WO2021043130A1

WO2021043130A1 - Key generation method and apparatus, computer-readable storage medium and mme

Info

Publication number: WO2021043130A1
Application number: PCT/CN2020/112842
Authority: WO
Inventors: 陶望胜
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-09-02
Filing date: 2020-09-01
Publication date: 2021-03-11
Also published as: CN112533198A

Abstract

A key generation method and apparatus, a computer-readable storage medium and an MME. By setting the value of an NAS Count for generating an initial key KeNB as a fixed value, the initial key KeNB can still be generated when there is no available uplink NAS Count, ensuring that a UE and an MME generate a consistent key KeNB.

Description

Key generation method, device, computer readable storage medium and MME

Cross-references to related applications

This application is based on a Chinese patent application with an application number of 201910835444.X and an application date of September 02, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated into this application by reference.

Technical field

The embodiments of the present application relate to, but are not limited to, mobile communication technology, in particular to a key generation method, device, computer-readable storage medium, and MME.

Background technique

In idle mode, when the user equipment (UE, User Equipment) moves from the fifth generation mobile communications (5G, The 5th Generation Mobile Communications) to the fourth generation mobile communications (4G, The 4th Generation Mobile Communications), the 5G core network is connected. Access and Mobility Management Function (AMF, Access and Mobility Management Function) need to map 5G security context to 4G security context, for example: through 5G security context key Kamf and uplink non-access stratum (NAS, Non Access Stratum) The serial number is used to generate the basic key Kasme in the 4G security context. Subsequently, the AMF will pass the generated mapped 4G security context to the Mobility Management Entity (MME, Mobility Management Entity) of the 4G core network, so that the 4G network can encrypt and protect the message when it subsequently interacts with the UE.

In idle mode, when the UE moves from 5G to 4G, if the UE has uplink data or uplink signaling that needs to be transmitted, then the UE will send the request message such as the tracking area update request (TAU Request) with the activation flag. In this way, the MME When the TAU Accept (TAU Accept) message is sent to the UE, an Initial Context Setup Request (Initial Context Setup Request) will be sent to the evolved UMTS Terrestrial Radio Access Network (E-UTRAN) at the same time, and it will be included in the Initial Context Setup Request. Carry the initial key KeNB so that E-UTRAN can activate the Access Stratum (AS, Access Stratum) security context.

According to the definition of generating the initial key KeNB in the 3GPP 33.501 specification, the MME will generate the initial key KeNB according to the basic key Kasme and the uplink NAS count (Count) in the mapped 4G security context delivered by 5G AMF. According to the specification, the value rule of the uplink NAS Count is:

If the MME does not trigger the Security Mode Command process before TAU Accept is issued, the uplink NAS Count is the NAS Count associated with the TAU Request message; otherwise, the uplink NAS Count is the security mode completion of the UE reply (Security Mode Complete) NAS Count associated with the message.

However, for the scenario where the 5G is switched to 4G in idle mode, the UE uses the 5G security context generated by the UE itself on the 5G side to protect the TAU Request message sent by itself, that is, the NAS Count associated with the TAU Request is not 4G Upstream NAS Count of the security context. Therefore, if the MME does not execute the Security Mode Command process before issuing TAU Accept to the UE, the UE and MME will not be able to obtain the uplink NAS Count, resulting in the failure to generate the key KeNB, or the generation of the UE and MME is inconsistent The key KeNB, which leads to the failure of AS layer security activation, which in turn causes the UE to fail to switch from 5G to 4G.

Summary of the invention

The embodiments of the present application provide a key generation method, device, computer-readable storage medium, and MME.

The embodiment of the present application provides a key generation method, including: the mobility management entity MME generates an initial key KeNB by using a fixed value of the uplink non-access stratum count NASCount.

An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to execute any one of the key generation methods described above.

The embodiment of the present application further provides a device for realizing key generation, including a processor and a memory; wherein a computer program that can run on the processor is stored in the memory: it is used to execute any of the above-mentioned keys. Steps to generate method.

The embodiment of the present application further provides a mobility management entity MME, which at least includes the above-mentioned device for realizing key generation.

Other features and advantages of the present application will be described in the following description, and partly become obvious from the description, or understood by implementing the present application. The purpose and other advantages of the application can be realized and obtained through the structures specifically pointed out in the specification, claims and drawings.

Description of the drawings

The accompanying drawings are used to provide a further understanding of the technical solution of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application, and do not constitute a limitation to the technical solution of the present application.

FIG. 1 is a schematic flowchart of a first embodiment of a key generation method according to an embodiment of the application;

2 is a schematic flowchart of a second embodiment of a key generation method according to an embodiment of the application;

FIG. 3 is a schematic diagram of a device for realizing key generation according to an embodiment of the application;

Fig. 4 is a schematic diagram of a mobility management entity MME according to an embodiment of the application.

detailed description

In a typical configuration of the embodiment of the present application, the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in a computer readable medium, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of a computer readable medium.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include non-transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

In order to make the objectives, technical solutions, and advantages of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. It should be noted that the embodiments in this application and the features in the embodiments can be combined with each other arbitrarily if there is no conflict.

The inventor of the present application found that for the UE from 5G TAU to 4G, when the 4G MME determines that the initial key KeNB needs to be generated and sent to the E-UTRAN in the Initial Context Setup Request, in some cases the initial key is not explicitly generated. The specific value of the uplink NAS Count used by the key KeNB. Therefore, it is likely that the UE and the MME may use different values of the uplink NAS Count to calculate an inconsistent initial key KeNB, which will cause the UE to fail to successfully transfer from 5G. TAU to 4G.

For the scenario where the UE goes from 5G TAU to 4G, in order to ensure that the UE and the MME generate a consistent initial key KeNB, an embodiment of the present application provides a key generation method, including:

The MME generates the initial key KeNB by using the fixed value of the uplink NAS Count.

In an example, the MME generates the initial key KeNB by using the uplink NAS Count with a fixed value, which may include:

The MME generates the initial key KeNB according to the basic key Kasme and the fixed value of the uplink NAS Count; where the basic key Kasme comes from the mapped 4G security context (Mapped 4G Security Context) of the AMF of the 5G core network.

In an example, the fixed value of the uplink NAS Count may be, for example, 2 ³² -1, or 0.

In this application, by setting the NAS Count used to generate the initial key KeNB to a fixed value, when there is no available uplink NAS Count, the initial key KeNB can still be generated, and it is ensured that both the UE and the MME generate consistent secrets. The key KeNB provides a guarantee for the successful handover of the UE from 5G to 4G.

In an example, the method of the embodiment of the present application further includes:

The MME carries the generated initial key KeNB in the Initial Context Setup Request and sends it to the E-UTRAN.

In an example, before generating the initial key KeNB in the embodiment of the present application, the method further includes:

The MME needs to issue an Initial Context Setup Request carrying the initial key KeNB.

In an example, the Initial Context Setup Request carrying the initial key KeNB needs to be issued, which may include:

The MME learns that the UE is from 5G TAU to 4G, and determines that the UE has uplink data or uplink signaling that needs to be uploaded, or determines that the user plane needs to be activated.

In an example, the MME determining that the UE has uplink data or uplink signaling that needs to be uploaded may include:

The MME receives the TAU Request message carrying the activation flag from the UE.

In an example, the MME determines that the user plane needs to be activated, which may include:

The MME receives the TAU Request message without the activation flag from the UE, but due to the local configuration of the MME or other reasons, the MME determines that the user plane needs to be activated. Here, other reasons for activating the user plane may be that the MME has received the downlink data notification from the SGW, dedicated load activation, etc.; the local configuration of the MME may be a switch, such as whether to support the activation of the user plane in the TAU process.

3, an embodiment of the present application also provides a device for realizing key generation, including a processor 301 and a memory 302; wherein, the memory 302 stores a computer program that can run on the processor 301: it is used to execute any of the foregoing. One of the steps of the key generation method.

Referring to FIG. 4, an embodiment of the present application also provides a mobility management entity MME 400, which includes any one of the above-mentioned apparatuses 401 for realizing key generation.

The application of the key generation method of the embodiment of the present application will be described in detail below in conjunction with specific embodiments.

In the first embodiment, as shown in FIG. 1, the key generation method of the embodiment of the present application may include:

Step 100: The UE has been registered to the 5G system.

Step 101: The UE detects that the 4G system needs to be started. In the first embodiment, assuming that the UE has uplink data that needs to be uploaded at this time, the UE sends a TAU Request message to the MME. The TAU Request message carries an Active Flag (Active Flag). ).

Step 102: The MME calculates and generates the initial key KeNB according to the basic key Kasme in the mapped 4G security context from the AMF of the 5G core network and the fixed NAS Count such as 2 ^{32 -1 or 0.}

Step 103: The MME carries the calculated initial key KeNB in the Initial Context Setup Request and sends it to the E-UTRAN.

In the second embodiment, as shown in FIG. 2, the key generation method of the embodiment of the present application may include:

Step 200: The UE has been registered to the 5G system.

Step 201: The UE detects that the 4G system needs to be started. In the second embodiment, it is assumed that the UE sends a TAU Request message to the MME, and the TAU Request message does not carry an activation flag.

Step 202: In the second embodiment, assuming that it is determined that the user plane needs to be activated due to the local configuration of the MME or other reasons, the basic key Kasme in the 4G security context will be mapped from the AMF of the 5G core network and the value A fixed NAS Count such as 2 ³² -1 or 0 is calculated to generate the initial key KeNB.

Here, other reasons for activating the user plane may be that the MME has received the downlink data notification from the SGW, dedicated load activation, etc.; the local configuration of the MME may be a switch, such as whether to support the activation of the user plane in the TAU process.

Step 203: The MME carries the calculated initial key KeNB in the Initial Context Setup Request and sends it to the E-UTRAN.

The embodiments of the present application provide a key generation method, device, computer readable storage medium, and MME, which can ensure that both the UE and the MME generate a consistent key, and provide guarantee for the successful handover of the UE from 5G to 4G.

In the embodiment of this application, by setting the NAS Count used to generate the initial key KeNB to a fixed value, when there is no available uplink NAS Count, the initial key KeNB can still be generated, and it is ensured that the UE and MME generate the same The key KeNB for the UE provides a guarantee for the successful handover from 5G to 4G.

The above are only a few examples of this application, and are not used to limit the protection scope of this application. Any modification, equivalent replacement, improvement, etc. made within the scope and principles of this application shall be included in the protection scope of this application.

Claims

A key generation method, including:

The mobility management entity MME generates the initial key KeNB by using the fixed value of the uplink non-access stratum count NASCount.
The method for generating a key according to claim 1, wherein the MME generating the initial key KeNB by using an uplink NAS Count with a fixed value comprises:

The MME generates the initial key KeNB according to the basic key Kasme and the fixed value of the uplink NAS Count; where the basic key Kasme comes from the access and mobility management function of the 5G core network of the fifth generation mobile communication AMF maps the 4G security context of the fourth-generation mobile communication.
The key generation method according to claim 1, before the step of generating the initial key KeNB, further comprising:

The MME needs to issue an initial context establishment request carrying the initial key KeNB.
The key generation method according to claim 3, wherein the initial context establishment request carrying the initial key KeNB needs to be issued includes:

The MME learns that the user equipment UE is updated from the 5G tracking area to 4G, and determines that the UE has uplink data or uplink signaling that needs to be uploaded.
The key generation method according to claim 4, wherein the determining that the UE has uplink data or uplink signaling that needs to be uploaded includes:

The MME receives a tracking area update TAU request message carrying an activation flag from the UE.
The key generation method according to claim 3, wherein the initial context establishment request carrying the initial key KeNB needs to be issued includes:

The MME learns that the user equipment UE updates the TAU to 4G from the 5G tracking area, and determines that the user plane needs to be activated.
The key generation method according to claim 6, wherein the determining that the user plane needs to be activated includes:

The MME determines that the user plane needs to be activated according to the local configuration of the MME or other reasons.
The method according to any one of claims 1 to 7, wherein the fixed value of the uplink NAS Count is: 2 32 -1, or 0.
A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the key generation method according to any one of claims 1 to 8.
A device for realizing key generation, including a processor and a memory; wherein a computer program that can be run on the processor is stored in the memory: for executing the key generation according to any one of claims 1 to 8 Method steps.
A mobility management entity MME, comprising the device for realizing key generation according to claim 10.