Method and apparatus for updating a key in an active state

• US 9,031,240 B2
• Filed: 08/16/2012
• Issued: 05/12/2015
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Yang, Yanmei, Huang, Min
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US13/587,340
• Publication Number:
  US 20120307803A1
• Time in Patent Office: 999 Days
• Field of Search: 380/277, 380/278, 380/279, 380/44
• US Class Current: 380/278
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method for updating a key in an active state is disclosed according to the embodiments of the present invention. The method includes steps of: initiating a key update by a user equipment in the active state or a network side when a pre-defined condition is met; updating the key by the network side and the user equipment, and negotiating an activation time of the new keys. An apparatus for updating a key in an active state is also disclosed according to the present invention. With the present invention, the user equipment in an active state and the network side may actively initiate the key update procedure in different cases, thereby solving the problem concerning the key update for a session in an active state.

Claims

1. A user equipment for updating a key in an active state, comprising:

a receiver, configured to receive, from an evolved NodeB (eNB), an intra-cell handover command which is configured to instruct the user equipment to use air-interface keys;

wherein the air-interface keys are updated based on a new key K_eNB;

wherein the new key K_eNB is derived based on a key which is generated during a key update procedure;

wherein the key update procedure is initiated by a Mobility Management Entity (MME) when a pre-defined condition is met;

a transmitter, configured to send an acknowledgement for receiving the intra-cell handover command; and

a processor, configured to apply the air interface keys in a security operation to a subsequent message received or sent by the user equipment.

2. The user equipment according to claim 1, wherein the pre-defined condition comprises that the user equipment has performed one of:

a handover between two eNBs, a handover within one eNB, and an inter-system handover.

3. The user equipment according to claim 1, wherein the security operation is any one of integrity protection, encryption and decryption.

4. A method for updating a key in an active state, the method being performed in a user equipment (UE), comprising:

receiving, from an evolved NodeB (eNB), an intra-cell handover command which is configured to instruct the UE to use air-interface keys;

wherein the air-interface keys are updated based on a new key K_eNB;

wherein the new key K_eNB is derived based on a key which is generated during a key update procedure;

wherein the key update procedure is initiated by a Mobility Management Entity (MME) when a pre-defined condition is met;

sending an acknowledgement for receiving the intra-cell handover command; and

applying the air interface keys in a security operation to a subsequent message received or sent by the UE.

5. The method according to claim 4, wherein the pre-defined condition comprises that the user equipment has performed one of:

a handover between two eNBs, a handover within one eNB, and an inter-system handover.

6. The method according to claim 4, wherein the security operation is any one of integrity protection, encryption and decryption.