Method and apparatus for authentication in a communication system

A method of generating authentication information for use in authenticating a subscriber unit communicating via a communication unit of a visited communication system using a first authentication protocol, the subscriber unit and a home communication system of the subscriber unit each storing a subscriber unit identifier and a first secret key of the subscriber unit and an authentication algorithm, the method comprising:

• in the home communication system, wherein the home communication system uses a home authentication protocol different from the first authentication protocol,
• (a) receiving an authentication message including the identifier of the subscriber unit, and an authentication challenge (RAND.sub.V) and response (RESP.sub.V) to the RAND.sub.V in the first authentication protocol from the communication unit;
• (b) in response to authentication message, converting the RAND.sub.V into an authentication challenge (RAND.sub.H) in the home authentication protocol;
• (c) obtaining the first secret key and processing the RAND.sub.H into an authentication response (RESP.sub.H) in the home authentication protocol using the first secret key and authentication algorithm;
• (d) determining whether the RESP.sub.H and RESP.sub.V are both derived from the first secret key;
• and
• (e) sending a message confirming authentication when it is determined the RESP.sub.H and RESP.sub.V are both derived from the first secret key.

A method of generating an authentication message for a subscriber unit communicating via a communication unit of a visited communication system using a first authentication protocol, the subscriber unit having a subscriber identity unit, and the subscriber identity unit and a home communication system of the subscriber identity unit each storing a subscriber identity unit identifier and a first secret key of the subscriber identity unit and an authentication algorithm, the method comprising:

• in the subscriber unit,
• (a) receiving a first authentication challenge (RAND.sub.V) in the first authentication protocol from the communication unit;
• (b) converting, in response to a determination that the first authentication protocol is different from a home authentication protocol used in the home communication system, the RAND.sub.V into an authentication challenge (RAND.sub.H) in the home authentication protocol;
• (c) obtaining the subscriber identity unit stored first secret key and processing the RAND.sub.H into an authentication response (RESP.sub.H) in the home authentication protocol using the subscriber identity unit stored first secret key and authentication algorithm;
• (d) converting the RESP.sub.H into a response (RESP.sub.V) in the first authentication protocol;
• and
• (e) sending the RESP.sub.V to the communication unit.

A method of authenticating a subscriber unit via a temporary subscriber unit terminal in a visited communication system using a first authentication protocol, the subscriber unit and a home communication system of the subscriber unit each storing a subscriber unit identifier and a first secret key of the subscriber unit and an authentication algorithm, the method comprising:

• in the terminal,
• (a) establishing a proximity communication link with the subscriber unit;
• (b) establishing a communication channel with a communication unit of the visited communication system, and requesting and receiving from the communication unit a first authentication challenge (RAND.sub.V) in the first authentication protocol from the visited communication system;
• (c) converting, in response to a determination that the first authentication protocol is different from a home authentication protocol used in the home communication system of the subscriber unit, the RAND.sub.V into an authentication challenge (RAND.sub.H) in the home authentication protocol, and sending the RAND.sub.H to the subscriber unit;
• (d) receiving an authentication response (RESP.sub.H) from the subscriber unit, and converting the RESP.sub.H into a response (RESP.sub.V) in the first authentication protocol;
• (e) sending the RESP.sub.V to the communication unit;
• and
• (f) receiving an authentication message notifying the terminal to activate a temporary subscriber unit when the RESP.sub.V, converted into the home authentication protocol, is determined to match a further response calculated from the RAND.sub.V, converted into the home authentication protocol, and the first secret key using the authentication algorithm.

A subscriber unit adapted for interfacing with a subscriber identity unit and for communicating via a communication unit of a local communication system and being authenticated by a home communication system, wherein the subscriber identity unit includes a memory having a subscriber identifier, a first secret key and an authentication algorithm, the subscriber unit comprising:

• (a) communications means for sending and receiving signals to and from the communication unit;
• (b) determining means for determining that the local communication system uses a local system authentication protocol different from a home system authentication protocol used in the subscriber identity unit, and for activating a converting means in response to such a determination;
• (c) the converting means, coupled to the determining means and communications means, being operable for converting a first authentication challenge (RAND.sub.V) from the communication unit in the local system authentication protocol into a home authentication challenge (RAND.sub.H) in the home authentication protocol;
• and
• (d) interface means, coupled to the converting means and the subscriber identity unit when the subscriber identity unit is interfaced with the subscriber unit, for inputting the RAND.sub.H into the subscriber identity unit for processing by the subscriber identity unit into a response (RESP.sub.H) and first encryption key using the first secret key and home system authentication algorithm, and for receiving the RESP.sub.H and first encryption key from the subscriber identity unit;
• wherein the converting means is further operable for converting the RESP.sub.H into a first response (RESP.sub.V) in the local system authentication protocol and outputting the RESP.sub.V to the communication means for transmission to the communication unit.

A subscriber unit for communicating via a communication unit of a local communication system and being authenticated by a home communication system, wherein the subscriber unit includes a memory having a subscriber identifier, a first secret key and an authentication algorithm, the subscriber unit comprising:

• (a) communications means for sending and receiving signals to and from the communication unit;
• (b) determining means for determining that the local communication system uses a local system authentication protocol different from a home system authentication protocol used in the subscriber unit, and for activating an authentication means in response to such a determination;
• and
• (c) the authentication means, coupled to the determining means and communications means, being operable for (i) converting a first authentication challenge (RAND.sub.V) from the communication unit in the local system authentication protocol into a home authentication challenge (RAND.sub.H) in the home authentication protocol, (ii) processing the RAND.sub.H into a response (RESP.sub.H) and first encryption key using the first secret key and authentication algorithm, and for converting the RESP.sub.H into a first response (RESP.sub.V) in the local system authentication protocol and outputting the RESP.sub.V to the communication means for transmission to the communication unit.

A subscriber identity unit adapted for being received in a subscriber unit communicating via a communication unit of a local communication system, wherein the subscriber identity unit includes a memory having a subscriber identifier, a first secret key and at least one authentication algorithm, the subscriber identity unit comprising:

• (a) interface means for sending and receiving information to and from the subscriber unit;
• (b) determining means for determining whether a challenge (RAND) received from the subscriber unit is in a home system authentication protocol or a visited system authentication protocol different from the home system authentication protocol, and for activating a converting means in response to such a determination that the RAND is in a visited system authentication protocol;
• (c) the converting means, coupled to the determining means and interface means, being operable for converting a first authentication challenge (RAND.sub.V) from the communication unit in the visited system authentication protocol into a home authentication challenge (RAND.sub.H) in the home system authentication protocol;
• and
• (d) processing means, coupled to the converting means, for inputting the RAND.sub.H and calculating a response (RESP.sub.H) using the RAND.sub.H, the first secret key and the authentication algorithm;
• wherein the converting means is further operable for receiving and converting the RESP.sub.H into a first response (RESP.sub.V) in the visited system authentication protocol and outputting the RESP.sub.V to the SU.

A subscriber terminal, for providing communication services to a subscriber having an authentication unit including a communications interface, a processor and a memory storing a subscriber identifier, a secret key and an authentication algorithm, and for communicating information between the authentication unit and a communication unit of a local communication system and authenticating the authentication unit by a home communication system of the authentication unit, the terminal comprising:

• (a) communications means for sending and receiving information to and from the communication unit, and for sending and receiving information to and from the authentication unit via the communications interface;
• (b) determining means for determining that the authentication unit uses a home system authentication protocol different from a local system authentication protocol used in the communication unit, and for activating a converting means in response to such a determination;
• (c) the converting means, coupled to the determining means and communications means, being operable for converting a first authentication challenge (RAND.sub.V) in the local system authentication protocol into a home authentication challenge (RAND.sub.H) in the home authentication protocol, and for converting a first response (RESP.sub.H) to the RAND.sub.H from the authentication unit in the home system authentication protocol into a response (RESP.sub.V)in the local system authentication protocol;
• wherein the communications means is further operable for communicating the RAND.sub.H to the authentication unit and receive the RESP.sub.H from the authentication unit, and for communicating the RESP.sub.V to the communication unit.

A temporary subscriber unit for communicating user information via a local communication system, comprising:

• (a) a temporary memory;
• (b) interface means, coupled to the temporary memory, for receiving and inputting authentication information and at least one use parameter into the temporary memory, wherein the at least one use parameter includes information specifying an amount of communications services allowed after which further communications with the temporary subscriber unit are inhibited;
• (c) communications means, coupled to the temporary memory, for using the authentication information to authenticate the temporary subscriber unit, and communicating the user information, with a local system for the specified amount of communications services;
• and
• (d) deactivation means for to inhibit the communication means and erase the authentication information and any subscriber-specific information following the specified amount of communications services.

A communication unit of a home communication system of a subscriber unit capable of operation in a second local communication system, wherein the communication unit and subscriber unit each have a memory including an authentication algorithm, a stored first secret key and a subscriber identifier of the subscriber unit, the communication unit comprising:

• (a) communication means for receiving and sending authentication information for the subscriber unit, wherein the authentication information includes at least a challenge (RAND) and a response to the challenge (RESP) by the subscriber unit;
• (b) determining means for determining that the authentication information from the local communication system is in a local system authentication protocol different from a home system authentication protocol used in the subscriber unit;
• and
• (c) authentication means, coupled to the determining means and communications means, for (i) converting a first authentication challenge (RAND.sub.V) from the local communication system in the local system authentication protocol into a home authentication challenge (RAND.sub.H) in the home authentication protocol, (ii) processing the RAND.sub.H into a response (RESP.sub.H) using the first secret key and authentication algorithm, and for converting the RESP.sub.H into a first response (RESP.sub.V) in the local system authentication protocol and outputting the RESP.sub.V to the communication means for transmission to the local communication system.

A communication system including a first subscriber unit, a home system having at least one home communication unit using a first authentication protocol and having memory for storing an identifier and first secret key of the first subscriber unit, wherein the home communication unit is operable for processing an authentication challenge into a response using the authentication challenge and first secret key, the communication system comprising:

• (a) a second local system having a local communication unit using a second authentication protocol, wherein the subscriber unit is operable for communicating with both the home system and local system;
• (b) interworking means, coupled to at least one of the local communication unit and home communication unit, for converting a first authentication challenge (RAND.sub.V) in the second authentication protocol into a home authentication challenge (RAND.sub.H) in the home authentication protocol, and converting a response to the RAND.sub.H (RESP.sub.H) in the home authentication protocol into a response (RESP.sub.V) in the second authentication protocol;
• and
• (c) communication means for coupling the local communication unit to the home communication unit for communicating between the local communication unit and home communication unit one of the group consisting of the RAND.sub.V and the RAND.sub.H and one of the group consisting of the RESP.sub.H and the RESP.sub.V.