METHOD AND APPARATUS FOR GENERATING SESSION KEYS

• US 20060240802A1
• Filed: 02/09/2006
• Published: 10/26/2006
• Est. Priority Date: 04/26/2005
• Status: Abandoned Application

• Current Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Nakhjiri, Madjid F., Venkitaraman, Narayanan
• Application Number:
  US11/276,016
• Publication Number:
  US 20060240802A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

Nonce exchange with a target BS is performed even when the MS connected to the source BS so when the mobile reaches the new BS, it will be able to create a fresh key quickly. Alternatively, the MS can provide the nonce directly to the target base station immediately (or very soon) upon handing over. In a similar manner, the mobile will receive the target BS nonce via one of several techniques. In a first embodiment of the present invention the target BS will share the BS nonce with the source BS which will provide the nonce to the MS. In a second embodiment of the present invention the target base station will transmit the nonce over-the-air to the MS as part to the initial exchanges leading to the set up of the wireless link between the MS and the target BS.

Claims

1. A method for generating a session key, the method comprising the steps of:

generating a first nonce (fresh value);

providing the first nonce to a source base station as part of an indication of a need to hand over to a target base station;

receiving a second nonce generated at the target base station; and

generating the session key based on the first and the second nonce.

2. The method of claim 1 wherein the step of generating the first nonce comprises the step of generating a random number.

3. The method of claim 1 wherein the step of generating the first nonce comprises the step of generating a nonce based on a time stamp, a sequence number, or a current frame number.

4. The method of claim 1 wherein the step of receiving the second nonce comprises the step of receiving the second nonce via an over-the-air communication from the source base station.

5. The method of claim 1 wherein the step of receiving the second nonce comprises the step of receiving the second nonce via an over-the-air communication from the target base station.

6. The method of claim 1 wherein the step of generating the session key comprises the step of generating the session key as a function of a pair-wise master key (PMK), a Base Station Identifier, a Mobile station identifier, the first nonce, and the second nonce.

7. The method of claim 1 further comprising the step of:

encrypting communications with the target base station with the session key.

8. The method of claim 1 wherein the step of providing the first nonce to the source base station causes the source base station to forward the first nonce to the target base station.

9. A method comprising the steps of:

generating a first nonce;

providing the first nonce to a target base station as part of a ranging operation;

receiving a second nonce generated at the target base station; and

generating the session key based on the first and the second nonce.

10. The method of claim 9 wherein the step of generating the first nonce comprises the step of generating a random number.

11. The method of claim 9 wherein the step of generating the first nonce comprises the step of generating a nonce based on a time stamp, a sequence number, or a current frame number.

12. The method of claim 9 wherein the step of receiving the second nonce comprises the step of receiving the second nonce via an over-the-air communication from the source base station.

13. The method of claim 9 wherein the step of receiving the second nonce comprises the step of receiving the second nonce via an over-the-air communication from the target base station.

14. The method of claim 9 wherein the step of generating the session key comprises the step of generating the session key as a function of a pair-wise master key (PMK), a Base Station Identifier, a Mobile station identifier, the first nonce, and the second nonce.

15. The method of claim 9 further comprising the step of:

encrypting communications with the target base station with the session key.

16. A method comprising the steps of:

receiving, at a source base station, notification that a mobile station desires to hand off to a target base station, wherein the notification comprises a first nonce generated at the mobile station;

providing the first nonce (or fresh value) to the target base station;

receiving a second nonce from the target base station; and

providing the second nonce to the mobile station via an over-the-air communication.

17. A method comprising the steps of:

receiving at a target base station, notification that a mobile station desires to hand off to the target base station, wherein the notification is generated at a source base station and comprises a first nonce generated at the mobile station;

generating a second nonce;

providing the second nonce to the mobile station; and

generating the session key based on the first and the second nonce.

18. The method of claim 17 wherein the step of generating the second nonce comprises the step of generating a random number.

19. The method of claim 17 wherein the step of generating the second nonce comprises the step of generating a nonce based on a time stamp, a sequence number, or a current frame number.

20. The method of claim 17 wherein the step of generating the session key comprises the step of generating the session key as a function of a pair-wise master key (PMK), a Base Station Identifier, a Mobile station identifier, the first nonce, and the second nonce.

21. The method of claim 17 further comprising the step of:

encrypting communications with the mobile station with the session key.

22. The method of claim 17 wherein the step of providing the second nonce to the mobile station comprises the step of providing the second nonce to a source base station, causing the source base station to forward the second nonce to the mobile station.