includes a sequence number field, an authentication management field, and an authentication key agreement random number field; and

the first random number includes a portion of the sequence number field, the authentication management field and a portion of the authentication key agreement random number field.

9. The method of claim 8 , wherein the first random number has a length of at least 64 bits.

10. The method of claim 1 , wherein the authentication key is a 128-bit authentication and key agreement (AKA) protocol key.

11. A method performed by a network to establish the network with a mobile equipment, the method comprising:

generating, at a network node, a challenge including a sequence number field, an authentication management field, and a random number field, the sequence number field including a sequence number and a portion of a first random number the network had received from the mobile equipment, the authentication management field including another portion of the first random number, and the random number field includes a second random number and a further portion of the first random number; and

obtaining, at the network node, at least one mobile equipment key using the first random number;

obtaining, at the network node, at least one network key using a second random number;

generating, at the network node, an authentication key that includes hashing together the mobile equipment key and the network key;

generating, at the network node, a first message authentication code based on the authentication key according to authentication and key agreement security protocol;

generating, at the network node, an authentication token based on the sequence number in the sequence number field, the authentication management field and the first message authentication code;

sending, at the network node, the challenge and the authentication token to the mobile equipment.

12. The method of claim 11 , further comprising:

receiving a response to the challenge and authentication token from the mobile equipment; and

establishing a mutually authenticated communication channel with the mobile equipment based on the response.

13. The method of claim 11 , wherein the sequence number field includes a flag controlling whether the mobile equipment generates a new random number for use during authentication.

14. The method of claim 11 , further comprising:

receiving a resynchronization message from the mobile equipment, the resynchronization message includes a third random number and a second message authentication code.

15. The method of claim 14 , wherein the second random number included in the resynchronization message has a length of at least 64 bits.

16. The method of claim 14 , further comprising:

verifying the mobile equipment based on the second message authentication code; and

storing the second random number for generating another challenge for the mobile equipment if the mobile equipment is verified.

17. The method of claim 11 , further comprising:

receiving a resynchronization message from the mobile equipment, the resynchronization message includes a number of bits indicating the resynchronization message includes a sequence number associated with the mobile equipment, the resynchronization message further includes the sequence number associated with the mobile equipment and a second message authentication code.

18. The method of claim 17 , further comprising:

verifying the mobile equipment based on the second message authentication code; and

storing the sequence number associated with the mobile equipment for generating another challenge if the mobile equipment is verified.

19. The method of claim 11 , wherein the authentication key is a 128-bit authentication and key agreement (AKA) protocol key.

Assignments (6)