Generating keys for protection in next generation mobile networks

Patent metadata

Field	Value
Publication number	US-9554271-B2
Application number	US-97604507-A
Country	US
Kind code	B2
Filing date	Oct 19, 2007
Priority date	Oct 20, 2006
Publication date	Jan 24, 2017
Grant date	Jan 24, 2017

Abstract

A set of associated keys for an authentication process to be performed in a second network is calculated based on a random value used in an authentication process of a first network.

First claim

What is claimed is:

1. A method comprising:
obtaining first keys of a first authentication process of a first radio access network during a handover process of a user equipment from the first radio access network to a second radio access network, wherein the first keys of the first authentication process of the first radio access network are produced based on a random value used in the first authentication process of the first radio access network; and
producing second keys for a second authentication process to be performed in the second radio access network having a different radio access technology to the first radio access network, the second keys produced based on the first keys of the first authentication process of the first radio access network and identities of network entities of the second radio access network, wherein the network entities are associated through the second authentication process to be performed in the second radio access network, and wherein the second keys include keys for ciphering, integrity protection, access stratum protection, non-access stratum protection and user-plane protection.

2. The method of claim 1 , wherein the network entities comprise at least one of a base station, a mobility management element and a user plane element.

3. The method of claim 1 , wherein the second radio access network comprises a long term evolution cellular network.

4. An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
receive first keys of a first authentication process of a first radio access network during a handover process of a user equipment from the first radio access network to a second radio access network, wherein the first keys of the first authentication process of the first radio access network are produced based on a random value used in the authentication process of the first radio access network; and
calculate second keys for a second authentication process to be performed in the second radio access network based on the first keys obtained in the authentication process of the first radio access network and identities of network entities of the second radio access network, wherein the network entities are associated through the second authentication process to be performed in the second radio access network, the first radio access network and the second radio access network comprising different radio access technologies, and wherein the associated keys include keys for ciphering, integrity protection, access stratum protection, non-access stratum protection and user-plane protection.

5. The apparatus of claim 4 , wherein the apparatus is further configured to at least:
transmit the first keys to a home subscriber server;
receive modified keys of the authentication process of the first radio access network from the home subscriber server; and
calculate the second keys based on the modified keys.

6. The apparatus of claim 4 , wherein the apparatus transmits the identities of the network entities towards said network entities.

7. The apparatus of claim 4 , wherein the second radio access network comprises a long term evolution cellular network.

8. An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
transmit first keys of a first authentication process of a first radio access network to a network device of a second radio access network during a handover process of a user equipment from the first radio access network to the second radio access network, wherein the first keys of the first authentication process of the first radio access network are produced based on a random value used in the authentication process of the first radio access network, wherein the transmitted keys and identities of network entities of the second radio access network are to be used by the network device of the second radio access network to calculate second keys for a second authentication process to be performed in the second radio access network, wherein the network entities are associated through the second authentication process to be performed in the second radio access network, the first radio access network and the second radio access network comprising different radio access technologies, and wherein the second keys include keys for ciphering, integrity protection, access stratum protection, non-access stratum protection and user-plane protection.

9. The apparatus of claim 8 , wherein the second radio access network comprises a long term evolution cellular network.

10. An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
receive identities of network entities of a second radio access network, during a handover process of a user equipment from a first radio access network to the second radio access network, the network entities being associated through an authentication process to be performed in the second radio access network; and
calculate associated keys for the authentication process to be performed in the second radio access network using the identities of the network entities, the first radio access network and the second radio access network comprising different radio access technologies, wherein the associated keys include keys for ciphering, integrity protection, access stratum protection, non-access stratum protection and user-plane protection.

11. The apparatus of claim 10 , wherein the second radio access network comprises a long term evolution cellular network.

12. An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one processor, the at least one memory, and the computer program code configured to cause the apparatus to at least:
receive first keys of a first authentication process of a first radio access network;
calculate modified keys based on the keys; and
transmit the modified keys to a network element of a second radio access network in which a second authentication process is to be performed, during a handover process of a user equipment from the first radio access network to the second radio access network, wherein the modified keys are to be used by the network element of the second radio access network to calculate second keys for the second authentication process to be performed in the second radio access network, the first radio access network and the second radio access network comprising different radio access technologies, and wherein the second keys include keys foe ciphering, integrity protection, access stratum protection, non-access stratum protection and user-plane protection.

13. The apparatus of claim 12 , wherein the apparatus is further configured to at least:
receive identities of network entities of a second radio access network, the network entities being associated through the second authentication process to be performed in the second radio access network
calculate second keys for the second authentication process to be performed in the second radio access network based on the modified keys using the identities of network entities of the second radio access network, wherein the first keys of the first authentication process of the first radio access network are produced based on a

Assignees

• Li Changhong
• Zhang Dajiang
• Hietala Mika P
• Niemi Valtteri
• Nokia Technologies Oy

Inventors

• Li Changhong
• Zhang Dajiang
• Hietala Mika P
• Niemi Valtteri

Classifications

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W12/062 Primary

  Pre-authentication · CPC title