System and method for preventing replay attacks in wireless communication

A system for authenticating a mobile station in a communication network, the system comprising at least one station for:

• receiving a public security parameter and an authentication signature from the mobile station, wherein the authentication signature is generated using both the public security parameter and a private security parameter;
• comparing the public security parameter communicated by the mobile station to at least one public security parameter previously received from the mobile station;
• and
• demanding an additional verification of identify from the mobile station if the public security parameter communicated by the mobile station matches a previously received public security parameter of the mobile station.

A station for authenticating a mobile station in a communication network, the station comprising:

• means for receiving a public security parameter and an authentication signature from the mobile station, wherein the authentication signature is generated using both the public security parameter and a private security parameter;
• means for comparing the public security parameter communicated by the mobile station to at least one public security parameter previously received from the mobile station;
• and
• means for performing an additional verification of the identify of the mobile station if the public security parameter communicated by the mobile station matches a previously received public security parameter of the mobile station.

A method of authenticating a subscriber in a communication network, the method comprising the steps of:

• performing a public challenge procedure;
• receiving a broadcast security parameter and an authentication signature from a subscriber who responds to the public challenge procedure;
• determining whether the broadcast security parameter transmitted by the subscriber matches a previously transmitted parameter from the subscriber, wherein the previously transmitted parameter is received from a previous public challenge procedure;
• and
• if the broadcast security parameter is different than the previously transmitted parameter, then generating an authentication signature using the broadcast security parameter transmitted by the subscriber as an input to a signature generation algorithm and checking whether the generated authentication signature matches the authentication signature received from the subscriber;
• if the broadcast security parameter matches a broadcast security parameter previously transmitted by the subscriber, then performing a private challenge procedure.