WO2001022685A1

WO2001022685A1 - Method and arrangement for communications security

Info

Publication number: WO2001022685A1
Application number: PCT/SE2000/001795
Authority: WO
Inventors: Andras Gergely Valko; Istvan Maricza
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 1999-09-20
Filing date: 2000-09-15
Publication date: 2001-03-29
Also published as: SE9903370L; AU7694200A; SE9903370D0; SE519471C2

Abstract

In a method for establishing a secure communication in a packet based network comprising an access network (13) having access points (10) for two or more mobile terminals (11) belonging to the access network, a first access point is contacted by one mobile terminal in the intention of initiating a session from the mobile terminal. A secret key is generated using a function f stored in the access points acting on the information from the mobile terminal at the first access point by a converter known by two or more access points. The secret key is sent from the first access point to the mobile terminal using encryption, which is decrypted at the mobile terminal. The secret key is then used as a shared security key in communication between the mobile terminal and any access point knowing the converter.

Description

METHOD AND ARRANGEMENT FORCOMMUNICATIONS SECURITY

TECHNICAL FIELD

This invention is concerned with a method and arrangement in a communication network for establishing a secure connection between one or more access points and a terminal in a network. The invention is especially advantageous at handover processes in wireless packet based networks for communication with a mobile terminal .

BACKGROUND A security risk in wireless communication is that the information can be listened in to or intercepted by- unauthorised entities. Therefore, most wireless networks include some kind of built-in security functions. In the network there are of course, in addition to the different built-in security functions, access points which may require passwords and other information for entering the wireless network.

A risk in a packet data based network is that the packets transferred in the network may arrive at or be caught by wrong terminals. Another risk is that a terminal may impersonate another one and send packets on behalf thereof .

Hence, wireless packet data systems include the security risks of both wireless communication and packet data networks. These risks can potentially make the system highly vulnerable to security attacks. Reliable security functions are essential in getting wireless packet data networks widely accepted.

Other methods of making the communication between terminals communicating with each other in a network secure are end-to- end authentication and encryption. These methods ensure that the receiver can verify that a data packet has really been transmitted by the claimed sender and that third parties capturing data packets can not understand their content because they cannot be read without a given decryption key. Because packets can be captured and forged over wired as well as wireless links, end-to-end security solutions need not be wireless specific.

In wireless access networks, however, packets exchanged between mobile terminals - and wireless access points also carry important control information related to mobile users. This represents a potential security risk enabling malicious users to listen to or forge control information. Forged packets could interfere with routing, charging, location management or other functions associated with the attacked user. In addition to end-to-end security functions, wireless access networks therefore have local mechanisms to authenticate and encrypt packets exchanged between mobile devices and wireless access points .

By decoupling local authentication and encryption mechanisms from end-to-end security support it is ensured that charging and authentication information related to a particular mobile user remains protected even when the user is engaged in a "regular", i.e. unprotected session. In addition, decoupling allows mobile users to run secure data sessions over a secure wireless network without sharing end-to-end secret keys with the access network. It is furthermore advantageous if the endpoint of this local secure relationship at any time is the access point to which the mobile terminal is actually connected. This allows packets originating from mobile units to be authenticated as soon as they enter the access network. This is important because packets originating from mobile units may trigger actions related to charging and routing information associated with the sending mobile device .

Different methods of implementing secure relationships exist. Symmetric methods rely on a secret key shared by two or more entities. This key must be exchanged between the communicating parties prior to communication and the same key is used for both encryption and decryption. Before transmitting a packet, the sender uses the secret key to compute an authentication field or to encrypt a payload. The receiver uses the same key to verify the authentication field or to decrypt the packet. An example of a method of exchanging secret keys is disclosed in the RFC 2409 standard concerned with Internet Key Exchange. A secret key based packet authentication mechanism is presented in P. Metzger, : Simpson, "IP Authentication using Keyed MD5" , Internet RFC 1828, August 1995.

Asymmetric security solutions rely on pairs of public and private keys. An entity willing to send authenticated packets uses its own private, e.g. secret, key to generate the authentication field. In addition, the sender advertises the public key associated with its private key. Authentication data generated by a given private key can only be decoded using the associated public key. This allows receivers having the public key to determine whether the packet was really transmitted by the claimed sender.

PGP digital signatures are an example of asymmetric authentication. By means of the PGP software, two binary numbers are generated, the public and the private key. These are saved in a separate file, but the public key is converted to ASCII format so that it can be distributed to everyone that intends to send messages to the user. The private key shall be kept secret and it is even encrypted before saving.

In summary, both symmetric and asymmetric security techniques require the receiver to have some kind of security information associated with the sender. In symmetric solutions, this information is the shared secret key, whereas in asymmetric solutions it is the sender's public key. Security information must either be available to the sender and the receiver prior to communication or it must be obtained when the communication session is established.

A mobile terminal is allowed to roam large areas while maintaining connectivity to a wired network. The terminals may migrate from one access point to another during active communication sessions by means of handover methods. In an handover process, the access point through which the communication is performed is changed. Security considerations require the mobile terminal to have a secure relationship with the access point to which it is actually attached.

Due to the potentially large number of access points and mobile devices, there are benefits of not having a pre-established secure relationship with all access points of an access network. Instead, a secure relationship is established as the mobile terminal migrates to an access point.

Conventional methods require the access point to obtain security information from a central server at handover. These solutions do not give a smooth handover due to the time that they require and they are therefore in contradiction with the quality requirements of access networks. In addition, such methods encounter scalability problems because the load on the central server represents a single point of failure. Finally, such server based methods rely on explicit signalling messages between access points and servers, what raises problems in low- end packet data environments built without using signalling, such as those described in A. Valkδ, "Cellular IP - A new approach to Internet Host Mobility" ACM Computer Communication Review, Vol. 29, No. 1, January 1999, pp. 50-65.

Another solution for the access points is to obtain security information from an adjacent access point, to which the mobile terminal has been connected prior to handover. Whereas this solution eliminates the scalability problems represented by the server approach, it has similar disadvantages in terms of the requirement of relying on explicit signalling messages. In addition, some access networks may not support direct communication between access points .

MOTOROLA INC. discloses an example of a prior art handover method in the published International Patent Application WO 96/36191. It describes a system in which handover involves exchanging control messages between access points and (semi) - centralised control points. This system also gives a possibility for security information related to the mobile device to be exchanged in the same way. In the method disclosed in this prior patent application, there is a need for centralised control and for control messaging at handover. Another example of a method that involves control messages between access points at handover is disclosed in the published European Patent Application 0 851 633, filed by LUCENT TECHNOLOGIES INC. In the GSM technique (Global System for Mobile Telecommunications) , a conventional authentication method is used in which the mobile device is not in a secure relationship with the access point or base station. Instead, it is in secure relationship with the MSC, see M. Mouly, M-B. Pautet, "The GSM System for Mobile Communication", ISBN 2-9507190-0-7. A description of the GSM authentication details can be also found in the published International Patent Application WO 97/01943, p. 11, lines 1-25, these details described therein as being prior art .

Thus, existing methods of establishing secure relationship between mobile terminals and access points have serious limitations. Whereas the server-based approach is applicable to cellular telephony networks, it becomes inefficient in packet data systems in which the cell sizes typically are smaller and handovers thus more frequent .

The published International Patent Application WO 97/01943 instead discloses a solution to a similar problem as this invention, i.e. avoiding authentication-related messages between the base station and the central server for economical reasons . This prior art method uses a concept in which messages between the old and the new base stations are instead exchanged via the terminal .

SUMMARY OF THE INVENTION

The object of the present invention is to provide a method in which the mobile device is not required to act as a relay station thereby avoiding that the constrained radio resource and power available for the mobile device are used for this purpose. In addition, relaying through the mobile device only works if the mobile spends a sufficient amount of time within the area in which the two access points are reachable by wireless communication. Furthermore, the method disclosed in the cited International Patent Application WO 97/01943 is only capable of providing authentication once, when handover is performed. An object of this invention is to find a more general method in which any message sent between a mobile device and an access point can use the shared secret for security.

The general object of the invention is to provide a method that allows mobile terminals to establish secure relationships in a very short time at handover.

In addition, in association with the recent emergence of low- end access networks having no signalling support, the object of the invention is to provide a method that does not presuppose the use of any signalling messages for handover.

Thus generally, a method is provided to be used in a packet based communication network for establishing a secure communication between an access point and an entity, the network comprising an access network having access points for two or more entities belonging to the access network. A first access point is contacted in an access network with the intention to initiate a session from an entity in the network. A secret key is generated from the information obtained from the entity at the first access point using a converter known by two or more access points of the network. The secret key is sent from the first access point to the entity using encryption which is decrypted at the entity. The secret key is then used as a shared security key in communication between the mobile terminal and any access point of the network knowing the converter .

In the network as described herein, a function is stored in the access points for generating a secret key from identification information of the entities in the access network.

Initial authentication can be performed by the entity and then the initial authentication can be carried out by communicating identification information of the entity to a first access point in the network to prove the identity of the entity.

The identification information is non-encrypted or encrypted using a key that is shared by all entities in the access network.

The generation of the secret key in the converter can be carried out by means of a function f or by means of a secret number shared by the access points which use it as a parameter for a pre-defined, well-known function generating the secret key. The function f can be stored by the access point in a mathematical form or as a lookup table. The input of the function f could be the identification information of the first entity and the output is an arbitrary password.

An important benefit of the invention is that a secure communication between an access point in the access network and the mobile terminal can be achieved without any previous signalling about the identity of the mobile terminal . Even if each access point does not know the password of each mobile device, authentication and/or encryption can be achieved between a mobile device and any access point or base station in this method. This is achieved with the function f, which is used to generate a password for each mobile terminal. For the mobile device, the password appears to be random, but from the point of view of the access point, it is not random as it is generated by the same function.

The method can support any secret based authentication or encryption algorithm, for example CAST or IDEA. CAST is described in the Internet RFC 2144. IDEA is the "International Data Encryption Algorithm described at http: /www. ascom. ch/infosec/idea.html . No signalling messages in the access network are required, except for the initial distribution of the generated secret key. The avoiding of signalling messages at handover makes handover smoother because the only handover delay caused is the time that it takes to derive the secret key and the actual security calculation associated therewith.

Furthermore, the method described herein can be combined with other security techniques, e.g. mobile terminals may use generated secret keys to authenticate packets and at the same time use the public key of the access network to encrypt the same packets. Due to the low cost involved, it can be used to authenticate each data packet if necessary. In this case, it is advantageous for the access point to temporarily store generated secret keys associated with devices currently connected to it. Finally, the method described herein scales to almost an arbitrary number of access points and mobile terminals. In systems in which handover does not need control information exchange between the old and new access points or between access points and central controllers, it becomes a burden if the security key must be explicitly exchanged between these entities. The method as described herein is especially important in these systems .

In the following, the method will be explained by examples. The intention is not to restrict the invention to the details of the following description, as the details can vary in accordance with the claims. For example, even if the example is described as concerning wireless networks, the invention is, in addition to wireless access networks, applicable to all scenarios in which an entity needs to establish secure relationship with a set of entities, which are in secure relationship with one another. The main idea is that, one entity can perform some initial security negotiation with one of the other entities and after the initial security negotiation, the entity must be able to start secure communication without further negotiation and without the entities having to communicate with one another in forehand.

BRIEF DESCRIPTION OF THE DRAWINGS

- Figure 1 is a schematic view of a network allowing a secure communication between an access point and an entity,

- Figure 2 is a general block scheme of a method performed in the network of Figure 1 for establishing the secure communication, and

- Figure 3 is a detailed example of an embodiment of the invention.

DETAILED DESCRIPTION In Figure 1, a network 14 is shown, comprising an access network 13 having access points 10, through which mobile terminals 11 can establish communication with the access network. The network also comprises a server 12 storing information on the mobile terminals belonging to the access network.

The access network 13 represents a single administrative domain and its access points 10 and potentially other entities may have shared secrets, like public encryption keys. In one embodiment, an encryption system comprising public and private keys is used. Thus, all the entities in the access network share the public encryption keys for encryption of their messages, whereas every entity has an own private key for decryption.

All access points are aware of a function f . The function f can be almost any function as long as each access point knows it . The input of the function is the identifier or identification information of the mobile terminal and its output is a number.

It should not be easy, e.g. to an intruder, to determine the function f, but it does not have to be a cryptographically strong function. An example of the function f is to compute the MD5hash, described in R. Rivest, "MD5 Digest Algorithm", RFC 1321, April 1992, from the concatenation of the mobile terminal identifier and the secret password of the access network, which can be any secret shared by the access points . Instead of sharing a secret function f, the access points can share a secret number and use it as a parameter for a pre-defined, well-known function. Outputs of f may be fixed or have variable lengths. In addition, it is not required for f to necessarily provide different outputs for two different input identifiers. However, it is required for f to be known by all access points of the network and to be unknown to entities not belonging to the access- network. Access points will typically store f either in a mathematical form as an algorithm or as a lookup table.

Referring now to Figure 2, a mobile terminal 11 first performs initial authentication and thereafter connecting to an access network according to step 1. This step may be omitted in access networks that allow any device to connect to it. The initial authentication process may be identical to authentication solutions generally used in the Internet, because it is performed only once and delay requirements can be relaxed. Upon the initial authentication, the access network uses its secret function f to convert the mobile terminal identifier to an output that here will be called the generated secret key in accordance with step 2. This output is then communicated to the mobile terminal in accordance with step 3 using encryption so that other terminals cannot capture it. After that, communication between the mobile terminal and the access point can take place using the generated secret key. The mobile terminal can send messages via the access point and messages from the access point can be sent using the generated secret key.

The generated secret key can be used for encryption of packets. Other aspects of security are authentication, data integrity, and non-repudiation. In this application encryption means protecting the content of messages so that only those users who have the right key can read it. In authentication, the receiver verifies that the message was transmitted by the claimed origin and was not transmitted by somebody else. In non-repudiation, the receiver proves that the sender transmitted the message or the receiver received the message .

One possible solution of the initial authentication and transmitting the generated secret key is described in Figure 3. Using the same reference numbers as in Figure 1, the access points are indicated by the reference number 10, the mobile terminals by the reference number 11 and the server by the reference number 12.

When a mobile terminal 11 starts a session, it first communicates its global mobile terminal identifier to an access point 10 of the access network in step 1' . This allows the access network to find and contact a server 12 in step 2 ' that contains security information related to the mobile terminal 11. In step 4', the access network downloads the public cryptographic key of the mobile terminal 11 sent from the sender 12 in step 3' and uses it to encrypt the generated secret key in step 5' . Alternatively, the access point can obtain a private encryption key and use it to encrypt the generated secret key, as a message can be encrypted using either the public or private encryption key. The access network can obtain the secret private key of the mobile terminal if the access network has a secure relationship with the "home" of the mobile terminal or with any server that knows this secret private key. Then it can get the secret private key and use it for encryption.

This has not to be done by the access point. Instead, the access network can have a central unit that does this . When the mobile terminal first contacts one of the access points, this access point informs the central unit server on the mobile device having come in contact . Then the central unit contacts the home of the mobile terminal and gets the secret key if there is trust among access networks. Next, it encrypts the generated secret key using the private key and sends it to the terminal .

Next, the encrypted generated secret key is transmitted over the wireless channel to the mobile terminal 11 as is indicated in step 6' . If the mobile terminal 11 is indeed the device that it claimed to be, it can decrypt the generated secret key in accordance with reference number 7' using its private encryption key. The transmitted message is useless for any other mobile terminal . The mobile terminal 11 can now use the generated secret key to authenticate or encrypt its packets in accordance with reference number 8' and send them to any access point in the access network.

Following the initial authentication, the mobile terminal shares a secret with all access points of the access network. This is achieved without the mobile terminal ever having contacted the access points, and hence the method is scalable to very large networks . The mobile terminal and the access points can now use any shared secret based security technique available. At the same time, the access network has different secrets to share with different mobile terminals.

Even if the mobile terminal can use the generated secret key to authenticate and/or encrypt its packets, using the generated secret key never encrypts the identifier of the mobile terminal . The identifier is either not encrypted at all or it is encrypted using another key that is shared by all mobile terminals, e.g. the public encryption key of the access network. This allows the access points to identify the claimed sender of received packets . The access point then uses f to compute the generated secret key of the claimed sender.

Using the generated secret key, the mobile terminal can then decode the authentication information to verify the identity of the sender and/or it can decrypt the packet. Similarly, access points can use the generated secret key to encrypt or authenticate a packet transmitted to a given mobile terminal, which can then decrypt or verify the packet using its own generated secret key.

If a sequence of authenticated/encrypted packets from the same mobile terminal are likely to arrive to the access point, then the access point may temporarily store the mapping of mobile terminal identifiers to generate secret keys later in order to avoid frequent recomputing of generated secret keys .

In systems using non-encrypted wireless channels, the transmission of plain text mobile terminal identifiers is not acceptable if the identity of attached mobile devices should be kept secret. In these cases, the initial authentication process can include the assignment of a possible random, temporary identifier to the mobile terminal or encrypting the real identifier using the public cryptographic key of the access network can generate a temporary identifier. The secret key will then be generated using the temporary identifier, but in other aspects, the mechanism remains the same.

Some wireless channels have built-in security, whereas other ones have no such functionality. In the latter case, higher layers will provide security information. The invention is applicable for both cases.

Claims

1. A method in a communication network (14) for establishing a secure communication between an access point (10) and an entity (11) , the communication network being a packed based network comprising an access network (13) having access points for at least two entities belonging to the access network, the method characterized by the steps of : a) contacting a first access point by an entity in the access network in the intention of initiating a session from the entity in the communication network, b) generating a secret key from the information obtained from the entity at the first access point by a converter known by two or more access points of the network, c) sending the secret key from the first access point to the entity using encryption, d) decrypting the secret key at the entity, and e) using the secret key as a shared security key in communication between the mobile terminal and any access point of the network knowing the converter.

2. A method according to claim 1, characterized in that step a) is carried out by performing initial authentication by the entity.

3. A method according to claim 2 , characterized in that the initial authentication is carried out by communicating identification information of the entity to a first access point in the network to prove the identity of the entity.

4. A method according to claim 3 , characterized in that the identification information is encrypted using a key that is shared by all entities in the access network.

5. A method according to claim 3 , characterized in that the identification information is non-encrypted.

6. A method according to any of claims 1 - 5, characterized in that the generation of the key in step b) is carried out by means of a function f .

7. A method according to any of claims 1 - 5, characterized in that the generation of the key in step b) is carried out by means of a secret number shared by the access points which use it as a parameter for a pre-defined, well-known function generating the secret key.

8. A method according to claim 6, characterized in that the function f is stored by the access point in a mathematical form or as a lookup table .

9. A method according to claim 6 , characterized in that the input of the function f is the identification information of the first entity and the output is a password.

10. A method according to any of claims 1 - 9, characterized in that after having received the identification information of the entity, the access point takes contact with a server (12) having information on the entities belonging to the access network to download a public cryptographic key of the entity, which is used in the encryption of point c) .

11. A method according to any of claims 1 - 9, characterized in that after having received the identification information of the entity, the access point takes contact with a server having or being allowed to get information about the entities belonging to the access network to download a private cryptographic key of the entity, which is used in the encryption of point c) .

12. A method according to any of claims 1 - 11, characterized in that the encryption is performed by the access point.

13. A method according to any of claims 10 or 11, characterized in that the encryption is performed by the server.

14. A method according to any of claims 1 - 13 , characterized in that the decryption of step d) is carried out using a private encryption key of the entity.

15. A method according to any of claims 1 - 14, characterized in that in step e) the generated secret key is used by the entity for authentication, data integrity, non-repudiation and/or encryption of its packets.

16. A method according to claim 15, characterized in that the authentication information or the packets sent from the entity is/are decoded at the access point using the generated secret key.

17. A method according to any of claims 1 - 16, characterized in that the generated secret key is used by the access points to send protected messages to the mobile terminal .

18. A method according to any of claims 1 - 17, characterized in that the access network is a wireless access network and the entities are mobile terminals.

19. A packet based network, comprising an access network (13) having access points (10) for at least two entities (11) belonging to the access network, allowing a secure communication between the access points of the access network and an entity, characterized by a function f stored in the access points for generating a secret key from identification information of the entities in the access network.

20. A packed based network according to claim 19, characterized in that the function f is stored by the access point in a mathematical form or as a lookup table, by means of which the secret key can be generated.