Generating keys for protection in next generation mobile networks

• US 20080184032A1
• Filed: 10/19/2007
• Published: 07/31/2008
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Hietala, Mika P., Niemi, Valtteri, Zhang, Dajiang, Li, Changhong
• Granted Patent: US 9,554,271 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/062 Pre-authentication

Abstract

A set of associated keys for an authentication process to be performed in a second network is calculated based on a random value used in an authentication process of a first network.

Claims

1. A method comprising:

producing a set of associated keys for an authentication process to be performed in a second network based on a random value used in an authentication process of a first network.

2. The method of claim 1, comprising:

producing a set of associated random values to be used in the authentication process of the second network based on the random value used in the authentication process of the first network; and

producing the set of associated keys based on the set of associated random values.

3. The method of claim 2, comprising:

producing the set of associated random values based on the random value using identities of network entities of the second network, the network entities being associated through the authentication process to be performed in the second network.

4. The method of claim 1, comprising:

producing keys of an authentication process of the first network based on the random value; and

producing the set of associated keys based on the keys using identities of network entities of the second network, the network entities being associated through the authentication process to be performed in the second network.

5. The method of claim 1, comprising:

obtaining the random value of the first network during an initial access of a user equipment towards the second network and/or during a handover process of a user equipment from the first network to the second network.

6. The method of claim 3, wherein the network entities comprise at least one of a base station, a mobility management element and a user plane element.

7. The method of claim 1, wherein the set of associated keys comprises a set of associated ciphering keys and a set of associated integrity protections keys.

8. The method of claim 1, wherein the set of associated keys comprises a key used for access stratum protection, a key used for non-access stratum protection, and a key used for user-plane protection.

9. A network device comprising:

a receiving unit configured to receive a random value used in an authentication process of a first network; and

a calculating unit configured to calculate a set of associated keys for an authentication process to be performed in a second network based on the random value.

10. The network device of claim 9, wherein the receiving unit is configured to receive keys of the authentication process of the first network, the network device comprising:

a transmitting unit configured to transmit the keys to a home subscriber server,

wherein the receiving unit is configured to receive modified keys of the authentication process of the first network from the home subscriber server,

and the calculating unit is configured to calculate the set of associated keys based on the modified keys.

11. The network device of claim 9, wherein the calculating unit is configured to calculate the set of associated keys using identities of network entities of the second network, the network entities being associated through the authentication process to be performed in the second network, wherein the network entities include said network device.

12. The network device of claim 9, comprising:

a transmitting unit configured to transmit the random value and identities of network entities of a second network to a home subscriber server, the network entities being associated through an authentication process to be performed in the second network, wherein the network entities include said network device,

wherein the receiving unit is configured to receive a set of associated keys for the authentication process to be performed in the second network from the home subscriber server.

13. The network device of claims 11, wherein the transmitting unit is configured to transmit the identities of the network entities towards said network entities.

14. A network device comprising:

a transmitting unit configured to transmit a random value used in an authentication process of a first network to a network device of a second network during a handover process of a user equipment from the first network to the second network.

15. The network device of claim 14, wherein the transmitting unit is configured to transmit keys of the authentication process of the first network to the network device of the second network.

16. A user equipment comprising:

a receiving unit configured to receive identities of network entities of a second network, the network entities being associated through an authentication process to be performed in the second network; and

a calculating unit configured to calculate a set of associated keys for the authentication process to be performed in the second network using the identities of the network entities.

17. A network device comprising:

a receiving unit configured to receive keys of an authentication process of a first network;

a calculating unit configured to calculate modified keys based on the keys; and

a transmitting unit configured to transmit the modified keys to a network element of a second network in which an authentication process is to be performed.

18. The network device of claim 17, wherein

the receiving unit is configured to receive a random value used in an authentication process of a first network and identities of network entities of a second network, the network entities being associated through an authentication process to be performed in the second network;

the calculating unit is configured to calculate a set of associated keys for the authentication process to be performed in the second network based on the random value using the identities; and

the transmitting unit is configured to transmit the set of associated keys to a network element of the second network.

19. The network device of claim 17, wherein

the receiving unit is configured to receive an authentication data request for an authentication to be performed in a second network;

and

the transmitting unit is configured to transmit a random value used in an authentication process of a first network and keys of the authentication process of the first network upon the authentication data request.