Apparatus to secure operations in a mobile radio network.

The invention relates to a device for securing operations are performed in a cellular network. It is to ensure the calls or data connections that are made by the participants over the radio path, provided in newer mobile radio systems a subscriber-specific key in two secure areas, namely the authentication center (AUC) at the home of the subscriber and the SIM of the subscriber, an intelligent module (SIM = subscriber Identity module), which can use the subscriber in any mobile device. the subscriber-specific key can not be removed, read or otherwise determined from both areas. Another feature of this system is a log-on request by the subscriber at any location (possibly abroad) stating its international subscriber number, stating the origin and carried out its forwarding to the authentication center via the signaling network.

The dispatch from the authentication center to the local exchange (MSC / VLR) is carried out in such a way at any location of the subscriber, that of a random number RAND (as challenge response) by means of user-specific key, a response code (SRES) and also from the random number and the subscriber-specific key optionally for the call-to-use key (KC) is calculated. The next steps are the query of the participant with the random number (RAND) by the local exchange and the calculation of the response code (SRES) and the key (KC) in the Subscriber Identity Module, the sending of the response code to the local exchange and delivery of the key ( KC) on its own mobile device, comparing the two resulting response codes in the exchange and in accordance approval of the log-on as well as the encryption of radio calls of the subscriber with the key (KC), which is in the exchange and the mobile device is known independently.

So Such system serves to secure interviews or data connections that are made by the participants via the radio link. However, it should also be achieved to secure the operations in a wireless network. This is for example required for sales outlets (distributors), provide the services of a mobile network operator to subscribers get the opportunity to create these participants themselves and with immediate effect in the exchanges of the operator. For this purpose it is necessary to the participant serving as electronic authorization card Subscriber Identity Module (SIM) to personalize, electronically to obtain from the network operator, if necessary by credit check approval of the new participant and to transmit its data to the accounting system of the network operator and the subscriber technically, d . h with his phone number and his or her individual rights in the competent local administration (HLR) to set up and release.

Because of the significant economic importance of this occurring over a public switched network operation appropriate safety precautions must be taken. and also to provide security within the internal operation of the network operator, in which accesses to databases by staff also subject to approval, this to improve, is the task of the invention.

This object is achieved according to the invention with a device in which using elements for securing the wireless transmission for addition to an authorization card (SIM Subscriber Identity Module) having subscriber to service authorized persons (third parties) a smart card as an authorization is provided on the phone number as origin a fictional authentication center (AUC), which is connected to all the computer equipment of the network operator and those in a position, by comparing a response code SRES, which is in itself when sending a log-on request from the authentication center a local exchange by sending a random number as a search word and the resulting calculation with a subscriber-specific key results, and a further response code SRES, which is formed during the interrogation of the subscriber with a random number by the local exchange and calculation in the SIM (subscriber Identity module) of the subscriber, to verify the identity of authorized person and to be used for a call connection key (KC) provides for the use by the terminal of the person authorized to carry out the preparation by their transactions.

Advantageous refinements and developments of the subject invention are disclosed in the dependent claims.

The invention will be explained in more detail.

The invention is based on the idea to use the funds earmarked for securing the radio transmission devices for securing operations are performed. For this, get employees, authorized dealers and other for operation authorized persons, each referred to as a third person, a smart card as an authorization, which corresponds exactly to a Subscriber Identity Module (SIM). The phone has a home a fictitious (logical) authentication center (AUC) of which is connected to all the computer equipment of the network operator and the authorization performs. In place of the local exchange (MSC / VLR) delivers the one data center or one data processing process of the network operator to which the third person trying to gain access. The logical authentication center (operating authentication center Bauc) added to the data center or the DV process in the situation, in the manner described above - by comparing the response code SRES -the identity of the third person to check and provides the key KC willing to the terminal the third person for the following transaction is used. The data center can hold for cooperating with him third parties sets of RAND (random number), SRES (response code) and KC (key) available, so that need not be asked back for each transaction during operation authentication center.

The operation authentication center (Bauc) manages all access privileges to computerized systems and the individual code KI of eligible persons (third parties). It can be housed centrally and secured while the individual computer systems are distributed in regional centers and the persons entitled to them from any location over any network, preferably also a public switched network such as the telephone network, the ISDM, the BTX put -Netz or the like. in conjunction.

The case of the accessibility of the operation authentication center via the signaling network results in that the authorization card of third person is also usable in a mobile device as a normal Subscriber Identity Module. The authentication request reaches correspondingly represents the number operating authentication center (BANC). The authorized person can lead a normal mobile phone call or reach the desired computer center via the mobile network. Here, criteria can be defined as the determined by the operating center authentication privilege of this special mobile subscriber is notified to the selected process (closed for example by membership of the subscriber to a user group).

To the electronic log-on or change of subscriber data to the authorized person (third person) has initially - as described above - to be shown, then the electronic device subscriber process is allowed. It is submitted then the Subscriber Identity Module of the respective participant. This may change over time, or - if the terminal used has two reading devices - also take place simultaneously with the proof of authorization of the authorized person. Thus it is guaranteed that the assignment to be personalized with new participants, pre-personalized Subsriber Identity Module (SIM) and the subscriber number (IMSI) contained therein to the permissions and is given free of errors person of the participant and that the case of changes in subscriber data subscriber has himself submitted his SIM for the change.

The verification of the subscriber SIM may be limited to reading the IMSI. In the presence of a signaling connection, it is also conceivable that the device process - again as a local exchange (MSC / VLR) agierend - by querying the authentication center of the participant performs a full authentication.