Method and arrangement for communications security

METHOD AND ARRANGEMENT FORCOMMUNICATIONS SECURITY

TECHNICAL FIELD

0003This invention is concerned with a method and arrangement in a communication network for establishing a secure connection between one or more access points and a terminal in a network. The invention is especially advantageous at handover processes in wireless packet based networks for communication with a mobile terminal .

0004BACKGROUND A security risk in wireless communication is that the information can be listened in to or intercepted by- unauthorised entities. Therefore, most wireless networks include some kind of built-in security functions. In the network there are of course, in addition to the different built-in security functions, access points which may require passwords and other information for entering the wireless network.

0005A risk in a packet data based network is that the packets transferred in the network may arrive at or be caught by wrong terminals. Another risk is that a terminal may impersonate another one and send packets on behalf thereof .

0006Hence, wireless packet data systems include the security risks of both wireless communication and packet data networks. These risks can potentially make the system highly vulnerable to security attacks. Reliable security functions are essential in getting wireless packet data networks widely accepted.

0007Other methods of making the communication between terminals communicating with each other in a network secure are end-to- end authentication and encryption. These methods ensure that the receiver can verify that a data packet has really been transmitted by the claimed sender and that third parties capturing data packets can not understand their content because they cannot be read without a given decryption key. Because packets can be captured and forged over wired as well as wireless links, end-to-end security solutions need not be wireless specific.

0008In wireless access networks, however, packets exchanged between mobile terminals - and wireless access points also carry important control information related to mobile users. This represents a potential security risk enabling malicious users to listen to or forge control information. Forged packets could interfere with routing, charging, location management or other functions associated with the attacked user. In addition to end-to-end security functions, wireless access networks therefore have local mechanisms to authenticate and encrypt packets exchanged between mobile devices and wireless access points .

0009By decoupling local authentication and encryption mechanisms from end-to-end security support it is ensured that charging and authentication information related to a particular mobile user remains protected even when the user is engaged in a "regular", i.e. unprotected session. In addition, decoupling allows mobile users to run secure data sessions over a secure wireless network without sharing end-to-end secret keys with the access network. It is furthermore advantageous if the endpoint of this local secure relationship at any time is the access point to which the mobile terminal is actually connected. This allows packets originating from mobile units to be authenticated as soon as they enter the access network. This is important because packets originating from mobile units may trigger actions related to charging and routing information associated with the sending mobile device .

0010Different methods of implementing secure relationships exist. Symmetric methods rely on a secret key shared by two or more entities. This key must be exchanged between the communicating parties prior to communication and the same key is used for both encryption and decryption. Before transmitting a packet, the sender uses the secret key to compute an authentication field or to encrypt a payload. The receiver uses the same key to verify the authentication field or to decrypt the packet. An example of a method of exchanging secret keys is disclosed in the RFC 2409 standard concerned with Internet Key Exchange. A secret key based packet authentication mechanism is presented in P. Metzger, : Simpson, "IP Authentication using Keyed MD5" , Internet RFC 1828, August 1995.

0011Asymmetric security solutions rely on pairs of public and private keys. An entity willing to send authenticated packets uses its own private, e.g. secret, key to generate the authentication field. In addition, the sender advertises the public key associated with its private key. Authentication data generated by a given private key can only be decoded using the associated public key. This allows receivers having the public key to determine whether the packet was really transmitted by the claimed sender.

0012PGP digital signatures are an example of asymmetric authentication. By means of the PGP software, two binary numbers are generated, the public and the private key. These are saved in a separate file, but the public key is converted to ASCII format so that it can be distributed to everyone that intends to send messages to the user. The private key shall be kept secret and it is even encrypted before saving.

0013In summary, both symmetric and asymmetric security techniques require the receiver to have some kind of security information associated with the sender. In symmetric solutions, this information is the shared secret key, whereas in asymmetric solutions it is the sender's public key. Security information must either be available to the sender and the receiver prior to communication or it must be obtained when the communication session is established.

0014A mobile terminal is allowed to roam large areas while maintaining connectivity to a wired network. The terminals may migrate from one access point to another during active communication sessions by means of handover methods. In an handover process, the access point through which the communication is performed is changed. Security considerations require the mobile terminal to have a secure relationship with the access point to which it is actually attached.

0015Due to the potentially large number of access points and mobile devices, there are benefits of not having a pre-established secure relationship with all access points of an access network. Instead, a secure relationship is established as the mobile terminal migrates to an access point.

0016Conventional methods require the access point to obtain security information from a central server at handover. These solutions do not give a smooth handover due to the time that they require and they are therefore in contradiction with the quality requirements of access networks. In addition, such methods encounter scalability problems because the load on the central server represents a single point of failure. Finally, such server based methods rely on explicit signalling messages between access points and servers, what raises problems in low- end packet data environments built without using signalling, such as those described in A. Valkδ, "Cellular IP - A new approach to Internet Host Mobility" ACM Computer Communication Review, Vol. 29, No. 1, January 1999, pp. 50-65.

0017Another solution for the access points is to obtain security information from an adjacent access point, to which the mobile terminal has been connected prior to handover. Whereas this solution eliminates the scalability problems represented by the server approach, it has similar disadvantages in terms of the requirement of relying on explicit signalling messages. In addition, some access networks may not support direct communication between access points .

0018MOTOROLA INC. discloses an example of a prior art handover method in the published International Patent Application WO 96/36191. It describes a system in which handover involves exchanging control messages between access points and (semi) - centralised control points. This system also gives a possibility for security information related to the mobile device to be exchanged in the same way. In the method disclosed in this prior patent application, there is a need for centralised control and for control messaging at handover. Another example of a method that involves control messages between access points at handover is disclosed in the published European Patent Application 0 851 633, filed by LUCENT TECHNOLOGIES INC. In the GSM technique (Global System for Mobile Telecommunications) , a conventional authentication method is used in which the mobile device is not in a secure relationship with the access point or base station. Instead, it is in secure relationship with the MSC, see M. Mouly, M-B. Pautet, "The GSM System for Mobile Communication", ISBN 2-9507190-0-7. A description of the GSM authentication details can be also found in the published International Patent Application WO 97/01943, p. 11, lines 1-25, these details described therein as being prior art .

0019Thus, existing methods of establishing secure relationship between mobile terminals and access points have serious limitations. Whereas the server-based approach is applicable to cellular telephony networks, it becomes inefficient in packet data systems in which the cell sizes typically are smaller and handovers thus more frequent .

0020The published International Patent Application WO 97/01943 instead discloses a solution to a similar problem as this invention, i.e. avoiding authentication-related messages between the base station and the central server for economical reasons . This prior art method uses a concept in which messages between the old and the new base stations are instead exchanged via the terminal .

SUMMARY OF THE INVENTION

0022The object of the present invention is to provide a method in which the mobile device is not required to act as a relay station thereby avoiding that the constrained radio resource and power available for the mobile device are used for this purpose. In addition, relaying through the mobile device only works if the mobile spends a sufficient amount of time within the area in which the two access points are reachable by wireless communication. Furthermore, the method disclosed in the cited International Patent Application WO 97/01943 is only capable of providing authentication once, when handover is performed. An object of this invention is to find a more general method in which any message sent between a mobile device and an access point can use the shared secret for security.

0023The general object of the invention is to provide a method that allows mobile terminals to establish secure relationships in a very short time at handover.

0024In addition, in association with the recent emergence of low- end access networks having no signalling support, the object of the invention is to provide a method that does not presuppose the use of any signalling messages for handover.

0025Thus generally, a method is provided to be used in a packet based communication network for establishing a secure communication between an access point and an entity, the network comprising an access network having access points for two or more entities belonging to the access network. A first access point is contacted in an access network with the intention to initiate a session from an entity in the network. A secret key is generated from the information obtained from the entity at the first access point using a converter known by two or more access points of the network. The secret key is sent from the first access point to the entity using encryption which is decrypted at the entity. The secret key is then used as a shared security key in communication between the mobile terminal and any access point of the network knowing the converter .

0026In the network as described herein, a function is stored in the access points for generating a secret key from identification information of the entities in the access network.

0027Initial authentication can be performed by the entity and then the initial authentication can be carried out by communicating identification information of the entity to a first access point in the network to prove the identity of the entity.

0028The identification information is non-encrypted or encrypted using a key that is shared by all entities in the access network.

0029The generation of the secret key in the converter can be carried out by means of a function f or by means of a secret number shared by the access points which use it as a parameter for a pre-defined, well-known function generating the secret key. The function f can be stored by the access point in a mathematical form or as a lookup table. The input of the function f could be the identification information of the first entity and the output is an arbitrary password.

0030An important benefit of the invention is that a secure communication between an access point in the access network and the mobile terminal can be achieved without any previous signalling about the identity of the mobile terminal . Even if each access point does not know the password of each mobile device, authentication and/or encryption can be achieved between a mobile device and any access point or base station in this method. This is achieved with the function f, which is used to generate a password for each mobile terminal. For the mobile device, the password appears to be random, but from the point of view of the access point, it is not random as it is generated by the same function.

0031The method can support any secret based authentication or encryption algorithm, for example CAST or IDEA. CAST is described in the Internet RFC 2144. IDEA is the "International Data Encryption Algorithm described at http: /www. ascom. ch/infosec/idea.html . No signalling messages in the access network are required, except for the initial distribution of the generated secret key. The avoiding of signalling messages at handover makes handover smoother because the only handover delay caused is the time that it takes to derive the secret key and the actual security calculation associated therewith.

0032Furthermore, the method described herein can be combined with other security techniques, e.g. mobile terminals may use generated secret keys to authenticate packets and at the same time use the public key of the access network to encrypt the same packets. Due to the low cost involved, it can be used to authenticate each data packet if necessary. In this case, it is advantageous for the access point to temporarily store generated secret keys associated with devices currently connected to it. Finally, the method described herein scales to almost an arbitrary number of access points and mobile terminals. In systems in which handover does not need control information exchange between the old and new access points or between access points and central controllers, it becomes a burden if the security key must be explicitly exchanged between these entities. The method as described herein is especially important in these systems .

0033In the following, the method will be explained by examples. The intention is not to restrict the invention to the details of the following description, as the details can vary in accordance with the claims. For example, even if the example is described as concerning wireless networks, the invention is, in addition to wireless access networks, applicable to all scenarios in which an entity needs to establish secure relationship with a set of entities, which are in secure relationship with one another. The main idea is that, one entity can perform some initial security negotiation with one of the other entities and after the initial security negotiation, the entity must be able to start secure communication without further negotiation and without the entities having to communicate with one another in forehand.

BRIEF DESCRIPTION OF THE DRAWINGS

0035- Figure 1 is a schematic view of a network allowing a secure communication between an access point and an entity,

0036- Figure 2 is a general block scheme of a method performed in the network of Figure 1 for establishing the secure communication, and

0037- Figure 3 is a detailed example of an embodiment of the invention.

0038DETAILED DESCRIPTION In Figure 1, a network 14 is shown, comprising an access network 13 having access points 10, through which mobile terminals 11 can establish communication with the access network. The network also comprises a server 12 storing information on the mobile terminals belonging to the access network.

0039The access network 13 represents a single administrative domain and its access points 10 and potentially other entities may have shared secrets, like public encryption keys. In one embodiment, an encryption system comprising public and private keys is used. Thus, all the entities in the access network share the public encryption keys for encryption of their messages, whereas every entity has an own private key for decryption.

0040All access points are aware of a function f . The function f can be almost any function as long as each access point knows it . The input of the function is the identifier or identification information of the mobile terminal and its output is a number.

0041It should not be easy, e.g. to an intruder, to determine the function f, but it does not have to be a cryptographically strong function. An example of the function f is to compute the MD5hash, described in R. Rivest, "MD5 Digest Algorithm", RFC 1321, April 1992, from the concatenation of the mobile terminal identifier and the secret password of the access network, which can be any secret shared by the access points . Instead of sharing a secret function f, the access points can share a secret number and use it as a parameter for a pre-defined, well-known function. Outputs of f may be fixed or have variable lengths. In addition, it is not required for f to necessarily provide different outputs for two different input identifiers. However, it is required for f to be known by all access points of the network and to be unknown to entities not belonging to the access- network. Access points will typically store f either in a mathematical form as an algorithm or as a lookup table.

0042Referring now to Figure 2, a mobile terminal 11 first performs initial authentication and thereafter connecting to an access network according to step 1. This step may be omitted in access networks that allow any device to connect to it. The initial authentication process may be identical to authentication solutions generally used in the Internet, because it is performed only once and delay requirements can be relaxed. Upon the initial authentication, the access network uses its secret function f to convert the mobile terminal identifier to an output that here will be called the generated secret key in accordance with step 2. This output is then communicated to the mobile terminal in accordance with step 3 using encryption so that other terminals cannot capture it. After that, communication between the mobile terminal and the access point can take place using the generated secret key. The mobile terminal can send messages via the access point and messages from the access point can be sent using the generated secret key.

0043The generated secret key can be used for encryption of packets. Other aspects of security are authentication, data integrity, and non-repudiation. In this application encryption means protecting the content of messages so that only those users who have the right key can read it. In authentication, the receiver verifies that the message was transmitted by the claimed origin and was not transmitted by somebody else. In non-repudiation, the receiver proves that the sender transmitted the message or the receiver received the message .

0044One possible solution of the initial authentication and transmitting the generated secret key is described in Figure 3. Using the same reference numbers as in Figure 1, the access points are indicated by the reference number 10, the mobile terminals by the reference number 11 and the server by the reference number 12.

0045When a mobile terminal 11 starts a session, it first communicates its global mobile terminal identifier to an access point 10 of the access network in step 1' . This allows the access network to find and contact a server 12 in step 2 ' that contains security information related to the mobile terminal 11. In step 4', the access network downloads the public cryptographic key of the mobile terminal 11 sent from the sender 12 in step 3' and uses it to encrypt the generated secret key in step 5' . Alternatively, the access point can obtain a private encryption key and use it to encrypt the generated secret key, as a message can be encrypted using either the public or private encryption key. The access network can obtain the secret private key of the mobile terminal if the access network has a secure relationship with the "home" of the mobile terminal or with any server that knows this secret private key. Then it can get the secret private key and use it for encryption.

0046This has not to be done by the access point. Instead, the access network can have a central unit that does this . When the mobile terminal first contacts one of the access points, this access point informs the central unit server on the mobile device having come in contact . Then the central unit contacts the home of the mobile terminal and gets the secret key if there is trust among access networks. Next, it encrypts the generated secret key using the private key and sends it to the terminal .

0047Next, the encrypted generated secret key is transmitted over the wireless channel to the mobile terminal 11 as is indicated in step 6' . If the mobile terminal 11 is indeed the device that it claimed to be, it can decrypt the generated secret key in accordance with reference number 7' using its private encryption key. The transmitted message is useless for any other mobile terminal . The mobile terminal 11 can now use the generated secret key to authenticate or encrypt its packets in accordance with reference number 8' and send them to any access point in the access network.

0048Following the initial authentication, the mobile terminal shares a secret with all access points of the access network. This is achieved without the mobile terminal ever having contacted the access points, and hence the method is scalable to very large networks . The mobile terminal and the access points can now use any shared secret based security technique available. At the same time, the access network has different secrets to share with different mobile terminals.

0049Even if the mobile terminal can use the generated secret key to authenticate and/or encrypt its packets, using the generated secret key never encrypts the identifier of the mobile terminal . The identifier is either not encrypted at all or it is encrypted using another key that is shared by all mobile terminals, e.g. the public encryption key of the access network. This allows the access points to identify the claimed sender of received packets . The access point then uses f to compute the generated secret key of the claimed sender.

0050Using the generated secret key, the mobile terminal can then decode the authentication information to verify the identity of the sender and/or it can decrypt the packet. Similarly, access points can use the generated secret key to encrypt or authenticate a packet transmitted to a given mobile terminal, which can then decrypt or verify the packet using its own generated secret key.

0051If a sequence of authenticated/encrypted packets from the same mobile terminal are likely to arrive to the access point, then the access point may temporarily store the mapping of mobile terminal identifiers to generate secret keys later in order to avoid frequent recomputing of generated secret keys .

0052In systems using non-encrypted wireless channels, the transmission of plain text mobile terminal identifiers is not acceptable if the identity of attached mobile devices should be kept secret. In these cases, the initial authentication process can include the assignment of a possible random, temporary identifier to the mobile terminal or encrypting the real identifier using the public cryptographic key of the access network can generate a temporary identifier. The secret key will then be generated using the temporary identifier, but in other aspects, the mechanism remains the same.

0053Some wireless channels have built-in security, whereas other ones have no such functionality. In the latter case, higher layers will provide security information. The invention is applicable for both cases.