Secure negotiation of authentication capabilities

(57) Abrégé/Abstract:

A network (20) comprises an authenticator node (22) and a server (24) such as an authentication, authorization, and accounting (AAA) server. A method comprises a terminal (30) sending authentication capabilities information (AC) across a network access interface (32) to the network (the authentication capabilities information provides an indication of authentication capabilities of the terminal). The network (20) then uses the authentication capabilities information to determine a first cryptographic value. The terminal (30) then uses the authentication capabilities information to determine a second cryptographic value. The network (20) compares the first cryptographic value and the second cryptographic value to authenticate the terminal.

Canada http://opic.gc.ca · Ottawa-Hull K1A 0C9 · http://cipo.gc.ca

O PI c

<img file="CA2736172C_D0001.tif" />

CIPO

OPIC-CIPO 191

CA 02736172 2011-03-04 (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)

<img file="CA2736172C_D0002.tif" />

(10) International Publication Number

WO 2010/027314 Al

PCT (19) World Intellectual Property Organization

International Bureau (43) International Publication Date 11 March 2010 (11.03.2010) (51) International Patent Classification:

H04W12/12 (2009.01) H04W88/08 (2009.01)

H04W12/06 (2009.01) H04L 29/06 (2006.01) (21) International Application Number:

PCT/SE2009/050554 (22) International Filing Date:

May 2009 (18.05.2009) (25) Fifing Language: English (26) Publication Language: English (30) Priority Data:

61/094,715 5 September 2008 (05.09.2008) US

12/463,461 11 May 2009 (11.05.2009) US (71) Applicant (for all designated States except US): TELEFONAKTIEBOLAGET L M ERICSSON (PUBL) [SE/ SE]; S-164 83 Stockholm (SE).

(72) Inventors; and (75) Inventors/Applicants (for US only): THAKARE, Kir an [SE/SE]; Fatburs Brunnsgata 26, S-118 28 Stockholm (SE). NÂSLUND, Mats [SE/SE]; Stopvagen 95, S-168 36 Bromma (SE). ERNSTRÔM, Per [SE/SE]; Anders Reimers vâg 4, 3tr, S-l 17 50 Stockholm (SE).

(74) Agent: HASSELGREN, Joakim; Ericsson AB, Patent Unit LTE, S-164 80 Stockholm (SE).

(81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BR, BW, BY, BZ, CA, CH, CN, CO, CR, CU, CZ, DE, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IS, JP, KE, KG, KM, KN, KP, KR,

KZ, LA, LC, LK, LR, LS, LT, LU, LY, MA, MD, ME,

MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PG, PH, PL, PT, RO, RS, RU, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW.

(84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LS, MW, MZ, NA, SD, SL, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, MD, RU, TJ, TM), European (AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, ΓΓ, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, SE, SI, SK, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, ML, MR, NE, SN, TD, TG).

Declarations under Rule 4.17:

— of inventorship (Rule 4.17(iv))

Published:

— with international search report (Art. 21(3)) wo 2010/027314 Al llllllllllllllllllllllllllllllllllllllllllllllllllllllllli (54) Title: SECURE NEGOTIATION OF AUTHENTICATION CAPABILITIES

<img file="CA2736172C_D0003.tif" />

Fig. 6 (57) Abstract: A network (20) comprises an authenticator node (22) and a server (24) such as an authentication, authorization, and accounting (AAA) server. A method comprises a terminal (30) sending authentication capabilities information (AC) across a network access interface (32) to the network (the authentication capabilities information provides an indication of authentication capabilities of the terminal). The network (20) then uses the authentication capabilities information to determine a first cryptographic value. The terminal (30) then uses the authentication capabilities information to determine a second cryptographic value. The network (20) compares the first cryptographic value and the second cryptographic value to authenticate the terminal.

FAX 0046107175695 ⁿ¹'ⁿ7 ⁿ 1 «. 28

Printed: 19/07/2010 , &gt; y ..........* «c

---- *”»&lt;&gt; ^w~'^,hen

DESCPAMD

PCT/SE 2009/050 55?-²S?-9?^.⁵A(

CA 02736172 2011-03-04

SECURE NEGOTIATION OF AUTHENTICATION CAPABILITIES

This application claims the priority and benefit of United States Provisional patent application 61/094,715, filed September 5, 2008, entitled “SECURE NEGOTIATION OF AUTHENTICATION CAPABILITIES”.

TECHNICAL FIELD

This invention pertains to telecommunications, and particularly to authentication of communications.

BACKGROUND [0001] In a typical cellular radio system, wireless terminals (also known as mobile stations and/or user equipment units (UEs)) communicate via a radio access network (RAN) to one or more core networks. The wireless terminals can be mobile stations or user equipment units (UE) such as mobile telephones (“cellular” telephones) and laptops with wireless capability), e.g., mobile termination), and thus can be, for example, portable, pocket, hand-held, computer-included, or car-mounted mobile devices which communicate voice and/or data with radio access network.

(0002] The radio access network (RAN) covers a geographical area which is typically divided into cell areas, with each cell area being served by a base station, e.g., a radio base station (RBS), which in some networks is also called “BS” in WiMAX, “AP” in WLAN, and also known as “NodeB” or “B node” in 3^rd generation mobile networks. A cell is a geographical area where radio coverage is provided by the radio base station equipment at a base station site. Each cell and/or base station is identified by an identity within the local radio area, which is broadcast in the cell. The base stations communicate over the air interface operating on radio frequencies with the user equipment units (UE) within range of the base stations.

[0003] In some versions (particularly earlier versions) of the radio access network, several base stations are typically connected (e.g., by landlines or microwave) to a radio network controller (RNC). The radio network controller, also sometimes termed a base station controller (BSC), supervises and coordinates various activities ion. 01.07.2010 15.17:09 - 01.07.2010 15:30:18. This page 12 of 5\ urMnrn cijrrpOl015:19:52 · AMENDED SHEET mm/omn

Jceived at the EPO on Jul 01,2010 15:30:18. Page 12 of 53 01/07/2010 '’’ίL“V 29 FAX 0046107175695 .-«o. “r--hen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04

Rinio/Aco,

PCT/SE 2009/050 55?-²5?-δ?^⁵Αθ of the plural base stations connected thereto. The radio network controllers are typically connected to one or more core networks. The base stations may also have means for enabling the hand over of wireless terminals between base stations, either assisted by the core network, or using direct base station interconnections.

[0004] The Universal Mobile Telecommunications System (UMTS) is a third generation mobile communication system, which evolved from the Global System for Mobile Communications (GSM), and is intended to provide improved mobile communication services based on Wideband Code Division Multiple Access (WCDMA) access technology. UTRAN is essentially a radio access network using wideband code division multiple access for user equipment units (UEs). The Third Generation Partnership Project (3 GPP) has undertaken to evolve further the UTRAN and GSM based radio access network technologies.

[0005] Specifications for the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) are ongoing within the 3^rd Generation Partnership Project (3GPP). The Evolved Universal Terrestrial Radio Access Network (E-UTRAN) comprises the Long Term Evolution (LTE) and is part of the System Architecture Evolution (SAE).

[0006] Long Term Evolution (LTE) is a variant of a 3GPP radio access technology wherein the radio base station nodes are connected directly to a core network rather than to radio network controller (RNC) nodes. In general, in LTE the functions of a radio network controller (RNC) node are performed by the radio base stations nodes. As such, the radio access network (RAN) of an LTE system has an essentially “flat” architecture comprising radio base station nodes without reporting to radio network controller (RNC) nodes. Thus, the evolved UTRAN (E-UTRAN) comprises evolved base station nodes, e.g., evolved NodeBs or eNBs, providing evolved UTRAN userplane and radio resource control-plane protocol terminations toward the wireless terminal.

[0007] WiMAX, the Worldwide Interoperability for Microwave Access, is a telecommunications technology that provides for the wireless transmission of data in a variety of ways, ranging from point-to-point links to full mobile cellular-type access. The technology provides the users with an idea of enjoying the broadband speed without the actual requirement of any wires or bulky network structures. The ation: 01.07.2010 15:17 09 - 01.07.2010 15:30:18. This page 13 of 5 _A » ,γμπεγ, cLirèVOlO 15 20 09 o AMtNDtU ontt I ai/A7/oaia

Received at the EPO on Jul 01,2010 15:30:18. Page 13 of 53 Ul /U//2UW

Λ.ί /.ηι_ι πηΐ η wioti_y. 1 λ . 29

Printed: 19/07/2010 ♦

FAX 0046107175695

PCT/SE2009/050 55 ’’ο “---hen

DESCPAMD , ,ΠΛλ.ι λ Z o c Ο

SE2009050554. _r η — ü±-v7 —

CA 02736172 2011-03-04 technology is based on the IEEE 802.16 standard (also called WirelessMAN). The name WiMAX was created by the WiMAX Forum.

[0008] When a node such as a wireless terminal attaches to a network, there is often performed a security handshake containing authentication and configuring the use of encryption on the radio interface etc. To this end, the wireless terminal must notify the network which security capabilities (e.g. security algorithms and protocols) it supports so that the network can make a suitable choice. However, this notification can be vulnerable for so called bidding-down attacks, as described below.

[0009] Suppose, for example, that the wireless terminal supports authentication algorithm S (“secure”) and authentication algorithm L (“less secure”). Suppose further that a malicious party intervenes and changes the wireless terminal’s capability signaling from the set of authentication algorithms {S, L} to the set {L}, as depicted in Fig. 1. The network will believe the wireless terminal (UE) only supports authentication algorithm L (“less secure”), and therefore the network will be forced to choose the less secure L. This means that the security obtained for the wireless terminal will be less that it could have been. Even worse, if the system allows terminals without any security capabilities, the attacker could forward an empty set of authentication algorithms, e.g., { }, meaning that the wireless terminal supports no security at all. Consequently there is a need to protect the message containing the wireless terminal’s security related (and possibly other) capabilities.

[00010] The usual or natural approach to security threats is to integrity protect the notification message that advises the network of the security capabilities of the wireless terminal. However, since the notification message normally must take place before the authentication, no cryptographic keys are usually available for this purpose since the keys are created after (or simultaneously with) the authentication. Using public key technology would be an option, but suffers from poor efficiency and lack of public key infrastructure (PKI) support in most wireless standards.

[00011] A solution for WIMAX is to move the capability signaling (SBC capability) until after the authentication step.

ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 14 of ⁵^[VIENDED SHEET®^{10 15:20:24} ?âeived at the EPO on Jul 01,2010 15:30:18. Page 14 of 53

01/07/2010

FAX 0046107175695

PCT/SE 2009/050 55-t - vx-vz -^vlC

<img file="CA2736172C_D0004.tif" />

DESCPAMD

<img file="CA2736172C_D0005.tif" />

CA 02736172 2011-03-04 [00012] The earlier IEEE 802.16 standards used the Privacy and Key Management (PKM) protocol which had many critical drawbacks. IEEE 802.16e includes a new version of the Privacy and Key Management (PKM) protocol released as PKMv2. PKMv2 has radical changes and in contrast with the previous version, including security features like nonces, message authentication codes, key ids, certificates, etc. Thus, PKMV2 in WIMAX carries some security capability in the PKM request message. These capabilities are security related and also might be related to the authentication capabilities, and such capabilities needs to be protected as well.

[00013] Another common technique (used in e.g. 3GPP UMTS and LTE) is depicted in Fig. 2. Fig. 2 particularly shows a wireless terminal performing parts of the network attach procedure. It is assumed that basic radio connection establishment (not shown) has already occurred. The technique comprises the following steps:

[00014] Step 2-1 : The wireless terminal (UE) sends its security capabilities to the network (VPLMN). Security capabilities here refer to encryption algorithm, etc. that will be used after (successful) authentication.

[00015] Step 2-2: The network (VPLMN) fetches authentication data from an authentication, authorization, and accounting (AAA) server or portion of HPLMN.

In UMTS, the AAA server is known as the Home Subscriber Server (HSS).

[00016] Step 2-3: Authentication by means of a challenge-response procedure (explained in more detail below) is performed and a key, k, is produced.

[00017] Step 2-4: The VPLMN “echoes” the security capabilities received from the wireless terminal (UE) in the message of Step 2-1, but now integrity protected (authenticated) by the key k.

[00018] Step 2-5: The wireless terminal (UE), using the same key k, verifies the integrity and checks that the capabilities are the same as it sent in message 1.

[00019] The technique exemplified by Fig. 2 solves an aforementioned problem with regards to security capabilities, but still has the unpleasant property that a faked ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 15 of

Reived at the EPO on Jul 01,2010 15:30:18. Page 15 of 53

-ΥΌ10 15:20:39 ’AMENDED SHEET

01/07/2010

PCT/SE 2009/050 55?-²S?-S?-¥Ao _N ^fax 0046107175695 -’hen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04 capability message is only detected after the authentication and enabling of security functions. Moreover, the security capabilities are only reliably protected if the authentication procedure is performed in a secure manner, since otherwise the key, k, may be known to other parties, enabling forgery of the message in Step 2-4.

[00020] Challenge-response protocols forming part of the procedure of Fig 2 exist in the prior art and are used for authentication (e.g. GSM/UMTS Authentication and Key Agreement, AKA, Extensible Authentication Protocol, EAP, Digestauthentication, etc.). In such protocols the wireless terminal and the AAA server are assumed to have a pre-shared key (or password), K. Basic aspects of such challengeresponse protocols are depicted by the example steps listed below.

[00021] (1) The AAA server chooses a random value, RAND.

[00022] (2) The AAA server computes an expected response, XRES = F(K,

RAND), where F is an agreed cryptographic function (F could depend also on other parameters than RAND). Other parameters, e.g. keys, may also be computed based on RAND and K.

[00023] (3) The AAA server sends RAND to the wireless terminal.

[00024] (4) The wireless terminal computes a response, RES = F(K, RAND), and sends it back (to the AAA server or some authenticator node in the access network).

[00025] (5) The AAA server/authenticator checks if RES = XRES, and if so considers the wireless terminal authenticated.

[00026] In such challenge-response protocols, Step (2) by necessity has to be performed after step (1) and before step (5) but may optionally be performed after step (3) and step (4). This poses limitations on the set of possible authentication procedures.

[00027] In general, systems such as UMTS or LTE protect the security capabilities, but do not protect the authentication capabilities. It is likely that such systems in the near future may support a plurality of authentication capabilities, and hence the lack of protection of the authentication capabilities creates both a basic threat against the tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 16 of 5\cljccVOIO 15:20:54

C AMtNDtU bntt I

Reived at the EPO on Jul 01,2010 15:30:18. Page 16 of 53 Ü1/O7/2O1O

-&gt;·'&gt;-&gt; nm ---30 FAX 0046107175695 - · - —--hen . runn/nco

Printed: 19/07/2010 DESGPAMD _DrT,_Cr ™no/ncn r r SE2009050554,, » ................. r(_ I/St 2009/050 55^-ui-uz -^vlC

CA 02736172 2011-03-04 authentication procedures, as well as a “domino effect” since the security capabilities may become threatened as a side effect. The reason that the authentication capabilities are not protected is partly due to the inherent “chicken-and-egg” problem associated with any straight-forward approach attempting to provide such protection.

[00028] Moreover, the security related capabilities in the prior art arrangements mentioned above (e.g. UMTS) are only protected between a visited public land mobile network (VPLMN) and the wireless tenninal. This is means that a strong trust in the VPLMN is needed since otherwise the VPLMN could still “fake” the wireless terminal capabilities forwarded from the wireless terminal. In particular, the authentication capabilities may sometimes be an “end-to-end” issue between wireless terminal and authentication and accounting (AAA) function/server and should likewise be end-to-end protected.

SUMMARY [00029] In one of its aspects the technology disclosed herein concerns a method of operating a communications network which communicates with a wireless terminal over an interface. The network comprises an authenticator node and a server such as an authentication, authorization, and accounting (AAA) server. In its most basic form, the method comprises the terminal sending authentication capabilities information across the interface to the network (the authentication capabilities information provides an indication of authentication capabilities of the tenninal).

The network then uses the received authentication capabilities information to determine a first cryptographic value to be used within an authentication and key agreement procedure with the terminal. The terminal then uses the authentication capabilities information to determine a second cryptographic value to be used within the authentication and key agreement procedure. If the first arid second cryptographic values differ, at least part of the authentication and key agreement procedure fails. The failure can be detected by the network, the terminal, or both.

[00030] In an example implementation, the authentication capabilities information comprises an identification (e.g., a list) of authentication algorithms, authentication/protocols, or authentication credentials supported by the terminal.

ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 17 of ⁵/\MENDED SHEET °¹° ^15:21:10 îfeeived at the EPO on Jul 01,2010 15:30:18. Page 17 of 53

01/07/2010

η. τγ”. A/-30 FAX 0046107175695 ·- »« „.-:_„_hen ra_n,o/n_Co.

Printed: 19/07/2010 DESCPAMD _Dr~T/cc onno men r r SE2009050554. _r » . . . PC I/Sh 2UUy/(JbU bb-t - v±-w/-^viC

CA 02736172 2011-03-04 [00031] Obtaining verification of the authentication procedure using the first cryptographic value and the second cryptographic value can occur in various ways. For example, obtaining verification can comprise comparing the first cryptographic value and the second cryptographic value and thereby making an explicit determination of whether the authentication procedure is successful (e.g., the authentication procedure is determined to be successful if the first cryptographic value equals the second cryptographic value). In some example embodiments such comparison of the first cryptographic value and the second cryptographic value can be performed by the network; in other example embodiments such comparison of the first cryptographic value and the second cryptographic value can be performed by the terminal. In yet other example embodiments obtaining the verification essentially comprises the network attempting to use the first cryptographic value and the terminal attempting to use the second cryptographic value in conjunction with secure (e.g., encrypted) communications between the network and the terminal. Such embodiments involve determining success of the authentication procedure if the encryption/decryption operations communications do not fail. The verification is in this case an example of implicit comparison, i.e. it is not based on explicit comparison, “is x == y ?”, but is rather based on evaluating a criteria of form “does h(x) match with g(y) ?” for some cryptographic functions h, g.

[00032] Thus, in one example embodiment the network provides the terminal with the first cryptographic value. The terminal compares the first cryptographic value and the second cryptographic value to authenticate the network and rejects the authentication and key agreement procedure if they differ.

[00033] In another example embodiment the terminal provides the network with the second cryptographic value, used as a cryptographic value. The network compares the first cryptographic value and the second cryptographic value to authenticate the terminal and rejects the authentication and key agreement procedure if they differ.

[00034] In yet another embodiment the first and second cryptographic value comprise session key material to be used in secure communication between the terminal and the network (e.g. encryption and/or data integrity protection). If either the network or the terminal detects a communication error related to the secure communication, the authentication and key agreement procedure is rejected.

ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 18 of ⁵y\|VlENDED SHEET^{010 15:21:27}

Zoeived at the EPO on Jul 01,2010 15:30:18. Page 18 of 53

01/07/2010 .»«·?? 7’ « .·»”’ 30 FAX 0046107175695 -r- F-,Vrr-hen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04

PCT/SE 2009/050 55Υ-αϊ-ΰ7-1X710 ,,ΓΛλ 5 o /.neo.....

SE2009050554, [00035] In an example server-based mode of the method, the terminal sends the authentication capabilities information across the interface to an authenticator node and to the server. The server uses the authentication capabilities information to determine the first cryptographic value. The terminal uses the authentication capabilities information to determine the second cryptographic value. The authenticator node compares the first cryptographic value and the second cryptographic value to authenticate the terminal.

[00036] In a more detailed implementation of the server-based mode, the terminal sends the authentication capabilities information across the radio interface to the authenticator node. The authenticator node in turn sends the authentication capabilities information to the server. The server generates the first cryptographic value as a function of the received authentication capabilities information, a random number, and a key (the key being pre-shared by the terminal and the server). The server sends the random number and the first cryptographic value to the authenticator node. The authenticator node sends the random number to the terminal. The terminal uses the random number, the key, and the authentication capabilities information to compute the second cryptographic value. The terminal sends the second cryptographic value to the authenticator node.

[00037] In an input-modified variation of the server-based mode, the terminal sends authentication capabilities information across the interface to the authenticator node. The authenticator node sends the authentication capabilities information to the server. The server chooses a secondary random number and further uses the secondary random number and the received authentication capabilities information to determine a primary random number. The server generates the first cryptographic value as a function of the primary random number and a key which is pre-shared by the terminal and the server. The server sends the secondary random number and the first cryptographic value to the authenticator node. The authenticator node sends the secondary random number to the terminal. The terminal uses the secondary random number and the authentication capabilities information to determine a second primary random number. The terminal uses the second primary random number and the key to compute the second cryptographic value.

tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 19 o^f SHEET°^{10 15:21:44}

Æeived at the EPO on Jul 01.2010 15:30:18. Page 19 of 53

01/07/2010

PCT/SE 2009/050 55?-²S?-S5-?.⁵ulC nm A , Λ. 30 FAX 0046107175695 —— ..... hen

Printed: 19/07/2010 DESCPAMD » ' .....

CA 02736172 2011-03-04

ΓΤιλ Π 0 /. Π c o.

[00038] In the input-modified variation of the server-based mode the server uses a server first function to determine the first cryptographic value, and an input to the server first function is dependent on the authentication capabilities information.

[00039] In an example implementation, the first cryptographic value is an authentication token (AUTN). In another embodiment the first cryptographic value is a ciphering key (CK) and/or an integrity key (IK). In another embodiment the first cryptographic value is an expected response (XRES) and the second cryptographic value is a response (RES). In another example implementation, the first cryptographic value is a master session key (MSK) key of Extensible Authentication Protocol Method for UMTS Authentication and Key Agreement (EAP-AKA).

[00040] Some of the embodiments describe herein utilize an explicit check value. For example, if the first authentication capabilities are modified by an attacker, a result (RES) value derived in the terminal will differ from the corresponding expected result (XRES) value generated by the network, and the comparison of RES and XRES will fail in the network. The embodiment in which the AUTN serves as the cryptographic value is also an example of an explicit check value, although in that embodiment the failure will be detected in the terminal. In other cases, e.g. when keys (MSK and/or CK/IK) are used as check value, the check values are implicit since detection of modified security capabilities will be due to e.g. ciphering failure.

[00041] In an example shared mode of the method, the terminal sends authentication capabilities information across the interface to an authenticator node of the network. The authenticator node requests a third cryptographic value from a server of the network. The server generates the third cryptographic value as a function of a random number and a key, the key being pre-shared by the terminal and the server. The server sends the random number and the third cryptographic value to the authenticator node. The authenticator node uses the random number, the third cryptographic value, and the authentication capabilities information to determine a first cryptographic value. The authenticator node sends the random number to the terminal. The terminal uses the random number, the key, and the authentication capabilities information to determine the second cryptographic value. The terminal sends the second cryptographic value to the authenticator node. In an example ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 20 ^of ^MENDED SHEET^^{010 15:22:01}

Reived at the EPO on Jul 01,2010 15:30:18. Page 20 of 53

01/07/2010 ί” ^,ηΖ ΐ’ mtiri 1.-. 31

Printed. 19/07/2010 »

FAX 0046107175695

PCT/SE 2009/050 55

DESCPAMD hen

ΓΛλ co

SE2009050554, _r η — vx —ύί— rfCvlL

CA 02736172 2011-03-04 implementation of the shared mode, the authenticator node is a Serving GPRS Support Node (SGSN) or MME (Mobility Management Entity) node in a visited public land mobile network (VPLMN) and the server is an AAA server or Home Subscriber Server (HSS) in a home public land mobile network (HPLMN).

[00042] In another of its aspects the technology disclosed herein concerns a node of a communications network. The node is configured to use authentication capabilities information of a terminal to determine a cryptographic value for the terminal (the authentication capabilities information provides an indication of authentication capabilities of the terminal). For example, the authentication capabilities information comprises an identification (e.g., a list) of authentication algorithms, authentication protocols, and/or authentication credentials supported by the terminal.

[00043] In an example embodiment the node comprise a server configured to determine the cryptographic value as a function of the authentication capabilities information, a random number, and a key, the key being pre-shared by the terminal and the server.

[00044] Another embodiment of the node comprises a server configured to choose a secondary random number and to use the secondary random number and the authentication capabilities information to determine a primary random number. The server is further configured to generate the cryptographic value as a function of the primary random number and a key which is pre-shared by the terminal and the server. This embodiment is an example of embodiments in which the server is configured to use a server first function to determine the cryptographic value, and wherein an input to the server first function is dependent on the authentication capabilities information.

[00045] In an example implementation, the node is an authenticator node (e.g.

MME (Mobility Management Entity) node or Serving GPRS Support Node (SGSN)) in a visited public land mobile network (VPLMN). In another example implementation, the node comprises an AAA server or Home Subscriber Server (HSS) node in a home public land mobile network (HPLMN).

10, ived at the EPO on Jul 01,2010 15:30:18. Page 21 of 53 ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 21 of ^MENDED SHEET «1015.22:16

01/07/2010 ,, . lÿhfl'»'» /.Λ Ε .Ο. ....

PCT/SE 2009/050 55§^9?-S?®§BlO

Λ· 31 FAX 0046107175695 .--- . -hen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04 [00046] In another of its aspects the technology disclosed herein concerns a communications network comprising a first node and a second node. The first node is configured to receive authentication capabilities information of a terminal and to request a third cryptographic value from the second node. The second node is configured to generate the third cryptographic value as a function of a random number and a key which is pre-shared by the terminal and the second node. The first node is configured to use the random number, the third cryptographic value, and the authentication capabilities information to determine a first cryptographic value and to compare a second cryptographic value received from the terminal with the first cryptographic value to authenticate the terminal. In an example implementation, the first node comprises an Serving GPRS Support Node (SGSN) or MME (Mobility Management Entity) node in a visited public land mobile network (VPLMN) and the second node comprises a AAA server or Home Subscriber Server (HSS) node in a home public land mobile network (HPLMN).

[00047] In another of its aspects the technology disclosed herein concerns a terminal configured to send authentication capabilities information over an interface to a communications network and to also use the authentication capabilities information to determine a cryptographic value which is sent over the interface to the communications network for authentication of the terminal. In an example implementation the authentication capabilities information comprises an identification of authentication algorithms supported by the terminal.

[00048] In another of its aspects the technology disclosed herein concerns a terminal configured to send authentication capabilities information over an interface to a communications network and to also use the authentication capabilities information to determine a first cryptographic value. The terminal is further configured to compare the first cryptographic value to a second cryptographic value received from a communications network as part of an authentication procedure and to reject the authentication procedure if the comparison fails. In an example implementation the authentication capabilities information comprises an identification of authentication algorithms supported by the terminal.

01/07/2010 ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 22 of El· . .γμγιγπ π_ιγγτ^ί010 15:22:32

AMENDED SHEET

SXlived at the EPO on Jul 01,2010 15:30:18. Page 22 of 53

FAX 0046107175695

PCT/SE 2009/050 55?-²S?^Sl^Ü⁴lC

Printed: 19/07/2010

I

..MA, ,.Μί!

DESCPAMD nhen

CA 02736172 2011-03-04

BRIEF DESCRIPTION OF THE DRAWINGS [00049] The foregoing and other objects, features, and advantages of the invention will be apparent from the following more particular description of preferred embodiments as illustrated in the accompanying drawings in which reference characters refer to the same parts throughout the various views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.

[00050] Fig. 1 is a diagrammatic illustrating potential attack by a malicious party of communications between a terminal and a network.

[00051] Fig. 2 is a diagrammatic view of steps involved in a common authentication technique.

[00052] Fig. 3 A is a schematic view of relevant portions of a first example communications network suitable for contextualizing the technology disclosed herein.

[00053] Fig. 3B is a schematic view of relevant portions of a second example communications network suitable for contextualizing the technology disclosed herein.

[00054] Fig. 4 is a diagrammatic view showing example acts or steps which are performed in a generic mode of a method in conjunction with communications network of Fig. 3.

[00055] Fig. 5A - Fig. 5E show example constituent units and functionalities of an authentication node, an AAA server, and a terminal according to differing, nonlimiting and more detailed example embodiments.

[00056] Fig. 6 illustrates example or representative, basic acts or steps of an example embodiment of a server-based method of authentication.

[00057] Fig. 7 shows basic or representative example acts or steps performed in a more detailed implementation of the server-based mode of Fig. 6.

on: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 23 of £

AMENDED SHEET

12, ived at the EPO on Jul 01,2010 15:30:18. Page 23 of 53

-?010 15:22:45

01/07/2010

/.ΐ,/η·, _?η1 η π-ρτ, 1 ο. 31 FAX 004 610 71756 9 5 - - - «--hen

Printed; 19/07/2010 DESCPAMD

CA 02736172 2011-03-04

PCT/SE 2009/050 55§^S?^^iiC

ΓΤίηηΛ Ζ λ c ο, (00058] Fig. 8 is a diagrammatic view showing basic or representative example acts or steps performed by another example method of the technology disclosed herein.

[00059] Fig. 9 is a diagrammatic view showing basic or representative example acts or steps performed in a mode involving UMTS Authentication and Key Agreement (AKA) wherein an AUTN parameter is made dependent on authentication capabilities.

(00060] Fig. 10 is a diagrammatic view showing basic or representative example acts or steps performed in a mode involving the Extensible Authentication Protocol method wherein a Master Session Key (MSK) is made dependent on authentication capabilities.

[00061] Fig. 11 is a diagrammatic view showing basic or representative example acts or steps performed by another example method of the technology disclosed herein.

DETAILED DESCRIPTION [00062] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, interfaces, techniques, etc. in order to provide a thorough understanding of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments that depart from these specific details. That is, those skilled in the art will be able to devise various arrangements which, although not explicitly described or shown herein, embody the principles of the invention. In some instances, detailed descriptions of well-known devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail. All statements herein reciting principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents as well as equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure.

tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 24 of EN D ED 5pj^ÊT^?01° ^15:22:59 t Jilived at the EPO on Jul 01,2010 15:30:18. Page 24 of 53

01/07/2010 n i /η-, nm η η-τγ, ,ι,Λ . 32 _FAX 0046107175695 .», “^:--~hen

Printed:19/07/2010 DESCPAMD ί .....- -......

CA 02736172 2011-03-04

PCT/SE 2009/050 55®-²°?-2?θ^ζ?1Ο ,Ric_*»c.z n e O , [00063] Thus, for example, it will be appreciated by those skilled in the art that block diagrams herein can represent conceptual views of illustrative circuitry embodying the principles of the technology. Similarly, it will be appreciated that any flow charts, state transition diagrams, pseudocode, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown.

[00064] The functions of the various elements including functional blocks labeled or described as “processors” or “controllers” may be provided through the use of dedicated hardware as well as hardware such as a computer capable of executing software. When provided by a processor, the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared or distributed. Moreover, explicit use of the term “processor” or “controller” should not be construed to refer exclusively to hardware capable of executing software, and may include, without limitation, digital signal processor (DSP) hardware, read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage.

[00065] Fig. 3A shows relevant portions of an example communications network 20 suitable for contextualizing the technology disclosed herein. The communications network 20 comprises authentication node 22 and authentication, authorization, and accounting (AAA) server 24. The authentication node 22 is connected to access network 26. The access network 26 comprises at least one base station 28, also known as a radio base station. The base station 28 communicates with a terminal 30 over an interface 32. Thus, in the example embodiment of Fig. 3A the access network 26 is a radio access network and terminal 30 is a wireless terminal which communicates over air or radio interface 32.

[00066] Fig. 3B illustrates that the technology disclosed herein is not confined to a radio access network or for use with a wireless terminal. Rather, Fig. 3B shows that the access network can be other than radio-based, e.g., and that the terminal 30’ can be other than wireless (e.g., wired or cable-connected using e.g. phone line, optical fiber, coaxial cable, etc). Although ensuing embodiments are primarily described with reference to the wireless context of Fig. 3 A, it should be appreciated that such ived at the EPO on Jul 01,2010 15:30:18. Page 25 of 53 tion. 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 25 of ^MENDED SHEET°¹° ^15:23:16 »1401/07/2010 . ^η ν,/ηππ»”·' ’*··32 FAX 0046107175695 .---. ®τ·ρ -., •-chen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04

PCT/SE 2009/050 55?

embodiments also can be implementation in a more general context such as shown in Fig. 3B.

[00067] The authentication node 22 can be any suitable node of communications network 20, such as (for example) a Serving GPRS Support Node (SGSN), an MSC, or a Mobility Management Entity (MME). The AAA server 24 can also be located at a node of communications network 20, for which reason AAA server 24 can also be considered to be a node. In this regard, AAA server 24 can be located at a (Radius or Diameter) AAA Server, a home location register/authentication centre (HLR/AuC), or a Home Subscriber Server (HSS).

[00068] In one of its basic aspects, the technology disclosed herein solves the bidding-down issue of the authentication protocol capabilities such as the problem described with reference to Fig. 1. To do so, the technology disclosed herein involves and integrates information pertaining to the authentication protocol capabilities into the authentication procedure itself. To this end authentication node 22 comprises authentication unit 34; AAA server 24 comprises authentication unit 36; and terminal 30 comprises authentication unit 38. In some embodiments described herein the dependency of an authentication procedure upon authentication capabilities information is essentially transparent to authentication node 22; in other embodiments such dependency is instead transparent to AAA server 24.

[00069] In an example implementation of the type shown in Fig. 3 A, authentication node 22 is situated in or comprises a Visited Public Land Mobile Network (VPLMN) 40, which can also be comprised by the radio access network (RAN) 26. In an example implementation, AAA server 24 is situated in or comprises a Home Public Land Mobile Network (HPLMN) 42.

[00070] Fig. 4 shows example acts or steps which are performed in a generic mode of an authentication procedure for communications network 20 of Fig. 3. Act 4-1 comprises terminal 30 sending authentication capabilities information (AC) message across interface 32 to network 20.

[00071] In the embodiments described herein, the authentication capabilities information (AC) provides an indication of authentication capabilities of the ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 26 of y\|V|Ef\|DED SHEET^^{010 15:23:32}

Jjiived at the EPO on Jul 01,2010 15:30:18. Page 26 of 53 /07/2010

FAX 0046107175595

PCT/SE 2009/050 55?-²5??δ?^Αθ n ί.. / Λ *7 . η η 1 π . mon 1 λ . β 2

Printed: 19/07/2010 r-_—· -?f&gt; -hen

DESCPAMD

CA 02736172 2011-03-04 terminal. The authentication capabilities therefore differ from security capabilities, which essentially concern encryption algorithms or the like which are to be utilized upon completion of a successful authentication procedure. The authentication capabilities information (AC) can be, for example, identification (e.g., a listing or description) of authentication algorithm(s), authentication protocol(s), and/or authentication credentials for which the terminal 30 is eligible or capable. Various different types of authentication algorithms might be included in the authentication capabilities information (AC) message sent as Act 4-1, depending on the type and nature of the terminal. A non-exhaustive sampling of example authentication algorithms for a terminal which are of a type which might be included in an example authentication capabilities information (AC) message include Milenage, RSA®, etc. Examples of authentication protocols may be UMTS AKA, EAP AKA, EAP TLS, etc. Examples of credentials may comprise IMSI(s), public key certificates etc.

[00072] It should be understood that a complete specification of an authentication mechanism may require specification of each of the authentication algorithm, the authentication protocol in which to use the algorithm, and the credentials (e.g. key and/or identifier) relative to which the authentication is performed. In some cases one or more of these three parameters are implicit and does not need to be explicitly included in the capabilities. For instance, in an LTE network only the UMTS AKA protocol is supported and there is no need to explicitly signal this fact. However, any parameter which requires explicit signaling may be subject to a bidding down attack and may therefore benefit from the protection offered by the technology described herein.

[00073] Act 4-2 comprises communications network 20 using the authentication capabilities information to determine a first cryptographic value (CV1). As act 4-3 terminal 30 uses its authentication capabilities information to determine a second cryptographic value (CV2). The first cryptographic value (CV1) and the second cryptographic value (CV2) can also be considered a first authentication check value and a second authentication check value, respectively. Act 4-4 comprises obtaining verification (using the first cryptographic value (CV1) and the second cryptographic value (CV2)) whether the authentication procedure is successful (e.g., permits authenticated communication between network 20 and terminal 30).

ion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 27 of ^[^NDED SHEET®^{10 15:23:49}

Jjiived at the EPO on Jul 01,2010 15:30:18. Page 27 of 53

01/07/2010

1Λ-.32 FAX 0 04 610 7175695 —- ¥---hen

Printed: 19/07/2010 DESCPAMD

- -·.&lt;*· ... 9 O /neo

PCT/SE 2009/050 55?-²S?-S?^⁵vi0

CA 02736172 2011-03-04 [00074] Fig. 4 depicts a generic mode of operation in the sense that act 4-2 can be distributed/shared between authentication node 22 and AAA server 24 in various manners in accordance with other modes of the method, including but not limited to other modes described herein. Fig. 4 is also generic from the perspective that act 4-4 can be performed by either terminal 30, network 20, or a combination of network 20 functioning together with terminal 30. For example, and as described in more detail subsequently, act 4-4 can comprise comparing first cryptographic value (CV1) and second cryptographic value (CV2) and thereby making an explicit determination of whether the authentication procedure is successful (e.g., the authentication procedure is determined to be successful if first cryptographic value (CV1) equals second cryptographic value (CV2)). In some example embodiments such comparison of first cryptographic value (CV1) and second cryptographic value (CV2) can be performed by network 20; in other example embodiments such comparison of first cryptographic value (CV1) and second cryptographic value (CV2) can be performed by terminal 30. In yet other example embodiments act 4-4 essentially comprises obtaining verification by the network 20 attempting to use the first cryptographic value (CV1) and the terminal 30 attempting to use the second cryptographic value (CV2) in conjunction with cryptographic communications (taking place after the authentication) between network 20 and terminal 30, and determining success of the authentication procedure if the secure communication (e.g. encryption/decryption) operations communications do not fail (since the communications would fail when unequal values of the first cryptographic value (CV1) and second cryptographic value (CV2) cause communication problems).

[00075] Fig. 5A shows, in more detail, example constituent units and functionalities of authentication node 22, AAA server 24, and terminal 30 according to a nonlimiting example embodiment. As shown in Fig. 5A, authentication node 22 comprises, among other unillustrated constituent components and functionalities, authentication node processor 50; interface 52 to AAA server 24; and interface 54 to radio access network (RAN) 26 (through which communications are provided to terminal 30). In the illustrated embodiment, the authentication node processor 50 performs at least partially the role of authentication unit 34 and as such further includes cryptographic value comparator 56.

tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 28 of “Z\|V|Ef\|DED SHEET^?°¹° ^15:24:06 tlLived at the EPO on Jul 01,2010 15:30:18. Page 28 of 53

01/07/2010

PCT/SE 2009/050 55?-²5?^^vlO

M/.A·, 1..33 fax 0046107175695 _; “---hen

Printed: 19/07/2010

DESCPAMD

CA 02736172 2011-03-04 [00076] The AAA server 24 comprises the AAA server authentication unit 36 and a computer or processor depicted as AAA server processor 60. The AAA server authentication unit 36, also known as the subscriber identify circuit, further includes first cryptographic value generator 62 and key memory 63. The AAA server authentication unit 36 is typically a secure tamper resistant unit. The AAA server processor 60 comprises random number generator 64; authentication node interface 66; authentication capabilities dependency unit (ACDU) 67; and authentication capabilities memory 68. The AAA server authentication unit 36 can take the form of a circuit such as an integrated circuit or processor which is separate from processor 60. As such, in an example embodiment, the AAA server authentication unit 36 can include not only a memory (e.g., non-volatile memory), but a processor which performs computer-readable or machine-readable instructions. Thus, in view, e.g., of its processor, the AAA server authentication unit 36 is also referred to as a computerimplemented or circuit-implemented authentication unit. Similarly, being realized or embodied by AAA server processor 60, the authentication capabilities dependency unit (ACDU) 67 is also referred to as computer-implemented authentication capabilities dependency unit.

[00077] Thus, the dependency on the authentication capabilities are made through authentication capabilities dependency unit (ACDU) 67 which generally operates on input to, or outputs from, the AAA server authentication unit 36, by including dependency on authentication capabilities. In the current example embodiment, the ACDU 67 operates on inputs to the AAA server authentication unit 36. The ACDU 67 forms inputs by combing random numbers provided by the random number generator 64 and the authentication capabilities memory 68. Since the ACDU operates directly on inputs/outputs of the AAA server authentication unit 36, the ACDU may alternatively be integrated entirely or in part in the AAA server authentication unit 36 (in which case it can still be referenced as a computerimplemented or even a circuit-implemented authentication capabilities dependency unit). However, it is usually preferred to avoid modifications of the AAA server authentication unit 36 which is the reason for the functional split as indicated in at least some of the figures such as Fig. 5 A.

[00078] In embodiments where the ACDU 67 operates only on the inputs to the AAA server authentication unit 36, a first cryptographic value (CV1) may be tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 29 of -^MENDED SHΕΕΤ^θ¹ ° ^{15:24 23} kt%ived at the EPO on Jul 01.2010 15:30:18. Page 29 of 53

01/07/2010 ^{1 Λ}' 33 FAX 0046107175695 -—-’.Λ .“^::r--:hen

Printed: 19/07/2010 DESCPAMD

CA 02736172 2011-03-04

PCT/SE 2009/050 55A - ÛÏ-Ù7-ZCTO

ITimn z n c o. .

SE2009050554.

identified directly with the output of the AAA server authentication unit 36. In embodiments (described later) where the ACDU 67 operates at least partly on the outputs to the AAA server authentication unit 36, the first cryptographic value (CV1) is instead identified with the output of the ACDU 67.

[00079] The terminal 30 of Fig. 5A comprises, among other unillustrated components and functionalities, authentication unit 38; terminal computer or terminal processor 70; and transceiver 71. The transceiver 71 is used for both uplink and downlink communications with base station 28 over interface 32 in conventionally known manner. The terminal authentication unit 38 further includes second cryptographic value generator 72 and key memory 73. The terminal authentication unit 38 is typically also a secure unit. The terminal processor 70 comprises random number generator 74; authentication node interface 76; terminal authentication capabilities dependency unit (ACDU) 77; and, authentication capabilities memory 78. Like the AAA authentication unit 36, the terminal authentication unit 38 can take the form of a circuit such as an integrated circuit, and particularly can take the form of an integrated circuit card such as a Subscriber Identity Module (SIM or USIM) type card. As such, in an example embodiment, the authentication unit 38 can include not only a memory (e.g., non-volatile memory), but a processor which performs computer-readable or machine-readable instructions. Thus, in view, e.g., of its processor, the terminal authentication unit 38 is also referred to as a computer-implemented or circuit-implemented terminal authentication unit. Similarly, being realized or embodied by terminal processor 70, the authentication capabilities dependency unit (ACDU) 67 is also referred to as computer-implemented authentication capabilities dependency unit.

[00080] The terminal authentication capabilities dependency unit (ACDU) 77 of terminal 30 essentially “mirrors” the corresponding ACDU 67 in the AAA server by operating on input and/or outputs from, the terminal authentication unit 38. The ACDU 77 may alternatively be integrated entirely or in part in the terminal authentication unit 38, which case it is still a computer-implemented or even circuitimplemented authentication capabilities dependency unit. However, the same desire to leave the terminal authentication unit 38 intact typically applies also here.

tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 30 of 'AMENDED SHEET^?01° ^15:24:40 drived at the EPO on Jul 01,2010 15:30:18. Page 30 of 53

01/07/2010

PCT/SE 2009/050 55 &lt;11 /m n ni n -HT, ,,. 33

Printed: 19/07/2010

FAX 0046107175695 , “-chen

DESCPAMD

..........~ _ ΓΛλ.ο 1 /nco

SE2009050554, _r

-t — kjx—uz — luR

CA 02736172 2011-03-04 [00081] Similar to the server side, in embodiments where the ACDU 77 operates only on the inputs to the terminal authentication unit 36, a second cryptographic value (CV2) may be identified directly with the output of the terminal authentication unit 38. In embodiments (also described later) where the ACDU 67 operates at least partly on the outputs to the terminal authentication unit 38, the second cryptographic value (CV2) is instead identified with the output of the ACDU 77.

[00082] In the embodiments described herein, a key or password for terminal 30 is pre-stored, configured, or downloaded in/to both key memory 63 of AAA server authentication unit 36 and key memory 73 of the terminal authentication unit 38.

The terminal 30 knows its own authentication capabilities (e.g., the authentication algorithms with/by which terminal 30 can operate), and has the authentication capabilities information (AC) indicative of such stored in authentication capabilities memory 78. If the authentication capabilities of terminal 30 change from time to time, the authentication capabilities information (AC) is accordingly updated in authentication capabilities memory 78.

[00083] Fig. 6 illustrates example or representative, basic acts or steps of an example server-based mode of the method of authentication according to the technology disclosed herein. In Fig. 6, as act 6-1 terminal 30 sends the authentication capabilities information (AC) across interface 32 in an authentication capabilities information message to authentication node 22 and to AAA server 24.

As shown in Fig. 6, the authentication capabilities information (AC) is typically first sent to authentication node 22, which relays the authentication capabilities information (AC) to 22. Act 6-2 comprises AAA server 24 using the authentication capabilities information to determine the first cryptographic value (CV1). Act 6-3 comprises terminal 30 using the authentication capabilities information to determine the second cryptographic value (CV2). Act 6-4 comprises authenticator node 22 comparing the first cryptographic value (CV1) and the second cryptographic value (CV2) to explicitly determine if the authentication procedure is successful and (if successful) to thereby authenticate the terminal.

[00084] Fig. 7 shows basic or representative example acts or steps performed in a more detailed implementation of the server-based mode. Act 7-0 comprises the terminal 30 sending its authentication capabilities in the form of an authentication tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 31 of ⁵ΑΜENDED SHEET°¹° ^15:24:57 iS&amp;ived at the EPO on Jul 01,2010 15:30:18. Page 31 of 53

01/07/2010

Çhn o r&gt; 7 n c o ,

PCT/SE 2009/050 55§^99§S5^iiO ,,Ο· »·».; J»,,» ll, *u ι ι « n ·

Printed: 19/07/2010

FAX 0046107175695 .--- «.-“«nnhen

DESCPAMD

CA 02736172 2011-03-04 capabilities information message to AAA server 24. As shown in Fig. 7, terminal 30 sends its authentication capabilities information across interface 32 to authentication node 22, and authentication node 22 sends the authentication capabilities information to AAA server 24.

[00085] The authentication capabilities information (AC) of terminal 30 is received through authentication node interface 66 of AAA server 24 and applied to AAA server authentication unit 36. Act 7-1 of Fig. 7 comprises AAA server processor 60 choosing a random value (RAND). In this regard, as act 7-1 processor 60 invokes random number generator 64. Having obtained the random number RAND from random number generator 64, the random number RAND is provided together with the authentication capabilities AC to the ACDU 67. The ACDU 67 combines them into RAND || AC and this value is provided as input to the AAA server authentication unit 36. As act 7-2, the first cryptographic check value generator 62 computes a cryptographic function F producing a first result or first check value, e.g., XRES, to be used as the first cryptographic value . In particular, in the example embodiment of Fig. 7 the first cryptographic value (CV1) is computed as XRES = F(K, RAND||AC), where F is an agreed cryptographic function and AC is the authentication capabilities information. It should be understood that the cryptographic function F could also depend on parameters other than RAND and K. Thus, as act 7-2 the cryptographic value XRES is computed as being dependent upon the authentication capabilities (AC). If desired, other parameters, e.g. keys, may also be computed as part of act 7-2.

[00086] Act 7-3 comprises AAA server 24 sending it chosen random value (RAND) to the terminal 30. More specifically, as shown in Fig. 7, AAA server 24 sends the random number RAND and the first cryptographic value XRES to authentication node 22, and the authentication node 22 in turn sends the random number RAND to terminal 30.

[00087] Act 7-4 comprises the second cryptographic check value generator 72 of terminal 30 computing a second cryptographic value, e.g., RES (e.g., the “result”).

In the example embodiment of Fig. 7, the second cryptographic is computed by second cryptographic check value generator 72 as RES - F(K, RAND||AC). In other words, terminal 30 uses the random number (RAND) received in act 7-3 from AAA tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 32 of y\|Ç|f:|\|DED SHEET^{1010 15:25:13} iSlived at the EPO on Jul 01,2010 15:30:18. Page 32 of 53

01/07/2010

Printed: 19/07/2010

FAX 0046107175695

<img file="CA2736172C_D0006.tif" />

CA 02736172 2011-03-04

<img file="CA2736172C_D0007.tif" />

server 24, the authentication capabilities information (AC) stored in authentication capabilities memory 78 to compute, via the ACDU 77, an input RAND || AC, provided to the terminal authentication unit 38. The terminal authentication unit 38 applies the cryptographic function F and the key (K) as stored in key memory 73 to the provided input and computes the second cryptographic value RES. Fig. 7 further shows terminal 30 sending the second cryptographic value RES to authentication node 22. Thus, act 7-4 comprises the terminal 30 including in its calculation of RES the authentication capabilities information (AC) value that it (believes it) sent in the message of act 7-0.

[00088] Act 7-5 comprises authentication node 22 determining whether the authentication procedure is successful by explicitly checking whether RES = XRES and, if so, considering the terminal to be properly authenticated. In other words, the cryptographic value comparator 56 of authentication node 22 compares the first cryptographic value XRES with the second cryptographic value RES, and if RES = XRES, the authentication node 22 authenticates the terminal 30. If the first authentication capabilities provided from the terminal in step 7-0 were modified by an attacker, this comparison would fail (since RES and XRES have been computed from different inputs) and would be detected by the authentication node 22. After the determination of successful authentication of act 7-5, authentication node 22 typically sends a notification in the form of a success/failure message to the terminal, which serves to inform the terminal of the fact of successful authentication. Hence, in this case any attack will first be detected by the authentication node 22 and the detection is explicit.

[00089] The function F may thus be considered part of the terminal’s authentication capabilities (e.g. different terminals could support different F functions). Typically, F is provided by a smart-card implementing a subscriber identity module function (SIM or UMTS SIM) which also provides secure storage of key(s). However the technology described herein will protect also against an attacker modifying that aspect of the security capabilities since a modification of that capability will still at least imply that different authentication capabilities (AC) inputs are used by the network and terminal, respectively. A modification of this capability may also mean that network and terminal will use different F-functions but this will typically only make it even more likely that RES and XRES are different.

ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 33 of £ 7 . _4ΓΚ

AMENDE téâived at the EPO on Jul 01,2010 15:30:18. Page 33 of 53

AMENDED SHEET

01/07/2010

FAX 0046107175695 ni πηΐ η .mon.,,5 λ. ^4

Printed: 19/07/2010 &lt; “---hen

DESCPAMD

PCT/SE 2009/050 55

SE2009050554, _rη - υι-υζ^ϋΐυ

CA 02736172 2011-03-04 [00090] In the illustrated mode of Fig. 7 it should be understood that the network may comprise more than one node performing different functionalities such as, e.g., authentication and radio reception and transmission. Even the calculation of the function F may be distributed over more than one node though the key (denoted K above) typically never leaves the (secure) key memory 63 in the AAA server. Moreover, the function of the AAA server 24 and authentication node 22, and the functionality of the user equipment unit or terminal 30 that perform acts herein described, may be realized by a processor or controller as those terms are expansively described herein, and thus can be considered as computer implemented. Such processor/controller can perform the acts described herein by executing instructions stored on any suitable computer-readable medium.

[00091] If someone has tampered with (or faked) the authentication capabilities (AC), by sending AC’ instead, this means that AAA server 24 will (in act 7-2) compute a XRES which differs (since it is based on AC’) from the one computed by the terminal (based on the local AC value). This, in turn, means that the terminal will be rejected, e.g., not be authenticated as noted above.

[00092] This still leaves open the issue that a malicious party might modify the authentication capabilities (AC) only to perform a Denial-of-Service DoS attack against the terminal (denying access). However, this property is shared with the 3GPP current approach described above. It is for instance always possible for an attacker to modify the RES value provided by the terminal, causing authentication to fail. It is also shared with the “basic” challenge-response authentication paradigm since the RES could be modified en-route by a third party. In any case an attacker is prevented from “fooling” the network and terminal to use a sub-optimal security level.

[00093] In its other aspects the technology disclosed herein encompasses various variations of the foregoing. For example, Fig. 8 illustrates one example embodiment in which acts 8-x essentially correspond to similarly numbered acts 7-x of Fig. 7. In the embodiment of Fig. 8, as a more indirect way of making RES dependent on AC, the RAND is made dependent on authentication capabilities (AC) (as reflected by act 8-1 of Fig. 8). In this regard, AAA server 24 can choose a random RAND’ and set RAND = G(RAND’ |[ AC). As act 8-3 RAND’ is then sent to the terminal rather

Riciived at the EPO on Jul 01,2010 15:30:18. Page 34 of 53 ation: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 34 of E^MENDED SHEET^?01° ^15:25:47

23: 01/07/2010

Printed: 19/07/2010

FAX 0046107175695 ---.,.«λ ..•--hen

DESCPAMD

ΓΤιλοε /neo

SE2009050554.

PCT/SE 2009/050 55~-o 7^77-1X710

CA 02736172 2011-03-04 than RAND, and the terminal locally computes RAND. Note that this is equivalent to modifying the cryptographic function F into the cryptographic function F’(K, RAND’ (I AC) = F(K, G(RAND’ || AC)), and thus this is covered by the earlierdescribed embodiment since it has the same effect: a modified authentication capabilities (AC) value causing the comparison of RES and XRES to fail. Yet the embodiment of Fig. 8 does provide a particularly simple way to reuse already defined and/or implemented cryptographic functions. This is relevant since as mentioned the F-function is typically “hard coded” (e.g., in a smart card such as a SIM card of terminal 30) and this embodiment leaves not only the implementation of function F unaffected, but also its complete input/output behavior.

[00094] The mode of Fig 7 and Fig. 8 are also known herein as variations of an input-modified server-based mode. Both the variations of Fig. 7 and of Fig. 8 modify the inputs to the F function, but in different ways.) Describing now the example acts of Fig. 8 in further detail, act 8-0 comprises terminal 30 sending authentication capabilities information (AC) across interface 32 to authentication node 22. The authentication node 22 in turn sends the authentication capabilities information to 24. Act 8-1 comprises AAA server 24 choosing a secondary random number (RAND’) from its random number generator 64 and using the secondary random number (RAND’) as well as the authentication capabilities information (AC) obtained by act 8-0 to determine, by the ACDU 67, a primary random number (RAND). Although the primary random number (RAND) is to be used for the determination of the first cryptographic value XRES, the secondary random number (RAND’) will be sent to terminal 30. Act 8-2 comprises AAA server 24 generating the first ciyptographic value XRES as a function of the primary random number (RAND) and the key (K) [obtained from key memory 63 and having been pre-shared by terminal 30 and AAA server 24]. Act 8-3 comprises AAA server 24 sending the secondary random number (RAND’) and the first cryptographic value (XRES) to authentication node 22. The authentication node 22 in turn sends the secondary random number (RAND’) to terminal 30. Act 8-4 comprises terminal 30 using the secondary random number (RAND’) and the authentication capabilities information (AC) stored in authentication capabilities memory 78 to first determine the primary random number (RAND) by means of the ACDU 77, and then using the primary random number (RAND) and the key (K) to compute the second cryptographic value RES. The terminal 30 sends the second cryptographic value RES to authentication ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 35 of AMENDED SHEET^?°¹° ^15:26:05 ?£A‘ived at the EPO on Jul 01,2010 15:30:18. Page 35 of 53

01/07/2010 , ^{n 1} Λί» ’’Λ¹ 9 THU. ^{1 Λ}· 35 FAX 0046107175695 --- THU, “'-'-hen . ..,- ?t.'-5? . -..

Printed: 19/07/2010 DESCPAMD PCT/SE 2009/050 55?^²S?-8?^%0

CA 02736172 2011-03-04 node 22, whose cryptographic value comparator 56 compares the values of the first cryptographic value XRES and the second cryptographic value RES to determine if the terminal 30 can be authenticated.

[00095] Fig. 5B together with Fig. 9 illustrate another example embodiment and concerns a specific case of UMTS Authentication and Key Agreement (AKA). In the Fig. 9 embodiment, the so-called AUTN parameter (authentication token for network authentication) is made dependent on authentication capabilities (AC), and the terminal 30 makes an explicit determination of whether the authentication process is successful. In particular, for the embodiment of Fig. 5B authentication node 22 does not include a cryptographic value comparator, but rather the function of cryptographic value comparison is located in terminal 30. Fig. 5B shows the terminal authentication unit 38 of terminal 30 as comprising second cryptographic check value generator 72 and key memory 73. The processor 70 of terminal 30 comprises random number generator 74; authentication node interface 76; terminal authentication capabilities dependency unit (ACDU) 77; authentication capabilities memory 78; and cryptographic value comparator 80. As mentioned above, all or some of the functionalities of terminal authentication unit 38 can be realized or facilitated by a Subscriber Identity Module (SIM) card.

[00096] In the example embodiment shown in Fig. 5B and Fig. 9, the

Authentication Token (AUTN) is sent in the Authentication Request message to the terminal along with a random number. In addition, in this and various other embodiments described herein the key sequence indicator (KSI) can also be sent to the terminal. The value of the key is not sent, only the name of the key, i.e., the KSI. The variables within the AUTN are used by the mobile in the authentication process that it conducts with the network. In particular, at AAA server 24 determines the first cryptographic value (CV1) as XAUTN = H(K,RAND || AC), and terminal 30 determines the second cryptographic value (CV2) as AUTN = H(K,RAND || AC). Similarly suffixed acts of Fig. 9 are analogous to those of Fig. 7, with the exception of using XAUTN instead of XRES as the first cryptographic value (CV1) and AUTN instead of RES as the second cryptographic value (CV2). Act 9-5 comprises cryptographic value comparator 80 of the terminal comparing XAUTN and AUTN. This mode is particularly beneficial since AUTN will be checked by the terminal before it even replies witli RES, thus providing “early abort” in case of a tampered tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 36 of SHEET^{7010 15 2623} ?£,%ived at the EPO on Jul 01.2010 15:30:18. Page 36 of 53

01/07/2010

CA 02736172 2015-12-14

P27134CA1 26 CA2,736,172 authentication capabilities information AC. This embodiment thus also provides an explicit check of the authentication capabilities, although in this case the check is performed by the terminal instead of the network. In practice, comparison of AUTN and XAUTN may be based on only part of the (X)AUTN value, i.e. the so called

MAC-part thereof as specified in 3GPP TS 33.102 and which also describes in detail how the comparison is done in this case.

[00097] Another example embodiment is illustrated in Fig. 5C and Fig. 10 and concerns use of the Extensible Authentication Protocol method for UMTS Authentication and Key Agreement (EAP-AKA). Extensible Authentication

Protocol Method for UMTS Authentication and Key Agreement, or EAP-AKA, is an Extensible Authentication Protocol (EAP) method for authentication and session key distribution using the Universal Mobile Telecommunications System (UMTS) Subscriber Identity Module (USIM). EAP-AKA is described in RFC4187. Master Session Key (MSK) is a term used in several security techniques and procedures which describes a master key, from which a number of other keys such as authentication and encryption keys are derived.

[00098] As shown in Fig. 5C, in the EAP-AKA example embodiment neither the authentication node nor terminal 30C have a cryptographic value comparator.

Rather, Fig. 5C shows that the network comprises encryption/decryption unit 81 and

0 terminal 30C comprises an encryption/decryption unit 82. Typically the encryption/decryption unit 81 is situated at base station 28. Both encryption/decryption unit 81 and encryption/decryption unit 82 use the Master Session Key (MSK), or a key derived therefrom, in conjunction with the encryption/decryption of messages sent between terminal 30C and authentication

5 node 22C. The encryption/decryption unit 81 typically is situated in and/or comprises base station 28. Although the other embodiments also may similarly comprise encryption/decryption units, in various other embodiments the encryption/decryption units do not necessarily play a role in validating the authentication procedure. Yet in the embodiment of Fig. 5C and Fig. 10 whether the o network and terminal 30C prepare the same authentication capabilities-dependent

Master Session Keys (XMSK and MSK) determines whether the encryption/decryption fails or succeeds, and thus is an indicator of whether the authentication procedure is successful (e.g., is validated).

m /m om n mur. 1 Λ, 35 FAX 004 610717 56 95 ---. .•nn “i^:--hen

Printed: 1.9/07/2010 DESCPAMD

PCT/SE 2009/050 55

........... Plrt OO./AC O, _y

SE2009050554. _n

H — VA— Vt -AulU

CA 02736172 2011-03-04 [00099] The MSK is used as key material in, e.g., a WiMAX setting. An analogous embodiment can easily be implemented in a UMTS or LTE setting by instead adding dependency on the authentication capabilities to the native UMTS AKA keys (Ck, Ik) (from which the MSK is derived, when EAP AKA is used).

[000100] In the Fig. 10 example, the Master Session Key (MSK) is made dependent on authentication capabilities (AC). As indicated above, in this embodiment, there will typically not be an explicit verification of the authentication capabilities. Rather, if an attacker modifies the authentication capabilities (AC) of the terminal, the terminal and the network will end up using different values for the MSK. However, verification of this fact is implicit. For instance, when the terminal encrypts a message based on MSK, the decryption process in the network will decrypt using the wrong MSK value. Similarly, if data integrity protection based on MSK is used, also this will produce an error. This will make the communication between the terminal and network “fail”. Thus, verification (e.g., determining whether the authentication procedure is successful) is implicit and not performed explicitly by any particular node in this embodiment. In other words, act 10-5 in Fig. 10 comprises obtaining verification of the authentication procedure in dependence upon subsequent performance of the encryption/decryption/data integrity procedure using the cryptographic values MSK and XMSK determined during the authentication procedure. The effect could be compared to making the terminal and network using incompatible “languages” when attempting to communicate.

[000101] Fig. 8, which shows the input-modified variation of the server-based mode of Fig. 7, is but one example of several embodiments in which AAA server 24 uses a server first function to determine the first cryptographic value (CV1, e.g., XRES’), and wherein an input to the server first function is dependent on the authentication capabilities information (AC). Common to some of the variations/embodiments encompassed hereby is the fact that the dependency of the capabilities (authentication capabilities (AC)) can affect the inputs to the various functions (e.g., functions F, G, and H) rather than affecting the outputs of the functions. For example, instead of computing XRES in a manner in which the dependency on the authentication capabilities (AC) is reflected by an input, e.g., XRES = F(K, RAND || AC), XRES = F’( F(K, RAND) || AC) could be computed for some suitable function, F’, so that output of function F is affected by the ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 38 of -/^MENDED S H EET^?°¹° ^15:26:58

Reived at the EPO on Jul 01,2010 15:30:18. Page 38 of 53

01/07/2010

FAX 0046107175695 .««./«Λ ηηΐ Λ. map ,·&gt; « - 36 Printed: 19/07/2010 i

’’’'f'. “--chen

DESCPAMD .,, ΓΙΐΛΊη /.AC;?.,,

PCT/SE 2009/050 55$-²S?-S?^uiC

CA 02736172 2011-03-04 authentication capabilities (AC). This is equivalent to modifying the cryptographic function F into the cryptographic function F”(K, RAND || AC) = F’(F(K, RAND) || AC) in the basic form described above, but this further form allows for F and F ’ to be computed in different nodes, where only the node calculating F’ needs to know AC, and only the node calculating F needs to know the shared key.

[000102] Since the function F is only possible to compute by the AAA server 24, the technique described above of having authentication capabilities information (AC) affect the output of such a function F has particular advantage in a situation such as that shown in Fig. 5D in which terminal 30 is roaming, i.e. when it operates in a Visited Public Land Mobile Network (VPLMN) 40 but has a shared secret key (K) with the Home Public Land Mobile Network (HPLMN) 42 of the terminal 30. In the situation of Fig. 5D, computation of the function F’ may be “delegated” to the VPLMN (e.g., to authentication node 22 of Visited Public Land Mobile Network (VPLMN) 40) if the AAA server 24 so desires (e.g. if AAA server 24 has a reasonably strong trust in the VPLMN). To facilitate utilization of the function F’ by authentication node 22, the authentication node authentication unit 34 comprises authentication node authentication capabilities dependency unit (ACDU) 57 and authentication capabilities memory 58. The authentication capabilities dependency unit (ACDU) 57 in turn comprises first cryptographic check value generator 59.

Since they can be realized by or comprise processor 50, the authentication node authentication capabilities dependency unit (ACDU) 57 and its first cryptographic check value generator 59 are also referred to as a computer-implemented devices, e.g., computer-implemented authentication node authentication capabilities dependency unit. The terminal authentication capabilities dependency unit (ACDU) 77 comprises second cryptographic check value (CV2) generator 79. Since they can be realized by or comprise processor 70, the terminal authentication capabilities dependency unit (ACDU) 77 and its second cryptographic check value generator 89 are also referred to as a computer-implemented devices, e.g., computer-implemented terminal authentication capabilities dependency unit.

[000103] An example such situation is shown in Fig. 11, which illustrates example acts or steps involved in an example shared mode of the method. Act 11-0 comprises terminal 30 the sending authentication capabilities infonnation (AC) across the interface to authentication node 22, and authentication node 22 requesting what will ition: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 39 of AMENDED SHEET^{101015 2719} ?2Jtived at the EPO on Jul 01,2010 15:30:18. Page 39 of 53

01/07/2010 . . phA Λ.Λ /.A C *5. .

PCT/SE 2009/050 55§-²S?-S?-^⁵Ao m /nn r&gt;n1 η mi, T. · 36

Printed: 19/07/2010 c

FAX 0046107175695 «λ . «'•--hen

DESÇPAMD

CA 02736172 2011-03-04 be termed herein as a third cryptographie value (FRES) from AAA server 24. Act 11-1 comprises AAA server 24 choosing or obtaining a random value (RAND) preparatory to computing the third cryptographie value (FRES). Act 1 l-2a comprises AAA server 24 generating the third cryptographie value (FRES) as a function of a random number (RAND) and a key (K), the key being pre-shared by terminal 30 and AAA server 24. The AAA server 24 then sends the random number (RAND) and the third cryptographic value (FRES) to authenticator node 22. Act 112b comprises the authenticator node 22, and particularly the first cryptographic check value generator 59 of authentication node authentication capabilities dependency unit (ACDU) 57, using the random number (RAND), the third cryptographic value (FRES), and the authentication capabilities information (AC) to determine a first cryptographic check value (XRES) e.g., RES = F’(FRES || AC). As part of act 112b, the authentication capabilities information (AC) is fetched from authentication capabilities memory 58. Act 11-3 comprises authentication node 22 sending the random number (RAND) to terminal 30. Act 11-4 comprises terminal 30 using the random number RAND), the key (K), and the authentication capabilities information (CA) to determine the second cryptographic value (RES). The terminal 30 then sends the second cryptographic value (RES) to AAA server 24. Act 11-5 comprises the authentication node 22 comparing the first cryptographic value (XRES) and the second cryptographic value (RES) as a prerequisite for authenticating the terminal 30.

[000104] The example embodiment of Fig. 11 is thus in contrast to the basic form of the technology disclosed herein and represented by Fig. 5 A (for example) and wherein the HPLMN (AAA server 24) needs to know both the key (K) and authentication capabilities information (AC). In the embodiment of Fig. 11 the authentication node 22 needs to know the authentication capabilities information (AC) but AAA server 24 need not know the authentication capabilities information (AC). Conversely, the authentication node 22 does not need know the key K but the AAA server 24 needs not know the key K. The same or similar sharing/distribution/delegation of actions as performed in the Fig. 11 embodiment can also be performed in other embodiments regardless of manner of verification of success of the authentication procedure, e.g., in embodiments in which there is an explicit verification by either the terminal or the authentication node and in tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 40 of q^MENDED SHEET^?°¹° ^15:27:36 t^âived at the EPO on Jul 01,2010 15:30:18. Page 40 of 53

01/07/2010 ni /m πλι.λ,.ιβοτι.,.ι,λ· 36

Printed:.19/07/2010 f

FAX 0046107175695

PCT/SE 2009/050 55

y.--hen

DESCPAMD

·. ΓΤιλ * i„ / n

SE2009050554

H — VJ ! —Z.&lt;J.

CA 02736172 2011-03-04 embodiments in which there is implicit verification by utilization of the first cryptographic values in a subsequent encryption/decryption operation.

[000105] Whereas Fig. 5D illustrates a situation in which the authentication capabilities information (AC) is used by authentication node 22 to affect the output of the function F, it will be appreciated that an output-affecting employment of the authentication capabilities (AC) can also be implemented in AAA server 24. For example, Fig. 5E illustrates an example embodiment in which a function such as XRES = F’( F(K, RAND) || AC) is computed by AAA server 24 rather than authentication node 22. In the situation of Fig. 5E, the AAA server authentication unit 36 still comprises a cryptographic value generator 62E, it is the authentication capabilities dependency unit (ACDU) 67E that utilizes the authentication capabilities (AC) to perform the XRES = F’( F(K, RAND) |j AC) computation, and thus the authentication capabilities dependency unit (ACDU) 67 serves as the first cryptographic check value generator for computing the first cryptographic check value (CV1).

[000106] The technology disclosed herein is particularly but not exclusively suited to the context of WiMAX or LTE authentication. In the latter case, the technology disclosed herein is particular suited when part of the UE authentication capabilities contain KDFs (Key Derivation Function) used in AAA/HSS and user equipment unit.

[000107] Other “basic” capabilities (e.g. radio/link related) that need to be exchanged before and or during authentication can be protected in a similar way as described herein.

[000108] The AAA server 24 will also choose among the capabilities of the terminal (i.e. decide which F, G, etc) functions to use. The AAA server 24 should signal its choice to the terminal in a secure way. Normally, this is handled automatically since, if an attacker tampers with the choice made by the AAA server 24, the terminal and AAA server 24 would use different algorithms to compute the authentication values, and hence get failure. But in any case, some additional protection could be achieved (e.g. if one algorithm is particularly unfavorable from security point of view) as follows: the AAA server 24 includes not only the tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 41 of ⁵/\|V|ENDED SHEET°¹° ^15:27:52 tS&amp;ived at the EPO on Jul 01,2010 15:30:18. Page 41 of 53

01/07/2010

PCT/SE 2009/050 55T- uï-^7-l\710

CA 02736172 2011-03-04 ni ί η π ηηΐ η, mun i λ . β γ

Printed: 19/07/2010 « &lt;'

FAX 0046107175695 ?^shen

DESCPAMD

ΓΤίο τ» n tnei.

SE2009050554, authentication capabilities (AC), but also the actual chosen algorithm(s) in the generation of the cryptographic check values. For instance, if the AAA server 24 chooses authentication algorithm F, the FRES value is computed as FRES = F(K, RAND ||“F”) where “F” denotes some pre-determined way of identifying algorithm F. The value “F” is then also included in the signaling toward the terminal.

[000109] The following possible types of attacks should be considered: (1) The attacker modifies by adding a capability, c, that the terminal did not send; (2) The attacker modifies by deleting a capability, c, that the terminal sent. Type (1) is probably not very serious, as it would mean that the attacker adds a capability that the terminal does not support. Hence, the terminal will anyway be unable to compute the correct first cryptographic value (e.g., RES). Anyway, common to both types is that the authentication capabilities information (AC) value used by AAA server 24 will differ from that used by the terminal and hence they will derive nonmatching authentication values.

(000110] There are several advantages of the technology disclosed herein. Among the advantages are the following:

• Simple and efficient (shared-key based) protection against bidding down of authentication capabilities and other “basic” capabilities which may need to be signaled before authentication takes place.

• Provision for end-to-end security between terminal and the AAA server 24.

• Provision for “early” detection of tampering with capabilities (before security is switched “on”).

• Potential improved PKMv2 Wimax security protocol signaling.

[000111] The algorithms (corresponding to F, G, H, etc) are typically implemented in a UICC-like (Universal Integrated Circuit Card) of the terminal. In various embodiments of the technology disclosed herein only changes the inputs and/or the outputs to F, G and H. This means that UICCs are not affected and the technology disclosed herein can be provided as “software” encapsulation of the UICC.

ation: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 42 of 5^^Q[7Q SHEET^?01° ^15:28:06

Relived at the EPO on Jul 01,2010 15:30:18. Page 42 of 53

01/07/2010 , ηι/m ·&gt;«1 Λ. r_O„.a«-'37 fax 0046107175695 ^^2.372.*. .”2Â^hen

Printed: 19/07/2010 DESCPAMD &lt;·/

CA 02736172 2011-03-04 »

PCT/SE 2009/050 55?^99§S?^?iO [000112J Although the description above contains many specificities, these should not be construed as limiting the scope of the invention but as merely providing illustrations of some of the presently preferred embodiments of this invention. The scope of the present invention fully encompasses other embodiments which may become obvious to those skilled in the art, and that the scope of the present invention is accordingly not to be unduly limited. Reference to an element in the singular is not intended to mean one and only one unless explicitly so stated, but rather one or more. AH structural, chemical, and functional equivalents to the elements of the above-described preferred embodiment that are known to those of ordinary skill in the art are intended to be encompassed hereby. Moreover, it is not necessary for a device or method to address each and every problem sought to be solved by the present invention for it to be encompassed hereby.

tion: 01.07.2010 15:17:09 - 01.07.2010 15:30:18. This page 43 of q$|-|Ε£7'^01θ 15:28:15 tâ^ived at the EPO on Jul 01,2010 15:30:18. Page 43 of 53 /07/2010

CA 02736172 2015-12-14

CA2,736,172

P27134CA1