WO2020140929A1

WO2020140929A1 - Key generation method, ue, and network device

Info

Publication number: WO2020140929A1
Application number: PCT/CN2020/070046
Authority: WO
Inventors: 刘福文
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2019-01-02
Filing date: 2020-01-02
Publication date: 2020-07-09
Also published as: CN111404670A

Abstract

Embodiments of the present application provide a key generation method, a UE, a network device, a system, and a computer storage medium. The method comprises: obtaining an assistant key; generating this session key at least on the basis of the assistant key, and communicating with a network side on the basis of this session key, wherein the generating this session key at least on the basis of the assistant key comprises: generating this session key on the basis of a session key generated according to a long-term key and the assistant key; or generating this session key on the basis of the session key generated according to the long-term key, the assistant key, and a session key used in a previous communication with a network side.

Description

Key generation method, UE and network equipment

Cross-reference of related applications

This application is based on a Chinese patent application with an application number of 201910000551.0 and an application date of January 2, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference.

Technical field

This application relates to the field of information processing technology, and in particular to a key generation method, UE (User Equipment), network equipment, system, and computer storage medium.

Background technique

5G will penetrate into all fields of the future society and will play a key role in building a comprehensive user-centric information ecosystem. The security architecture is the guarantee for the normal operation of the 5G network. The authentication protocol is the cornerstone of building a 5G security architecture. The UE and the network each need to generate DH key exchange related parameters. The generation of these parameters requires the use of asymmetric algorithms, which consumes a lot of computing resources, which is particularly unacceptable for IoT terminals, and this kind of processing can only prevent passive attacks (eavesdropping), not active attacks (man-in-the-middle attacks), In other words, the security of the session key currently used in communication needs to be improved.

Summary of the invention

To solve the above technical problems, the embodiments of the present application provide a key generation method, a UE, a network device, a system, and a computer storage medium.

In a first aspect, a key generation method is provided, which is applied to a UE. The method includes:

Obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Generate the session key at least based on the auxiliary key, and communicate with the network side based on the session key;

Wherein, generating the session key at least based on the auxiliary key includes:

Generate the session key based on the session key generated by the long-term key and the auxiliary key;

Alternatively, the session key is generated based on the session key generated by the long-term key, the auxiliary key, and the session key used in the last communication with the network side.

In a second aspect, a key generation method is provided, which is applied to a first network device, and the method includes:

Obtain the auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Generating at least a session key corresponding to the UE based on the auxiliary key corresponding to the UE, and communicating with the UE based on the session key;

Wherein, generating the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE includes:

Generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication. .

In a third aspect, a key generation method is provided, which is applied to a second network device, and the method includes:

Generating the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE;

Send the session key corresponding to the UE to the first network device;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.

According to a fourth aspect, a UE is provided, including:

The first processor is used to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least the session key is generated based on the auxiliary key;

A first communication interface, used to communicate with the network side based on the session key;

Wherein, the first processor is used to generate the session key based on the session key generated by the long-term key and the auxiliary key;

According to a fifth aspect, a first network device is provided, including:

The second communication interface is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the session key Key to communicate with the UE;

A second processor, configured to generate the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE;

Wherein, the second processor is used to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

In a sixth aspect, a second network device is provided, including:

The third processor is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least based on the auxiliary key corresponding to the UE The key generates the session key corresponding to the UE;

A third communication interface, configured to send the session key corresponding to the UE to the first network device;

Wherein, the third processor is used to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

In a seventh aspect, a computer storage medium is provided on which a computer program is stored, wherein the computer program is executed by a processor to implement the steps of the foregoing method

In a seventh aspect, a key generation system is provided, including: at least one UE and an authentication service function AUSF entity; wherein,

The UE is used to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least the session key is generated based on the auxiliary key, based on The session key is communicated with the network side;

The AUSF entity is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the session key The key communicates with the UE; at least based on the auxiliary key corresponding to the UE to generate the session key corresponding to the UE;

Among them, the UE is specifically used to generate the session key based on the session key generated by the long-term key and the auxiliary key; The session key used for the side communication to generate this session key;

The AUSF is specifically used to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

In a seventh aspect, a key generation system is provided, including: at least one UE, an authentication service function AUSF entity, and a UDM entity; wherein,

The UDM entity is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least based on the auxiliary key corresponding to the UE The key generates the session key corresponding to the UE; sends the session key corresponding to the UE to the AUSF entity;

The AUSF entity is used to communicate with the UE based on the session key corresponding to the UE;

Among them, the UE is specifically used to generate the session key based on the session key generated by the long-term key and the auxiliary key; or, the session key generated by the long-term key, the auxiliary key and the last time with the network The session key used for the side communication to generate this session key;

The UDM entity is specifically used to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

The technical solution of the embodiment of the present application can, when generating the final session key, in addition to the long-term key, also combine the auxiliary key, or combine the auxiliary key and the session key used in the previous communication, The generation of the session key is performed jointly; thus, the security of the session key can be enhanced without major changes to the original authentication protocol.

BRIEF DESCRIPTION

FIG. 1 is a schematic diagram 1 of a key generation method provided by an embodiment of the present application;

2 is a schematic diagram 2 of a key generation method provided by an embodiment of the present application;

FIG. 3 is a schematic flowchart 3 of a key generation method according to an embodiment of this application;

4 is a schematic flowchart 4 of a key generation method according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a composition structure of a UE provided by an embodiment of the present application;

6 is a schematic structural diagram of a composition of a first network device provided by an embodiment of this application;

7 is a schematic structural diagram of a composition of a second network device provided by an embodiment of this application;

FIG. 8 is a schematic diagram of a system composition structure provided by an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

As shown in FIG. 1, an embodiment of the present application provides a key generation method, which is applied to a UE. The method includes:

Step 101: Obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Step 102: Generate the session key based on at least the auxiliary key, and communicate with the network side based on the session key;

Generate the session key based on the session key and auxiliary key generated by the long-term key;

This embodiment provides a variety of specific processing scenarios, which are described below respectively:

Scenario 1. In addition to using a long-term key, the generation of a session key also includes an auxiliary key. The specific instructions are as follows:

The obtaining the auxiliary key includes:

After processing at least one of the shared key, encryption key, and integrity key with UDM, obtain one of the auxiliary keys; or, the shared key, encryption key, and One of the integrity keys serves as the auxiliary key.

That is, at least one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM is subjected to some kind of mixed processing, and the obtained output result is used as one of the auxiliary keys. Alternatively, any one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM can be used directly as the auxiliary key; for example, the shared key can be used directly as the auxiliary key, or the encryption key The key is directly used as the auxiliary key, or the integrity key is used as the auxiliary key.

In addition, when generating the auxiliary key, the method further includes:

When the UE establishes a connection with the network side for the first time, the mobile identification number (MISN, Mobile Identification) number of the permanent identification SUPI of the UE is encrypted based on the elliptic curve comprehensive encryption system ECIES to generate an encrypted SUPI; SUPI is sent to the network side.

Specifically, referring to FIG. 2, the encrypted SUPI may be SUCI; where the encrypted SUPI is sent to the network side, it may be: a security anchor function (SEAF, SEcurity Anchor Function) that sends SUCI to the network side; and SEAF sends SUCI to the authentication service function (AUSF, Authentication Server Function), and AUSF sends SUCI to UDM;

UDM decrypts the SUCI to obtain SUPI. UDM finds the relevant information of the UE according to the SUPI, and determines which authentication protocol is used to authenticate the UE based on the relevant information of the UE; wherein, the authentication protocol may be 5G, AKA or EAP -AKA', of course, the authentication protocol can also have other protocols, but it is not exhaustive in this embodiment. In addition, the relevant information profile of the user's terminal device can be written into Unified Data Management (UDM, Unified Data Management) when the terminal device signs a contract with the network side, and then when the terminal device needs to be authenticated, UDM To determine which authentication protocol the terminal device uses for processing; thereafter UDM will send the auxiliary key to AUSF;

The UE and the network use the selected authentication protocol for mutual authentication; after the authentication is completed, a session key is generated.

Among them, the way to generate the session key includes:

The session key is generated based on the long-term key; the session key is generated based on the session key and the auxiliary key.

Specifically, UE and AUSF use KSEAF and KASIS to generate the final session key KSEAF*, which is calculated as follows:

KSEAF* = KDF (KSEAF, KASIS, AP)

Among them, KDF is a key derivation function, such as HMAC-SHA-256, AP is an auxiliary parameter used for auxiliary functions, such as preventing bidding down attacks, AP is an optional parameter, and may not appear in the formula.

It should be pointed out that UDM can also use KSEAF and KASIS to generate the final session key KSEAF* instead of passing KASIS to AUSF, and then pass it to AUSF.

Scenario 2. In addition to using a long-term key, the generation of a session key also includes an auxiliary key.

This scenario is different from scenario 1 in that the auxiliary key is obtained in different ways. The specific instructions are as follows:

The obtaining the auxiliary key includes:

When the UE first connects with the network side, a random number is generated as an auxiliary key.

In this scenario, the method for generating the auxiliary key may be a random number generated locally by the UE. It can be understood that when the UE generates the auxiliary key, the network side has not yet obtained the auxiliary key. Therefore, further, after generating the auxiliary key, the method further includes:

Based on the auxiliary key and the MSIN in the permanent identification SUPI of the UE, encrypt to generate SUCI; send the SUCI to the network side.

That is to say, after the UE generates the auxiliary key, the auxiliary key will also be sent to the network side as the encrypted content of the SUCI. Specifically, the UE may send the SUCI to the UDM on the network side.

See also Figure 2 for a specific description of this scenario, including:

When the UE connects to the network for the first time, it generates the auxiliary key KASIS, uses the ECIES scheme to encrypt the user's permanent identification SUPI and KASIS, and generates SUCI, and passes the SUCI to SEAF. Among them, the contents of SUCI are as follows:

SUCI = type of SUPI + home network identifier + route identifier + protection scheme identifier + BPUB + APUB + KE {MSIN, KASIS} + Tag.

Then, SEAF passes SUCI to AUSF, and AUSF passes SUCI to UDM; UDM decrypts SUCI to obtain SUPI, finds the UE's Profile according to SUPI, and then determines which authentication protocol to use to authenticate the UE (5G AKA or EAP-AKA' ), the processing method here is the same as that in scenario 1 and will not be repeated here.

UDM passes KASIS to AUSF in the Nudm_Authentication_Get Response message;

The UE and the network use the selected authentication protocol for mutual authentication; after the authentication is completed, the session key is generated.

The method of generating the session key in this scenario is also the same as in scenario 1, so it will not be described in detail.

It should also be pointed out that, in this scenario, the same UDM can also use KSEAF and KASIS to generate the final session key KSEAF* instead of passing KASIS to AUSF, and then pass it to AUSF.

Scenario 3: Based on the session key, the auxiliary key, and the session key used in the previous communication, the session key is generated; the specific instructions are as follows:

Generate session keys based on long-term keys;

This session key is generated based on the session key, the auxiliary key, and the session key used in the previous communication.

It should be noted that in this scenario, the method for generating the auxiliary key may be the scenario 1 scenario, or may be the scenario 2 scenario, which will not be repeated here. The difference from scenario 1 and scenario 2 is that in this scenario, when the session key is finally generated, the session key used in the previous communication is also added. For example, when the UE and AUSF generate the final session key KSEAF*, in addition to KSEAF and KASIS, the last final session key KSEAF*_pre stored in the UE and AUSF, respectively, is also used. The final session key KSEAF* is calculated as follows:

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

Here KDF is the key derivation function, such as HMAC-SHA-256, AP is the auxiliary parameter for auxiliary functions, such as preventing bidding down attacks, AP is an optional parameter, and may not be visible in the formula.

Finally, it should be noted that scenario 1 and scenario 2 can guarantee the security of the final session key KSEAF*, because when generating this session key, in addition to relying on the key KSEAF generated based on the long-term key K , Also depends on the auxiliary key KASIS, and the security of KASIS is guaranteed by ECIES. Whereas ECIES can prevent both passive and active attacks. Therefore, neither the active attacker nor the passive attacker can obtain the final session key KSEAF*, even if the long-term key K has been leaked.

Scenario 3 is more secure than Scenario 1 and Scenario 2, because in this scenario, when UE and AUSF generate the session key KSEAF*, in addition to KSEAF and KASIS, they are also stored on the UE and AUSF respectively. The final session key KSEAF*_pre. In this way, even if KASIS is cracked by the attacker, the attacker cannot obtain the final session key KSEAF* unless it can obtain the last final session key KSEAF*_pre.

In the three scenarios involved in this application, only when the UE is connected to the network for the first time, in order for the UE and UDM to obtain the auxiliary key KASIS, an asymmetric key algorithm (due to the use of ECIES) is required. Subsequent final session key KSEAF* generation does not require the use of an asymmetric key, for example, a symmetric key can be used. Therefore, this proposal is suitable for use in IoT scenarios. In addition, this proposal is highly compatible with the existing 5G standard, because it does not require major changes to the original authentication protocol to achieve enhanced session key security.

By using the above scheme, when generating the final session key, in addition to the long-term key, you can also combine the auxiliary key, or the auxiliary key and the session key used in the previous communication Generation of secondary session keys; thus, the security of session keys can be enhanced without major changes to the original authentication protocol.

As shown in FIG. 3, an embodiment of the present application provides a key generation method, which is applied to a first network device, and the method includes:

Step 301: Obtain the auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Step 302: Generate a session key corresponding to the UE based at least on the auxiliary key corresponding to the UE, and communicate with the UE based on the session key;

The first network device involved in this embodiment may be regarded as a device with AUSF function on the network side.

The obtaining the auxiliary key includes:

Obtain the auxiliary key corresponding to the UE from UDM;

Wherein, the auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of the shared key, the encryption key, and the integrity key between the UE and UDM; or, One of the shared key, encryption key, and integrity key between the UE and the UDM serves as the auxiliary key.

That is, at least one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM is subjected to some kind of hybrid operation, and its output is used as one of the auxiliary keys. Alternatively, any one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM can be used directly as the auxiliary key; for example, the shared key can be used directly as the auxiliary key, or the encryption key The key is directly used as the auxiliary key, or the integrity key is used as the auxiliary key.

For example, the following mix:

KASIS = KDF (KECDH, sharedinfo)

KASIS＝KDF(KE||KM)

Here KDF is a key derivation function, such as HMAC-SHA-256, shared information (sharedinfo) is a value known by UE and UDM, it can also be empty.

In addition, when the auxiliary key is generated, when the UE establishes a connection with the network for the first time, the permanent identity SUPI of the UE is encrypted based on the elliptic curve comprehensive encryption system ECIES to generate the encrypted SUPI; the encrypted SUPI is generated; Send to the network side.

Specifically, referring to FIG. 2, the encrypted SUPI may be SUCI; where the encrypted SUPI is sent to the network side, it may be: a security anchor function (SEAF, SEcurity Anchor Function) that sends SUCI to the network side; and SEAF sends SUCI to the authentication service function (AUSF, Authentication Server Function), which is the first network device, and AUSF sends SUCI to UDM;

Among them, the way to generate the session key includes:

Generate a session key based on the long-term key corresponding to the UE;

Based on the session key and the auxiliary key corresponding to the UE, the current session key used for communication between the network side and the UE is generated.

Specifically, the UE and AUSF, that is, the first network device respectively use KSEAF and KASIS to generate the final session key KSEAF*, which is calculated as follows:

KSEAF* = KDF (KSEAF, KASIS, AP)

This scenario is different from scenario 1 in that the auxiliary key generation method is different, but for the first network device, the auxiliary key is obtained from UDM in the same way as scenario 1, in addition, other processing procedures are different from Scene 1 is the same, so it will not be repeated here.

Generate a session key based on the long-term key corresponding to the UE;

Based on the session key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication, the current session key used for communication between the network side and the UE is generated.

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

As shown in FIG. 4, this embodiment also provides a key generation method, which is applied to the second network device. The method includes:

Step 401: Obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Step 402: Generate a session key corresponding to the UE at least based on the auxiliary key corresponding to the UE;

Step 403: Send the session key corresponding to the UE to the first network device;

In this embodiment, the second network device may be a network device equipped with at least UDM; it should be noted that the first network device and the second network device may be physically the same device or different devices. In this embodiment No limitation.

The auxiliary key corresponding to the UE includes: at least one of a shared key, an encryption key, and an integrity key between the second network device and the UE; or, between the second network device and the UE One of the shared key, encryption key, and integrity key is used as the auxiliary key.

That is, at least one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM is subjected to some kind of hybrid operation, and its output is used as one of the auxiliary keys. For example, the following mix:

KASIS = KDF (KECDH, sharedinfo)

KASIS＝KDF(KE||KM)

Here KDF is the key derivation function, such as HMAC-SHA-256, sharedinfo is the value known by UE and UDM, it can also be empty.

Specifically, the encrypted SUPI can be SUCI; where the encrypted SUPI is sent to the network side, it can be: the security anchor point function (SEAF, SEcurityAnchorFunction) that sends SUCI to the network side; then the SECI sends SUCI Send to the authentication service function (AUSF, Authentication, Server, Function), AUSF then sends SUCI to UDM;

UDM decrypts the SUCI to obtain SUPI. UDM finds the relevant information of the UE according to the SUPI, and determines which authentication protocol is used to authenticate the UE based on the relevant information of the UE; wherein, the authentication protocol may be 5G, AKA or EAP -AKA', of course, the authentication protocol can also have other protocols, but it is not exhaustive in this embodiment. In addition, the relevant information profile of the user's terminal device can be written into Unified Data Management (UDM, Unified Data Management) when the terminal device signs a contract with the network side, and then when the terminal device needs to be authenticated, UDM To determine which authentication protocol the terminal equipment uses for processing;

The UE and the network use the selected authentication protocol for mutual authentication; after the authentication is completed, the session key is obtained.

It should be noted that in this scenario, UDM may not pass KASIS to AUSF, but UDM means that the second network device itself generates the session key used for communication with the UE, and then sends the generated session key To AUSF. Specifically: generate a session key based on the long-term key corresponding to the UE; generate a session key used for communication between the network side and the UE based on the session key and the auxiliary key corresponding to the UE .

Specifically, UE and UDM use KSEAF and KASIS to generate the final session key KSEAF*, which is calculated as follows:

KSEAF* = KDF (KSEAF, KASIS, AP)

When the UE first connects with the network side, an auxiliary key is generated. The method of generating the auxiliary key may be a random number generated locally by the UE. It can be understood that when the UE generates the auxiliary key, the network side has not yet obtained the auxiliary key. Therefore, further, the execution of the second network device includes:

Obtain the SUCI sent by the UE, and decrypt the SUCI to obtain the auxiliary key and SUPI corresponding to the UE;

The auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of a shared key, an encryption key, and an integrity key between the UE and UDM.

A processing flow in this scenario is:

When the UE connects to the network for the first time, it generates the auxiliary key KASIS, uses the ECIES scheme to encrypt the MSIN and KASIS in the user's permanent identity SUPI, and generates SUCI, and passes the SUCI to SEAF. Among them, the contents of SUCI are as follows:

UDM does not need to pass KASIS to AUSF, but directly uses KSEAF and KASIS to generate the final session key KSEAF*, and then passes it to AUSF. The specific method for generating the session key of the second network device, that is, UDM, may be the same as that in scenario 1, and will not be described in detail.

Generate a session key based on the long-term key corresponding to the UE;

It should be noted that in this scenario, the method for generating the auxiliary key may be the scenario 1 scenario, or may be the scenario 2 scenario, which will not be repeated here. The difference from scenario 1 and scenario 2 is that in this scenario, when the session key is finally generated, the session key used in the previous communication is also added. Finally, the calculation of the session key KSEAF* is as follows:

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

As shown in FIG. 5, an embodiment of the present application provides a UE, including:

The first processor 51 is used to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least the session key is generated based on the auxiliary key ;

The first communication interface 52 communicates with the network side based on the session key;

Wherein, the first processor 51 is used to generate the session key based on the session key generated by the long-term key and the auxiliary key;

The first processor 51 is configured to process at least one of the shared key, the encryption key, and the integrity key with the UDM to obtain one auxiliary key;

or,

One of the shared key, encryption key, and integrity key with UDM is used as the auxiliary key.

KASIS = KDF (KECDH, sharedinfo)

KASIS＝KDF(KE||KM)

In addition, the first processor 51 is used to encrypt the permanent identity SUPI of the UE based on the elliptic curve comprehensive encryption system ECIES when the UE establishes a connection with the network side for the first time to generate an encrypted SUPI; the encrypted SUPI is generated; Send to the network side.

The UE and the network use the selected authentication protocol for mutual authentication; after the authentication is completed, the session key KSEAF is generated.

The first processor 51 is configured to generate a session key based on the long-term key; and generate the session key based on the session key and the auxiliary key.

KSEAF* = KDF (KSEAF, KASIS, AP)

The first processor 51 is configured to generate an auxiliary key when connecting with the network for the first time.

In this scenario, the method for generating the auxiliary key may be a random number generated locally by the UE. It can be understood that when the UE generates the auxiliary key, the network side has not yet obtained the auxiliary key. Therefore, further, after the auxiliary key is generated, the first processor 51 is configured to encrypt and generate the SUCI based on the auxiliary key and the permanent identifier SUPI of the UE;

The first communication interface 52 is used to send the SUCI to the network side.

See also Figure 2 for a specific description of this scenario, including:

When the UE connects to the network for the first time, it generates the auxiliary key KASIS, uses the ECIES scheme to encrypt the MSIN and KASIS in the user's permanent identification SUPI, and generates SUCI, and passes the SUCI to SEAF. Among them, the contents of SUCI are as follows:

UDM passes KASIS to AUSF in the Nudm_Authentication_Get Response message;

The first processor 51 is configured to generate a session key based on the long-term key; and generate the session key based on the session key, the auxiliary key, and the session key used in the previous communication.

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

Here, KDF is a key derivation function, such as HMAC-SHA-256, AP is an auxiliary parameter for auxiliary functions, such as preventing bidding down attacks, AP is an optional parameter, and may not be visible in the formula.

As shown in FIG. 6, an embodiment of the present application provides a first network device, including:

The second communication interface 61 is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the current session The key communicates with the UE;

The second processor 62 is configured to generate the session key corresponding to the UE based on at least the auxiliary key corresponding to the UE;

The second communication interface 61 is used to obtain the auxiliary key corresponding to the UE from the UDM;

For example, the following mix:

KASIS = KDF (KECDH, sharedinfo)

KASIS＝KDF(KE||KM)

The second processor 62 is used to generate a session key based on the long-term key corresponding to the UE;

KSEAF* = KDF (KSEAF, KASIS, AP)

The second processor 62 is configured to generate a session key based on the long-term key corresponding to the UE;

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

As shown in FIG. 7, this embodiment also provides a second network device, including:

The third processor 71 is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by the UE and the unified data management UDM on the network side; at least based on the auxiliary corresponding to the UE The key generates the session key corresponding to the UE;

The third communication interface 72 is used to send the session key corresponding to the UE to the first network device;

The auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of a shared key, an encryption key, and an integrity key between the second network device and the UE; Alternatively, one of the shared key, encryption key, and integrity key between the second network device and the UE is used as the auxiliary key. That is, at least one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM is subjected to some kind of hybrid operation, and its output is used as one of the auxiliary keys. Alternatively, any one of the shared key KECDH, the encryption key KE, and the integrity key KM between the UE and the UDM can be used directly as the auxiliary key; for example, the shared key can be used directly as the auxiliary key, or the encryption key The key is directly used as the auxiliary key, or the integrity key is used as the auxiliary key.

For example, the following mix:

KASIS = KDF (KECDH, sharedinfo)

KASIS＝KDF(KE||KM)

Specifically, the encrypted SUPI can be SUCI; where the encrypted SUPI is sent to the network side, it can be: the security anchor function (SEAF, SEcurityAnchorFunction) that sends SUCI to the network side; then the SECI will send SUCI Send to the authentication service function (AUSF, Authentication, Server, Function), AUSF then sends SUCI to UDM;

It should be noted that in this scenario, UDM may not pass KASIS to AUSF, but UDM means that the second network device itself generates the session key used for communication with the UE, and then sends the generated session key To AUSF. Specifically: the third processor 71 is configured to generate a session key based on the long-term key corresponding to the UE; generate a network side to communicate with the UE based on the session key and the auxiliary key corresponding to the UE The session key used.

KSEAF* = KDF (KSEAF, KASIS, AP)

When the UE first connects with the network side, an auxiliary key is generated. The method of generating the auxiliary key may be a random number generated locally by the UE. It can be understood that when the UE generates the auxiliary key, the network side has not yet obtained the auxiliary key. Therefore, further, the third communication interface 72 is used to obtain the SUCI sent by the UE, and the third processor 71 is used to decrypt the SUCI and obtain the auxiliary key and SUPI corresponding to the UE;

The auxiliary key corresponding to the UE includes at least one of a shared key, an encryption key, and an integrity key with the UE.

A processing flow in this scenario is:

The third processor 71 is configured to generate a session key based on the long-term key corresponding to the UE;

It should be pointed out that in this scenario, the method for generating the auxiliary key may be the scenario 1 scenario, or may be the scenario 2 scenario, which will not be repeated here. The difference from scenario 1 and scenario 2 is that in this scenario, when the session key is finally generated, the session key used in the previous communication is also added. Finally, the calculation of the session key KSEAF* is as follows:

KSEAF*=KDF (KSEAF, KASIS, KSEAF*_pre, AP)

Embodiments of the present application also provide a computer-readable storage medium for storing computer programs.

Optionally, the computer-readable storage medium can be applied to any network device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding process implemented by the network device in each method of the embodiments of the present application, for simplicity And will not be repeated here.

As shown in FIG. 8, this embodiment also provides a key generation system, including: at least one UE 81 and an authentication service function AUSF entity 82; wherein,

The UE 81 is used to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least the session key is generated based on the auxiliary key, based on The session key is communicated with the network side;

The AUSF entity 82 is used to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the current session The key communicates with the UE; the session key corresponding to the UE is generated based at least on the auxiliary key corresponding to the UE;

The UE is configured to obtain at least one of the auxiliary key after processing at least one of the shared key, encryption key, and integrity key with the UDM; or, the shared secret with the UDM One of the key, encryption key, and integrity key is used as the auxiliary key;

The AUSF entity is used to obtain the auxiliary key corresponding to the UE from UDM; wherein, the auxiliary key corresponding to the UE is: based on the shared key, encryption key, and integrity between the UE and UDM One key obtained by processing at least one of the keys; or, one of the shared key, the encryption key, and the integrity key between the UE and the UDM is used as the auxiliary key.

The system further includes: a UDM entity 83, configured to send the auxiliary key corresponding to the UE to the AUSF entity.

Based on the above architecture, this application may also provide a key generation system, including: at least one UE, an authentication service function AUSF entity, and a UDM entity; wherein,

Those of ordinary skill in the art may realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that for the convenience and conciseness of the description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical, or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application essentially or part of the contribution to the existing technology or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, including Several instructions are used to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

The above is only the specific implementation of this application, but the scope of protection of this application is not limited to this, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in this application. It should be covered by the scope of protection of this application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

A key generation method is applied to user equipment UE. The method includes:

Obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Generate the session key at least based on the auxiliary key, and communicate with the network side based on the session key;

Wherein, generating the session key at least based on the auxiliary key includes:

Generate the session key based on the session key generated by the long-term key and the auxiliary key;

Alternatively, the session key is generated based on the session key generated by the long-term key, the auxiliary key, and the session key used in the last communication with the network side.
The method according to claim 1, wherein the obtaining the auxiliary key comprises:

After processing at least one of the shared key, the encryption key, and the integrity key with the UDM, obtain one of the auxiliary keys;

or,

One of the shared key, encryption key, and integrity key with UDM is used as the auxiliary key.
The method according to claim 2, wherein, when acquiring the auxiliary key, the method further comprises:

When the UE establishes a connection with the network side for the first time, the permanent identity SUPI of the UE is encrypted based on an elliptic curve comprehensive encryption system ECIES to generate an encrypted SUPI;

Send the encrypted SUPI to the network side.
The method according to claim 1, wherein the obtaining the auxiliary key comprises:

When the UE first connects with the network side, a random number is generated as an auxiliary key.
The method according to claim 4, wherein after generating the auxiliary key, the further comprising:

Based on the auxiliary key and the mobile identification number MISN in the permanent identification SUPI of the UE, encrypt to generate SUCI;

Send the SUCI to the network side.
A key generation method is applied to the first network device. The method includes:

Obtain the auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Generating at least a session key corresponding to the UE based on the auxiliary key corresponding to the UE, and communicating with the UE based on the session key;

Wherein, generating the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE includes:

Generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.
The method according to claim 6, wherein the acquiring the auxiliary key corresponding to the UE comprises:

Obtain the auxiliary key corresponding to the UE from UDM;

Wherein, the auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of the shared key, the encryption key, and the integrity key between the UE and UDM; or, One of the shared key, encryption key, and integrity key between the UE and the UDM serves as the auxiliary key.
A key generation method is applied to a second network device. The method includes:

Obtain the auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side;

Generating the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE;

Send the session key corresponding to the UE to the first network device;

Wherein, generating the session key corresponding to the UE at least based on the auxiliary key corresponding to the UE includes:

Generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.
The method according to claim 8, wherein the acquiring the auxiliary key corresponding to the UE comprises:

Obtain the SUCI sent by the UE, and decrypt the SUCI to obtain the auxiliary key and SUPI corresponding to the UE;

The auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of a shared key, an encryption key, and an integrity key between the second network device and the UE; Alternatively, one of the shared key, encryption key, and integrity key between the second network device and the UE is used as the auxiliary key.
A UE, including:

The first processor is configured to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least the session key is generated based on the auxiliary key;

A first communication interface configured to communicate with the network side based on the current session key;

Wherein, the first processor is configured to generate the session key based on the session key generated by the long-term key and the auxiliary key;

Alternatively, the session key is generated based on the session key generated by the long-term key, the auxiliary key, and the session key used in the last communication with the network side.
The UE according to claim 10, wherein the first processor is configured to process at least one of a shared key, an encryption key, and an integrity key with UDM to obtain one of the Auxiliary key; or, one of the shared key, encryption key, and integrity key with the UDM is used as the auxiliary key.
The UE according to claim 11, wherein the first processor is configured to encrypt the permanent identity SUPI of the UE based on an elliptic curve comprehensive encryption system ECIES when the connection is first established with the network side to generate an encrypted SUPI;

The first communication interface is configured to send the encrypted SUPI to the network side.
The UE according to claim 10, wherein the first processor is configured to generate a random number as an auxiliary key when the UE and the network side are connected for the first time.
The UE according to claim 13, wherein the first processor is configured to encrypt and generate a SUCI based on the auxiliary key and the MSIN in the permanent identity SUPI of the UE;

The first communication interface is configured to send the SUCI to the network side.
A first network device, including:

The second communication interface is configured to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the session key Key to communicate with the UE;

A second processor configured to generate the session key corresponding to the UE based on at least the auxiliary key corresponding to the UE;

Wherein, the second processor is configured to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.
The first network device according to claim 15, wherein the second communication interface is configured to obtain the auxiliary key corresponding to the UE from UDM;

Wherein, the auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of the shared key, the encryption key, and the integrity key between the UE and UDM; or, One of the shared key, encryption key, and integrity key between the UE and the UDM serves as the auxiliary key.
A second network device, including:

The third processor is configured to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least based on the auxiliary key corresponding to the UE The key generates the session key corresponding to the UE;

A third communication interface configured to send the session key corresponding to the UE to the first network device;

Wherein, the third processor is configured to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.
The second network device according to claim 17, wherein the third communication interface is configured to acquire the SUCI sent by the UE;

A third processor configured to obtain the auxiliary key and SUPI corresponding to the UE after decrypting the SUCI;

The auxiliary key corresponding to the UE is: a key obtained by processing based on at least one of a shared key, an encryption key, and an integrity key between the second network device and the UE; Alternatively, one of the shared key, encryption key, and integrity key between the second network device and the UE is used as the auxiliary key.
A computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1-5 are implemented.
A computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the method of claim 6 or 7 are implemented.
A computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the method according to claim 8 or 9 are realized.
A key generation system includes: at least one UE and an authentication service function AUSF entity; wherein,

The UE is configured to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; the session key is generated based at least on the auxiliary key, based on The session key is communicated with the network side;

The AUSF entity is configured to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; and based on the session secret The key communicates with the UE; at least based on the auxiliary key corresponding to the UE to generate the session key corresponding to the UE;

Wherein, the UE is configured to generate the session key based on the session key generated by the long-term key and the auxiliary key; or, the session key generated by the long-term key, the auxiliary key and the last time with the network side The session key used for communication to generate this session key;

The AUSF is configured to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.
The system according to claim 22, wherein the UE is configured to obtain at least one of the auxiliary key after processing at least one of a shared key, an encryption key, and an integrity key with UDM Or, one of the shared key, encryption key, and integrity key with UDM is used as the auxiliary key;

The AUSF entity is configured to obtain the auxiliary key corresponding to the UE from UDM; wherein, the auxiliary key corresponding to the UE is: based on the shared key, encryption key, and integrity between the UE and UDM One key obtained by processing at least one of the keys; or, one of the shared key, the encryption key, and the integrity key between the UE and the UDM is used as the auxiliary key.
The system of claim 23, wherein the system further comprises:

The UDM entity is configured to send the auxiliary key corresponding to the UE to the AUSF entity.
A key generation system includes: at least one UE, an authentication service function AUSF entity, and a UDM entity; wherein,

The UE is configured to obtain an auxiliary key; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; the session key is generated based at least on the auxiliary key, based on The session key is communicated with the network side;

The UDM entity is configured to obtain an auxiliary key corresponding to the UE; wherein the auxiliary key is at least one key that can be obtained by both the UE and the unified data management UDM on the network side; at least based on the auxiliary key corresponding to the UE The key generates the session key corresponding to the UE; sends the session key corresponding to the UE to the AUSF entity;

The AUSF entity is configured to communicate with the UE based on the session key corresponding to the UE;

Wherein, the UE is configured to generate the session key based on the session key generated by the long-term key and the auxiliary key; or, the session key generated by the long-term key, the auxiliary key and the last time with the network side The session key used for communication to generate this session key;

The UDM entity is configured to generate the session key corresponding to the UE based on the session key generated by the long-term key and the auxiliary key corresponding to the UE;

Alternatively, the current session key corresponding to the UE is generated based on the session key generated by the long-term key, the auxiliary key corresponding to the UE, and the session key used by the UE in the previous communication.