Key negotiation method and system, network entity and computer storage medium

• US 20170346798A1
• Filed: 07/01/2015
• Published: 11/30/2017
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Yu, Wantao
• Granted Patent: US 10,454,909 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Disclosed is a key negotiation method including that a network entity generates an MTC communication key between an MTC device or an MTC application and a network by utilizing a key distribution algorithm for MTC communication according to a root key for the MTC communication maintained by the network entity. The network entity generates an MTC group key by utilizing a key distribution algorithm for MTC group communication according to the root key. The network entity issues the generated MTC communication key and the generated MTC group key to the MTC device or the MTC application via a secure method so as to allow the MTC device or the MTC application to securely store the MTC communication key and the MTC group key. Also disclosed are a network entity, a key negotiation system and a computer storage medium.

Claims

1. A key negotiation method applied to a network entity, comprising:

generating a Machine Type Communication (MTC) communication key between an MTC device or MTC application and a network by utilizing a key distribution algorithm for MTC communication according to a root key for the MTC communication maintained by the network entity;

generating an MTC group key by utilizing a key distribution algorithm for MTC group communication according to the root key; and

issuing the generated MTC communication key and the generated MTC group key to the MTC device or MTC application via a secure method so as to allow the MTC device or MTC application to securely store the MTC communication key and the MTC group key.

2. The method according to claim 1, before generating the MTC communication key and the MTC group key, the method further comprising:

creating an MTC group and generating a corresponding MTC group identification;

receiving MTC group register request information sent by the MTC device or MTC application; and

validating or certificating the MTC device or MTC application, and after passing the validation or certification, updating and storing a relationship table of the MTC group identification and identity information of the MTC device or MTC application according to related information in the received MTC group register request information.

3. The method according to claim 2, before issuing the generated MTC communication key and the MTC group key to the MTC device or MTC application via the secure method, the method further comprising:

issuing an MTC group notification to the MTC device or MTC application; and

receiving acknowledgement information returned by the MTC device or MTC application.

4. The method according to claim 3, after issuing the MTC communication key and the MTC group key, the method further comprising:

receiving acknowledgement information returned by the MTC device or MTC application.

5. The method according to claim 1, wherein generating the MTC communication key between the MTC device or MTC application and the network by utilizing the key distribution algorithm for the MTC communication according to the root key for the MTC communication maintained by the network entity comprises:

taking the root key, the identity information of the MTC device or MTC application and one random number as distribution parameters, and putting the distribution parameters into the key distribution algorithm for the MTC communication to generate the MTC communication key.

6. The method according to claim 1, wherein generating the MTC group key by utilizing the key distribution algorithm for the MTC group communication according to the root key comprises:

taking the root key and one random number as distribution parameters, and putting the distribution parameters into the key distribution algorithm for the MTC group communication to generate the MTC group key.

7. The method according to claim 1, further comprising:

updating MTC communication keys and/or MTC group keys corresponding to all MTC devices or MTC applications in an MTC group of the network entity according to a set security policy.

8. The method according to claim 7, wherein updating the MTC communication keys and/or MTC group keys corresponding to all the MTC devices or MTC applications in the MTC group of the network entity comprises:

issuing a key update notification to all the MTC devices or MTC applications;

receiving acknowledgement formation returned by the MTC devices or MTC applications; and

issuing the MTC group identification and a new MTC communication key and/or MTC group key corresponding to the MTC group identification to a corresponding MTC device or MTC application via a secure method so as to allow the corresponding MTC device or MTC application to update with and securely store the new MTC communication key and/or MTC group key corresponding to the MTC group identification.

9-16. -16. (canceled)

17. A network entity, comprising:

a first key generating unit, a second key generating unit and a sending unit, wherein

the first key generating unit is configured to generate a Machine Type Communication (MTC) communication key between an MTC device or MTC application and a network by utilizing a key distribution algorithm for MTC communication according to a maintained root key for the MTC communication;

the second key generating unit is configured to generate an MTC group key by utilizing a key distribution algorithm for MTC group communication according to the root key; and

the sending unit is configured to issue the generated MTC communication key and the generated MTC group key to the MTC device or MTC application via a secure method so as to allow the MTC device or MTC application to securely store the MTC communication key and the MTC group key.

18. The network entity according to claim 17, further comprising:

an MTC group creating unit and a receiving unit, wherein

the MTC group creating unit is configured to create an MTC group, generate a corresponding MTC group identification, validate or certificate the MTC device or MTC application, after passing the validation and or certification, update and store a relationship table of the MTC group identification and identity information of the MTC device or MTC application according to related information in a received MTC group register request information, and trigger the first key generating unit and the second key generating unit;

the receiving unit is configured to receive MTC group register request information sent by the MTC device or MTC application;

the first key generating unit is configured to generate the MTC communication key between the MTC device or MTC application and the network by utilizing the key distribution algorithm for the MTC communication according to the root key in response to trigger from the MTC group creating unit; and

the second key generating unit is configured to generate the MTC group key by utilizing the key distribution algorithm for the MTC group communication according to the root key in response to trigger from the MTC group creating unit.

19. The network entity according to claim 18, wherein the sending unit is further configured to issue an MTC group notification to the MTC device or MTC application, and issue the generated MTC communication key and the generated MTC group key to the MTC device or MTC application via a secure method in response to trigger from the receiving unit;

and

the receiving unit is further configured to trigger the sending unit after receiving acknowledge information returned by the MTC device or MTC application.

20. The network entity according to claim 19, wherein the receiving unit is further configured to receive the acknowledgement information returned by the MTC device or MTC application after securely storing the MTC communication key and the MTC group key by the MTC device or MTC application.

21. The network entity according to claim 18, wherein the sending unit is further configured to issue a key update notification to all MTC devices or MTC applications, and issue the MTC group identification and a new MTC communication key and/or MTC group key corresponding to the MTC group identification to a corresponding MTC device or MTC application via a secure method so as to allow the corresponding MTC device or MTC application to update with and securely store the new MTC communication key and/or MTC group key corresponding to the MTC group identification.

22-27. -27. (canceled)

28. A non-transitory computer storage medium, comprising a set of instructions, which, when being executed, cause at least one processor to execute a key negotiation method applied to a network entity, wherein the method comprising:

generating a Machine Type Communication (MTC) communication key between an MTC device or MTC application and a network by utilizing a key distribution algorithm for MTC communication according to a root key for the MTC communication maintained by the network entity;

generating an MTC group key by utilizing a key distribution algorithm for MTC group communication according to the root key; and

issuing the generated MTC communication key and the generated MTC group key to the MTC device or MTC application via a secure method so as to allow the MTC device or MTC application to securely store the MTC communication key and the MTC group key.