KEY EXCHANGE METHOD AND APPARATUS

• US 20180176773A1
• Filed: 02/07/2018
• Published: 06/21/2018
• Est. Priority Date: 03/05/2013
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: ZHANG, Dongmei, CHEN, Jing
• Granted Patent: US 10,397,775 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 76/14 Direct-mode setup

Abstract

Embodiments of the present invention disclose a key exchange method and apparatus, which relate to the communications field, and can enable user equipments establishing a D2D link to share a set of keys, and further, information security can be achieved when a user equipment transmits service data or a signaling message through a Ud interface. A network device acquires a first key, and sends a message including the first key to a second user equipment, so that the second user equipment uses, when communicating with a first user equipment by using a D2D link, the first key to protect transmitted information. Embodiments of the present invention are applicable to an exchange process of keys for protecting data on a D2D link.

Claims

1. A key exchange method, wherein a device to device (D2D) link is established between a first user equipment and a second user equipment, and the method comprises:

acquiring, by the first user equipment, a first key; and

protecting, by the first user equipment, transmitted information by using the first key when communicating with the second user equipment by using the D2D link.

2. The key exchange method according to claim 1, wherein, after the acquiring, by the first user equipment, the first key, the method further comprises:

receiving, by the first user equipment, an encryption algorithm identifier; and

generating, by the first user equipment, an encryption key according to the first key and the encryption algorithm identifier;

wherein the protecting, by the first user equipment, the transmitted information by using the first key comprises;

encrypting, by the first user equipment by using the encryption key and an encryption algorithm corresponding to the encryption algorithm identifier, the information transmitted on the D2D link.

3. The key exchange method according to claim 1, wherein, after the acquiring, by the first user equipment, the first key, the method further comprises:

receiving, by the first user equipment, an integrity protection algorithm identifier from a network device; and

generating, by the first user equipment, an integrity protection key according to the first key and the integrity protection algorithm identifier;

wherein the protecting, by the first user equipment, the transmitted information by using the first key comprises;

performing, by the first user equipment by using the integrity protection key and an integrity protection algorithm corresponding to the integrity protection algorithm identifier, integrity protection on the information transmitted on the D2D link.

4. The key exchange method according to claim 1, wherein, after the acquiring, by the first user equipment, the first key, the method further comprises:

receiving, by the first user equipment, an encryption algorithm identifier and an integrity protection algorithm identifier from a network device;

generating, by the first user equipment, an encryption key according to the first key and the encryption algorithm identifier; and

generating, by the first user equipment, an integrity protection key according to the first key and the encryption algorithm identifier;

wherein the protecting, by the first user equipment, the transmitted information by using the first key comprises;

encrypting, by the first user equipment by using the encryption key and an encryption algorithm corresponding to the encryption algorithm identifier, the information transmitted on the D2D link; and

performing, by the first user equipment by using the integrity protection key and an integrity protection algorithm corresponding to the encryption algorithm identifier, integrity protection on the information transmitted on the D2D link.

5. The key exchange method according to claim 1, wherein

the acquiring, by the first user equipment, the first key comprises:

acquiring, by the first user equipment, a second key, wherein the second key is a shared key between the network device and the first user equipment; and

generating, by the first user equipment, the first key according to the second key and a first parameter by using a key derivation function, wherein the first parameter comprises a random number generated by the network device;

or

the acquiring, by the first user equipment, the first key comprises receiving, by the first user equipment, a message that is from the network device and comprises the first key.

6. The key exchange method according to claim 5, wherein the receiving, by the first user equipment, the message that is from the network device and comprises the first key comprises receiving, by the first user equipment by using an encrypted connection between the first user equipment and the network device, the message that is from the network device and comprises the first key.

7. An apparatus, wherein a device to device (D2D) link is established between a first user equipment and a second user equipment, and the apparatus comprises:

a processor, configured to acquire a first key; and

a transmitter, configured to send a message comprising the first key to the second user equipment for protecting transmitted information by using the first key when the second user equipment communicates with the first user equipment by using the D2D link.

8. The apparatus according to claim 7, wherein

the processor is configured to:

acquire a second key, wherein the second key is a shared key between the apparatus and the first user equipment; and

generate the first key according to the second key and a first parameter by using a key derivation function; and

the first parameter comprises a random number generated by the processor.

9. The apparatus according to claim 7, wherein

the first key is a random key acquired by the processor;

and

after the processor acquire the first key, the transmitter is further configured to send a message comprising the first key to the first user equipment.

10. The apparatus according to claim 9, wherein the transmitter is configured to send the message comprising the first key to the first user equipment by using an encrypted connection between the apparatus and the first user equipment.

11. The apparatus according to claim 7, wherein

the processor is further configured to, before the transmitter sends the message comprising the first key to the second user equipment:

acquire, a second key, wherein the second key is a shared key between the apparatus and the second user equipment;

generate, by the apparatus, a third key according to the second key; and

encrypt the first key by using the third key; and

the transmitter is configured to send the message comprising an encrypted first key to the second user equipment.

12. The apparatus according to claim 7, wherein the transmitter is configured to send the message comprising the first key to the second user equipment by using an encrypted connection between the apparatus and the second user equipment.

13. The apparatus according to claim 7, wherein

the processor is further configured to:

determine, according to a pre-stored cryptographic algorithm list, a security capability of the first user equipment, and a security capability of the second user equipment, a cryptographic algorithm that is applicable to the first user equipment and the second user equipment and whose priority ranks first in the cryptographic algorithm list; and

the transmitter is further configured to;

send the cryptographic algorithm to the first user equipment and the second user equipment,

wherein;

the security capability of the first user equipment is used to indicate a cryptographic algorithm applicable to the first user equipment;

the security capability of the second user equipment is used to indicate a cryptographic algorithm applicable to the second user equipment;

the cryptographic algorithm comprises at least one of an encryption algorithm i or an integrity protection algorithm;

the encryption algorithm is used to encrypt data transmitted on the D2D link; and

the integrity protection algorithm is used to perform integrity protection on information transmitted on the D2D link.

14. An apparatus, wherein a device to device (D2D) link is established between a first user equipment and a second user equipment, and the apparatus comprises:

a processor, configured to acquire a first key, and protect transmitted information by using the first key when communicating with the second user equipment by using the D2D link.

15. The apparatus according to claim 14, wherein

the apparatus further comprises a receiver, configured to receive an encryption algorithm identifier;

and

the processor is further configured to, after the processor acquires the first key;

generate an encryption key according to the first key and the encryption algorithm identifier; and

protect the transmitted information implemented by encrypting, by using the encryption key and an encryption algorithm corresponding to the encryption algorithm identifier, the information transmitted on the D2D link.

16. The apparatus according to claim 14, wherein

the apparatus further comprises a receiver, configured to receive an integrity protection algorithm identifier from a network device;

and

the processor is further configured to, after the processor acquires the first key;

generate an integrity protection key according to the first key and the integrity protection algorithm identifier; and

protect the transmitted information implemented by performing, by using the integrity protection key and an integrity protection algorithm corresponding to the integrity protection algorithm identifier, integrity protection on the information transmitted on the D2D link.

17. The apparatus according to claim 14, wherein

the apparatus further comprises a receiver, configured to receive an encryption algorithm identifier and an integrity protection algorithm identifier from a network device;

and

the processor is further configured to, after the processor acquires the first key;

generate an encryption key according to the first key and the encryption algorithm identifier; and

generate an integrity protection key according to the first key and the encryption algorithm identifier; and

protect the transmitted information implemented by;

encrypting, by using the encryption key and an encryption algorithm corresponding to the encryption algorithm identifier, the information transmitted on the D2D link; and

performing, by using the integrity protection key and an integrity protection algorithm corresponding to the encryption algorithm identifier, integrity protection on the information transmitted on the D2D link.

18. The apparatus according to claim 14, wherein

the processor is further configured to:

acquire a second key, wherein the second key is a shared key between the network device and the first user equipment; and

generate the first key according to the second key and a first parameter by using a key derivation function, wherein the first parameter comprises a random number generated by the network device;

or

the apparatus further comprises;

a receiver, configured to receive a message that is from the network device and comprises the first key.

19. The apparatus according to claim 18, wherein the receiver is configured to receive, by using an encrypted connection between the first user equipment and the network device, the message that is from the network device and comprises the first key.