Authentication between a cellular phone and an access point of a short-range network

[0001] The present application is based on, and claims priority from, EP Application Number 03292926.7, filed Nov. 26, 2003, the disclosure of which is hereby incorporated by reference herein in its entirety.

[0002] The present invention relates in general to connecting an access point of a short-range wireless network of the Bluetooth or Wi-Fi type to a mobile terminal of a cellular network of the GSM type and equipped with a transceiver module that shall communicate with an access point of the short-range network. More specifically the present invention relates to generating a link key during authentication of the mobile terminal and the access point in order to pair them.

[0003] As regards the security of a radio link, Bluetooth in particular, for instance a user wishing to set up a Bluetooth link between a portable personal computer PC and a cellular mobile terminal will acquire a PIN identification code as the secret key to the computer's and the mobile terminal's keyboards. The computer and the mobile terminal each set up a link key depending on the random numbers being exchanged between them, on the secret key, and on the Bluetooth addresses of the computer and the mobile terminal. Illustratively if the personal computer is the link authenticator, then it will generate a random number (challenge) which it transmits through the Bluetooth radio interface to the mobile terminal. This terminal calculates a response depending on the received random number, on the link key and on the Bluetooth address of the mobile terminal in order that the computer can compare the reply of the terminal with the reply that the computer calculates, whereby, if the compared replies are identical, there is an identity.

[0004] The pairing of the computer and the terminal requires a secret key (PIN code) to share the secret link. The secret key must be sufficiently long and not appear in dictionaries to prevent the key from being attacked, in an attempt to discover the key and other coding key(s). Such attacks cast doubt on authentication and on the integrity of the exchanged data.

[0005] The secret key must be sufficiently long to preclude such attacks, and consequently a laborious acquisition subject to errors must be carried out, in particular in the mobile terminal having a man-machine interface of limited size.

[0006] An object of the present invention is to provide a new and improved method of and apparatus for making a secure connection between a mobile cellular terminal and an access point of a short-range wireless network without having to acquire a secret key (PIN code) while using such a key, which may include many bits.

[0007] According to one aspect of the present invention, an authentication process preceding a session between a short-range radio network having access points and a mobile terminal in a cellular radiocommunication network comprises the following stages:

[0008] (1) transmitting a request including a mobile terminal address and an access point address in a zone where the mobile terminal is located; the request is transmitted to a controller that generates a secret code and is linked to the cellular network,

[0009] (2) transmitting from the controller a confirmation message including the secret code and the access point address that was retrieved from the request by the mobile terminal through the cellular network; the mobile terminal request includes the secret code and the mobile terminal address that was retrieved from the request at the access point,

[0010] (3) requesting that the mobile terminal be connected to the access point which was designated by the address retrieved from the confirmation message to enable the mobile terminal and the access point to generate a session key depending on (a) the access point address, (b) the mobile terminal address, (c) the secret code that was retrieved from the confirmation message, and (d) the connection request message, and

[0011] (4) authenticating the mobile terminal on the part of the access point as a function of session key.

[0012] Authentication of the mobile terminal preferably includes generating, at the access point, a reply that is a function of the session key and an access point. The reply is transmitted to the mobile terminal which transmitted the reply to the access point through the short-range network. At the access point a reply is generated as a function of the session key and a comparison of the replies for the purpose of authorization opening network. Opening a session between the access point and the mobile terminal is authorized in response to the replies being favorably compared, e.g., the replies being identical.

[0013] Preferably the preceding authentication by the access point of the mobile terminal is completed by the mobile terminal authenticating the access point as a function of the session key when the access point has authenticated the mobile terminal. In such a case, following a favorable comparison of the replies of the access point, the procedure preferably transmits a prompt to the mobile terminal. The prompt causes the mobile terminal to authenticate the access point by prompting the access point to generate a second reply as a function of the session key. The access point transmits the second reply to the mobile terminal through the short-range network by generating a second reply as a function of the session key and by comparing the second replies of the mobile terminal and the access point to authorize session opening only in response to a favorable comparison of the second replies compared in the mobile terminal.

[0014] It is preferable in practice that the mobile terminal seek several access points in a zone where the mobile terminal is located in order to insert addresses of the access points found in the request. Thereupon a controller selects the address of an optimal access point from among the access point addresses retrieved from the request. The selected address depends on one or more predetermined criteria for enabling the optimal access point to be inserted into a confirming message transmitted to the mobile terminal and into the connection request message transmitted to the optimal access point.

[0015] In one embodiment of the present invention, the controller generates the session key instead of the session key being generated by the mobile terminal and the access point. In this variant, the generated session key, instead of the secret code, is inserted into the confirmation message and into the connection request message in order that, during authentication, the replies which are compared are generated as a function of the session key retrieved from the preceding messages.

[0016] Another aspect of the present invention relates to a platform type controller linked to a cellular radio communication network for the purpose of taking part in authentication between a short-range wireless network and a mobile terminal within the cellular network. The controller is arranged so the controller replies to a request which includes the mobile terminal address and an access point address in a zone where the mobile terminal is located by generating a secret code. The controller transmits to the mobile terminal a confirming message including the secret code and the access point address that was retrieved from the request. The confirming message is transmitted through the cellular network with a connection request message which includes the secret code and the mobile terminal address retrieved from the request to the access point. The connection request message causes the mobile terminal to request a connection to the access point designated by the address retrieved from the confirming message. The mobile terminal and the access point respond to the connection request message by generating a session key as a function of (1) the access point address, (2) the mobile terminal address and (3) the secret code retrieved from the confirming message. The access point authenticates the mobile terminal as a function of the session key.

[0017] In a variation of the present invention, the controller determines the session key and inserts it, instead of the secret code, into the confirming message and the connection request message.

[0018] Other features and advantages of the present invention are elucidated in the description below of several preferred, illustrative and non-limiting embodiments of the invention and in relation to the appended drawings.

[0021] The telecommunications system shown in FIG. 1 that performs an authentication procedure comprises a cellular mobile terminal TM within a cellular radio communications network RC, one or more access points AP linked by a distribution network RD within a short-range wireless network RFP for accessing a high-rate packet network RP, such as the Internet, and a controller, i.e., management platform, PFG. Illustratively the cellular network RC is a GSM network and the short-range wireless network RFP is a Bluetooth network.

[0022] The mobile terminal TM has first and second radio (i.e., wireless) interfaces, respectively with the cellular network RC and the short-range network RFP.

[0023] Each of the access points AP and, in a variation, the mobile terminals TM includes a pseudo-random generator and each manages an authentication algorithm AA for producing replies RP1, RP2, etc. Each of the replies RP1, RP2, etc., is a function of a random number, of a secret code and of the address of the mobile terminal or of the address of an access point in the short-range network RFP. A session key algorithm AS also is performed by the stations at the access points and by the mobile terminal.

[0024] Mobile terminal TM is temporarily coupled to cellular network RC, for instance a GSM network. Network RC includes, for instance a base station BTS, a base station controller BSC, a mobile switching service MSC associated to a visitor location recorder VLR and a nominal location recorder HLR.

[0025] The management platform PFG is linked to the nominal location recorder HLR either directly by an authentication center (not shown) that is linked to the recorder HLR by a server through an intermediary network such as the Internet RP. Also the platform PFG is linked (1) to a Short Message Service Center SMSC in response to short message requests RQ being transmitted to it by mobile terminals and/or (2) to an Unstructured Supplementary Service Data signaling message USSD in response to requests RQ being transmitted to it in USSD form by mobile terminals TM. The USSD messages are transmitted by actual sessions, at a rate greater than the short messages. The short message center and the signaling message center are designated hereafter without distinction as “message center CM”. In particular the controller PFG includes a pseudo-random generator that generates secret codes CS in response to requests from mobile terminals such as the terminal TM. The secret codes are longer than usual, typically being at least sixteen octets, namely longer than 128 bits.

[0026] In other variations of the system of FIG. 1 invention, the controller PFG contains a database of addresses ADAP of the access points AP of several short-range wireless networks in combination with the geographic locations of the access points AP relative to determined location zones AP relative to determined location zones ZL within the cellular network RC. A location zone within a cellular network covers several cells associated with base stations BTS. A switch MSC manages one or several location zones.

[0027] As described infra, controller PFG is an intermediate management tool between a mobile terminal TM and an access point AP. Controller PFG transmits to terminal TM and access point AP a secret code CS used for authentication of the terminal access point. In other variations described farther below, controller PFG selects an optimal access point in reply to request RQ of a mobile terminal.

[0028] FIG. 1 only includes one short-range wireless network; it is understood that the mobile terminal TM can communicate with any short-range wireless network, in particular in public places such as a train station, a shopping mall, an airport, a hotel etc. Illustratively a radio access point AP is a station fitted with a Bluetooth radio interface to provide communications within a radius of several dozen meters with mobile terminals and with a line interface. The line interface can communicate on one hand with other access points AP through the distribution network RD if any, of the short-range wireless network. On the other hand the line interface provides high-data rate packet communications at the mobile terminals as a result of the distribution network RD being linked to the Internet RP. In some short-range wireless network configurations, the distribution network RD is an intranet network directly linked by xDSL lines to the Internet RP: alternatively the distribution network RD is merged into the Internet RP and each access point AP is directly linked through xDSL lines to the Internet RP.

[0029] As shown in FIG. 2, the authentication procedure used by the system of FIG. 1 substantially comprises steps or stages E1 through E17. Initially the mobile terminal TM is activated and recognized by the cellular network RC within its radioelectrically covered zone. Accordingly the TM terminal when in the sleep mode is assumed to be located in a zone ZL of the network RC, and has received, in a known manner, a temporary identify TMSI by the recorder VLR coupled to this location zone ZL.

[0030] In stage E1, the user of the terminal TM entering the short-range, wireless network RFP with access points AP selects a Bluetooth menu on his terminal TM. The user initiates a search of a sub-menu (inquiry mode) including access points AP. The access points, i.e., stations, AP search for terminals TM in proximity to the access points; that is the access points AP periodically scan for the presence of a mobile terminal and detect an inquiry transmitted by the mobile terminals in the search zone of the access point. Each access point transmits its particular address to the mobile stations in proximity to the access point. By means of this feature the mobile terminal TM collects the addresses ADAP of the access points situated in the zone where the terminal TM is located; the addresses ADAP are collected with respect to the short-range network RFP. The terminal TM sorts the replies to its inquiry for the addresses of the short-range network RFP entities that correspond to equipment classes associated with the access points for the purpose of eliminating any address from any equipment fitted with a transceiver module compatible with the RFP network, such as a mobile phone terminal, a personal digital assistant PDA, a portable computer etc.

[0031] In stage E2, the terminal TM stores ADAP addresses of the available access points that were found during the previous search during stage E1. Terminal TM inserts the ADAP addresses into the request RQ that is transmitted to the controller PFG through the fixed portion of the cellular network RC. The request RQ comprises the address ADTM of the terminal TM that was pre-stored in the memory of terminal TM so that the controller PFG can communicate the address of terminal TM to the subsequently selected access points. As the addressee's address, the request RQ includes an identifier, IDPFG, of controller PFG: identifier IDPFG was pre-stored in the mobile terminal TM. The request RQ can be a short message or a signaling message USSD, in which case the controller PFG is then connected to the corresponding message center CM.

[0032] In response to the request RQ having been automatically transmitted from the terminal TM and received by controller PFG, the controller then checks the access points list ADAP retrieved from the request RQ to select the optimal access point (stage E3). The selected optimal access point is a function of one of several predetermined criteria. The selection by controller PFG of the optimal access point is preceded by the controller verifying the user profile of the mobile terminal TM, as identified by permanent identifier IMSI of the mobile terminal for the purpose of authorizing access by mobile terminal MT to an access point of the short-range wireless network RFP.

[0033] In a first embodiment variation, a predetermined criterion relates to comparing the power levels of reference signals transmitted from the access points and detected by the mobile terminal TM. In this variation the mobile terminal TM also includes, in association with each ADAP address of each available access point that was found in the transmitted request RQ, a power level NP received at the terminal TM. Thereupon the terminal TM transmits to controller PFG the request RQ together with the ADAP address and the NP power level for the access point associated with the ADAP address. Controller PFG compares the received power levels NP to determine the access point having the highest received power level and to select the access point AP associated with the maximum received power level as the optimal access point for the purpose of deciding the access point to be coupled to the terminal TM.

[0034] In a somewhat similar embodiment to the above described embodiment, the mobile terminal TM, instead of the controller PFG, searches for, detects and selects the optimal access point having the highest power level received by the mobile terminal. The search is performed during stage E1 from among available access points that were found in the zone where the mobile terminal TM is located. In such an embodiment, the request RQ only contains the address ADAP of the optimal access point AP instead of the pairs ADAP, NP.

[0035] In a second embodiment, a predetermined criterion is used to compare traffic loads of the available access points AP that were found by the mobile terminal TM. The criterion enables controller PFG to select the access point having the least traffic as the optimal access point. The traffic loads of the access points AP of the short-range network RFP are collected by the distribution network RD which, through the Internet RP or a special line, periodically communicates the traffic loads to controller PFG to update the access points database.

[0036] In a complementary embodiment, which can be combined with the first or second preceding embodiment controller PFG interrogates the nominal location recorder HLR of the cellular network RC to read out the IDZL identifier of the location zone containing the terminal TM within the cellular network. The interrogation occurs before the selection of the optimal access point address takes place. Depending on the location zone identifier IDZL, the controller PFG eliminates the ADFAP addresses of the list included in the request RQ. These ADFAP addresses designate the available and found access points AP that are situated outside the location zone including the mobile terminal TM and defined within the cellular network. This complementary embodiment precludes a mobile terminal from being substituted for the access point by declaring itself to have an address of an access point which is very remote from the mobile terminal in order to communicate with the latter. Next the optimal access point is selected by controller PFG merely taking the first access point address from the list retrieved from the request RQ or by combining this embodiment with the embodiment using the power levels or the traffic loads of the access points in order to select the access point which exhibits the largest power level or the least traffic load among the access points situated in the location zone.

[0037] In stage E3 moreover, the pseudo-random generator in controller PFG also determines a secret code CS of great length, at least 128 bits.

[0038] Thereupon controller PFG prepares two messages.

[0039] In stage E4, controller PFG derives a confirming message MC containing the optimal access point address ADAP and the secret code CS. Controller PFG transmits message MC through the cellular network RC to the mobile terminal TM. The MC message is of the same type as the request RQ, i.e. it is a short message SM or a USSD message, and it propagates through the corresponding message center CM. Terminal TM retrieves and stores the secret code CS from the message MC in association with the optimal access point address ADAP. In stage E4, the terminal TM holds the secret code CS as if, in the prior art, the user had acquired the PIN code at the terminal keyboard.

[0040] In parallel with the stage E4, controller PFG sets up a connection request message, MDC, including (1) the address ADTM of the mobile terminal TM, (2) the optimal access point address ADAP and (3) the generated secret code CS to be transmitted to the optimal access point AP in the short-range wireless network (in stage E5). The connection request message MDC is in the form of a packet IP (Internal Protocol) which propagates via the Internet RP to the distribution network RD of the short-range wireless network RFP. The secret code CS retrieved from the MDC message is stored in association with the ADTM address in the station at the optimal access point AP.

[0041] In response to the ADAP address of the optimal access point AP retrieved from the confirming message MC received by the mobile terminal TM, terminal TM attempts to connect itself to the thusly identified optimal access point AP by asking the optimal access point to authenticate itself. In stage E6, the mobile terminal TM transmits to optimal access point AP (1) a first frame T1 containing the ADTM terminal address, (2) the ADAP address of the optimal access point, (3) an indicator of connection request and (4) an indicator that the access point is to generate a session key DC.

[0042] The optimal access point in the periodic search mode recognizes that the frame T1 is meant for it. The mobile terminal and the access point then each generate a common session key KS by coupling through the short-range network RFP, to the session key algorithm AS, (1) the mobile terminal address ADTM, (2) the access point address ADAP, (3) the secret code CS and (4) one or more mutually exchanged random numbers RAND. The secret code CS used by the mobile terminal is the one retrieved from the confirmation message MC, whereas the secret code CS used by the access point AP is the secret code that is retrieved from the connection request message MDC. The mobile terminal TM and the optimal access point AP are paired in this manner. The session key KS is stored in the terminal and the access point key KS, and is no longer used when the access point AP and the mobile terminal TM are disconnected. Thus, the session key KS is used for authentication and encrypting data only during a transmission session between terminal TM and access point AP.

[0043] Next, in response to the first frame T1, authentication of the mobile terminal TM is triggered by the station at optimal access point AP transmitting to the mobile terminal TM, in stage E7, a frame T2. Frame T2 includes the optimal access point address ADAP, the address ADTM of the mobile terminal TM, a random number RAP generated by the pseudo-random generator at the access point and a reply request indicator DRP.

[0044] Next the procedure passes through stages E8, E9 and E10 relating to an actual authentication of the mobile terminal TM by the optimal access point AP. In stage E8, upon receiving the frame T2 with the reply request indicator, the mobile terminal TM couples to the authentication algorithm AA the random number RAP retrieved from the frame T2, the session key KS generated in stage E6 and its address ADTM and a reply RP1. In stage E8, the optimal access point AP executes a similar application: RP1=M (RAP, KS, ADTM): however in this instance the session key now is the key that was generated in stage E6 and is associated with the address ADTM. Then, in stage E9, the mobile terminal transmits a frame T3 which includes, (1) the addresses ADTM and ADAP and (2) the reply RP1=AA (RAP, KS, ADTM) that was generated by the mobile terminal. The frame T3 is recognized by the optimal access point AP which, in stage E10, compares (1) the reply RP1 that point AP generated in stage E8 with (2) the reply RPI that point AP retrieved from the received frame T3. If point AP detects that the compared replies are identical, the optimal access point AP authorizes, in stage E16, opening a session through it from the mobile terminal TM toward the distribution network RD and the Internet RP.

[0045] This open session key KS is used to generate the session key of an ensuing session between the mobile terminal TM and the access point AP when the session key KS was not erased in the meantime at the end of a time interval which begins with storing the key KS, as predetermined by the operator managing the station at access point AP.

[0046] In a more complete embodiment of mutual authentication, when the access point AP has authenticated the mobile terminal TM (in stage E10), the optimal access point AP transmits (in stage E11) a frame T4 containing the ADAP and ADTM addresses and an indicator IA that prompts the terminal TM to authenticate frame T4.

[0047] In reply to the preceding frame T4, the mobile terminal TM triggers the authentication of the optimal access point by transmitting a frame T5 (stage E12) to the optimal access point address ADAP. The frame T5 includes a random number RTM generated by the pseudo-random generator at the mobile terminal, and a request reply indicator DRP. In stage E13, the access point AP responds to frame T5 by applying, to authentication algorithm AA, the random number RTM retrieved from the frame T5, the session key KS determined in stage E6 and its address ADAP. The authentication algorithm AA then produces a second reply RP2. Also, in stage E13, the mobile terminal TM executes an operation: RP2=AA (RTM, KS, ADAP). In operation RP2 of stage E13, the session key KS is the session key that was generated in stage E6 and which is associated with the ADAP address. Next, during step 14, the optimal access point AP transmits a frame T6 which includes (1) the ADAP and ADTM addresses, and (2) the reply RP2=AA (RTM, KS, ADAP) that was generated at the optimal access point AP during operation 13. The frame T6 is recognized by the mobile terminal TM which, in stage E15, compares the reply RP2 that was generated in the mobile terminal with the reply RP2 that the mobile terminal retrieved from received frame T6. If the compared replies are favorable, e.g., identical, the terminal TM, by transmitting another frame, confirms the opening of the session requested by the optimal access point in stage E16.

[0048] In a further embodiment, the session key KS is not determined separately by the mobile terminal TM and the optimal access point AP in stage E6 but is determined beforehand by controller PFG in stage E3. In the above described manner, the controller PFG randomly generates a session key KS having the same number of bits as the session keys generated by mobile terminal TM and access point AP.

[0049] However, to assure coherence, the controller PFG can contain the session key algorithm AS. At the end of stage E3, the controller PFG has selected the optimal access point and has associated the ADAP address of the optimal access point with the address ADTM of the mobile terminal supplying the address that was retrieved from the request RQ. In this embodiment, controller PFG generates the session key by supplying the ADAP and ADTM addresses, the secret code CS and one or more random numbers RAND, to the AS algorithm, in accordance with:
KS=AS(ADAP, ADTM, CS, RAND).

[0050] In stages E4 and E5, controller PFG inserts the determined session key KS instead of the secret code CS into the confirming message MC transmitted to the mobile terminal TM and into the connection request message MDC transmitted to the optimal access point AP, to enable the optimal access point and the mobile terminal to use the session key KS for authentication in steps E6 through E10 or steps E6 through E15 and, once the session is open, in stage E16. In this situation, session key KS is not generated in stage E6.

[0051] As indicated in stage E17, if authentication of the mobile terminal TM by optimal access point AP fails, that is if the replies RP1 compared in stage E10 differ or if mutual authentication failed, that is, if the replies RP2 compared in stage E15 differ, then a tentative session opening request is repeated by executing the stages E6 through E10 for terminal authentication by the optimal access point AP or by executing E6 through E15 for mutual authentication.

[0052] In practice, the stages concerning requests for connection, generating replies and comparing responses, i.e., stages E6 through E10 or stages E6 through E15 can be repeated a maximum of N times as long as the compared replies RP1 or RP2 differ, where N is a predetermined number of iterations, for instance 3.

[0053] If, after N-iterated connection requests of stage E17 have been performed and there has been a failure to authenticate, that is, if the compared replies still differ, the procedure automatically returns to stage E2 and stages E3 through E17 are repeated by substituting the ADAP address of another access point selected according to predetermined criteria; an example of such criteria is selecting the ADAP address from the list which is included in the request RQ, as indicated in intermediate stage E18. Obviously the selection of another access point is from this list of the last optimal access point that was previously selected and with respect to which N attempted connections did fail. The other selected optimal access point is situated in the zone where the mobile terminal TM is located regarding the short-range network RFP. It may be that the selected access point is the access point which exhibits the largest received power level or the least traffic load in the remaining list, or that which is subsequent in the list to the last selected optimal access point.

[0054] Even though the preferred embodiment of the present invention was discussed above with respect to a cellular network of the GSM type and a short-range wireless network of the Bluetooth type, the invention applies equally to a radio communication network of the UMTS type or more generally to the third generation type and to other short-range wireless networks, such as in the IEEE 802.11B standard and other standards subsequent to the above one, that is to so-called Wi-Fi (Wireless Fidelity) networks. While there have been described and illustrated specific embodiments of the invention, it will be clear that variations in the details of the embodiments specifically illustrated and described may be made without departing from the true spirit and scope of the invention as defined in the appended claims.