KR20100092371A - Method and apparatus for traffic count key management and key count management - Google Patents

Abstract

PURPOSE: A traffic count key, and a method and an apparatus for managing a traffic count key are provided to variously operate network and generate traffic encryption key(TEK) by synchronizing a key count between a mobile terminal and a base station. CONSTITUTION: An authentication process and a reauthentication process are performed between a mobile terminal(AMS) and a base station(ABS)(S201). The mobile terminal and the base station are performed a three-way handshake process(S202). The base station shares nonce by transmitting the nonce to the mobile terminal(S203). The mobile terminal and the base station maintain different TEK count for each sercuroty association(S204a, S204b). The base station transfers the TEK count value to an authenticating object(S205). The mobile terminal and the base station generate TEK(S206a, S206b).

Description

Method and Apparatus for traffic count key management and key count management}

The present invention relates to a method for managing a key count value for generating and / or updating a traffic encryption key (TEK) in various communication environments of a wireless access system, and an apparatus in which the methods can be performed.

Hereinafter, a brief description of a protocol layer based on the IEEE 802.16e (Institute of Electrical and Electronics Engineers 802.16e) system.

1 illustrates a protocol layer model defined in a wireless mobile communication system based on an IEEE 802.16e system that is generally used.

Referring to FIG. 1, a medium access control (MAC) layer belonging to a link layer may be composed of three sublayers. First, the Service-Specific Convergence Sublayer (Service-Specific CS) is a MAC SDU of a MAC Common Part Sublayer (CPS) that receives data from an external network received through a CS SAP (Service Access Point). Can be transformed or mapped into Service Data Units. This layer may include a function of classifying SDUs of an external network and then associating a corresponding MAC Service Flow IDentifier (SFID) with a Connection IDentifier (CID).

Next, the MAC CPS layer provides core functions of MAC such as system access, bandwidth allocation, connection establishment and management, and receives data classified by specific MAC connection from various CSs through MAC SAP. do. In this case, quality of service (QoS) may be applied to data transmission and scheduling through the physical layer.

In addition, the security sublayer may provide authentication, security key exchange, and encryption functions. Hereinafter, the security service and the security sublayer will be briefly described.

Security services are those that provide the confidentiality and integrity of network data. Integrity refers to whether the original message content is delivered to the other party in the same content. In other words, integrity is to ensure that messages are not tampered with by third parties or the like. Confidentiality is the disclosure of information only to authorized persons. In other words, confidentiality is to completely protect the content of the transmitted data to prevent unauthorized access to the content.

The security sublayer provides security, authentication, and confidentiality in broadband wireless networks. The security sublayer may apply an encryption function to a MAC PDU (Medium Access Control Protocol Data Unit) transmitted between the terminal and the base station. Thus, the base station and the terminal can provide a robust defense against the theft attacks of illegal users. The base station encrypts the service flow throughout the network to prevent unauthorized access to the data transmission service.

The security sublayer controls the base station to distribute information related to the key to the terminal using a key management protocol of an authenticated client / server structure. At this time, the digital certificate-based terminal device authentication may be added to the key management protocol to further strengthen the function of the basic security mechanism.

If the terminal does not provide a security function during the terminal basic function negotiation, authentication and key exchange procedures are omitted. In addition, even when a specific terminal is registered as a terminal that does not support the authentication function, the base station may consider that the authority of the terminal is verified. If a specific terminal does not support a security function, the terminal does not perform a key exchange or data encryption function because no service is provided.

The security sublayer consists of an encapsulation protocol and a key management protocol (PKM). The encapsulation protocol is a protocol for the security of packet data in a broadband wireless network. The encapsulation protocol provides a method for applying such an algorithm to a set representing a cryptographic suite such as data encryption and data authentication algorithms and a MAC PDU payload.

The cryptographic suite represents a set of security associations (SAs) that represent algorithms for data encryption, data authentication, and TEK exchange. That is, a pair of a data encryption algorithm and a data authentication algorithm is shown.

The key management protocol is a protocol that provides a method for securely distributing key related data from a base station to a terminal. The base station and the terminal may provide a method for securely distributing key related data using a key management protocol. By using the key management protocol, key-related data can be shared between the terminal and the base station, and the base station can control network access.

The security sublayer is connected through a physical layer (PHY) and a physical layer access point (PHY SAP). The PHY layer performs a function of delivering PDUs generated and encrypted in the MAC layer to a destination.

Embodiments of the present invention relate to methods and apparatuses applied to an IEEE 802.16m (hereinafter 16m) system. The IEEE 802.16m system represents a system using a standard related to a wireless access system developed in the aforementioned IEEE 802.16e (hereinafter, referred to as 16e) system. Parts not specifically defined in the 16m system can refer to the standard of the 16e system.

For the 16e standard, the TEK update is supported during handoff using the CMAC key count (CMAC_KEY_COUNT) for handoff only. However, since the CMAC key count is defined only for the case where the terminal performs handover, it is inconsistent in overall TEK management. In addition, since the 16m system has a different TEK generation method from the 16e system, creating and managing TEKs using CMAC_KEY_COUNT is inefficient and may not be suitable.

In addition, the 16m (hereinafter 16m) standard for broadband wireless access defines a traffic encryption key (TEK) for the protection of unicast data services. At this time, the generation of the TEK described at 16m is based on the use of a key count (eg, COUNTER_TEK). However, the 16m standard does not describe the specific method of managing the key count for updating the TEK.

For example, in a 16m system, TEK can be generated and used locally by mobile terminals and base stations. The flow of data service over a 16m wideband wireless access network has a set of QoS parameters and requires encryption and decryption via TEK.

However, the 16m standard does not include handoff (HO), network reentry (e.g. network reentry due to connection loss, uncoordinated HO, etc.) or idle mode. When network operation such as location update or network re-entry occurs, there is no clear definition of how the key count should be managed to update the TEK. That is, when the mobile station performs handoff from the serving base station to the target base station or performs a network reentry procedure, a part of how to handle the TEK count required for TEK update is not clearly defined.

In addition, the 16m standard clearly defines how key counts for TEK update should be managed in case of re-authentication or exhaustion of PN space (Packet Number Space), which is a factor of TEK update. Not.

The present invention has been made to solve the problems of the general technology as described above, an object of the present invention is to provide an efficient data service encryption method.

Another object of the present invention is to provide a key counter management method for updating a TEK of a 16m system. That is, the present invention provides methods and apparatuses for managing key counts when network operations such as handoff, network reentry, location update in idle mode, or network reentry in idle mode occur.

It is still another object of the present invention to provide a method for synchronizing a TEK count (or key count) to flexibly update a TEK to be used by a mobile station for handoff and / or network reentry with a base station.

It is still another object of the present invention to provide a method for generating and updating a TEK that does not place a heavy load on the network to support providing an enhanced data service.

It is still another object of the present invention to provide methods and apparatuses for managing key counts in case of re-authentication or exhaustion of PN space, which is an update factor of TEK.

Still another object of the present invention is to provide methods and apparatuses for synchronizing key counts between a terminal and a base station for various network operations or updating of a TEK.

Technical objects to be achieved in the present invention are not limited to the above-mentioned matters, and other technical problems which are not mentioned are those skilled in the art from the embodiments of the present invention to be described below. Can be considered.

In order to solve the above technical problem, the present invention discloses various methods and apparatuses for managing and generating a TEK, a TEK counter (or key count) value in various communication environments. Also disclosed are various methods and apparatus for generating and maintaining a traffic encryption key using a TEK counter (key count) value.

According to a first embodiment of the present invention, a TEK count management method for generating or updating a traffic encryption key includes transmitting a first message including a first TEK count maintained in a mobile station to a base station and a second from the base station. Receiving a second message comprising the TEK count and generating the TEK using the second TEK count. In this case, the second TEK count is determined based on the first TEK count (a), and the first TEK count (a) and the second TEK count increase each time handover or network reentry is performed, but when generating the TEK. It can be initialized whenever the nonce used is updated.

In the first embodiment, the second TEK count is determined to be the second TEK count when the first TEK count a is greater than the third TEK count b held by the base station. When the first TEK count is less than or equal to the third TEK count b, the third TEK count b may be determined as the second TEK count.

According to a second embodiment of the present invention, there is provided a method of managing a TEK count for generating or updating a traffic encryption key. The method may include transmitting a second message including the second TEK count to the mobile station and generating a TEK using the second TEK count at the base station. In this case, the second TEK count is determined based on the first TEK count, and the first TEK count and the second TEK count are increased each time handover or network reentry is performed, but the nonce used when generating the TEK is updated. Can be initialized each time.

The second embodiment may further include comparing the first TEK count with a third TEK count maintained at the base station. At this time, if the first TEK count is greater than the third TEK count, the first TEK count is determined as the second TEK count. If the first TEK count is less than or equal to the third TEK count, the third TEK count is determined. 2 can be determined by the TEK count.

The first and second embodiments may further include exchanging nonce and security materials with a mobile terminal through a key negotiation process.

In the first and second embodiments, the first message is one of a handover request message and a ranging request message used in handover, and the second message is a handover request message and lane used in handover. It may be one of a gong response message. Alternatively, the first message may be a ranging request message used for network reentry, and the second message may be a ranging response message used for network reentry.

Generating a TEK in the first and second embodiments may include generating a TEK using at least one of a second TEK count, a nonce, an authentication key (AK), and a security association identifier (SAID) at the base station. Can be performed.

In the first and second embodiments, the first message further includes one or more of a temporary identifier, a handover indication, a location update request, a paging controller TLV, and a CMAC tuple, and the second message includes a location update response and a nonce. It may further include one or more of the handover optimization information, CMAC tuples.

According to a third embodiment of the present invention, a method of managing a key count in a terminal includes: performing an authentication procedure with a base station, exchanging a key material including a nonce in a key negotiation process with a base station, and a key negotiation process Generating an authentication key (AK) using a key material, establishing two key counts having consecutive values, and using a security association identifier (SAID), an authentication key, and two key counts shared with the base station. To generate two traffic encryption keys (TEKs). At this time, it is preferable that two traffic encryption keys are managed for each security association.

As a fourth embodiment of the present invention, a method for managing a key count in a base station includes: performing an authentication procedure with a terminal, exchanging a key material including a nonce in a key negotiation process with a terminal, and a key negotiation process In the step of generating an authentication key (AK) using the key material, setting two key counts having consecutive values, and using a security association identifier (SAID), authentication key, and two key counts shared with the terminal. To generate two traffic encryption keys (TEKs). In this case, it is preferable that two traffic encryption keys are managed for each security association.

At this time, in the third embodiment and the fourth embodiment, two key counts may be initialized when handover, network reentry, location update in idle mode, and network reentry in idle mode. In addition, network reentry may occur due to location update from idle mode and handover due to network reentry, unregulated handover or loss of connection. In addition, two TEK updates may be performed due to the end of each TEK lifetime.

Meanwhile, when packet number (PN) space is exhausted, only one TEK update may be performed, and in this case, only one key count may be set in each of the terminal and the base station.

In the third and fourth embodiments of the present invention, two TEKs may be generated using a Dot16KDF algorithm. At this time, when the AK is newly generated, the two key counts are preferably initialized.

As a fifth embodiment of the present invention, a terminal for managing a key count may include a transmitting module for transmitting a message, a receiving module for receiving a message, and a processor for managing a key count. In this case, the processor of the terminal performs an authentication procedure with the base station, exchanges a key material including a nonce in the key negotiation process with the base station, and uses the key material in the key negotiation process to obtain an authentication key (AK). Generating two key counts having successive values and generating two traffic encryption keys (TEKs) using a security association identifier (SAID), an authentication key, and two key counts. Can be. At this time, the security association preferably manages two traffic encryption keys.

The two key counts may be initialized in case of handover, network reentry, location update in idle mode, and network reentry in idle mode. In addition, network re-entry may be due to handover due to location update or network reentry from idle mode, unregulated handover or loss of connection. In addition, two TEK updates may occur due to the end of each TEK lifetime. In this case, it is preferable that two TEKs are generated using a Dot16KDF algorithm.

Meanwhile, when packet number (PN) space is exhausted, only one TEK update may be performed, and in this case, only one key count may be set in each of the terminal and the base station.

In the fifth embodiment, when the AK is newly generated, two key counts are preferably initialized.

The first to fifth embodiments are merely some of the preferred embodiments of the present invention, and various embodiments in which the technical features of the present invention are reflected will be described below by those skilled in the art. It can be derived and understood based on the detailed description of the invention.

According to the embodiments of the present invention, the following effects are obtained.

First, key counts (or TEK counts) can be efficiently managed when network operations such as handoff, network reentry, location update in idle mode, or network reentry in idle mode occur through embodiments of the present invention. have.

Second, in case of re-authentication or exhaustion of PN space, which is a factor of renewal of TEK, key count can be managed efficiently.

Third, it is possible to provide methods for synchronizing key counts between a terminal and a base station for various network operations or generation and update of a TEK, and apparatuses therefor.

Fourth, by defining the key count management method described in the embodiments of the present invention, the terminal and the base station can flexibly generate and update the TEK to provide a seamless service.

Fifth, by eliminating the use of the CMAC KEY COUNT used in the conventional system (e.g. 16e system), it is possible to generate and update a consistent TEK in the advanced system (e.g. 16m system). That is, in the conventional system, the use of the CMAC key count is considered only for updating the TEK during handover. However, in the embodiments of the present invention, a key count that may be commonly used for generating and updating the TEK is a new concept. By defining COUNTER_TEK), the terminal and the base station can manage the TEK consistently.

Sixth, embodiments of the present invention can improve the user's ability to support enhanced data services by providing a TEK generation and update method that does not place a heavy load on the network, and can solve the problem of degradation of communication performance due to the creation of related information. have.

Effects obtained in the embodiments of the present invention are not limited to the above-mentioned effects, and other effects not mentioned above are usually described in the technical field to which the present invention pertains from the description of the embodiments of the present invention. Can be clearly derived and understood by those who have That is, unintended effects of practicing the present invention may also be derived from those skilled in the art from the embodiments of the present invention.

1 illustrates a protocol layer model defined in a wireless mobile communication system based on an IEEE 802.16e system that is generally used.
2 is a diagram illustrating a method of managing a TEK count according to an embodiment of the present invention.
3 is a diagram illustrating one method of updating a TEK count in a handover process according to an embodiment of the present invention.
4 is a diagram illustrating a method of updating a TEK count by a mobile terminal in an idle mode in a ranging process according to an embodiment of the present invention.
5 is a diagram illustrating a method of updating a TEK count by a mobile station and a target base station in advance in a handover process according to an embodiment of the present invention.
FIG. 6 is a diagram illustrating a method of synchronizing TEK counts in a handover process when the mobile terminal determines handover according to an embodiment of the present invention.
7 is a diagram illustrating a method of synchronizing a TEK count in a handover process when a serving base station determines handover according to an embodiment of the present invention.
8 is a diagram illustrating a method of synchronizing a target base station and a TEK count through a ranging process according to an embodiment of the present invention.
9 is a diagram illustrating one method of managing a key counter in a handover environment according to an embodiment of the present invention.
10 is a diagram illustrating a method of managing a key count when a terminal re-enters a network in a connected state according to an embodiment of the present invention.
FIG. 11 is a diagram illustrating one key count management method when an idle mode terminal releases a key count according to an embodiment of the present invention.
12 is a diagram illustrating another key count management method when an idle mode terminal releases a key count according to an embodiment of the present invention.
FIG. 13 is a diagram illustrating one key count management method when an idle mode terminal does not release a key count according to an embodiment of the present invention.
14 is a view showing another key count management method when the idle mode terminal does not release the key count according to an embodiment of the present invention.
FIG. 15 is a view illustrating one key count management method when an idle mode terminal releases a key count while reentering a network according to an embodiment of the present invention.
FIG. 16 is a diagram illustrating another key count management method when an idle mode terminal releases a key count while reentering a network according to an embodiment of the present invention.
FIG. 17 is a diagram illustrating one key count management method when an idle mode terminal does not release a key count while reentering a network.
18 is a diagram illustrating another key count management method when an idle mode terminal releases a key count while reentering a network according to an embodiment of the present invention.
19 is a view showing a method of generating TEK that can be applied to embodiments of the present invention.
20 is a diagram illustrating a terminal and a base station in which the embodiments of the present invention described with reference to FIGS. 2 to 19 are performed.

Embodiments of the present invention described below disclose methods and apparatuses for generating and managing traffic encryption key count values in various communication environments.

The following embodiments are a combination of elements and features of the present invention in a predetermined form. Each component or feature may be considered to be optional unless otherwise stated. Each component or feature may be implemented in a form that is not combined with other components or features. In addition, some of the elements and / or features may be combined to form an embodiment of the present invention. The order of the operations described in the embodiments of the present invention may be changed. Some configurations or features of certain embodiments may be included in other embodiments, or may be replaced with corresponding configurations or features of other embodiments.

In the description of the drawings, procedures or steps that may obscure the gist of the present invention are not shown, and procedures or steps that can be understood by those skilled in the art are not shown. However, these unillustrated parts reveal that they can be inferred to the extent that it is obvious to those skilled in the art.

In the present specification, embodiments of the present invention have been described based on data transmission / reception relations between a base station and a mobile station. Here, the base station is meaningful as a terminal node (TN) of a network that directly communicates with a mobile station. The specific operation described as performed by the base station in this document may be performed by an upper node (UN) of the base station in some cases.

That is, various operations performed for communication with a mobile station in a network consisting of a plurality of network nodes (NN) including a base station may be performed by the base station or other network nodes other than the base station. In this case, the 'base station' may be replaced by terms such as a fixed station, a Node B, an eNode B (eNB), an advanced base station (ABS), or an access point.

In addition, a mobile station (MS) is a user equipment (UE), a subscriber station (SS), a mobile subscriber station (MSS), a mobile terminal (MT), an advanced mobile terminal (AMS). It may be replaced with terms such as mobile station or terminal.

Also, the transmitting end refers to a fixed and / or mobile node providing data service or voice service, and the receiving end means a fixed and / or mobile node receiving data service or voice service. Therefore, in uplink, a mobile station may be a transmitting end and a base station may be a receiving end. Similarly, in downlink, a mobile station may be a receiving end and a base station may be a transmitting end.

Embodiments of the present invention may be supported by standard documents disclosed in at least one of the wireless access systems IEEE 802.xx system, 3GPP system, 3GPP LTE system and 3GPP2 system. That is, obvious steps or portions not described among the embodiments of the present invention may be described with reference to the above documents.

In addition, all terms disclosed in the present document can be described by the above standard document. In particular, embodiments of the present invention may be supported by one or more of the standard documents P802.16e-2004, P802.16e-2005, P802.16-2009, and P802.16m standard documents of the IEEE 802.16 system.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following detailed description, together with the accompanying drawings, is intended to illustrate exemplary embodiments of the invention and is not intended to represent the only embodiments in which the invention may be practiced.

In addition, specific terms used in the embodiments of the present invention are provided to help the understanding of the present invention, and the use of the specific terms may be changed into other forms without departing from the technical spirit of the present invention. .

For example, uncoordinated HO may be used in the same sense as uncontrolled HO. In addition, as a counter value used to generate and / or update a TEK, a key count and a TEK count COUNT_TEK may be used in the same meaning.

Hereinafter, a method of generating and updating a TEK used in handover or network reentry will be described.

Protection for the unicast data service defined in the 16m system means cryptographic conversion of MPDUs delivered through the connection between the mobile station (AMS) and the base station (ABS). Protection of data between the mobile station and the base station is a role of a traffic data encryption function, which is one of the functions of the security sublayer of the MAC layer.

Data encryption is applied to the MAC PDU Payload, which is requested by the selected Ciphersuite. In general, a key is required for data encryption, and the 16m standard defines a traffic encryption key (TEK) as one of various keys.

In the 16e system, the base station generates a TEK and transmits the TEK to the mobile terminal, whereas in the 16m system, the base station does not exchange the TEK with the mobile terminal through an air interface. That is, in the 16m system, the base station and the mobile terminal can generate TEK separately.

Therefore, in the 16e system, since the base station generates a TEK and transmits the TEK to the mobile station, several mobile stations can share a single SA. However, in the 16m system, the base station and the mobile terminal share only security materials for generating a TEK, and each mobile terminal has one SA because these security materials are used to generate the TEK.

In embodiments of the present invention, the base station and the mobile station maintain and manage the synchronized TEK count for efficient update of the TEK. For example, the mobile station maintains and manages a TEK count for each TEK context, and the base station can also maintain a TEK count synchronized with a TEK counter corresponding to the mobile terminal for each TEK context.

Equation 1 below shows one of a method of generating a TEK during handoff of a base station and a mobile terminal.

Referring to Equation 1, the mobile station and the base station may include a key encryption key (KEK), a CMAC key count, and a security association identifier (SAID) for identifying a security association (SA) between the mobile station and the base station. TEK can be created by assigning it to a Key Derivation Function (KDF).

After PKMv2 authentication or re-authentication is successfully completed or a new PMK is set, the mobile station initializes CMAC_KEY_COUNT and sets it to '0'. This is done after receiving the SA TEK challenge message.

Equation 2 below shows one of methods for generating TEK in a 16m system.

Referring to Equation 2, the mobile station and the base station are the authentication key (AK), SAID, nonce (Nonce), key count (Key_Count), the base station identifier (BSID) and the mobile station's MAC address (AMS MAC Address) The TEK can be generated separately by substituting the parameters such as the key generation function KDF.

2 is a diagram illustrating a method of managing a TEK count as one of embodiments of the present invention.

Referring to FIG. 2, the mobile station AMS may perform an authentication procedure or a re-authentication procedure with the base station ABS (S201).

The mobile station and the base station may perform a key agreement process for negotiating an encryption key for data protection. As an example of the key negotiation process, the mobile station and the base station may perform a 3-way handshake process (S202).

In step S202, the mobile station and the base station may share security contexts for generating a TEK through a key negotiation process (e.g. 3-way handshake). The 3-way handshake process can be performed through three steps: SA-TEK challenge, SA-TEK request, and SA-TEK response. In this case, the security context may include an AK context, a KEK context, and the like.

After the key negotiation process is performed, the base station may share a nonce by transmitting a nonce for generating a TEK to the mobile terminal (S203).

The TEK count for generating and updating the TEK may be initialized by the mobile station and the base station and set to '0' after authentication or re-authentication is performed or a new PMK is set. The mobile station and the base station may set and maintain separate TEK counts (1st TEK count, 2nd TEK count) for each TEK context activated for each security association (SA). Accordingly, the mobile station and the base station can uniquely maintain the TEK count for each SA when the TEK is generated. That is, the TEK count must be kept different for each SA (S204a, S204b).

The base station may transmit the set TEK count value to the authentication entity (AAA server) (S205).

The mobile station and the base station may generate the TEK using the nonce, the TEK count, and other security contexts (S206a, S206b).

In the process of data communication, the mobile terminal may reenter the network. However, the network reentry at this time is a case where the network reentry due to network operation such as connection loss or unintentional handover (uncoordinated HO) is not performed by the mobile terminal in idle mode. It means (S207).

The TEK count maintained by the mobile station and the base station is incremented each time a handover or network re-entry occurs, and can be initialized each time the nonce used in TEK generation is updated. In this case, the size of the TEK count does not need to be large. This is because when the network re-entry is made, the TEK count is initialized since a new nonce is generated by the base station and assigned to the mobile station.

That is, the TEK count is incremented each time a handover or network re-entry occurs, preventing the same TEK from being generated. The same may be applied to the case where the mobile station moves from the serving base station to the target base station and then returns to the serving base station again.

In the embodiments of the present invention, the TEK count is defined as a value that is initialized each time a TEK is generated, and this may also be applied to a general update situation of a TEK in which a PN size (Packet Number size) expires.

The mobile station may transmit a ranging request (RNG-REQ) message including a TEK count TLV (e.g. 1st TEK count) indicating information on the TEK count to the base station during handover or network reentry (S208).

In step S208, the ranging request message may further include one or more of a temporary ID of the mobile station, a handover indication (HO Indication) and a CMAC tuple (CMAC Tuple).

The base station may check the TEK count value (1st TEK count) of the mobile terminal through the TEK count information (eg, TEK count TLV) included in the RNG-REQ message. Accordingly, the base station may compare the received TEK count value with the TEK count value (2nd TEK count) held by the base station (S209).

In step S209, when the TEK count (1st TEK count) maintained by the mobile station is smaller than the TEK count (2nd TEK count) maintained by the base station, the base station transmits a ranging response (RNG-RSP) message to the mobile station. It can tell the TEK count value (2nd TEK count). That is, the base station may instruct to update the TEK count value of the mobile terminal to the TEK count value maintained by the base station (S210).

In step S210, the ranging response message may further include one or more of a CMAC tuple, a nonce, a TEK count TLV, and a handover optimization information (HO Optimization Info.) For network entry.

The mobile station receiving the ranging response message including the TEK count value (2nd TEK count) of the base station may update its TEK count with the TEK count value (2nd TEK count) of the base station (S211a).

Meanwhile, in step S209, when the TEK count maintained by the mobile terminal is larger than the TEK count maintained by the base station, the base station may update the TEK count value held by the mobile terminal to the TEK count value maintained by the mobile terminal (S211b). .

Steps S211a and S211b are processes in which the mobile station and the base station synchronize synchronization of TEK counts with each other during handoff and network reentry.

If the TEK counts of the mobile station and the base station are the same in step S209, the base station transmits an RNG-RSP message including the corresponding TEK count (2nd TEK count) to the mobile station, and the mobile station and the base station use the same TEK count. TEK can be generated (not shown).

When the mobile station completes the handoff or network re-entry, the base station may inform the authentication server (e.g. Authenticator) and transmit a TEK count value of the mobile station and / or the base station to the authentication server (S212).

When network re-entry occurs as shown in FIG. 2, the TEK count information (TEK count TLV) held by the mobile station and the base station may be transmitted in the ranging request message and the ranging response message. These specify TEK count values currently maintained by the mobile station and the base station, respectively, and are used for synchronization of the TEK counts for generation of TEKs to be shared by the mobile station and the base station.

3 is a diagram illustrating one of methods of updating a TEK count in a handover process as one of embodiments of the present invention.

Referring to FIG. 3, the mobile station AMS may perform initial authentication or re-authentication with a serving base station (S-ABS) (S301).

The mobile terminal and the serving base station may exchange nonce and other security materials through a key agreement process. At this time, the security material may include a CMAC tuple, an authentication key (AK), a mobile station MAC address (AMS MAC address), a base station identifier (ABS ID) and SAID (S302).

The mobile station and the serving base station may respectively initialize the TEK count according to the TEK context (S303a and S303b). In addition, the mobile terminal and the serving base station may generate the TEK using the nonce, the TEK count, and the security material (S304a, S304b).

As the mobile station moves the cell area of the serving base station, a handover to a target base station (T-ABS: Target ABS) may be determined (S305).

In operation S305, the mobile station determines handover to the target base station, but the serving base station may determine whether to handover according to a communication environment or a user's requirement.

If it is determined to perform a handover, the serving base station targets the target base station together with the TEK count set as a result of authentication or reauthentication, the nonce and other security materials (eg security contexts) required for TEK generation. It may transmit to the base station (S306).

In FIG. 3, the mobile station and the target base station may update the TEK before the handover procedure is completed. The target base station may synchronize the TEK count through the mobile terminal and the laminating procedure. That is, the mobile station and the target base station may check whether or not the TEK counts of the mobile station and the target base station are synchronized by exchanging the RNG-REQ message and the RNG-RSP message (S307).

In this case, step S307 may refer to the description of step S208 to step S211 of FIG. 2.

The mobile station and the target base station may generate the TEK using the synchronized TEK count, respectively, and then resume communication (S308a and S308b).

FIG. 4 is a diagram illustrating a method of updating a TEK count by a mobile terminal in an idle mode as one of embodiments of the present invention during a ranging process.

4 illustrates a method of managing a TEK count upon network reentry in a connected state (Connecion Loss, Uncoordinated HO). The mobile station (AMS) and the target base station (T-ABS) have parameters for generating TEK, respectively.

In FIG. 4, it is assumed that the mobile terminal is in an idle mode. That is, as the mobile station moves from the idle mode to the target base station, which is the neighboring base station of the serving base station, the target base station may perform location update. That is, the mobile terminal can maintain and update the TEK count through the location update process with the target base station.

Therefore, the mobile station and the target base station can confirm the AK by exchanging the ranging request message and the ranging response message in the process of performing the location update, and can confirm whether the TEK count is synchronized.

That is, nonce and other security materials (e.g. security context) do not need to be newly transmitted from the target base station to the mobile station, and the TEK count is also synchronized to an increased value and can be used for TEK update.

Referring to FIG. 4, a mobile station can enter a temporary ID, a handover indication, a location update request, a paging controller TLV, and a TEK count when reentering a network in an idle mode. A ranging request message including at least one of a TEK count TLV and a CMAC tuple may be transmitted to the target base station (S401).

In this case, the mobile station may include a temporary identifier instead of the mobile station's MAC address in the ranging request message to transmit to the target base station to protect the location confidentiality of the mobile station. In addition, the TEK count TLV value represents a TEK count value currently held by the mobile terminal.

Upon receiving the ranging request message, the target base station may transmit an AMS Info request message for requesting information on the AMS to a paging controller (S402).

The paging controller may transmit an AMS information response message including the MAC address and temporary identifier mapping information of the mobile station to the target base station (S403).

The temporary identifier mapping information represents mapping information between the MAC address and the temporary identifier of the mobile terminal. That is, the target base station can identify the mobile terminal using the temporary identifier mapping information.

The target base station may transmit the ranging response message to the mobile terminal as a response to the ranging request message. In this case, the ranging response message includes one or more of a location update response, a CMAC tuple, a nonce, a TEK count TLV, and a handover optimization information (HO Optimization Info.) Indicating a skippable procedure upon entering the network. It may be (S404).

The mobile station and the target base station may generate the TEK using the synchronized TEK count, nonce and other security materials, respectively (S405a and S405b).

Generation and update of the TEK in Figure 4 may be performed using the following equation (3).

Referring to FIG. 4, the mobile station and the target base station may generate TEK by substituting the AK, nonce, SAID, and TEK count values into the key generation function. However, in steps S405a and S405b, the mobile terminal and the base station may generate the TEK using the TEK generation method described in Equation 2 in addition to Equation 3.

FIG. 5 is a diagram illustrating a method of updating a TEK count by a mobile station and a target base station in advance in a handover process according to one embodiment of the present invention.

Referring to FIG. 5, a mobile station (AMS), a serving base station (S-ABS), and a target base station (T-ABS) may maintain and manage a TEK count, respectively. In this case, it is assumed that the TEK count of the mobile station and the serving base station is a and the TEK count of the target base station is b.

When the mobile station wants to move from the cell area of the serving base station to the cell area of the target base station, the mobile station may transmit a handover request message to the serving base station. At this time, the handover request message may include the TEK count value (a) of the mobile terminal (S501).

The serving base station receiving the handover request message may deliver the nonce and security materials to the target base station through the backbone network. At this time, the security material may include one or more of the TEK count, TEK context, CMAC tuple, authentication key (AK), mobile station MAC address (AMS MAC address), base station identifier (ABS ID) and SAID of the mobile terminal ( S503).

The target base station may compare the TEK count value (a) of the mobile terminal with the TEK count value (b) held by the target base station. If a is greater than b, the target base station updates the TEK count with a value. If a is less than b, the target base station transmits a value of b to the serving base station so that the mobile station can update the TEK count to b. In addition, when the a value and the b value is the same, the target base station may immediately generate a TEK using the b value and the nonce received in step S503. In FIG. 5, it is assumed that the b value is larger than the a value.

That is, through the comparison process, the target base station and the mobile station can synchronize the TEK count value before completing the handover. Therefore, the target base station may transmit the updated TEK count value (b) to the serving base station through the backbone network (S505).

The serving base station may transmit the TEK count value b of the target base station to the mobile terminal through the handover response message (S507).

The mobile station and the target base station may generate the TEK using the updated TEK count value (b), respectively. The mobile terminal and the target base station may generate a TEK using one of Equations 2 and 3 (S509a and S509b).

By using the embodiments of the present invention, even when the mobile terminal performs handover or network re-entry, it is possible to receive a seamless and confidential service. For example, the serving base station transmits the TEK count required for generation of the TEK to the target base station during handoff, so that the mobile station and the target base station maintain the synchronized TEK count to update the same TEK. In addition, the location update ranging process or the handover ranging process may check whether the TEK count is synchronized.

Through this process, the mobile station and the target base station can quickly and flexibly generate and update a TEK, thereby solving the problem of deteriorating communication performance for security-related information.

Hereinafter, as another embodiment of the present invention, methods for synchronizing a TEK count in a handover process will be described in detail. However, the following embodiments will be described in more detail based on the methods described with reference to FIGS. 2 to 5.

In embodiments of the present invention, the TEK count represents a value that can be uniquely maintained per SA when the TEK is generated. Also, the TEK count can be defined as a value that is initialized when the TEK is ganged. When the mobile station and the base station update the TEK, (1) when the mobile terminal performs a handover, (2) when the mobile terminal reenters the network, (3) the TEK lifetime of the TEK expires. And (4) the TEK may be updated when the packet number size (PN Size) expires.

In embodiments of the present invention, the TEK count is incremented by '1' each time the mobile station performs handover or network reentry, so that the mobile station and the base station may not generate the same TEK.

In addition, the mobile station and the base station preferably maintain different TEK counts for the activated TEK context for each security association (SA). That is, the mobile station and the base station maintain the TEK count differently for each SA.

The base station may successfully complete the authentication or re-authentication, or set up a new AK context after the key agreement, and may initialize the TEK count and set it to '0' at the time of sharing the nonce with the mobile station. The base station may maintain a separate TEK count for each activated TEK context for each SA. That is, the TEK count is a value that must be kept different for each SA.

FIG. 6 is a diagram illustrating a method of synchronizing a TEK count in a handover process when the mobile station determines handover as one of embodiments of the present invention.

Since descriptions of the steps S601 to S605 of FIG. 6 are the same as the descriptions of the steps S301 to S305 of FIG. 3, the description of FIG. 3 is replaced with the description of FIG. 3.

The mobile station AMS may transmit a handover request (MOB_MSHO-REQ) message to the serving base station (S-ABS) (S606).

The serving base station may recognize that the mobile station performs handover by receiving a handover request message from the mobile station. Accordingly, the base station generates a new TEK count by increasing the TEK count maintained by 1 and transmits the newly generated TEK count to the mobile station by including the newly generated TEK count in a handover response (MOB_BSHO-RSP) message. There is (S607).

As another aspect of FIG. 6, since the mobile station determines whether to perform a handover, the mobile station may transmit a new TEK count to the serving base station by including a new TEK count in the handover request message. That is, a new TEK count is generated by increasing the TEK count maintained by the mobile station by '1', and transmitted to the serving base station so that the serving base station can update the TEK count.

Therefore, in step S606 or S607, the MOB_MSHO-REQ message or the MOB_BSHO-RSP message may include information for conveying a new TEK count, and this information may be added to the handover message in the form of an additional field, parameter, or TLV. May be included.

Referring back to FIG. 6, the serving base station may transmit a new TEK count, a nonce necessary for TEK generation, and other security related parameters to the target base station through the backbone network. In this case, the security material may include a CMAC tuple, an authentication key (AK), a mobile station's MAC address (AMS MAC address), a base station identifier (ABS ID), and an SAID (S608).

Through step S606 to step S608, the mobile station and the target base station can manage the synchronized TEK count. That is, the mobile terminal can explicitly match the synchronization of the TEK count required for updating the TEK to be used by the target base station. Therefore, the mobile terminal and the target base station can generate and use the same TEK (S609a, S609b).

Since the mobile station can generate the same TEK as the target base station before accessing the target base station (ie, ranging process), the continuity of the service is not impaired. Therefore, the mobile station and the target base station may perform the ranging procedure using the generated TEK (S610 and S611).

FIG. 7 is a diagram illustrating a method of synchronizing a TEK count in a handover process when a serving base station determines handover as one of embodiments of the present invention.

The description of FIG. 7 is almost similar to the description of FIG. 6. Therefore, the repeated content will be described with reference to FIG. 6. Hereinafter, only matters different from those of FIG. 6 will be described.

Referring to FIG. 7, in step S706, the serving base station (S-ABS) may determine whether to handover a mobile station (S705).

In this case, since the serving base station has a handover situation, the serving base station may generate a new TEK count by increasing the TEK count maintained by one. Accordingly, the serving base station may include the new TEK count in the handover request (MOB_BSHO-REQ) message and transmit it to the mobile station (S706).

In addition, the serving base station may deliver new TEK count, nonce and security materials to the target base station through which the mobile station will perform handover through the backbone network. At this time, the security material may include a CMAC tuple, an authentication key (AK), a mobile station's MAC address (AMS MAC address), a base station identifier (ABS ID) and SAID (S707).

Through the steps S706 and S707, the mobile station and the target base station may generate and maintain the same TEK in advance before the handover is completed. Therefore, the service provided to the mobile terminal can be provided without interruption.

8 is a diagram illustrating a method of synchronizing a target base station and a TEK count through a ranging process according to an embodiment of the present invention.

When the mobile station and the target base station perform network reentry due to connection loss or unintended handover, the TEK count can be synchronized by exchanging ranging messages during network reentry. have.

For example, since the mobile station and the target base station each have security parameters (eg Security Materials) for TEK generation, during the network reentry, the target base station is configured to display the mobile station and the ranging message (RNG-REQ and RNG-RSP). Through the exchange, the authentication key (AK) can be checked and the TEK count can be synchronized.

In this case, since the nonce and other security parameters are already shared by the mobile station and the target base station, the target base station does not need to transfer them back to the mobile station. In addition, the TEK count of the mobile station and the target base station may also be synchronized to an increased value and used to update the TEK.

Referring to FIG. 8, the mobile station transmits an RNG-REQ message including a station identifier (STID), a handover indication field, a TEK count TLV indicating a TEK count (a) of the mobile station, and a CMAC tuple field to a target base station. It may be (S801).

At this time, the target base station may compare the TEK count (a) of the mobile terminal indicated by the TEK count TLV included in the RNG-REQ message with the TEK count (b) held by the target base station. If the TEK counts of the mobile station and the target base station are the same, the mobile station and the target base station may use the TEK already generated.

However, when the TEK counts managed by the mobile station and the target base station are different from each other, the mobile station and / or the target base station preferably updates the TEK count to generate a new TEK.

For example, if the TEK count (a) of the mobile terminal is larger than the TEK count (b) of the target base station, the target base station updates the TEK count to the TEK count (a) of the terminal, and the TEK count (a) of the mobile terminal. If is smaller than the TEK count (b) of the target base station, the mobile station may initialize the TEK count (a) or update the TEK count (b) of the target base station according to the indication of the target base station.

In the embodiment of the present invention, it is assumed that the TEK count of the mobile station is updated by the TEK count of the target base station. Accordingly, the target base station may include the TEK count TLV (b) synchronized through the CMAC tuple and the comparison process in a ranging response (RNG-RSP) message and transmit it to the mobile station (S802).

The mobile station and the target base station can generate the same TEK using the newly synchronized TEK count (b). In this case, the TEK may be generated using the TEK generation method described in Equation 2 or Equation 3 (S803a and S803b).

Embodiments of the present invention can provide a seamless service to a mobile terminal by providing TEK count management methods for supporting a flexible TEK update to a mobile terminal performing handoff and network reentry in a connected state.

For example, when the serving base station delivers an increased value of the TEK count required for generation of the TEK to the target base station during handoff, the mobile station and the target base station can update the same TEK while maintaining the synchronized TEK count.

In addition, the mobile station and the base station can also check whether the TEK count is synchronized through a general ranging process.

In addition, the mobile station and the target base station confirms whether the TEK count is synchronized by exchanging ranging messages during network reentry, and sets the TEK count to an increased value of the TEK count maintained by the mobile station and the target base station, respectively. You can update the TEK.

Key count initialization

In embodiments of the present invention, the key count is preferably initialized after initial authentication or reauthentication is completed. In addition, it is preferable that two TEKs are generated for each security association SA. Therefore, when the key count is initialized, the value of the key count may be set to two consecutive values of '0' and '1'. That is, in the embodiments of the present invention described below, since two TEKs should be generated when the terminal AMS is initially authenticated to the base station ABS, key count values necessary for generating the TEK are '0' and '1'. 'Becomes.

Each key count value is then used to generate a separate TEK. For example, the key count is initialized whenever an Authorization Key (AK) is set between AMS and ABS. Also, the key count is a value maintained for each Security Association (SA) for TEK generation and update. The key count is determined by the terminal and / or the base station after handover (HO), network reentry due to uncoordinated HO, network reentry due to connection loss, or position update in idle mode and network reentry. A function to ensure that the same key (for example, TEK) is not used as before can be performed.

In addition, the key count can ensure that a different TEK is used even when the TEK is renewed due to the end of the TEK Life Time or the exhaustion of the PN space. In other words, the key count ensures the freshness of the TEK. In this context, the TEK's period (e.g. duration) may depend on the size of the key count. For example, when the key count reaches a predetermined maximum, the key count may be reset to an initial value of '0' or '1' so that the TEK may be updated.

The reset and increment condition of the key count for updating the TEK proposed in the embodiments of the present invention are as follows.

1) Handover

2) Network re-entry due to uncoordinated handover (Uncoordinated HO)

3) Network re-entry in connected state due to connection loss

4) TEK renewal due to expiration of the TEK duration

5) TEK update due to PN space depletion

1) to 4) are key count reset conditions and 5) are key count increment conditions. The AMS and ABS preferably maintain separate key counts for the individual TEKs activated for each SA. At this time, the generation method of the TEK in consideration of the use of the key count is represented by the following equation (4). Of course, the TEK may be generated and / or updated using the TEK generation method described in Equations 1 to 3.

The Dot16KDF algorithm used in Equation 4 represents a Counter mode Encryption (CTR) mode configuration that generates any amount of key materials from source key materials. Referring to Equation 4, in the embodiments of the present invention, the TEK may be generated by substituting the authentication key (AK), the security association identifier (SAID), and the key count into the Dot16KDF algorithm.

In embodiments of the present invention, the key count may be used as the value (i) of the TEK counter (COUNTER_TEK). That is, the key count is a counter value used to generate separate TEKs for the same security association identifier (SAID). The key count can be changed whenever a new TEK needs to be created while the same AK is valid. Also, the key count can be initialized each time a new AK is created. The terminal and / or the base station may maintain two TEKs at all times for each security association. At this time, these two TEKs can be derived from successive key count values.

In the embodiments of the present invention, a new TEK is generated as follows.

1) Initial network entry

2) Reentry Handover

3) Position update

4) Network reentry from idle mode

5) TEK PN Space Depletion

6) Expiration of TEK Duration

7) Immediately after recertification or PMK renewal

Other than the expiration of the TEK duration, among the conditions under which the TEK is generated, the remaining conditions occur when a new AK is generated. In this case, the TEK duration is equal to the AK duration.

In the case of 1) to 4) of the conditions under which a new TEK is generated, the Encryption Key Sequence (EKS) value for each TEK is the same as the key count (COUNTER_TEK) value used to generate the TEK. In addition, for condition 5), each time a new TEK is generated at the base station and / or the terminal, the key count value may be increased by one.

In the above, the conditions for initializing the key count value have been described. This key count initialization method can be applied to embodiments of the present invention to be described below.

Handover  To manage key count when re-entry network

9 is a diagram illustrating one method of managing a key counter in a handover environment according to one embodiment of the present invention.

The terminal AMS may perform an initial authentication process or a re-authentication process with the serving base station S-ABS (S901), and exchange security materials (Security Materials) through a key negotiation process with the serving base station (S902).

The terminal and the base station may initialize two key counts to '0' and '1' (S903a and S903b), respectively, and generate two TEKs using the TEK generation method disclosed in Equation 4 (S904a, S904b).

As the communication environment changes, the terminal may determine to perform a handover to the target base station by performing a handover procedure with the serving base station (S905).

In this case, the serving base station may deliver the key materials negotiated with the terminal to the target base station which is the base station for handover. At this time, the key count value included in the key material may be transmitted by increasing by 1 (or by a predetermined size) because a handover situation has occurred. Or since the AK is newly created, the key count value can be initialized. This is to prevent the serving base station and the target base station from having the same TEK after handover (S906).

The terminal and the target base station may further exchange nonce and other security materials in the handover process, and generate a TEK based on the key materials they have. At this time, the terminal and the target base station may generate a TEK using the increased key count value (S907a, S907b).

After moving to the target base station, the terminal may synchronize with the target base station through a ranging procedure (RNG-REQ / RNG-RSP exchange) and may acquire information related to other target base stations (S908 and S909).

FIG. 10 is a diagram illustrating a method of managing a key count when a terminal reenters a network in a connected state according to an embodiment of the present invention.

When the terminal performs network reentry from the connected state due to loss of connection or uncoordinated handover, the terminal and the base station may each generate two new TEKs using the increased key count value. This is possible if you have an AK permit. Alternatively, when a new AK is generated, the key count value may be initialized. In FIG. 10, the car count can be synchronized by referring to the EKS included in the PN. When the update of the TEK is performed, communication between the terminal and the base station is resumed.

Referring to FIG. 10, the terminal AMS includes a ranging request (RNG-REQ) including one or more of a station identifier (STID), a handover indication (HO indication), and a CMAC tuple (CMAC Tuple) to perform network reentry. ) May be transmitted to the target base station (Target ABS) (S1010).

In FIG. 10, since a connection loss or non-coordinated handover, which is a key count increase condition, occurs, the terminal and the target base station may synchronize with an increased key count value or a reset key count value, respectively. That is, the terminal and the target base station may check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN (S1020a and S1020b).

The target base station transmits a ranging response (RNG-RSP) message including a CMAC tuple used in the target base station in response to the ranging request message to the terminal (S1030).

The terminal and the base station may generate (or update) two TEKs respectively using the reset or increased key count value (S1040a and S1040b).

How to manage key count when updating position

FIG. 11 is a diagram illustrating one key count management method when an idle mode terminal releases a key count according to another embodiment of the present invention.

When location update is performed in the idle mode, the terminal AMS and the base station ABS may generate (or update) a new TEK after AK permission is made. In this case, since both the paging group to which the terminal belongs and the target base station are changed, an AK to be used by the terminal may be newly generated. That is, the terminal and the base station can update the TEK by initializing the key count value.

Referring to FIG. 11, the terminal AMS enters an idle mode from the serving base station S-ABS (S1110).

As the terminal moves to the neighboring base station area, the terminal may perform location update with the target base station (T-ABS). Therefore, the terminal may transmit the ranging request message to the target base station to perform the location update. In this case, the ranging request message may include one or more of a temporary identifier, a handover indication parameter, a location update request parameter, a paging controller TLV, and a CMAC tuple value (S1120).

Upon receiving the ranging request message, the target base station may transmit new location information of the terminal to a paging controller (PC) (S1130).

At this time, the terminal and the target base station may release the existing key count and reset to '0' and '1' to generate two TEK, respectively (S1140a and S1140b).

The target base station may transmit the ranging response message to the terminal in response to the ranging request message. In this case, the ranging response message may include at least one of a location update response parameter, a CMAC tuple, a new temporary identifier, and a new paging group identifier (S1150).

The terminal and the target base station may generate two new TEKs using the reset key count value (S1160a and S1160b).

In this case, the terminal and the target base station may check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN.

FIG. 12 is a diagram illustrating another key count management method when an idle mode terminal releases a key count according to another embodiment of the present invention.

When the location update is performed in the idle mode, the terminal AMS and the base station ABS may generate (or update) a new TEK. In this case, the TEK may be generated after the AK permission is made. If both the paging group to which the terminal belongs and the target base station are changed, an AK to be used by the terminal and the base station may be newly generated.

Most of the steps in the embodiment of the present invention described in FIG. 12 are performed in a similar manner to the embodiment described in FIG. However, there is a difference from FIG. 11 in the method of synchronizing the key count and the process of generating the TEK. Hereinafter, only portions that differ from FIG. 11 will be described. The remaining part may refer to FIG. 11.

The terminal and the target base station may check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN. In this case, the terminal and the target base station may release the existing key count and initialize the key count to a predetermined fixed value. At this time, the terminal and the target base station may be set to two consecutive key count values (S1240a, S1240b).

The terminal and the target base station may generate two new TEKs using the reset key count value (S1260a and S1260b).

FIG. 13 is a diagram illustrating one key count management method when an idle mode terminal does not release a key count according to another embodiment of the present invention.

When the location update is performed in the idle mode, the terminal AMS and the base station ABS may generate (or update) a new TEK after the AK permission is made. In this case, since both the paging group to which the terminal belongs and the target base station are changed, an AK to be used by the terminal may be newly generated. In this case, the terminal and the base station may update the TEK using the key count value previously maintained.

Referring to FIG. 13, the terminal AMS enters an idle mode from the serving base station S-ABS (S1310).

As the terminal moves to the neighboring base station area, the terminal may perform location update with the target base station (T-ABS). Therefore, the terminal may transmit the ranging request message to the target base station to perform the location update. In this case, the ranging request message may include one or more of a temporary identifier, a handover indication parameter, a location update request parameter, a paging controller TLV, and a CMAC tuple value (S1320).

The target base station receiving the ranging request message may transmit new location information of the terminal to a paging controller (PC) (S1330).

In order to generate two TEKs, the terminal and the target base station may continue to maintain the existing key count without releasing the existing key count even if the AK is newly generated. At this time, the terminal and the target base station can check whether the terminal and the base station is using the same TEK by referring to the EKS included in the PN (S1340a, S1340b).

The target base station may transmit the ranging response message to the terminal in response to the ranging request message. In this case, the ranging response message may include one or more of a location update response parameter, a CMAC tuple, a new temporary identifier, and a new paging group ID (S1350).

The terminal and the target base station may generate two new TEKs using the reset key count values (S1360a and S1360b).

FIG. 14 illustrates another key count management method when the idle mode terminal does not release the key count according to another embodiment of the present invention.

The description of FIG. 14 is mostly similar to FIG. 13. However, since there is a difference in FIG. 13 in the method of managing the key count and generating the TEK, the difference will be mainly described, and the rest will be described with reference to FIG. 13.

In FIG. 14, in order to generate two TEKs, the terminal and the target base station may continue to maintain the existing key count without releasing the existing key count even if the AK is newly generated. In this case, the terminal and the target base station may check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN. In addition, the terminal and the target base station may reset the key count values maintained by 1 by increasing the values by 1 (S1440a and S1440b).

The terminal and the target base station may generate two new TEKs using the reset key count value (S1460a and S1460b).

In idle mode  Upon network reentry or In idle mode  Key count management method when entering

When the terminal reenters the network in the idle mode, the terminal and the base station should generate (or update) a new TEK. However, generation of the TEK is possible after the AK grant is made at the base station. In another embodiment of the present invention, the paging group to which the terminal belongs does not change, and only the base station to be re-entry may or may not be changed. If the re-entry target base station is not changed, the AK does not change, and if the target base station is changed, the AK should be newly generated.

When the terminal enters the idle mode from the normal mode, if the key count is not maintained, the key count is initialized and the TEK is updated regardless of the AK. In addition, when the terminal enters the idle mode, when the key count is maintained, the previous key count may be reused or the TEK may be updated using the increased key count. However, if the AK has not changed, it is not necessary to initialize the key count, and it is sufficient to update the TEK using the previous key count or the incremented key count.

That is, as described above, the initialization of the key count is applicable only when the AK is reset. Synchronization of the key count can be made using the EKS included in the PN. That is, the terminal and the target base station can check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN. However, when the key count is released and the key count initialized upon network reentry is used, two TEKs are generated as in the case of initial authentication. Thus, the value of the key count used may be '0' and / or '1', or some other fixed value.

FIG. 15 is a diagram illustrating one key count management method when an idle mode terminal releases a key count while reentering a network according to another embodiment of the present invention.

When the terminal re-enters the network in idle mode, the terminal AMS and the base station ABS may generate (or update) a new TEK after the AK grant is made. In another embodiment of the present invention, the paging group to which the terminal belongs does not change, and the network reentry target base station may change. When the target base station is changed, it is preferable that the AK is newly generated. That is, the terminal and the base station can update the TEK by initializing the key count value.

Referring to FIG. 15, the terminal AMS enters an idle mode from the serving base station S-ABS (S1510).

As the terminal moves to a neighboring base station area, the terminal may re-enter the network managed by the target base station (T-ABS). Accordingly, the terminal may transmit a ranging request message to the target base station to synchronize with the target base station. In this case, the ranging request message may include one or more of a temporary identifier, a handover indication parameter, a paging controller TLV, and a CMAC tuple value (S1520).

The target base station receiving the ranging request message (e.g. AMS Info request) may request information related to the terminal (AMS information) by transmitting a request message to a paging controller (PC) (S1530).

The paging controller may transmit a response message (e.g. AMS Info response) to the target base station in response to the request message. In this case, the response message may include information related to the terminal mapped to the MAC address and the temporary identifier of the terminal (S1540).

The terminal and the target base station may synchronize the key count using the EKS included in the PN. In this case, the terminal and the target base station may release the existing key count and reset the key count to '0' and / or '1' to generate one TEK, respectively (S1550a and S1550b).

The target base station may transmit the ranging response message to the terminal in response to the ranging request message. In this case, the ranging response message may include one or more of a CMAC tuple and handover optimization information (HO Optimization Info.) For network reentry (S1560).

The terminal and the target base station may generate one new TEK using the reset key count value. In this case, the terminal and the target base station may generate a TEK using the method disclosed in Equation 1 (S1570a, S1570b).

FIG. 16 is a view illustrating another key count management method when an idle mode terminal releases a key count while reentering a network according to another embodiment of the present invention.

Basic assumptions and details of the embodiment of the present invention described in FIG. 16 are similar to those of FIG. 15. However, since there is a difference in the method of managing the key count, only a part different from FIG. 15 will be described below, and the remaining parts will be described with reference to FIG. 15.

Referring to FIG. 16, the terminal and the target base station may synchronize key counts using the EKS included in the PN. At this time, the terminal and the target base station may release the existing key count and initialize the key count to a predetermined fixed value other than '0' and / or '1' (S1650a and S1650b).

The terminal and the target base station may generate one new TEK, respectively, using the reset key count values (S1670a and S1670b).

FIG. 17 is a view illustrating one key count management method when an idle mode terminal does not release a key count while reentering a network according to another embodiment of the present invention.

When the terminal re-enters the network in idle mode, the terminal AMS and the base station ABS may generate (or update) a new TEK after the AK grant is made. In another embodiment of the present invention, the paging group to which the terminal belongs and the base station to which the network re-entry may not be changed. If the target base station is not changed, the AK is not changed. In this case, the AK may be maintained without initializing the key count value.

Referring to FIG. 17, the terminal AMS enters an idle mode from the serving base station S-ABS (S1710).

As the terminal moves to a neighboring base station area, the terminal may re-enter the network managed by the target base station (T-ABS). Accordingly, the terminal may transmit a ranging request message to the target base station to synchronize with the target base station. In this case, the ranging request message may include one or more of a temporary identifier, a handover indication parameter, a paging controller TLV, and a CMAC tuple value (S1720).

The target base station that receives the ranging request message (e.g. AMS Info request) may request information related to the terminal (AMS information) by transmitting a request message to a paging controller (PC) (S1730).

The paging controller may transmit a response message (e.g. AMS Info response) to the target base station in response to the request message. In this case, the response message may include information related to the terminal mapped to the MAC address of the terminal, the temporary identifier (S1740).

The terminal and the target base station may synchronize the key count using the EKS included in the PN. At this time, the terminal and the target base station may continue to maintain the existing key count without releasing the existing key count, respectively (S1750a, S1750b).

The target base station may transmit the ranging response message to the terminal in response to the ranging request message. In this case, the ranging response message may include at least one of a CMAC tuple and handover optimization information (HO Optimization Info.) For network reentry (S1760).

The terminal and the target base station may each generate two new TEKs using the previously maintained key count value. At this time, the terminal and the target base station may generate a TEK by using the method disclosed in Equation 1 (S1770a, S1770b).

FIG. 18 is a diagram illustrating another key count management method when an idle mode terminal releases a key count while reentering a network according to another embodiment of the present invention.

Basic assumptions and details of the embodiment of the present invention described in FIG. 18 are similar to those of FIG. 17. However, since there is a difference in the method of managing the key count, only a part different from FIG. 7 will be described below, and the remaining parts will be described with reference to FIG. 17.

Referring to FIG. 18, the terminal and the target base station can check whether the terminal and the base station are using the same TEK by referring to the EKS included in the PN. In this case, the terminal and the target base station may maintain the key count without releasing the existing key count. However, in FIG. 18, the terminal and the base station may set the existing key count value to 1 or a predetermined increased value (S1850a and S1850b).

The terminal and the target base station may generate two new TEKs respectively using the increased key count value (S1870a and S1870b).

19 is a view showing a method of generating TEK that can be applied to embodiments of the present invention.

Referring to FIG. 19, the terminal may perform an EAP-based authentication procedure in an initial access process with a base station (S1910).

After the authentication process, the terminal and the base station generate the PMK, AK and CMAC keys through the key negotiation process, verify the newly generated PMK, AK and CMAC keys, and perform the key negotiation process to exchange other key materials. You can (not shown).

At this time, the terminal and / or the base station calculates the master key (MSK) in the EAP-based authentication process. Most security keys are generated directly / indirectly using MSK at the terminal and / or base station. The terminal and / or the base station generates a pairwise master key (PMK) using the MSK, and the PMK is used to generate an authentication key (AK). The AK is used to generate TEK and CMAC key (Cipher-based Message Authentication Code Key) later (S1920).

In embodiments of the present invention, the key negotiation process may be performed in the following steps.

First, after the EAP-based authentication procedure is completed, the base station may transmit a first key negotiation message (e.g. AAI_PKM-RSP) including an arbitrary nonce (e.g. NONCE_ABS) to the terminal. The terminal may generate PMK, AK, and CMAC keys using the nonce. In addition, the terminal may transmit a second key negotiation message (e.g. AAI_PKM-REQ) including the nonce (e.g. NONCE_ABS, NONCE_AMS) used in the terminal and the base station. The base station may generate PMK, AK and CMAC keys using the nonce received from the terminal. Thereafter, the base station may transmit a third key negotiation message (e.g. AAI_PKM-RSP) including a nonce (e.g. NONCE_ABS, NONCE_AMS) and security association identifiers (SAIDs) to the terminal. Through this key negotiation process, the terminal and the base station can generate AK and exchange SAID, respectively.

In the embodiments of the present invention, a security association (SA) refers to a set of information required for confidentiality communication between a terminal AMS and a base station ABS. The security association may be shared through an advanced air interface (AAI) network between the terminal and the base station. Security associations are identified using security association identifiers. A security association can be used for each unicast flow.

This will be described with reference to FIG. 19 again. If the authentication key is newly generated in step S1920, the key count is reset. In this case, the key count may be reset to initial values '0' and / or '1', respectively (S1930).

In addition, when the authentication key is maintained without being newly generated in step S1920, the terminal and the base station may continue to maintain the key count without releasing the key count (S1940).

In embodiments of the present invention, since it is assumed that two TEKs are generated per security association (SA), the terminal and the base station preferably have two consecutive key counts.

The terminal and the base station may generate two TEKs using the set security association identifier (SAID), authentication key (AK), and key count. However, when the key count is not released (e.g. when reentering the network in idle mode), the terminal and / or the base station may generate only one TEK.

19 may be applied to the embodiments of the present invention described with reference to FIGS. 9 to 18.

20 is a diagram illustrating a terminal and a base station in which the embodiments of the present invention described with reference to FIGS. 2 to 19 are performed.

The terminal may operate as a transmitter in uplink and operate as a receiver in downlink. In addition, the base station may operate as a receiver in the uplink, and may operate as a transmitter in the downlink.

The terminal (AMS) and the base station (ABS) are antennas 2000 and 2010 capable of transmitting and receiving information, data, signals, and / or messages, and a transmission module (Tx module; 2040 and 2050) for controlling a antenna and transmitting a message. A reception module (Rx module) 2060 and 2070 for receiving a message by controlling an antenna; a memory 2080 and 2090 for storing information related to communication with a base station; and a processor 2020 for controlling a transmission module, a reception module, and a memory , 2030).

The antennas 2000 and 2010 transmit a signal generated by the transmission modules 2040 and 2050 to the outside, or receive a wireless signal from the outside and transmit the signal to the receiving modules 2060 and 2070. If a multiple antenna (MIMO) function is supported, two or more antennas may be provided.

Processors 2020 and 2030 typically control the overall operation of a mobile station or base station. In particular, the processor is a control function for performing the above-described embodiments of the present invention, a medium access control (MAC) frame variable control function according to service characteristics and a propagation environment, a power saving mode function for controlling idle mode operation, and handover (Hand Over), authentication and encryption can be performed.

In addition, the processors 2020 and 2030 may each include an encryption module for controlling encryption of various messages. For example, the mobile station and the base station may perform the methods described with reference to FIGS. 2 to 12 using a processor and an encryption module included in the processor.

The transmission modules 2040 and 2050 may perform a predetermined coding and modulation on signals and / or data that are scheduled from a processor and transmitted to the outside, and then may be transmitted to the antennas 2000 and 2010.

The receiving modules 2060 and 2070 decode and demodulate the radio signals received through the antennas 2000 and 2010 from the outside to restore the original data to the processor 2020 and 2030. I can deliver it.

The memory 2080 and 2090 may store a program for processing and controlling a processor, and input / output data (in the case of a mobile station, an UL grant allocated from a base station, system information, STID, and FID). , Operation time, region allocation information, frame offset information, etc.) may be temporarily stored.

In addition, the memory may be a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, SD or XD memory), RAM Random Access Memory (RAM), Static Random Access Memory (SRAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Read-Only Memory (PROM), Magnetic Memory, Magnetic It may include a storage medium of at least one type of disk, optical disk.

Hereinafter, the functions of the terminal and the base station apparatus will be described in more detail.

The counter and the base station apparatus described in FIG. 13 may further include a counter (not shown). The counter may be a module (or means) for processing a key count used in embodiments of the present invention, configured independently of other modules or included in the processors 1320, 1330. The key count value processed by the counter may be stored in the counter itself or in each of the memories 1380 and 1390.

In embodiments of the present invention, the key count is preferably initialized after the authentication or reauthentication is completed. When the key count is initialized, the value of the key count may be set to two consecutive values of '0' and '1'. However, when the terminal releases the key count in the idle mode and uses the key count initialized when reentering the network, only one TEK needs to be generated unlike the initial authentication, so that the terminal and the base station set the key count value to '0' or the like. Can be set to '1'.

In FIG. 13, a processor of a terminal may perform an initial authentication and re-authentication process and a key negotiation process with a serving base station. In addition, the processor may manage the key count value, and may generate and update the TEK by the method described in Equation 1 using the key count value.

The terminal and the base station apparatus of FIG. 13 may perform functions for transmitting and receiving messages, managing key count values, and generating a TEK in each communication environment described with reference to FIGS. 2 to 12. That is, the mobile station and the base station can perform the operations described with reference to FIGS. 2 to 12 according to the respective functions using the above-described components.

Meanwhile, in the present invention, the terminal is a personal digital assistant (PDA), a cellular phone, a personal communication service (PCS) phone, a GSM (Global System for Mobile) phone, a WCDMA (Wideband CDMA) phone, an MBS. A Mobile Broadband System phone, a hand-held PC, a notebook PC, a smart phone, or a Multi Mode-Multi Band (MM-MB) terminal may be used.

Embodiments of the invention may be implemented through various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

In the case of a hardware implementation, the method according to embodiments of the present invention may include one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs). Can be implemented by field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, and / or microprocessors.

In the case of an implementation by firmware or software, the method according to the embodiments of the present invention may be implemented in the form of a module, a procedure, or a function that performs the functions or operations described above. For example, software code may be stored in the memory units 1380 and 1390 and driven by the processors 1320 and 1330. The memory unit may be located inside or outside the processor, and may exchange data with the processor by various known means.

The invention can be embodied in other specific forms without departing from the spirit and essential features of the invention. Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention. In addition, the claims may be combined to form an embodiment by combining claims that do not have an explicit citation relationship or may be incorporated as new claims by post-application correction.

Embodiments of the present invention can be applied to various wireless access systems. Examples of various radio access systems include 3rd Generation Partnership Project (3GPP), 3GPP2 and / or IEEE 802.xx (Institute of Electrical and Electronic Engineers 802) systems. Embodiments of the present invention can be applied not only to the various radio access systems, but also to all technical fields to which the various radio access systems are applied.

Claims (18)

In the method of managing the key count,
Performing an authentication procedure with the base station;
Exchanging a key material including a nonce in a key negotiation process with the base station;
Generating an authentication key (AK) using the key material in the key negotiation process;
Setting two key counts having consecutive values; And
And generating two traffic encryption keys (TEKs) using a security association identifier (SAID) shared with the base station, the authentication key, and the two key counts. The method of claim 1,
Wherein the two key counts are initialized when handover, network reentry, location update in idle mode and network reentry in idle mode, respectively. The method of claim 2,
And the network re-entry is due to a handover due to unregulated handover or loss of connection. The method of claim 2,
Wherein the two TEK updates are due to the end of each TEK lifetime. The method of claim 1,
The two TEKs are generated using a Dot16KDF algorithm. The method of claim 1,
And when the AK is newly generated, the two key counts are initialized. In the method of managing the key count,
Performing an authentication procedure with the terminal;
Exchanging a key material including a nonce in a key negotiation process with the terminal;
Generating an authentication key (AK) using the key material in the key negotiation process;
Setting two key counts having consecutive values; And
And generating two traffic encryption keys (TEKs) using a security association identifier (SAID) shared with the terminal, the authentication key, and the two key counts. The method of claim 7, wherein
Wherein the two key counts are initialized when handover, network reentry, location update in idle mode and network reentry in idle mode, respectively. The method of claim 8,
And the network re-entry is due to a handover due to unregulated handover or loss of connection. The method of claim 8,
Wherein the two TEK updates are due to the end of each TEK lifetime. The method of claim 7, wherein
The two TEKs are generated using a Dot16KDF algorithm. The method of claim 7, wherein
And when the AK is newly generated, the two key counts are initialized. In a terminal for managing a key count, the terminal,
A sending module for sending a message;
A receiving module for receiving a message; And
A processor for managing the key count;
The processor comprising:
Performing an authentication procedure with the base station;
Exchanging a key material including a nonce in a key negotiation process with the base station;
Generating an authentication key (AK) using the key material in the key negotiation process;
Setting two key counts having consecutive values; And
And generating two traffic encryption keys (TEKs) using a security association identifier (SAID) shared with the base station, the authentication key, and the two key counts. The method of claim 13,
The two key counts are respectively initialized when handover, network reentry, location update in idle mode and network reentry in idle mode. The method of claim 14,
The network re-entry is due to a handover due to unregulated handover or loss of connection. The method of claim 14,
The two TEK updates are due to the end of each TEK duration. The method of claim 13,
The two TEKs are generated using a Dot16KDF algorithm. The method of claim 13,
And when the AK is newly generated, the two key counts are initialized.

Images