# US 10,484,187 B2 · Cellular network authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,187 B2 - Document ID: US10484187B2 - Status: Granted - Kind: B2 - Application number: 15/310,328 - Filed: 2014-05-20 - Published: 2017-06-01 - Granted: 2019-11-19 - Earliest claimed: 2014-05-20 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Hannu Bergius; Silke Holtmanns - Web page: https://patentgrep.com/patent/US10484187B2 ## CPC - H04L 9/3271: {using challenge-response} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method, apparatus and computer program in which a cellular terminal: transmits a request that requires authentication procedure triggering to a cellular network and responsively receiving from the cellular network an authentication request message with an indication of a selected cryptographic algorithm from a group of a plurality of cryptographic algorithms; decodes the authentication request message to a decoded authentication request according to the selected cryptographic algorithm and based on a shared secret known by the cellular terminal and a network operator of the cellular terminal; based on the decoded authentication request, the shared secret and the selected cryptographic algorithm, produces and encrypts an authentication response message; and transmits the authentication response message to the cellular network. ## Claims ### Claim 1 A method in a cellular terminal, the method comprising: transmitting a request requiring authentication procedure triggering to a mobility management entity of a cellular network; receiving from the mobility management entity of the cellular network an authentication request message with an indication of a cryptographic algorithm selected from a group of a plurality of cryptographic algorithms provided to the mobility management entity by a home subscriber server; decoding the authentication request message to obtain a decoded authentication request according to the selected cryptographic algorithm and based on a shared secret known by the cellular terminal and a network operator of the cellular terminal; based on the decoded authentication request, the shared secret and the selected cryptographic algorithm, producing and encrypting an authentication response message; transmitting the authentication response message to the mobility management entity of the cellular network, the authentication response message including a cryptography algorithm indication; receiving a security mode completion message from the mobility management entity of the cellular network; and sending a security mode complete reply to the mobility management entity of the cellular network to complete a registration process, wherein the cryptographic algorithms are selected from a group consisting of MILENAGE; 128 bit TUAK; and 256 bit TUAK, wherein the authentication request message is an extended authentication request message, and wherein the extended authentication request message comprises an authentication token that comprises 128 bits, 192 bits, 256 bits or 320 bits. ### Claim 2 (depends on 1) The method of claim 1, wherein the request that requires authentication procedure triggering is a network registration request. ### Claim 3 (depends on 1) The method of claim 1, wherein the request that requires authentication procedure triggering is a routing area request. ### Claim 4 (depends on 1) The method of claim 1, wherein the request that requires authentication procedure triggering is a tracking area update request. ### Claim 5 (depends on 1) The method of claim 1, wherein the authentication request message is received from a mobility management entity. ### Claim 6 (depends on 1) The method of claim 1, wherein the authentication response message is transmitted to the mobility management entity. ### Claim 7 (depends on 1) The method of claim 1, wherein the cellular terminal comprises a security entity. ### Claim 8 (depends on 7) The method of claim 7, wherein the security entity comprises a secure element and a subscriber identity application. ### Claim 9 (depends on 8) The method of claim 8, wherein the secure element is removable or embedded or integrated in an existing processor architecture. ### Claim 10 (depends on 7) The method of claim 7, wherein the security entity is configured to decode authentication requests and to produce authentication responses. ### Claim 11 (depends on 1) The method of claim 1, wherein the extended authentication request comprises a message type indication that is configured to cause legacy terminals to neglect the extended authentication request message. ### Claim 12 (depends on 1) The method of claim 1, wherein the authentication token comprises a sequence number, SQN. ### Claim 13 (depends on 12) The method of claim 12, wherein the sequence number consists of 48 bits. ### Claim 14 (depends on 1) The method of claim 1, wherein the authentication token comprises an anonymity key, AK. ### Claim 15 (depends on 1) The method of claim 1, wherein the authentication token comprises an authentication management field which indicates cryptography adaptation information. ### Claim 16 A method in a mobility management entity, the method comprising: receiving a request requiring authentication procedure triggering from a cellular terminal; requesting authentication data from a home subscriber server; receiving an authentication data response from the home subscriber server with the requested authentication data; identifying a cryptographic algorithm selected from a group of a plurality of cryptographic algorithms for use by a cellular terminal for authentication of the cellular terminal; obtaining network credentials corresponding to the selected cryptographic algorithm for the authentication of the cellular terminal; transmitting to the cellular terminal an authentication request message with an indication of the selected cryptographic algorithm, the authentication request message being decodable by the cellular terminal to obtain an authentication request decoded according to the selected cryptographic algorithm and based on a shared secret known by the cellular terminal and a network operator of the cellular terminal; receiving an authentication response message from the cellular terminal, the authentication response message including a cryptography algorithm indication; decoding the authentication response message according to the selected cryptographic algorithm; determining, based on the network credentials and the decoded authentication response message, whether authentication of the cellular terminal is successful or not successful; when authentication is successful, sending a security mode completion message to the cellular terminal; and receiving a security mode complete reply from the cellular terminal to complete a registration process, wherein the cryptographic algorithms are selected from a group consisting of MILENAGE; 128 bit TUAK; and 256 bit TUAK, wherein the authentication request message is an extended authentication request message, and wherein the extended authentication request message comprises an authentication token that comprises 128 bits, 192 bits, 256 bits or 320 bits. ### Claim 17 An apparatus comprising: at least one memory and processor that are collectively configured to cause the apparatus to perform the steps of: transmitting a request requiring authentication procedure triggering to a mobility management entity of a cellular network; receiving from the mobility management entity of the cellular network an authentication request message with an indication of a cryptographic algorithm selected from a group of a plurality of cryptographic algorithms provided to the mobility management entity by a home subscriber server; decoding the authentication request message to obtain a decoded authentication request according to the selected cryptographic algorithm and based on a shared secret known by the cellular terminal and a network operator of the cellular terminal; based on the decoded authentication request, the shared secret and the selected cryptographic algorithm, producing and encrypting an authentication response message; transmitting the authentication response message to the mobility management entity of the cellular network, the authentication response message including a cryptography algorithm indication; receiving a security mode completion message from the mobility management entity of the cellular network; and sending a security mode complete reply to the mobility management entity of the cellular network to complete a registration process, wherein the cryptographic algorithms are selected from a group consisting of MILENAGE; 128 bit TUAK; and 256 bit TUAK, wherein the authentication request message is an extended authentication request message, and wherein the extended authentication request message comprises an authentication token that comprises 128 bits, 192 bits, 256 bits or 320 bits.