US 6,587,680 B1Granted

Transfer of security association during a mobile terminal handover

AssigneeNokia Corporation

InventorsJuha Ala-Laurila, Harri Hansén, Juha Salvela

Life of this patent

Estimating the term…

Loading patent…

Abstract

An existing security association is re-established when a communication handover event occurs in a radio communications system such as IEEE 082.11 or a HIPERLAN wherein the existing security association between a mobile terminal and a wireless communication network is maintained when the communication handover occurs within the network. Authentication during a handover event is achieved by a challenge/response procedure. In accordance with the challenge/response procedure each member of a communication pair that is made up of a new access point and the mobile terminal that is experiencing a handover to the new access point sends a challenge to the other member of the communication pair. Each member of the communication pair then calculates a response to its received challenge, and these responses are sent back to the other member of the communication pair. Each member of the communication pair then compares its received response to a correct response. When these comparisons are correct, payload communication begins between the second access point and the mobile terminal.

Claims20

Dependent claims

In a communication system having a plurality of access-points, each access point serving a different geographic area within an overall geographic area that is served by said communication system, said communication system further having a plurality of mobile-terminals that are each physically moveable within said overall geographic area and between said different geographic areas, a method of providing information security when communication with a given mobile-terminal is handed-over from a first access-point to a second access-point, said method comprising the steps of:

sensing when said given mobile-terminal moves from a communication-influence with said first access-point into a communication-influence with said second access-point;
responding to said sensing step by retrieving security-association-parameters from said first access-point, by creating a security association at said second access-point in accordance with said retrieved security-association-parameters, and by creating a security association at said given mobile-terminal in accordance with said retrieved security-association-parameters;
responding to said sensing step by sending an authenticate-access-point-challenge from said given mobile-terminal to said second access-point, and by sending an authenticate-mobile-terminal-challenge from said second access-point to said given mobile-terminal;
generating an authenticate-access-point-response at said second access-point in response to said authenticate-access-point-challenge received from said given mobile-terminal;
sending said authenticate-access-point-response to said given mobile-terminal;
generating an authenticate-mobile-terminal-response at said given mobile-terminal in response to said authenticate-mobile-terminal-challenge received from said second access-point;
sending said authenticate-mobile-terminal-response to said second access-point;
first-comparing said authenticate-access-point-response to a correct response at said given mobile-terminal;
and
second-comparing said authenticate-mobile-terminal-response to a correct response at said second access-point.

7 more elements

Apparatus for maintaining a given security-association in a radio communications system when a communication-handover occurs as a mobile-terminal physically moves from a first geographic area that is served by a first communication-access-point to a second geographic area that is served by a second communication-access-point, said mobile-terminal initially forming a first communication-pair with said first communication-access-point, and after said communication-handover said mobile-terminal forming a second communication-pair with said second communication-access-point, each member of said first communication-pair having said given security-association associated therewith, the apparatus comprising;

first means at said mobile-terminal for sensing a need to initiate said communication-handover;
second means within said radio communications system and responsive to said first means sensing said need to initiate said communication-handover for establishing said given security-association at said second communication-access-point;
third means at said mobile-terminal for generating an access-point-challenge as a function said given security-association, and for sending said access-point-challenge to said second communication-access-point;
fourth means at said second communication-access-point for generating a mobile-terminal-challenge as a function of said given security-association established at said second communication-access-point, and for sending said mobile-terminal-challenge to said mobile-terminal;
fifth means at said mobile-terminal and responsive to said mobile-terminal-challenge for generating a mobile-terminal-response as a function of said given security-association, and for sending said mobile-terminal-response to said second communication-access-point;
sixth means at said second communication-access-point and responsive to said access-point-challenge for generating an access-point-response as a function of said given security-association established at said second communication-access-point, and for sending said access-point-response to said mobile-terminal;
seventh means at said mobile-terminal and responsive to said access-point-response for determining if said access-point-response is correct as a function of said given security-association;
eighth means at said second communication-access-point and responsive to said mobile-terminal-response for determining if said mobile-terminal-response is correct as a function of said given security-association established at said second communication-access-point;
and
ninth means within said radio communications system and responsive to said eighth and ninth means for establishing said communication-handover when both said mobile-terminal-response and said access-point-response are correct.

7 more elements

A method for maintaining a given security-association in a radio communications system when a communication-handover of a mobile terminal occurs, said mobile-terminal initially forming a first communication-pair with said first communication-access-point, and after said communication-handover said mobile-terminal forming a second communication-pair with said second communication-access-point, each member of said first communication-pair having said given security-association associated therewith, the method comprising the steps of;

sensing a need to initiate said communication-handover;
responding to said need to initiate said communication-handover and establishing said given security-association at said second communication-access-point in response thereto;
generating at said mobile-terminal an access-point-challenge as a function said given security-association;
sending said access-point-challenge to said second communication-access-point;
generating at said second communication-access-point a mobile-terminal-challenge as a function of said given security-association established at said second communication-access-point;
sending said mobile-terminal-challenge to said mobile-terminal;
responding to said mobile-terminal-challenge at said mobile-terminal and generating a mobile-terminal-response as a function of said given security-association;
sending said mobile-terminal-response to said second communication-access-point;
responding to said access-point-challenge at said second communication-access-point and generating an access-point-response as a function of said given security-association established at said second communication-access-point;
sending said access-point-response to said mobile-terminal;
responding to said access-point-response at said mobile-terminal and determining if said access-point-response is correct as a function of said given security-association;
responding to said mobile-terminal-response at said second communication-access-point and determining if said mobile-terminal-response is correct as a function of said given security-association established at said second communication-access-point;
and
establishing said communication-handover when both said mobile-terminal-response and said access-point-response are correct.

11 more elements

Dependencies are inferred from the claim text.