Method, device, and system for anchor key generation and management in a communication network for encrypted communication with service applications

Patent metadata

Field	Value
Publication number	US-12328305-B2
Application number	US-202217858271-A
Country	US
Kind code	B2
Filing date	Jul 6, 2022
Priority date	Jan 16, 2020
Publication date	Jun 10, 2025
Grant date	Jun 10, 2025

Abstract

This disclosure generally relates to encrypted communication between terminal devices and service applications via a communication network. Such encrypted communication may be based on various hierarchical levels of encryption keys that are generated and managed by the communication network. Such encrypted communication and key management may be provided by the communication network to the terminal devices as a service that can be subscribed to. The various levels of encryption keys may be managed to improve flexibility of the communication network and to reduce potential security breaches.

First claim

What is claimed is:

1. A method for generation of an anchor key in a network device in a communication network, the method being performed by the network device and comprising:
obtaining a subscription data packet associated with an application security subscription of a user network module to an anchor key management service, the anchor key management service being user-subscribable separate from a subscription to accessing the communication network;
extracting from the subscription data packet a subscription dataset, wherein the subscription dataset comprises a subscription permanent identifier, SUPI, and an identifier of an application key management network node in the communication network that is associated with a service application;
generating a base authentication key upon successful completion of an authentication process for registering the user network module with the communication network;
generating the anchor key based on the base authentication key and the SUPI;
generating a unique identifier for the anchor key based on the identifier of the application key management network node; and
wherein the anchor key is used for a user equipment associated with the user network module and the service application to generate an application encryption key for encrypted communication therebetween.

2. The method of claim 1 , wherein the network device comprises the user equipment.

3. The method of claim 2 , wherein the subscription dataset is stored in the user equipment during the subscription of the user network module to the anchor key management service.

4. The method of claim 3 , wherein generating the anchor key is further based on at least one of a type of the user network module, and an authentication dataset generated during the authentication process for registering the user equipment with the communication network.

5. The method of claim 4 , wherein:
the authentication dataset comprises a random number generated in the authentication process for registering the user network module with the communication network; and
generating the anchor key comprises generating the anchor key based on the base authentication key, the SUPI, and the random number.

6. The method of claim 5 , wherein generating the unique identifier for the anchor key comprises generating the unique identifier for the anchor key based on the random number and the identifier of the application key management network node.

7. The method of claim 1 , wherein the network device comprises an authentication network node in the communication network.

8. The method of claim 7 , wherein:
the subscription data packet is obtained from a user data management network node of the communication network separate from the authentication network node; and
the user data management network node is configured to store user subscription information.

9. The method of claim 8 , wherein generating the anchor key is further based on at least one of a type of the user network module, and an authentication dataset generated during the authentication process for registering the user equipment with the communication network.

10. The method of claim 9 , wherein the authentication dataset is generated by the user data management network node.

11. The method of claim 10 , wherein:
the authentication dataset comprises a random number generated by the user data management network node in the authentication process for registering the user network module with the communication network; and
generating the anchor key comprises generating the anchor key based on the base authentication key, the SUPI, and the random number.

12. The method of claim 11 , wherein the unique identifier for the anchor key comprises the random number and the identifier of the application key management network node.

13. The method of claim 11 , further comprising transmitting the anchor key and the random number to the application key management network node, wherein:
generating the unique identifier for the anchor key comprises receiving the unique identifier for the anchor key generated by the application key management network node upon receiving the random number from the authentication network node.

14. The method of claim 8 , wherein generating the unique identifier for the anchor key comprises generating by the authentication network node the unique identifier for the anchor key.

15. The method of claim 14 , further comprising transmitting the anchor key and the unique identifier for the anchor key to the application key management network node.

16. The method of claim 1 , wherein generating the anchor key is further based on processing the base authentication key and the subscription dataset using a secure Hash algorithm.

17. A device comprising one or more processors and one or more memories, wherein the one or more processors are configured to read computer code from the one or more memories to implement the method in claim 1 .

Assignees

• Zte Corp

Inventors

• You Shilin
• Cai Jiyan
• Peng Jin
• Yu Wantao
• Liu Yuze
• Lin Zhaoji
• Mao Yuxin
• Wang Jigang

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04W12/069 Primary

  using certificates or pre-shared keys · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title