Enhanced security design for cryptography in mobile communication systems
DC
First Claim
Patent Images
1. A method of enhancing security for protected communication based on a key agreement procedure in a mobile communications network having a network side for serving a mobile terminal having at least one basic cryptographic security algorithm, said method comprising:
- said mobile terminal transferring a list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm to said network side;
said network side selecting an enhanced version of said at least one basic cryptographic security algorithm for communication between said mobile terminal and said network side based on said list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm and a list of at least one enhanced version, allowed by said network side, of said at least one basic cryptographic security algorithm;
said network side transmitting information representative of said selected enhanced version of said at least one basic cryptographic security algorithm to said mobile terminal;
said mobile terminal generating an algorithm-specific security key by applying a basic security key resulting from said key agreement procedure and said information representative of said selected enhanced version of said at least one basic cryptographic security algorithm as inputs to a key-modifying function which generates said algorithm-specific security key based on said basic security key and said information applied as inputs; and
said mobile terminal applying said algorithm-specific security key as key input to said at least one basic cryptographic security algorithm for protected communication between said mobile terminal and said network side of said mobile communications network,wherein said at least one basic cryptographic security algorithm together with said algorithm-specific security key correspond to said selected enhanced version of said at least one basic cryptographic security algorithm, andwherein both said basic security key and said algorithm-specific security key are valid for protected communication between said mobile terminal and said mobile communication network.
1 Assignment
Litigations
0 Petitions
Accused Products
Abstract
A basic idea according to the invention is to enhance or update the basic cryptographic security algorithms by an algorithm-specific modification of the security key information generated in the normal key agreement procedure of the mobile communication system. For communication with the mobile terminal, the network side normally selects an enhanced version of one of the basic cryptographic security algorithms supported by the mobile, and transmits information representative of the selected algorithm to the mobile terminal. The basic security key resulting from the key agreement procedure (AKA, 10) between the mobile terminal and the network is then modified (22) in dependence on the selected algorithm to generate an algorithm-specific security key. The basic security algorithm (24) is then applied with this algorithm-specific security key as key input to enhance security for protected communication in the mobile communications network.
32 Citations
27 Claims
-
1. A method of enhancing security for protected communication based on a key agreement procedure in a mobile communications network having a network side for serving a mobile terminal having at least one basic cryptographic security algorithm, said method comprising:
-
said mobile terminal transferring a list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm to said network side; said network side selecting an enhanced version of said at least one basic cryptographic security algorithm for communication between said mobile terminal and said network side based on said list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm and a list of at least one enhanced version, allowed by said network side, of said at least one basic cryptographic security algorithm; said network side transmitting information representative of said selected enhanced version of said at least one basic cryptographic security algorithm to said mobile terminal; said mobile terminal generating an algorithm-specific security key by applying a basic security key resulting from said key agreement procedure and said information representative of said selected enhanced version of said at least one basic cryptographic security algorithm as inputs to a key-modifying function which generates said algorithm-specific security key based on said basic security key and said information applied as inputs; and said mobile terminal applying said algorithm-specific security key as key input to said at least one basic cryptographic security algorithm for protected communication between said mobile terminal and said network side of said mobile communications network, wherein said at least one basic cryptographic security algorithm together with said algorithm-specific security key correspond to said selected enhanced version of said at least one basic cryptographic security algorithm, and wherein both said basic security key and said algorithm-specific security key are valid for protected communication between said mobile terminal and said mobile communication network. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. An arrangement for enhancing security for protected communication based on a key agreement procedure in a mobile communications network having a network side for serving a mobile terminal having at least one basic security algorithm, said arrangement comprising:
-
means for transferring a list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm from said mobile terminal to said network side; means for selecting, at said network side, an enhanced version of said at least one basic cryptographic security algorithm for communication between said mobile terminal and said network side based on said list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm and a list of at least one enhanced version, allowed by said network side, of said at least one basic cryptographic security algorithm; means for transmitting information representative of said selected enhanced version of said at least one basic cryptographic security algorithm from said network side to said mobile terminal; means for generating, at said mobile terminal, an algorithm-specific security key by applying a basic security key resulting from said key agreement procedure and said information representative of said selected enhanced version of said at least one basic cryptographic security algorithm as inputs to a key-modifying function which generates said algorithm-specific security key based on said basic security key and said information applied as inputs; and means for applying, at said mobile terminal, said algorithm-specific security key as key input to said at least one basic cryptographic security algorithm for protected communication between said mobile terminal and said network side in said mobile communications network, wherein said at least one basic cryptographic security algorithm together with said algorithm-specific security key correspond to said selected enhanced version of said at least one basic cryptographic security algorithm, wherein both said basic security key and said algorithm-specific security key are valid for protected communication between said mobile terminal and said mobile communication network, and wherein said arrangement comprises hardware means or a combination of hardware and software means. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A mobile terminal for operation in a mobile communications network having a network side for serving said mobile terminal, said mobile terminal comprising:
-
an authentication and key agreement module; an engine for supporting at least one basic cryptographic security algorithm; means for transferring a list of at least one enhanced version of said at least one basic cryptographic security algorithm to said network side; means for receiving, from said network side, information representative of an enhanced version of said at least one basic cryptographic security algorithm selected by said network side based on said list of at least one enhanced version of said at least one basic cryptographic security algorithm and a list of at least one enhanced version, allowed by said network side, of said at least one basic cryptographic security algorithm; means for generating an algorithm-specific security key by applying a basic security key from said authentication and key agreement module and said information representative of said selected enhanced version of said at least one basic cryptographic security algorithm as inputs to a key-modifying function which generates said algorithm-specific security key based on said basic security key and said information applied as input; and means for applying said algorithm-specific security key as key input to said engine for at least one basic cryptographic security algorithm for protected communication between said mobile terminal and said network side in said mobile communications network, wherein said at least one basic cryptographic security algorithm together with said algorithm-specific security key correspond to said selected enhanced version of said at least one basic cryptographic security algorithm, wherein both said basic security key and said algorithm-specific security key are valid for protected communication between said mobile terminal and said mobile communication network, and wherein said mobile terminal comprises hardware means or a combination of hardware and software means. - View Dependent Claims (20, 21)
-
-
22. A network node for operation in a mobile communications network that supports at least one basic cryptographic security algorithm for protected communication in said mobile communications network, said mobile communications network having a network side for serving a mobile terminal, said network node comprising:
-
means for receiving a list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm from said mobile terminal; means for selecting an enhanced version of said at least one basic cryptographic security algorithm for communication between said mobile terminal and said network side based on said list of at least one enhanced version, supported by said mobile terminal, of said at least one basic cryptographic security algorithm and a list of at least one enhanced version, allowed by said network side, of said at least one basic cryptographic security algorithm; and means for transmitting information representative of said selected enhanced version of said at least one basic cryptographic security algorithm from said network side to said mobile terminal to enable said mobile terminal to generate an al algorithm-specific security key by applying a basic security key resulting from a key agreement procedure and said information representative of said selected enhanced version of said at least one basic cryptographic security algorithm as inputs to a key-modifying function which generates said algorithm-specific security key based on said basic security key and said information applied as inputs and apply said algorithm-specific security key as key input to said at least one basic cryptographic security algorithm for protected communication between said mobile terminal and said network side in said mobile communications network, wherein said at least one basic cryptographic security algorithm together with said algorithm-specific security key correspond to said selected enhanced version of said at least one basic cryptographic security algorithm, wherein both said basic security key and said algorithm-specific security key are valid for protected communication between said mobile terminal and said mobile communication network, and wherein said network node comprises hardware means or a combination of hardware and software means. - View Dependent Claims (23)
-
-
24. In an arrangement in which a mobile terminal receives wireless communication services from a wireless network, a method to operate said mobile terminal, comprising:
-
said mobile terminal generating a basic security key by performing an authenticate and key agreement (AKA) procedure using a shared key as an input to said AKA procedure, both said shared key and said AKA procedure being common to said mobile terminal and said wireless network; said mobile terminal transferring a list of one or more security algorithms supported by said mobile terminal to said wireless network, each of said one or more security algorithms being a data transformation algorithm that transforms input data to output data in which said transformation is dependent on a key input to said data transformation algorithm; said mobile terminal receiving selection information from said wireless network indicating a selection of one of said one or more security algorithms; said mobile terminal generating an algorithm-specific security key by applying said basic security key and said selection information as inputs to a key-modifying function which generates said algorithm-specific security key based on aid basic security key and said selection information applied as inputs; and said mobile terminal applying said algorithm-specific security key as said key input to said selected data transformation algorithm for communication between said mobile terminal and said wireless network; wherein both said basic and algorithm-specific keys are valid for protected communication between said mobile terminal and said wireless network. - View Dependent Claims (25, 26, 27)
-
Specification
-
- Resources
Litigation Campaign Assessment
Thank you for your request. You will receive a custom alert email when the Litigation Campaign Assessment is available.
×
Litigation Data
-
Current AssigneeTelefonaktiebolaget LM Ericsson
-
Original AssigneeTelefonaktiebolaget LM Ericsson
-
InventorsMats, Naslund, Arkko, Jari, Blom, Rolf
-
Primary Examiner(s)Vu; Kimyen
-
Assistant Examiner(s)Zee; Edward
-
Application NumberUS10/937,873Publication NumberTime in Patent Office1,978 DaysField of Search380/270, 380/273, 380 44- 46, 380247-249, 380/259, 380/260, 380/262, 713/168, 713/171, 455/403, 455/410, 455/411, 455/422.1US Class Current380/249CPC Class CodesH04L 2209/80 Wireless network architectu...H04L 63/0428 wherein the data content is...H04L 63/06 for supporting key manageme...H04L 9/0844 with user authentication or...H04L 9/3273 for mutual authentication n...H04W 12/02 Protecting privacy or anony...H04W 12/033 of the user plane, e.g. use...H04W 12/037 of the control plane, e.g. ...H04W 12/041 Key generation or derivationH04W 12/0431 Key distribution or pre-dis...H04W 12/0433 Key management protocolsH04W 12/062 Pre-authenticationH04W 12/069 using certificates or pre-s...
