Patent Application
20080134306
1. Field of the Invention
The invention relates to a method and apparatus for authenticating a user equipment (UE) in a packet data network.
2. Description of the Related Art
A Wireless Local Area Network (WLAN) is a Local Area Network (LAN) to which a mobile user can connect through a wireless (radio) connection. The Institute of Electrical and Electronics Engineers (IEEE) has defined several sets of standard specifications, such as for example 802.11, 802.16, and 802.20, that specify the technologies to be used for WLANs. For example, in the set of standard specifications 802.11, there are currently four specifications: 802.11, 802.11a, 802.11b, and 802.11g, all of which are published by the IEEE. All four use the Ethernet protocol and CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) for path sharing.
WLANs are deployed in different public places such as shopping mall, hotels or airports. A WLAN allows a user of a device having a wireless client (laptop or desktop computer equipped with PC or PCI cards) to access a plurality of services. More particularly, PC or PCI cards receive radio signals from an access point with which it communicates and translates that signal into digital data that PCs can understand. In the WLAN, access points are provided for granting access to the user.
Access points are hard-wired to a LAN. Using an ordinary RJ-45 cable, it is possible to connect an access point to a wired LAN such as an Ethernet network. Also, Access points can be described as software that run on a server, however the vast majority of access points are separate pieces of hardware. Access points translate digital data from the network into radio signals that wireless clients can understand for providing services to a user, while within the coverage of the WLAN.
A Multi-Access Environment solution defines an integration of a WLAN and a third generation (3G) digital cellular network such as CDMA2000 or UMTS (Universal Mobile Telecommunication System), which are fully integrated for data/voice transmission. Therefore, a 3G network's operator can offer WLAN services to their subscribers and this depending on their location. However, WLAN access and 3G networks' access are completely independent access technologies. For that reason, 3G networks require a complement for deploying a WLAN hotspot coverage within the broader 3G wide area coverage and for allowing mobile users to roam from a WLAN to a 3G network and vice versa. For doing so, the Multi-Access Environment solution uses Mobile IP.
In a Multi-Environment, the AP also communicates via a connection with an authentication server located in the home 3G WWAN of the UE 5 for authentication purposes. The authentication server is responsible for authenticating and authorizing subscriber accessing the network. For example in CDMA2000 network and WLAN accesses, the authentication also serves as a repository for accounting data. The authentication server contains profile of data entries for every subscriber registered in the 3G WWAN. The authentication server and a gateway node, which interworks between the 3G WAN and the WLAN, are ultimately connected via IP connections and to an IP network such as Internet for providing IP services to the UE (e.g. Internet access). It has been stated that the UE may roam back and forth from the WLAN to the 3G WWAN. It can also be understood that the UE may roam in a visited network (not shown) of the 3G WWAN. More particularly, when the UE is roaming in the visited network of the 3G WWAN, the authentication server authenticates the UE via a Foreign authentication server (not shown) located in the visited network where the UE is roaming. Following this, accounting information is sent back to its home billing system (not shown).
Reference is now made to on
When the UE 5 moves from the AP1 to another AP215 (step 58), the UE 5 needs to be re-authenticated at the second AP215. If the UE 5 is performing the real-time service 54, the service has to be interrupted (step 62) while the UE 5 waits for the authentication process to complete successfully (messages and steps 66 to 86) before continuing the real-time service 55 between the UE 5 and the CN 25 (step 94). Messages and steps 66 to 86 are similar to messages and steps 30 to 50 respectively and can be repeated during a predetermined period of time until the UE 5 is authenticated.
As shown in
For these reasons, there is a need to provide a method for performing an efficient and secure handoff and authentication of a UE in a packet data network when the UE is involved in a real-time service.
It is a broad aspect of the present invention to provide a method for providing real-time service access to a user equipment (UE) in a packet data network, the method comprising the steps of:
receiving, at an access point (AP), an authentication information message from an authentication server, the authentication information message including an identity of the UE involved in a real-time service with a corresponding node and information data for authenticating the UE at the AP;
detecting, at the AP, that the UE enters a zone coverage of the AP;
sending a puzzle from the AP to the UE;
receiving, at the AP from the UE, an answer for the puzzle;
verifying, at the AP, the received answer;
authenticating the UE at the AP; and
allowing the UE to continue the real-time service with the corresponding node.
It is another broad aspect of the present invention to provide an access point (AP) for authenticating a user equipment (UE) in a packet data network, the AP comprising:
an input/output (I/O) unit for receiving an authentication information message from an authentication server, the authentication information message including an identity of the UE involved in a real-time service with a corresponding node and information data for authenticating the UE at the AP;
a processor for detecting that the UE enters a zone coverage of the AP;
wherein the I/O unit sends a puzzle from the AP to the UE and receives from the UE, an answer for the puzzle and upon reception of an answer for the puzzle from the UE, the processor verifies the received answer authenticates the UE and allows the UE to continue the real-time service with the corresponding node.
The foregoing and other aspects, features, and advantages of the invention will be apparent from the following more particular detailed description as illustrated in the accompanying drawings in which reference characters refer to the same parts throughout the various views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.
In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, interfaces, techniques. In order to provide a thorough understanding of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well known devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail.
Reference is now made to
In particular, the UE 205 refers to a device that is operable on a cellular network, or a Voice-Over IP (VoIP) network such as Session Initiated Protocol (SIP), or a Wireless Local Area Network (WLAN) using an 802.11x protocol, or any combination thereof. It can be understood that the present invention is not limited to VoIP services, Gaming or IPTV, and it should be clear that any real-time packet data service that can be provided by the present network 200 is also encompassed.
The network 200 is divided into packet data zones or cells in which the UE 205 may roam. In
AP1210, AP2215 and AP3220 are connected to a Gateway Node 230, which acts as a Gateway Node between a Wide Area Network (WAN) 300 and the UE 205. The Gateway Node 230 can be an access server or any network element that can provide interworking function between two different networks. The WAN 300 can be the Internet or any third generation (3G) cellular network such as 3G Universal Mobile Telecommunications Systems (3G UMTS) network such as a CDMA2000 network, a Wideband Code Division Multiple Access (WCDMA) network, a Global System for Mobile Communications/Enhanced Data for GSM Evolution (GSM/EDGE) or a High Speed Packet Data Access (HSPDA) network. The WAN 300 comprises an authentication server 320 for authenticating and authorizing the UE 205 to access the WAN 300. The authentication server 320 authenticates and authorizes the UE 205 to operate in the network 200. The authentication server 320 further provides user profile information 340 to the gateway 230 and ultimately an AP serving the UE 205 and stores accounting data regarding registered UE in the network 300 in the database 332.
The authentication server 320 comprises an input/output (I/O) unit 325 for receiving information from the network 200 and for sending information to the network 200, a processor 330 for operating the authentication server 320 and generating messages sent from the server 320, a database 332 for storing information that can be accessed by the processor 330. The database 332 comprises a network configuration repository 335 for storing the association of each AP and each gateway of the network 200. The database 332 also comprises UE information 340 that correlates information like the identity of a UE, the timestamp associated to a puzzle sent from an AP and the result of the authentication process between an AP and the UE. The authentication server 320 can be, while not being limited to, an authentication, authorization and accounting (AAA) server or a Remote Authentication Dial In User Service (RADIUS). The database 332, the memory 250 and the memory 208 may be any persistent memory like a Read-Only Memory (ROM), a Structured Query Language (SQL) database or a Flash memory. The processors 330, 255 and 207 can be hardware, software, or any combination thereof.
Reference is now made to
Following the authentication of step 125, the authentication server 320 informs neighboring APs of AP1210 where the UE 205 has first access the real-time service. The neighboring APs are determined as follows: each access point APx has ‘n’ geographically adjacent access points called AP(x, 1, 1 . . . n) where AP(x,y,z) is the ‘z’th access point which is separated ‘y’ levels from Access point ‘x’ where the UE 205 first gets authenticated. Using the proposed scheme the authentication server 320 informs the neighboring access points AP(x, 1 . . . r, 1 . . . n) that the UE 205 has been authenticated. The number of levels of access points that can be informed ‘r’ can be configured in the network configuration 325.
The authentication server 320 informs neighboring APs (AP2215, AP3220) by sending an authentication information message 114 that contains the ID 104 of the UE 205 involved in a real-time service 55 with a Corresponding node 25 and Information data 116. The information data 116 can be any of the following: a verification function V(x) 117, a puzzle PZ(m) 118 and an expected answer XA(m) for the puzzle 118. The ID 104 of the UE 205 can be, while not being limited to, an International Mobile Subscriber Identity (IMSI), a username or a Network Access Identifier (NAI). The verification function V(x) 117 can be for example a Digital Signature Algorithm (DSA) as defined in NIST FIPS 186. The puzzle 118 can be a token or challenge (packet data code or plain text), which needs to be operated by the UE 205, and the expected answer 119 may be any answer in the same format of the puzzle 118. At step 402, the AP2215 receives the authentication information message 114. The AP2215 stores the ID 104 and the V(x) 117 associated to the ID 104 for further use when the UE 205 tries to be authenticated with its identity ID 104 (step 404). Reference is now made to
When the AP2215 detects that the UE 205 enters its zone of coverage (step 406), the AP2215 determines whether the puzzle 118 and the expected answer 119 are included in the information data 116 (step 408) and stored in list 600. If it is the case, the AP2215 generates a timestamp 133 to be associated to the puzzle 118 (step 409). However, if the puzzle 118 and the expected answer 119 are not included, the AP2215 processes the V(x) 117 and generates a random puzzle PZ(m) 118 (step 410). This provides a replay protection since the timestamp cannot be replicated the puzzle then cannot be duplicated.
When the UE 205 initiates the authentication procedure when responding to an IDREQ 140 with an IDRES 142 the AP2215 sends to the UE 205 a puzzle information message 146 including the PZ(m) 118 and requests the UE 205 to solve the PZ(m) 118 (step 414). At step 416, the UE 205 runs processes the PZ(m) 118 and the timestamp 133 and generates an answer A(m) 148. The UE 205 sends the answer 148 to the AP2215 in a puzzle information response 146 (step 420).
After receiving the answer A(m) 148 from the UE 205, the AP2215 stores the received answer 148 in the memory 250 (step 422). If the expected answer 119 is included in the information data 116, the AP2215 processes and compares the received answer A(m) 148 and the expected answer XA(m) 119 (step 424).
Alternatively, if the expected answer 119 was not included in the information data 116 or for other reasons the AP2215 can verify the answer 148 of the UE 205 using the V(x) 117. The authentication server 320 may only send the verification function 525 for avoiding a processing overload of the authentication server 320, which can occur if the authentication server 320 has to send the puzzle 505 and the expected answer 520 to a large number of APs. Since this is a zero knowledge proof that a fraudulent user is listening on the link will not gain any additional information. The AP2215 process V(A(m)) at step 424 for determining that the received answer is an exact answer for the PZ(m) 118 (step 428). If the answer A(m) 148 is an exact answer for the PZ(m) 118, the AP2215 authenticates the UE 205 (step 434) and allows the UE 205 to continue the real-time service 155 with no further authentication needed from the authentication server (step 436). The AP2215 may also initiate a new accounting session on behalf of the UE 205 towards an authentication server 320. However, if the answer A(m) 148 is not a valid answer of if the time for the UE 105 to send the answer A(m) 148 is exceeded, the AP2215 denies network access to the UE 205 and the packet data for the real-time service are no longer transmitted to the UE 205.
At any time during the authentication process, the puzzle can be rendered obsolete when an event is detected at either the authentication server 320 or the AP2215. The event can be for example a UE that has exceeded a timeout for responding to an authentication request or an identity request from an AP or the authentication server 320. The event can also be a termination of a service requested from a UE or simply a network management request (not shown) for terminating a service such as for prepaid service termination. In general, the event triggers the revocation of the pre-authentication provided with the sending of the authentication information message.
Reference is now made to
It can be understood that some messages and therefore some parameters sent between network elements of the packet data network 200 are omitted for clarity reasons. More particularly, it should also be understood that
While the invention has been particularly shown and described with reference to the preferred embodiments thereof, it will be understood by those skilled in the art that various alterations may be made therein without departing from the spirit and scope of the invention.
