Method for producing key material

• US 20060271785A1
• Filed: 09/16/2005
• Published: 11/30/2006
• Est. Priority Date: 05/26/2005
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Laitinen, Pekka, Ginzboorg, Philip, Holtmanns, Silke, Rajaniemi, Jaakko, Miettinen, Kari
• Granted Patent: US 8,582,762 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/10 Small scale networks; Flat hierarchical networks

Abstract

This invention relates to security procedures in a communication system, specifically to production of key material. The invention provides a method for producing key material in a highly secure way for use in communication with a local network of a company. The method uses authentication information obtained from the communication system and information exchanged locally between a mobile station and the authentication systems of the company to produce a communication key for use in authentication procedures or e.g. for signing and/or encrypting data.

Claims

1. Method for producing key material in a station of a communication system, comprising the steps of:

producing authentication information by performing an authentication procedure with a communication system;

exchanging key generation information with a second system external to the communication system; and

generating a communication key for communication with the second system at least in part on a basis of the authentication information and the key generation information.

2. A method according to claim 1, further comprising the steps of:

encrypting an identification code with the generated communication key; and

transmitting the encrypted identification code.

3. A method according to claim 1, further comprising the steps of:

encrypting a password with the generated communication key; and

transmitting the encrypted password.

4. A method according to claim 1, wherein:

the communication key is generated based at least in part on time information.

5. A method according to claim 1, wherein:

the key generation information comprises a password.

6. A method according to claim 1, wherein:

the key generation information comprises seed information for a sequence,

the step of generating a communication key comprises generating a next item in the sequence, and

the communication key is generated based at least in part of the generated next item.

7. A method according to claim 1, wherein the step of exchanging the key generation information comprises exchanging a shared secret.

8. A method according to claim 1, wherein the step of exchanging the key generation information comprises exchanging a time value.

9. A method according to claim 1, wherein:

the authentication procedure performed in the step of producing the authentication information is a GAA authentication procedure.

10. A method according to claim 1, wherein:

the authentication information is produced based at least in part on a salt value.

13. A method according to claim 1, comprising the steps of:

decrypting a password with the generated communication key, and

verifying correctness of the decrypted password.

14. A method according to claim 10, wherein:

the communication key is generated based at least in part on time information.

15. A method according to claim 10, wherein the step of exchanging the key generation information comprises exchanging a password.

16. A method according to claim 10, wherein:

the key generation information comprises seed information for a sequence,

the step of generating a communication key comprises the step of generating a next item in the sequence, and

the communication key is generated based at least in part on the generated next item.

11. Method for producing key material in a node of an authentication system, comprising the steps of:

requesting authentication information related to a station from an authentication node of a communication system;

exchanging key generation information with the station external to the communication system; and

generating a communication key at least in part on a basis of the authentication information and the key generation information.

12. A method according to claim 11, comprising the steps of:

decrypting an identification code with the generated communication key, and

verifying correctness of the decrypted identification code.

17. A method according to claim 11, wherein the step of exchanging the key generation information comprises exchanging a shared secret.

18. A station for a communication system, comprising:

means for producing authentication information by performing an authentication procedure with a communication system;

means for exchanging key generation information with a second system external to the communication system; and

means for generating a communication key for communication with the second system at least in part on a basis of the authentication information and the key generation information.

19. A node for an authentication system for a local area network, comprising:

means for requesting authentication information related to a station of a wireless communication system from an authentication node of the wireless communication system,

means for exchanging key generation information with a station of a wireless communication system external to the wireless communication system, and

means for generating a communication key at least in part on a basis of authentication information and key generation information.

20. A software program product for a station, embodied on a computer readable medium, comprising software program code for carrying out the steps of:

producing authentication information by performing an authentication procedure with a communication system;

exchanging key generation information with a second system external to the communication system; and

generating a communication key for communication with the second system at least in part on a basis of the authentication information and the key generation information.

21. A software program product for a node of a communication system, embodied on a computer readable medium, comprising software program code for carrying out the steps of:

requesting authentication information related to a station from an authentication node of a communication system;

exchanging key generation information with the station external to the communication system; and

generating a communication key at least in part on a basis of the authentication information and the key generation information.

22. A station for a communication system, comprising:

a controller for producing authentication information by performing an authentication procedure with a communication system,

a controller for exchanging key generation information with a second system external to the communication system, and

a key generator for generating a communication key for communication with the second system at least in part on a basis of the authentication information and the key generation information

23. A station according to claim 22, further comprising:

an encryptor for encrypting an identification code with the generated communication key, and

a transmitter for transmitting the encrypted identification code.

24. A station according to claim 22, wherein:

the key generator is configured to generate the communication key based at least in part on time information.

25. A station according to claim 22, comprising:

a sequence generator for generating a sequence based on seed information in the key generation information, and wherein

the key generator is configured to generate the communication key based at least in part on an item generated by the sequence generator.

26. A station according to claim 22, wherein the station is a mobile station for a wireless communication system.

27. A node for an authentication system for a local area network, comprising:

a requester for requesting authentication information related to a station of a wireless communication system from an authentication node of the wireless communication system,

a controller for exchanging key generation information with a station of a wireless communication system external to the wireless communication system, and

a key generator for generating a communication key at least in part on a basis of authentication information and key generation information.

28. A node according to claim 27, further comprising:

a decryptor for decrypting an identification code with a generated communication key, and

a controller for verifying correctness of a decrypted identification code.

29. A node according to claim 27, wherein:

the key generator is configured to generate a communication key based at least in part on time information.

30. A node according to claim 27, further comprising:

a sequence generator for generating a sequence based on seed information in key generation information, and wherein

the key generator is configured to generate a communication key based at least in part on an item generated by the means for generating a sequence.

31. A node according to claim 27, wherein the node comprises a functionality of a network access function node for a wireless communication system.

32. System for producing key material, comprising:

a first authentication node,

a second authentication node,

a requester in the second authentication node for requesting authentication information related to a station from the first authentication node,

a controller in the second authentication node for exchanging key generation information with a station external to the communication system, and

a key generator in the second authentication node for generating a communication key at least in part on a basis of authentication information and key generation information.

33. A system according to claim 32, wherein:

the first authentication node is an authentication node of a wireless communication network.

34. A system according to claim 32, further comprising:

the second authentication node is an authentication node of a local area network.

35. A system according to claim 32, further comprising:

a mobile station,

a controller in the mobile station for producing authentication information by performing an authentication procedure with the first authentication node,

a controller in the mobile station for exchanging key generation information with the second authentication node, and

a key generator in the mobile station for generating a communication key based at least in part on the authentication information and the key generation information.