Security method for transmissions in telecommunication networks
The invention related to method for providing connection security for the transmission between communicating parties in a telecommunication network, the method comprising the steps of: exchanging security parameters between communicating parties, providing connection security for messages based on these security parameters, and transmitting said messages between communicating parties. It is characteristic for the method according to the invention that it further comprises the steps of: reaching agreement between communicating parties on an interval for recalculation of the security parameters, monitoring of the interval for recalculation by the communicating parties, recalculating the security parameters at the agreed interval, and providing connection security for messages based on the latest recalculated security parameters.
Latest Nokia Networks Oy Patents:
This application is a continuation of PCT/FI98/00721 filed Sep. 15, 1998.
FIELD OF THE INVENTIONThe invention relates to a method for providing connection security for transmission between the communicating parties in a telecommunication network.
BACKGROUND OF THE INVENTIONAt the beginning of a communication a handshake is usually performed between applications in telecommunication networks, during which the parties involved typically authenticate each other and exchange key information, for example, negotiate an encryption algorithm and cryptographic keys to be used in communication. It is only after the handshake that the actual data is transmitted. The confidentiality of the transmission is arranged, for example, through ciphering.
C=EK(M)
M=DK(C),
where C is the cipher text, M is the message in plain text, EK is the encryption with key K, and DK is the decryption with key K.
C=EB+(M)
M=DB−(C),
where C is the cipher text, M is the message in plain text, EB+ is encryption with the receiver's public key KB+, and DB− is decryption with the receiver's private key KB−.
In the public key algorithm the encryption of a message with the private key K− of the message sender acts as a signature, since anyone can decrypt the message with the known public key K+ of the sender. Since asymmetric keys are usually much longer than symmetric keys, the asymmetric algorithm requires much more processing power. Thus asymmetric algorithms are unsuitable for encrypting large amounts of data.
A hybrid cryptography uses both the above-mentioned algorithms together. For example, only session keys are exchanged using public key algorithm, and the rest of the communication is encrypted with symmetric method.
To provide message integrity and authentication in a connection, a message authentication code MAC is calculated and attached to the transmitted message. For example, MAC can be calculated with a one-way hash algorithm in the following way:
h=H(K, M, K),
where K is the key, M is the message, and H is the hash function. The input cannot be deduced from the output. When MAC is attached to a message, the message cannot be corrupted or impersonated. The receiving party calculates MAC using the received message and the same hash function and key as the transmitting party and compares this calculated MAC to the MAC attached to the message in order to verify it.
One problem with providing connection security is that handshaking requires plenty of processing time since several messages must be sent between the parties involved. The low processing power and narrow bandwidth in the mobile stations make handshakes particularly burdensome in mobile communication networks. Handshakes are also burdensome for applications which have numerous simultaneous transactions, for example, a server in a bank. Therefore, it is desirable to minimize the number and duration of the handshakes. This leads to the problem that an attacker has lots of time for cryptanalysis, as the same encryption keys are used between the two handshakes. If the attacker succeeds in the cryptanalysis, he can access all the material sent between the two handshakes.
SUMMARY OF THE INVENTIONThe object of this invention is to provide a method for securely protecting transmitted information between communicating applications, especially over narrow-band connections, without unnecessarily loading the communicating parties.
This is achieved by using a method according to the invention characterized by what is stated in the independent claim 1. Special embodiments of the invention are presented in the dependent claims.
The invention is based on the idea that the communicating parties recalculate the security parameters during the transmission session simultaneously with each other at agreed intervals and the continue communicating and providing connection security for messages with these new parameters. The communicating parties monitor the time for recalculation and at the agreed intervals recalculate and thus change the security parameters without a handshake taking place. In the primary embodiment of the invention, the messages are numbered and the number agreed on triggers recalculation at intervals.
The advantage of the method according to the invention is that security parameters can be changed during the session without handshaking. This reduces the need for handshakes.
Another advantage of the method according to the invention is that the security of the transmission is improved, i.e. attacking is made more difficult and less profitable.
The description of the preferred embodiments of the invention will now be made with reference to the attached drawings, in which
The present invention can be applied to any telecommunication network. Below the invention is described in more detail using as an example a mobile station operating in the digital GSM mobile communication system and communicating with an application located either inside or outside the GSM network.
In the following the primary embodiment of the invention is described in more detail with reference to
After agreeing on the intervals for recalculation both the parties monitor the agreed intervals. If an interval after four messages is agreed on, either both parties monitor the number of messages sent, which requires a reliable transmission media with no lost messages, or they number all transmitted messages and transmit these sequence numbers with the messages. The advantage of sending the sequence numbers or time stamps with the messages is that the recalculation is synchronous at both ends even though some messages get lost along the way or messages received are not in correct order. When in the example described above the fourth message is transmitted and received, both the communicating parties recalculate the security parameters and use these new parameters for providing connection security for the next four messages. A handshake or any other session key exchange is not performed during or after the recalculation of the parameters. The recalculation can be based on a shared secret and the latest sequence number, for example. Security parameters can also be used to calculate session keys Kn for ciphering and the message authentication code MAC in the following way, for example:
Kn=H(S, N)
MAC=H(M, S, N),
where H is a predetermined hash algorithm, S is the shared secret, N is the latest sequence number, and M is the message to be transmitted in plain text.
In another embodiment of the invention, MAC is used to provide connection security for message transmission in the place of ciphering. According to the invention MAC is calculated, from the sequence number that last triggered recalculation of the security parameters, for example. In the example in
Yet another embodiment of the invention uses ciphering and MAC to provide connection security for messages. This is implemented by combining the embodiments described above.
Recalculation of the security parameters includes also the possibility of changing the ciphering algorithm to be used in ciphering the next messages.
The drawings and the accompanying explanation are only intended to demonstrate the principles of the invention. The details of the method according to the invention can vary within the patent claims. Although the invention was described above mostly in connection with a mobile station and service application communication, the invention can also be used for providing connection security for messages between any two or more applications communicating together, also in mobile to mobile connection in a speech, data and short message transmission. The invention is also suitable for use in recalculating other security parameters than session keys and MACs. The invention is not restricted for use only in connection with the ciphering algorithms presented above, but can be applied together with any ciphering algorithms.
Claims
1. A method for providing connection security for the transmission between communicating parties in a telecommunication network, the method comprising the steps of:
- exchanging security parameters between communicating parties,
- providing connection security for messages based on these security parameters,
- transmitting said messages between communicating parties,
- wherein the method further comprises the steps of:
- reaching agreement between communicating parties on an interval for recalculation of the security parameters,
- monitoring of the interval for recalculation by the communicating parties,
- recalculating the security parameters at the agreed interval, and providing connection security for messages based on the latest recalculated security parameters.
2. The method according to claim 1, wherein providing connection security for messages based on the latest recalculated security parameters comprises the step of
- ciphering messages based on the latest recalculated security parameters.
3. The method according to claim 1, wherein providing connection security for messages based on the latest recalculated security parameters comprises the step of
- authenticating and providing integrity for the messages based on the latest recalculated security parameters.
4. The method according to claim 1, wherein providing connection security for messages based on the latest recalculated security parameters comprises the steps of
- ciphering messages based on the latest recalculated security parameters, and
- authenticating and providing integrity for the messages based on the latest recalculated security parameters.
5. The method according to claim 3, wherein authenticating and providing integrity for the messages is arranged with a message authentication code MAC.
6. The method according to claim 1, wherein the method further comprises the steps of:
- numbering the messages,
- agreeing on the number of messages to determine the interval for the recalculation of the security parameters,
- recalculating the security parameters after the agreed number of messages have been transmitted.
7. The method according to claim 6, wherein the method further comprises the steps of:
- numbering the messages with sequence numbers,
- transmitting the sequence number with the message, and
- using the latest sequence number as input for recalculation of the security parameters.
8. The method according to claim 1, wherein the method comprises the step of
- reaching agreement between communicating parties during handshaking on the interval for recalculation of the security parameters.
9. A mobile station configured to
- exchange security parameters with at least one communicating party,
- negotiate an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- monitor the interval for recalculation,
- recalculate the security parameters at the agreed interval, and
- providing connection security for messages transmitted between the mobile station and the at least one communicating party based on the latest calculated security parameters.
10. The mobile station according to claim 9, configured to cipher messages based on the latest recalculated security parameters.
11. The mobile station according to claim 9, configured to authenticate and provide integrity for messages based on the latest recalculated security parameters.
12. The mobile station according to claim 9, configured to cipher, authenticate and provide integrity for messages based on the latest recalculated security parameters.
13. The mobile station according to claim 11, wherein the messages are authenticated and integrity for the messages is provided with a message authentication code.
14. The mobile station according to claim 9, configured to
- number the messages,
- agree on a number of messages for determining the interval for the recalculation of security parameters, and
- recalculate the security parameters after the agreed number of messages have been transmitted.
15. The mobile station according to claim 14, configured to
- number the messages with sequence numbers,
- transmit a respective sequence number with a message, and
- use the latest sequence number as input for recalculation of the security parameters.
16. The mobile station according to claim 9, configured to negotiate and reach an agreement with said at least one communicating party during handshaking on the interval for recalculation of the security parameters.
17. A server configured to
- exchange security parameters with at least one communicating party,
- negotiate an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- monitor the interval for recalculation,
- recalculate the security parameters at the agreed interval, and
- provide connection security for messages transmitted between the server and the at least one communicating party based on the latest calculated security parameters.
18. The server according to claim 17, configured to cipher messages based on the latest recalculated security parameters.
19. The server according to claim 17, configured to authenticate and provide integrity for messages based on the latest recalculated security parameters.
20. The server according to claim 17, configured to cipher, authenticate and provide integrity for messages based on the latest recalculated security parameters.
21. The server according to claim 19, wherein the messages are authenticated and integrity for the messages is provided with a message authentication code.
22. The server according to claim 17, configured to
- number the messages,
- agree on a number of messages for determining the interval for the recalculation of security parameters, and
- recalculate the security parameters after the agreed number of messages have been transmitted.
23. The server according to claim 22, configured to
- number the messages with sequence numbers,
- transmit a respective sequence number with a message, and
- use the latest sequence number as input for recalculation of the security parameters.
24. The server according to claim 17, configured to negotiate and reach an agreement with said at least one communicating party during handshaking on the interval for recalculation of the security parameters.
25. A mobile station comprising
- means for exchanging security parameters with at least one communicating party,
- means for negotiating an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- means for monitoring the interval for recalculation,
- means for recalculating the security parameters at the agreed interval, and
- means for providing connection security for messages transmitted between the mobile station and the at least one communicating party based on the latest calculated security parameters.
26. A server comprising
- means for exchanging security parameters with at least one communicating party,
- means for negotiating an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- means for monitoring the interval for recalculation,
- means for recalculating the security parameters at the agreed interval, and
- means for providing connection security for messages transmitted between the server and the at least one communicating party based on the latest calculated security parameters.
27. A method of operating a mobile station, the method comprising
- exchanging security parameters with at least one communicating party,
- negotiating an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- monitoring the interval for recalculation,
- recalculating the security parameters at the agreed interval, and
- providing connection security for messages transmitted between the mobile station and the at least one communicating party based on the latest calculated security parameters.
28. A method of operating a server, the method comprising
- exchanging security parameters with at least one communicating party,
- negotiating an agreement with the at least one communicating party on an interval for recalculation of security parameters,
- monitoring the interval for recalculation,
- recalculating the security parameters at the agreed interval, and
- providing connection security for messages transmitted between the server and the at least one communicating party based on the latest calculated security parameters.
29. A telecommunications network comprising at least two parties arranged to communicate with each other and to provide connection security, the at least two parties configured to
- exchange security parameters with each other,
- negotiate an agreement on an interval for recalculation of security parameters,
- monitor the interval for recalculation,
- recalculate the security parameters at the agreed interval, and
- provide connection security for messages transmitted between the at least two communicating parties based on the latest calculated security parameters.
30. A telecommunications network comprising a server and at least one mobile station, the server and the at least one mobile station configured to
- exchange security parameters with each other,
- negotiate an agreement on an interval for recalculation of security parameters,
- monitor the interval for recalculation,
- recalculate the security parameters at the agreed interval, and
- provide connection security for messages transmitted between the server and the at least one mobile station on the latest calculated security parameters.
31. A telecommunications network comprising at least two mobile stations, the at least two mobile stations configured to
- exchange security parameters with each other,
- negotiate an agreement on an interval for recalculation of security parameters,
- monitor the interval for recalculation,
- recalculate the security parameters at the agreed interval, and
- provide connection security for messages transmitted between the at least two mobile station on the latest calculated security parameters.
4607137 | August 19, 1986 | Jansen et al. |
4856063 | August 8, 1989 | McCalmont |
5241599 | August 31, 1993 | Bellovin et al. |
5602917 | February 11, 1997 | Mueller |
5812667 | September 22, 1998 | Miki et al. |
5854841 | December 29, 1998 | Nakata et al. |
5905445 | May 18, 1999 | Gurney et al. |
5966449 | October 12, 1999 | Iwamura et al. |
5991405 | November 23, 1999 | Mills |
6014444 | January 11, 2000 | Nakamura et al. |
6125185 | September 26, 2000 | Boesch |
6157722 | December 5, 2000 | Lerner et al. |
6157723 | December 5, 2000 | Schultz |
6230002 | May 8, 2001 | Floden et al. |
0 189 823 | January 1986 | EP |
01-288131 | November 1989 | JP |
06006615 | January 1994 | JP |
WO 95/06374 | March 1995 | WO |
95/08232 | March 1995 | WO |
95/26087 | September 1995 | WO |
- Davies et al, “Security for Computer Networks”, Nikkei MacGrow Hill-Sha, Dec. 5, 1985, pp. 126-128. (with English Translation).
- Mar. 25, 1999, International Search Report for PCT/FI98/00721.
Type: Grant
Filed: Sep 9, 2004
Date of Patent: Apr 24, 2007
Assignee: Nokia Networks Oy (Espoo)
Inventor: Tommi Raivisto (Vantaa)
Primary Examiner: Quochien B. Vuong
Assistant Examiner: Tuan Tran
Attorney: Squire Sanders & Dempsey L.L.P.
Application Number: 10/936,830
International Classification: H04M 1/66 (20060101); H04M 1/68 (20060101); H04M 3/16 (20060101);