Two-factor authentication in a cellular radio access network
A method for authenticating radio access network devices is disclosed, comprising: authenticating, at a coordination server, a base station in a radio access network using a first authentication factor; selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database; sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station; receiving, from the base station at the coordination server, a response to the challenge question; verifying, at the coordination server, the correctness of the response using a key derived from the historical information; and granting the base station access to a core network of a mobile operator, thereby addressing security issues unsolved by one-factor authentication.
1. A method for authenticating radio access network devices, comprising:
authenticating, at a coordination server, a base station in a radio access network using a first authentication factor;
selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station including continuously developing events stored within a database;
sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station, wherein the challenge question is based on a first key derived from the historical information;
receiving, from the base station at the coordination server, a response to the challenge question;
verifying, at the coordination server, the correctness of the response using a second key derived from the historical information; and
granting the base station access to a core network of a mobile operator, thereby addressing security issues unsolved by one-factor authentication.
2. The method of claim 1 , wherein the historical information further comprises a base station identifier, a timestamp, and an event type.
3. The method of claim 1 , wherein the historical information is based on a user equipment (UE) attach event.
4. The method of claim 1 , further comprising receiving an index of the historical information at the coordination server from a database server.
5. The method of claim 1 , further comprising forwarding, from the coordination server, the historical information to a database server.
6. The method of claim 1 , further comprising, at the base station, using an index of the historical information and a local copy of the historical information to derive a secret key at the base station.
7. A non-transitory computer-readable medium which, when executed by a processor at a server, causes the server to perform:
authenticating, at a coordination server, a base station in a radio access network using a first authentication factor;
selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database;
sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station, wherein the challenge question is based on a first key derived from the historical information including continuously developing events;
receiving, from the base station at the coordination server, a response to the challenge question;
verifying, at the coordination server, the correctness of the response using the first key derived from the historical information; and
granting the base station access to a core network of a mobile operator, thereby addressing security issues unsolved by one-factor authentication.