Apparatuses and methods for wireless communication

Patent metadata

Field	Value
Publication number	US-9918225-B2
Application number	US-201514919397-A
Country	US
Kind code	B2
Filing date	Oct 21, 2015
Priority date	Nov 3, 2014
Publication date	Mar 13, 2018
Grant date	Mar 13, 2018

Abstract

One feature pertains to a method operational at a device. The method includes performing authentication and key agreement with a session key management entity (SKME) device. The method also includes generating an authentication session key based in part on a secret key shared with a home subscriber server, the authentication session key being known to the SKME device. The method further includes generating a mobility session key based in part on the authentication session key, the mobility session key being known to a mobility management entity serving the device. Data sent from the device to a wireless communication network is cryptographically secured using the mobility session key.

First claim

What is claimed is:

1. A method operational at a session key management entity (SKME), the method comprising:
obtaining, at the SKME, authentication information associated with a device, the authentication information including at least an authentication session key;
performing authentication and key agreement (AKA) with the device using at least a portion of the authentication information;
after performing AKA with the device, generating, at the SKME, a mobility session key based in part on the authentication session key and a mobility management entity (MME) identification value that identifies an MME serving the device; and
transmitting the mobility session key from the SKME to the MME serving the device.

2. The method of claim 1 , further comprising:
generating different mobility session keys for different MMES based on the authentication session key.

3. The method of claim 1 , wherein obtaining the authentication information includes:
determining that authentication information associated with the device is not stored at the SKME;
transmitting an authentication information request to a home subscriber server; and
receiving the authentication information associated with the device from the home subscriber server in response to transmitting the authentication information request.

4. The method of claim 1 , wherein obtaining the authentication information includes:
determining that authentication information associated with the device is stored at the SKME; and
retrieving the authentication information from a memory circuit at the SKME.

5. The method of claim 4 , further comprising:
receiving a key set identifier from the device; and
determining that the authentication information associated with the device is stored at the SKME based on the key set identifier received.

6. The method of claim 1 , further comprising:
prior to performing authentication and key agreement with the device, receiving, from the MME, a non-access stratum (NAS) message originating from the device.

7. The method of claim 1 , wherein the MME identification value is a globally unique MME identifier (GUMMEI).

8. The method of claim 1 , wherein the MME identification value is an MME group identifier (MMEGI).

9. The method of claim 1 , further comprising:
generating a different mobility management key for each MME serving the device, each of the different mobility management keys based in part on the authentication session key and a different MME identification value associated with each MME.

10. The method of claim 1 , further comprising:
determining that, in connection to an MME relocation, a second MME is attempting to serve the device;
generating a second mobility management key based in part on the authentication session key and a second MME identification value associated with the second MME; and
transmitting the second mobility management key to the second MME to facilitate MME relocation.

11. The method of claim 1 , further comprising:
maintaining a counter value Key Count; and
generating the mobility session key based further in part on a counter value Key Count.

12. The method of claim 1 , wherein generating the mobility session key includes deriving the mobility session key using a key derivation function having at least one of the authentication session key, the MME identification value uniquely identifying the MME, and/or a counter value Key Count as input(s).

13. A session key management entity (SKME) comprising:
a communication interface adapted to send and receive data; and
a processing circuit communicatively coupled to the communication interface, the processing circuit adapted to:
obtain, at the SKME, authentication information associated with a device, the authentication information including at least an authentication session key;
perform authentication and key agreement (AKA) with the device using at least a portion of the authentication information;
after performing AKA with the device, generate, at the SKME, a mobility session key based in part on the authentication session key and a mobility management entity (MME) identification value that identifies an MME serving the device; and
transmit the mobility session key from the SKME to the MME serving the device.

14. The SKME of claim 13 , wherein the processing circuit is further adapted to:
generate different mobility session keys for different MMES based on the authentication session key.

15. The SKME of claim 13 , wherein the processing circuit adapted to obtain the authentication information includes:
determine that authentication information associated with the device is not stored at the network device;
transmit an authentication information request to a home subscriber server; and
receive the authentication information associated with the device from the home subscriber server in response to transmitting the authentication information request.

16. The SKME of claim 13 , wherein the processing circuit is further adapted to:
prior to performing authentication and key agreement with the device, receiving, from the MME, a non-access stratum (NAS) message originating from the device.

17. The SKME of claim 16 , wherein the NAS message received includes a device identifier that identifies the device and the MME identification value that identifies the MME.

18. A session key management entity (SKME) comprising:
means for obtaining, at the SKME, authentication information associated with a device, the authentication information including at least an authentication session key;
means for performing authentication and key agreement (AKA) with the device using at least a portion of the authentication information;
after performing AKA with the device, means for generating, at the SKME, a mobility session key based in part on the authentication session key and a mobility management entity (MME) identification value that identifies an MME serving the device; and
means for transmitting the mobility session key from the SKME to the MME serving the device.

19. The SKME of claim 18 , further comprising:
means for generating different mobility session keys for different MMES based on the authentication session key.

20. A non-transitory computer-readable storage medium having instructions stored thereon that are operational at a session key management entity (SKME), the instructions when executed by at least one processor causes the processor to:
obtain, at the SKME, authentication information associated with a device, the authentication information including at least an authentication session key;
perform authentication and key agreement (AKA) with the device using at least a portion of the authentication information;
after performing AKA with the device, means for generating, at the SKME, a mobility session key based in part on the authentication session key and a mobility management entity (MME) identification value that identifies an MME serving the device; and
transmit the mobility session key from the SKME to the MME serving the device.

21. The non-transitory computer-readable storage medium of claim 20 , wherein the instructions when executed by the processor further cause the processor to:
generate different mobility session keys for different MMES based on the authentication session key.

Assignees

• Qualcomm Inc

Inventors

• Lee Soo Bum
• Horn Gavin Bernard
• Palanigounder Anand

Classifications

• H04W12/06 Primary

  Authentication · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04W12/0433

  Key management protocols · CPC title