Security key derivation for handover

Patent metadata

Field	Value
Publication number	US-11071021-B2
Application number	US-201816035239-A
Country	US
Kind code	B2
Filing date	Jul 13, 2018
Priority date	Jul 28, 2017
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

Methods, systems, and devices for wireless communication are described that support security key derivation for handover. A network entity (e.g., an access and mobility function (AMF)) may establish an access stratum (AS) key to ensure secure communications between a user equipment (UE) and a base station. If the UE relocates to a new network entity (e.g., target network entity), the initial network entity (e.g., source network entity) may perform a handover procedure to the target network entity. In some aspects, the network entities may derive a unified AS key for the handover procedure. Additionally, the network entities may utilize one or more intermediate keys (e.g., refreshed intermediate keys) derived from, in part, respective freshness parameters for the handover procedure. The target network entity may then utilize the derived intermediate keys to derive the AS key for the handover procedure and establish communications with the UE.

First claim

What is claimed is:

1. A method for wireless communication at a source access and mobility function (AMF), comprising:
identifying a handover trigger that triggers a handover from the source AMF to a target AMF;
in response to the handover trigger, generating an AMF base key based at least in part on inputting a downlink non-access stratum (NAS) count into a key derivation function;
generating a target base station base key based at least in part on inputting the AMF base key and an uplink NAS count into the key derivation function; and
transmitting, by the source AMF to the target AMF, both of the AMF base key and the target base station base key, wherein the AMF base key is different from the target base station base key.

2. The method of claim 1 , further comprising:
generating an intermediate key based at least in part on a network entity base key, wherein the intermediate key is different from the AMF base key.

3. The method of claim 2 , further comprising:
generating a source base station base key based at least in part on the intermediate key and a counter reserved for refreshing the source base station base key.

4. The method of claim 3 , further comprising:
transmitting the source base station base key to a source base station.

5. The method of claim 3 , further comprising:
generating a refreshed source base station base key based at least in part on the counter reserved for refreshing the source base station base key.

6. The method of claim 1 , further comprising:
generating an encryption key for non-access stratum (NAS) signaling and an integrity key for NAS signaling based at least in part on the AMF base key.

7. The method of claim 1 , wherein the AMF base key is configured exclusively for generating the target base station base key.

8. A method for wireless communication at a target access and mobility function (AMF), comprising:
identifying a handover trigger that triggers a handover from a source AMF to the target AMF;
receiving, from the source AMF, an AMF base key, wherein the AMF base key is based at least in part on a downlink non-access stratum (NAS) count;
receiving, from the source AMF, a target base station base key, wherein the target base station base key is based at least in part on the AMF base key and an uplink NAS count, and wherein the AMF base key is different from the target base station base key; and
transmitting the target base station base key to a target base station.

9. The method of claim 8 , wherein the AMF base key is distinct from an intermediate key used at the source AMF.

10. The method of claim 8 , wherein the AMF base key comprises a chained key of a network entity base key.

11. The method of claim 8 , further comprising:
generating an encryption key for non-access stratum (NAS) signaling and an integrity key for NAS signaling based at least in part on the AMF base key.

12. A method for wireless communication at a user equipment (UE), comprising:
receiving a handover command message via a source access and mobility function (AMF) that triggers a handover of the UE from the source AMF to a target AMF;
receiving an indication of a downlink non-access stratum (NAS) count;
in response to the handover command message, generating an AMF base key based at least in part on inputting the downlink NAS count into a key derivation function;
receiving an indication of a NAS count value; and
generating a target base station base key based at least in part on inputting the AMF base key and the NAS count value into the key derivation function.

13. The method of claim 12 , further comprising:
receiving an indication of an updated NAS count value; and
refreshing the target base station base key based at least in part on the updated NAS count value.

14. The method of claim 12 , further comprising:
receiving an indication of an updated AMF base key; and
refreshing the target base station base key based at least in part on the updated AMF base key.

15. The method of claim 12 , further comprising:
receiving an indication of an updated downlink NAS count; and
refreshing the target base station base key based at least in part on the updated downlink NAS count.

16. The method of claim 12 , further comprising:
communicating with a target base station based at least in part on the target base station base key.

17. The method of claim 12 , further comprising:
generating an intermediate key based at least in part on a network entity base key, wherein the intermediate key is different from the AMF base key.

18. The method of claim 12 , further comprising:
receiving an indication that the AMF base key is configured exclusively for generating the target base station base key.

19. A method for wireless communication at a source access and mobility function (AMF), comprising:
identifying a handover trigger that triggers a handover from the source AMF to a target AMF;
generating, in response to the handover trigger, an AMF base key based at least in part on inputting a downlink non-access stratum (NAS) count into a key derivation function;
generating a target base station base key based at least in part on inputting the AMF base key and an uplink NAS count into the key derivation function;
transmitting both of the AMF base key and the target base station base key to the target AMF; and
generating an encryption key for non-access stratum (NAS) signaling and an integrity key for NAS signaling based at least in part on the AMF base key.

20. A method for wireless communication at a target access and mobility function (AMF), comprising:
identifying a handover trigger that triggers a handover from a source AMF to the target AMF;
receiving an AMF base key from the source AMF, wherein the AMF base key is based at least in part on a downlink non-access stratum (NAS) count;
receiving a target base station base key from the source AMF, wherein the target base station base key is based at least in part on the AMF base key and an uplink NAS count;
transmitting the target base station base key to a target base station; and
generating an encryption key for non-access stratum (NAS) signaling and an integrity key for NAS signaling based at least in part on the AMF base key.

21. A method for wireless communication at a user equipment (UE), comprising:
receiving a handover command message via a source access and mobility function (AMF) that triggers a handover of the UE from the source AMF to a target AMF;
receiving an indication of a downlink non-access stratum (NAS) count;
generating an AMF base key based at least in part on inputting the downlink NAS count into a key derivation function and in response to the handover command message;
receiving an indication of a NAS count value;
generating a target base station base key based at least in part on inputting the AMF base key and the NAS count value into the key derivation function;
receiving an indication of an updated downlink NAS count; and
refreshing the target base station base key based at least in part on the updated downlink NAS count.

22. An apparatus for wireless communication at a source access and mobility function (AMF), comprising:
a processor;
memory coupled with the processor; and
instructions stored in the memory and operable, when executed by the processor, to cause the apparatus to:
identify a handover trigger that triggers a handover from the source AMF to a target AMF;
in response to the handover trigger, generate an AMF base key b

Assignees

• Qualcomm Inc

Inventors

• Lee Soo Bum
• Escott Adrian Edward
• Palanigounder Anand

Classifications

• H04W36/0072

  of resource information of target access point · CPC title

• H04L12/04 Primary

  Switchboards · CPC title

• H04W36/0038 Primary

  of security context information · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L12/4625

  Single bridge functionality, e.g. connection of two networks over a single bridge · CPC title