Methods and devices having a key distributor function for improving the speed and quality of a handover

Patent metadata

Field	Value
Publication number	US-9860220-B2
Application number	US-201514858018-A
Country	US
Kind code	B2
Filing date	Sep 18, 2015
Priority date	Apr 26, 2010
Publication date	Jan 2, 2018
Grant date	Jan 2, 2018

Abstract

A key distributor node for a network includes a memory device with at least one first key, at least one data communication device that can exchange data with first and second access nodes for a terminal integrated wirelessly into the network, at least one processor connected to the memory device and the data communication device, wherein functions are provided for the processor(s) that allow authentication of the terminal at the second access node in response to a key request received by the second access node, a derivation of a second key from the first key, and triggered transmission of the second key through the data communication device to the second access node. Connections to the network's first and second access nodes with security relationships can be provided for the key distributor node when using the first key.

First claim

The invention claimed is:

1. A key distributor node, comprising:
a memory device with at least one first key, said first key derived from a master key for building a secure relationship;
at least one data communication device configured to exchange data with first and second access nodes integrated wirelessly into a network in which the key distributor node is connected, wherein the first key is derived from the master key during establishment of a security relationship between the second access node and the key distributor node,
at least one processor connected to the memory device and the data communication device,
wherein functions are provided for the at least one processor to complete a handover of a terminal from the first access node to the second access node by responding to a received key request from the terminal via the second access node using the established security relationship with the key distributor node by:
deriving a second key from the first key in response to the key request at the key distributor node, and
transmitting the derived second key to the second access node via the data communication device and forwarding the second key to the terminal to establish a secure relationship for communications between the terminal and the second access node in order to complete the handover without renewal of authentication of the terminal and without the second access node forming a secure relationship with the first access node.

2. The key distributor node of claim 1 , wherein the key distributor node is an authentication server.

3. The key distributor node of claim 1 , the key distributor node is a node on a mesh network.

4. The key distributor node of claim 1 , wherein the second key encodes proprietary features of the terminal.

5. The key distributor node of claim 1 , wherein the first and second keys are symmetric key pairs.

6. The key distributor node of claim 1 , wherein the network facilitates at least one member of the group consisting of a voice-over-IP application and a video-on-demand application.

7. A combination comprising the key distributor node of claim 1 , a first access node and a second access node.

8. The combination of claim 7 , wherein the first and second access nodes are nodes on a mesh network.

9. A network comprising the key distributor node of claim 1 , a first access node, a second access node, and a terminal.

10. The network of claim 9 , wherein said network is a mesh network; and
wherein the key distributor node has connections to the first and second access nodes with security relationships that are established prior to the key request being received by the key distributor node.

11. The network of claim 10 , wherein the mesh network is a local network.

12. A method for authenticating a terminal during a handover procedure in a network comprising:
a key distributor node authenticating a first access node of a network to form a security relationship between the first access node and the key distributor node;
the key distributor node authenticating a second access node of the network to form a security relationship between the second access node and the key distributor node;
a communication terminal moving away from a wireless cell of the first access node toward a wireless cell of the second access node after the authenticating the first and second access nodes by the key distributor node, the communication terminal moving away from the wireless cell of the first access node toward the wireless cell of the second access node such that the communication terminal initiates a handover procedure from the first access node to the second access node, the handover procedure comprising:
the second access node requesting a second key from the key distributor node for forming a security relationship between the second access node and the communication terminal without establishing a secure relationship between the first and second access nodes for performing the handover procedure,
in response to the request for the second key for forming the security relationship between the communication terminal and the second access node, the key distributor node generating the second key by deriving that second key from a first key saved in a storage device accessible by the key distributor node and subsequently sending the derived second key to the second access node, the first key being a pre-existing key that was previously saved by the key distributor node when forming the security relationship between the second access node and the key distributor node prior to the key distributor node receiving the request for the second key from the second access node, and
the second access node communicating an authentication response to the communication terminal based on the second key received from the key distributor node to facilitate the handover procedure for associating the communication terminal with the second access node without forming secure relationship between the first and second access nodes for performing the handover procedure, the second key forming a basis for protecting a communication relationship between the second access node and the communication terminal.

13. The method of claim 12 , wherein the second key is a PMK-R1 key.

14. The method of claim 13 , wherein the first key is a PMK-R0 key that is generated based on the authenticating of the second access node.

15. The method of claim 12 , wherein the key distributor node is an authentication server.

16. The method of claim 12 , wherein the handover procedure is performed such that no communication with a mobility domain controller is involved to effect the handover.

17. A non-transitory computer-readable storage media comprising instructions that are executable by a key distributor node that, when implemented, result in the key distributor node performing a method comprising:
the key distributor node authenticating a first access node of a network to form a security relationship between the first access node and the key distributor node;
the key distributor node authenticating a second access node of the network to form a security relationship between the second access node and the key distributor node;
the key distributor node responding to a request for a second key from the second access node for use in forming a security relationship between the second access node and a communication terminal that is received after the first and second access nodes were authenticated by the key distributor node by generating the second key by deriving that second key from a first key saved in a storage device accessible by the key distributor node that was formed during the authenticating of the second access node of the network to form the security relationship between the second access node and the key distributor node and subsequently sending the derived second key to the second access node, wherein the generated second key sent to the second access node is usable for facilitating a handover procedure from the first access node to the second access node for associating the communication terminal with the second access node without an establishment of a secure relationship between the first access node and the second access node for performing the handover, the second key forming a basis for protecting a communication relationship between the second access node and the communication terminal.

18. The non-transitory computer-readable storage media of claim 17 , wherein the method is defined such that the handover procedure is performed without communication with a mobility

Assignees

• Unify Gmbh & Co Kg

Inventors

• Gamer Thomas
• Roth Matthias
• Bahr Michael
• Schwingenschlogl Christian

Classifications

• H04L63/062 Primary

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04W36/0016

  Hand-off preparation specially adapted for end-to-end data sessions · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04W12/06

  Authentication · CPC title