METHOD AND RELATED DEVICE FOR GENERATING GROUP KEY

• US 20140237559A1
• Filed: 04/29/2014
• Published: 08/21/2014
• Est. Priority Date: 11/01/2011
• Status: Abandoned Application

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: ZHANG, Lijia, CHEN, Jing, XU, Yixian
• Application Number:
  US14/264,566
• Publication Number:
  US 20140237559A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method and a related device for generating a group key are provided. A group ID of a group to which an MTC device belongs and a group communication root key related to a security key are received from an MME, where the security key is corresponding to the group ID; a group key corresponding to the group ID is generated according to the group communication root key; and a generating parameter used to generate the group key is sent to the MTC device, so that the MTC device generates the group key according to the group key generating parameter and a security key saved in the MTC device. Therefore, a base station only needs to maintain a same group key for a same group, thereby reducing the operation complexity of the base station.

Claims

1. A base station, comprising:

a receiving module, configured to receive, from a mobility management entity (MME), a group ID of a group to which a machine type communication (MTC) device belongs, and a group communication root key related to a security key, wherein the security key is corresponding to the group ID;

or, receive, from the MME, a service ID of a service supported by the MTC device, and a service root key related to a security key, wherein the security key is corresponding to the service ID, determine, according to the service ID, the group ID of the group to which the MTC device belongs, and generate the group communication root key according to the group ID and the service root key;

a generating module, configured to generate a group key corresponding to the group ID according to the group communication root key; and

a first sending module, configured to send, to the MTC device, a generating parameter used to generate the group key, so that the MTC device generates the group key according to the group key generating parameter and a security key which is saved in the MTC device.

2. The base station according to claim 1, wherein the receiving module is further configured to receive, from the MME, a random number used to generate a group communication root key;

and

the group key generating parameter sent to the MTC device comprises the random number.

3. The base station according to claim 1, wherein the group communication root key is generated according to a random number;

and

the first sending module is configured to send, in an authentication process of the MTC device, to the MTC device, an authentication parameter used to generate the group communication root key, wherein the authentication parameter comprises the random number.

4. The base station according to claim 1, wherein when the group communication root key is generated according to the group ID and the service root key, generating the group communication root key according to a random number is further comprised;

and

the first sending module is configured to send the group ID and the random number to the MTC device.

5. The base station according to claim 1, further comprising:

a binding module, configured to bind the group communication root key, the group key and the group key generating parameter with the group ID; and

a second sending module, configured to send, when it is determined that another MTC device belongs to the group corresponding to the group ID, the group key generating parameter bound with the group ID to the another MTC device, so that the another MTC device generates the group key according to the group key generating parameter and the security key corresponding to the group ID or the service ID.

6. The base station according to claim 1, further comprising:

an updating module, configured to update the group key when a hyper frame number HFN corresponding to the group ID reaches a threshold, wherein all MTC devices with the group ID share one HFN; and

a third sending module, configured to send, to the MTC device, update information used to update the group key, so that the MTC device updates the group key according to the update information.

7. The base station according to claim 1, wherein all MTC devices with the group ID share one HFN,

the HFN corresponding to the group ID is preset to a fixed value;

or

the base station further comprises a fourth sending module, configured to send, through respective signaling bearers of all the MTC devices in the group corresponding to the group ID, a common signaling bearer of the group corresponding to the group ID or a broadcast channel, a value of the HFN to all the MTC devices in the group corresponding to the group ID;

or configured to send, when the HFN corresponding to the group ID reaches a threshold, through respective signaling bearers of all the MTC devices in the group corresponding to the group ID, a common signaling bearer of the group corresponding to the group ID or a broadcast channel, indication information used to indicate that the HFN needs to be added by 1 to all the MTC devices in the group corresponding to the group ID.

8. The base station according to claim 1, further comprising:

a fifth sending module, configured to send, when the MTC device rejoins group communication corresponding to the group ID after entering an idle state or a detached state, a key update count required for updating the group key to the MTC device, so that the MTC device updates the group key according to the key update count;

or

a sixth sending module, configured to send, when another MTC device joins group communication corresponding to the group ID for a first time, the generating parameter used to generate the group key and a key update count required for updating the group key to the another MTC device, so that the another MTC device generates the group key according to the group key generating parameter, the key update count and the security key corresponding to the group ID or the service ID,

wherein the key update count is added by 1 each time when an HFN corresponding to the group ID reaches a threshold.

9. A mobility management entity, comprising:

a first receiving module, configured to receive a group ID, sent by a machine type communication (MTC) device, of a group to which the MTC device belongs, or a service ID of a service supported by the MTC device;

a first sending module, configured to send the group ID or the service ID to a home subscriber system (HSS) serving the MTC device, so that the HSS generates a group communication root key according to a generated random number and a security key corresponding to the group ID, or so that the HSS generates a service root key according to a generated random number and a security key corresponding to the service ID;

a second receiving module, configured to receive the group communication root key or the service root key from the HSS; and

a second sending module, configured to send the group ID and the group communication root key to a base station, or send the service ID and the service root key to a base station, so that the base station performs the following actions;

(1) in a case of receiving the group ID and the group communication root key, generates a group key corresponding to the group ID according to the group communication root key, or in a case of receiving the service ID and the service root key, determines, according to the service ID, the group ID of the group to which the MTC device belongs, generates a group communication root key corresponding to the group ID according to the group ID and the service root key, and generates the group key corresponding to the group ID according to the group communication root key; and

(2) sends, to the MTC device, a generating parameter used to generate the group key, so that the MTC device generates the group key according to the group key generating parameter and a security key which is saved in the MTC device.

10. The mobility management entity according to claim 9, wherein the first sending module is configured to send, when the group ID is not bound with the group communication root key corresponding to the group ID, or the service ID is not bound with the service root key corresponding to the service ID, the group ID or the service ID to the home subscriber system HSS serving the MTC device.

11. The mobility management entity according to claim 9, further comprising:

a first binding module, configured to bind the group communication root key with the group ID and store the group communication root key and the group ID, or bind the service root key with the service ID and store the service root key and the service ID; and

a third sending module, configured to send, when an attach request that carries the group ID or the service ID and that is sent by another MTC device is received, and if the MTC device performs authentication with a network side successfully, the group ID and the group communication root key, or the service ID and the service root key to the base station.

12. The mobility management entity according to claim 9, wherein the second receiving module is configured to receive the group communication root key or the service root key and the random number from the HSS;

and

the second sending module is further configured to send the random number to the base station, so that the base station sends the random number to the MTC device.

13. The mobility management entity according to claim 12, further comprising:

a second binding module, configured to bind the group communication root key and the random number with the group ID and store the group communication root key, the random number and the group ID, or bind the service root key and the random number with the service ID and store the service root key, the random number and the service ID; and

a fourth sending module, configured to send, when an attach request that carries the group ID or the service ID and that is sent by another MTC device is received, and if the MTC device performs authentication with the network side successfully, the group ID, and the group communication root key and the random number that are bound with the group ID to the base station, or the service ID, and the service root key and the random number that are bound with the service ID to the base station.

14. The mobility management entity according to claim 9, further comprising:

a third receiving module, configured to receive a group authentication parameter from the HSS, wherein the group authentication parameter is generated by the HSS according to the security key, or generated by the HSS according to the security key and an individual key of the MTC device; and

an authentication module, configured to perform authentication with the MTC device according to the group authentication parameter.

15. A machine type communication device, comprising:

a sending module, configured to send, to a mobility management entity (MME), a group ID of a group to which the machine type communication (MTC) device belongs or a service ID of a service supported by the MTC device, so that the MME sends the group ID or the service ID to a subscriber home system (HSS) serving the MTC device, the HSS generates a group communication root key according to a random number and a security key corresponding to the group ID, or generates a service root key according to a random number and a security key corresponding to the service ID, and sends the group communication root key or the service root key to the MME, the MME sends the group ID and the group communication root key to a base station, or the MME sends the service ID and the service root key to a base station, and in a case of receiving the group ID and the group communication root key, the base station generates a group key corresponding to the group ID according to the group communication root key, or in a case of receiving the service ID and the service root key, the base station determines, according to the service ID, the group ID of the group to which the MTC device belongs, generates a group communication root key corresponding to the group ID according to the group ID and the service root key, and generates the group key corresponding to the group ID according to the group communication root key;

a first receiving module, configured to receive, from the base station, a generating parameter used to generate the group key; and

a generating module, configured to generate the group key according to the group key generating parameter and a security key saved in the MTC device.

16. The machine type communication device according to claim 15, wherein in a case that the base station receives the group ID and the group communication root key, the first receiving module is configured to receive, in an authentication process of the MTC device, an authentication parameter used to generate the group communication root key from the base station;

or receive the random number from the base station, wherein the random number is sent to the base station by the HSS through the MME.

17. The machine type communication device according to claim 15, wherein in a case that the base station receives the service ID and the service root key, the first receiving module is configured to receive the group ID and the random number from the base station, wherein the random number is sent to the base station by the HSS through the MME, and the group ID is determined by the base station according to the service ID.

18. The machine type communication device according to claim 15, further comprising:

a second receiving module, configured to receive, from the base station, update information used to update the group key, wherein the base station updates the group key when an HFN corresponding to the group ID reaches a threshold, and all MTC devices with one ID share a same HFN; and

a first updating module, configured to update the group key according to the update information.

19. The machine type communication device according to claim 15, wherein all the MTC devices with one group ID share the same HFN, and

the HFN corresponding to the group ID is preset to a fixed value;

or

the machine type communication device further comprises a third receiving module, configured to receive a value of the HFN from the base station through a signaling bearer of the MTC device, a common signaling bearer of the group corresponding to the group ID or a broadcast channel;

or

the machine type communication device further comprises a fourth receiving module, configured to receive, when the HFN corresponding to the group ID reaches the threshold, from the base station, indication information used to indicate that the HFN needs to be added by 1, through a signaling bearer of the MTC device, a common signaling bearer of the group corresponding to the group ID or a broadcast channel.

20. The machine type communication device according to claim 15, further comprising:

a fifth receiving module, configured to receive, when the MTC device rejoins group communication corresponding to the group ID after entering an idle state or a detached state, from the base station, a key update count required for updating the group key, wherein the key update count is added by 1 by the base station each time when an HFN corresponding to the group ID reaches a threshold; and

a second updating module, configured to update the group key according to the key update count.