WO2011006390A1

WO2011006390A1 - Method and device for generating security keys

Info

Publication number: WO2011006390A1
Application number: PCT/CN2010/072691
Authority: WO
Inventors: 李静岚
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-07-15
Filing date: 2010-05-12
Publication date: 2011-01-20

Abstract

A method for generating security keys is disclosed. During generating the three keys of the Access Stratum(AS), if the encryption algorithm is a null algorithm, a Key Derivation Function (KDF) needs to be called only once to generate the signaling integrity protection key, while the signaling confidentiality key and the user data confidentiality key are directly set to zero; if the encryption algorithm is not a null algorithm, the parameters for generating any two of the cipher keys are spliced to obtain the two keys during the process of calling the KDF once. Therefore, generating the three keys needs to call the KDF only twice. A device for generating security keys is disclosed simultaneously by the invention. With the method or device of the invention, the resource utilization ratio of generating keys can be improved and the delay of the whole cipher key generating system can be decreased.

Description

Method and device for generating security key

The present invention relates to the field of mobile communication security, and in particular, to a method and apparatus for generating a security key. Background technique

In the Long Term Evolution (LTE) system, the RRC (Radio Resource Control) function of the network is placed on the evolved Node B (eNB, Evolved NodeB), so the corresponding security protection mechanism of the RRC is also followed. Placed in the eNB. Due to the large number of eNB deployments and the wide distribution area, each network entity between the access layers is highly geographically and logically decentralized. The operators cannot implement centralized security control at all. Each eNB is at A non-secure area, so each eNB needs to generate a key for the access layer (AS, Access Stratum) security mechanism between each user equipment (UE, User Equipment).

According to the description of the 3GPP TS33.401 protocol, in the initial context establishment process initiated by the Mobility Management Entity (MME) of the core network, after receiving the initial context setup request message of the MME, the eNB needs to be based on the initial context. The AS root key K _eNB carried in the request message is established, and three keys for AS integrity protection and encryption are generated by using a Key Derivation Function (KDF): Signaling integrity protection key Κι^ _ΙηΡ signaling encryption key Κ]^ _Εη . The user data encryption key K _UpEne , the length of each of the three keys is a fixed length of 128 bits.

When fresh next hop (NH, Next Hop) value or the current K _eNB, AS generates a new root key K * _eNB RRC network switching occurs immediately or reconstruction, according to the need to provide the core network MME; when no fresh The NH value needs to be based on the target physical cell ID (PCI, Target Physical Cell). ID), the physical target cell ^ "the carrier frequency (EARFCN-DL, Target Physical Cell Downlink Frequency) generate K * _eNB. Generate K * _eNB, AS then generates integrity protection and ciphering for use according to the KDF K * _eNB Three keys.

KDF uses the HMAC-SHA-256 (Keyed-Hash Message Authentication Code - Secure Hash Algorithm-256) algorithm, which has two input parameters, one is the string (S), and the other is the AS root key (Key). These two parameters are variable length. In the LTE system, the Key is fixed 256 bits; the output of the KDF is fixed to 256 bits.

In the prior art, the process of generating three keys Kfocmt KfocEnc K _UpEnc using KDF is as shown in FIG. 1:

Step 101: Constructed separately for generating Kfocmt

K _UpEnc 's KDF string input parameters SI, S2, S3;

Constructed separately to generate Κ _η ι,

K _UpEnc 's KDF string input parameters S1, S2, S3, where

Where: ΊΓ indicates concatenation; FC is the KDF instance identifier, which is used to identify different KDF instances. When KDF is used to generate three security keys for AS, the value is 0x15; POi is the algorithm type identifier ( algorithm type distinguisher ), the specific values are shown in Table 1; LOi is the byte length; the above i represents the Rrclnt, RrcEnc, and UpEnc in the formula; In this paper, the parameters of Rrclnt, RrcEnc, and UpEnc as subscripts are respectively used to generate

K _UPENC parameters; where POfocmt corresponds to RRC-int-alg; Ρ0]^ _{Εη in} Table 1. Corresponding to RRC-enc-alg in Table 1; P0 _UpEnc corresponds to UP-enc-alg; ?1 in Table 1, which is the algorithmic identity of the encryption or integrity protection algorithm used. The specific values are shown in Table 2. For example: When the selected encryption algorithm is an empty algorithm, that is, the Null ciphering algorithm in Table 2, the value of Pli is 0x00. However, according to the description of the 3GPP TS33.401 protocol, the algorithm for Κ]^ _Ιηί cannot be an empty algorithm; ^ is the length of the byte;

Table 2

Step 102: When the RRC initial security activation of the network, the input parameter of the KDF is S1 and

K _eNB ; In the RRC handover or re-establishment of the network, the input parameters of the KDF are S1 and K* _eNB ; the KDF is called to obtain a 256-bit KDF output string;

Step 103: Intercept the lower 128 bits of the KDF output string as

Step 104: When the RRC initial security activation of the network, the input parameters of the KDF are S2 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters of the KDF are S2 and K* _eNB ; and the KDF is invoked to obtain the 256-bit KDF. Output string;

Step 105: Intercept the lower 128 bits of the KDF output string as 3⁄4^^;

Step 106: When the RRC initial security activation of the network, the input parameters of the KDF are S3 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters of the KDF are S3 and K* _eNB ; and the KDF is invoked to obtain the 256-bit KDF. Output string;

Step 107: Intercept the lower 128 bits of the KDF output string as K _UpEnc .

As you can see from the above process, in order to generate three keys for the AS, you need to call it three times. KDF, each call gets a key; and each time the KDF output is 256 bits, but each key requires only 128 bits, so each call process only utilizes a portion of the KDF output. Obviously, such a key generation method not only reduces resource utilization, but also increases the latency of the entire key generation system. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for generating a security key, improve the utilization of key generation resources, and reduce the delay of the entire key generation system.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention implements a security key generation method. When generating a security key of an access layer AS, the method includes:

If the encryption algorithm chosen is an empty algorithm:

The signaling encryption key and the user data encryption key are directly set to 0; a string input parameter of KDF for generating a signaling integrity protection key is constructed, KDF is called, and signaling integrity is generated by the obtained KDF output string. Protection key

If the chosen encryption algorithm is not empty:

Constructing a string input parameter of KDF for generating a signaling integrity protection key, a signaling encryption key, and a user data encryption key, and calling KDF, generating the two by using the obtained KDF output string Key

Constructing a string input parameter of KDF for generating a signaling integrity protection key, a signaling encryption key, and a remaining one of the user data encryption keys, calling KDF, and generating a KDF output string Said key.

The string input parameter of the KDF configured to generate the signaling integrity protection key is specifically: selecting a parameter for generating a signaling integrity protection key: a KDF instance identifier, an algorithm type identifier, and an algorithm type identifier Byte length, integrity protection algorithm identifier, byte length of the integrity protection algorithm identifier, the parameters are concatenated, and the KDF string input parameter is constructed. Number.

And when the selected encryption algorithm is an empty algorithm, generating a signaling integrity protection key by using the received KDF output string, specifically: intercepting 128 bits of the KDF output string as the signaling integrity protection key .

The string input parameter for generating the KDF of the two keys specifically includes: splicing the parameters respectively used to generate the two keys into a string as a string input parameter of the KDF.

The parameters used to generate the two keys are respectively spliced into a string, which is specifically: selecting two secrets used to generate a signaling integrity protection key, a signaling encryption key, and a user data encryption key. The parameters of the key, including: the KDF instance identifier, the algorithm type identifier, the byte length of the algorithm type identifier, the encryption or integrity protection algorithm identifier, the encryption or the byte length of the integrity protection algorithm identifier, and the parameters are serially spliced Make up a string.

The method for generating a security key, if the selected encryption algorithm is not a null algorithm, the generating the two keys is specifically: intercepting 128 bits of the KDF output string as the two secrets a key in the key, and then intercepting 128 bits of the KDF output string as the other of the two keys;

The generating the key is specifically: intercepting 128 bits of the KDF output string as the remaining one key.

The calling KDF is specifically as follows: KDF obtains the KDF output string by using an AS root key and the KDF string input parameter as input parameters.

The present invention implements a security key generating apparatus, and the apparatus includes:

a first string parameter construction module, configured to generate two of a signaling integrity protection key, a signaling encryption key, and a user data encryption key when the selected encryption algorithm is not a null algorithm The first string input parameter of KDF;

a second string parameter construction module, configured to: when the selected encryption algorithm is not a null algorithm Generating a second string input parameter of KDF for generating a signaling integrity protection key, a signaling encryption key, and a remaining one of the user data encryption keys, transmitted to the KDF processing module; When the algorithm is an empty algorithm, constructing a second string input parameter of the KDF for generating a signaling integrity protection key, and transmitting the parameter to the KDF processing module;

a KDF processing module, configured to obtain a KDF output string, and send the KDF output string obtained by the first string input parameter of the KDF to the first key generation module and the second key generation module respectively; The KDF output string obtained by the second string input parameter of the KDF is sent to the third key generation module;

a first key generation module, configured to generate one of the two keys by using the received KDF output string when the selected encryption algorithm is not a null algorithm; the selected encryption algorithm is empty In the algorithm, 0 is used as a signaling encryption key or a user data encryption key;

a second key generating module, configured to generate another one of the two keys by using the received KDF output string when the selected encryption algorithm is not a null algorithm; When the algorithm is empty, the module uses 0 as the user data encryption key or the signaling encryption key. The third key generation module is configured to output the character through the received KDF when the selected encryption algorithm is not empty. The string generates the remaining one key; when the selected encryption algorithm is a null algorithm, the signaling integrity protection key is generated by the received KDF output string.

The device also includes:

The AS root key module is used to provide an AS root key to the KDF processing module.

The invention provides a security key generation method and device, when generating three keys of an AS: If the encryption algorithm is an empty algorithm, Κ]^ _Εικ and K _{UpEnc are} directly set to 0, and only need to call KDF once. Generate Kfodnt; If the encryption algorithm is not empty, the parameters used to generate any two keys are spliced, and then the KDF process is called to obtain the two keys, thus, the three keys The generation only needs to call KDF twice, thus omitting a complicated key generation process, and omitting the key generation process twice when the encryption algorithm is empty. However, the amount of calculation of key generation and the delay of the key generation system can be reduced, especially when multiple UEs are simultaneously accessed. DRAWINGS

1 is a schematic diagram of a process of generating three keys for an AS in the prior art;

2 is a schematic flowchart of a method for generating a security key in the present invention;

FIG. 3 is a schematic flowchart of a method for generating a security key when an encryption algorithm selected in the present invention is an empty algorithm;

4 is a schematic flow _chart of a method for generating a security key in a process of calling KDF in a process according to the present invention;

Figure 5 will be in the present invention

Schematic diagram of the method of the security key generated during a call to the KDF process;

Figure 6 is a view of the present invention

Schematic diagram of the method of the security key generated by K _UpEnc in a KDF process;

FIG. 7 is a schematic structural diagram of an apparatus for implementing generation of a security key in the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The basic idea of the present invention is: When generating a security key for an AS, if the selected encryption algorithm is an empty algorithm, which is equal to not performing the encryption process, then the generation may not be performed.

Κ _υρΕ , then directly

Otherwise, construct a string input parameter for generating KDF for any two of these keys, call KDF, and generate the two keys from the resulting KDF output string; finally, construct the one used to generate the remaining one. The KDF output string, called KDF, is generated from the resulting KDF output string.

Embodiment 1: The process of generating a security key is as shown in FIG. 2, before the security key is generated, the communication parties of the network negotiate the interception mode of the KDF output string for generating the three keys, and Preferably, the interception methods are not the same, that is, the generated three keys are different, which can enhance security. The method includes the following steps:

Step 201: If the selected encryption algorithm is a null algorithm, and the encryption process is not performed, then the _3⁄4 ^^ and K _UpEnc keys may be directly set to 0, and the process _proceeds to step 205. If the selected encryption algorithm is not empty, then go to step 202;

Step 202: When the selected encryption algorithm is not a null algorithm, select

The two of K RxcEnc and K _UpEnc are the first key K _AS1 and the second key K _AS2 , respectively, and the respective parameters for generating K _AS1 and K _AS2 are selected and spliced into one for generating 1^ ₈₁ and K _AS2. The KDF string input parameter (S1);

Select the parameters used to generate the K _AS :: P0 _Keyl , L0 _Keyl ,

Ll _Keyl, and a parameter for generating the K _{_{_AS2: P0 Key2, L0 Key2, Pl}} Key2 and Ll _Key2; FC = 0xl5; the parameters used to generate K _AS1 ^ K _AS2 spliced to a string input parameter S1 KDF, i.e. :

_{S1 = FC II P0 Keyl II L0} Keyl II Pl Keyl II Ll Keyl II P0 Key2 II L0 Key2 ll Pl Key2 II Ll Key2; wherein, ΊΓ is the series, PO ^^ selected according to Table 1, Pl ^^ selected according to Table 3, 1^0 ₁ is? 0 ₁ byte length, ! ^ is the length of the byte, according to Table 1 and Table 3, ! The value of ^, is 0x0001, that is, one byte length, where i represents Keyl, Key2, Keyl, and Key2 are respectively two of Rrclnt, RrcEnc, and UpEnc corresponding to K _AS1 and K _AS2 ;

table 3

Step 203: Invoke KDF. When the RRC initial security activation of the network, the input parameters are S1 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters are S1 and K* _eNB ; and the 256-bit KDF output character is obtained. string; Step 204: According to the interception manner negotiated by the communication parties of the network, respectively intercept different 128 bits of the KDF output string as K _AS1 and K _AS2 ;

Step 205: When the selected encryption algorithm is a null algorithm, Kfocmt is used as the third key K _AS3 ; when the selected encryption algorithm is not empty, the remaining one of Κ]^, _3⁄4 ^^, and K _{UpEnc is selected} . is K _AS3; configured for generating a character string of the input parameters of the KDF K _AS3 (S2);

When the selected encryption algorithm is an empty algorithm, the parameter Pfocmp LOfoe , Plfoc 0X15 for constructing S2 is selected, and the structure S2 is: S2=FC II PORrcint II LORrcint II PlRrcI

among them,

1 select; select 0x04; be the byte length of POfoe, Llfocmt is the byte length of Plfocmt, according to Table 1 and Table 3, LOfoe,

Llfocmt has a value of 0x0001, which is one byte in length;

When the selected encryption algorithm is not empty, select the remaining one of _3⁄4 ^^ and K _UpEnc as K _AS3 , and select the parameters P0 _Key3 , L0 _Key3 , Pl _Key3 , Ll _Key3 , FC for generating S2 of K _AS3 . = 0xl5, construct S2 as:

S2=FC II P0 _Key3 II L0 _Key3 II Pl _Key3 II Ll _Key3 ;

Among them, P0 _{Key3 is} selected according to Table 1, Pl _{Key3 is} selected according to Table 3, L0 _Key3 is the byte length of P0 _Key3 , Ll _Key3 is the byte length of Pl _Key3 , according to Table 1 and Table 3, L0 _Key3 , Ll _Key3 The value is 0x0001, which is a byte length, and Key 3 is one of Rrclnt, RrcEnc and UpEnc corresponding to K _AS3 ;

Step 206: Invoke KDF, when the initial RRC security activation of the network, the input parameter is

S2 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters are S2 and K* _eNB ; obtaining a 256-bit KDF output string;

Step 207: According to the interception manner negotiated by both parties of the network, intercept 128 bits of the KDF output string as K _AS3 , and the current security key generation process ends.

By the above method, each of K _AS1 , K _AS2 and K _AS3 can be obtained. And K _UpEnc „

Embodiment 2: When the selected encryption algorithm is a null algorithm, the interception of the KDF output string is performed by intercepting the high or low 128 bits of the KDF output string. The embodiment of the method for generating a security key in the present invention, such as As shown in Figure 3, the following steps are included:

Step 301: Directly set the signaling encryption key and the data encryption key to 0, that is, Κ]^ _Ε =0,

KupEnc-0;

Step 302: Construct for generation

KDF string input parameter (S);

Select the parameters used to generate Kfocmt: POfoe , LOfoe . Plfoe ,

FC = 0x15 , the string input parameters of the constructed KDF are:

S=FC II PORrcint II LORrcint II PIRTC II LI J-C ,

among them,

1 select, that is, POfocmt is 0x04, 3 is selected,

The byte length of PO W, 字节字节 byte length, according to Table 1 and Table 3, LOfoe, Llfocmt are all 0x0001, that is, one byte length, for example:

According to Table 3, when Plfocmt is 128-EIA1 SNOW 3G:

S=Oxl5IIOx04IIOx0001IIOx01IIOx0001,

As another example, when PlRrdnt is 128-EIA2 AES:

S=Oxl5IIOx04IIOx0001IIOx02IIOx0001;

Step 303: Invoke KDF. When the RRC initial security activation of the network, the input parameters are S and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters are S and K* _eNB ; and the 256-bit KDF output character is obtained. string;

Step 304: Intercept the high or low 128 bits of the KDF output string as Κ]^ _Ιηί .

Embodiment 3: When the selected encryption algorithm is not a null algorithm, _3⁄4 ^^ and K _UpEnc are generated in a process of calling KDF, and the interception of the KDF output string is performed by intercepting a high 128 bits of the KDF output string. An embodiment of the method for generating a security key, as shown in FIG. 4, includes the following steps: Step 401: Select for generation

K _UpEnc parameters, and spliced into KDF string input parameters (S1);

Specifically, select the parameters used to generate KfocEnc: PORrcEnc.LO RrcEnc ^ PlRrcEnc ^ L1 ^ _οΕώο , and the parameters used to generate K _UpEnc : P0 _UpEnc , L0 _UpEnc , Pl _UpEnc , Ll _UpEnc ; where PO, according to Table 1 Select, Pl ^ selected according to Table 3, ! ^ is the length of the byte, ! ^为? The byte length of ^, according to Table 1 and Table 3, is 0x0001, which is a byte length, where i represents RrcEnc, UpEnc, that is, according to Table 1, Ρ0]^ _Εικ is 0x03, P0 _UpEnc is 0x05 ; String input parameters spliced into KDF for generating _3⁄4 ^^ and K _UpEnc are:

S 1 =FCI IPO TCEOCI ILO rcEncl IP 1 RrcEncl IL 1 RrcEncl IPOupEncl ILOupEncl IP 1 UpEncl IL 1 UpEnc, Column ^:

According to Table 3, when PlfocEnc and Pl _UpEnc are 128-EIA1 SNOW 3G,

Sl=Oxl5IIOx03IIOx0001IIOx01IIOx0001IIOx05IIOx0001IIOx01IIOx0001, or, when PlfocEnc and Pl _UpEnc are 128-EEA2 AES based algorithm: Sl=Oxl5IIOx03IIOx0001IIOx02IIOx0001IIOx05IIOx0001IIOx02IIOx0001;

Step 402: Invoke KDF, when the initial RRC security activation of the network, the input parameter is

S1 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters are S1 and K* _eNB ; obtaining a 256-bit KDF output string;

Step 403: Intercept the high 128 bits of the KDF output string as the lower 128 bits of the KDF output as K _UpEnc ; or, intercept the upper 128 bits of the KDF output string as K _UpEnc , and intercept the lower 128 bits of the KDF output as Κ]^ ^;

Step 404: Construct for generation

KDF string input parameter (S2):

Select the parameters used to generate Kfocmt: POfoe , LOfoe . Plfoe ,

FC = 0x15 , the string input parameters for the generated KDF are:

S2=FCIIP0 _Rrc i _nt IIL0 _Rrc i _nt IIPl _Rrc i _nt IILl Rrclnt?

Where P0 _{RrcInt is} selected according to Table 1, PO focmt is 0x04; Pl R^nt is selected according to Table 3,

The length of the byte of P0 _{RrcInt is} the byte length of Pl _RrcInt . According to Table 1 and Table 3, the value of LOfocmt Llfocmt is 0x0001, which is a byte length, for example:

According to Table 3, when Plfocmt is 128-EIA1 SNOW 3G:

S2=0X15II0X04II0X0001II0X01II0X0001,

Or when PlRrdnt is 128-EIA2AES:

S2=0X15II0X04II0X0001II0X02II0X0001;

Step 405: Invoke KDF. When the RRC initial security activation of the network, the input parameters are S2 and K _eNB ; when the RRC handover or re-establishment of the network, the input parameters are S2 and K* _eNB ; and the 256-bit KDF output character is obtained. string;

Step 406: Intercept the high or low 128 bits of the KDF output string as _3⁄4 ^ _113⁄4 .

Embodiment 4: When the selected encryption algorithm is not a null algorithm, 3⁄4^^ and 3⁄4^^ are generated in a process of calling KDF, and the interception of the KDF output string is performed by intercepting the KDF output string by 128. An embodiment of the method for generating a security key, as shown in FIG. 5, includes the following steps:

Step 501: Select various parameters for generating _3⁄4 ^ _113⁄4 and Κ]^ _Εικ , and splicing into a string input parameter (S1) of KDF;

Specifically, select for generation

Parameters used to generate KRrcEnc: PORTCEIIC, L0 RrcEnc, P 1 RrcEnc, L 1 RrcEnc; FC=0x 15; stitched into for generation

The string input parameters for KDF are:

SlzFCIIPO rcintllLO rcintllPl rcintlLl rcintllPO rcEncllLO rcEncllPl RrcEnc IILl RxcEnc, where ΡΟ^^ is selected according to Table 1, Pl^^ according to Table 3, ! ^ is the length of the byte, ! ^ is the length of the byte, according to Table 1 and Table 3, the value of LO is 0x0001, that is, a byte length, where i represents Rrclnt, RrcEnc, that is, according to Table 1, POR W is 0x04,

POfocEnc is 0x03; for example:

According to Table 3, when Plfodnt is 128-EIA1 SNOW 3G and Ρ1]^ _Εη . 128-EEA1 When SNOW 3G based algorithm:

Sl=Oxl5IIOx04IIOx0001IIOx01IIOx0001IIOx03IIOx0001IIOx01IIOx0001;

For another example, when PlRr _Clnt is 128-EIA2 AES and PlRr _cEnc is 128-EEA2 AES based algorithm:

Sl=OxlllOx04IIOx0001IIOx02IIOx00015IIOx03IIOx0001IIOx02IIOx0001;

For another example, when PlRrdnt is 128-EIA1 SNOW 3G and PlRr _cEnc is 128-EEA2 AES based algorithm:

Sl=Oxl5IIOx04IIOx0001IIOx01IIOx0001IIOx03IIOx0001IIOx02IIOx0001;

For another example, when Plfodnt is 128-EIA2 AES and 1]^1^ is 128-EEA1 SNOW 3G based algorithm:

Sl=Oxl5IIOx04IIOx0001IIOx02IIOx0001IIOx03IIOx0001IIOx01IIOx0001; Step 502: Invoke KDF, when the RRC initial security activation of the network, its input parameters are S1 and K _eNB ; when the network is RRC handover or re-establishment, its input parameters are S1 and K* _eNB ; get 256 bits KDF output string;

Step 503: Intercept the high 128 bits of the KDF output string as

Intercept the lower 128 bits of the KDF output string as

Or intercept the high 128 bits of the KDF output string as

Intercept the lower 128 bits of the KDF output string as

Step 504: Construct a string input parameter (S2) for generating KDF of K _UpEnc ; select parameters for generating K _UpEnc : P0 _UpEnc , L0 _UpEnc ,

Ll _UpEnc , FC, The string input parameters of the KDF constructed to generate K _UpEnc are:

Where ΊΓ denotes concatenation, P0 _{UpEnc is} selected according to Table 1, ie P0 _UpEnc is 0x05, Pl _{UpEnc is} selected according to Table 3, L0 _UpEnc is the byte length of P0 _UpEnc , Ll _UpEnc is the byte length of Pl _UpEnc , according to Table 1 and Table 3, L0 _UpEnc , Ll _UpEnc are all 0x0001, that is, one byte length, FC = 0xl5; For example: According to Table 3, when Pl _UpEnc is 128-EIA1 SNOW 3G:

S2=0X15II0X05II0X0001 II0X01 II0X0001;

As another example, when Pl _UpEnc is 128-EIA2 AES:

S2=0X15II0X05II0X0001 II0X02II0X0001;

Step 505: Invoke KDF, when the initial RRC security activation of the network, the input parameter is

Step 506: Intercept the high or low 128 bits of the KDF output string as K _UpEnc .

Embodiment 5: When the selected encryption algorithm is not a null algorithm,

In the process of invoking the KDF, the interception of the KDF output string is performed by intercepting the high or low 128 bits of the KDF output string. The present invention implements a method for generating a security key, as shown in FIG. , including the following steps:

Step 601: Select for generation

Κ _υρΕη . Each parameter, and spliced into a string input parameter (S1) for generating KDF and _KUpEnc ;

Specifically, select the parameters used to generate Kfocmt: POfocmt . LOfoe . Plfoeint ^ Ll^, parameters for generating K _UpEnc : P0 _UpEnc , L0 _UpEnc , Pl _Up Enc , Ll _UpEnc ; FC=0xl5;

And K _UpEnc 's KDF string input parameters are:

S 1 =FCI IPORrdntllLORrcintl IP 1 Rrclntl IL 1 Rrclntl IPOupEncl ILOupEncl IP 1 UpEncl IL 1 UpEnc; where ΊΓ indicates concatenation, selected according to Table 1, selected according to Table 3, 1^0 ₁ is? 0 ₁ byte length, ! ^ is the length of the byte, according to Table 1 and Table 3, ! The value of ^, is 0x0001, which is a byte length, where i represents Rrclnt, UpEnc, that is, according to Table 1, ΡΟ^ι^ is 0x04, P0 _UpEnc is 0x05;

E.g:

According to Table 3, when PlRrdnt is 128-EIA1 SNOW 3G and Pl _UpEnc is 128-EEA1 SNOW 3G based algorithm: ^F ^ —^ Ί ooo^o TM ^ ^uaoj3⁄4 oi i Ύ

£

o ^uaoj3⁄4 id 'εοχο ^ ^ouaoj3⁄4 od ^ ' ^3⁄4 I f » ^ouaoj3⁄4 od '^ ^ "ii,, 'ψ^

: ^ Y φ da3⁄4 ^ ^{ouaoj3⁄4 3⁄4} ^l O=Dd

' ^ou a ^oj 3⁄4 i , ^ou a ^oj 3⁄4 J ,

:( ) Y φ d Dl ^TM3⁄4 " - -ί- :W)9

8Π dd3⁄4 ''° ^{uadn 3⁄4} 8Π φ ^^ si da3⁄4 'TM3⁄4 ^^' φ da3⁄4 : εο9 ^

• ^9N3 , 3⁄4 4 is ^ Y ^ ' 3⁄4 ^ Cover ^ D3⁄43⁄4 · ^{9Ν3 3⁄4} 4 is

^:^ ^ ' ^3⁄4- D3⁄43⁄4 k^U^ 'da3⁄4 tirT : Π)9 ^

• I000 ^X 0III0 ^X 0III000 ^X 0IIS0 ^X 0III000 ^X 0II^0 ^X 0III000 ^X 0II170 ^X 0IISI ^X 0=IS Οΐ ssBq og 7 ONS 1¥33"8^1 ^ ^ouadn Id 'SHV ^¥13"8^1 ^TM Id '. F

• I000 ^X 0II^0 ^X 0III000 ^X 0IIS0 ^X 0III000 ^X 0III0 ^X 0III000 ^X 0II170 ^X 0IISI ^X 0=IS 9SBq SHV ^VHH-8^I ^ ^ouadn Id 'DC AONS 1¥13"8^1 ^ ^TMId '. f Y s

• I000 ^X 0II^0 ^X 0III000 ^X 0IIS0 ^X 0III000 ^X 0II^0 ^X 0III000 ^X 0II170 ^X 0IISI ^X 0=IS

^{^{^{• I000 X 0III0 X 0III000 X 0IIS0}}} X 0III000 X 0III0 X 0III000 X 0II170 X 0IISI X 0 = IS

T69Z.0/0l0ZN3/X3d 06C900/llOZ OAV According to Table 3, when? 1]^^ is 128-EIA1 SNOW 3G:

S2=0X15II0X03II0X0001II0X01II0X0001;

Another example, when? 1]^^ is 128-EIA2 AES:

S2=0X15II0X03II0X0001II0X02II0X0001;

Step 605: Invoke KDF. When the RRC initial security activation of the network, the input parameters are S2 and K _ENB ; when the network is RRC switched or re-established, its input parameters are S2 and K* _ENB ; and 256-bit KDF output characters are obtained. string;

Step 606: Intercept the high or low 128 bits of the KDF output string as 3⁄4^^.

Based on the above method, in the device for implementing security key generation in the present invention, before the security key is generated, the communication parties of the network negotiate the interception mode of the KDF output string for generating the three keys, and each interception method is best. Don't be the same, that is, the generated three keys are different. As shown in Figure 7, the device includes:

The first character string parameter construction module 71, the second character string parameter construction module 72, the KDF processing module 74, the first key generation module 75, the second key generation module 76, and the third key generation module 77;

The first string parameter construction module 71 is configured to generate two parameters, namely, a signaling integrity protection key, a signaling encryption key, and a user data encryption key when the selected encryption algorithm is not a null algorithm. The first string input parameter of the KDF, the first string input parameter is transferred to the KDF processing module 74; constructing a string input parameter of the KDF for generating the two keys, specifically: The parameters of the keys are combined into a string, which is used as a string input parameter of KDF. The selected parameters are: KDF instance identifier, algorithm type identifier, algorithm type identifier byte length, encryption or integrity related to each key. The length of the byte identified by the protection algorithm identification, encryption, or integrity protection algorithm. When the selected encryption algorithm is an empty algorithm, the module does not participate in the work.

a second string parameter construction module 72, configured to: when the selected encryption algorithm is not a null algorithm, Constructing a second string input parameter for generating a signaling integrity protection key, a signaling encryption key, and a _KDF remaining in the user data encryption key, and transmitting the same to the KDF processing module 74; When the algorithm is a null algorithm, the second string input parameter of the KDF for generating the signaling integrity protection key is transmitted to the KDF processing module 74;

The KDF processing module 74 is configured to: when the selected encryption algorithm is not a null algorithm, obtain a KDF output string, and send the KDF output string obtained by the first string input parameter sent by the first string parameter construction module 71 respectively. Go to the first key generation module 75 and the second key generation module 76; send the KDF output string obtained by the second character string input parameter transmitted by the second string parameter construction module 72 to the third key generation module 77. When the selected encryption algorithm is a null algorithm, only the KDF output string obtained by the second string parameter input module 72 is sent to the third key generation module 77;

The first key generation module 75 is configured to generate one of the two keys by using the received KDF output string according to the interception manner negotiated by the communication parties of the network when the selected encryption algorithm is not a null algorithm. Key; when the selected encryption algorithm is a null algorithm, 0 is used as a signaling encryption key or a user data encryption key;

The second key generating module 76 is configured to: when the selected encryption algorithm is not a null algorithm, generate another one of the two keys by using the received KDF output string according to a truncation manner negotiated by the communication parties of the network. a key; when the selected encryption algorithm is an empty algorithm, the module uses 0 as a user data encryption key or a signaling encryption key;

The third key generating module 77 is configured to: when the selected encryption algorithm is not a null algorithm, generate the remaining one key by using the received KDF output string according to the interception manner negotiated by the communication parties of the network; When the encryption algorithm is an empty algorithm, the signaling integrity protection key is generated by the received KDF output string;

When the KDF processing module 74 is configured to correspond, the first character string parameter construction module 71 may be configured to correspond to the first key generation module 75 and the second key generation module 76, which is to be first The KDF output string obtained by the first string input parameter transmitted by the string parameter constructing module 71 is sent to the first key generating module 75 and the second key generating module 76 respectively; correspondingly, the second string parameter constructing module is set. 72 corresponds to the third key generation module 77, that is, the KDF output character string obtained by the second character string input parameter transmitted by the second character string parameter construction module 72 is sent to the third key generation module 77.

The KDF output string described above may be 256 bits, and each key generation module intercepts any 128 bits of the KDF output string as the obtained key.

Further, the apparatus further includes: an AS root key module 73;

The AS root key module 73 is configured to provide an AS root key to the KDF processing module 74. Specifically, when the RRC initial security activation of the network is performed, another input parameter of the KDF is provided: K _eNB ; RRC switching or reestablishing in the network For the time being, provide another input parameter for KDF: K* _eNB .

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

A method for generating a security key, characterized in that, when generating a security key of an access layer AS, the method includes:

If the encryption algorithm chosen is an empty algorithm:

The signaling encryption key and the user data encryption key are directly set to 0; a string input parameter of a key generation function (KDF) for generating a signaling integrity protection key is constructed, KDF is called, and the obtained KDF output character is obtained. The string generates a signaling integrity protection key;

If the chosen encryption algorithm is not empty:

The method for generating a security key according to claim 1, wherein the string input parameter of the KDF configured to generate a signaling integrity protection key is specifically: The parameters of the signaling integrity protection key: the KDF instance identifier, the algorithm type identifier, the byte length of the algorithm type identifier, the integrity protection algorithm identifier, and the byte length of the integrity protection algorithm identifier, and the parameters are connected in series. A string input parameter constructed as KDF.

The method for generating a security key according to claim 1 or 2, wherein when the selected encryption algorithm is an empty algorithm, signaling integrity protection is generated by the received KDF output string. The key is specifically: intercepting 128 bits of the KDF output string as the signaling integrity protection key.

The method for generating a security key according to claim 1, wherein the string input parameter for generating the KDF of the two keys specifically includes: The parameters for generating the two keys are concatenated to form a string as a string input parameter of the KDF.

The method for generating a security key according to claim 4, wherein the parameters used to generate the two keys are spliced to form a character string, specifically: selecting for generating signaling The parameters of the two keys in the integrity protection key, the signaling encryption key, and the user data encryption key, including: KDF instance identifier, algorithm type identifier, byte length of the algorithm type identifier, encryption or integrity protection algorithm The length of the identifier identified by the identification, encryption, or integrity protection algorithm, and the parameters are concatenated in series to form a string.

6. A method of generating a security key according to claim 1, 4 or 5, wherein if the selected encryption algorithm is not an empty algorithm,

The generating the two keys is specifically: intercepting 128 bits of the KDF output string as one of the two keys, and then intercepting 128 bits of the KDF output string as the two Another key in the key;

The method for generating a security key according to claim 1, wherein the calling KDF is specifically: KDF is obtained by using an AS root key and the KDF string input parameter as input parameters. The KDF output string.

8. A device for generating a security key, the device comprising:

a second string parameter construction module, configured to generate a signaling integrity protection key, a signaling encryption key, and a remaining one of the user data encryption keys when the selected encryption algorithm is not a null algorithm The second string input parameter of the key KDF is passed to the KDF processing module; When the selected encryption algorithm is an empty algorithm, constructing a second string input parameter of the KDF for generating a signaling integrity protection key, and transmitting the parameter to the KDF processing module;

The apparatus for generating a security key according to claim 8, wherein the apparatus further comprises: