Method and device for key generation

Patent metadata

Field	Value
Publication number	US-9049594-B2
Application number	US-201313952985-A
Country	US
Kind code	B2
Filing date	Jul 29, 2013
Priority date	Jan 28, 2011
Publication date	Jun 2, 2015
Grant date	Jun 2, 2015

Abstract

A method and a device for key generation are disclosed in embodiments of the present invention. The method for key generation is applied to a UMTS-LTE resource convergence scenario that has a base station as an anchor point, and includes: deriving, according to a root key and a count value of an LTE system, or according to a random number and an LTE system root key, a UMTS integrity key and cipher key, and sending the UMTS integrity key and cipher key to a UMTS control node. The embodiments of the present invention enable the derivation of the UMTS integrity key and cipher key in a UMTS-LTE resource convergence scenario that has a base station as an anchor point, enable a user equipment to communicate securely through a UMTS, and further improve security of data transmitted in the UMTS.

First claim

What is claimed is:

1. A method for key generation, applied to a universal mobile telecommunications system (UMTS)-long term evolution (LTE) resource convergence scenario that has a base station as an anchor point, the method comprising:
after establishing a Radio Bearer between a User Equipment (UE), which is served by an LTE system, and a UMTS control node, deriving, according to a root key and a count value of the LTE system, or according to a random number and a root key of the LTE system, a UMTS integrity key and cipher key; and
sending the UMTS integrity key and cipher key to the UMTS control node, so that the UMTS control node implements cipher and integrity protection by using the UMTS integrity key and cipher key.

2. The method according to claim 1 , wherein the LTE system root key comprises a non-access stratum root key to the LTE system and the count value of the LTE system comprises a current non-access stratum count value of the LTE system;
before the deriving, according to a root key and a count value of an LTE system, or according to a random number and an LTE system root key, a UMTS integrity key and cipher key, the method further comprises:
receiving, by a core network node of the LTE system, a UMTS key derivation instruction message from an access network node of the LTE system; and
the deriving, according to a root key and a count value of an LTE system, or according to a random number and an LTE system root key, a UMTS integrity key and cipher key comprises:
deriving, by the core network node of the LTE system, according to the current non-access stratum count value of the LTE system and the non-access stratum root key to the LTE system, or according to the non-access stratum root key to the LTE system and a random number generated by the core network node of the LTE system, a UMTS integrity key and cipher key.

3. The method according to claim 2 , wherein the sending the UMTS integrity key and cipher key to a UMTS control node comprises:
sending, by the core network node of the LTE system, the UMTS integrity key and cipher key to the access network node of the LTE system, so that the access network node of the LTE system sends the UMTS integrity key and cipher key to the UMTS control node.

4. The method according to claim 1 , wherein the LTE system root key comprises an access layer root key to the LTE system and the count value of the LTE system comprises a packet data convergence protocol count value of the LTE system; and
the deriving, according to a root key and a count value of an LTE system, or according to a random number and an LTE system root key, a UMTS integrity key and cipher key comprises:
deriving, by an access network node of the LTE system, according to the access layer root key to the LTE system and the packet data convergence protocol count value of the LTE system, or according to the access layer root key to the LTE system and a random number generated by the access network node of the LTE system, a UMTS integrity key and cipher key.

5. The method according to claim 4 , wherein the sending the UMTS integrity key and cipher key to the UMTS control node, comprising:
sending, by the access network node of the LTE system, the UMTS integrity key and cipher key to the UMTS control node.

6. The method according to claim 1 , further comprising:
receiving, by the UMTS control node, the UMTS integrity key and cipher key as well as the UE security capability;
sending, by the UMTS control node, through an access network node of the LTE system, a security mode command message under integrity protection to a user equipment, wherein the security mode command message carries: an integrity algorithm and a cipher algorithm that are selected by the UMTS control node according to the UE security capability, the UE security capability and parameter values generated by the UMTS control node, and an integrity message authentication code generated by the UMTS control node according to the UMTS integrity key, the parameter values generated by the UMTS control node, an integrity sequence number, the security mode command message, and a direction indication; and
receiving, by the UMTS control node, a security mode command complete message under integrity protection that is sent, through the access network node of the LTE system, from the UE, wherein the UE sends the security mode command complete message to the UMTS control node through the access network node of the LTE system in the following scenario: after the UE receives the security mode command message, the UE generates an integrity message authentication code according to a UE integrity key to UMTS, the integrity sequence number, the direction indication, the security mode command message, and parameter values carried in the security mode command message; additionally, the UE determines that the integrity message authentication code generated by the UE is consistent with an integrity message authentication code carried in the security mode command message and the UE security capability carried in the security mode command message is consistent with a security capability of the UE itself.

7. A method for key generation, applied to a universal mobile telecommunications system (UMTS)-long term evolution (LTE) resource convergence scenario that has a base station as an anchor point, the method comprising:
after establishing a Radio Bearer between a User Equipment (UE), which is served by an LTE system, and a UMTS control node, sending, by an access network node of the LTE system, a UMTS key derivation instruction message to the UMTS control node, wherein the UMTS key derivation instruction message carries a random number generated by the access network node of the LTE system, so that the UMTS control node generates, according to an internet protocol security key and the random number, a UMTS integrity key and cipher key; and
deriving, by the access network node of the LTE system, according to the internet protocol security key and the random number, a UMTS integrity key and cipher key.

8. The method according to claim 7 , before the sending, by an access network node of an LTE system, a UMTS key derivation instruction message to a UMTS control node, further comprising:
performing, by the access network node of the LTE system and the UMTS control node, a certificate-based authentication procedure, so as to generate the internet protocol security key and the random number.

9. A method for key generation, applied to a universal mobile telecommunications system (UMTS)-long term evolution (LTE) resource convergence scenario that has a base station as an anchor point, the method comprising:
receiving, by a user equipment (UE) served by an LTE system, a UMTS key derivation instruction message after a Radio Bearer between the UE and a UMTS control node is established; and
deriving, by the UE, according to a count value and a root key to the LTE system, or according to a root key of the LTE system and a random number carried in the UMTS key derivation instruction message, a UMTS integrity key and cipher key.

10. The method according to claim 9 , wherein the LTE system root key comprises a non-access stratum root key to the LTE system, the count value of the LTE system comprises a current non-access stratum count value of the LTE system, and the random number carried in the UMTS key derivation instruction message comprises a random number generated by a core network node of the LTE system;
the receiving, by the UE, a UMTS key derivation instruction message comprises:
receiving, by the UE, the UMTS key derivation instruction message from the core network node of the LTE system; and
the deriving, by the UE, according to a count value and a root key

Assignees

• Huawei Tech Co Ltd

Inventors

• Chen Xinyi
• Zhang Dongmei
• Zhang Lijia
• Liu Xiaohan

Classifications

• H04W88/12

  Access point controller devices · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W12/0431

  Key distribution or pre-distribution; Key agreement · CPC title