Abstract:
A communication device comprising a central processing unit (CPU) and a memory device is disclosed. The CPU is configured to send a first attach request including a first subscription identity (FSI) to the network apparatus, receive an authentication request including a random number and an authentication token from the network apparatus as a response to the first attach request. Further, the CPU is configured to authenticate the authentication token using the random number and a first key associated with the FSI, obtain a second key and a second subscription identity (SSI) in response to authentication of the authentication token failing, where SSI is obtained from the authentication request. The CPU is further configured to send an authentication failure to the network apparatus. The second key and SSI are stored in the memory device such that the second key is associated with SSI.

Description:
TECHNICAL FIELD 
     The present invention generally relates to an authentication server and a communication device. 
     BACKGROUND 
     In the field of the remote subscription management such as MCIM (Machine Communication Identity Module) defined in 3GPP TR 33.812, a registration operator (RO) provides 3GPP connectivity for communication devices to request downloading and provisioning of MCIM credentials from provisioning servers. Each communication device is pre-allocated (pre-installed) a unique subscription identity such as IMSI (International Mobile Subscriber Identity) and a Corresponding credential such as a secret key (hereinafter also referred to as “key” or “K”) and uses the subscription identity and key to attach to the RO. To pre-allocate a unique pair of IMSI/K to each communication device for initial connectivity has the following drawbacks. First, it takes cost that the RO delivers unique pairs of IMSI/K to device manufactures and the device manufactures configure the unique pairs of IMSI/K to their communication devices. Second, some of the pre-allocated IMSI may not be used when the communication device supports radio access technology other than 3GPP network access technology. This leads to waste IMSI numbering space. 
     A solution to overcome the above drawbacks is to pre-allocate the single same pair of IMSI/K to a plurality of communication devices. However, this solution also has drawbacks. Because the RO cannot handle a plurality of attachment requests with the same IMSI at the same time, it is required to carefully manage when and which communication devices can use the common IMSI to attach to the RO for the MCIM provisioning. This is, however, obviously cumbersome and costly because careful scheduling is needed and careful modification of the schedule needs to be performed when another communication device is added with the common IMSI. 
     SUMMARY 
     The present invention is intended to address the above-described problem, and it is a feature thereof to introduce a technology for allocating a unique subscription identity to a communication device having a common subscription identity. 
     According to an aspect of the present invention, there is provided an authentication server. The server includes a receiving unit configured to receive an authentication data request from a network apparatus. The authentication data request includes a subscription identity. The server further includes a determination unit configured to determine whether the received subscription identity is a predetermined subscription identity and an obtaining unit configured to obtain, when it is determined that the received subscription identity is the predetermined subscription identity, a key and a subscription identity other than the received subscription identity. The key is derived by applying a key derivation function to a random number and a key associated with the predetermined subscription identity. The server further includes a storage unit configured to store the obtained key and the obtained subscription identity such that the obtained key is associated with the obtained subscription identity and a response unit configured to send an authentication data response including the random number and an authentication token to the network apparatus. The authentication token includes the obtained subscription identity. 
     According to another aspect of the present invention, there is provided a communication device. The device includes a sending unit configured to send an attach request to a network apparatus. The attach request includes a subscription identity. The device further includes a receiving unit configured to receive an authentication request from the network apparatus as a response of the attach request. The authentication request includes a random number and an authentication token. The device further includes an obtaining unit configured to obtain a key and a subscription identity. The subscription identity is obtained from the received authentication request and the key is derived by applying a key derivation function to the received random number and a key associated with the sent subscription identity. The device further includes a storage unit configured to store the obtained key and the obtained subscription identity such that the obtained key is associated with the obtained subscription identity and a response unit configured to send an authentication failure to the network apparatus. 
     Further features of the present invention will become apparent from the following description of exemplary embodiments with reference to the attached drawings, in which like reference characters designate the same or similar parts throughout the figures thereof. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  illustrates an exemplary overall system  100  according to some embodiments of the present invention. 
         FIG. 2  illustrates an exemplary block diagram of the authentication server according to some embodiments of the present invention. 
         FIG. 3  illustrate an exemplary block diagram of the communication device according to some embodiments of the present invention. 
         FIG. 4  illustrates exemplary operations of the system in  FIG. 1  according to some embodiments of the present invention 
     
    
    
     DETAILED DESCRIPTION 
     Embodiments of the present invention will now be described with reference to the attached drawings. Each embodiment described below will be helpful in understanding a variety of concepts from the generic to the more specific. It should be noted that the technical scope of the present invention is defined by claims, and is not limited by each embodiment described below. In addition, not all combinations of the features described in the embodiments are always indispensable for the present invention. 
       FIG. 1  illustrates an exemplary overall system  100  according to some embodiments of the present invention. The system  100  may include a communication device  110  and networks  120  and  130 . The system  100  may include more than one communication device and the communication device  110  represents any one of the communication devices included in the system  100 . The following description uses an IMSI and secret key as a subscription identity and credential. However, the present invention can apply to any type of subscription identities and credentials which are used in attachment procedures. 
     The network  120  is a network managed by a visited network operator (VNO) and includes a network apparatus  121 . The network  120  may be also referred to as a VNO network  120 . The network apparatus  121  provides temporary 3GPP network access to the communication device  110 . The network apparatus  121  may provide full or restricted connectivity during initial access. The network apparatus  121  may be implemented in a Visitor Location Register (VLR) or a Serving GPRS Support Node (SGSN) of the VNO network  120 . 
     The network,  130  is a network managed by a registration operator (RO) and includes an authentication server  131 . The network  130  may be also referred to as an RO network  130 . The authentication server  131  provides initial connectivity to the communication device  110  and provides registration and Provisioning functions for the communication device  110 . The authentication sever  131  may be implemented in a. Home Location Register (HLR) of the RO network  130 . 
     The communication device  110  is a device which can attach to the RO network  130  by use of a pair of IMSI/K. Examples of the communication device  110  include a mobile phone, a personal computer, a navigation device in a vehicle, a security camera, and so on. 
     The system  100  may include a network (not shown) managed by a selected home operator (SHO) which is a network operator with capability of providing network connectivity to the communication device  110 , as described in 3GFP TR 33.812. 
       FIG. 2  illustrates an exemplary block diagram of the authentication server  131 . The authentication server  131  may comprise a CPU  201 , a memory  202 , a receiving unit  203 , a determination unit  204 , an obtaining unit  205 , a response unit  206 , a random number generator  207 , and a storage device  208 . 
     The CPU  201  controls overall operations of the authentication server  131 . The memory  202  stores computer programs and data used in operations of the authentication server  131 . The random number generator  207  generates random numbers. The storage device  208  is typically implemented by a nonvolatile storage device such as a hard disk drive and stores a special IMSI list  209  and a mapping table  210 . Functions of the receiving unit  203 , the determination unit  204 , the obtaining unit  205 , and the response unit  206  will be described in detail later with reference to  FIG. 4 . These functions may be implemented in form of computer programs to be executed by the CPU  201 . 
     The special IMSI list  209  stores special IMSIs. As used herein, the special IMSI means an IMSI which is shared among a plurality of communication devices. On the other hand, as used herein, a normal IMSI means an IMSI which is uniquely allocated to a communication device and used in authentication procedure (that is, AKA procedure) or attachment procedure between a communication device and the authentication server  131 . The authentication server  131  regards an IMSI included in the special IMSI list  209  as a special IMSI and an IMSI not included in the special IMSI list  209  as a normal IMSI. The RO may add to the special IMSI list  209  an IMSI which was provided to, for example, device manufactures so as to be shared among communication devices of the manufactures. The mapping table  210  stores pairs of IMSI and key. In the mapping table  210 , each IMSI is associated with a corresponding key. The mapping table  210  includes entries for special IMSIs and normal IMSIs. 
       FIG. 3  illustrates an exemplary block diagram of the communication device  110 . The communication device  110  may comprise a CPU  301 , a memory  302 , a use interface  303 , a network interface  304 , a sending unit  305 , a receiving unit  306 , an obtaining unit  307 , a response unit  308 , a trusted environment (TRE)  309 , and an authentication unit  310 . 
     The CPU  301  controls overall operations of the communication device  110 . The memory  302  stores computer programs and data used in operations of the communication device  110 . The user interface  303  provides an interface with a human such as the user of the communication device  110  and includes a display, a keypad, a speaker, and the like, for example. The network interface  304  provides an interface with other devices such as the network apparatus  121 , the authentication server  131 , and the likes. Functions of the sending unit  305 , the receiving unit  306 , the obtaining unit  307 , the response unit  308 , and an authentication unit  310  will be described in detail later with reference to  FIG. 4 . These functions may be implemented in form of computer programs to be executed by the CPU  301 . 
     The TRE  309  provides some hardware and software protection and separation for the provisioning, storage, execution, and management of subscription modules. The TRE  309  may have a pre-installed subscription module. In some embodiments of the present invention, the TRE  309  stores a special IMSI (hereinafter referred to as “IMSI 0 ”) and a corresponding key (hereinafter referred to as “K 0 ”). IMSI 0  and K 0  may be pre-installed during the manufacture of the communication device  110 . Alternatively, IMSI 0  and K 0  may be included in a memory card which a user of the communication device  110  inserts to the communication device  110 . Generally speaking, IMSI 0  and K 0  may be stored in the communication device  110  in a secure way. 
       FIG. 4  illustrates exemplary operations of the system  100  according to some embodiments of the present invention. The CPUs included in the communication device  110 , a network apparatus  121 , and the authentication server  131  may execute computer programs stored in their memories to process these operations. It is assumed that both of the Communication device  110  and the authentication server  131  stores a special IMSI (IMSI 0 ) and a corresponding key (K 0 ) before the following operations are performed. 
     In step S 1 , the sending unit  305  of the communication device  110  sends an attach request to the network apparatus  121  in order to obtain a normal IMSI (that is, a unique IMSI). The attach request to be sent includes IMSI 0 . The network apparatus  121  receives this attach request. Although this attach request includes a special IMSI, this attach request can take the same format as an attach request used in a normal attachment procedure so that the network apparatus  121  can handle this attach request in the same way as the normal attachment procedure. As used herein, the normal attachment procedure means an attachment procedure using a normal IMSI, such as defined in 3GPP TS 33.102 for example. 
     In step S 2 , the network apparatus  121  sends an authentication data request to the authentication server  131  in order to obtain a random number (hereinafter referred to as “RAND”) and an authentication token (hereinafter referred to as “AUTN”). The authentication data request to be sent includes IMSI 0  extracted from the received attach request. The receiving unit  203  of the authentication server  131  receives this authentication data request. This authentication data request can take the same format as an authentication data request used in the normal attachment procedure. 
     In step S 3 , the determination unit  204  of the authentication server  131  determines whether an IMSI extracted from the received authentication data request (that is, IMSI 0 ) is a special IMSI or a normal IMSI, for example by determining whether the extracted IMSI is included in the special IMSI list  209 . When it is determined that the extracted IMSI is a normal IMSI, the authentication server  131  performs the normal attachment procedure. Details for the normal attachment procedure are omitted because it is well known to those skilled in the art. 
     When it is determined that the extracted IMSI is a special IMSI, the procedure goes to step S 4 . In step S 4 , the obtaining unit  205  of the authentication server  131  obtains a new normal (unique) IMSI (hereinafter referred to as “IMSI 1 ”) and a new corresponding key (hereinafter referred to as “K 1 ”). The obtaining unit  205  may obtain IMSI 1  by generating a new unique IMSI or by requesting another server to generate a new unique IMSI. The obtaining unit  205  may obtain K 1  by applying a key derivation function (KDF) to a RAND and the key (that is, K0) associated with IMSI 0 . That is K 1  is derived from the equation K 1 =KDF(K 0 , RAND). Any type of standard key derivation functions may be used of the KDF in step S 4 . The obtaining unit  205  may obtain the RAND using the random number generator  207 . The obtaining unit  205  may obtain the key associated with IMSI 0  by referring to the mapping table  210 . 
     In step S 5 , the obtaining unit  205  stores the obtained IMSI 1  and K 1  in the mapping table  210  such that K 1  is associated with the IMSI 1  for future use. 
     In step S 6 , the response unit  308  of the authentication server  131  sends an authentication data response to the network apparatus  121  in order to respond to the authentication data request received in step S 2 . The authentication data response to be sent includes the RAND obtained in step S 4  and an AUTN including the IMSI obtained in step S 4  (that is, IMSI 1 ). The network apparatus  121  receives this authentication data response. An example of AUTN encoding, an IMSI consists of 15 digits, which are smaller than 60 bits, and an AUTN is 128 bits. Therefore, an AUTN can carry all bits of an IMSI. The AUTN may include the IMSI in the first 60 bits and the remaining bits of the AUTN may be filled with 1 for example. The AUTN may include IMSI 1  in the last 60 bits instead of the first 60 bits. Generally speaking, the AUTN may be derived by applying any suitable function to IMSI 1  such that the communication device  110  can obtain IMSI 1  by applying a reverse function to the AUTN. 
     This authentication data response can take the same format as an authentication data response used in a normal attachment procedure. According to the normal attachment procedure, an authentication data response also includes a ciphering key (CK), an integrity key (IK), and an expected response (XRES). In order to comply with the format of the authentication data response used in the normal attachment procedure, the response unit  308  fills CK, IK, and XRES in the authentication data response to be sent in step S 6  with arbitrary values. 
     In step S 7 , the network apparatus  121  sends an authentication request to the communication device  110  in order to authenticate the communication device  110 . The authentication data request to be sent includes the RAND and AUTN extracted from the received authentication data response. The receiving unit  306  of the communication device  110  receives this authentication request. 
     In step S 8 , the authentication unit  210  may authenticate the AUTN included in the received authentication request, using the RAND included in this request and K 0 . This authentication will fail because the AUTN was not generated according to the normal attachment procedure. This step may be skipped because the sending unit  305  sent the attach request including a special IMSI in step S 1  and thus the authentication unit  210  can forecast that the authentication will fail. In some embodiment, the procedure goes to step S 9  after it is determined that the authentication in step S 8  fails. 
     In step S 9 , the response unit  308  of the communication device  110  sends an authentication failure message to the network apparatus  121  to inform that authentication of the AUTN fails. As described above, the authentication of the AUTN may or may not be actually performed. Failure code in the authentication failure message may be “MAC failure” or “GSM authentication unacceptable” described in 3GPP TS 24.008. The network apparatus  121  receives this authentication failure message. 
     In step S 10 , the network apparatus  121  sends an authentication failure report to the authentication server  131  to inform that the authentication of the AUTN fails in the communication device  110 . The authentication server  131  may confirm that IMSI 1  has been successfully delivered to the communication device  110  based on receiving of the authentication failure report. 
     In step S 11 , the obtaining unit  307  of the communication device  110  obtains IMSI 1  and a key. The obtaining unit  307  may obtain IMSI 1  by extracting IMSI 1  from the AUTN which was received in step S 7 . The obtaining unit  307  may apply to the ATUN the inverse function of the function which was used in step S 6  in order to obtain the AUTN from IMSI 1 . In this case, the reverse function may be stored in the communication device  110  (for example, in the TRE  309 ) before the procedure shown in  FIG. 4  begins. In some embodiments, the reverse function may be allocated to the communication device  110  when IMSI 0  and K 0  are allocated to the communication device  110 . 
     The obtaining unit  307  may obtain a key by applying the KDF to the RAND included in the authentication request in step S 7  and K 0  stored in the TRE  309 , that is, by calculating KDF(K 0 , RAND). The KDF used in step S 11  is the same function as the KDF used in step S 4 . Thus, the obtained key is equal to K 1  because the arguments applied to the KDF are the same in steps S 4  and S 11 . The KDF may be stored in the communication device  110  (for example, in the TRE  309 ) before the procedure shown in  FIG. 4  begins. In some embodiments, the KDF may be allocated to the communication device  110  when IMSI 0  and K 0  are allocated to the communication device  110 . 
     In step S 12 , the obtaining unit  307  stores IMSI 1  and K 1  in the TRE  309  such that K 1  is associated with IMSI 1  for future use. 
     After step S 12 , the communication device  110  can use a unique IMSI (that is IMSI 1 ) and a corresponding key (that is K 1 ) which the authentication server  131  also stores. The communication device  110  therefore can perform the normal attachment procedure using IMSI 1  and K 1 . In one embodiment, in step S 13 , the Sending unit  305  of the communication device  110  sends another attach request including IMSI 1  to the network apparatus  121  to attach to the RO network  130 . In step S 14 , the network apparatus  121  sends to an authentication data request including IMSI 1  to the authentication server  131 . The remaining operations will be understood by those skilled in the art and their descriptions omitted. 
     In another embodiment, the network apparatus  121  may send an identity request to the communication device  110  after receiving the authentication failure message in step S 9 . The communication device  110  sends an identity response including IMSI 1 . Descriptions of the remaining operations are omitted because they are specified in the 3GPP TS24.008. 
     In order to reduce a risk of DoS (Denial of Service) attack for a special IMSI, the authentication server  131  may set rate limit for authentication data requests from the network apparatus  121 , shorter valid period for allocated IMSI 1 , or the like. 
     According to the embodiments of the present invention, a single same pair of subscription identity and secret key is shared among a plurality of communication devices and a unique pair of subscription identity and secret key is allocated to a communication device on demand. This avoids wasting a numbering space of subscription identities. Moreover, the cost to coordinate for collision avoidance in terms of initial connectivity establishment can be removed. 
     The communication device and the authentication server can share a secret key associated with the delivered subscription identity in a secure way because this secret key is not communicated via networks. 
     During the procedure for delivering a unique subscription identity, the network apparatus relaying communication between the communication device and the authentication server can handle messages in the same way as in the normal attachment procedure. Thus, the present invention is applicable to the scenario where the communication device is located in a visited network, without changing configuration of the network apparatus such as a VLR and SGSN. 
     While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions.