Security key management method and device

Abstract

A security key management method that can be implemented in a user equipment (UE) capable of communicating with a primary node (MN) and a secondary node (SN) simultaneously. The method includes transitioning (504) from a connected state to a deactivated state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key (502), in which a radio connection between the UE and a radio access network (RAN) is suspended. The method also includes performing a process for transitioning from the deactivated state to the connected state, including generating a new RAN key K corresponding to the SN. SN (506) and based at least on the new RAN key K SN A new security key is generated for communicating with the SN (508).

Description

Technical Field

[0001] The present disclosure relates generally to wireless communications and, more particularly, to methods and apparatus for managing security keys for secure communications. Background Art

[0002] To protect the confidentiality and integrity of traffic (i.e., to prevent inspection in the event of unauthorized interception and modification, respectively), network equipment operating in cellular networks utilizes various security keys. For example, 5G cellular networks support a hierarchy of security keys for communicating with certain network nodes (e.g., 5G Node B (gNB) operating in the Radio Access Network (RAN) or Access and Mobility Management Function (AMF) operating in the core network), communicate certain types of information (e.g., control plane data, user plane data), and provide specific security features (e.g., confidentiality protection through encryption, integrity protection). In some cases, a user device (or user equipment, generally represented by the acronym "UE") is able to utilize the resources of multiple base stations simultaneously and apply corresponding security keys to these resources.

[0003] For example, the UE is able to communicate with base stations supporting the same radio access technology (RAT) or different RATs in a so-called dual connectivity (DC), in which case the DC is referred to as multi-radio DC (MR-DC). In these cases, one base station operates as a master node (MN) and the other base station operates as a secondary node (SN). In general, the MN can provide control plane connectivity and user plane connectivity to the core network (CN), while the SN typically provides the user plane connectivity. The cell associated with the MN defines a master cell group (MCG), and the cell associated with the SN defines a secondary cell group (SCG). The UE and the base stations MN and SN are able to exchange radio resource control (RRC) messages and non-access stratum (NAS) messages using signaling radio bearers (SRBs).

[0004] When operating in DC, the UE can use several types of SRBs. SRB1 and SRB2 resources allow the UE and MN to exchange RRC messages related to the MN and embed RRC messages related to the SN, and can be called MCG SRBs. SRB3 resources allow the UE and SN to exchange RRC messages related to the SN, and can be called SCG SRBs. Separate SRBs allow the UE to exchange RRC messages directly with the MN by using the radio resources of the MN, the SN, or both the MN and the SN. In addition, the UE and the base stations MN and SN use data radio bearers (DRBs) to transmit data on the user plane. A DRB that terminates at the MN and uses only the low-layer resources of the MN can be called an MCG DRB, a DRB that terminates at the SN and uses only the low-layer resources of the SN can be called an SCG DRB, and a DRB that terminates at the MN but uses the low-layer resources of both the MN and the SN can be called a separate DRB.

[0005] To achieve security, the UE can use the following key: K UPenc , encrypts the user plane data sent via DRB; K UPint , protect the integrity of user plane data sent via DRB; K RRCenc to encrypt the RRC data sent via the SRB; and K RRCint , protecting the integrity of RRC data sent over SRBs. The UE and the gNB are able to derive these keys, at least in part, from RAN keys associated with RAN nodes. Thus, a gNB operating in the RAN is able to communicate with the key K gNB Associated, the eNB operating in the RAN can be associated with the key K eNB According to the security key hierarchy, the network device can then control other keys (such as K AMF ), generate a RAN key based on a previous value of the RAN key, a RAN level counter, etc.

[0006] Because the UE uses multiple DRBs and SRBs to communicate in the DC, in some cases, the UE must manage multiple sets of security keys simultaneously. Specifically, the UE is able to use MN-specific security keys as well as SN-specific security keys. When the UE and the MN suspend the radio connection between the UE and the MN and the SN after transitioning from the connected state to the deactivated state, according to 3GPP TS38.331 version 15.5.1, the UE retains a portion of the configuration as a stored access stratum (AS) context. The retained portion of the configuration belongs to the MN and the SN.

[0007] However, when the UE resumes the radio connection after transitioning back to the connected state from the deactivated state, the UE and the RAN do not always properly align the security keys for the DRBs and SRBs. More specifically, the UE and the SN may use different encryption keys for the SN-terminated radio bearers. As a result, after transitioning back to the connected state, the UE and the SN cannot properly support encryption. Summary of the invention

[0008] In general, when the UE transitions from a deactivated state of a protocol for controlling radio resources (e.g., RRC) to a connected state to resume communication with the MN and SN, the UE and RAN (MN and / or SN) implement the techniques of the present disclosure to ensure that the UE and SN apply the same one or more encryption keys to services on the radio bearer terminated by the SN.

[0009] To this end, the UE generates a new K SN The key (can be K gNB or K eNB , depending on the type of base station). The UE then calculates the value of the new K based at least in part on the new K. SN Key derivation: New security key, such as K UPenc , used to communicate with SN. In order to derive the new K SN Key, the UE can use the current value of the counter associated with the initial security configuration of the radio bearer terminated at the SN, such as sk-Counter. In at least some implementations, the UE can also generate a new K MN The UE can also derive a new security key for communicating with the MN based at least in part on the new K. MN key to generate a new K SN Key.

[0010] In this case, MN and SN are based at least in part on K MN The previous value of the key (or simply the "previous K MN Key") to generate a new K MN The key is based at least in part on K MN The new value of the key generates a new K SN key, and is based at least in part on the new K SN Keys are used to derive new security keys for communication between UE and SN.

[0011] In an example scenario, a UE capable of communicating with a MN and a SN simultaneously transitions from a connected state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, to a deactivated state, in which a radio connection between the UE and the RAN is suspended. The UE then performs a process of transitioning from the deactivated state to the connected state. The process includes generating a new RAN key K corresponding to the SN.SN , and at least based on the new RAN key K SN Generate new security keys for communicating with the SN.

[0012] One example embodiment of the described technology is a UE comprising processing hardware configured to implement the above-described method.

[0013] In another example scenario, a RAN including a first base station operating as a MN and a second base station operating as a SN causes a UE to transition from a connected state to a deactivated state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, in which a radio connection between the UE and the RAN is suspended. The RAN then generates a new RAN key K corresponding to the MN. MN , based at least on the new RAN key K MN Generate a new RAN key K corresponding to SN SN , and based at least on the new RAN key K SN Generate new security keys for communication between the UE and the SN.

[0014] Another example embodiment of these techniques is a RAN comprising a first base station coupled to a CN and a second base station communicatively coupled to the CN and the first base station. The RAN is configured to implement the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 An example communication system is illustrated in which a user equipment (UE) and a base station operating as a master node (MN) and a secondary node (SN), respectively, in a radio access network (RAN) are able to manage security keys using the techniques of the present disclosure;

[0016] Figure 2A yes Figure 1 A block diagram of an example security management system that can be implemented by a UE;

[0017] Figure 2B yes Figure 1 A block diagram of an example security management system that can be implemented by a base station;

[0018] Figure 3 Picture shows Figure 1 A fragment of the security key hierarchy under which the device is able to operate;

[0019] Figure 4 is a message diagram of an example scenario, where MN sends a new K SN key, and sending a command to the UE to resume the suspended radio connection;

[0020] Figure 5is a flow chart of an example method for generating a security key for communicating with a SN, which can be Figure 1 ; and

[0021] Figure 6 is a flow chart of an example method for generating a security key for communication between a SN and a UE, which can be Figure 1 is implemented in the RAN. DETAILED DESCRIPTION

[0022] Figure 1 An example wireless communication network 100 is depicted in which an example UE 102 operates in dual connectivity with a MN 104 and a SN 106 of a RAN 108. To protect confidentiality and integrity of messages, the UE 102 and devices operating in the RAN 108 utilize security keys. The UE 102 and the RAN 108 implement the key management techniques of the present disclosure, which will be discussed in detail below.

[0023] In different configurations of the wireless communication system 100, the MN 104 can be implemented as a master eNB (MeNB) or a master gNB (MgNB) node, the SN 106 can be implemented as a secondary eNB (SeNB) or a secondary gNB (SgNB) node, and the UE 102 communicates with the MN 104A and the SN 106A via the same RAT or a different RAT such as EUTRA or NR. In some cases, the MeNB or SeNB is implemented as an ng-eNB instead of an eNB. When the MN 104 is an Mng-eNB and the SN 106 is an SgNB, the UE 102 can be in a next generation (NG) EUTRA-NR DC (NGEN-DC) with the Mng-eNB and the SgNB. When the MN 104 is a MgNB and the SN is an SgNB, the UE 102 can be in an NR-NR DC (NN-DC) with the MgNB and the SgNB. When the MN 104 is a MgNB and the SN is a Sng-eNB, the UE 102 may be in NR-EUTRA DC (NE-DC) with the MgNB and the Sng-eNB.

[0024] MN 104 and SN 106 can be connected to CN 110, which can be, for example, a 5G core network (5GC) or an evolved packet core (EPC). The core network can be equipped with AMF 140. MN 104 and SN 106 can therefore support an S1 interface to communicate with the EPC, or support an NG interface to communicate with the 5GC. In addition, in order to directly exchange messages during the scenarios discussed below, MN 104 and SN 106 can support an Xn interface. The cell 114 associated with MN 104 defines an MCG, and the cell 116 associated with SN 106 defines an SCG.

[0025] The UE 102 is equipped with processing hardware 120, which can include one or more general-purpose processors, such as central processing units (CPUs), and non-transitory computer-readable memory storing machine-readable instructions that can be executed on the one or more general-purpose processors and / or special-purpose processing units. The processing hardware 120 in the example implementation includes a UE security controller 122 and a security key storage 124 that stores one or more security keys that the UE security controller 122 operates on. Other components of the UE 102 that use the security keys and cooperate with the UE security controller 122 will be referred to below. Figure 2A Have a discussion.

[0026] Because a base station can operate as a MN or a SN in different scenarios, the MN 104 and the SN 106 can implement a similar set of functions and support both MN and SN operations. Figure 1 As shown, the MN 104 is equipped with processing hardware 130, which can include one or more general-purpose processors such as CPUs and non-transitory computer-readable memory that stores machine-readable instructions that can be executed on one or more general-purpose processors and / or special-purpose processing units. The processing hardware 130 in the example implementation includes a RAN security controller 132 and a security key storage 134 that stores one or more security keys that the RAN security controller 132 can operate on. Other components of the MN 104 that use security keys and cooperate with the RAN security controller 132 will be referred to below. Figure 2B SN 106 has a similar implementation.

[0027] In the scenario discussed below, UE 102 first operates in a connected state and uses corresponding security keys to communicate with MN 104 and SN 106. RAN 108 then transitions UE 102 from the connected state to a deactivated state, in which UE 102 suspends the radio connection between UE 102 and RAN 108. When UE 102 resumes the radio connection with RAN 108, UE security controller 122 and RAN security controller 132 at SN 106 generate new security keys that are aligned (e.g., the same or have another type of correspondence or dependency) so that UE 102 and SN 106 can properly handle uplink (i.e., traveling from UE 102 to RAN 108) and downlink (i.e., traveling from RAN 108 to UE 102) messages.

[0028] Before discussing several example scenarios in which UE 102, MN 104, and SN 106 implement these security key management techniques, reference is made to Figure 2Aand Figure 2B Briefly consider an example security management system for UE 102 and base stations 104, 106. Then refer to Figure 3 Consider a portion of a security key hierarchy in the wireless communication network 100 .

[0029] Figure 2A Depicted Figure 1 1 is a block diagram of an example security management system 200 in which the UE security controller 122 can operate. The security management system 200 can also include the RRC controller 210, or cooperate with the RRC controller 210. The UE security controller 122 and the RRC controller 210 in operation can access the key storage 124, which in this example implementation stores the RAN key K MN and K SN The current value of . Depending on the implementation, the key K MN Can be K gNB or K eNB , and the key K SN Can be K gNB or K eNB UE security controller 122 can at some point apply a key derivation function (KDF) 220 (which can include a set of functions specific to various keys) to K MN The current value of K MN In addition, the UE security controller 122 can use the KDF 220 to determine the value of MN The current value of K is used to generate SN In at least some implementations, the UE security controller 122 generates K SN The current value of sk-Counter 280 is also used when the value of sk-Counter 280 is received by UE 102 from MN 104 as described below.

[0030] In addition, the UE security controller 122 can use the KDF 220 to utilize K SN Generates K for secure communication of control plane data with SN 106 RRCint and / or K RRCenc The current value of K (if SRB3 is configured for UE 102), and K for secure communication of user plane data with SN 106 UPint and / or K UPenc Similarly, the UE security controller 122 can use KDF 220 to utilize K MN Generate one or more security keys for communicating with MN 106 (to avoid confusion, Figure 2A not shown).

[0031] like Figure 2A As shown, the RRC controller 210 is able to access the key storage 124 to access the key K RRCint , K RRCenc , K UPint and K UPenc For example, the RRC controller 210 can also communicate with the UE security controller 122 to report an event, in response to which the UE security controller 122 generates a new key. The RRC controller 210 or the UE security controller 122 can also provide K to other components (or multiple components) of the UE 102 (e.g., a PDCP controller, an integrity protection component, an integrity checking component, an encryption component, a decryption component). UPint and / or K UPenc The current value of these components uses K UPint to perform integrity protection and integrity checking on control plane data, and / or use the current value of K UPenc To encrypt and decrypt user plane data.

[0032] Reference now Figure 2B , Figure 1 The RAN security controller 132 can operate in an example security management system 250. The security management system 250 can also include an RRC controller 260, or cooperate with an RRC controller 260. The RAN security controller 132 and the RRC controller 260 in operation can access the key storage 134, which in this example implementation stores the RAN key K MN and K SN 、AMF key K AMF , next hop key NH and key K RRCint , K RRCenc , K UPint and K UPenc The current value of . Depending on the implementation, the key K MN Can be K gNB or K eNB , and the key K SN Can be K gNB or K eNB If integrity protection is configured for UE 102 for user plane data, RAN security controller 132 may not generate the key K UPint .

[0033] The RAN security controller 132 includes a MN security key controller 252 and an SN security key controller 254 for supporting MN-specific security key functions and SN-specific security key functions, respectively. The RAN security controller 132 can at some point apply a KDF 270 (which can include a set of functions dedicated to various keys) to the K MN The current value of K MN In addition, the RAN security controller 132 can use the KDF 270 to determine the value of MN The current value of K is used to generate SN In at least some implementations, the RAN security controller 132 generates K SN The current value of sk-Counter 280 is also applied when the value is changed.

[0034] In the example scenario, the MN security key controller 252 generates a key K MN The value of , using the key K MN The value of and the current value of sk-Counter280 are used to generate the key K SN The new value of key K SN The SN security key controller 254 then sends the new value of K SN The current value of is stored in the key memory 134.

[0035] In addition, the RAN security controller 132 can use the KDF 270 to utilize the K SN Generates K for secure communication of control plane data with UE 102 RRCint and / or K RRCenc The current value of , and K for secure communication of data plane data with UE 102 UPint and / or K UPenc The RRC controller 260 can access the key memory 134 to access the key K RRCint , K RRCenc , K UPint and K UPenc For example, the RRC controller 260 can also communicate with the RAN security controller 132 to report an event, in response to which the RAN security controller 132 generates a new key. If the RRC controller 260 at the SN 106 does not configure SRB3 for the UE 102, the SN security controller 254 may not generate the key K RRCint and K RRCenc If the RRC controller 260 at the MN 104 does not configure the DRB terminated at the MN to the UE 102, the MN security controller 252 may not generate the key K UPint and K UPenc .

[0036] In addition, the RAN security controller 132 can in some cases receive the key K from the AMF 140 AMF , and stores the key in the key storage 134. The RAN security controller 132 can use the key K AMF To generate K gNB In some cases, the RAN security controller 132 can receive the key NH from the AMF 140 and store the key in the key storage 134. For example, the RAN security controller 132 can use the key NH to generate a key such as K gNB The RAN key.

[0037] As described above, the wireless communication network 100 can generate security keys according to a hierarchy such that the value of a security key associated with a particular radio bearer can depend on a RAN key of a base station at which the radio bearer terminates, which in turn can depend on a previous value of the RAN key and / or a key associated with a CN entity such as the AMF 140.

[0038] To make it clearer, Figure 3 A fragment 300 of a security key hierarchy is shown, which includes a key K AMF , K gNB , NH, K RRCint , K RRCenc , K UPint and K UPenc Key K AMF can have some dependency on one or more parameters of the corresponding CN, which can be (at least in part) used as a proxy such as K gNB The RAN key and the parent key of the NH key. gNB Or NH key can be used as the generated key K gNB The new version of K gNB '(For example, K gNB →K gNB ' or NH→K gNB '). Key K gNB To generate the key K RRCint , K RRCenc , K UPint and K UPenc If the key K gNB ' is generated, then the key K gNB ' is used to generate the key K RRCint , K RRCenc , KUPint and K UPenc A new version of .

[0039] Figure 4A message diagram of an example scenario 400 is depicted in which, after UE 102 resumes a suspended radio connection, UE 102 and SN 106 receive a message from K SN The same security keys are derived.At the start of scenario 400, UE 102 is in a connected state associated with a protocol for controlling radio resources (eg, RRC_CONNECTED state associated with the RRC protocol).

[0040] UE 102 and MN 104 use the slave K MN The derived (first) security key is communicated 402, and in some cases, one or more additional keys are used. For example, UE 102 and MN 104 can use at least K MN A key and at least one algorithm derivation function having one or more parameters to derive a first security key K RRCint , K RRCenc , K UPint and K UPenc . Return to reference Figure 2A and Figure 2B UE 102 and MN 104 can utilize KDF 220 and KDF 270, respectively, to determine the KDF based at least in part on K MN A first security key is derived.

[0041] When MN 104 is an Mng-NB, K MN The key can be used as K eNB Key K gNB When MN 104 is a MgNB, K MN The key can be K gNB When SN 106 is an SgNB, K SN The key can be the S-KgNB key. When the SN 106 is an Sng-eNB, K SN The key can be K used as the S-KeNB key gNB Key.

[0042] UE 102 and MN 104 can generate a first K on the control plane RRCint Key to protect the integrity of RRC PDU, and / or generate the first K RRCenc More specifically, UE 102 can generate an uplink RRC PDU using a first K RRCint The key performs integrity protection on the uplink RRC PDU to generate an integrity-protected RRC PDU (eg, including the uplink RRC PDU and the uplink RRC PDU and the first K RRCint Key-generated integrity message authentication code (MAC-I)), using the first K RRCintThe MN 104 can then receive the encrypted and integrity-protected RRC PDU and use the first K to encrypt the integrity-protected RRC PDU and deliver the encrypted and integrity-protected RRC PDU to the MN 104 via the corresponding SRB, as described below. RRCenc The encrypted and integrity-protected RRC PDU is decrypted using the first K to generate a decrypted integrity-protected RRC PDU, and finally RRCint The key performs an integrity check on the decrypted integrity-protected RRC PDU to obtain the original uplink RRC PDU (e.g., using the first K RRCint The MN 104 can generate a downlink RRC PDU in a similar manner, using the first K RRCint Key and First K RRCenc The key applies integrity protection and ciphering to the downlink RRC PDU, and the UE 102 can use the first K RRCint Key and First K RRCenc The key is decrypted and integrity protection is performed to obtain the original downlink RRC PDU.

[0043] The RRC PDU can include, for example, an RRC message compliant with 3GPP TS 38.331 when the MN 104 is a MgNB, or an RRC message compliant with 3GPP TS 36.331 when the MN 104 is a Mng-eNB. The UE 102 and the MN 104 can exchange the RRC PDU through an SRB (e.g., SRB1 or SRB2). To configure the SRB, the MN 104 can use, for example, a connection establishment procedure, an RRC connection establishment procedure, an RRC connection reconfiguration procedure, or an RRC reconfiguration procedure.

[0044] To communicate on the user plane, UE 102 and MN 104 can exchange UP data packets (e.g., IP packets, Ethernet packets, Service Data Adaptation Protocol (SDAP) PDUs) using MN-terminated DRBs, which can be MCG radio bearers or split radio bearers. When MN 104 configures integrity protection for MN-terminated DRBs, UE 102 and MN 104 can generate a first K UPint key to protect the integrity of downlink data packets, and / or to generate a first K UPenc More specifically, the MN 104 can generate a downlink data packet using a first K UPint The key performs integrity protection on the downlink data packet to generate an integrity-protected data packet (eg, including the data packet and the data packet and the first K UPint Key-generated MAC-I), using the first KUPenc The encrypted and integrity-protected data packet is encrypted using the first K and delivered to the UE 102 through the corresponding DRB. The UE 102 is able to receive the encrypted and integrity-protected data packet and use the first K UPenc The encrypted and integrity-protected data packets are decrypted using the first K to generate decrypted integrity-protected data packets. UPint The key performs an integrity check on the decrypted integrity-protected data packet to obtain the original downlink data packet. UE 102 can generate uplink data packets in a similar manner, respectively using the first K UPint Key and First K UPenc The first K is used to apply integrity protection and encryption to uplink data packets, and the MN 104 can use the first K UPint Key and First K UPenc Key decryption and integrity protection are performed to obtain the original uplink data packet (eg, using the first K UPint key to verify MAC-I).

[0045] In some cases, MN 104 does not configure integrity protection for MN-terminated DRBs, and UE 102 and MN 104 do not need to derive the first K UPint In this case, MN 104 does not perform integrity protection on downlink data packets delivered by MN 104 to UE 102, and MN 104 does not perform integrity protection on uplink data packets received by MN 104 from UE 102. In other cases, MN 104 does not configure MN-terminated DRBs, and UE 102 and MN 104 do not need to derive the first K UPint Key and First K UPenc Key.

[0046] For simplicity, Figure 4 The discussion of the present invention refers to the first, second, third, and fourth security keys in the singular (e.g., "first security key"). However, for the reasons described above, the UE 102, MN 104, or SN 106 can use one or more security keys to exchange control plane data or user plane data in each of the first instance, the second instance, the third instance, and the fourth instance. In the first instance, the UE 102 can use the first security key. RRCint , First K RRCenc , First K UPint or the first K UPenc 402; in a second example, UE 102 can use a second K RRCint , Second K RRCenc , Second KUPint or the second K UPenc In the third example, UE 102 can use a third K RRCint , Third K RRCenc , Third K UPint or the third K UPenc One or more of the UEs 102 communicate 450 with the MN 104; and in a fourth example, the UE 102 is able to use a fourth K RRCint , the fourth K RRCenc , the fourth K UPint or the fourth K UPenc One or more of the Nth security key communicates 490 with the SN 106. Thus, in the following discussion, "Nth security key" should be understood to refer to one or more security keys.

[0047] Continue to refer Figure 4 UE 102 and SN 106 use the K SN The derived (second) security key is communicated 404, and in some cases, one or more additional keys are used. The UE 102 and the SN 106 can use at least K MN A key and at least one algorithmic derivation function having one or more parameters to derive a second security key K RRCint , K RRCenc , K UPint and K UPenc . Return to reference Figure 2A and Figure 2B UE 102 and SN 106 can utilize KDF 220 and KDF 270, respectively, to determine the KDF based at least in part on K SN A first security key is derived.

[0048] Similar to event 402, UE 102 and SN 106 can generate a second K RRCint Key to protect the integrity of the RRC PDU, and / or generate a second K RRCenc The UE 102 can generate an uplink RRC PDU using the second K RRCint The key performs integrity protection on the uplink RRC PDU to generate an integrity-protected RRC PDU (eg, including the RRC PDU and the RRC PDU and the second K RRCint Key generated MAC-I), using the second K RRCintThe SN 106 can then receive the encrypted and integrity-protected RRC PDU and use the second K to encrypt the integrity-protected RRC PDU and deliver the encrypted and integrity-protected RRC PDU to the SN 106 via the corresponding SRB, which can be SRB3. RRCenc The encrypted and integrity-protected RRC PDU is decrypted using the second K to generate a decrypted integrity-protected RRC PDU, and finally RRCint The key performs an integrity check on the decrypted integrity-protected RRC PDU to obtain the original uplink RRC PDU (e.g., using the second K RRCint The SN 106 can generate a downlink RRC PDU in a similar manner, using the second K RRCint Key and Second K RRCenc The key applies integrity protection and ciphering to the downlink RRC PDU, and the UE 102 can use the second K RRCint Key and Second K RRCenc The key is decrypted and integrity protection is performed to obtain the original downlink RRC PDU.

[0049] Similar to the RRC PDUs exchanged between UE 102 and MN 104, when SN 104 is an SgNB, the RRC PDUs traveling on the SRB terminated at SN 106 can include RRC messages compliant with 3GPP TS 38.331. As described above, for example, UE 102 and SN 106 can exchange RRC PDUs over SRB3. To configure SRB3, SN 106 can use, for example, an RRC connection reconfiguration procedure or an RRC reconfiguration procedure. Depending on the implementation of SN 106, SN 106 can not configure SRB3 to UE 102. If SN 106 does not configure SRB3 to UE 102, UE 102 and SN 106 can not generate a second K. RRCint Key and / or Second K RRCenc Key.

[0050] In addition, UE 102 and SN 106 can exchange UP data packets (e.g., IP packets or Ethernet packets) using SN-terminated DRBs, which can be SCG radio bearers or split radio bearers. When SN 106 configures integrity protection for SN-terminated DRBs, UE 102 and SN 106 can generate a second K UPint key to protect the integrity of downlink data packets, and / or generate a second K UPenc More specifically, the SN 106 can generate a downlink data packet using the second K UPintThe key performs integrity protection on the downlink data packet to generate an integrity-protected data packet (eg, including the data packet and the data packet and the second K UPint Key generated MAC-I), using the second K UPenc The encrypted and integrity-protected data packet is encrypted using the second K key and delivered to the UE 102 through the corresponding DRB. The UE 102 is able to receive the encrypted and integrity-protected data packet and use the second K key to encrypt the integrity-protected data packet. UPenc The encrypted and integrity-protected data packet is decrypted using the second K to generate a decrypted integrity-protected data packet, and finally UPint The key performs an integrity check on the decrypted integrity-protected data packet to obtain the original downlink data packet (eg, using a second K UPint The UE 102 can generate uplink data packets in a similar manner, using the second K UPint Key and Second K UPenc The key applies integrity protection and encryption to the uplink data packets, and the SN 106 can use the second K UPint Key and Second K UPenc The key is decrypted and integrity protection is performed to obtain the original uplink data packet.

[0051] In some cases, SN 106 does not configure integrity protection for SN-terminated DRBs, and UE 102 and SN 106 do not need to derive the second K UPint In this case, SN 106 does not perform integrity protection on downlink data packets that SN 106 delivers to UE 102, and SN 106 also does not perform integrity protection on uplink data packets that SN 106 receives from UE 102.

[0052] Thus, when operating in the RRC_CONNECTED state, the UE 102 can communicate 402, 404 in dual connectivity with the MN 104 and the SN 106. Alternatively, the UE 102 can operate in a single connectivity with the MN 104 and communicate with the SN 106 via the MN 104.

[0053] At some point, MN 104 can send 410 an RRC deactivation command to UE 102. In response to the RRC deactivation command, UE 102 can transition 412 to a connection state associated with a protocol for controlling radio resources (e.g., an RRC_INACTIVE state associated with an RRC protocol). When MN 104 is a MgNB, the RRC deactivation command message can be an RRC release (RRCrelease) message. When MN 104 is a Mng-eNB, the RRC deactivation command can be an RRC connection release (RRCconnectionrelease) message.

[0054] After a period of time of deactivation on the radio interface with the RAN 108, the UE 102 initiates 420 the RRC connection recovery procedure to recover the RRC connection. In some scenarios, for example, if a higher layer of the communication requests a connection, the UE 102 initiates 420 the RRC connection recovery procedure to send uplink data. In another scenario, the UE 102 initiates 420 the RRC connection recovery procedure in response to a paging from the MN 104.

[0055] For example, in response to UE 102 initiating 420 an RRC connection procedure, UE 102 can derive 422 a new K MN and is based, at least in part, on the new K MN UE 102 can derive a new (third) security key based on K MN The previous value of K or in some cases the new K is derived using the NH key obtained by UE 102 from MN 104. MN In this case, UE 102 starts from the new K MN Derive more than one new security key (e.g., K RRCint , K RRCenc , K UPint or K UPenc MN 104 indicates that UE 102 should use K in the RRC deactivation command. MN or a previous value of the NH key. In some implementations, the MN 104 includes a Next Hop Chaining Count value in the RRC deactivation command. If the Next Hop Chaining Count value is associated with the NH key, the UE 102 and the MN 104 derive K based on the NH key. MN If the next hop link count value is equal to K MN , then UE 102 and MN 104 use K MN The previous value of K MN In some cases, UE 102 can derive more than one new K MN(e.g., for each of several radio bearers), and from each new K MN Deriving more than one new security key (e.g., K RRCint , K RRCenc , K UPint or K UPenc ).

[0056] Depending on the implementation, the UE 102 can derive 422 the new K before the UE 102 sends 424 the RRC recovery request or after the UE 102 sends 424 the RRC recovery request. MN and a third security key. In addition, UE 102 can derive 422 a new K before UE 102 receives 460 an RRC resume message (see below). MN and a third security key. In addition, in some implementations, the UE 102 derives 422 a new K in response to receiving 410 the RRC deactivation command. MN and a third security key.

[0057] In response to receiving 424 the RRC resume request, or in response to sending 410 the RRC deactivation command, the MN 104 can generate a new K MN key, and is based at least in part on the new K MN key to derive at least one third security key (K RRCint , K RRCenc , K UPint and K UPenc ). In some implementations, MN 104 receives the MN The new K is derived from the previous value of MN In other implementations, the MN 104 obtains the NH key or obtains the K AMF Key derivation new K MN Key (see Figure 2B MN 104 can then apply KDF 270 and one or more parameters to the new K MN key to generate a third security key.

[0058] MN 104 can exchange data with UE 102 using this new third security key. Similar to event 402 discussed above, the data can include control plane data units (e.g., RRC PDUs) and / or user plane data units (e.g., IP packets, Ethernet packets, SDAP PDUs). As a more specific example, the first RRC PDU sent by MN 104 to UE 102 using the third security key can include an RRC recovery message (see event 460), and the first RRC PDU sent by UE 102 to MN 104 using the third security key can include an RRC recovery complete message (see event 480). UE 102 and MN 104 can correctly process these RRC PDUs using the third security key.

[0059] Therefore, since UE 102 and MN 104 use the new K MN The key generates a third key so the third security key is aligned (e.g., the same or has another type of correspondence or dependency) between UE 102 and MN 104, and thus UE 102 and MN 104 can correctly encrypt data and / or apply integrity protection.

[0060] According to some implementations, MN 104 can use the new K MN The key and sk-Counter value are used to generate 434 new K SN The MN 104 can maintain a sk-Counter value for the UE 102. In other implementations, the MN 104 receives the sk-Counter value from the CN 110. In other implementations, the MN 104 can determine or update the sk-Counter under certain conditions. Specifically, the MN 104 can increase the sk-Counter value by N, where N is a positive integer, such as 1, 2, etc.

[0061] MN 104 includes the new K in the SN request message SN The MN 104 receives the key and delivers 440 an SN request message to the SN 106. In some cases, the MN 104 includes the updated sk-Counter in the same or a different subsequent SN request message to the SN 106.

[0062] Then, SN 106 was able to SN In response to the SN request message, the SN 106 delivers 442 an SN request confirmation message. In some implementations, before sending 442 the SN request confirmation message, the SN 106 derives 444 at least one new fourth security key from the new K SN In other implementations, after sending 442 the SN Request Confirmation message, the SN 106 derives a fourth security key from the new KSN The key derives the fourth security key.

[0063] In some implementations, the SN request message is an S-Node modification request message, and the SN request confirmation message is an S-Node modification request confirmation message. In other implementations, the SN request message is an S-Node addition request message, and the SN request confirmation message is an S-Node addition request confirmation message.

[0064] Continue to refer Figure 4 , export 422 new K in UE MN After the UE 102 and the third security key are exchanged, the UE 102 and the MN 104 can communicate 450 using the third security key. Similar to event 402 discussed above, the data exchanged by the UE 102 and the MN 104 can include CP or UP data. The UE 102 and the MN 104 can use the new third security key, and in some cases one or more additional security keys, to apply encryption and / or integrity protection techniques, as discussed above with reference to event 402.

[0065] In response to receiving 424 the RRC recovery request, or in response to receiving 442 the SN request confirmation message, the MN 104 can send 460 an RRC recovery message to the UE 102. The RRC recovery message can include the value of the sk-Counter discussed above. The UE 102 can receive 460 a downlink RRC PDU including the RRC recovery message using the third security key. In response, the UE 102 can send 480 an RRC recovery complete message to the MN 104. The UE 102 can send 480 an uplink RRC PDU including the RRC recovery complete message using the third security key. Then, the UE 102 can enter a transition 472 back to a connected state (e.g., RRC_CONNECTED).

[0066] When the MN 104 is a MgNB, the RRC resume request can be an RRC resume request (RRCresumerequest) message, the RRC resume message can be an RRC resume (RRCresume) message, and the RRC resume complete message can be an RRC resume complete (RRCresumecomplete) message. When the MN 104 is an Mng-eNB, the RRC resume request message can be an RRC connection resume request (RRCConnectionResumeRequest) message, the RRC resume message can be an RRC connection resume (RRCConnection Resume) message, and the RRC resume complete message can be an RRC connection resume complete (RRCConnectionResumeComplete) message.

[0067] Before transitioning 472 to the connected state, or after transitioning to the connected state, UE 102 can MN and sk-Counter export 470 new K SN UE 102 can then use the new K SN Deriving a new fourth security key. Thus, the SN 106 and the UE 102 are able to derive 444, 470 a fourth security key that is appropriately aligned, such that the SN 106 and the UE 102 are able to appropriately encrypt, decrypt and / or apply integrity protection to uplink and downlink traffic (data and / or control messages).

[0068] like Figure 4 As shown, UE 102 and SN 106 can use the fourth security key communication 490. Similar to event 404 discussed above, the traffic in event 490 can include control plane data units (e.g., RRC PDUs) and / or user plane data units (e.g., IP packets, Ethernet packets, SDAP PDUs). As discussed above with reference to event 404, UE 102 and SN 106 can apply one or more fourth security keys K RRCint , K RRCenc , K UPint and K UPenc .

[0069] UE 102 and SN 106 can use SN terminated SRB or DRB, which can be SCG radio bearer or split radio bearer. In some scenarios, UE 102 and SN 106 communicate 490 with each other via MN 104. More specifically, SN 106 may not configure radio resources to UE 102, so that UE 102 uses the radio resources of MN 104 (lower layer of radio bearer) to communicate with SN 106 via MN 104. In other scenarios, if SN 106 is an SgNB, SN 106 configures radio resources for UE 102 in a cell group configuration (CellGroupConfig information element (IE)) and sends CellGroupConfig IE to MN 104 in an SN request confirm message. MN 104 then includes the CellGroupConfig IE in an RRC resume message (event 460). UE 102 and SN 106 can communicate data with each other using the CellGroupConfig IE using a fourth security key. In some implementations, the SN 106 includes the CellGroupConfig IE in the RRCReconfiguration message and includes the RRCReconfiguration message in the SN Request Ack message (Event 442). The MN includes the RRCReconfiguration message in the RRC Resume message (Event 460).

[0070] In some cases, MN 104 indicates that UE 102 should reestablish PDCP for an SRB (e.g., SRB2). To do this, MN 104 uses an IE or field (e.g., reestablishPDCP) in an RRC resume message (event 460). In some cases, MN 104 can also use this IE or field or a similar IE or field to indicate that UE 102 should reestablish PDCP for an MN terminated DRB or an SN terminated DRB. SN 106 can also indicate in an IE or field (e.g., reestablishPDCP) that UE 102 should reestablish PDCP for an SRB (e.g., SRB3) and deliver 442 the IE or field to MN 104 in an SN request confirm message. SN 106 can also indicate in an IE or field (e.g., reestablishPDCP) that UE 102 should reestablish PDCP for an SN terminated DRB and deliver 442 the IE or field to MN 104 in an SN request confirm message. The MN can then include one or more IEs with this indication in the RRC Resume message (event 460).

[0071] In some cases, after sending 480 the RRC recovery message, but before sending 440 the SN request message or receiving 442 the SN request confirmation message, the MN 104 can receive control plane or user plane traffic addressed to the SN 106 from the UE 102. In this case, the MN 104 can buffer the SN bound traffic. Then, after sending 440 the SN request message or receiving 442 the SN request confirmation message, the MN 104 can send the buffered traffic to the SN 106.

[0072] like Figure 4 As shown, in some implementations or scenarios, before sending 440 the new K to the SN 106, SN Before the new K key is sent to the SN 106, the MN 106 can send an instruction to the UE 102 to resume the suspended radio connection (process "A"). In addition, in some implementations or scenarios, before the new K key is sent to the SN 106, the MN 106 can send an instruction to the UE 102 to resume the suspended radio connection (process "A"). SN Prior to retrieving the key, MN 106 can send an instruction to UE 102 to resume the suspended radio connection, and also receive an indication that UE 102 has resumed the suspended radio connection (process "B").

[0073] refer to Figure 5 The example method 500 for generating a security key for communicating with a SN can be implemented in a suitable UE. For convenience, the method 500 is discussed below with reference to the UE 102 operating in the wireless communication system 100.

[0074] Method 500 begins at block 502, where UE 102 communicates with MN 104 and SN 106 using at least one first security key and at least one second security key, respectively. The first security key(s) can be a key that is shared between UE 102 and MN 104 based on K. MN The first K generated RRCint , First K RRCenc , First K UPint and the first K UPenc The second security key (or keys) can be a key between UE 102 and MN 104 based on K SN The second K generated RRCint , Second K RRCenc , Second K UPint and the second K UPenc For example, as mentioned above, Figure 4 As discussed in events 402 and 404 , UE 102 is able to communicate at block 502 .

[0075] At block 504, UE 102 transitions from a connected state (e.g., RRC_ACTIVE) to a deactivated state (e.g., RRC_INACTIVE) at block 504. For example, UE 102 can make such a transition in response to a command from MN 104 (see Figure 4 event 410).

[0076] Next, at block 506, UE 102 can generate a new K SN Key (see Figure 4 For example, in response to detecting that UE 102 should transition back to the connected state, UE 102 can generate the key. In some implementations, to generate a new K SN Key, UE 102 first generates a new K MN Key (see Figure 4 Event 422), receiving the sk-Counter value from MN 104 (see Figure 4 event 460), and is based at least in part on the new K MN Key and sk-Counter to derive the new K SN key (see event 470).

[0077] At block 508, UE 102 can generate at least one new security key for use in communicating with SN 106. According to scenario 400 discussed above, the at least one new security key for use in communicating with SN 106 is a fourth security key K RRCint , K RRCenc , K UPint and K UPenc One or more of the K SN keys to generate these keys.

[0078] Next, Figure 6 An example method 600 for generating security keys for communication between a SN and a UE is illustrated, which can be implemented in a RAN including a base station capable of supporting dual connectivity for a UE. For convenience, the method 600 is discussed below with reference to the RAN 108 of the wireless communication system 100.

[0079] At block 602, MN 104 and SN 106 communicate with UE 102 using at least one first security key and at least one second security key, respectively. The first security key (or keys) can be a key that is determined by UE 102 and MN 104 based on K. MN The first K generated RRCint , First K RRCenc , First K UPint and the first K UPencThe second security key (or keys) can be a key between UE 102 and MN 104 based on K SN The second K generated RRCint , Second K RRCenc , Second K UPint and the second K UPenc For example, as mentioned above, Figure 4 As discussed above with respect to events 402 and 404 , the RAN 108 is able to communicate with the UE 102 at block 602 .

[0080] At block 604, the RAN 108 causes the UE 102 to transition from the connected state (e.g., RRC_ACTIVE) to the deactivated state (e.g., RRC_INACTIVE). To this end, for example, the MN 104 can send a command to the UE 102 (see Figure 4 Next, at block 606, the RAN 108 generates a new key K MN (See Figure 4 Then, RAN 108 uses the new key K MN To generate a new key K SN (See Figure 4 As described above, MN 104 is able to generate a new key K SN , and sends (see event 440) the new key K to SN 106 SN .

[0081] At block 610, the RAN 108 can use the new key K SN At least one new security key is generated for communication between SN 106 and UE 102 (see event 444). According to scenario 400 discussed above, the at least one new security key for communication between SN 106 and UE 102 is a fourth security key K RRCint , K RRCenc , K UPint and K UPenc One or more of .

[0082] The following additional considerations apply to the foregoing discussion.

[0083] A user device (e.g., UE 102) capable of implementing the technology of the present disclosure can be any suitable device capable of wireless communication, such as a smartphone, a tablet computer, a laptop, a mobile game console, a point of sale (POS) terminal, a health monitoring device, a drone, a camera, a media streaming dongle or another personal media device, a wearable device such as a smart watch, a wireless hotspot, a femtocell base station, or a broadband router. In addition, in some cases, the user device can be embedded in an electronic system, such as a host or an advanced driver assistance system (ADAS) of a vehicle. In addition, the user device can operate as an Internet of Things (IoT) device or a mobile Internet device (MID). Depending on the type, the user device can include one or more general-purpose processors, a computer-readable memory, a user interface, one or more network interfaces, one or more sensors, etc.

[0084] Certain embodiments are described in the present disclosure as including logic or multiple components or modules. A module can be a software module (e.g., a code or machine-readable instruction stored on a non-transitory machine-readable medium) or a hardware module. A hardware module is a tangible unit that can perform certain operations and can be configured or arranged in certain ways. A hardware module can include dedicated circuits or logic that are permanently configured to perform certain operations (e.g., as a dedicated processor, such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC), a digital signal processor (DSP), etc.). A hardware module can also include programmable logic or circuits (e.g., contained in a general-purpose processor or other programmable processor) that are temporarily configured by software to perform certain operations. The decision to implement a hardware module in a dedicated and permanently configured circuit or in a temporarily configured circuit (e.g., configured by software) can be driven by cost and time considerations.

[0085] When implemented in software, the techniques can be provided as part of an operating system, a library used by multiple applications, a specific software application, etc. The software can be executed by one or more general-purpose processors or one or more special-purpose processors.

[0086] After reading this disclosure, those skilled in the art will understand additional and alternative structural and functional designs for managing security keys through the principles disclosed herein. Therefore, although specific embodiments and applications have been illustrated and described, it should be understood that the disclosed embodiments are not limited to the precise constructions and components disclosed herein. Various modifications, changes and variations can be made to the arrangement, operation and details of the methods and devices disclosed herein without departing from the spirit and scope defined in the appended claims, which will be apparent to those of ordinary skill in the art.

[0087] When implemented in software, the techniques can be provided as part of an operating system, a library used by multiple applications, a specific software application, etc. The software can be executed by one or more general-purpose processors or one or more special-purpose processors.

[0088] Aspect 1. A security key management method in a user equipment (UE) capable of communicating with a primary node (MN) and a secondary node (SN) simultaneously, the method comprising: transitioning, by processing hardware, from a connected state to a deactivated state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, in which a radio connection between the UE and a radio access network (RAN) is suspended; and executing, by the processing hardware, a process for transitioning from the deactivated state to the connected state, comprising: generating a new RAN key K corresponding to the SN SN , and at least based on the new RAN key K SN Generate new security keys for communicating with the SN.

[0089] Aspect 2. The method according to aspect 1, wherein executing the process for transitioning from the deactivated state to the connected state further comprises: generating a new RAN key K corresponding to the MN. MN , where a new RAN key K is generated SN At least based on the new RAN key K MN .

[0090] Aspect 3. The method according to aspect 2, wherein a new RAN key K is generated. SN Further based on a counter value sk-Counter associated with the initial security configuration of the radio bearer terminated at the SN.

[0091] Aspect 4. The method according to aspect 3 further includes: receiving a counter value sk-Counter from the MN in response to a request from the UE to resume the radio connection.

[0092] Aspect 5. The method according to aspect 2, wherein the new security key is a fourth security key, and the method further comprises: based at least on the new RAN key K MN A third security key is generated for communicating with the MN.

[0093] Aspect 6. A method according to aspect 5, wherein generating the third security key is in response to detecting at least one of: (i) initiation of a process for restoring a radio connection between the UE and the RAN; or (ii) notification from the MN that the radio connection is deactivated.

[0094] Aspect 7. The method according to aspect 5 further comprises: receiving a data unit including an instruction to resume the suspended radio connection from the MN using a third security key.

[0095] Aspect 8. A method according to any one of aspects 1-7, wherein generating a new security key for communicating with the MN or SN comprises generating an integrity protection key K for radio resource control (RRC) data sent over a signaling radio bearer (SRB). RRCint .

[0096] Aspect 9. The method according to any one of aspects 1 to 7, wherein generating a new security key for communicating with the MN or SN comprises generating an encryption key K for RRC data sent via SRB. RRCenc .

[0097] Aspect 10. A method according to any one of aspects 1-7, wherein generating a new security key for communicating with the MN or SN comprises generating an encryption key K for user plane data sent over a data radio bearer (DRB). UPenc .

[0098] Aspect 11. A user equipment (UE), comprising processing hardware and configured to implement the method according to any one of aspects 1-10.

[0099] Aspect 12. A method for security key management in a radio access network (RAN), the radio access network comprising a first base station operating as a master node (MN) and a second base station operating as a secondary node (SN), the method comprising: causing a UE to transition from a connected state to a deactivated state by processing hardware, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, in which a radio connection between the UE and the RAN is suspended; after causing the UE to transition to the deactivated state, generating, by processing hardware, a new RAN key K corresponding to the MN MN ; by the processing hardware based at least on the new RAN key K MN To generate a new RAN key K corresponding to SN SN ; and by the processing hardware based on at least the new RAN key K SN Generate new security keys for communication between the UE and the SN.

[0100] Aspect 13. The method according to aspect 12, wherein a new RAN key K is generated. MN The method is in response to receiving a request from the UE to resume a suspended radio connection.

[0101] Aspect 14. The method according to aspect 12, wherein causing the UE to transition to the deactivated state comprises sending a notification to the UE that the radio connection is deactivated; and generating a new RAN key K in response to sending the notification. MN .

[0102] Aspect 15. A method according to any one of aspects 12-14, wherein a new RAN key K is generated. MN Includes the RAN key K from the previous MN Derive the new RAN key K MN .

[0103] Aspect 16. A method according to any one of aspects 12-14, wherein a new RAN key K is generated. MN This involves deriving a new RAN key K from the next hop (NH) key associated with the core network (CN). MN .

[0104] Aspect 17. A method according to any one of aspects 12-14, wherein a new RAN key K is generated. MN Includes the AMF key K associated with the Authentication Management Function (AMF) of the serving network AMF Derive the new RAN key K MN .

[0105] Aspect 18. A method according to aspects 12-17, wherein a new RAN key K is generated. SN Further based on a counter value sk-Counter associated with the initial security configuration of the radio bearer terminated at the SN.

[0106] Aspect 19. The method according to aspect 18, further comprising sending a counter value sk-Counter to the UE in response to a request to resume the suspended radio connection.

[0107] Aspect 20. The method according to aspect 18, further comprising receiving a counter value sk-Counter from a core network (CN).

[0108] Aspect 21. The method according to aspect 18, further comprising maintaining a counter value sk-Counter at the MN.

[0109] Aspect 22. The method according to any one of aspects 12-21 further comprises: sending a new RAN key K from the MN to the SN. SN , and sends a new RAN key K to the SN SN Thereafter, an instruction to resume the suspended radio connection is sent from the MN to the UE.

[0110] Aspect 23. The method according to any one of aspects 12-21, further comprising: sending an instruction from the MN to the UE to resume the suspended radio connection; and after sending the instruction to resume the suspended radio connection, sending a new RAN key K from the MN to the SN. SN .

[0111] Aspect 24. The method according to any one of aspects 12-21 further comprises: sending an instruction from the MN to the UE to resume the suspended radio connection; receiving an indication from the UE at the MN that the radio connection is resumed; and in response to receiving the indication that the radio connection is resumed, sending a new RAN key K from the MN to the SN. SN .

[0112] Aspect 25. A method according to any one of aspects 12-24, wherein the new security key is a fourth key, the method further comprising: based at least on the new RAN key K MN , generating a third security key for communication between the UE and the MN.

[0113] Aspect 26. The method according to any one of aspects 12-25, further comprising: sending an instruction to resume the suspended radio connection from the MN to the UE using a third security key.

[0114] Aspect 27. A method according to any one of aspects 12-26, wherein generating a new security key for communicating with the MN or SN comprises generating an integrity protection key K for radio resource control (RRC) data sent over a signaling radio bearer (SRB). RRCint .

[0115] Aspect 28. A method according to any one of aspects 12-26, wherein generating a new security key for communicating with the MN or SN comprises generating an encryption key K for RRC data sent over the SRB. RRCenc .

[0116] Aspect 29. A method according to any one of aspects 12-26, wherein generating a new security key for communicating with the MN or SN comprises generating an encryption key K for user plane data sent over a data radio bearer (DRB). UPenc .

[0117] Aspect 30. A radio access network (RAN), comprising: a first base station coupled to a core network (CN); and a second base station communicatively coupled to the CN and the first base station; the RAN is configured to implement the method described in any of Aspects 13-20.

[0118] Aspect 31. The method of claim 1, further comprising communicating with the SN via the MN using a fourth security key.

[0119] Aspect 32. The method according to aspect 1, wherein performing the process for transitioning from the deactivated state to the connected state is in response to detecting data to be transmitted.

[0120] Aspect 33. The method according to aspect 1, wherein performing the process for transitioning from the deactivated state to the connected state is in response to receiving a paging notification from the MN.

[0121] Aspect 34. The method according to any one of aspects 1 to 10, before transitioning to the deactivated state, further comprises: based on at least a previous RAN key K corresponding to the MN MN to generate a first security key; and based at least on a previous RAN key K corresponding to the SN SN To generate a second security key.

Claims

1. A security key management method in a user equipment (UE) capable of communicating with a primary node (MN) and a secondary node (SN) simultaneously, the method comprising: transitioning from a connected state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, to a deactivated state, in which a radio connection between the UE and a radio access network (RAN) is suspended; as well as A process for transitioning from a deactivated state to a connected state is performed, including: Generate a new RAN key K corresponding to the MN MN , At least based on the new RAN key K MN generating a third security key for communicating with the MN, receiving an RRC recovery message including a counter value sk-Counter from the MN using a third security key, Using (i) the counter value and (ii) the RAN key K corresponding to the MN MN Generate a new RAN key K corresponding to SN SN ,and At least based on the new RAN key K SN A fourth security key is generated for communicating with the SN.

2. The method according to claim 1, in, Use the RAN key K corresponding to the MN MN Generate a new RAN key K SN Including the use of a new RAN key K MN .

3. The method according to claim 2, wherein: The counter value sk-Counter is associated with the initial security configuration of the radio bearer terminated at the SN.

4. The method according to claim 3, wherein: The counter value sk-Counter is received from the MN in response to a request from the UE to resume the radio connection.

5. The method according to claim 2, wherein: The new security key is the fourth security key.

6. The method according to claim 5, wherein: Generating the third security key is in response to detecting at least one of: (i) initiate a procedure for restoring the radio connection between the UE and the RAN, or (ii) Notification from the MN that the radio connection is deactivated.

7. The method according to claim 5, further comprising: A data unit including an instruction to resume the suspended radio connection is received from the MN using the third security key.

8. The method according to claim 1, wherein: Generating the third security key or the fourth security key includes at least one of the following: Generates the integrity protection key K for radio resource control (RRC) data sent over a signaling radio bearer (SRB) RRCint , Generate the encryption key K for RRC data sent over SRB RRCenc ,or Generates the encryption key K for user plane data sent over a data radio bearer (DRB) UPenc .

9. The method according to claim 1, wherein: The RRC resume message is the RRCConnectionResume message.

10. The method according to claim 1, wherein: The RRC recovery message is the RRCResume message.

11. The method of claim 1 , further comprising, in response to the RRC resume message: transitioning from the deactivated state to the connected state; and Send an RRC recovery complete message to the MN.

12. A security key management method in a radio access network (RAN), the radio access network comprising a first base station operating as a master node (MN) and a second base station operating as a secondary node (SN), the method comprising: causing the UE to transition from a connected state to a deactivated state, in which the UE communicates with the MN using a first security key and communicates with the SN using a second security key, and in which a radio connection between the UE and the RAN is suspended; After the UE is switched to the deactivated state, a new RAN key K corresponding to the MN is generated. MN ; At least based on the new RAN key K MN generating a third security key for communication between the UE and the MN; Sending an RRC recovery message including a counter value sk-Counter to the UE using a third security key; At least based on the new RAN key K MN To generate a new RAN key K corresponding to SN SN ; as well as At least based on the new RAN key K SN To generate a fourth security key for communication between the UE and the SN.

13. The method according to claim 12, wherein: Generate a new RAN key K MN The method is in response to receiving a request from the UE to resume a suspended radio connection.

14. The method according to any one of claims 12 or 13, wherein: Generate a new RAN key K MN Include at least one of the following: From the previous RAN key K MN Derive the new RAN key K MN , The new RAN key K is derived from the next hop (NH) key associated with the core network (CN) MN ,or From the AMF key K associated with the Authentication Management Function (AMF) of the serving network AMF Derive the new RAN key K MN .

15. The method according to claim 12, further comprising: Send a new RAN key K from MN to SN SN ; as well as Sending a new RAN key K to SN SN Thereafter, an instruction to resume the suspended radio connection is sent from the MN to the UE.

16. A device for security key management in a user equipment (UE), comprising one or more processors and configured to implement the method of any one of claims 1-11 or 12-15.

Images