AKMA Authentication Profiles for RADIUS and IPsec Interworking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication protocols, such as AKMA, do not effectively support secure communication between Personal Internet of Things (PIN) network elements and Authentication, Authorization, and Accounting (AAA) servers using RADIUS or IPsec protocols, limiting the scalability and efficiency of secure wireless connections in PIN systems.
Innovation Solution
Implementing new AKMA profiles that support RADIUS and IPsec protocols to enable secure message exchanges between PIN network elements and AAA servers, enhancing the security and scalability of PIN systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing communication protocols (AKMA) are used for secure communication between PIN network elements and AAA servers, then basic authentication functionality is provided, but security and scalability are limited
Solution Approach 1:
The patent implements multiple security protocols (RADIUS, IPsec, EAP) within the AKMA framework, allowing the same authentication server and key management infrastructure to serve multiple protocol requirements. This enables a single system to provide secure communication across different protocol standards, enhancing both security reliability and protocol adaptability simultaneously
2Reliability
If existing communication protocols (AKMA) are used for secure communication, then basic authentication is supported, but scalability of secure wireless connections is limited
Solution Approach 1:
The patent implements dynamic protocol selection and configuration capabilities, allowing the authentication system to adaptively choose between RADIUS, IPsec, and EAP protocols based on network conditions and security requirements. This dynamic approach enables the system to scale efficiently by optimizing security configurations for different deployment scenarios without compromising overall security reliability
3Reliability
If new AKMA profiles supporting RADIUS and IPsec are implemented, then security and scalability are enhanced, but device complexity increases
Solution Approach 1:
The patent introduces an authentication server as an intermediary that centralizes the complex cryptographic operations and protocol management. The authentication server handles key derivation, verification, and protocol-specific processing, while network elements maintain simpler client implementations. This intermediary approach enables enhanced security through multiple protocols while reducing the complexity burden on individual devices
4Adaptability or versatility
If multiple security protocols (RADIUS, IPsec) are integrated into AKMA, then protocol versatility improves, but implementation complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct functional modules: a core AKMA authentication server, protocol-specific adapters for RADIUS/IPsec/EAP, and network element clients. Each protocol is implemented as a separate adapter layer that interfaces with the unified authentication core. This segmentation allows the system to support multiple protocols with high versatility while keeping individual component complexity manageable through clear separation of concerns
Data Source
AI summary
There is provided an apparatus, method and computer program for causing a first apparatus to: obtain an identifier of a cryptographic key according to a first security communication protocol; signal, to a second apparatus, a first authentication request according to a second security communication protocol, the first authentication request comprising the identifier of the cryptographic key and a first verifying information according to a second security communication protocol, wherein the first verifying information comprises a first value calculated using the cryptographic key; receive, from the second apparatus, an authentication response according to the second security communication protocol, the authentication response comprising a second verifying information according to the second security communication protocol, wherein the second verifying information comprises a second value; and verify the second apparatus for the second security communication protocol using the second value and the cryptographic key.