HK1062982A - Authentication of a mobile telephone - Google Patents

Description

Authentication of mobile phones

Cross reference to related applications

This application claims priority from U.S. provisional patent application No. 60/332117, published 11/2001, which is incorporated herein by reference.

I. Field of the invention

The present invention relates generally to methods of authentication and more particularly to methods of authenticating a mobile telephone operating in a cellular communications network.

Background of the invention

Mobile phones operating within a cellular communication network undergo an authentication process before being able to place or receive calls. Authentication prevents, among other things, fraudulent use of the mobile phone. Two types of networks in which authentication is performed are Code Division Multiple Access (CDMA) networks and global system for mobile communications (GSM) networks, the latter operating in Time Division Multiple Access (TDMA) format.

As is well known in the art, fig. 1 is a schematic diagram illustrating an authentication process in a cellular network 10. A mobile telephone 12 in the network 10 sends an initial signal to a Mobile Switching Center (MSC)16 that communicates with a Base Station System (BSS) 14. To be authenticated for operation in the network, the MSC 16 instructs an authentication center (AUC)18 to generate a random authentication number 20, typically as a triplet. The authentication number 20 is sent to the mobile telephone 12 within an authentication packet 22. The generation process is performed using data derived from the Home Location Register (HLR) 29. MSC 16, AUC 18 and HLR29 are included within the backbone of network 10 coupled to BSS 14. To generate the reply value 24, the mobile phone processes the number through an authentication algorithm included within the mobile phone. The reply value is sent to the MSC within the authentication reply packet 26. The MSC uses AUC 18 and HLR29 to check whether the random number 20 and reply 24 meet the network's authentication criteria. If the criteria are met, the mobile phone is allowed to continue operating within the network.

The network 10 also includes a short message service center (SMS-C)28 in the backbone of the network that is capable of sending and receiving short character messages. The mobile telephone 12 may be implemented to receive and transmit such SMS messages. Generally, the character messages sent and received by SMS-C contain about 128 characters, although larger numbers of characters may be transmitted.

If the network 10 comprises a CDMA network operating in accordance with an industry standard protocol, such as the TIA/EIT/IS-2000-a-1 standard published by the telecommunications industry association, Arlington, VA, the mobile telephone 12 comprises a CDMA mobile telephone. AUC 18 implements the ANSI-41 protocol, published by third Generation partnership project 2, and available athttp：//www.3gpp2.orgThe protocol is incorporated herein by reference, as found above. In this case, the random authentication number 20 issued from the authentication center is 32 digits, and the reply value 24 generated by the CDMA mobile phone is 18 digits. To authenticate, a CDMA mobile phone needs to be able to send its authentication reply in 18-bit numbers.

If the network 10 comprises a GSM network operating in accordance with an industry standard protocol, such as ETSI TS 100940 V7.8.0 technical specification published by european telecommunications standards institute, Sophia Antipolis Cedex, France, the mobile telephone 12 comprises a GSM mobile telephone. Part 4.3 of the specification, incorporated herein by reference, describes the authentication steps followed in a GSM network. In this case the random authentication number issued from the authentication centre is a 32 digit number and the reply value generated by the GSM mobile phone is a 32 digit number. In order to authenticate within a GSM network, a GSM mobile phone needs to be able to send its authentication reply in 32-bit numbers.

However, if the CDMA mobile phone is to operate within a GSM network, the 32-bit digital authentication reply that the mobile phone needs to generate is greater than the 18-bit capability of the CDMA mobile phone. Methods known in the art for overcoming the limited performance of CDMA mobile phones include changing the software in both the GSM authentication center and the GSM mobile phone. When a CDMA mobile phone is to operate in its native CDMA environment, the software is replaced by the original software. Another step well known in the art is to change the software in the GSM center so that only "CDMA type" authentication is performed on CDMA mobile phones operating within the GSM network. It will be appreciated that both approaches are problematic.

Summary of the invention

It is an object of some aspects of the present invention to provide a method and apparatus for authenticating a mobile telephone operating in a communications network.

In a preferred embodiment of the invention, the mobile phone is intended to operate in a cellular communication network. A base station or switching center in the network authenticates the mobile telephone by sending an authentication request to the mobile telephone in the form of a message, preferably a Short Message System (SMS) message. The SMS message includes a first identifier that defines the SMS message as an authentication request, and a random number that is used as part of the authentication step. By analyzing the first identifier, the mobile phone recognizes the SMS message as an authentication request and processes the accompanying random number through an authentication algorithm included within the mobile phone in order to generate an authentication response. The response is sent in a return SMS message sent from the mobile phone to the network. The return SMS message includes a second identifier that defines the return message as including an authentication response. The network recovers the response from the return message and compares the recovered response to the expected response in order to authenticate the mobile phone. The delivery system using SMS messages as authentication requests and responses avoids the random number and size limitations of responses in systems known in the art.

In some preferred embodiments of the present invention, the mobile telephone is capable of operating in more than one communication network. Each network includes different authentication protocols, each defining different sizes for random numbers and responses. The mobile phone may be authenticated within its "home" network, or in a network operating under a different protocol, the software or hardware within the mobile phone not changing as it moves within the network.

In another preferred embodiment of the invention, a network in which the mobile phone operates is sent as a DBM, which network supports a Data Burst Message (DBM), an authentication request message to the mobile phone, and an authentication response message from the mobile phone. The DBM is preferably of a type already supported by the communication protocol used by the network to operate.

Brief Description of Drawings

Fig. 1 is a schematic diagram illustrating an authentication process in a cellular communication network as is well known in the art;

fig. 2 is a schematic diagram illustrating an authentication process of a mobile phone in accordance with a preferred embodiment of the present invention; and

fig. 3 is a sequence diagram illustrating the steps involved in authenticating the mobile phone of fig. 2 operating in a communication network in accordance with a preferred embodiment of the present invention.

Description of The Preferred Embodiment

Reference is now made to fig. 2, which is a schematic diagram illustrating the authentication process of the mobile phone 32, in accordance with a preferred embodiment of the present invention. The mobile phone 32 is adapted to operate in a cellular communication network 30 that functions in accordance with a first industry standard cellular communication protocol. The mobile phone includes circuitry 35 that enables the mobile phone to operate. The mobile phone 32 is preferably adapted to operate in accordance with a first protocol and to operate in accordance with a second industry standard cellular communication protocol. For example, the first protocol comprises a global system for mobile communications (GSM) protocol, such as the ETSI TS 100940 V7.8.0 specification referenced in the background of the invention, and the second protocol comprises a Code Division Multiple Access (CDMA) protocol, such as the TIA/EIA/IS-2000-a-1 standard also referenced in the background of the invention. Alternatively, the mobile phone 32 operates according to either GSM or CDMA industry standard protocols, or other protocols well known in the art.

The base station system (BBS)34 is coupled to a Mobile Switching Center (MSC)40, which in turn is coupled to an authentication center (AUC)36 and a Home Location Register (HLR) 38. A short message service center (SMS-C)42 may also be coupled to the MSC 40. One or more of BSS 34, AUC 36, HLR 38 and MSC 40 act as a network control center 37, controlling transmissions within network 30. In addition to the differences described below, AUC 36, HLR 38, MSC 40, and SMS-C42 generally operate as AUC 18, HLR29, MSC 16, and SMS-C28, respectively, which were described in the background of the invention with reference to FIG. 1.

The mobile phone 32 expects to operate within the network 30 and sends an initial signal to the BSS 34. To authenticate the mobile phone, the BSS 34 sends a random authentication number 44 encapsulated in a first, forward, message 48 to the mobile phone 32. Except as described below, assume that message 48 comprises an SMS message. The message 48 incorporates an identifier 46 within the message so that the mobile phone 48 can recognize the SMS message 48 as a special message transmitting a random authentication number. Upon receipt of the SMS message 48, the mobile phone 32 decodes the message, restores the value of the random authentication number 44, and applies the restored value to an authentication algorithm included within the mobile phone, thereby generating an authentication response. The software for decoding the message 48, the recovery number 44 and the authentication algorithm are preferably combined as a separate replaceable element 31, preferably as a Subscriber Identity Module (SIM) within the mobile phone 32. Alternatively, the software is incorporated entirely within the memory 33 of the mobile phone.

The mobile phone 32 incorporates the authentication response as a reply value 50 in a second, return message 54 and sends the message to the BSS 34. Except as described below, assume that message 54 comprises an SMS message. The mobile phone 32 incorporates an identifier 52 in the message 54 so that the message can be recognized as a special message that transmitted the authentication reply. The SMS message 54 is routed by the BSS 34 to the MSC 40, recognizes the message from the identifier 52 as including an authentication reply, and extracts the reply value 50 from the message. The MSC 40 checks that the value 50 corresponds to an expected response to the random number authentication 44 and authenticates the mobile phone 32 if a correspondence exists. By incorporating the random number authentication 44 and the reply value 50 within the SMS message, the size limitations of the random number authentication and reply values, which are defined by the different protocols in which the mobile phone 32 operates, may be overcome. These limitations are overcome because SMS messages can send 128 or more 8-bit characters.

Fig. 3 is a sequence diagram 60 illustrating the steps involved in authenticating a mobile phone 32 operating in a communication network 30, in accordance with a preferred embodiment of the present invention. By way of example, assume that the network 30 operates in accordance with the GSM protocol. Sequence diagram 60 illustrates steps performed before and after the mobile phone 32 has made an initial transmission, received by the BSS 34, and awaiting authentication. This initial transmission incorporates the International Mobile Subscriber Identity (IMSI), typically the telephone number of the mobile telephone 32, which has been assigned to the mobile telephone at the time of initial registration in the network, and is also stored in the AUC 36. Also at registration time, the mobile phone 32 is assigned a subscriber authentication key (Ki), which is stored in the mobile phone and AUC 36.

In a first step 62, the AUC 36 generates a random number (RAND) and uses the RAND to calculate an identification parameter, called the Signal Response (SRES), which is a function of RAND and Ki. AUC 36 also calculates the encryption key (Kc), which is a function of Ki and RAND, imsi, Kc, RAND, while SRES is transmitted and not stored in HLR 38.

In a second step 64, HLR 38 passes the values of IMSI, Kc, RAND, and SRES to MCS 40 after the MSC has received the initial transmission through BSS 34. The MSC 40 stores IMSI, Kc, RAND, and SRES for later comparison purposes.

In a third step 66, the MSC 40 incorporates the RAND value corresponding to the random authentication number 44 (fig. 2) within the SMS message 48. The SMS message is transmitted to the BSS 34 either through traffic or through a control channel. Alternatively, if the network 30 comprises a CDMA 2000 network, the transfer may be performed using an Application Data Delivery Service (ADDS).

In a fourth step 68 the BSS adds the identifier 46 to the message and sends the message to the mobile phone 32.

In a fifth step 70, the mobile phone 32 identifies the SMS message as a message comprising the number 44 by the identifier 46 using software included in the SIM 31 or memory 33 of the mobile phone. The mobile phone uses the number 44 and the mobile phone stored values IMSI and Ki to generate a reply value 50 as a signal reply to the number 44. The mobile phone then composes an SMS message 54 incorporating the reply value 50 and the identifier 52.

In a sixth step 74 the mobile phone sends an SMS message 54 to the BSS 34.

In a final step 76, BSS 34 transmits SMS message 54 to MSC 40, which identifies the SMS message from identifier 52 as a response to authentication SMS message 48. MSC 40 then recovers the value of reply value 50 as a signal reply from message 54 and compares the recovered value with the expected value of SRES received from HLR 38 in a second step 64. If the two signal responses match, the MSC 40 authenticates the mobile phone; if the responses do not match, the mobile phone is not authenticated.

It will be appreciated that the description above with reference to figures 2 and 3 applies generally to any mobile transceiver operating in a cellular communications network, wherein the transceiver is capable of sending and receiving SMS messages. Thus, the scope of the present invention is not limited to any particular protocol or method of transmission used by the transceiver and/or network.

In another preferred embodiment of the present invention in which the BSS 34 and the mobile phone 32 are capable of communicating over a spread spectrum system, such as a Code Division Multiple Access (CDMA) system, the messages 48 and 54 (fig. 2) comprise short data burst messages. The data burst message IS described and characterized in the TIA/EIA/IS-2000-A-1 standard, which IS made clear by reference to the background of the invention. The data burst message is preferably implemented according to one of the predefined types incorporated in the standard or by a user-defined type. If messages 48 and 54 are in the form of data burst messages, BSS 34 identifies the data burst message as an authentication response, recovers the reply value 50, and provides the value to MSC 40 in a sixth step 74 and a final step 76. The MSC then makes a comparison between the recovered value and the expected value of SRES.

By incorporating random authentication numbers and responses within these numbers of SMS or data burst messages, the limitations of the number and response size can be avoided. Such size limitations, i.e., the number of corresponding bits for the random authentication number and its response, are generally defined by the particular protocol. Thus, the use of SMS or data burst messages as a delivery system enables the mobile phone to be authenticated with various protocols without having to change the software or hardware within the mobile phone.

It will be appreciated that the preferred embodiments described above are cited by way of example, and that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention includes both combinations and subcombinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.

Claims (15)

1. A method for enabling a mobile phone to operate in a communication network, comprising:

generating a random authentication number and an expected response to the random authentication number;

sending a forward Short Message Service (SMS) message incorporating the random authentication number to the mobile phone;

generating an authentication response at the mobile phone in response to the random authentication number;

receiving a return SMS message from the mobile phone in conjunction with the authentication response;

comparing between the authentication response and the expected response within the returned SMS message; and

the mobile phone is authenticated to operate in the communication network in response to the comparison.

2. The method of claim 1, wherein the mobile phone is adapted to operate under a plurality of different communication protocols.

3. The method of claim 2, wherein the random authentication number comprises a random authentication number size and the expected response and the authentication response each comprise an expected response size, and wherein the random authentication number size and the expected response size have values in response to respective protocols included in the plurality of protocols.

4. The method of claim 1, comprising:

incorporating a forward identifier into the forward SMS message, the forward identifier being adapted to enable the mobile phone to recognize the forward SMS message as an authentication request; and

the mobile phone incorporates a reverse identifier within the return SMS message so that the return SMS message is recognized as an authentication response.

5. Apparatus for operating a mobile telephone within a communications network, comprising:

a network control center for:

a random authentication number and an expected response to the random authentication number are generated,

incorporating the random authentication number in a forward Short Message Service (SMS) message, an

Sending the forward SMS message to the mobile phone; and

circuitry included within a mobile phone for:

an authentication response is generated in response to the random authentication number,

incorporating the authentication response in the return SMS message, an

The return SMS message is sent to the network control center,

the network control center is also configured to make a comparison between the authentication response and the expected response and to authenticate the mobile phone as operating in the communication network in response to the comparison.

6. The apparatus of claim 5, wherein the network control center comprises at least one of a Base Station System (BSS), a Mobile Switching Center (MSC), and an authentication center (AUC).

7. The apparatus of claim 5, wherein the circuitry is to operate a mobile station under a plurality of different communication protocols.

8. The apparatus of claim 7, wherein the random authentication number comprises a random authentication number size and the expected response and the authentication response each comprise an expected response size, and wherein the random authentication number size and the expected response size have values in response to respective protocols included in a plurality of protocols.

9. The apparatus of claim 5, wherein the network control center is operative to incorporate into the forward SMS message a forward identifier that enables the circuitry to recognize the forward SMS message as an authentication request, and wherein the circuitry is operative to incorporate into the return SMS message a reverse identifier that enables the network control center to recognize the return SMS message as an authentication response.

10. A method for enabling a mobile telephone to operate in a communication network for transmitting and receiving data burst messages, comprising:

generating a random authentication number and an expected response to the random authentication number;

sending the forward data burst message combined with the random authentication number to the mobile phone;

generating an authentication response at the mobile phone in response to the random authentication number;

receiving a return data burst message from the mobile telephone in conjunction with the authentication response;

comparing between the authentication response and the expected response within the return data burst message; and

the mobile phone is authenticated to operate in the communication network in response to the comparison.

11. Apparatus for operating a mobile telephone within a communication network adapted to transmit and receive data burst messages, comprising:

a network control center for:

a random authentication number and an expected response to the random authentication number are generated,

incorporating the random authentication number in a forward data burst message, an

Sending the forward data burst message to the mobile telephone; and

circuitry included within a mobile phone for:

an authentication response is generated in response to the random authentication number,

incorporating the authentication response in a return data burst message, an

The return data burst message is sent to a network control center,

the network control center is also configured to make a comparison between the authentication response and the expected response and to authenticate the mobile phone as operating in the communication network in response to the comparison.

12. Apparatus for operating a mobile telephone within a communications network, comprising:

network control means for:

a random authentication number and an expected response to the random authentication number are generated,

incorporating the random authentication number in a forward Short Message Service (SMS) message, an

Sending the forward SMS message to the mobile phone; and

circuitry included within a mobile telephone for:

an authentication response is generated in response to the random authentication number,

incorporating the authentication response in the return SMS message, an

The return SM8 message is sent to the network control center,

the network control means is also arranged to make a comparison between the authentication response and the expected response and to authenticate the mobile telephone to operate in the communications network in response to the comparison.

13. The apparatus of claim 12, wherein the circuit means is for operating a mobile station under a plurality of different communication protocols.

14. The apparatus of claim 13, wherein the random authentication number comprises a random authentication number size and the expected response and the authentication response each comprise an expected response size, and wherein the random authentication number size and the expected response size have values in response to respective protocols included in a plurality of protocols.

15. The apparatus of claim 12 wherein the network control means is for incorporating a forward identifier in the forward SMS message, the forward identifier enabling the circuitry to recognize the forward SMS message as an authentication request, and wherein the circuitry is for incorporating a reverse identifier in the return SMS message, the reverse identifier enabling the network control means to recognize the return SMS message as an authentication response.