Two-Factor Authentication in a Cellular Radio Access Network

Abstract

A method for authenticating radio access network devices is disclosed, comprising: authenticating, at a coordination server, a base station in a radio access network using a first authentication factor; selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database; sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station; receiving, from the base station at the coordination server, a response to the challenge question; verifying, at the coordination server, the correctness of the response using a key derived from the historical information; and granting the base station access to a core network of a mobile operator, thereby addressing security issues unsolved by one-factor authentication.

1 . A method for authenticating radio access network devices, comprising:
 authenticating, at a coordination server, a base station in a radio access network using a first authentication factor;   selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database;   sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station;   receiving, from the base station at the coordination server, a response to the challenge question;   verifying, at the coordination server, the correctness of the response using a key derived from the historical information; and   granting the base station access to a core network of a mobile operator,   thereby addressing security issues unsolved by one-factor authentication.   
     
     
         2 . The method of  claim 1 , wherein the historical information is based on a plurality of events that have occurred at the base station. 
     
     
         3 . The method of  claim 1 , wherein the historical information further comprises a base station identifier, a timestamp, and an event type 
     
     
         4 . The method of  claim 1 , wherein the historical information is based on a user equipment (UE) attach event. 
     
     
         5 . The method of  claim 1 , wherein the challenge question is based on a key derived from the historical information. 
     
     
         6 . The method of  claim 1 , further comprising receiving an index of the historical information at the coordination server from a database server. 
     
     
         7 . The method of  claim 1 , further comprising forwarding, from the coordination server, the historical information to a database server. 
     
     
         8 . The method of  claim 1 , further comprising, at the base station, using an index of the historical information and a local copy of the historical information to derive a secret key at the base station. 
     
     
         9 . A non-transitory computer-readable medium which, when executed by a processor at a server, causes the server to perform:
 authenticating, at a coordination server, a base station in a radio access network using a first authentication factor;   selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database;   sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station;   receiving, from the base station at the coordination server, a response to the challenge question;   verifying, at the coordination server, the correctness of the response using a key derived from the historical information; and   granting the base station access to a core network of a mobile operator,   
       thereby addressing security issues unsolved by one-factor authentication.