Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
  • H04W12/041—Key generation or derivation

Definitions

• the present disclosure relates generally to establishing a security context between a user equipment and a wireless network infrastructure.
• Wireless communication systems are widely deployed to provide various types of communication content such as, for example, voice, video, data, and so on.
• Typical wireless communication systems may be multiple-access systems capable of supporting communication with multiple users by sharing available system resources (e.g., bandwidth, transmission power, etc.).
• wireless multiple-access communication systems may simultaneously support communication for multiple devices. Each served device may communicate with one or more radio access stations.
• a device Before accessing a wireless communication network, a device (also referred to as a subscriber device, user equipment, mobile device, etc.) may be authenticated. In many wireless communication networks, authentication may be performed using credentials provided by the network operator and/or a service provider. Thus, systems and methods for authenticating a device to a wireless communication network by exchanging one or more certificates may be beneficial.
• a user equipment may be registered with two or more wireless networks of differing types.
• the user equipment establishes and maintains a security context with each wireless network.
• executing a full authentication of the UE every time it registers with a new serving network is time consuming.
• An aspect of the present disclosure may reside in a method for establishing a security context with a second network by a user device/station having a security context with a first network based on a first key, including: generating, by the user device, a key identifier based on the first key and a network identifier of the second network; forwarding, by the user device, the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network; receiving, by the user device, a key count from the second network, wherein the key count is associated with a second key forwarded to the second network from the first network; and generating, by the user device, the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.
• the user device may establish the first key with the first network when the user device registers with a third network.
• the first key may be established between the user device and the first network as part of the execution of an authentication and key agreement protocol with the first network.
• the user device may be a mobile device, the first network may a first public land mobile network, and the second network may be a second public land mobile network.
• the second network may comprise a wireless local area network (WLAN) access network or a fixed broadband access network.
• the third network may comprise a 3GPP radio access network such as 5G Radio Access Network (RAN) or Long-Term Evolution (LTE) RAN.
• RAN 5G Radio Access Network
• LTE Long-Term Evolution
• the method may further comprise using, by the user device, the second key to generate at least one of an encryption key or an integrity key for protecting communications between the user device and the second network. Also, generating the key identifier may be further based on at least a portion of a user device identifier and/or a function call value.
• a user device for establishing a security context with a second network, including: means for generating a key identifier based on a first key and a network identifier of the second network, wherein a security context between the first network and the user device is based on the first key; means for forwarding the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network; means for receiving a key count from the second network, wherein the key count is associated with a second key forwarded to the second network from the first network; and means for generating the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.
• a user device for establishing a security context with a second network, including: a processor configured to: generate a key identifier based on a first key and a network identifier of the second network, wherein a security context between the first network and the user device is based on the first key; forward the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network; receive a key count from the second network, wherein the key count is associated with a second key forwarded to the second network from the first network; and generate the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.
• Another aspect of may reside in a computer-readable medium, including: code for causing a computer to generate a key identifier based on a first key and a network identifier of the second network, wherein a security context between the first network and the user device is based on the first key; code for causing the computer to forward the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network; code for causing the computer to receive a key count from the second network, wherein the key count is associated with a second key forwarded to the second network from the first network; and code for causing the computer to generate the second key based on the first key and the received key count thereby establishing a security context between the computer.
• Yet another aspect may reside in a method, including: receiving, by a first network, a key identifier, wherein the key identifier is based on a first key and a network identifier of a second network; identifying, by the first network, the first key based on the key identifier and the network identifier of the second network; generating, by the first network, a second key based on the first key and a key count; and forwarding, by the first network, the second key and the key count to the second network for establishing a security context between the second network and a user device.
• a first network including: means for receiving a key identifier, wherein the key identifier is based on a first key and a network identifier of a second network; means for identifying the first key based on the key identifier and the network identifier of the second network; means for generating a second key based on the first key and a key count; and means for forwarding the second key and the key count to the second network for establishing a security context between the second network and a user device.
• a processor configured to: receive a key identifier, wherein the key identifier is based on a first key and a network identifier of a second network; identify the first key based on the key identifier and the network identifier of the second network; generate a second key based on the first key and a key count; and forward the second key and the key count to the second network for establishing a security context between the second network and a user device.
• Another aspect may reside in a computer-readable medium, including: code for causing a computer to receive a key identifier, wherein the key identifier is based on a first key and a network identifier of a second network; code for causing the computer to identify the first key based on the key identifier and the network identifier of the second network; code for causing the computer to generate a second key based on the first key and a key count; and code for causing the computer to forward the second key and the key count to the second network for establishing a security context between the second network and a user device.
• An aspect may reside in a method for establishing a security context with a second network by a user device having a security context with a first network based on a first key, including: generating, by the user device, a key identifier based on the first key and at least a portion of a user device identifier; forwarding, by the user device, the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network; receiving, by the user device, a key count from the second network, wherein the key count is associated with a second key forwarded to the second network from the first network; and generating, by the user device, the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.
• FIG. 1 is a block diagram illustrating an exemplary wireless network system in which a user equipment may perform multiple network registrations with multiple serving networks while avoiding a primary authentication.
• FIGS. 2A and 2B illustrate flow diagrams of an exemplary authentication and registration process for establishing a security context for a user device communicating over one or more networks, according to one feature.
• FIG. 3 is a diagram illustrating an exemplary key hierarchy structure for a 5G communication system.
• FIG. 4 is a block diagram of an exemplary user device configured to perform multiple registrations and establishing multiple security contexts.
• FIG. 5 is a flow diagram of a method for establishing a security context between a user device and a second network, according to one exemplary feature.
• FIG. 6 is a flow diagram of another exemplary method operational on a user device for facilitating efficient security context generation by identifying a first key and providing a key count for establishing another security context, according to one aspect.
• FIG. 7 is a block diagram of an exemplary network node/device configured to provide services to one or more user devices.
• FIG. 8 is a flow diagram of an exemplary method operational on a home network device for facilitating efficient security context generation by identifying a first key and providing a key count for establishing another security context, according to one aspect.
• FIG. 9 illustrates an exemplary network architecture 900 of a next generation wireless network infrastructure.
• FIG. 1 is a block diagram illustrating an exemplary wireless network system in which a user equipment may perform multiple network registrations with multiple serving networks while avoiding a primary authentication.
• a user device 102 e.g., a subscriber device, a mobile phone, a wearable device, a communication device incorporated into a vehicle, a user equipment, etc.
• RAN radio access network
• A e.g., first serving network
• a first key K1 112a and 112b is generated that is known to the home network 106 and the user device 102.
• This first key K1 (or another key derived from Kl) is then used to generate a first security context A 114 which serves to secure communications to/from the user device 102 and/or generate additional keys at the user device 102.
• the first security context A 114 may be generated at both the user device 102 and at the first service provider A 108.
• the user device 102 may seek to communicate over a second service provider B 110 (e.g., second serving network) via a second radio access network B 105. Consequently, it may attempt to register with the second service provider 110 to establish a security context with the second service provider B (e.g., second serving network) 110. Rather than performing another AKA process with the home network 106 (which is time consuming), the first key Kl may be reused to establish a second security context B 116 with the second network B 110.
• the second security context B 116 may be generated at both the user device 102 and at the second service provider B 110.
• both service provider A 108 and B 110 may be coupled to a single radio access network.
• FIGS. 2A and 2B illustrate flow diagrams of an exemplary authentication and registration process 200 for reusing a security key to establish another security context for a user device 210 communicating over one or more networks.
• the user device 210 may initially obtain service via a third (serving) network 215.
• the user device 210 may establish a first key K1 with a home network 230 when the user device 210 registers with the third network 215 (e.g., a radio access network).
• the user device 210 may be a mobile station, a subscriber device, a wearable device, a communication device incorporated in a vehicle, a client device, a mobile device, a wireless device, etc.
• the home network 230 may be a public land mobile network (PLMN) and may comprise a 3GPP radio access network such as 5G RAN or LTE RAN. In some instances, the home network (e.g., also referred to as an authentication network, an authorizing network, etc.) Similarly, the third network 215 may be a first public land mobile network, and may comprise a wireless local access network (WLAN) and/or a fixed broadband access network.
• WLAN wireless local access network
• the home network 230 may authenticate the user device 210 (e.g., based on a unique device identifier) and at least one key may be established at the home network 230 and user device 210. For instance, upon successful authentication of the user device, a first key K1 may be established 204 at the user device 210 and the home network 230. This first key K1 may be generated based on, for example, information exchanged in the AKA 202, a secret user device key, a unique user device identifier, etc.
• AKA authentication and key agreement
• This first key K1 may be used to generate a third key K3 (e.g., an anchor key) 206b at the home network 230.
• This third key K3 may be sent 208 by the home network 230 to the third network 215.
• the first key K1 may be known only to the user device 210 and the first (home) network 230, but is unknown to the third network 215.
• the third network 215 may then generate and/or establish a first security context 212b, for the user device 210, as a function of the third key K3 (e.g., an anchor key KISEAF). It is contemplated that various methods may be used to establish the first key Kl, which may also be associated with a unique user device identifier (UID) at the home network 230.
• UID unique user device identifier
• various methods may be used to generate or establish the third key K3, where the user device 210 may be aware of the methods (e.g., key derivation function) used by the home network 230 and the third network 215.
• the user device may establish a local instance of the first key Kl 204a (e.g., using the same key derivation function as the home network 230) and then may generate a local instance of the third key K3 206a (e.g., using the same key derivation function as the third network 215).
• the user device may then use its local version of the third key K3 to establish a security context 212a with the third network 215.
• the security context 212a and 212b is established as a function of the first key Kl.
• the user device 210 may use a second (serving) network 220 for communications. That is, the user device 210 may switch to using the second network 220 or it may use the second network 220 concurrently with the third network 215.
• the second network 220 may be a second public land mobile network and may comprise a wireless local access network (WLAN) or a fixed broadband access network.
• WLAN wireless local access network
• the user device 210 may reuse the first key Kl to establish a second security context with the second network 220.
• the user device 210 may use a key derivation function (KDF) to generate a key identifier KeylD 235 based on the first key Kl, a second network identifier or network name SN-B of the second network 220, and/or the unique user device identifier (UID).
• KDF key derivation function
• the first key Kl may be utilized as a basis to establish multiple security contexts (e.g., first security context 212 and second security context 272) with at least two distinct serving networks.
• the user device 210 may forward the key identifier KeylD, as part of a registration request 240, to the second network 220.
• the second network 220 may then send an authentication request 245, including the second network identifier/name SN-B and the unique user device identifier UID, to the home network 230.
• the home network 230 may then identify the user device 210 based on the first key Kl . That is, the unique user device identifier UID, the home network 230 is able to ascertain the first key Kl.
• the home network 230 is thus able to authenticate the user device 210 without executing the AKA protocol again.
• the home network 230 may generate a second key K2 255 as a function of the first key Kl and a key count COUNT.
• the home network 230 may then forward 260 the second key K2 to the second network 220 (e.g., as part of an authentication response that also includes the unique user device identifier UID and the key count COUNT).
• the second network 220 may send 265 the key count COUNT to the user device 210 (e.g., as part of a security mode command). Having received the second key K2, the second network 220 is then able to generate/establish a second security context 272b, with the user device 210, based on the second key K2.
• the user device 210 may also generate a local instance of the second key K2 270 based on the first key K1 and the received key count COUNT. The user device 210 may then use its local instance of the second key K2 to establish the second security context 272a with the second network 220.
• FIG. 3 is a diagram illustrating an exemplary key hierarchy structure for a 5G communication system.
• This exemplary key hierarchy structure 300 may serve to generate various keys to establish and secure communications between a user device (UE) 302 and a network 304.
• a long term secret key (K) 306 may be provisioned in a universal subscriber identification module (USIM) for the user device 302.
• the user device 302 and network 304 may generate a ciphering key (CK) and integrity key (IK) 308 as a function of the secret key K 306.
• CK ciphering key
• IK integrity key
• a first authentication key KAUSF 310 is derived by the user device and network (e.g., Authentication Credential Repository and Processing Function or ARPF) from the ciphering key CK and integrity key IK 308 during an Authentication and Key Agreement (AKA) process. If the 3GPP secret key K is used for authentication over a radio access technology supporting the extensible authentication protocol EAP, the first authentication key KAUSF 310’ is derived according to the EAP AKA’ specification.
• ARPF Authentication Credential Repository and Processing Function
• a serving network specific anchor key (KSEAF) 312 may be derived from the first authentication key KAUSF 310
• the anchor key KSEAF 312 confidentiality and integrity protection keys are derived for NAS signaling and the access stratum (AS) consisting of control plane (CP), i.e., radio resource control (RRC) messages, and user plane (UP).
• AS access stratum
• CP control plane
• RRC radio resource control
• UP user plane
• the anchor key KSEAF 312 may be used to derive an access and mobility key KAMF 314 by the user device and a security anchor function (SEAF).
• the access and mobility function (AMF) may generate a confidential integrity key K NAS i nt 316 and a confidential encryption key KNAS CHC 318 from the access and mobility key KAMF for Non-Access Stratum (NAS) signaling protection.
• a security context may include the confidential integrity key K NAS i nt 316 and the confidential encryption key K NASOIC 318.
• the user device 312 and the AMF may also generate a node key K 3 ⁇ 4NB 320 from the access and mobility key KAMF 314.
• Integrity and confidentiality keys for AS i.e. UP (Kupi nt and Kup enc ) and RRC (Kg RC i nt and K RRCOIC ), may be derived from the node key K gNB -
• An intermediate key NH may also be derived to provide forward secrecy during handover.
• the first key K1 may be equivalent to the first authentication key KAUSF 310 or 310 * in the key hierarchy 300 of FIG. 3.
• a first anchor key KISEAF may then be generated from the first key Kl.
• a first anchor key KISEAF may be generated as a function of the first key Kl (e.g., first authentication key KAUSF 310 or 310’ FIG. 3) at the user device 210 and the AUSF (at the home network 230).
• the AUSF at the home network 230 may then send the first anchor key KISEAF to the third network 215.
• the first key Kl (e.g., authentication key KAUSF 310 or 310') may be used to authenticate the user device and generate a second anchor key K2SEAF ⁇
• subsequent registrations of the user device with other serving networks may utilize the first key Kl (e.g., authentication key KAUSF 310 or 310’) to avoid a primary authentication and to generate additional anchor keys.
• the first key Kl e.g., authentication key KAUSF 310 or 310’
• a second key K2 255 (e.g., second anchor key K2SEAF) is generated by the AUSF of the home network 230).
• This second key K2 (e.g., second anchor key K2SEAF) is then sent 260 to the second network 220 by the AUSF of the home network 230.
• the user device 210 also generates a local version of the second key K2 270.
• Both the user device 210 and the second network 220 may then establish a second security context 272a and 272b based on the second key K2 (e.g., second anchor key K2SEAF) ⁇
• FIG. 4 is a block diagram of an exemplary user device configured to perform multiple registrations and establishing multiple security contexts.
• the user device 400 may comprise a processing circuit 410 coupled to a storage device/medium 420 (e.g., a memory and/or a disk drive), a display 430, an input device 440 (e.g., a keypad, a microphone, etc.), and/or a communication interface/circuit 445 coupled to one or more wireless antennas 450.
• a storage device/medium 420 e.g., a memory and/or a disk drive
• an input device 440 e.g., a keypad, a microphone, etc.
• a communication interface/circuit 445 coupled to one or more wireless antennas 450.
• a user device may be registered in a first serving network over a certain type of access (e.g. 3GPP) and may be registered with a second serving network over another type of access (e.g. non-3GPP).
• the user device may independently maintain and use two different (5G) security contexts, one per serving network (i.e., one per PLMN network).
• the user device 400 may be configured to reuse a first key, previously established with the first serving network, to bypass/avoid performing primary authentication again for the second serving network.
• a first key K1 has been generated and stored at the authentication server function (AUSF) for the home network for the user device 400.
• AUSF authentication server function
• this first key K1 may be known as the first authentication key K AUSF (310 or 310’ in FIG. 3).
• the first key K1 may be used to create security contexts at the second serving network without having to perform yet another primary authentication via the second serving network.
• a key identifier KeylD may be derived from the first authentication key KAUSF by incorporating the serving network identifier/name SN-B of the second serving network and using it to: a) negotiate the use of the optional feature (i.e., reuse of the first key K1 to avoid a separate primary authentication execution) between the user device 400 and the home network, and b) identify the context at the AUSF of the home network to establish the security contexts. More specifically, if the user device 400 has previously registered in a first serving network and wants to register with a different second serving network and has the stored first authentication key KAUSF available, it may derive a key identifier KeyID_AUSF from the first authentication key KAUSF and may include it in a Registration Request (240 in FIG. 2). The user device 400 may include the serving network identifier/name of the serving network (PLMN) in the key identifier KeyID_AUSF derivation.
• PLMN serving network identifier/name of the serving network
• the KeylD (or KeyID_AUSF ) may be derived as follows:
• KeyID_AUSF KDF (K_AUSF, SN-ID, FC value for KeylD derivation), where KeyID_AUSF may be identified with a fixed (e.g., 32) least significant bits of the output of a key derivation function (KDF), such as the SHA-256 (which may have an output of 256 bits).
• KDF key derivation function
• the K_AUSF may be 256 bits long.
• the serving network identifier/name SN-ID may be the serving network identifier/name (e.g., second network identifier SN-B) and may be equal to a concatenation of a service code set to '5G' and a visiting PLMN (VPLMN ID) according to standards for construction of a serving network identifier/name.
• the user device 400 may forward the KeyID_AUSF and a user device identifier (UID) to the Access and Mobility Management Function (AMF) in a Registration Request (240 in FIG. 2).
• UID user device identifier
• AMF Access and Mobility Management Function
• the UID may be a subscription concealed identifier (SUCI) or a subscription permanent identifier (SUPI).
• SEAF security anchor function
• SUCI subscription concealed identifier
• SUPI subscription permanent identifier
• SEAF security anchor function
• 5G-AIR Authentication Initiation Request
• the user device identifier or a portion of the UID (e.g., 32 least significant bits of the UID) may be included as an input to the KDF to derive the KeylD instead of the network identifier/name SN-ID.
• the UID is a privacy preserving subscription identifier, such as the SUCI
• the inclusion of at least a portion of the UID ensures that the generated key identifier preserves privacy of the subscriber identifier.
• the UID or part of the UID may be included as the input to the KDF in addition to the SN-ID.
• the AUSF may decide to reuse it If it decides to reuse it then the AUSF may derive the KeylD AUSF in the same way as the user device 400, and verifies whether the KeyID_AUSF derived by the AUSF matches the received value. If they match, then the AUSF may skip the authentication and may derive the K_SEAF (i.e., second key K2 in FIG. 2) from the K_AUSF (e.g., first key K1 in FIG. 2) and a counter AUSF_KDF_COUNT.
• K_AUSF i.e., first authentication key KAUSF
• a key derivation function KDF such as SHA-256, may be used to derive the K_SEAF (e.g., second key K2 in FIG. 2).
• the AUSF_KDF_COUNT (e.g., COUNT in FIG. 2) may be a monotonically increasing 32-bit coimter, with the initial value of zero. After each key derivation from the K_AUSF, the AUSF increments AUSF_KDF_COUNT by 1.
• the AUSF_KDF_COUNT may be stored by the AUSF along with the K_AUSF. The use of AUSF_KDF_COUNT ensures that a key derived from K_AUSF is always fresh.
• the AUSF may send the derived K_SEAF (e.g., second key K2 in FIG. 2), along with the AUSF_KDF_COUNT, to the SEAF in Authentication Initiation Answer (5G-AIA) (260 in FIG. 2).
• the AMF may use the K SEAF to establish a separate 5G security context with the user device 400 by sending a Network Access Stratum (NAS) Security Mode Command (SMC) to the user device 400.
• the NAS SMC may include the AUSF_KDF_INPUT.
• the AUSF_KDF_INPUT in the NAS SMC may be integrity protected but not ciphered.
• the user device 400 shall use the AUSF_KDF_COUNT received in the NAS SMC to derive the KJSEAF (second key K2 in FIG. 2) and to establish a separate 5G security context with the AMF in the second serving network.
• the user device 400 may send an NAS Security Mode Complete command (275 in FIG.
• the AMF (second serving network) may respond with a accept message (280 in FIG. 2).
• the AUSF may initiate a primary authentication by sending Auth-lnfo-Req message to the UDM/ARPF.
• a successful authentication of the UE results in establishment of a separate 5G security context with the AMF.
• Various examples of the user device 400 may include a handheld phone, a subscriber device, a user equipment (UE), a wearable computing device, a communication device incorporated in a vehicle, and/or a laptop computer.
• the communication interface/circuit 445 for the user device 400 may support any one of a number of multiple access techniques such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), space division multiple access (SDMA), polarization division multiple access (PDMA), or other modulation techniques known in the art.
• CDMA code division multiple access
• TDMA time division multiple access
• FDMA frequency division multiple access
• SDMA space division multiple access
• PDMA polarization division multiple access
• FIG. 5 is a flow diagram of a method, operational at a user device, for establishing a security context between the user device and a second network, according to one exemplary feature.
• this method may be implemented by the user device 400 of FIG. 4.
• a key identifier KeylD may be generated 510 based on a first key K1 (previously established for a first network) and a network identifier/name of the second network (235 FIG. 2), wherein a security context between the first network and the user device 400 is based on the first key Kl.
• the key identifier Key ID may be forwarded/sent 520 to the second network for forwarding to a home network to enable the home network to identify the first key Kl (250 FIG. 2).
• a key count COUNT may be received 530 from the second network (265 FIG. 2), wherein the key count is associated with a second key K2 forwarded to the second network from the home network.
• the second key K2 may be generated 540 based on the first key Kl and the received key count thereby establishing a security context between the second network and the user device 400 (270 and 272 in FIG. 2).
• the user device 400 may be configured to establish a security context with a second network 220 (FIG. 2), comprising: means (e.g., processing circuit 410 and/or communication interface/circuit 445) for generating a key identifier KeylD based on a first key Kl (e.g., first authentication key KAUSF) and a second network identifier/name SN-B, wherein a first security context between a third network 215 and the user device 400 has been previously established based on the first key Kl; means (e.g., processing circuit 410 and/or communication interface/circuit 445) for forwarding (240 in FIG.
• Kl e.g., first authentication key KAUSF
• SN-B second network identifier/name SN-B
• the key identifier KeylD to the second network for forwarding to a home network to enable the home network to identify the first key Kl (i.e., to ascertain whether the first key Kl has been previously used by the user device); means (e.g., processing circuit 410 and/or communication interface/circuit 445) for receiving a key count COUNT from the second network (265 in FIG. 2), wherein the key count is associated with the second key K2 forwarded to the second network from the home network; and means (e.g., processing circuit 410) for generating the second key K2 based on the first key Kl and the received key count COUNT thereby establishing a security context between the second network and the user device (272 in FIG. 2).
• means e.g., processing circuit 410 and/or communication interface/circuit 445) for receiving a key count COUNT from the second network (265 in FIG. 2), wherein the key count is associated with the second key K2 forwarded to the second network from the home network
• means e.g., processing circuit
• Another aspect may provide computer-readable medium or storage device 420, comprising: code for causing the processing circuit 410 to generate a key identifier KeylD based on a first key Kl (previously established through a first serving network) and a network identifier/name of a second serving network (235 in FIG. 2 or 510 in FIG. 5), wherein a first security context between the first serving network and the user device 400 is based on the first key Kl; code for causing the processing circuit 410 to forward (240 in FIG. 2 or 520 in FIG.
• the key identifier KeylD to the second serving network for forwarding to the home network to enable the home network to identify the first key Kl at the home network; code for causing the processing circuit 410 to receive a key count COUNT from the second network, wherein the key count is associated with a second key K2 forwarded to the second network from the home network (265 in FIG. 2 or 530 in FIG. 5); and code for causing the processing circuit 410 to generate the second key K2 based on the first key Kl and the received key count thereby establishing a security context (i.e., second security context) between the second network and the user device 400 (272 in FIG. 2 or 540 in FIG. 5).
• a security context i.e., second security context
• FIG. 6 is a flow diagram of another exemplary method 800 operational on a user device for facilitating efficient security context generation by identifying a first key and providing a key count for establishing another security context, according to one aspect.
• This method 600 may be performed, for instance, by the user device 400.
• a first key Kl may have been previously established (e.g., as part of an AKA procedure) between the user device and a first (home) network.
• the user device may generate a key identifier Key ID 610 based on the first key and at least a portion of a user device identifier UID (235 in FIG. 2).
• the user device may forward the key identifier 620 to the second network for forwarding to the first (home) network to enable the home network to identify the first key at the home network (steps 240).
• the user device may receive a key count COUNT 630 from the second network (265 in FIG. 2).
• the key count may be associated with a second key K2 forwarded to the second network from the first (home) network.
• the user device may generate the second key 640 based on the first key and the received key count thereby establishing a security context between the second network and the user device (270 in FIG. 2).
• FIG. 7 is a block diagram of an exemplary network node/device configured to provide services to one or more user devices.
• the network node/device 700 may comprise a processing circuit 710 coupled to a storage device/medium 720 (e.g., a memory and/or a disk drive), a display 730, an input device 740 (e.g., a keypad, a microphone, etc.), and/or a communication interface/circuit 745 coupled to one or more wireless antennas 750 and/or networks.
• the network node/device 700 may be the third network 215, the second network 220, and/or the first/home network 230 in FIG. 2, and/or may be configured to perform one or more functions performed by these networks.
• the network node/device 700 may be configured to perform multiple registrations and establishing multiple security contexts for one or more user devices.
• FIG. 8 is a flow diagram of an exemplary method 800 operational on a first (home) network for facilitating efficient security context generation by identifying a first key and providing a key count for establishing another security context, according to one aspect
• This method 800 may be performed, for instance, by a home network node/device (230 in FIG. 2).
• a key identifier KeylD may be received 810, wherein the key identifier is based on a first key Kl and a network identifier/name SN-B of a second network.
• the first key may be identified 820 based on the key identifier and the network identifier/name of the second network.
• the home network node/device may ascertain that the first key has been previously established by a sending user device but for a different serving network.
• a second key K2 is then generated 830 based on the first key and a key count COUNT.
• the second key and the key count are then forwarded 840 to the second network for establishing a security context between the second network and a user device.
• the network node/device 700 comprising: means (e.g., processing circuit 710 and/or communication interface/circuit 745) for receiving a key identifier KeylD, wherein the key identifier is based on a first key Kl and a network identifier/name SN-B of a second network; means (e.g., processing circuit 710) for identifying the first key based on the key identifier and the network identifier/name of the second network; means (e.g., processing circuit 710) for generating a second key K2 based on the first key and a key count COUNT; and means (e.g., processing circuit 710 and/or communication interface/circuit 745) for forwarding the second key and the key count to the second network for establishing a security context between the second network and a user device.
• means e.g., processing circuit 710 and/or communication interface/circuit 745
• a key identifier KeylD wherein the key identifier is based on
• Another aspect may reside in the computer-readable medium or storage device 620, comprising: code for causing the processing circuit 710 to receive a key identifier key!D, wherein the key identifier is based on a first key Kl and a network identifier/name SN-B of a second network (245 in FIG. 2 or 810 in FIG. 8); code for causing the processing circuit 710 to identify the first key based on the key identifier and the network identifier/name of the second network (250 in FIG. 2 or 820 in FIG. 8); code for causing the processing circuit 710 to generate a second key K2 based on the first key and a key count COUNT (255 in FIG. 2 or 830 in FIG. 8); and code for causing the processing circuit 710 to forward the second key and the key count to the second network for establishing a security context between the second network and a user device (260 FIG. 2 or 840 in FIG. 8).
• FIG. 9 illustrates an exemplary network architecture 900 of a next generation wireless network infrastructure (i.e., 5G).
• a User Equipment (UE) 902 e.g., user device/station 210 in FIG. 2, may be connected to either an Access Network (AN) or a Radio AN ((R)AN) 904 as well as an Access and Mobility Function (AMF) 906.
• the RAN 904 may represent a base station or access node using, for example, evolved LTE while an AN may be a general base station including non-3GPP access, e.g., Wi-Fi.
• the core network generally may include the AMF 906, a Session Management Function (SMF) 908, a Policy Control Function (PCF) 910, an Application Function (AF) 912, an Authentication Server Function (AUSF) 914, a User Plane Function (UPF) 916, a User Data Management (UDM) 918, and a Data Network connection (DN) 920. More details regarding may be found in 3GPP TS 23.501: "System Architecture for the 5G System".
• One or more of the core network components and/or functions may be implemented, for instance, at a serving network 215 and/or 220 and/or a home network 230.
• DSP digital signal processor
• ASIC application specific integrated circuit
• FPGA field programmable gate array
• a general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine.
• a processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
• a software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
• An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
• the storage medium may be integral to the processor.
• the processor and the storage medium may reside in an ASIC.
• the ASIC may reside in a user terminal.
• the processor and the storage medium may reside as discrete components in a user terminal.
• the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
• Computer-readable media includes both non-transitory computer-readable storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
• a storage media may be any available media that can be accessed by a computer.
• such computer- readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to cany or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
• any connection is properly termed a computer-readable medium.
• the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium.
• DSL digital subscriber line
• Disk and disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and bhi-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephone Function (AREA)
• Telephonic Communication Services (AREA)

Priority Applications (7)

Applications Claiming Priority (4)

Publications (1)

Family

ID=67219894

Family Applications (1)

Country Status (2)

Cited By (1)

Citations (3)

• 2019
  • 2019-01-12 WO PCT/US2019/013392 patent/WO2019140337A1/en unknown
  • 2019-01-12 JP JP2020538542A patent/JP2021524167A/ja active Pending

Patent Citations (3)

Also Published As

Similar Documents

Legal Events