Method for the combined authentication of a telecommunications terminal and a user module in a communications network.

The present invention relates to a method for controlling access to a telecommunications network by means of a terminal operating with a user module. It is used in any communication system that requires authentication terminals.

Is known, for example from EP-A-0,552,392, for procedures for mutually authenticating a user unit and a terminal. These procedures allow the user to. ensure the authenticity of the terminal to which it presents its module. However, they do not inform the network about the authenticity of the terminal or module.

The communication network needs to know and verify the identity of users to ensure proper routing of communications and to enable billing. Most often, such as in the case of European cellular radio (GSM), each device is associated with a single user, and the authentication terminal and user is confused.

Currently, the concept of personal mobility grows, and it is desired to allow to be shared by multiple user terminals. This implies a separation between the management of users and terminal.

In the scheme currently applied to the GSM network, authentication is limited to the user modules. The terminal does not contain own security data. The withdrawal of the user module implies the absence of the authentication data related to the terminal. It becomes amorphous and is no longer reachable. When moving, especially during a location update procedure, the user module (SIM) which is authenticated (see the article "An application of smart card: the module 'subscriber identity of European digital radio "Pretty P. et al published in the Echo des Recherches No. 139, 1st quarter 1990, pages 13 to 20). In addition, if it is contemplated that the terminal can be shared by several users for receiving communications, it becomes possible for one user to be recorded on a terminal during a location update. It may be that the terminal does not physically has a user module during a location update; in this case, authentication is impossible and location update fails, it being noted that the terminals must be unable to use radio resources without being associated with users.

In view of the foregoing, a main object of the present invention is to provide a flexible process for the combined authentication of a user module and a terminal.

The invention thus proposes a method for controlling access to a telecommunications network by means of a terminal operating with a user unit, wherein a session key is calculated, on the one hand by the user unit and secondly by the network, based on data including a user identification key secretly stored in a memory of the user unit and a first random number provided by the network, the network finding the key to 'user identification on the basis of a user identification parameter from the terminal, characterized in that the terminal calculates an authentication key based on data including the session key calculated by the module user, a terminal identification key stored secretly in a memory of the terminal and a second random number provided by the network, in that the network calculated in the same way the authentication key based on data including the key session calculated by the network, the terminal identification key found by the network on the basis of a terminal identification parameter sent by the terminal and the second random number, and in that allows the terminal to access the network in the event of agreement between the authentication keys calculated by the terminal and the network.

The session key is used to control the user modules, while the authentication key is used to control in combination the user modules (via session key) and terminals. This access control mode offers flexibility. In particular, terminals and users can be managed by different entities. So when the network includes an access system and one or more user management units, the session key calculations are performed at the user management unit (under the service provider's control), while the authentication key calculations are performed at the access system (under the control of the network operator).

Preferably, the terminal stores the user identification parameter and the session key calculated by the user module, and the network stores the user identification parameter and the received terminal identification parameter of the terminal and the session key computed by the network. In this way, the physical association of the user module to the terminal is no longer required when a subsequent authentication procedure is performed, since it is not necessary to recalculate each time a session key. This advantage is especially important for cellular radiotelephone network, for which authentication procedures are generally conducted at each location last day of a mobile station.

With the method according to the invention may be considered to "register" multiple users on the same terminal. Access to the network by the terminal can be authorized for each of the user modules successively presented to the terminal, without crowding previous users. It is then provided that the terminal stores the user identification parameters for each of the modules that were presented to him successively, and at least one session key calculated for one of these modules, and the network stores the settings user identification related to each of these modules, the parameter for identifying the terminal and at least the session key computed by the network relatively to said module.

Other features and advantages of the present invention appear from the following description of a preferred embodiment but not limitative, with reference to the accompanying drawings, in which:<ul><li>Figure 1 is a block diagram of a cellular radiotelephone network and a mobile station associated, for the implementation of the invention; and</li><li>Figures 2 and 3 are diagrams illustrating the steps of authentication procedures carried out according to the method of the invention.</li></ul>

The invention is described below in its application to a cellular radiotelephony network. Those skilled in the art will understand that the method is easily generalized to other types of telecommunications networks. Figure 1 illustrates the well-known European GSM radio network architecture. For a general description of the network, one can refer to the article "The European digital cellular communication system with mobile" to Ghillebaert B. et al published in the Echo des Recherches No. 131, 1st quarter 1988 pages 5 to 16.

The cellular network includes a SAA access system, and one or more HLR user management units. The SAA access system is connected to a wired telephone network PSTN to enable mobile users to communicate with the wired network subscriber. The access system SAA includes a number of base stations BS spread over the territory covered, that provide the radio interface with the mobile stations. Each base station BS is controlled by a base station controller BSC is connected to a mobile services switching center MSC.

For user management, the management unit, or location register HLR includes a database 10 that stores the information necessary for managing communications with a number of mobile subscribers. The database 10 is associated with processing circuitry 11 that provide calculations and data traffic for communications management. The PAC access system further includes location registers VLR each associated with one or more switching centers MSC. VLR includes a database 12 containing a copy of the HLR records for all mobile subscribers that are in the cells dependent or switching centers MSC in question, and associated processing circuits 13.

A mobile station capable of communicating with the cellular network comprises an AP terminal associated with a user module SIM. The SIM module is either in the form of a memory card, either in the form of a snap-in which are stored various data specific to the user, including its identification parameter IMUI and its secret key d 'Ku user identification. Ku identification key is stored in a protected area of ​​the memory 15 of the SIM module. It is also stored in the database 10 of the user's home HLR, in correspondence with the identification parameter IMUI. Ku-key is never transmitted between two functional components involved in a communication for security reasons. Management IMUI and secret keys Ku parameters is provided by the network operator that has the HLR responsibility and delivers the SIM user modules. The memory 15 of the SIM module is associated with processing circuits 16 that perform calculations and ensure data exchange with the PA terminal.

For carrying out the method according to the invention, the PA terminal also comprises a memory 17 having stored therein data specific to the terminal, including the parameter for identifying the IMTI terminal and the secret identification key of the terminal D . the memory 17 is associated with processing circuits 18 that perform some calculations involved in the authentication process, and ensure data exchanges on the one hand with the SIM and the other with the access system SAA. One can foresee that the secret keys D are linked to corresponding identification parameters IMTI by a secret known only function of the network operator, which include the key D = f (IMTI) in a protected area of ​​memory 17 each terminal. The network (VLR) is then able to find the D key on a terminal on the basis of its identification parameter IMTI. When he appealed to such secret function f, the network does not need to have a home database of all available terminals or to determine the home network of each terminal.

The mode of communication between components of a mobile station and the cellular network is conventional and will not be detailed further here. We may in this regard refer to the article by B. Ghillebaert et al. cited above. Only the access control method to which the present invention will be described below with reference to Figures 2 and 3.

The access control process involves two separate cryptographic functions AG and AT. The first AG function is applied at the SIM modules and HLR management units to calculate session keys Ks. The algorithm of the AG function is stored both in the SIM modules (in a protected area of ​​the memory 15) and in the HLR. AG function is not necessarily the same for all manage HLR service providers. In the embodiment described, the AG function has three arguments: (i) the secret identification key Ku of the user concerned, and (ii) the IMTI parameter for identifying the terminal concerned, and (iii) a random number R1 provided by the network. AG function can of course have other arguments (eg IMUI identification parameter of the user in question), if you would like more diversity in the session key Ks.

AT the second cryptographic function is applied to calculate SRES authentication keys on the one hand at the level of PA terminals, and secondly at the level of SAA access system, specifically at the location register visitors VLR concerned. The algorithm of the AT function is stored both in the terminal (in a protected area of ​​the memory 17) and in the VLR. In the embodiment described, the TA function has three arguments: (i) the session key Ks calculated by the first GA function, (ii) the secret key D ID of the terminal concerned, and (iii) a second random number R2 provided by the network. Of course, the AT function can have other arguments (eg IMTI parameter for identifying the terminal in question), if we would like more diversity in the authentication key SRES.

A registration process and authorization of a user on a terminal PA is illustrated in Figure 2. When the user presents their SIM module to the terminal (or the power of the physically associated terminal SIM) the SIM module transmits to the terminal PA IMUI the user identification parameter stored in its memory 15. the terminal then sends a registration request including the parameter IMUI he has received the SIM and its own parameter IMTI identification stored in its memory 17. the SAA access system forwards the registration request to the VLR concerned. The VLR then generates two random numbers R1, R2 and transmits them to the PA terminal via the access system. The VLR informs the HLR also concerned the registration request, and transmits the identification IMUI parameters IMTI and the first random number R1.

The PA terminal then communicates its SIM IMTI identification parameter and the first random number R1. The SIM module calculates the session key Ks = AG (Ku, IMTI, R1), and transmits it to PA terminal. The terminal calculates the SRES authentication key based on the key Ks session that just received from the SIM from its secret key D ID, and the second random number R2: SRES = AT (Ks, D , R2). This authentication key SRES is sent by the terminal to the VLR via the access system.

Based on the user identification parameter IMUI it received from the VLR, HLR found in its database 10 the secret key Ku IMUI associated with this parameter. It then calculates the secret key Ks = AG (Ku, IMTI, R1), and transmits to the VLR. Based on the IMTI terminal identification parameter it received from the PA terminal, the VLR finds the secret key D = f (IMTI). It then calculates the authentication key SRES according to the key Ks session he received from the HLR, the key terminal D Identification it has found, and the second random number R2: SRES = AT (Ks, D, R2). The VLR then compares the authentication key SRES he calculated himself that he received from the PA terminal, to determine whether the terminal should be allowed to access the network. In case of agreement between the key authentication, authorization is given to the PA terminal which then stores the IMUI user identification parameter and the session key Ks he received from the SIM module. For its part, the VLR stores IMUI identification parameters and IMTI and the session key Ks he received from the HLR, then it allocates the session IMUI / IMTI a forwarding number MSRN to communicate HLR. The HLR can then store the data relating to the user identified by the IMUI parameter, namely the parameter for identifying the IMTI terminal, the session key Ks calculated by the HLR, and the re-routing number MSRN allocated by the VLR.

Authentication thus deals with both the user unit (through the session key Ks) and on the terminal.

Once the registration process and authentication illustrated in Figure 2 is completed, the user can remove its SIM module while remaining registered with the PA terminal. If outside for this user appeal, the HLR is interrogated and found the VLR concerned on the basis of the MSRN forwarding number associated with that user IMUI. The VLR can then determine the base station BS which can communicate with the PA terminal on which is inscribed the user. The communication can be established without a new session key Ks is calculated, it is has to say without the user need to reintroduce its SIM module. In the case of a call from the mobile user, it is preferably provided that it should reintroduce its SIM module and the registration and authorization procedure illustrated in Figure 2 is renewed.

After registration and authorization of user IMUI and removing the SIM module of the user, it is possible to register on the same terminal IMUI another user '. The applied procedure is essentially the same as that illustrated in Figure 2. A new session key Ks 'and a new authentication key SRES' are calculated, and authentication is performed based on the authentication key SRES '. Where authorization is effective, the PA terminal stores both user identification parameters IMUI, IMUI 'and the session key Ks', and the VLR stores the two user identification parameters IMUI, IMUI' the identification parameter IMTI terminal, and the session key Ks'. The new session key Ks' is shared among different users IMUI, IMUI enrolled in the PA terminal. It is also possible to remember the two session keys Ks and Ks 'IMUI each user, IMUI' while keeping its own session key. The procedure below is applicable in the same way for the registration of any number of users on the same terminal.

The subsequent authentication procedure for network-initiated or at a terminal location update is illustrated in Figure 3. When the PA terminal has determined that it needs to change of location area, it transmits the VLR concerned an authorization request including the user ID parameter IMUI registered, and the ID parameter IMTI terminal. The VLR then searches its database 12 if it has stored a session key Ks in relation IMUI and IMTI parameters.

If the VLR finds no session key in relation IMUI and IMTI, it is in the case of a location update with change of connecting VLR. Based on the user identification parameter IMUI, the VLR is able to determine the HLR manage the communications of the user. It transmits to the HLR and IMUI IMTI parameters. The HLR finds himself involved in its database 10 Ks session key associated with the user and IMUI IMTI terminal, and transmits this key Ks session VLR. The VLR then generates a random number R2 that transmits to the PA terminal via the access system. The PA terminal calculates an authentication key SRES according to the session key Ks which has been previously stored, its secret identification key D and the random number R2 that he just received from the VLR: SRES = AT (Ks, D, R2). This authentication key SRES is transmitted by the AP to the VLR terminal. For its part, the VLR finds the secret identification key of D terminal on the basis of parameter IMTI he received. It then calculates the authentication key SRES according to the session key Ks he received from the HLR, the key D that has just found, and random number R2: SRES = AT (Ks, D, R2). The VLR compares the authentication key SRES it has determined that he received from the PA terminal and, when matched, it gives permission to communicate to the PA terminal. Where authorization is effective, the VLR stores the credentials IMUI, IMTI, and key Ks session he received from the HLR, then it allocates a new forwarding number MSRN to the user. The forwarding number is transmitted to the HLR, which stores it in relation to the identification parameters IMUI, IMTI and the session key Ks. The HLR ultimately informs the old VLR, in which the user was previously registered, that can erase its records for the user and IMUI IMTI terminal.

In the case where initially the VLR finds a session key Ks associated with the identification parameter IMUI, IMTI, it is in the case of a location update with no change of VLR. Applied authentication procedure is then the same as that illustrated in Figure 3 except that the steps shown enclosed by dashed lines do not need to be performed. In this case, no data exchange between the VLR and the HLR is required.

Subsequent authentication procedures illustrated in Figure 3 are similarly applicable when several users IMUI, IMUI ', ... are simultaneously recorded on the same terminal PA.

After the registration of one or more users, the terminal can be authenticated independently, regardless of the associated SIM modules (SIM module is not involved in the diagram in Figure 3). This advantage is especially important for radio networks need to authenticate terminals at location updates.

It will be observed that the process described above as an example may be adjusted to take account of constraints specific to each network type. For example, it is expected that the credentials of users and IMUI terminals IMTI, who have not the same degree of confidentiality as the secret keys Ku, D, are not transmitted in the clear over the radio interface between base stations and mobile stations, this interface is accessible to all. Mention may in particular transmitting the identification parameters in an encoded form dependent on the location area of ​​the mobile station. A well known example of such a coding mode is applied in the case of GSM to define the temporary mobile subscriber identity (TMSI) of users (see Recommendations No. GSM 02.09, 02.17, 03.20 and 03.21).

We can still provide that the random numbers R1 in calculating session keys are generated by the HLR and not by the VLR. In particular, when the VLR transmits a registration request to the HLR with the IMUI and IMTI parameters (Figure 2), the HLR can generate several random numbers R1₁, ..., R1_not and calculate key corresponding sessions Ks₁, ..., Ks_not. It then transmits several couples (R1_i, Ks_i) To the VLR which selects one of them for the calculation of the authentication key SRES. When the registration and authorization procedure is subsequently renewed (at the initiative of the network or when a call from the mobile station), the VLR can use another pair (R1_i, Ks_i) Without having to go back to the HLR. This provision, applied in a comparable way in the current GSM system advantageously reduces the number of exchanges between the VLR and the HLR.