Key generation method and device, storage medium and program product

Abstract

The invention provides a key generation method and device, a storage medium and a program product, relates to the technical field of communication, and is used for enhancing the security of key generation. The method includes generating an authentication service function key based on at least two random numbers.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a key generation method, device, storage medium and program product. Background Art

[0002] With the evolution of the fifth-generation mobile communication technology (5G) network and the rapid development of quantum technology, the security needs of mobile communication networks are constantly upgraded, especially the security of keys in the network has received great attention. Cryptography is the core gene for maintaining network and information security. The most important thing is the security of keys. The security of a key directly determines the security of the system. Therefore, enhancing key security has become an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide a key generation method, device, storage medium and program product for improving the security of key generation. The technical solutions provided by the embodiments of the present application are as follows:

[0004] In a first aspect, a key generation method is provided, the method comprising:

[0005] An authentication service function key is generated based on at least two random numbers.

[0006] The technical solution provided by the present application brings at least the following beneficial effects: the present application introduces at least two random numbers in the authentication service process, and generates an authentication service function key based on at least two random numbers. Compared with the authentication service function key in the related art being generated based on the same random number, the security of the authentication service function key generation is enhanced. At the same time, while meeting the requirements of the existing key derivation system, the introduction of at least two random numbers optimizes the key generation method in the existing process, and meets the requirements for key derivation in different authentication modes (such as AKA mode and EAP-AKA' mode).

[0007] As a possible implementation manner, the authentication service function key includes at least one of the following: an authentication service function key in an authentication and key agreement AKA mode, and an authentication service function key in an extensible authentication protocol EAP AKA' mode.

[0008] Based on this possible implementation, at least two random numbers are introduced, the key generation method in the existing process is optimized, and the requirements of the AKA mode and the EAP-AKA' mode for key derivation are met.

[0009] As a possible implementation manner, a first encryption key and a first integrity key are generated based on at least two random numbers, the first encryption key is an encryption key generated based on a portion of the at least two random numbers, and the first integrity key is an integrity key generated based on another portion of the at least two random numbers;

[0010] An authentication service function key is generated based on the first encryption key and the first integrity key.

[0011] Based on this possible implementation method, an authentication service function key is generated based on an encryption key generated based on a part of at least two random numbers and an integrity key generated based on another part of at least two random numbers. Compared with the related art in which an encryption key and an integrity key are generated based on the same random number, the security of the generation of encryption keys and integrity keys is improved without modification or light modification, thereby enhancing the security of the generation of authentication service function keys.

[0012] As a possible implementation manner, a second encryption key and a second integrity key are generated based on at least two random numbers, the second encryption key includes an encryption key generated based on each of the at least two random numbers, and the second integrity key includes an integrity key generated based on each of the at least two random numbers;

[0013] The first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key.

[0014] Based on this possible implementation method, the key length is enhanced by storing in series the encryption key generated by each of the at least two random numbers and in series the integrity key generated by each of the at least two random numbers, so as to cope with quantum attacks through longer key lengths in view of the development of future network technologies.

[0015] As a possible implementation manner, the first encryption key and the first integrity key are both 128 bits.

[0016] Based on this possible implementation method, the security of encryption key and integrity key generation is improved without modification or with lightweight modification, while meeting the length requirements of encryption key and integrity key for generating authentication service function key in relevant authentication mode.

[0017] As a possible implementation manner, the second encryption key and the second integrity key are both 256 bits.

[0018] Based on this possible implementation method, compared with the encryption key and integrity key stored in the related art in which the length is 128 bits, the present application upgrades the length of the encryption key and integrity key to 256 bits, which can better cope with quantum attacks.

[0019] As a possible implementation method, the random number is a quantum random number.

[0020] Based on this possible implementation method, quantum random numbers are introduced to enhance the security of random numbers.

[0021] In a second aspect, a key generation device is provided, the device comprising:

[0022] A processing module is used to generate an authentication service function key based on at least two random numbers.

[0023] As a possible implementation manner, the authentication service function key includes at least one of the following: an authentication service function key in an authentication and key agreement AKA mode, and an authentication service function key in an extensible authentication protocol EAP AKA' mode.

[0024] As a possible implementation, the processing module is specifically used to:

[0025] Generate a first encryption key and a first integrity key based on at least two random numbers, the first encryption key is an encryption key generated based on a portion of the two random numbers, and the first integrity key is an integrity key generated based on another portion of the at least two random numbers;

[0026] An authentication service function key is generated based on the first encryption key and the first integrity key.

[0027] As a possible implementation manner, the processing module is configured to generate a second encryption key and a second integrity key based on at least two random numbers, the second encryption key includes an encryption key generated based on each of the at least two random numbers, and the second integrity key includes an integrity key generated based on each of the two random numbers;

[0028] The acquisition module is used to acquire the first encryption key from the second encryption key, and acquire the first integrity key from the second integrity key.

[0029] As a possible implementation manner, the first encryption key and the first integrity key are both 128 bits.

[0030] As a possible implementation manner, the second encryption key and the second integrity key are both 256 bits.

[0031] As a possible implementation method, the random number is a quantum random number.

[0032] In a third aspect, a communication device is provided, comprising: a memory and a processor; the memory and the processor are coupled; the memory is used to store computer program instructions executable by the processor; and the processor implements the key generation method of any of the above embodiments when executing the computer program instructions.

[0033] In a fourth aspect, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed on a computer (such as a communication device or a key generation device), the key generation method of any of the above embodiments is implemented.

[0034] In a fifth aspect, a computer program product is provided, which includes computer program instructions, and when the computer program instructions are executed, the key generation method of any of the above embodiments is implemented.

[0035] The specific description of the second to fifth aspects and their various implementations in this application can refer to the detailed description of the first aspect and its various implementations. The beneficial effects of the second to fifth aspects and their various implementations can refer to the beneficial effect analysis of the first aspect and its various implementations, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of key deduction in a related technology provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of a network architecture provided for an embodiment of the present application;

[0038] Figure 3 Another schematic diagram of a network architecture provided for an embodiment of the present application;

[0039] Figure 4 A flowchart of a key generation method provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of a network-side key generation architecture provided in an embodiment of the present application;

[0041] Figure 6 A schematic diagram of a terminal-side key generation architecture provided in an embodiment of the present application;

[0042] Figure 7 A key derivation flow chart provided for an embodiment of the present application;

[0043] Figure 8 A schematic diagram of the structure of a key generation device provided in an embodiment of the present application;

[0044] Fig. 9A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "plurality" means two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

[0047] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0048] With the evolution of 5G networks and networks, and the rapid development of quantum technology, the security needs of mobile communication networks are constantly being upgraded. In particular, the security of keys in the network has received great attention. Cryptography is the core gene for maintaining network and information security. The most important thing is the security of keys. The security of a key directly determines the security of the system. Therefore, enhancing key security has become an urgent problem to be solved.

[0049] At present, in the existing cryptographic system, facing quantum attacks, the main measure of symmetric algorithms is to increase the length of the key, and the main countermeasure of asymmetric algorithms is to use or integrate anti-quantum algorithms to resist attacks. In the existing standard system, how to enhance the security of the key without modification or lightweight modification has aroused the industry's thinking, and seeking a highly secure, lightweight, flexible and efficient way is the main direction of research. Integrating quantum technology and gradually migrating to anti-quantum is an important technical direction for mobile communications and evolving networks. How to select the core key system in the expanding network system as the primary direction is an important direction of concern for industry experts. From the concepts of endogenous security, zero trust, trustworthiness, etc., the boundaries and depth of security in the field of mobile communications have been deepened again. Integrated development is the way out. To this end, exploring the deep integration and innovation of mobile communication networks with cryptography and cutting-edge technologies is the mainstream direction of the development of 5G and future mobile communication networks, realizing secure self-growth and trusted self-accompaniment.

[0050] 5G network is a key infrastructure, and the security of the core network is of paramount importance. The application of cryptography in the core network is the focus of research and the difficulty of core technology research. Many experts and scholars in the industry have thought about and explored the application of cryptography in mobile communication networks and put forward some unique insights, but the core is centered around the existing standard system, without fine-grained thinking and improvement of the processes in the standards, and lightweight transformation, that is, the existing research is coarse-grained.

[0051] In the existing series of standards of the 3rd Generation Partnership Project (3GPP), 5G network key derivation has a complete derivation system involving terminals and core network elements. The root key is the K value, which is stored in the core network elements for a long time. According to the key derivation system, with the participation of the key derivation function and related parameters, the key derivation of the entire system is completed.

[0052] For example, Figure 1 The key derivation process in the related technology provided by this application, such as Figure 1 As shown in FIG, the 5G main authentication process is divided into two types: 5G authentication and key agreement (AKA) and improved extensible authentication protocol EAP AKA'.

[0053] Specifically, for the user equipment (UE) side, the UE saves the same root key K as the network side; when the authentication method is 5G AKA authentication, the UE generates an encryption key (cipher key, CK) and an integrity key (integrity key, IK) based on K; and generates an authentication service function key (K AUSF ); According to K AUSF And SN name generates anchor key (K SEAF ); According to K SEAF , the subscription permanent identifier (SUPI) and the anti-bidding down between architectures (ABBA) are used to generate the lower-level key (K AMF ). When the authentication mode is EAP AKA', UE generates CK and IK based on K; generates CK' and IK' based on CK, IK and SN name; generates K based on CK', IK' and SUPI AUSF According to K AUSF and SNname to generate the anchor key (K SEAF ); According to K SEAF , SUPI and ABBA generate K AMF .

[0054] Specifically, on the network side, the unified data manager (UDM) stores the same root key K as the UE side, and generates CK and IK based on K. When the authentication method is 5GAKA, UDM generates K based on CK, IK and SN name. AUSF , and K AUSF Sent to the authentication server function (AUSF); when the authentication method is EAP AKA', UDM generates CK', IK' according to CK, IK and SN name, and sends CK', IK' to AUSF, AUSF generates K according to CK', IK' and SUPI AUSF .

[0055] AUSF receives or generates K AUSF And SN name generates anchor key K SEAF , and after the main authentication process is successful, K SEAFSent to the security anchor function (SEAF) / access and mobility management function (AMF); SEAF / AMF receives K SEAF Then according to K SEAF , SUPI and ABBA generate K AMF .

[0056] From the above, it can be seen that under the EAP AKA' authentication method, CK and IK need to be further generated based on the key derivation function to derive CK' and IK' and then derive K AUSF This undoubtedly increases the complexity of the authentication process, resulting in poor key generation efficiency and flexibility, and the derived K AUSF The security is also low. Moreover, with the development of quantum technology and the promotion of network security needs, the existing key derivation system faces the problem of K derived from CK and IK. AUSF The security risk is upgraded. For example, under quantum attacks, the main way for symmetric algorithms to deal with it is to increase the key length. In the 3GPP standard, the key length of 256 bits is being promoted, but there are still many details to be discussed. In the future, 256 bits or even longer key lengths will be the main means to deal with quantum attacks. For this reason, the existing CK and IK methods for further deriving keys need to be further strengthened. At the same time, in the face of the expansion of the network system, it is also necessary to take into account the lightweight transformation. Lightweight is an important transitional means to deal with future quantum attacks.

[0057] With the continuous development of mobile communication networks and security technologies, the importance of security has become more prominent. Operators need to rely on their own natural resource advantages and industry attributes to accelerate the deep integration and innovation of mobile communication networks and new security technologies. Quantum and anti-quantum technologies are developing more rapidly in the context of the new era. Faced with the expansion of network resources and data resources, it is necessary to accelerate the iterative upgrade of security technologies. However, in the face of the "one hair moves the whole body" of the network, it is necessary to handle it with caution, seek lightweight transformation, and gradually expand the area according to the degree of importance, with points as the center, extract successful experiences, and make a smooth transition.

[0058] In view of this, the present application provides a key generation method, which generates an authentication service function key based on at least two random numbers by introducing at least two random numbers in the authentication service process, and enhances the security of the authentication service function key generation compared to the authentication service function key generated based on the same random number in the related art. At the same time, while meeting the requirements of the existing key derivation system, at least two random numbers are introduced, the key generation method in the existing process is optimized, and the requirements for key derivation in different authentication modes (such as AKA mode and EAP-AKA' mode) are met.

[0059] The key generation method provided in the embodiment of the present application can be applied to systems of various communication formats. For example, the key generation method provided in the embodiment of the present application can be applied to systems including, but not limited to, LTE systems, various versions based on LTE evolution, 5G systems, ambient internet of things (Ambient IoT) and other communication systems. In addition, the key generation method provided in the embodiment of the present application can also be applied to future-oriented communication systems (such as 6G communication systems), etc.

[0060] Take the 5G system as an example. Specifically, new communication scenarios are defined in the 5G system: ultra-reliable and low-latency communication (URLLC), enhanced mobile broadband (eMBB) and massive machine type communication (mMTC). These communication scenarios have more stringent requirements for communication security. Therefore, before the terminal and the core network transmit data, authentication and authorization, as the most basic security prevention technology, are particularly important in the 5G communication process. The terminal and the core network authenticate each other through the AKA process and negotiate the security context that can be used in the subsequent security process. The security context includes security parameters for authentication, integrity protection and encryption.

[0061] Figure 2A possible network architecture diagram applicable to the embodiment of the present application, the network architecture is composed of UE, radio access network (RAN) and operator network, the operator network includes core network (CN) and data network (DN), and UE accesses the operator network through RAN. CN, as a bearer network, provides an interface to DN, provides communication connection, authentication, management, policy control and data service bearing for UE. Among them, CN includes: AMF, SEAF, session management function (SMF), user plane function (UPF), AUSF, UDM, network exposure function (NEF), application function (AF), network slice selection function (NSSF), policy control function (PCF), network function repository function (NRF), etc.

[0062] Figure 2 In the figure, N1, N2, N3, N4 and N6 are interfaces between corresponding network elements; Namf, Nsmf, Nausf, Nudm, Nnef, Npcf, Naf, Nnssf and Nnrf are service interfaces presented by AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF and NRF respectively.

[0063] Figure 3 The above network architecture diagram shows the main network elements and their connection relationships involved in the embodiment of the present application, including UE, AMF, AUSF and UDM.

[0064] The specific description is as follows: UE is a logical entity. Specifically, UE can be a device with wireless transceiver function. UE can be a passive device, terminal equipment, communication device, Internet of Things (IoT) device, ambient IoT device, mobile phone, tablet computer, computer with wireless transceiver function, virtual reality (VR) terminal, augmented reality (AR) terminal, wireless terminal in industrial control, wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, etc. The embodiments of the present application do not limit the application scenarios. UE may also be sometimes referred to as terminal equipment, user, terminal, access terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal, mobile device, UE terminal, key generation device, mobile terminal (mobile terminal, MT), UE agent or UE device, etc., which is not limited in the embodiments of the present application. The communication device may be a server, a gateway (gateway, GW), a controller, etc. The IoT device may be a sensor, an electric meter, a water meter, etc. The UE communicates with the AMF via the N1 interface. This is not limited in the embodiments of the present application.

[0065] Among them, a quantum random number chip can be built into the terminal side, which can be used to generate 128-bit quantum random numbers.

[0066] AMF is responsible for the access management and mobility management of the terminal, such as registration management, connection management, mobility management, reachability management, etc. In practical applications, it includes the mobility management function in the mobility management entity (MME) in the network framework of the long term evolution system (LTE), and adds the access management function. In addition, SEAF provides the main authentication service. In the current standard definition, SEAF and AMF are set together. Namf is the service interface provided by AMF.

[0067] UDM is a control plane network element provided by the operator. It is responsible for generating authentication parameters and storing the operator's network Subscriber Permanent Identity (SUPI), registration information, credentials, contract data, etc. Nudm is a service-oriented interface provided by UDM. In addition, the authentication credential repository and processing function (ARPF) is located in UDM and is used to generate authentication parameters.

[0068] Among them, UDM / ARPF can have a built-in quantum random number chip or an external quantum random number generation chip or device, which can be used to generate 128-bit quantum random numbers. At present, quantum random number generator products are ready. The application of quantum random numbers lays a solid foundation for facing future quantum attacks or resisting quantum migration, and also accelerates the evolution of mobile communication networks 5G-A or 6G networks and quantum integration.

[0069] It is understandable that the purpose of built-in or external quantum random number generators, whether chips or external devices, is to generate quantum random numbers, replace existing random number generators, and improve the security of random numbers. To this end, a quantum random number generation chip or device is built-in or external on the core network side, and a quantum random number chip is built-in on the terminal side to achieve 128-bit quantum random number generation. According to existing standards, the final signaling sent by the terminal to the core network contains random numbers. A series storage mode of two quantum random numbers can be formed on the terminal side and the core network side, which can be used on demand. The series connection of random numbers also lays the foundation for the increase in key length in subsequent 5G and evolution networks. It is a lightweight method that meets the needs of existing networks.

[0070] AUSF is a control plane network element provided by the operator, which can be used for the operator network to authenticate the network subscribers. Nausf is the service-oriented interface provided by AUSF.

[0071] SEAF / AMF and AUSF may be located in the same network, for example, SEAF / AMF and AUSF are both located in the home public land mobile network (HPLMN), referred to as the home network; SEAF / AMF and AUSF may also be located in different networks, for example, SEAF / AMF is located in the visited public land mobile network (VPLMN), referred to as the visited network, and AUSF is located in the home network. If the UE is outside the coverage of the home network, it cannot directly access the home network to obtain services. At this time, if the UE is within the coverage of the visited network, the UE needs to access the visited network in order to obtain network services provided by the visited network and the home network;

[0072] The UE sends a registration request to SEAF / AMF through a non-access stratum (NAS) message. SEAF / AMF decides to initiate authentication and sends an authentication request carrying a user permanent identifier SUPI or a user hidden identifier (subscription concealed identifier, SUCI) and a serving network name (SN name) to AUSF. The serving network name consists of a service code and a serving network identifier SNId. For example, the service code can be a character string 5G, 6G or 7G, which is not limited here. AUSF checks whether the serving network name in the authentication request matches the expected service network name. If the verification is successful, an authentication vector acquisition request is sent to UDM. After receiving the request, UDM selects an authentication method and generates an authentication vector (AV), where the authentication method can be EAP AKA' or 5GAKA.

[0073] The RAN of the embodiment of the present application may include various forms of base stations, macro base stations, micro base stations (also called small stations), relay stations, access points, new radio controllers (new radio controllers, NR controllers), centralized network elements (centralized units), radio frequency remote modules, distributed network elements (distributed units), transmission reception points (transmission reception points, TRP) or transmission points (transmission points, TP), or any other wireless access devices, but the embodiments of the present application are not limited thereto. Among them, in systems using different wireless access technologies, the name of the RAN may be different. For example, the RAN can be a next generation base station (next generation NodeB, gNB) in a 5G mobile communication system or a base station in a future mobile communication system. The embodiments of the present application do not limit the specific technology and specific equipment form adopted by the wireless access network.

[0074] In some embodiments, a base station (BS) may be a base station or an evolutionary base station (eNB or eNodeB) in long term evolution (LTE), long term evolution advanced (LTEA), a base station device in a 5G network, or a base station in a future communication system, etc. The base station may include various macro base stations, micro base stations, home base stations, wireless remotes, reconfigurable intelligent surfaces (RISs), routers, relays, TRPs, wireless fidelity (WIFI) devices, user equipment (UE), and other network side devices. The embodiments of the present application are not limited to this.

[0075] It should be noted that Figure 2 or Figure 3 This is just an exemplary framework diagram. Figure 2 or Figure 3 The number of units included in the Figure 2 or Figure 3 In addition to the units shown, the radio access network may also include other units.

[0076] The application scenarios of the embodiments of the present application are not limited. The system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0077] This application embodiment provides a key generation method. Figure 4 As shown, the method comprises the following steps:

[0078] S101. Generate an authentication service function key based on at least two random numbers.

[0079] Among them, the authentication service function key is a key component used to achieve mutual authentication between the terminal side and the network side. In modern and future mobile communication networks, authentication and key negotiation are important links to ensure communication security.

[0080] In some embodiments, generating an authentication service function key based on at least two random numbers includes:

[0081] Generate a first encryption key and a first integrity key based on at least two random numbers, the first encryption key is an encryption key generated based on a portion of the at least two random numbers, and the first integrity key is an integrity key generated based on another portion of the at least two random numbers;

[0082] An authentication service function key is generated based on the first encryption key and the first integrity key.

[0083] Among them, the encryption key is used to encrypt user data, and the integrity key is used to protect the integrity of user data.

[0084] In this way, the security of key derivation in different modes is enhanced by generating a key based on the cross-concatenation of at least two quantum random numbers as a key derivation parameter.

[0085] It is understandable that the generation parameters of the encryption key and the integrity key may also include other parameters besides the random number, such as the root key, which is not limited in this application. The length of the root key K may be 128 bits or 256 bits.

[0086] In some embodiments, the random numbers in the present application are quantum random numbers.

[0087] In this way, quantum random numbers are introduced to replace the existing random number generation method and enhance the security of random numbers. Among them, random numbers occupy an important position in 5G networks and evolving networks. The integration of mobile networks and quantum technology is an important technical direction for enhancing network security in the future. For this reason, quantum technology is introduced in random number generation to enhance the security of random numbers.

[0088] For example, Figure 5 As shown, taking the case where the network side generates an encryption key and an integrity key based on one of at least two quantum random numbers as an example, the function involved in the key derivation is a MILENAGE function, which includes functions f1-f5, and some of the variables involved include:

[0089] K: 128-bit user key (root key), which is the core input of f1-f5 functions.

[0090] AK: A 48-bit anonymity key.

[0091] AMF: Authentication Management Field, a 16-bit authentication management field containing information about the authentication algorithm and sequence number.

[0092] c1, c2, c3, c4, c5: 128-bit constants that are XORed with the intermediate variable.

[0093] CK: A 128-bit encryption key based on the output of function f3.

[0094] IK: A 128-bit integrity key based on the output of function f4.

[0095] RAND: A 128-bit quantum random number.

[0096] SQN: 48-bit serial number.

[0097] Among them, RAND, AMF, SQN and K generate message authentication codes (MAC) based on f1. RAND and K jointly generate expected user authentication response (XRES) based on f2. RAND and K generate CK based on f3. RAND and K generate IK based on f4. RAND and K generate AK based on f5.

[0098] For example, Figure 6 As shown, taking the example of the terminal side generating an encryption key and an integrity key based on one of at least two quantum random numbers, the function involved in the key derivation is MILENAGE, which includes functions f1-f5, and some variables involved include:

[0099] K: 128-bit user key (root key), which is the core input of f1-f5 functions.

[0100] AK: A 48-bit anonymity key.

[0101] AMF: Authentication Management Field, a 16-bit authentication management field containing information about the authentication algorithm and sequence number.

[0102] c1, c2, c3, c4, c5: 128-bit constants that are XORed with the intermediate variable.

[0103] CK: A 128-bit encryption key based on the output of function f3.

[0104] IK: A 128-bit integrity key based on the output of function f4.

[0105] RAND: A 128-bit quantum random number.

[0106] SQN: 48-bit serial number.

[0107] Among them, RAND and K jointly generate AK based on f5. SQN⊕AK, K, RAND and AMF jointly generate the expected message authentication code (XMAC) based on f1. RAND and K jointly generate the user authentication response (RES) based on f2. RAND and K jointly generate CK based on f3. RAND and K jointly generate IK based on f4.

[0108] It is understandable that the generation of 128-bit quantum random numbers can be achieved by building in or plugging in a quantum random number generation chip or device on the core network side and building in a quantum random number chip on the terminal side. According to relevant standards, the final signaling sent by the terminal to the core network contains a random number, and a series storage mode of two quantum random numbers can be formed on the terminal side and the core network side, which can be used on demand. The series connection of random numbers also lays the foundation for the increase in key length in subsequent 5G and evolution networks. It is a lightweight method that meets the needs of existing networks.

[0109] In some embodiments, generating a first encryption key and a first integrity key based on at least two random numbers includes:

[0110] generating a second encryption key and a second integrity key based on the at least two random numbers, the second encryption key comprising an encryption key generated based on each of the at least two random numbers, the second integrity key comprising an integrity key generated based on each of the at least two random numbers;

[0111] The first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key.

[0112] In this way, without the need to upgrade or lighten the network, the second encryption key includes an encryption key generated based on each of at least two random numbers, and the second integrity key includes an integrity key generated based on each of at least two random numbers, which can meet the generation of longer key lengths for CK and IK, and thus meet the needs of the network as needed.

[0113] In some embodiments, the first encryption key and the first integrity key are both 128 bits.

[0114] In some embodiments, the second encryption key and the second integrity key are both 256 bits.

[0115] Exemplarily, two random numbers are taken as an example below, and the two random numbers are recorded as a first random number and a second random number. The encryption key generated based on the first random number is recorded as CK1 (128 bits), and the integrity key generated based on the first random number is recorded as IK1 (128 bits); the encryption key generated based on the second random number is recorded as CK2 (128 bits), and the integrity key generated based on the second random number is recorded as IK2 (128 bits).

[0116] CK1 and CK2 are connected in series to form CK1||CK2 (256 bits) and stored, and IK2 and IK1 are connected in series to form IK1||IK2 (256 bits) and stored.

[0117] In this way, without modification or light modification, under the condition of meeting the requirements of the existing key derivation system, two random numbers are introduced to realize the generation of two pairs of CK and IK (i.e. CK1, IK1, CK2, IK2). The so-called light modification is such as increasing the storage capacity of one CK and IK, so that the generation of two pairs of CK and IK can be realized by using two random number generation.

[0118] Specifically, this example can form a key length of 256 bits each through the series connection of two CKs and two IKs, laying a foundation for the subsequent increase in key length in 5G networks and evolved networks, and realizing elastic expansion (that is, CK1 and CK2 can be connected in series to form CK1||CK2 with a length of 256 bits, which is recorded as a 256-bit CK and stored, and IK1 and IK2 can be connected in series to form IK1||IK2 with a length of 256 bits, which is recorded as a 256-bit IK and stored). The advantage of this is that there is no need to modify existing network equipment, and a smooth transition from 128 bits to 256 bits for CK and IK can be achieved, providing a good technical reference for lightweight transformation. In addition, when CK and IK are 256 bits, the series connection of CK and IK forms 512 bits, which provides guidance for further enhancing key security. Of course, the 512-bit method needs to consider other factors, such as storage, equipment upgrades, protocol transformation, etc.

[0119] For example, Figure 7 Provides a key derivation process. Figure 7 As shown, taking the network side as an example, two quantum random numbers are first generated, namely quantum random number 1 (denoted as RAND1) and quantum random number 2 (denoted as RAND2).

[0120] UDM / ARPF saves the same root key K as the terminal side; UDM / ARPF generates 128-bit CK1 and 128-bit IK1 based on K and RAND1, and generates 128-bit CK2 and 128-bit IK2 based on K and RAND2.

[0121] Optionally, the network side may concatenate CK1 and CK2 to obtain a first encryption key (denoted as CK1||CK2), and the network side may concatenate IK1 and IK2 to obtain a first integrity key (denoted as IK1||IK2); then the first 128 bits of the first encryption key, i.e. CK1, and the last 128 bits of the first integrity key, i.e. IK2, may be selected and concatenated to form a new combined parameter 1 (which may be denoted as CK1||IK2) as the authentication service function key (denoted as K in the AKA mode). AUSF1 Similarly, the last 128 bits of the first encryption key, i.e., CK2, and the first 128 bits of the first integrity key, i.e., IK1, can be selected in series to form a new combined parameter 2 (denoted as CK2||IK1) as the authentication service function key (denoted as K in the EAP AKA' mode). AUSF2 ) generation parameters.

[0122] Optionally, the UDM / ARPF on the network side concatenates the 128-bit CK1 and the 128-bit IK2 into a 256-bit combined parameter (denoted as CK1||IK2) as the authentication service function key in the AKA mode (denoted as K AUSF1 ) generation parameters. The UDM / ARPF on the network side concatenates the 128-bit CK2 and the 128-bit IK1 into a 256-bit combination parameter (denoted as CK2||IK1) as the authentication service function key (denoted as K in the EAPAKA' mode) AUSF1 ) generation parameters.

[0123] In AKA mode, UDM / ARPF generates K based on CK1||IK2 AUSF1 Alternatively, UDM / ARPF can send CK1||IK2 to AUSF, and AUSF generates K based on CK1||IK2. AUSF1 .

[0124] In EAP AKA' mode, UDM / ARPF generates K based on CK2||IK1 AUSF2 Alternatively, UDM / ARPF can send CK2||IK1 to AUSF, and AUSF generates K based on CK2||IK1. AUSF2 .

[0125] Continue to refer Figure 7 As shown, taking the terminal side as an example, two quantum random numbers are first generated, namely quantum random number 1 (denoted as RAND1) and quantum random number 2 (denoted as RAND2).

[0126] The terminal side stores the same root key K as the network side; the terminal side (eg, universal subscriber identity module (USIM)) generates 128-bit CK1 and 128-bit IK1 based on K and RAND1, and generates 128-bit CK2 and 128-bit IK2 based on K and RAND2.

[0127] Optionally, the terminal side may concatenate CK1 and CK2 to obtain a second encryption key (denoted as CK1||CK2), and the terminal side may concatenate IK1 and IK2 to obtain a second integrity key (denoted as IK1||IK2); then the first 128 bits of the second encryption key, i.e. CK1, and the last 128 bits of the second integrity key, i.e. IK2, may be selected and concatenated to form a new combined parameter 1 (which may be denoted as CK1||IK2) as the authentication service function key (denoted as K in the AKA mode). AUSF1Similarly, the last 128 bits of the first encryption key, i.e., CK2, can be selected and concatenated with the first 128 bits of the first integrity key, i.e., IK1, to form a new combined parameter 2 (denoted as CK2||IK1) as the authentication service function key (denoted as K in the EAP AKA' mode). AUSF2 ) generation parameters.

[0128] Optionally, the terminal concatenates 128-bit CK1 and 128-bit IK2 into a 256-bit combined parameter (denoted as CK1||IK2) as the authentication service function key in AKA mode (denoted as K AUSF1 The terminal side concatenates 128-bit CK2 and 128-bit IK1 into a 256-bit combined parameter (recorded as CK2||IK1) as the authentication service function key (recorded as K in EAP AKA' mode). AUSF2 ) generation parameters.

[0129] In AKA mode, the terminal side (e.g., mobile equipment (ME)) generates K in AKA mode based on CK1||IK2. AUSF1 .

[0130] In EAP AKA' mode, the terminal side (such as ME) generates K in EAP AKA' mode based on CK2||IK1 AUSF2 .

[0131] K in the example AUSF1 and K AUSF2 The length of each can be 256 bits.

[0132] In this example, the derivation algorithm involved in the generation of the authentication service function key is KDF(Key, S), where Key is CK1||IK2 (or CK2||IK1). The KDF function is a key derivation function, such as a hash function. S is a parameter, for example, S can include multiple sub-parameters in different derivation scenarios, such as FC, P0, L0, P1, L1.

[0133] based on Figure 7 It can be clearly seen that compared with the background technology, in the EAP AKA' authentication mode, CK and IK need to be derived based on the key derivation function to generate CK' and IK' and then derive K AUSFBased on the introduction of two quantum random numbers, the present application can generate two pairs of CK and IK by the terminal or the network side, which can simultaneously meet the requirements of both AKA and EAP-AKA' authentication modes for key derivation, optimize the key derivation method under the EAP-AKA' mode, and reduce the complexity of the process under the EAP-AKA' authentication mode. In addition, the technical solution provided by the present application improves the efficiency and flexibility of key generation, and the security of the derived authentication service function key is also improved.

[0134] It is understandable that, in the case where the authentication service function key is generated based on N random numbers, and N is an integer greater than 2, the N random numbers can be synthesized by some calculation methods to obtain two quantum random numbers, and then the generation of the authentication service function key is realized by referring to the method described in the above embodiment or example, which will not be repeated here. Exemplarily, the adjacent random numbers among the N random numbers are synthesized to obtain two quantum random numbers. For example, there are 4 quantum random numbers, R1, R2, R3 and R4, where R1 and R2 are adjacent, R3 and R4 are adjacent, R1 and R2 are weighted summed, or other calculation methods are used to synthesize a random number, and R3 and R42 are weighted summed, or other calculation methods are used to synthesize another random number. Among them, the adjacent random numbers here can refer to random numbers generated adjacently, or random numbers that are judged to have an adjacent relationship by some preset rules.

[0135] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the method. A key generation device is also shown below for executing the key generation method in any of the above embodiments and possible implementations thereof. It can be understood that, in order to implement the key generation method, the key generation device includes a hardware structure and / or software module corresponding to each function; those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiment of the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0136] The embodiment of the present application can divide the key generation device into functional modules according to the above method embodiment. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one functional module. The above integrated module can be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0137] Figure 8 The key generation device 80 provided in the embodiment of the present application includes: a processing module 81 and an acquisition module 82 .

[0138] A processing module is used to generate an authentication service function key based on at least two random numbers.

[0139] In some embodiments, the authentication service function key includes at least one of the following: an authentication service function key in an authentication and key agreement AKA mode, and an authentication service function key in an extensible authentication protocol EAP AKA' mode.

[0140] In some embodiments, the processing module 81 is specifically configured to:

[0141] Generate a first encryption key and a first integrity key based on at least two random numbers, the first encryption key is an encryption key generated based on a portion of the at least two random numbers, and the first integrity key is an integrity key generated based on another portion of the at least two random numbers;

[0142] An authentication service function key is generated based on the first encryption key and the first integrity key.

[0143] In some embodiments, the processing module 81 is configured to generate a second encryption key and a second integrity key based on at least two random numbers, the second encryption key comprising an encryption key generated based on each of the at least two random numbers, and the second integrity key comprising an integrity key generated based on each of the at least two random numbers;

[0144] The acquisition module 82 is configured to acquire the first encryption key from the second encryption key, and acquire the first integrity key from the second integrity key.

[0145] In some embodiments, the first encryption key and the first integrity key are both 128 bits.

[0146] In some embodiments, the second encryption key and the second integrity key are both 256 bits.

[0147] In some embodiments, the random numbers are quantum random numbers.

[0148] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present application also provides a possible structure of a communication device, which is used to execute the key generation method provided by the embodiment of the present application. Fig. 9 As shown, the communication device 900 includes: a communication interface 903, a processor 902 and a bus 904. Optionally, the communication device may further include a memory 901.

[0149] The processor 902 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 902 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0150] The communication interface 903 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0151] The memory 901 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0152] As a possible implementation, the memory 901 may exist independently of the processor 902, and the memory 901 may be connected to the processor 902 via a bus 904 for storing instructions or program codes. When the processor 902 calls and executes the instructions or program codes stored in the memory 901, the key generation method provided in the embodiment of the present application can be implemented.

[0153] In another possible implementation, the memory 901 may also be integrated with the processor 902 .

[0154] The bus 904 may be an extended industry standard architecture (EISA) bus, etc. The bus 904 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0155] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the key generation method described in any of the above embodiments.

[0156] In an exemplary embodiment, the computer may be the key generating device described above, and the present application does not limit the specific form of the computer.

[0157] In some examples, the computer-readable storage media described above may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks, or key drives, etc.). The various computer-readable storage media described herein may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0158] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the key generation method described in any of the above embodiments.

[0159] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A key generation method, characterized in that: The method comprises: An authentication service function key is generated based on at least two random numbers.

2. The method according to claim 1, characterized in that The authentication service function key includes at least one of the following: an authentication service function key in an authentication and key agreement AKA mode, and an authentication service function key in an extensible authentication protocol EAP AKA' mode.

3. The method according to claim 1, characterized in that The step of generating an authentication service function key based on at least two random numbers comprises: Generate a first encryption key and a first integrity key based on the at least two random numbers, wherein the first encryption key is an encryption key generated based on a portion of the at least two random numbers, and the first integrity key is an integrity key generated based on another portion of the at least two random numbers; An authentication service function key is generated based on the first encryption key and the first integrity key.

4. The method according to claim 3, characterized in that The generating a first encryption key and a first integrity key based on the at least two random numbers comprises: generating a second encryption key and a second integrity key based on the at least two random numbers, the second encryption key comprising an encryption key generated based on each of the at least two random numbers, the second integrity key comprising an integrity key generated based on each of the at least two random numbers; The first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key.

5. The method according to claim 3, characterized in that: The first encryption key and the first integrity key are both 128 bits.

6. The method according to claim 4, characterized in that The second encryption key and the second integrity key are both 256 bits.

7. The method according to claim 1, characterized in that The random number is a quantum random number.

8. A key generation device, characterized in that: The device comprises: A processing module is used to generate an authentication service function key based on at least two random numbers.

9. A communication device, characterized in that: include: Memory and processor; Memory and processor coupling; The memory is used to store instructions executable by the processor; When the processor executes the instructions, the method according to any one of claims 1 to 7 is performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a communication device, the communication device is caused to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that When the computer program product is executed, the method according to any one of claims 1 to 7 is implemented.

Images