Abstract:
In the method and the arrangement for checking the authenticity of a first communication subscriber in a communications network, a first information item is formed in the first communication subscriber using a fault detection data item of the first communication subscriber and an information item relating to a random data item. In a second communication subscriber in the communications network, a second fault information item is formed using a fault detection data item of the second communication subscriber and the information relating to the random data item. The authenticity of the first communication subscriber is checked using the first fault information and the second fault information.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]    This application is based on and hereby claims priority to German Application No. 19927 271.9 filed on Jun. 15, 1999 in Germany, and PCT Application No. PCT/DE00/01788 filed on May 31, 2000, the contents of which are hereby incorporated by reference. 
     
    
     
       BACKGROUND OF THE INVENTION  
         [0002]    The invention relates to a method and an arrangement for checking the authenticity of a first communication subscriber in a communications network.  
           [0003]    In a communications network, data is generally transmitted between communication subscribers, for example a service provider and a service user. In order to protect a communications network against penetration of an unauthorized communication subscriber into the communications network, the authenticity of each communication subscriber is generally checked.  
           [0004]    3G TS 33.102 Version 3.0.0 Draft Standard, 3 rd  Generation Partnership Project, Technical Specification Group Services and System Aspects, 3G Security, Security Architecture, 05/1999 (“the 3G reference”) discloses a method and an arrangement for checking the authenticity of a communication subscriber, in particular of a service provider or of a service user in a communications network.  
           [0005]    The method known from the 3G reference and the corresponding arrangement are based on what is referred to as 3G TS 33.102 Version 3.0.0 Draft Standard, which describes a security architecture of a mobile phone system.  
           [0006]    In FIG. 4, the procedure during the checking of the authenticity of a communication subcriber, such as is known from the 3G reference is illustrated symbolically and parts thereof will be explained below briefly.  
           [0007]    A transmission of data is illustrated in FIG. 4 by an arrow in each case. A direction of an arrow characterizes a transmission direction during a data transmission.  
           [0008]    [0008]FIG. 4 shows a mobile phone system  400 , comprising a user  401  of a communication service, for example a mobile phone, and a provider  402  of a communication service. The provider  402  comprises a dial-in network  403  with a dial-in network operator from which the user  401  locally requests a communication service, and a home network  404  with a home network operator with which the user  401  is signed on and registered.  
           [0009]    In addition, the user  401 , the dial-in network  403  and the home network  404  each have a central processing unit with a memory, for example a server (central computing unit), with which processing unit the procedure described below is monitored and controlled and on which memory data is stored.  
           [0010]    The dial-in network  403  and the home network  404  are connected to one another via a data line over which digital data can be transmitted. The user  401  and the dial-in network  403  are connected to one another via any desired transmission medium for the transmission of digital data.  
           [0011]    During a communication, the user  401  dials  410  into the dial-in network  403 . At the start of the communication, checking of both the authenticity of the user  401  and the authenticity of the provider  402  is carried out.  
           [0012]    To do this, the dial-in network  403  requests  411  what is referred to as authentication data from the home network  404 , with which data the authenticity of the user  401  and of the provider  402  can be checked.  
           [0013]    The authentication data which is obtained from the home network  404  comprises a random number and a sequential number of the provider  402 . The sequential number of the provider  402  is obtained in such a way that a counter of the provider  402  increases the sequential number of the provider  402  by the value 1 at each attempt at communication between the user  401  and the provider  402 .  
           [0014]    It is to be noted that the random number and the sequential number of the provider  402  only constitute part of the authentication data and are not to be understood as comprehensive. Further authentication data is known from the 3G reference.  
           [0015]    The home network  404  transmits  412  the requested authentication data to the dial-in network  403 . The dial-in network  403  processes the received authentication data in a suitable way  413 , and transmits the processed authentication data to the user  401 .  
           [0016]    The user  401  checks  415  the authenticity of the provider  402  using a dedicated sequential number, which is handled in a way corresponding to the sequential number of the provider  402 , and using the sequential number of the provider  402 .  
           [0017]    The procedure during the checking of the authenticity of the provider  402  is described in the 3G reference.  
           [0018]    A result of the checking of the authenticity of provider  402 , “authenticity of provider satisfactory”  416 , “authenticity of provider satisfactory but sequential fault has occurred”  417  or “authenticity of provider not satisfactory”  418 , is transmitted  419  from the user  401  to the provider  402 .  
           [0019]    In the case of the result “authenticity of provider satisfactory”  416 , the dial-in network  403  checks  420  the authenticity of the user  401  as described in the 3G reference.  
           [0020]    In the case of the result “authenticity of provider not satisfactory”  418 , the communication is interrupted and/or restarted  421 .  
           [0021]    In the case of the result “authenticity of provider satisfactory but a sequential fault has occurred”  417 , resynchronization takes place in such a way that the home network  404  transmits  422  a resynchronization request to the user  401 . The user responds with a resynchronization response in which resynchronization data is transmitted  423  to the home network  404 . The sequential number of the provider  402  is changed  424  as a function of the resynchronization response. The authenticity of the user  401  is then checked, as is known from the 3G reference.  
           [0022]    The procedure described has the disadvantage that during checking of the authenticity of a communication subscriber, in particular during the checking of the authenticity of a service provider, a large amount of data has to be transmitted between the communication subscribers.  
         SUMMARY OF THE INVENTION  
         [0023]    One aspect of the invention is thus based on simplifying and improving the known method and the known arrangement, to yield a simplified and improved arrangement for checking the authenticity of a communication subscriber in a communications network.  
           [0024]    In the method for checking the authenticity of a first communication subscriber in a communications network, a first fault information item is formed in the first communication subscriber using a fault detection data item of the first communication subscriber and an information item relating to a random data item. In a second communication subscriber in the communications network, a second fault information item is formed using a fault detection data item of the first communication subscriber and the information relating to the random data item.  
           [0025]    The authenticity of the first communication subscriber is checked using the first fault information item and the second fault information item.  
           [0026]    In the arrangement for checking the authenticity of a first communication subscriber in a communications network, the first communication subscriber is set up in such a way that a first fault information item can be formed using a fault detection data item of the first communication subscriber and an information item relating to a random data item. In addition, the arrangement has a second communication subscriber in the communications network which is set up in such a way that a second fault information item can be formed using a fault detection data item of the second communication subscriber and the information relating to the random data item. The authenticity of the first communication subscriber can be checked using the first fault information item and the second fault information item.  
           [0027]    The checking of the authenticity of a communication subscriber in a communications network is to be understood as meaning method steps which are carried out in the wider sense with checking of the authorization of a communication subscriber for access to a communications network or participation in communication in a communications network.  
           [0028]    This thus encompasses both method steps which are carried out within the scope of the checking of the authorization of a communication subscriber for access to a communications network and such method steps which are carried out within the scope of the processing or the administration of data which is used in the checking.  
           [0029]    The developments described below relate to the method and to the arrangement.  
           [0030]    The development described below can be implemented either using software or hardware, for example using a specific electrical circuit.  
           [0031]    In one refinement, the first communication subscriber is a service provider and/or the second communication subscriber is a service user in the communications network.  
           [0032]    A sequential number is preferably used as the fault detection data item.  
           [0033]    In one refinement, the information relating to the random data item is a random number.  
           [0034]    In one development, the checking of the authenticity is simplified by determining a difference between the fault detection data item of the first communication subscriber and the fault detection data item of the second communication subscriber.  
           [0035]    In one refinement, the checking of the authenticity is further improved with respect to the security of the communications network by limiting the difference.  
           [0036]    One development is preferably used within the scope of a mobile phone system. In the mobile phone system, the service user is implemented as a mobile phone and/or the service provider is implemented as a mobile phone network operator. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0037]    These and other objects and advantages of the present invention will become more apparent and more readily appreciated from the following description of the preferred embodiments, taken in conjunction with the accompanying drawings of which:  
         [0038]    [0038]FIG. 1 shows a mobile phone system;  
         [0039]    [0039]FIG. 2 shows an outline in which checking of the authenticity of a communication subscriber is illustrated symbolically;  
         [0040]    [0040]FIG. 3 shows a flowchart in which individual method steps are illustrated during checking of the authenticity of a service provider in a communications network; and  
         [0041]    [0041]FIG. 4 shows an outline in which checking of the authenticity of a communication subscriber in accordance with the 3G TS 33.102 Version 3.0.0 Standard is illustrated symbolically. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0042]    Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to like elements throughout.  
         [0043]    Exemplary Embodiment: Mobile Phone System  
         [0044]    A mobile phone system  100  is illustrated in FIG. 1. The mobile phone system  100  comprises a mobile phone  101 , a local dial-in network  102  with a dial-in network operator  103  and a home network  104  with a home network operator  105 .  
         [0045]    The mobile phone  101  is signed on and registered in the home network  104 .  
         [0046]    In addition, the mobile phone  101 , the dial-in network  102  and the home network  104  each have a central processing unit  106 ,  107 ,  108  with a memory  109 ,  110 ,  111 , with which processing units  106 ,  107 ,  108  the procedure described below is monitored and controlled, and on which memories  109 ,  110 ,  111  data is stored.  
         [0047]    The dial-in network  102  and the home network  104  are connected to one another via a data line  112  via which digital data can be transmitted. The mobile phone  101  and the dial-in network  102  are connected to one another via any desired transmission medium  113  for transmitting digital data.  
         [0048]    The procedure during the checking of the authenticity of the mobile phone  101  and the procedure during the checking of the authenticity of the home network  104  and/or of the home network operator  105  are illustrated symbolically in FIG. 2, and parts thereof will be explained below briefly.  
         [0049]    The transmission of data in FIG. 2 is illustrated in each case by an arrow. A direction of an arrow characterizes a transmission direction during a data transmission.  
         [0050]    The procedure which is described below and illustrated symbolically in FIG. 2 is based on what is referred to as a 3G TS 33.102 Version 3.0.0 Standard, which describes a security architecture of a mobile phone system and is described in the 3G reference.  
         [0051]    During a communication, the mobile phone  201  dials  210  into the dial-in network  203 . At the start of the communication, checking both of the authenticity of the mobile phone  201  and of the authenticity of the home network  204  and/or of the home network operator takes place.  
         [0052]    To do this, the dial-in network  203  requests  211  authentication data from the home network  204 , with which authentication data the authenticity of the user  201  and of the home network  204  and/or of the home network operator can be checked.  
         [0053]    The authentication data which is determined by the home network  204  comprises a random number and a sequential number of the home network  204  (cf. FIG. 3 step  310 ). The sequential number of the home network  204  is determined in such a way that a counter of the home network  204  increases the sequential number of the home network  204  by the value 1 at each attempt at communication between the mobile phone  201  and the home network  204 .  
         [0054]    It is to be noted that the random number and the sequential number of the home network  204  only constitute part of the authentication data and are not to be understood as comprehensive. Further authentication data is specified in the 3G reference.  
         [0055]    The home network  204  transmits  212  the requested authentication data to the dial-in network  203 . The dial-in network  203  processes the received authentication data in a suitable way  213  and transmits the processed authentication data to the mobile phone  201 .  
         [0056]    The mobile phone  201  checks  215  the authenticity of the home network  204  using a dedicated sequential number which is handled in a way corresponding to the sequential number of the home network  204 , and using the sequential number of the home network  204 . In a way corresponding to the home network  204 , the mobile phone  201  also has a counter.  
         [0057]    The procedure during the checking of the authenticity of the home network  204  is described in the 3G reference. Method steps which differ therefrom are described below.  
         [0058]    What is referred to as overflow checking of the counter of the mobile phone  201  is carried out within the scope of the checking of the authenticity of the home network  203 . This overflow checking prevents overflowing of an acceptable numerical range of the counter of the mobile phone  201 .  
         [0059]    In the overflow checking, the following conditions are tested:  
         [0060]    1) sequential number of the home network  204 &gt;sequential number of the mobile phone  201 ;  
         [0061]    2) sequential number of the home network  204 −sequential number of the mobile phone  201 &lt;−predefinable deviation (1,000,000);  
         [0062]    the following applying for the predefined deviation:  
         [0063]    predefinable deviation is sufficiently large in order to ensure, during normal or fault-free communications operation:  
         [0064]    that the sequential number of the home network  204 −sequential number of the mobile phone  201  is not &gt;predefinable deviation;  
         [0065]    the maximum permissable sequential number of the mobile phone  201 /predefinable deviation is sufficiently large in order to ensure that the maximum permissible sequential number of the mobile phone  201  is not reached during operation.  
         [0066]    The result of the checking of the authenticity of the home network  204 , “authenticity satisfactory”  216 , “authenticity satisfactory but a sequential fault has occurred”  217  or “authenticity not satisfactory”  218  is transmitted  219  to the home network  204  from the mobile phone  201 .  
         [0067]    In the case of the result “authenticity satisfactory”  216 , the dial-in network  203  checks  220  the authenticity of the mobile phone  201 , as described in 3G reference.  
         [0068]    In the case of the result “authenticity not satisfactory”  218 , the communication is interrupted or restarted  221 .  
         [0069]    In the case of the result “authenticity satisfactory but a sequential fault has occurred”  217 , resynchronization  222  takes place. Resynchronization is to be understood as a change of the sequential number of the home network  204 .  
         [0070]    For this purpose, the mobile phone  201  transmits  222  resynchronization data to the dial-in network  203 .  
         [0071]    The resynchronization data comprises the same random number which was transmitted within the scope of the authentication data, and the sequential number of the mobile phone  201  (cf. FIG. 3 step  320 ).  
         [0072]    The dial-in network  203  processes the resynchronization data in a suitable way and transmits the processed resynchronization data to the home network  204 .  
         [0073]    The home network  204  checks the sequential number of the mobile phone  201  and the sequential number of the home network  204  using the processed resynchronization data, and if appropriate changes  223  the sequential number of the home network  204  (cf. FIG. 3 step  330 ).  
         [0074]    The home network  204  subsequently transmits new authentication data, which if appropriate comprises the changed sequential number of the home network  204 , to the dial-in network  203 .  
         [0075]    In order to illustrate the described procedure, important steps  300  of the procedure are illustrated in FIG. 3.  
         [0076]    [0076]FIG. 3 shows a first step  310  within the scope of which the authentication data (first fault information) is determined.  
         [0077]    The resynchronization data (second fault information) is determined within the scope of a second step  320 .  
         [0078]    The sequential number of the mobile phone and the sequential number of the home network are checked within the scope of a third step  330 , using the resynchronization data.  
         [0079]    An alternative of the first exemplary embodiment is described below.  
         [0080]    In the alternative exemplary embodiment, a method is implemented in which the home network is made more reliable with respect to a data loss in the event of a system crash.  
         [0081]    For this purpose, the current sequential number of the home network is stored in the memory of the home network, in each case at a predefinable time interval. A sequential number of the home network which has been lost during a system crash of the home network is restored in such a way that a predefinable additional value is added to the value of the stored sequential number. The predefinable additional value is dimensioned in such a way that exceeding of the sum of the sequential number of the mobile phone and the predefinable deviation is not exceeded.  
         [0082]    In the alternative exemplary embodiment, the predefinable additional value is determined in such a way that an average number of authentication attempts on one day by the home network, which number is determined during operation of the communications network, is multiplied by a factor with the value 10.  
         [0083]    The invention has been described in detail with particular reference to preferred embodiments thereof and examples, but it will be understood that variations and modifications can be effected within the spirit and scope of the invention.