WO2002102103A2

WO2002102103A2 - Authentication method

Info

Publication number: WO2002102103A2
Application number: PCT/EP2002/006397
Authority: WO
Inventors: Harald Vater; Markus Bockes; Ulrich Heckmanns
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2001-06-12
Filing date: 2002-06-11
Publication date: 2002-12-19
Also published as: AU2002345028A1; EP1400142A2; WO2002102103A3; DE10128300A1

Abstract

The invention relates to a method for producing an authentication response parameter SRES for authenticating a subscriber identification unit in a network, especially GSM-network, in a service provider. The authentication response parameter SRES is calculated by using an individual authentication key Ki from a question parameter RAND, allocated to said subscriber identification unit . A modifying parameter AM associated with the service provider is used in at least one step of the inventive method during calculation.

Description

authentication method

The present invention relates to a method for generating an authentication response parameter for authenticating a subscriber identification unit in a network at a service provider. Furthermore, the invention relates to an authentication method for a network using such a method for generating the authentication response parameter, a subscriber identification unit and an authentication center for carrying out the method, and a computer program with corresponding program code means to carry out the method by means of a computer.

In mobile radio networks, it is known that the mobility of the subscribers is achieved by the individual network operators each providing the most widespread, close-knit network of base stations via which the individual subscriber can communicate with the mobile radio network using his terminal or mobile radio device. Due to these radio interfaces, the entire system is relatively sensitive to misuse of the network by unauthorized users and eavesdropping on the transmitted information, since it is usually possible to listen to or transmit the radio signals from any location without any direct mechanical intervention the mobile network, for example connecting cables etc., is necessary. The same problem arises in other networks, such as the Internet, in which data is exchanged in a relatively easy way for the public, and in which access to many services or data areas is in principle easily and often unnoticed possible without mechanical intervention.

For this reason, special measures are required in particular in such easily accessible networks in order to protect both the users of the network or the service in the network and the service provider against such undesired interventions. There are two main security objectives in the foreground:

One goal is the authentication and thus the access control of the individual subscriber to the service offered, for example in the case of the mobile radio network the establishment of a connection to another telephone subscriber. Another main goal is the protection of the transmitted information itself.

The purpose of authentication is to verify the identity and authenticity of a communication partner. It is sufficient if one-sided authentication is carried out, that is, if the network or the service provider can determine the authenticity of the subscriber or the terminal or a subscriber identification unit located therein, which is located, for example, on a chip card. For authentication, the two communication participants must have a shared secret that is checked using an authentication method. This can be, for example, a password or the like. However, it makes sense to use a dynamic method for authentication. Such a dynamic method is designed in such a way that it is protected against an attack by re-importing recorded data from previous sessions, since a different data basis is used for each individual authentication. This is possible, for example, in that in a first step the network or the service provider sends a specific request parameter (challenge) to the subscriber identification unit, which is encrypted in the subscriber identification unit with a secret authentication key that is only known to the subscriber identification unit and the network or the service provider is. The encryption result is then sent back in a second step and compared by the network or the service provider with a response parameter (response) generated in parallel from the sent request parameter and the common key. This principle is referred to as the so-called “challenge and response principle”. It is the usual principle of authentication in the chip card area. As a rule, a random number is generated as the request parameter is not intended to limit the use of a random number as a query parameter.

After authentication has been carried out, the information that must be protected against attacks is transmitted. The transmission of data between the terminal and the network or the service provider is preferably secured by a suitable message and encryption, with a new key being used here for each connection. This is e.g. This is possible, for example, in that the request parameter (or the random number) which the network or the service provider sends to the subscriber identification unit, which is initially used for the authentication, is additionally used to provide a (temporary) message coding key for encrypting the transmitted data produce. The principle of subscriber authentication and message encryption described above is explained in detail below using the example of the standard for mobile phones known as GSM (Global System for Mobile Communications). However, it is pointed out once again that the invention is not restricted to use in mobile radio networks, in particular according to this standard.

A GSM mobile radio network is made up of several Base Station Systems (BSS), which are managed by a Mobile Switching Center (MSC), which has a so-called Authentication Center (AUC) as a special component. The AUC is a special security entity that has the necessary keys and algorithms for the authentication of the mobile radio devices or the subscriber identification units located therein.

The counterpart to the Base Station Systems (BSS) are the individual mobile devices. A mobile radio device essentially consists of the actual device itself, which has the radio part, a coding / decoding unit (codec) for processing, in particular for encrypting and decrypting the transmitted data, a keyboard, a display and other customary components. Another essential component of the mobile radio device is a subscriber identification unit, which is called SIM (Subscriber Identity Module) in the GSM system. The SIM is usually located on a chip card, which is inserted into the actual device. The mobile device can only be used when the SIM is inserted.

Each SIM is inherently a unique number in the entire GSM system, the so-called IMSI (International Mobile Subscriber Identity), as well as a secret number, the so-called authentication key (Subscriber authentication Key; Ki). This data and in particular the authentication key (Ki) are stored in the SIM in a specially protected area.

On the other hand, the authentication center (AUC) of the respective mobile radio network has a database in which the identification numbers (IMSI) are stored together with the assigned authentication keys (Ki).

If a mobile radio device (hereinafter also referred to as a mobile station) is booked into a mobile radio network, the IMSI is first transmitted to the mobile radio network by the mobile station or SIM. The mobile station is thus clearly identified in the mobile radio network. For authentication, a randomly generated number (generally referred to as RAND or RND) is transmitted from the mobile radio network to the mobile station.

Both the SIM of the mobile station and the authentication center generate an authentication response parameter (generally called Signed Response; SRES) from this random number by means of a defined algorithm, which is called "A3" in the GSM system, using the SIM's secret individual authentication key Ki According to the current standard, the random number has a length of 128 bits, and the authentication key usually has a length of 128 bits, and the result of the authentication response parameter SRES generated with the A3 algorithm is 32 bits in the current standard is transmitted from the SIM to the mobile network, where the response with the authentication response generated in parallel by the Authentication Center AUC parameter is compared. If there is a match, it can be assumed that the SIM has the correct key Ki. It is therefore authenticated.

Furthermore, both the SIM and the Authentication Center AUC have a so-called A8 algorithm. In this A8 algorithm, a message coding key (cipher key; Kc; length: 64 bits) is generated from the random number, again using the authentication key Ki of the respective SIM. This message coding key Kc is used to encrypt the (voice) data to be transmitted during the connection between the mobile station and the mobile radio network and thus to protect it against eavesdropping. The message coding key Kc is consequently generated anew with each authentication process depending on the random number RAND, which considerably increases the security of the transmission against eavesdropping. The encryption unit located in the codec of the mobile radio device is able to encrypt or decrypt the voice data in real time with the message coding key Kc using a so-called A8 algorithm. On the other hand, the transmitted data is encrypted or decrypted accordingly in the mobile radio network using the identical key generated in parallel there.

For authentication and security, a so-called "triplet" of three parameters - the random number (RAND), the derived authentication response parameter (SRES) and the message coding key (Kc) - is required for each new registration of a mobile station in a mobile radio network, only the Random number is sent from the mobile network to the mobile station and this the authentication response parameters ter sends back. Each triplet (RAND, SRES, Kc) is used only once and then discarded.

In order to save computing and transmission times for the triplets, a number of triplets are usually generated by the authentication center AUC for each subscriber of the associated mobile radio network at a specific point in time and stored in a special security parameter file. Since these three parameters (RAND, SRES, Kc) are completely sufficient to authenticate a specific SIM and establish an encrypted connection, there is thus the possibility of external GSM networks from

To make a certain triplet available to the home network without having to release the secret authentication key (Ki) or the usually secret algorithm, which are usually stored in special security devices within the authentication center. There is thus a simple possibility for a subscriber of a mobile radio network, in so-called “roaming”, to log in as a guest in an external network.

Due to the possibility of authentication by means of only three temporary parameters without the strictly confidential being given out

Key or coding algorithms, such a method is also well suited for use on the Internet or other publicly accessible networks. Here too, for example, an authentication center can provide various service providers or different independent servers with a number of triplets for a specific subscriber identification unit, with which they are then able to authenticate a specific subscriber identification unit and to exchange encrypted data. In addition, the but also lead to additional security in closed, secured networks, e.g. B. ATM networks are used.

A special A3 algorithm for generating an authentication response parameter for authenticating a subscriber identification unit in a GSM network is described in WO 97/15161. According to the method mentioned there, it is provided that the 128-bit random number is first converted into a 152-bit parameter using a special algorithm. This input parameter is fed to a so-called CAVE algorithm, which generates an 18-bit output parameter from it. This 18-bit output parameter is then converted into a 32-bit authentication response parameter. The method described there has the purpose of making the CA VE algorithm used in American mobile radio standards usable for the GSM standard. However, the method has the disadvantage that the entire algorithm is fixed and can only be varied with great effort.

As already described above, it is desirable if not only the individual authentication keys Ki of the individual subscriber identification units of a mobile radio network are kept secret, but also the algorithm is individualized in order to achieve higher security

The invention is therefore based on the object of providing a corresponding method for generating the authentication response parameter, which can be individually and easily changed at low cost. Furthermore, there is the task of a corresponding authentication method as well as a subscriber identification unit and a to provide the centralization center for carrying out the method.

This object is achieved by a method for generating an authentication response parameter according to claim 1, an authentication method according to claim 5, a subscriber identification unit according to claim 7 and an authentication center according to claim 9. Advantageous refinements of the invention are specified in the dependent claims.

According to the invention, the method for generating the authentication response parameter from the request parameter, preferably a random number, is individualized in that an individual modification parameter assigned to the respective service provider is used in the calculation in at least one method step. This means that, like a key, an additional parameter is introduced which is used at a specific point in the algorithm. The change in this modification parameter consequently also means a change in the algorithm. In this way it is possible to provide individual authentication methods for a large number of different service providers, which are just as secure and fast as the methods carried out with the unchanged algorithm.

The modification parameter can be generated, for example, with a random number generator. This can be carried out, for example, by a manufacturer of the subscriber identification units, in particular a chip card manufacturer, who generally also identifies the identification number. mern and generated the authentication keys for the individual subscriber identification units in a secure environment and implemented in the subscriber identification units. Likewise, the modification parameter from the manufacturer of the subscriber identification units, just like the algorithm, the identification numbers and the authentication key for the subscriber identification units, can be transmitted to the authentication center in a secure manner on the one hand and stored in a secure environment on the other.

Conventional encryption methods such as, for example, the triple DES method explained in more detail below can be used in the method. These methods currently offer the greatest possible security. The modification parameter can be included, for example, by logically linking it to the request parameter before encryption. Of course, it is also possible to link the modification parameter with an intermediate result in the course of the method or to use the modification parameter several times within the procedure.

To further increase security, the request parameter is broken down into at least two parts and the parts are used in the calculation in different procedural steps. This results in additional mixing of the request parameter.

In a preferred embodiment variant of the method, an output or intermediate result is used to calculate the message coding key when calculating the authentication response parameter. In this way, the overall algorithm for generating the Encryption result more complicated and therefore more secure without additional effort.

An authentication method according to the invention for a network has the following method steps. First, a query parameter, preferably a random number (in the following, a random number is again assumed as a query parameter without restricting the invention). This can be done either in an authentication center or in a separate random generator. This random number is then transmitted over the network to a subscriber identification unit of a user's terminal. The authentication response parameter and possibly the message coding key are then generated in the subscriber identification unit using the previously explained method according to the invention. This authentication response parameter is transmitted back to the network and is compared there with the authentication response parameter determined in parallel by the authentication center using the same authentication key. If the two parameters match, the subscriber or the corresponding subscriber identification unit is regarded as identified.

A subscriber identification unit according to the invention must first have storage means in which an individual authentication key assigned to the respective subscriber identification unit and a modification parameter assigned to the service provider are stored. The memory means can be completely separate memories, but also memory areas within an overall memory. It makes sense for this to be a non-volatile memory. Furthermore, the subscriber identification unit must have means for generating an authentication response parameter from a random number using the method according to the invention. This can be a special hardware circuit which, for example, executes the algorithm directly in binary. Such a special hardware structure of the circuit is complex, but very powerful in terms of computing speed. In the simpler case, it can be a CPU, for example in a microcontroller, in which the method is implemented in software in the form of a computer program with suitable program code means. In particular, such a subscriber identification unit can be a chip card, for example a SIM card in the case of the GSM system.

It goes without saying that if the respective subscriber identification unit authorizes the use of services from different service providers, several modification parameters are stored accordingly. This shows another advantage of the invention, since in order to use a subscriber identification unit for different service providers, it is not necessary to implement several complete algorithms in the subscriber identification unit, but rather only a basic algorithm that is individualized by the stored modification parameters in a service provider-specific manner. This is of great advantage in particular when using chip cards as subscriber identification units because of the limited capacity of the chips.

An authentication center according to the invention in a network must accordingly have storage means with a database of different authentication devices assigned to the individual subscriber identification units. key and with a modification parameter assigned to the respective service provider. In addition, this authentication center also requires means for generating an authentication response parameter from a random number using the method according to the invention. Here too, the method can be implemented either by setting up a special circuit or by a computer with a suitable software program.

In the case of a mobile radio network, the authentication center is the usual AUC.

Other networks, for example on the Internet, can be an independent authentication center, which takes over the authentication as a service provider for various service providers and has corresponding, particularly secure zones for storing the various keys. In principle, however, it is also possible for individual service providers to have their own authentication center, each of which communicates via the Internet with a subscriber identification unit located on the subscriber's terminal. In such a case, too, it makes sense to arrange the subscriber identification unit, for example within a chip card, and accordingly to integrate a chip card reader on the terminal, for example a PC, with which the subscriber identification unit is accessed.

As already mentioned at the beginning, authentication in mobile radio networks is a main area of application of the method according to the invention. Another area of application is authentication against certain service providers on the Internet. Of course, authentication also comes with this This method in other networks, for example in networks of ATMs or other systems, such as access control systems or the like, in question.

The invention is explained in more detail below with reference to the accompanying drawings using various exemplary embodiments. The features shown there and also the features already described above can be essential to the invention not only in the combinations mentioned, but also individually or in other combinations. Show it:

Figure 1 is a schematic representation of the sequence of the inventive method according to a first embodiment.

2 shows a schematic illustration of the sequence of the method according to the invention in accordance with a second exemplary embodiment;

Fig. 3 is a schematic representation of the sequence of the inventive method according to a third embodiment.

For the sake of simplicity, the exemplary embodiments shown in the figures again assume the use of the method according to the invention for authentication in a mobile radio network.

A relatively simple version of the method according to the invention is shown in FIG. The random number RAND is first linked to the modification parameter AM (Algorithm Modifier). In the present case, this link is an XOR (exclusive OR) i

- 15 -

-Shortcut. Any other logical link can also be selected.

Such an XOR operation corresponds to a bit-wise addition of the two binary numbers, the combinations 1 + 1 and 0 + 0 each giving 0 and exclusively the combination 1 + 0 and 0 + 1 each giving 1. The consequence of this is that an XOR combination of any bit sequence with a bit sequence consisting of all zeros does not change the bit sequence. A modification parameter 000 ... 0 therefore does not change the basic algorithm. By modifying the AM at the request of the service providers of

000 ... 0 is set to different bit sequences defined for each service provider, the data for each service provider network can be individually encrypted while maintaining the same basic algorithm.

The modification parameter AM has the same bit length as the random number RAND. In the GSM system, the modification parameter AM in the exemplary embodiment according to FIG. 1, like the random number RAND, has the length of 128 bits.

The link result is then by means of the triple DES

Encryption method encrypted using the individual authentication key Ki of the subscriber identification unit. The simple DES method is a so-called symmetrical encryption method that is used relatively frequently in the chip card area (that is, the same key is used for encryption and decryption). The key length is usually 64 bits, although in the DES method, however, every eighth bit is usually a parity bit, which is only used to control the other bits in the key and therefore not significant for the result. If a 128-bit key Ki is used, which does not contain any parity bits (for example keys in the GSM system), every eighth bit is simply ignored in the encryption provided. The DES encryption process is considered to be extremely secure. The only promising attack against such a system to date is a very complex search for the key by trial and error, which requires enormous computing capacity.

To prevent such a direct attack, the triple DES method is therefore used, in which three DES operations with alternating encryption and decryption are connected in series. This means that first a plain text, in the present case the combination result of the random number RAND and the modification parameter AM is encrypted in a DES method with a first key, then decrypted with a second key in a DES method and finally encrypted again, in which case the same key is used for the second encryption as for the first encryption. Of course, three different keys can also be used. In the present case, the authentication key Ki consists of 128 bits, the 64 most significant bits (msb) forming a first key Kl, which is used for encryption within the triple DES method, and the lower-order 64 bits (least significant bits; lsb) of Ki form the second key K2, which is used for the decryption within the Triple-DES method.

Mathematically this can be done by the spelling 3-DESκι (C) = DESκι (DES- ⁱ _K2 (DESκι (C)))

represent, where DESκι (C) the simple DES encryption of a 64-bit plain text C with the key Kl and DES ^_1 κ2 (C) means a corresponding decryption with the key K2.

The further precise details of the DES process and the Triple DES process will not be discussed here. Although this is the preferred form of the encryption method within the method according to the invention. However, any other suitable encryption method can also be used instead of the triple DES method.

The result of the combination of the random number RAND and the modification parameter AM encoded in this way is referred to in FIG. 1 as OUTS _RE S. This result OUTSRES has the same bit length as the input parameters, ie 128 bits in the present exemplary embodiment. In the GSM standard, however, the authentication response parameter SRES only has a bit length of 32 bits. Therefore, only the low-order 32 bits of the encryption result OUTSRES are used as authentication response parameters SRES. In the case of 128 bit input parameters, the DES is operated in the so-called CBC mode (cipher block chaining). If the input parameters are only 64 bits long, work in non-chained DES mode.

In the exemplary embodiment shown in FIG. 2, a somewhat more complicated method is used. Here, the random number RAND is first divided into a higher value part R ^ and a lower value part R2 of the same bit length broken down. This means that the parts R ^ and R2 are each 64 bits long when using the method according to the GSM standard. Accordingly, the modification parameter AM also has a length of 64 bits. In this method, too, as in the method according to FIG. 1, there is first a logical XOR combination of the random number RAND and the modification parameter AM.

In this second exemplary embodiment too, the linking result is then encrypted using a triple DES method using the authentication key Ki of the subscriber identification unit. The encryption result T \ obtained therefrom, which in turn has a length of 64 bits, is first linked in a further method step with the higher-value portion R1 of the random number RAND, and this linking result is repeated using the authentication key Ki with a triple DES method encrypted. The authentication response parameter SRES is only obtained from this double-encrypted method, in which the random number RAND has been mixed together. As in the first exemplary embodiment, only the least significant 32 bits of the last encryption result OUTSRES, also called T2 in FIG. 2, are used as authentication response parameters SRES.

FIG. 3 shows a further embodiment of the method according to FIG. 2, in which a message coding key Kc is simultaneously generated from the random number RAND. For this purpose, the encryption result T2 obtained according to the method in FIG. 2 is again linked to the low-value part R2 of the random number RAND by means of an XOR operation. This

Link result is then again using the authentication key Ki encrypted with a triple DES method. The message coding key Kc is then obtained from the encryption result Outκc.

In the exemplary embodiment shown, two different possibilities are indicated. Either the message coding key Kc consists of the 54 most significant bits of the encryption result Outκc and the ten least significant bits of the message coding key Kc are set to 0, or the entire encryption result Outκc is used unchanged as the message coding key Kc.

In one embodiment of the method it is specifically provided that only a so-called "flag bit" is set as an indicator (not shown) and this flag bit is automatically queried before the message coding key Kc is output. If the flag bit is 0, if the last bits of Outκc are automatically set to 0, if the flag bit is 1, Outκc remains unchanged.

Of course, it is also possible to set the last ten bits to 1 in a defined manner or to set a longer or shorter number of end bits to a certain predetermined value. The exact specifications depend on the requirements of the service provider or depend on whether a key with a known number of so-called tail bits is required within the information encryption process between the terminal and the network or service provider. Some encryption methods require known tail bits in order to set the encoder to a known state at the end of a block or before the start of a new block. The method shown in FIG. 3 therefore, in the notation of the GSM standard, advantageously combines the A3 algorithm for the generation of the authentication response parameter SRES with the A8 algorithm for the generation of the message coding key Kc, so that the A8 algorithm is set up securely , on the other hand, however, a large part of the computing effort was already used for the A3 algorithm, and thus, unlike in the case of completely separate parallel algorithms, the calculation effort is low.

For the sake of clarity, all abbreviations used and the reference symbols used in the figures are listed again below:

RAND random number Rl higher value portion of RAND

R2 low value portion of RAND

AM modification parameter (Algorithm Modifier) Ki authentication key Υ first encryption result

T2 second encryption result

SRES Authentication Response Parameters (Signed Response)

Kc ciphering key

OutsREs encryption result Outκc encryption result

DES Data Encryption Standard (encryption method)

Kl higher value part of Ki K2 lower value part of Ki

XOR "exclusive OR" combination msb most significant bit (lsb significant bit) lsb least significant bit (least significant bit)

GSM Global System for Mobile Communications

SIM Subscriber Identity Module (subscriber identification unit in the GSM system) BSS Base Station System

MSC Mobile Switching Center

AUC Authentication Center (authentication center in the GSM system)

Claims

claims:

1. Method for generating an authentication response parameter

(SRES) for authenticating a subscriber identification unit in a network at a service provider, in which the authentication response parameter (SRES) is calculated from a request parameter (RAND) using an individual authentication key (Ki) assigned to the subscriber identification unit, characterized in that in at least one Method step in the calculation of a modification parameter (AM) assigned to the service provider is used.

2. The method according to claim 1, characterized in that the request. parameter (RAND) is broken down into at least two parts (Rj, R2), and the parts (R ^, R2) in different process steps in the

Calculation can be used.

3. The method according to claim 2, characterized by the following steps:

- Decomposition of the request parameter (RAND) into a higher value

Component (R3J and a low-value component (R2) of the same bit length,

in a first linking step, linking the low-value part (R2) of the request parameter (RAND) with the modification parameter (AM), Encryption of a linking result of the first linking step using the authentication key (Kl) to a first encryption result (Ti),

- In a second linking step, linking the first encryption result (i) with the higher value portion (R ^) of the

Request parameters (RAND),

- Encryption of a linking result of the second linking step preceding the step using the

Authentication key (Ki) to a second encryption result (T2), and

- Determination of the authentication response parameter (SRES) from the second encryption result (T2).

4. The method according to any one of claims 1 to 3, characterized in that the encryption of at least one link result is carried out in a triple DES method.

5. The method according to claim 3 or 4, characterized in that the second encryption result (T2) is linked to the low-order portion (R2) of the request parameter (RAND) and a result of the linkage obtained is encrypted using the authentication key (Ki) and a message coding key (Kc) is obtained from a third encryption result (Outκc) obtained therefrom.

6. Authentication procedure for a network with the following procedure steps:

- Generation of a request parameter (RAND),

Transmission of this request parameter (RAND) from the network to a subscriber identification unit of a terminal,

Generation of an authentication response parameter (SRES) from the request parameter (RAND) using an authentication key (Ki) of the subscriber identification unit,

Transmission of the authentication response parameter (SRES) from the subscriber identification unit to the network, and

- Comparison of the authentication response parameter (SRES) obtained from the subscriber identification unit with an authentication response parameter (SRES) determined by an authentication center using the authentication key (Ki) from the request parameter (RAND), characterized in that the authentication response parameter (SRES) by means of a Method according to one of claims 1 to 4 is generated from the request parameter (RAND).

7. Authentication method according to claim 6, characterized in that a message from the subscriber identification unit and from the authentication center according to a method according to claim 5. tencoding key (Kc) is generated, which is used to encrypt data to be transmitted between the terminal and the network.

8. Subscriber identification unit with storage means in which an individual authentication key (Ki) assigned to the subscriber identification unit and a modification parameter (AM) assigned to a service provider are stored, and with means for generating an authentication response parameter (SRES) from a request parameter (RAND) according to a method according to one claims 1 to 4.

9. subscriber identification unit according to claim 8, characterized by means for generating a message coding key (Kc) according to a method according to claim 5.

10. Authentication center for a network with storage means; in which individual authentication keys (Ki) assigned to individual subscriber identification units and a modification parameter (AM) assigned to a service provider are stored, and with means for generating an authentication response parameter

(SRES) from a request parameter (RAND) according to a method according to one of claims 1 to 4.

11. Authentication center according to claim 9, characterized by means for generating a message coding key (Kc) according to a method according to claim 5.

2. Computer program with program code means to carry out all steps according to one of claims 1 to 5 when the program is executed on a computer.