DEVICES AND METHOD FOR MTC GROUP KEY MANAGEMENT

• US 20160182477A1
• Filed: 07/07/2014
• Published: 06/23/2016
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: ZHANG, Xiaowei, PRASAD, Anand Raghawa
• Granted Patent: US 11,570,161 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

In order to improve security upon distributing a group key, there is provided a gateway (20) to a core network for a group of MTC devices (10_1-10_n) communicating with the core network. The gateway (20) protects confidentiality and integrity of a group key, and distributes the protected group key to each of the MTC devices (10_1-10_n). The protection is performed by using: a key (Kgr) that is preliminarily shared between the gateway (20) and each of the MTC devices (10_1-10_n), and that is used for the gateway (20) to authenticate each of the MTC devices (10_1-10_n) as a member of the group; or a key (K_iwf) that is shared between an MTC-IWF (50) and each of the MTC devices (10_1-10_n), and that is used to derive temporary keys for securely conducting individual communication between the MTC-IWF (50) and each of the MTC devices (10_1-10_n).

Claims

1. A communication system comprising:

a group of MTC (Machine-Type-Communication) devices that communicate with a core network; and

a gateway to the core network for the group, the gateway distributing to each of the MTC devices a first key for securely conducting group communication,

wherein upon distributing the first key, the gateway protects confidentiality and integrity of the first key by using;

a second key that is preliminarily shared between the gateway and each of the MTC devices, and that is used for the gateway to authenticate each of the MTC devices as a member of the group;

or

a third key that is shared between an MTC-IWF (MTC Inter-Working Function) and each of the MTC devices, and that is used to derive temporary keys for securely conducting individual communication between the MTC-IWF and each of the MTC devices, the MTC-IWF serving as an entering point to the core network for an SCS (Service Capability Server) that communicates with the group through the core network.

2. The communication system according to claim 1, further comprising:

an HSS (Home Subscriber Server) that manages subscription information on each of the MTC devices, and that derives the first key to be distributed from the gateway to each of the MTC devices,

wherein as a parameter for deriving the first key, the HSS uses;

the second key;

the third key;

Kasme (Key Access Security Management Entity);

or

a random number.

3. The communication system according to claim 2, wherein the HSS transfers the first key to the MTC-IWF.

4. The communication system according to claim 2, wherein the HSS is configured to:

update the first key when lifetime of the first key expires, a member of the group is deleted from the group, the parameter is changed, or the group communication transits to an inactive state; and

cause the gateway to re-distribute the updated first key.

5. The communication system according to claim 4, wherein the HSS uses an Insert Subscriber Data message upon causing the gateway to re-distribute the updated first key.

6. The communication system according to claim 1,

wherein the MTC-IWF derives the first key to be distributed from the gateway to each of the MTC devices,

wherein as a parameter for deriving the first key, the MTC-IWF uses:

the second key;

the third key;

Kasme;

or

a random number.

7. The communication system according to claim 6, further comprising:

an HSS that manages subscription information on each of the MTC devices,

wherein the MTC-IWF acquires the parameter from the HSS.

8. The communication system according to claim 6, wherein the MTC-IWF is configured to:

update the first key when lifetime of the first key expires, a member of the group is deleted from the group, the parameter is changed, or the group communication transits to an inactive state; and

cause the gateway to re-distribute the updated first key.

9. The communication system according to claim 1, wherein the gateway derives the first key by using as a parameter:

the second key;

the third key;

Kasme;

or

a random number.

10. The communication system according to claim 9, wherein the gateway is configured to:

update the first key when lifetime of the first key expires, a member of the group is deleted from the group, the parameter is changed, or the group communication transits to an inactive state;

protect the updated first key by using the second or third key; and

re-distribute the protected and updated first key.

11. A gateway to a core network for a group of MTC devices communicating with the core network, the gateway comprising:

protection means for protecting confidentiality and integrity of a first key for securely conducting group communication; and

distribution means for distributing the protected first key to each of the MTC devices,

wherein the protection means is configured to perform the protection by using;

a second key that is preliminarily shared between the gateway and each of the MTC devices, and that is used for the gateway to authenticate each of the MTC devices as a member of the group;

or

a third key that is shared between an MTC-IWF and each of the MTC devices, and that is used to derive temporary keys for securely conducting individual communication between the MTC-IWF and each of the MTC devices, the MTC-IWF serving as an entering point to the core network for an SCS that communicates with the group through the core network.

12. The gateway according to claim 11, further comprising:

reception means for receiving the first key from an HSS that manages subscription information on each of the MTC devices, or from the MTC-IWF.

13. The gateway according to claim 12,

wherein when the first key is updated by the HSS or the MTC-IWF, the reception means is configured to receive the updated first key,

wherein the protection means is configured to protect the updated first key by using the second or third key,

wherein the distribution means is configured to re-distribute the protected and updated first key.

14. The gateway according to claim 11, further comprising derivation means for deriving the first key by using as a parameter:

the second key;

the third key;

Kasme;

or

a random number.

15. The gateway according to claim 14,

wherein the derivation means is configured to update the first key when lifetime of the first key expires, a member of the group is deleted from the group, the parameter is changed, or the group communication transits to an inactive state,

wherein the protection means is configured to protect the updated first key by using the second or third key,

wherein the distribution means is configured to re-distribute the protected and updated first key.

16. An MTC device that is grouped to communicate with a core network, the MTC device comprising:

reception means for receiving, from a gateway to the core network for a group of MTC devices, a first key for securely conducting group communication, confidentiality and integrity of the first key being protected with a second key or a third key,

wherein the second key is preliminarily shared between the gateway and each of the MTC devices, and used for the gateway to authenticate each of the MTC devices as a member of the group,

wherein the third key is shared between an MTC-IWF and each of the MTC devices, and used to derive temporary keys for securely conducting individual communication between the MTC-IWF and each of the MTC devices, the MTC-IWF serving as an entering point to the core network for an SCS that communicates with the group through the core network.

17. A method of controlling operations in a gateway to a core network for a group of MTC devices that communicates with the core network, the method comprising:

protecting confidentiality and integrity of a first key for securely conducting group communication; and

distributing the protected first key to each of the MTC devices,

wherein the protection is performed by using;

a second key that is preliminarily shared between the gateway and each of the MTC devices, and that is used for the gateway to authenticate each of the MTC devices as a member of the group;

or

a third key that is shared between an MTC-IWF and each of the MTC devices, and that is used to derive temporary keys for securely conducting individual communication between the MTC-IWF and each of the MTC devices, the MTC-IWF serving as an entering point to the core network for an SCS that communicates with the group through the core network.

18. A method of controlling operations in an MTC device that is grouped to communicate with a core network, the method comprising:

receiving, from a gateway to the core network for a group of MTC devices, a first key for securely conducting group communication, confidentiality and integrity of the first key being protected with a second key or a third key,

wherein the second key is preliminarily shared between the gateway and each of the MTC devices, and used for the gateway to authenticate each of the MTC devices as a member of the group,

wherein the third key is shared between an MTC-IWF and each of the MTC devices, and used to derive temporary keys for securely conducting individual communication between the MTC-IWF and each of the MTC devices, the MTC-IWF serving as an entering point to the core network for an SCS that communicates with the group through the core network.