A method of carrying out an authentication check between a base station and a mobile station in a mobile radio system.
Abstract
A method for carrying out an authentication check in a mobile telephone system in which an authentic base station (BS) serves a plurality of mobile stations (MS1-MSn). It is earlier known to carry out a unidirectional check from the base station (BS) to a calling mobile station (MSk). A false base station (BSf) is able, in this way, to carry out a false authentication check, by collecting a number of so-called RAND-Response pairs. In order to avoid this, there is introduced a further unidirectional authentication check, base station-mobile station, and also an authentication check from the mobile station to the base station. According to one embodiment of the method, the unidirectional check is excluded and only the bidirectional authentication check is carried out. <IMAGE>
Term
Term ended
Expired 8 March 2006, 20.5 years ago.
- Priority
- Filed
- Granted
- Expired
- Today
35 claims: 8 independent, 27 dependent
- 1CLAIMS REIVINDICACÕES 1 Arrangement for performing an authentication check between a base station (BS) and a mobile station (MSk) in a mobile radio network, in which prior to establishing a connection, the base station sends a question regarding mobile authentication and orders the rover to send a first response signal (Resp 1), which is used at the base station to establish rover authentication, characterized in that the base station comprises microprocessor-controlled transmission means for sending a second response signal (Resp 2) to the mobile (MSk) subsequent to establishing the mobile authentication at the base station to establish the base station authentication , and base station transmission means controlled by the microprocessor means (13) to send a third response signal (Resp 3), and to establish mobile authentication before making the connection. 1 - Disposição para realizar uma verificação de autenticação entre uma estação base (BS) e uma estação móvel (MSk) numa rede rádio móvel, na qual antes do estabelecimento de uma ligação, a estação base envia uma pergunta relacionada com a autenticação do móvel e ordena ao móvel para enviar um primeiro sinal de resposta (Resp 1), que é usado na estação base para estabelecer a autenticação do móvel, caracterizada por compreender na estação base meios de transmissão controlados por meios de microprocessador para enviarem um segundo sinal de resposta (Resp 2) para o móvel (MSk), subsequente ao estabelecimento da autenticação do móvel na estação base, para estabelecer a autenticação da estação base, e meios de transmissão da estação base controlados pelos meios de microprocessador (13) para enviarem um terceiro sinal de resposta (Resp 3), e para estabelecerem a autenticação do móvel antes de estabelecerem a ligação.
- 44 A process for performing an authentication check between a base station (BS) and a mobile station (MSk) in a mobile radio network, where prior to establishing a connection, the base station sends a question regarding mobile authentication and orders the to send a first response signal (Resp 1), which is used at the base station to establish rover authentication, characterized in that subsequent to the establishment of rover authentication (2, 3, 4) at the base station, a second response signal (Resp 2) is sent from the base station to the mobile which forms with it in (8) a corresponding second response signal (Resp 2) to establish in (9) ) base station authentication, and when this authentication is established, the mobile sends a third reply signal (Resp 3) and establishes the mobile authentication before the connection is established. 4 - Processo para realizar uma verificação de autenticação entre uma estação base (BS) e uma estação móvel (MSk) numa rede rádio móvel, em que antes do estabelecimento de uma ligação, a estação base envia uma pergunta referente à autenticação do móvel e ordena ao móvel para enviar um primeiro sinal de resposta (Resp 1), que é utilizado na estação base para estabelecer a autenticação do móvel, caracterizado por, subsequentemente ao estabelecimento da autenticação do móvel (2, 3, 4) na estação base, ser enviado da estação base um segundo sinal de resposta (Resp 2) para o móvel, o qual forma com o mesmo em (8) um segundo sinal de resposta correspondente (Resp 2), para estabelecer em (9) a autenticação da estação base e, quando é estabelecida esta autenticação, o móvel envia um terceiro sinal de resposta (Resp 3) e estabelece a autenticação do móvel, antes da ligação ser estabelecida.
- 77 - Processo para realizar uma verificação de autenticação entre uma estação base (BS) e uma estação móvel (MSk), numa rede rádio móvel, subsequentemente à estação móvel ter pedido e ser reservada uma ligação através de um dado canal, caracterizado por compreender a formação na estação base (BS) de um primeiro sinal de resposta (Resp 2), o envio do dito primeiro sinal de resposta para o móvel (MSk) que forma com o mesmo um correspondente sinal de resposta (Resp 2) com o objectivo da verificação da autenticação da estação base e, subsequentemente ao estabelecimento de tal autenticação, o móvel envia um segundo sinal de resposta (Resp 3) para a estação base, que forma um sinal de resposta correspondente e estabelece a autenticação do móvel, antes do estabelecimento de uma ligação. 7th Method for performing an authentication check between a base station (BS) and a mobile station (MSk) in a mobile radio network after the mobile station has requested and reserved a connection through a given channel, characterized in that it comprises forming at the base station (BS) of a first response signal (Resp 2), sending said first reply signal to the mobile (MSk) which forms with it a corresponding reply signal (Resp 2) for the purpose of verifying the base station authentication and, subsequent to the establishment of such authentication, the mobile sends a second reply signal (Resp 3) to the base station, which forms a corresponding reply signal and establishes mobile authentication prior to establishing a connection.
- 1921 4. A method according to which the other data includes claim 18, the dialed number. 21 - Processo de acordo com a caracterizado por os outros dados incluírem reivindicação 18, o número marcado.
- 2325 Method for controlling call establishment between a network and a mobile station within the area covered by the network, comprising the steps of:25 - Processo para controlar o estabelecimento de chamadas entre uma rede e uma estação móvel dentro da área coberta pela rede, caracterizado por compreender os passos de: enviar o primeiro sinal aleatório de rede para a estação móvel;send the first random network signal to the mobile station;calcular na estação móvel o primeiro valor, o qual está dependente do primeiro sinal aleatório recebido da rede;calculating at the mobile station the first value, which is dependent on the first random signal received from the network;enviar o primeiro valor da estação móvel para a rede;send the first value from the mobile station to the network;calcular na rede um valor correspondente ao primeiro valor;calculate in the network a value corresponding to the first value;calcular na rede um segundo valor que está dependente de um segundo sinal aleatório;calculate in the network a second value that is dependent on a second random signal;comparar o primeiro valor com o correspondente primeiro valor;compare the first value with the corresponding first value;reservar para a estação móvel um canal de fala, se o primeiro valor coincide com o primeiro valor correspondente;reserve a speech channel for the mobile station if the first value coincides with the first corresponding value;72 179 72 179 LM 4869/13139 LM 4869/13139 -14enviar o segundo valor e o segundo sinal aleatório da rede para a estação móvel;Sending the second value and the second random signal from the network to the mobile station;calcular na estação móvel um valor correspondente ao segundo valor;calculate at the mobile station a value corresponding to the second value;comparar calcular dependente do enviar o calcular o segundo com o segundo valor correspondente;compare calculate dependent on send or calculate the second with the second corresponding value;at the mobile station a third value, which is a second random signal;na estação móvel um terceiro valor, o qual está segundo sinal aleatório;terceiro valor da estação móvel para a rede;e na rede um valor correspondente ao terceiro valor;third value from the mobile station to the network;and in the network a value corresponding to the third value;comparar o terceiro valor com o terceiro valor correspondente;e estabelecer a chamada entre a rede e a estação móvel se o terceiro valor coincide com o terceiro valor correspondente. compare the third value with the corresponding third value;and establishing the call between the network and the mobile station if the third value matches the corresponding third value.
- 2729 Authentication process in a mobile radio network, including a network and a mobile station, characterized in that it comprises the steps of;29 - Processo de autenticação numa rede rádio móvel, incluindo uma rede e uma estação móvel, caracterizado por compreender os passos de;between the network and the mobile station;entre a rede e a estação móvel;72 179 72 179 LM 4869/13139 LM 4869/13139 -15 generate a random number;-15gerar um número aleatório;exchange the random number to calculate on the network and mobile station an authentication number which is a function of each random number;permutar o número aleatório calcular na rede e na estação móvel um número de autenticação que é uma função de cada número aleatório;transmit the calculated authentication number on the network to the mobile station;and comparing the calculated authentication number on the mobile station with the authentication number received from the network. transmitir o número de autenticação calculado na rede para a estação móvel;e comparar o número de autenticação calculado na estação móvel com o número de autenticação recebido da rede.
- 3234 Method for performing an authentication check between a network and a mobile station in a mobile radio network, comprising the steps of:34 - Processo para a realização de uma verificação de autenticação entre uma rede e uma estação móvel, numa rede rádio móvel, caracterizado por compreender os passos de: seleccionar um primeiro valor aleatório;select a first random value;72 179 72 179 LM 4869/13139 LM 4869/13139 -16 providing the first random value to the network and the mobile station;-16proporcionar o primeiro valor aleatório à rede e à estação móvel;calcular na rede e na estação móvel um primeiro valor de autenticação a partir do primeiro valor aleatório;calculating on the network and mobile station a first authentication value from the first random value;enviar o primeiro valor de autenticação calculado na estação móvel para a rede;send the first calculated authentication value at the mobile station to the network;comparar o primeiro valor de autenticação calculado na rede com o primeiro valor de autenticação recebido da estação móvel;compare the first calculated authentication value on the network with the first authentication value received from the mobile station;seleccionar um segundo valor aleatório;select a second random value;proporcionar o segundo valor aleatório à rede e à estação móvel;providing the second random value to the network and the mobile station;calcular na rede e na estação móvel um segundo valor de autenticação a partir do segundo valor aleatório;calculate on the network and mobile station a second authentication value from the second random value;enviar o segundo valor de autenticação calculado na rede para a estação móvel;e comparar o segundo valor de autenticação calculado na estação móvel com o segundo valor recebido da rede. send the second calculated authentication value on the network to the mobile station;and comparing the second authentication value calculated on the mobile station with the second value received from the network.
- 3436 Authentication process in a mobile cellular telephone network, including a network and a mobile station, comprising the steps of:36 - Processo de autenticação numa rede telefónica celular móvel, incluindo uma rede e uma estação móvel, caracterizado por compreender os passos de: 72 179 72 179 LM 4869/13139 LM 4869/13139 -17 transmit the calculated authentication output on the network to the mobile station;and comparing the calculated authentication output on the mobile station with the authentication output received from the network. -17transmitir a saída de autenticação calculada na rede para a estação móvel;e comparar a saída de autenticação calculada na estação móvel com a saída de autenticação recebida da rede.
Independent claims8
38 paragraphs in 9 sections, as filed
TECHNICAL FIELD
The present invention relates to an arrangement for performing an authentication check between a base station and a mobile station in a mobile radio network, particularly in a cellular mobile telephone network. The proposed arrangement may also be applied to other mobile radio networks, for example message transmission networks.
PREVIOUS ART
In the case of a cellular mobile telephone network, for example, an authentication check is performed before a call is made between the mobile and the base station. The base station requests information about the mobile, regarding its identity, requesting the mobile to send an identification number. 0 The mobile is thereby forced to disclose its identity to the base station, so that the base station will know that the mobile is authorized to send a call over the network, so that the base station and also the central office know which mobile which should be carried by the subsequently established call.
On the other hand, the mobile station must be certain that it communicates with the genuine base station, that is, with a base station that is truly authorized to connect a call when the mobile is the caller (the mobile is a subscriber). A), and the call to the mobile station will be debited correctly.
For the purpose of performing an authentication check, it was previously known to form authentication signals, Resp signals, at the base station and mobile station. A random number (RAND) is sent from the base to the furniture within the area covered by the base station. The calling mobile responds to a given signal (Resp 1). Similarly, the base station forms the
179
LM 4869/13139
<img file="PT96979B_D0001.tif" />
-3same Resp 1 signal from the random number and identity of the calling mobile. Usually these signals coincide and the base station arranges the mobile for a speech channel.
DESCRIPTION OF THE INVENTION
Thus, in the aforementioned known arrangement for performing authentication checks, an RANDR response pair is formed for a given mobile station, that is, a given Answer signal is formed on the mobile for a given random received RAND number, and a base station it may thereby receive a number of such response signals for a number of different random numbers. This means that it is possible to establish a false base station which is capable of transmitting a number of mutually different random numbers and receiving a corresponding (different) number of Answer signals. The fake base station is also capable of creating a mobile subscription, which is not allowed to send calls over the network. This disadvantage or deficiency of the known authentication verification is due to the fact that the verification is unidirectional, namely it is only the base station that requires the reply signal as proof of mobile authentication.
According to the present arrangement, authentication verification is bidirectional, that is, not only the base station needs the identity of the rover, but the rover also needs the identity of the base station.
It is therefore the object of the present invention to provide an improved authentication verification arrangement which makes manipulation by a fake base station with the intention of gaining access to the authentication code of the mobile telephone network impossible.
The arrangement of the invention is characterized in that it includes the means set forth in the characterizing part of claim 1. Further developments of the proposed arrangement are set forth in subordinate claims 2 and 3.
<img file="PT96979B_D0002.tif" />
179
LM 4869/13139
-4 BRIEF DESCRIPTION OF DRAWINGS
The invention will now be described in greater detail with reference to the accompanying drawings, in which:
Figure 1 schematically illustrates communication between two base stations and a plurality of mobile stations;
Figure 2 is a flow chart of the operation of one embodiment of the proposed arrangement;
Figure 3 is a block diagram of the input and output quantities of an authenticity algorithm included in a mobile station; and Figure 4 is a flowchart illustrating another embodiment of the proposed arrangement.
BEST WAY TO CARRY OUT THE INVENTION
Figure 1 illustrates a genuine B8 listening base station transmitting random numbers to a plurality of MS1MSn rovers over a given control channel. From these mobiles, a response is received from a mobile Msk indicating that it wishes to establish a call through a given speech channel. As described above, a one-way authentication check is performed when the base station needs a Resp 1 response from the mobile MSk. This will be described in more detail below with reference to Figure 2. Since during this stage the connection is unidirectional, a false base station EiSE is able to obtain a response from a plurality of mobile phones when transmitting the random RAND number behind. mentioned in the manner mentioned above. The I3SE base station is also capable of creating a RAND-Reply replica bank, which can then be used in a manner not authorized by a mobile station.
In order to make this impossible, an authentication arrangement is proposed according to the invention that functions in accordance with
<img file="PT96979B_D0003.tif" />
179
LM 4869/13139
5th flow chart of Figure 2.
A genuine BS base station listens to a plurality of mobile MS1-MSn within the area covered by said base station, transmitting a random number block 1 RAND »
A given mobile station MSk wishing to establish a call responds with an Resp 1 signal block 2. This signal is formed on the mobile microprocessor from a PIN, ESN and DN input data number, added to the received random RAND number, see Figure 3, where PIN represents the mobile personal identification number, ESN represents the mobile number. serial number of the mobile, and DN represents the dialed number. The mobile station MSk is also a subscriber. The microprocessor 13 then sends the Resp 1 signal which consists of an 18 bit AUTH signal and an 8 bit RANDC signal. , which is sent to the base station.
The base station calculates Resp 1 correspondingly, block 3, from the AUTH and RANDC input signals, and makes a comparison with the calculated and transmitted Resp signal value by the mobile, block 4. When these match, the base station arranging the mobile for a given reserved speech channel, block 5, and the connection is established in a known manner, block 6. The operation of the aforementioned arrangement is known in advance.
According to the proposed arrangement, the base station now forms a Resp 2 response signal from an additional random number RAND 2, and from the mobile PIN personal identification number, this number being known at the base station (blocks 2, 3) »Both Resp 2 and RAND 2 are sent to the mobile, block 7.» The mobile station forms a value of Resp 2 from its PIN and the received RAND 2 random number, block 3. A comparison is now made on the mobile block 9 between the received Resp 2 and the formed Resp 2 value. If these two values match, the mobile forms a Resp 3 value and sends this value to the base station, block 10. Resp 3 is formed from RAND 2 and PIN on the mobile. The base station forms Resp 3 in a similar manner from RAND 2 and PIN,
179
LM 4869/13139
<img file="PT96979B_D0004.tif" />
which are known at the base station, block 11. A comparison, block 12, is then made between the received values and formed Resp 3 values. If the values match, the call connection continues to establish a speech connection.
The operating stages of the arrangement according to blocks 7, 8 and 9 provide an authentication check, in which the mobile decides whether or not the base station is genuine, provided that the verification of the Resp 2 signal sent from the base station take place on the mobile, and compared to a Resp 2 value calculated on said mobile. The base station signal Resp 2 may therefore be considered as a response signal from said station. 0 The functioning of the above provision constitutes the main difference between the proposed provision and the known arrangement according to blocks 2, 3 and 4.
The verification performed in accordance with blocks 10, 11 and 12 is substantially a repetition of the operation of the arrangement according to blocks 2, 3 and 4, i.e. a verification from the base station that the furniture is genuine.
A key difference with respect to the operation of the known authentication arrangement (blocks 1-4) is that the mobile also requires a Resp 2 response from the base station and checks this response according to blocks 7--9. A false base station must therefore know exactly how this response signal will be calculated. Verification is also bidirectional.
Authentication verification according to blocks 2, 3 and 4 can be performed on a general control channel in the mobile radio network, and authentication verification according to blocks 7- · 12 can be performed on the speech channel established between BS base station and mobile MSk (blocks 5 and 6).
Figure 4 is a block diagram illustrating the early stages of the arrangement in which case only a bidirectional authentication check is performed. In this case, the stages according to blocks 1-3 replace the
179
LM 4869/13139 ~ 7 ~
<img file="PT96979B_D0005.tif" />
stages according to blocks 1-6 of FIG. 2. In this case, uidirectional authentication is not performed (and known) - A calling rover, for example MSk, requests a connection from base station BS. Upon receiving this call request, the BS base station searches for a free speech channel and arranges the mobile MSk on this free channel. Thus, a free connection is established through the speech channel without performing an authentication check. The actual authentication check is then performed in the manner previously described with reference to blocks 7-12 of FIG. 2, That is, only a two-way authentication check is performed.
Contents9
5 sheets
Sheet 1 Sheet 2 Sheet 3 Sheet 4 Sheet 5
42 members in 24 offices
Priority claims4
| Document | Office | Kind | Date |
|---|---|---|---|
| 9000856 | Sweden | A | |
| 9000856 | Sweden | A | |
| 9000856 | – | – | – |
| SE19900000856 | – | – | – |
Members42
| Document | Office | Kind | |
|---|---|---|---|
| SE9000856D0 | Sweden | D0 | |
| CA2051385A1 | Canada | A1 | |
| SE9000856L | Sweden | L | |
| IE910544A1 | Ireland | A1 | |
| EP0447380A1 | European Patent Office (EPO) | A1 | |
| WO9114348A1 | World Intellectual Property Organization (WIPO) | A1 | |
| CN1054868A | China | A | |
| AU7495291A | Australia | A | |
| SE465800B | Sweden | B | |
| FI915237A0 | Finland | A0 | |
| NO914357D0 | Norway | D0 | |
| NO914357L | Norway | L | |
| BR9104907A | Brazil | A | |
| KR920702171A | Republic of Korea | A | |
| JPH04505693A | Japan | A | |
| TW199250B | Taiwan Province of China | B | |
| PT96979A | Portugal | A | |
| AU638820B2 | Australia | B2 | |
| NZ236936A | New Zealand | A | |
| US5282250A | United States of America | A | |
| CN1024241C | China | C | |
| MY105349A | Malaysia | A | |
| US5390245A | United States of America | A | |
| EP0447380B1 | European Patent Office (EPO) | B1 | |
| AT121254T | Austria | T | |
| ATE121254T1 | Austria | T1 | |
| DE69108762D1 | Germany | D1 | |
| HK101895A | Hong Kong, China | A | |
| DK0447380T3 | Denmark | T3 | |
| ES2073726T3 | Spain | T3 | |
| DE69108762T2 | Germany | T2 | |
| IE67887B1 | Ireland | B1 | |
| US5559886A | United States of America | A | |
| PH30204A | Philippines | A | |
| NO300249B1 | Norway | B1 | |
| KR0144560B1 | Republic of Korea | B1 | |
| PT96979BThis record | Portugal | B | |
| FI102134B | Finland | B | |
| FI102134B1 | Finland | B1 | |
| CA2051385C | Canada | C | |
| SA76B1 | Saudi Arabia | B1 | |
| SA91110255B1 | Saudi Arabia | B1 |
3 legal events, as the office reported them to INPADOC
Over the term
Point at a mark for the eventEvents
| Event | Code | |
|---|---|---|
| Annulment/lapse due to non-payment of fees, searched and examined patentLapsedMM4A | MM4A | |
| Patent granted, date of grantingGrantedFG3A | FG3A | |
| Laying open of patent applicationBB1A | BB1A |
Numbers
- Publication, DOCDB
- 96979
- Publication, EPODOC
- PT96979
- Application
- 96979
- Application, DOCDB
- 9697991
- Application, EPODOC
- PT19910096979
Titles2
- English
- PROCESS AND ARRANGEMENT TO PERFORM an authentication check BETWEEN A BASE STATION AND A RAILWAY STATION IN A MOBILE RADIO NETWORK MOBILE
- Portuguese
- PROCESSO E DISPOSICAO PARA REALIZAR UMA VERIFICACAO DE AUTENTICACAO ENTRE UMA ESTACAO BASE E UMA ESTACAO MOVEL NUMA REDE RADIO MOVEL
Classification
- CPC, 2
- H04W12/06
- H04W84/00
- IPC, 2
- H04L9 32
- H04W12 06