1 / 9

Use of GSM SIM Authentication in IEEE802.11 System

Use of GSM SIM Authentication in IEEE802.11 System. Submitted to IEEE802.11 TGe January 2001 H. Haverinen, J.P. Edney, Nokia. Use of GSM SIM Authentication in IEEE 802.11 System - Submission to Task Group ‘e’.

corbin
Télécharger la présentation

Use of GSM SIM Authentication in IEEE802.11 System

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Use of GSM SIM Authentication in IEEE802.11 System Submitted to IEEE802.11 TGe January 2001 H. Haverinen, J.P. Edney, Nokia Haverinen/Edney, Nokia

  2. Use of GSM SIM Authentication in IEEE 802.11 System - Submission to Task Group ‘e’ • Focus of 802.11 has been mostly private ownership of WLAN networks (e.g. Corporate or home use) • New business opportunities can be created by enabling secure public access systems with deployment by nationwide operators. • Existing cellular phone systems form the legacy for public access authentication and security solutions • authorization infrastructure for cellular telecommunications (e.g., GSM, 3G) is standardized and widely deployed • Today, there is no simple way for IEEE 802.11 to leverage this infrastructure in public access applications • This submission proposes how to fit cellular authentication within TGe baseline • Note: the current baseline already is very well in line with this target Haverinen/Edney, Nokia

  3. GSM SIM Card Authentication(as used in mobile phone) Network Mobile Terminal Identity SIM Random Challenge SSK A3 A3 Response SSK A8 A8 Session Key Generated Internally A5 A5 Encrypted Data Ax = Encryption / Digest Algorithm SSK = SIM Secret Key (changes for each SIM) Haverinen/Edney, Nokia

  4. Note A3 / A8 algorithms are implemented inside the SIM card and vary between operators A3 / A8 algorithm implementation method highly “secret” A5 is open method supported by all phones When roaming, challenge response validation done by home network. GSM SIM Card AuthenticationComments Mobile Network Identity SIM Random Challenge A3 A3 Response A8 A8 A5 A5 Haverinen/Edney, Nokia

  5. IP Network GSMSIM used in WLAN(Nokia Approach) Authentication Gateway Access Zone Router AccessPoint GSM Authentication Exchange EXISTING GSM Authentication / Billing User Terminal Haverinen/Edney, Nokia

  6. Integration to TGe Baseline • GSM SIM authentication can be transmitted as an EAP authentication type (EAP/GSMSIM) • EAP Request/Response : Identity • EAP Request/Response : GSMSIM/Start • EAP Request/Response : GSMSIM/Challenge • EAP Success / Fail • EAP/GSMSIM supports mutual authentication • Client sends a nonce to network • Network accompanies challenge with an authenticator • EAP/GSMSIM will be published as an Internet-Draft Haverinen/Edney, Nokia

  7. Key-Generating EAP types • As part of the authentication procedure, EAP/GSMSIM securely distributes a session key to the client • EAP/GSMSIM is equivalent to EAP/TLS (RFC 2716) • Use several GSM challenges to generate long keys • Baseline should allow negotiation of key-generating EAP as an alternative to the default mechanism (EAP/GSS-API/IAKERB) • The EAP authentication type makes no difference to the access point, as long as a key is generated • Key distribution between access points needs to be agreed upon Haverinen/Edney, Nokia

  8. NOKIA Associate Probe Request/Response EAP Identity Request EAP Identity Response EAP Identity Response EAP-GSMSIM Response EAP-GSMSIM Request EAP-GSMSIM Request EAP-GSMSIM Request EAP-Success + Session Key EAP-Success Initial Contact Example AP RADIUSServer STA Negotiate EAP/GSMSIM This applies to any key- generatingEAP Repeat ……. ……. 802.1X, 802.11 is Unblocked Haverinen/Edney, Nokia

  9. Summary • Baseline should include any EAP authentication type that generates a key • EAP/TLS, EAP/GSMSIM and others • Need to determine a method to negotiate key-generating EAP type • Need to agree on a key distribution mechanism Haverinen/Edney, Nokia

More Related