Cryptography – Cellular telephone cryptographic authentication
Reexamination Certificate
1999-09-28
2004-07-13
Morse, Gregory (Department: 2134)
Cryptography
Cellular telephone cryptographic authentication
C380S270000
Reexamination Certificate
active
06763112
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to a security procedure for use with a Universal Mobile Telephone Service (UMTS), the security procedure being performed in response to a detection of a communication failure between a Mobile Station (MS) and a Radio Network Controller (RNC) related to security such as a failure of an integrity check or a ciphering failure.
2. Description of the Related Art
A Universal Mobile Telephone Service (UMTS) is a network platform for a third-generation mobile communication system which aims to deliver seamless services for a subscriber and is usable across many networks. In general, the UMTS system includes a Core Network (CN) connected to a plurality of Universal Radio Access Networks (URANs). The CN comprises two parts: a first part adapted for circuit switch traffic (e.g. a Mobile Switching Center (MSC) and Visiting Location Register (VLR)) and a second part adapted for packet switch traffic (e.g. a Serving GPRS Support Node (SGSN)). Each URAN provides radio coverage over a prescribed geographical area referred to as a URAN Area (URA). To provide this coverage, each URAN includes a Radio Network Controller (RNC) which controls at least one Base Station (BS). The RNC is interconnected with other RNCs to perform switching operations and mobility management. The CN is connectable to all other types of networks to provide the subscriber with seamless services.
The movement of an MS from one URA (called an old URA) to a new URA initiates a URA update performed by the RNC of the new URA so that the MS can be reached when required. It is in the interest of the network operator to ensure that the MS initiating the URA update is a valid user. The validation involves the RNC performing an integrity check which is an authentication of the packet transmission between the RNC and the MS.
Each MS (which is also referred to as UMTS Equipment (UE)) includes a Subscriber Identity Module (SIM) card containing databases and executable files. The SIM card contains in its databases an International Mobile Subscriber Identity (IMSI), location information pertaining to the present location of the MS, an integrity key IK, and other security and administrative information. The location information is updated on the SIM card after each call termination, when the handset is properly deactivated, and when the MS moves from one URA to another. The location information includes a temporary anonymous identification used within each URA which may be known as the Temporary Mobile Subscriber Identity (TMSI), Packet TMSI (PTMSI), or Radio Network Temporary Identification (RNTI). The TMSI or other temporary identification is used as a security measure to provide an anonymous identity instead of using the IMSI which identifies the specific MS. As a further security measure, the communications between the MS and the URAN are encrypted using an encryption key. The encryption key is usually a ciphering key CK which is stored in an Authentication Center (AuC) or a Home Location Register (HLR).
The prior art integrity check in a UMTS System will now be described with reference to FIG.
5
. The integrity check is initiated when the MS initiates the establishment of a Radio Resource Connection (RRC) by sending a COUNT parameter to the RNC, step
1
. The COUNT is a time dependent value that is incremented at both sides of the radio link every 10 ms. A user stores the last used COUNT parameter and increments it by one to ensure that no COUNT value is reused (by the network) with the same integrity key IK.
The RNC stores the received COUNT parameter, step
2
. The MS then transmits an Initial L
3
Message such, for example, as a Location update request, a Communications Management (CM) service request, or a Routing Area Update Request to the relevant CN, step
3
. The Initial L
3
Message will contain relevant mobility management (MM) information, MS identity using, for example, a temporary identification as described above, an MS classmark IE, which includes information on the UMTS Integrity Algorithms (UIAs) and the UMTS Encryption Algorithms (UEAs) supported by the MS, and a Key Set Identifier (KSI) which is the number allocated by the CN at the last authentication for this CN domain.
After the MS has transferred all this information, an authentication of the packet and generation of new security keys such as the integrity key IK and the ciphering key CK may be performed, step
4
. A new KSI will then also be allocated. Therefore the authentication procedure is used to change IK and CK, in addition to authenticate the information packet transmitted by the user.
To perform the packet authentication, the CN selects UIAs and UEAs that are allowed to be used. The CN initiates the integrity check (and possible also a ciphering update) by sending a RANAP message “Security Mode Command” to the RNC, step
6
. This message includes the allowed UIAs and the IK to be used. It may also contain the allowed UEAs and the CK to be used if a ciphering update is required. This message also includes the UE classmark IE which is transmitted transparently to the MS through the RNC.
The RNC determines which of the allowed UIAs and UEAs to use, generates a random value FRESH and initiates the downlink integrity protection, step
7
. The RNC then generates the RRC message “Security Control Command” including a random challenge RAND and an authentication token for network authentication AUTN. This message also includes the UE classmark IE, the UIA and the random value FRESH. The UEA to be used and additional information related to start of ciphering may also be included if a ciphering update is being performed. At this point there are two CNs, each with its own IK. Accordingly, the network must indicate which IK to use. This is accomplished by including a CN type indicator information in the “Security Control Command” message. Before sending the “Security Control Command” message to the MS, the RNC generates a MAC-I (Message Authentication Code for Integrity) and attaches this information to the message.
Upon receiving the “Security Control Command” message including the RAND AUTN with the MAC-I, the MS verifies that the UE classmark IE received from the RNC is equal to the UE classmark IE sent in the initial L
3
message and then computes a XMAC-I based on the message received by using the indicated UIA, the stored COUNT and the received FRESH parameter. The UE then verifies the data integrity of the message by comparing the received MAC-I with the generated XMAC-I, step
9
.
If step
9
is successful, the MS computes a “Security Control Response” (RES) of the RRC message and generates a second MAC-I for this message. The MS then transmits the “Security Control Response” with the second MAC-I to the RNC, step
10
.
Upon receipt of the RES message, the RNC computes a second XMAC-I based on the RES as an input to the UIA. The RNC then verifies the data integrity of the message by comparing the received second MAC-I with the generated second XMAC-I, step
11
. When the data integrity is verified at step
11
, the RNC transmits a RANAP “Security Mode Complete” message to the CN to end the integrity procedure, step
12
.
The “Security Mode Command” in step
6
to MS starts the downlink integrity protection, i.e. all following messages sent to the MS are integrity protected. The “Security Control Response” transmitted by the MS starts the uplink Integrity protection, i.e. all following messages sent from the MS are integrity protected.
If a communication failure occurs because the above described integrity check fails or because the deciphering fails, the RNC does not know what to do (as it can not perform the authentication procedure of the MS) and the MS will be disconnected. One of the reasons this may occur is that the ciphering key CK or the integrity key IK of a valid MS does not match the ciphering key or integrity key IK stored in the RNC. This situation also presents itself if a radio link is disrupted and restarted in which case the RNC or the MS, for security
Brown Christopher J.
Cohen & Pontani, Lieberman & Pavane
Morse Gregory
Nokia Networks Oy
LandOfFree
Security procedure in universal mobile telephone service does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Security procedure in universal mobile telephone service, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Security procedure in universal mobile telephone service will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3208459