Fast authentication for inter-domain handovers
Fast mobile device authentication can be achieved during inter-domain handovers between administrative domains operating under a federated service agreement using pseudonym identifications (PID). Specifically, the mobile device may derive a PID when obtaining authentication in a first wireless network, and then use the PID to obtain fast authentication in a second wireless network. The PID may be generated during an Elliptic curve Diffie-Hellman (ECDH) authentication procedure using public keys associated with the mobile device and the first wireless network. The PID (or a derivative thereof) may then be provided to an authentication server in a second wireless network for validation. The PID may be validated by the second authentication server via online or offline validation procedures. The PID can also be used as an electronic coupon for accessing the second network.
1. A method for fast authentication, the method comprising:
deriving, by a mobile station, a pseudonym identification (PID) during an Elliptic Curve Diffie-Hellman (ECDH) key exchange with a first authentication server in a first wireless access network, wherein the PID is not known by the first authentication server; and
obtaining, by the mobile station, authentication from a second authentication server in a second wireless access network in accordance with the PID derived during the ECDH key exchange between the mobile station and the first authentication server, wherein the first wireless network and the second wireless network are controlled by different network operators.
2. The method of claim 1 , wherein the first wireless network and the second wireless network operate in different administrative domains.
3. The method of claim 1 , wherein the first wireless network is operated by a first network operator, and wherein the second wireless network is operated by a second network that is in a federated agreement with the first network operator.
4. The method of claim 1 , wherein deriving the PID during the ECDH key exchange with the first authentication server comprises:
sending, by the mobile station, a first public key or a derivative of the first public key to the first authentication server, the first public key being associated with the mobile station;
receiving, by the mobile station, a second public key or a derivative of the second public key from the first authentication server; and
deriving, by the mobile station, the PID in accordance with the first public key and the second public key.
5. The method of claim 4 , wherein obtaining authentication from the second authentication server in the second wireless network in accordance with the PID comprises:
sending, by the mobile station, the first public key or the derivative of the first public key to the second authentication server;
computing a hash value of the PID; and
sending the hash value of the PID to the second authentication server, wherein the hash value of the PID is configured to be validated by the second authentication server to authenticate the mobile station in the second wireless network.
6. A method for fast authentication, the method comprising:
deriving, by a mobile station, a pseudonym identification (PID) during an Elliptic Curve Diffie-Hellman (ECDH) key exchange with a first authentication server in a first wireless access network, wherein deriving the PID during the ECDH key exchange with the first authentication server includes sending a first public key associated with the mobile station, or a derivative of the first public key, to the first authentication server, receiving a second public key or a derivative of the second public key from the first authentication server, and deriving the PID in accordance with the first public key and the second public key; and
obtaining, by the mobile station, authentication from a second authentication server in a second wireless access network in accordance with the PID derived during the ECDH key exchange between the mobile station and the first authentication server, wherein the first wireless network and the second wireless network are controlled by different network operators, wherein obtaining authentication from the second authentication server in the second wireless network in accordance with the PID comprises sending the first public key or the derivative of the first public key to the second authentication server, computing a hash value of the PID, and sending the hash value of the PID to the second authentication server, wherein the hash value of the PID is validated by the second authentication server to authenticate the mobile station in the second wireless network, and wherein the hash value of the PID is configured to be validated via a validation protocol between the second authentication server and the first authentication server.
7. A method for fast authentication, the method comprising:
deriving, by a mobile station, a pseudonym identification (PID) during an Elliptic Curve Diffie-Hellman (ECDH) key exchange with a first authentication server in a first wireless access network, wherein deriving the PID during the ECDH key exchange with the first authentication server includes sending a first public key associated with the mobile station, or a derivative of the first public key, to the first authentication server, receiving a second public key or a derivative of the second public key from the first authentication server, and deriving the PID in accordance with the first public key and the second public key; and
obtaining, by the mobile station, authentication from a second authentication server in a second wireless access network in accordance with the PID derived during the ECDH key exchange between the mobile station and the first authentication server, wherein the first wireless network and the second wireless network are controlled by different network operators, wherein obtaining authentication from the second authentication server in the second wireless network in accordance with the PID comprises sending the first public key or the derivative of the first public key to the second authentication server, computing a hash value of the PID, and sending the hash value of the PID to the second authentication server, wherein the hash value of the PID is validated by the second authentication server to authenticate the mobile station in the second wireless network, and wherein the hash value of the PID is configured to be validated via an offline validation procedure by the second authentication server, the offline validation procedure enabling the second authentication server to validate the hash value of the PID without communicating with the first authentication server in real-time.
8. A mobile station comprising:
a processor; and
a computer readable storage medium storing programming for execution by the processor, the programming including instructions to:
derive a pseudonym identification (PID) during an Elliptic Curve Diffie-Hellman (ECDH) key exchange with a first authentication server in a first wireless access network, wherein the PID is not known by the first authentication server; and
obtain authentication from a second authentication server in a second wireless access network in accordance with the PID derived during the ECDH key exchange between the mobile station and the first authentication server,
wherein the first wireless network and the second wireless network are controlled by different network operators.
9. The mobile station of claim 8 , wherein the first wireless network and the second wireless network operate in different administrative domains.
10. The mobile station of claim 8 , wherein the first wireless network is operated by a first network operator, and wherein the second wireless network is operated by a second network that is in a federated agreement with the first network operator.
11. The mobile station of claim 8 , wherein the instructions to derive the PID during the ECDH key exchange with the first authentication server include instructions to:
send a first public key or a derivative of the first public key to the first authentication server, the first public key being associated with the mobile station;
receive a second public key or a derivative of the second public key from the first authentication server; and
derive the PID in accordance with the first public key and the second public key.
12. The mobile station of claim 11 , wherein the instructions to obtain authentication from the second authentication server in the second wireless network in accordance with the PID include instructions to:
send the first public key or the derivative of the first public key to the second authentication server;
compute a hash value of the PID; and
send the hash value of the PID to the second authentication server.
13. The mobile station of 12 , wherein the hash value of the PID is validated by the second authentication server to authenticate the mobile station in the second wireless network.
14. The mobile station of 13 , wherein the hash value of the PID is validated via a validation protocol between the second authentication server and the first authentication server.
15. The mobile station of 13 , wherein the hash value of the PID is validated via an offline validation procedure by the second authentication server, the offline validation procedure enabling the second authentication server to validate the hash value of the PID without communicating with the first authentication server in real-time.