Back to results
US 8,027,679 B2Granted
Secure intra- and inter-domain handover
AssigneeNtt Docomo, Inc.
InventorAnand R. Prasad
Life of this patent
Estimating the term…
Abstract
To achieve a secure and fast handover in a distributed mobile communication environment (10), the control functionality is lying at the borderline between wireless and wire-bound communication network elements, and it is proposed to, firstly, execute a mutual authentication between a mobile device (26) and a new access point (14) using security context information previously transmitted to the new access point. Then, after successful mutual authentication, a handover will be executed from the current access point (12) to the new access point (14).
Claims8
A method of secure handover in a distributed mobile communication environment, wherein the secure handover is executed for a mobile device between a current access device and a new access device, comprising:
- generating a master secret authentication value during log-on of the mobile device with an authentication server;
- receiving the master secret authentication value after log-on of the mobile device with the authentication server at the current access device;
- deriving a roaming authentication value for mutual authentication between the mobile device and the new access device from the master secret authentication value at the current access device, wherein the new access device is identified in a neighborhood relation of the current access device;
- forwarding security context information comprising at least the master secret authentication value and the roaming authentication value for mutual authentication between the mobile device and the new access device to the new access device from the current access device to the new access device;
- executing a mutual authentication between the mobile device and the new access device using the roaming authentication value comprised in the security context information;
- executing a handover from the current access device to the new access device when the executing a handover from the current access device to the new access device when the mutual authentication is successful, the handover being executed between access devices of different communication domains, wherein the current access device is operated in a current communication domain and the new access device is operated in a new communication domain;
- transmitting security information with respect to the new communication domain from the current access device to the mobile device, wherein the security information comprises at least one item of:
- an identification of the new communication domain;
- a new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain, when the current communication authentication value for mutual communication between the mobile device and the current access device in the current communication domain is not communicated to the new communication domain;
- a time out period for the new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain;
- and
- an encryption algorithm to be used in the new communication domain.
9 more elements
An access device for executing secure handover in a distributed mobile communication environment, wherein the secure handover is executed for a mobile device between a current access device and a new access device, comprising:
- an encryption key unit adapted to generate a master secret authentication value in cooperation with an authentication server during log-on of the mobile device at the authentication server and adapted to generate a roaming authentication value for mutual authentication between the mobile device and the new access device from the master secret authentication value;
- a communication unit adapted to forward security context information comprising at least the master secret authentication value and the roaming authentication value for mutual authentication between the mobile device and the new access device to the new access device, wherein the new access device is identified in a neighborhood relation of the current access device;
- an authentication unit adapted to execute a mutual authentication between the mobile device and the new access device using the roaming authentication value for mutual authentication between the mobile device and the new access device;
- a handover control unit adapted to execute a handover from the current access device to the new access device when the mutual authentication is successful;
- wherein the handover control unit is adapted to execute handover between access devices of different communication domains, wherein the access device is operated in a current communication domain and the target access device is operated in a new communication domain and the communication unit is adapted to create a trusted communication between an authentication server of the current communication domain and at least one handover target access device in the new communication domain;
- and
- wherein the communication unit is adapted to transmit security information with respect to the new communication domain to the mobile device, wherein the security information comprises a least one item of:
- an identification of the new communication domain;
- optionally, a care-of-address of a foreign agent in the new communication domain;
- a new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain, when the current communication authentication value for mutual communication between the mobile device and the current access device in the current communication domain is not communicated to the new communication domain;
- a time out period for the new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain;
- and
- an encryption algorithm to be used in the new communication domain.
10 more elements
A mobile device for executing secure handover in a distributed mobile communication environment, wherein the secure handover is executed between a current access device in a current communication domain and a new access device in a new communication domain, wherein the new access device is identified in a neighborhood relation of the current access device, comprising:
- a communication unit adapted to receive a roaming authentication value derived from a master secret authentication value for mutual authentication between the mobile device and the new access device from the current access point;
- an authentication unit adapted to execute a mutual authentication between the mobile device and the new access device using the roaming authentication value;
- and
- a handover control unit adapted to execute a handover from the current access device to the new access device when the mutual authentication is successful;
- wherein the communication unit is adapted to receive security information with respect to the new communication domain, wherein the security information comprises at least one item of:
- an identification of the new communication domain
- optionally, a care-of-address of a foreign agent in the new communication domain;
- a new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain, when the current communication authentication value for mutual communication between the mobile device and the current access device in the current communication domain is not communicated to the new communication domain and/or a master secret authentication value used in the current communication domain is not communicated to the new communication domain and the current communication authentication value for mutual communication between the mobile device and the current access device in the current communication domain will lime out before creation of a new master secret authentication value used in the new communication domain;
- a time out period for the new communication authentication value for mutual communication between the mobile device and the new access device in the new communication domain;
- and
- an encryption algorithm to be used in the new communication domain.
8 more elements
Dependencies are inferred from the claim text.