Key generation method and apparatus, and storage medium and program product

Abstract

A key generation method and apparatus, and a storage medium and a program product. The method comprises: generating an authentication server function key on the basis of at least two random numbers.

Description

Key generation method and device, storage medium and program product

[0001] This application claims priority to Chinese Patent Application No. 202411365258.1, filed on September 27, 2024, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of communication, and in particular to a key generation method, device, storage medium and program product. BACKGROUND

[0003] With the evolution of the 5th-generation mobile communication technology (5G) network and the rapid development of quantum technology, the security requirements of mobile communication networks are constantly upgraded, and the security of keys in the network is of great concern. As the core gene for maintaining network and information security, the most important thing is the security of the key, and the security of a key directly determines the security level of the system. SUMMARY

[0004] In a first aspect, a key generation method is provided, which includes generating an authentication service function key based on at least two random numbers.

[0005] As an implementation manner, the authentication service function key includes at least one of the following: an authentication service function key in an authentication and key agreement (AKA) mode, and an authentication service function key in an extensible authentication protocol (EAP) AKA' mode.

[0006] As an implementation manner, the first encryption key is generated based on a part of the at least two random numbers, and the first integrity key is generated based on another part of the at least two random numbers.

[0007] The authentication service function key is generated based on the first encryption key and the first integrity key.

[0008] As an implementation manner, the second encryption key is generated based on the at least two random numbers, and the second integrity key is generated based on the at least two random numbers.

[0009] The first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key.

[0010] As an implementation, the second encryption key and the second integrity key are generated based on at least two random numbers, comprising:

[0011] The encryption keys generated by each of the at least two random numbers are concatenated in sequence to form the second encryption key; and

[0012] The integrity keys generated by each of the at least two random numbers are concatenated in sequence to form the second integrity key.

[0013] As an implementation, the first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key, comprising:

[0014] The first encryption key is selected from the front half of the second encryption key, and the first integrity key is selected from the back half of the second integrity key; or,

[0015] The first encryption key is selected from the back half of the second encryption key, and the first integrity key is selected from the front half of the second integrity key.

[0016] As an implementation, the first encryption key and the first integrity key are concatenated to generate an authentication service function key.

[0017] As an implementation, the first encryption key and the first integrity key are both 128 bits.

[0018] As an implementation, the second encryption key and the second integrity key are both 256 bits.

[0019] As an implementation, each of the at least two random numbers is a quantum random number.

[0020] As an implementation, the at least two random numbers are stored in series.

[0021] In a second aspect, a key generation apparatus is provided, comprising:

[0022] A processing component configured to generate an authentication service function key based on at least two random numbers.

[0023] As an implementation, the authentication service function key comprises at least one of the following: an authentication service function key in an authentication and key agreement (AKA) mode, and an authentication service function key in an extensible authentication protocol (EAP) AKA' mode.

[0024] As an implementation, the processing component is configured to:

[0025] generate a first encryption key and a first integrity key based on the at least two random numbers, the first encryption key being an encryption key generated based on a part of the at least two random numbers, the first integrity key being an integrity key generated based on another part of the at least two random numbers;

[0026] generate an authentication service function key based on the first encryption key and the first integrity key.

[0027] As an implementation form, the processing component is configured to generate a second encryption key and a second integrity key based on the at least two random numbers, the second encryption key including an encryption key generated based on each of the at least two random numbers, the second integrity key including an integrity key generated based on each of the at least two random numbers;

[0028] The obtaining component is configured to obtain the first encryption key from the second encryption key and the first integrity key from the second integrity key.

[0029] As an implementation form, the first encryption key and the first integrity key are both 128 bits.

[0030] As an implementation form, the second encryption key and the second integrity key are both 256 bits.

[0031] As an implementation form, the random number is a quantum random number.

[0032] In a third aspect, a communication apparatus is provided, which includes a memory and a processor; the memory and the processor are coupled; the memory is configured to store computer program instructions executable by the processor; and the processor implements the key generation method of any of the above embodiments when executing the computer program instructions.

[0033] In a fourth aspect, a computer readable storage medium is provided, which stores computer program instructions; and the computer program instructions, when executed on a computer (for example, the communication apparatus or the key generation apparatus), implement the key generation method of any of the above embodiments.

[0034] In a fifth aspect, a computer program product is provided, which includes computer program instructions; and the computer program instructions, when executed, implement the key generation method of any of the above embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0035] FIG. 1 is a flowchart of key derivation in a related art according to some embodiments of the present disclosure;

[0036] FIG. 2 is a schematic diagram of a network architecture according to some embodiments of the present disclosure;

[0037] FIG. 3 is a schematic diagram of another network architecture according to some embodiments of the present disclosure;

[0038] FIG. 4 is a flowchart of a key generation method according to some embodiments of the present disclosure;

[0039] FIG. 5 is a schematic diagram of a network-side key generation architecture according to some embodiments of the present disclosure;

[0040] FIG. 6 is a schematic diagram of a terminal-side key generation architecture according to some embodiments of the present disclosure;

[0041] FIG. 7 is a flowchart of a key derivation according to some embodiments of the present disclosure;

[0042] FIG. 8 is a schematic diagram of a structure of a key generation apparatus according to some embodiments of the present disclosure;

[0043] FIG. 9 is a schematic diagram of a structure of a communication apparatus according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some of the embodiments of the present disclosure, but not all of the embodiments of the present disclosure. Based on the embodiments in the present disclosure, any other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of the present disclosure.

[0045] In the description of the present disclosure, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this document is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can mean that A exists alone, A and B exist together, and B exists alone. In addition, "at least one" means one or more, and "multiple" means two or more. "First", "second", and the like do not limit the quantity and execution order, and "first", "second", and the like do not necessarily mean different.

[0046] It should be noted that in the present disclosure, "exemplary" or "for example" is used to mean an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the present disclosure should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, "exemplary" or "for example" is used to present the relevant concept in a specific manner.

[0047] With the evolution of 5G networks and networks, the rapid development of quantum technology, constantly giving rise to the upgrading of the security needs of mobile communication networks, especially the security of the key in the network is of great concern. As the core gene of maintaining network and information security, the most important thing is the security of the key, and the security of a key directly determines the security level of the system. Therefore, enhancing the security of the key has become a problem to be solved.

[0048] Currently, in the face of quantum attacks, the main measure of symmetric algorithms in the related technical cryptographic system is to increase the length of the key, and the main countermeasure of asymmetric algorithms is to use or integrate quantum-resistant algorithms to resist attacks. In the current standard system, how to enhance the security of the key without modification or light-weight modification has aroused the thinking of the industry, and seeking a high-security, light-weight, flexible and efficient way is the main direction of research. Integrating quantum technology and gradually migrating to quantum resistance is an important technical direction for mobile communication and evolved networks. How to select the core key system in the bloated network system as the primary direction is an important direction for industry experts to focus on. The concepts of endogenous security, zero trust, and trust have been proposed, and the boundaries and depth of security in the mobile communication field have been further deepened. Integration and development are the way out, therefore, exploring the deep integration and innovation of mobile communication networks, cryptography, and cutting-edge technologies is the mainstream direction of 5G and future mobile communication network development, realizing the self-growth of security and the self-reliance of trust.

[0049] 5G network as a key infrastructure, the security of the core network is the most important, and the application of cryptography in the core network is the focus of research and the difficulty of core technology research. Many industry experts and scholars have thought about and explored the application of cryptography in mobile communication networks and have put forward some unique insights, but the core is around the current standard system, without fine-grained thinking and perfecting the process in the standard, light-weight modification, that is, the current research has the problem of coarse granularity.

[0050] In the series of standards of the 3rd generation partnership project (3rd generation partnership project, 3GPP), the key derivation of 5G network has a complete derivation system, involving terminals and core network elements. The root key is K value, which is long-term stored in the core network element. According to the key derivation system, the key derivation function and related parameters are involved to complete the key derivation of the entire system.

[0051] FIG. 1 is a flowchart of a key derivation procedure in the related art according to some embodiments of the present disclosure. As shown in FIG. 1, the 5G primary authentication procedure is divided into two parts, 5G authentication and key agreement (AKA) and extensible authentication protocol authentication and key agreement prime (EAP AKA’).

[0052] For example, for the user equipment (UE) side, the UE saves the same root key K as the network side. When the authentication mode is 5G AKA authentication, the UE generates a cipher key (CK) and an integrity key (IK) according to K; generates a key for an authentication service function (Kaf) according to CK, IK, and a serving network name (SN name), etc.; generates an anchor key (Kanc) according to K and the SN name; and generates a lower layer key (Klwl) according to K, a subscription permanent identifier (SUPI), and an anti-bidding down between architectures (ABBA). AUSF ) according to K AUSF and the SN name. When the authentication mode is EAP AKA’, the UE generates CK and IK according to K; generates CK’ and IK’ according to CK, IK, and the SN name, etc.; generates Kanc according to CK’, IK’, and the SUPI; and generates Klwl according to K, the SUPI, and the ABBA. SEAF ) according to K SEAF and the SN name. When the authentication mode is EAP AKA’, the UE generates CK and IK according to K; generates CK’ and IK’ according to CK, IK, and the SN name, etc.; generates Kanc according to CK’, IK’, and the SUPI; and generates Klwl according to K, the SUPI, and the ABBA. AMF AUSF AUSF SEAF SEAF AMF

[0053] For example, for the network side, a unified data manager (UDM) saves the same root key K as the UE side, and generates CK and IK according to K. When the authentication mode is 5G AKA, the UDM generates K according to CK, IK, and the SN name, etc., and sends K AUSF to an access and mobility management function (AMF). When the authentication mode is EAP AKA’, the UDM generates Kanc according to CK, IK, and the SN name, etc., and sends K AUSF ​​​​​​to the authentication server function (AUSF); when the authentication mode is EAP AKA', the UDM generates CK', IK' according to CK, IK and SN name, and sends CK', IK' to the AUSF, and the AUSF generates K based on CK', IK' and SUPI AUSF .

[0054] The AUSF generates an anchor key K based on the received or self-generated K AUSF and SN name SEAF , and sends K SEAF to the security anchor function (SEAF) / access and mobility management function (AMF) after the main authentication process is successful; the SEAF / AMF receives K SEAF , and generates K SEAF based on K AMF .

[0055] As can be seen from the above, under the EAP AKA' authentication mode, CK and IK are further used to generate CK' and IK' based on a key derivation function, and then K AUSF is derived, which undoubtedly increases the complexity of the process under this authentication mode, resulting in poor key generation efficiency and flexibility, and the derived K AUSF has low security. Moreover, with the development of quantum technology and the demand for network security, the current key derivation system is facing the risk of security escalation of K AUSF derived from CK and IK with the development of future network technology. For example, under quantum attacks, the main way to cope with symmetric algorithms is to increase the key length. In the 3GPP standard, 256-bit key enhancement is being promoted, but many details need to be discussed. In the future, 256-bit or even longer key length is the main means to cope with quantum attacks. Therefore, the current way of further deriving keys from CK and IK needs to be further strengthened, and at the same time, in the face of bloated network systems, lightweight modification also needs to be considered. Lightweight is an important transitional means to cope with future quantum attacks.

[0056] With the continuous development of mobile communication network and security technology, the importance of security is more prominent. Operators need to rely on their natural resource advantages and industry attributes to accelerate the deep integration of mobile communication network and new security technology. Quantum and anti-quantum technologies are developing more rapidly in the context of the new era. In the face of huge network resources and data resources, it is urgent to accelerate the iteration and upgrading of security technology. However, in the face of the "pull a hair and the whole body moves" characteristics of the network, it is necessary to handle it carefully, seek lightweight transformation, and gradually expand the area according to the importance, extract successful experience, and smoothly transition.

[0057] Therefore, some embodiments of the present disclosure provide a key generation method. The method introduces at least two random numbers in the authentication service process, and generates an authentication service function key based on the at least two random numbers. Compared with the authentication service function key generated based on the same random number in the related art, the security of the authentication service function key generation is enhanced. In addition, under the condition of meeting the demand of the current key derivation system, the introduction of at least two random numbers optimizes the generation mode of the key in the current process, and meets the requirements of key derivation in different authentication modes (such as AKA mode and EAP-AKA' mode).

[0058] The key generation method provided by some embodiments of the present disclosure can be applied to systems of various communication systems. For example, the key generation method provided by some embodiments of the present disclosure can be applied to systems including but not limited to long term evolution (LTE) systems, various versions based on LTE evolution, 5G systems, ambient internet of things (Ambient IoT), and the like. In addition, the key generation method provided by some embodiments of the present disclosure can also be applied to future-oriented communication systems (such as 6th Generation Mobile Communication Technology (6G) systems) and the like.

[0059] Taking the 5G system as an example, new communication scenarios are defined in the 5G system: ultra-reliable and low-latency communication (URLLC), enhanced mobile broadband (eMBB) and massive machine type communication (mMTC), which have more stringent requirements for communication security. Therefore, before the terminal and the core network perform data transmission, authentication and authorization as the most basic security protection technology is particularly important in the 5G communication process. The terminal and the core network authenticate each other through the AKA process, and negotiate the security context that can be used in the subsequent security process, including security parameters for authentication, integrity protection and encryption.

[0060] FIG. 2 is a schematic diagram of a network architecture according to some embodiments of the present disclosure. The network architecture is composed of a UE, a radio access network (RAN) and an operator network, the operator network including a core network (CN) and a data network (DN), and the UE accesses the operator network through the RAN. The CN provides an interface to the DN as a bearer network, provides communication connection, authentication, management, policy control and completes bearer for data service for the UE. The CN includes: AMF, SEAF, session management function (SMF), user plane function (UPF), AUSF, UDM, network exposure function (NEF), application function (AF), network slice selection function (NSSF), policy control function (PCF), network function repository function (NRF) and the like.

[0061] In FIG. 2, N1, N2, N3, N4 and N6 are interfaces between corresponding network elements; Namf, Nsmf, Nausf, Nudm, Nnef, Npcf, Naf, Nnssf and Nnrf are service interfaces exposed by AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF and NRF respectively.

[0062] Figure 3 shows the main network elements and their connection relationship in the network architecture described above, including UE, AMF, AUSF, UDM, etc., which are involved in some embodiments of the present disclosure.

[0063] The UE is a logical entity. For example, the UE can be a device with wireless transceiver function. The UE can be a passive device, a terminal device, a communication device, an Internet of Things (IoT) device, an ambient IoT device, a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical system, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The present disclosure does not limit the application scenario. The UE can also be referred to as terminal device, user, terminal, access terminal, UE unit, UE station, mobile station, mobile station, remote station, remote terminal, mobile device, UE terminal, key generation device, mobile terminal (MT), UE agent or UE apparatus, etc. The present disclosure does not limit this. The communication device can be a server, a gateway (GW), a controller, etc. The IoT device can be a sensor, an electricity meter, a water meter, etc. The UE communicates with the AMF through the N1 interface. The present disclosure does not limit this.

[0064] A quantum random number chip can be built-in on the terminal side, which can be used to generate a quantum random number of 128 bits.

[0065] The AMF is responsible for access management and mobility management of the terminal, such as registration management, connection management, mobility management, and reachability management; in actual application, it includes the mobility management function in the mobility management entity (MME) in the network framework in the long term evolution (LTE) system, and adds the access management function. In addition, the SEAF provides a primary authentication service. In the current standard definition, the SEAF and the AMF are set together. Namf is a service interface provided by the AMF.

[0066] The UDM is a control plane network element provided by an operator, responsible for generating authentication parameters, storing subscription user permanent identifiers (SUPIs), registration information, credentials, subscription data, and the like of the operator network. Nudm is a service interface provided by the UDM. In addition, an authentication credential repository and processing function (ARPF) is located in the UDM, used for generating authentication parameters.

[0067] A quantum random number chip or an external quantum random number generation chip or device can be built-in in the UDM / ARPF, and the chip or device can be used to implement quantum random number 128-bit generation. The quantum random number generator product currently has the conditions, and the application of quantum random numbers lays a solid foundation for facing future quantum attacks or quantum migration resistance, and is also the acceleration of the evolution of the 5G-A or 6G network and quantum fusion of the mobile communication network.

[0068] It can be understood that the built-in or external quantum random number generator, whether it is a chip or an external device, is to generate quantum random numbers to replace the current random number generator and improve the security of the random number. Therefore, the quantum random number generation chip or device is built-in or external on the core network side, and the quantum random number chip is built-in on the terminal side to implement quantum random number 128-bit generation. According to the current standard, the signaling finally sent by the terminal to the core network contains a random number, and the terminal side and the core network side can form a series storage mode of two quantum random numbers, which is used on demand. The series of random numbers also lays a foundation for the increase of key length in the subsequent 5G and evolved network, belongs to a lightweight way, and meets the current network demand.

[0069] The AUSF is a control plane network element provided by an operator, which can be used for authentication of network subscription users of the operator network. Nausf is a service interface provided by the AUSF.

[0070] The SEAF / AMF and the AUSF can be located in the same network, for example, both the SEAF / AMF and the AUSF are located in a home public land mobile network (HPLMN), referred to as a home network. The SEAF / AMF and the AUSF can also be located in different networks, for example, the SEAF / AMF is located in a visited public land mobile network (VPLMN), referred to as a visited network, and the AUSF is located in the home network. If the UE is out of the coverage of the home network, the UE cannot directly access the home network to obtain services. At this time, if the UE is in the coverage of the visited network, in order for the UE to be able to obtain the network services provided by the visited network and the home network, the UE needs to access the visited network.

[0071] The UE sends a registration request to the SEAF / AMF through a non-access stratum (NAS) message, the SEAF / AMF decides to initiate authentication, and sends an authentication request carrying a user permanent identifier (SUPI) or a subscription concealed identifier (SUCI) and a service network name (SN name) to the AUSF. The service network name is composed of a service code and a serving network identifier (SN Id). For example, the service code can be a string 5G, 6G or 7G, which is not limited herein. The AUSF checks whether the service network name in the authentication request matches the expected service network name, and sends an authentication vector acquisition request to the UDM if the verification is successful. The UDM receives the request, selects an authentication method and generates an authentication vector (AV) after receiving the request. The authentication method can be EAP AKA' or 5G AKA.

[0072] The RAN of some embodiments of the present disclosure can include various forms of base stations, macro base stations, micro base stations (also known as small stations), relay stations, access points, new radio controllers (NR controllers), centralized units, radio frequency remote modules, distributed units, transmission reception points (TRPs) or transmission points (TPs), or any other wireless access devices, but the present disclosure is not limited thereto. It should be noted that the name of the RAN can be different in systems using different wireless access technologies. For example, the RAN can be a next generation base station (gNB) in a 5G mobile communication system or a base station in a future mobile communication system. The present disclosure does not limit the technology and device form of the radio access network.

[0073] In some embodiments, the base station (BS) can be a base station or evolved base station (eNB or eNodeB) in long term evolution (LTE) or long term evolution advanced (LTE-A), a base station device in a 5G network, or a base station in a future communication system, etc., which can include various macro base stations, micro base stations, home base stations, wireless remote modules, reconfigurable intelligent surfaces (RISs), routers, relays, TRPs, wireless fidelity (Wi-Fi) devices, user equipment (UE), and various network side devices. The present disclosure is not limited thereto.

[0074] It should be noted that FIG. 2 or FIG. 3 is only an exemplary block diagram, the number of units included in FIG. 2 or FIG. 3, and the name of each unit is not limited, and the radio access network can also include other units in addition to the units shown in FIG. 2 or FIG. 3.

[0075] The present disclosure is not limited to the application scenarios. The system architecture and business scenarios described in some embodiments of the present disclosure are to make the technical solutions of the embodiments of the present disclosure more clearly explained, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art can know that with the evolution of network architecture and the appearance of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0076] Some embodiments of the present disclosure provide a key generation method. As shown in FIG. 4, the method comprises the following steps:

[0077] S101, generating an authentication service function key based on at least two random numbers.

[0078] The authentication service function key is a key component for realizing mutual authentication between the terminal side and the network side. In modern and future mobile communication networks, authentication and key agreement is an important link to ensure communication security.

[0079] In some embodiments, the authentication service function key is generated based on at least two random numbers, comprising:

[0080] The first encryption key is an encryption key generated based on a part of the at least two random numbers, and the first integrity key is an integrity key generated based on another part of the at least two random numbers;

[0081] The authentication service function key is generated based on the first encryption key and the first integrity key.

[0082] The encryption key is used for encryption of user data, and the integrity key is used for protecting the integrity of user data.

[0083] In this way, by cross-cascading the generation of the key based on at least two quantum random numbers as the derivation parameter of the key, the security of key derivation in different modes is enhanced.

[0084] It can be understood that the generation parameters of the encryption key and the integrity key can also include other parameters in addition to the random number, such as a root key, which is not limited by the present disclosure. For example, the root key K can be 128 bits or 256 bits in length.

[0085] In some embodiments, the random number is a quantum random number.

[0086] In this way, by introducing quantum random numbers to replace the current random number generation method, the security of the random number can be enhanced. It can be understood that the random number occupies an important position in the 5G network and the evolved network, and the integration of mobile networks and quantum technology is an important technical direction for enhancing network security in the future. Therefore, quantum technology is introduced in the generation of random numbers to enhance the security of random numbers.

[0087] As shown in FIG. 5, taking the generation of an encryption key and an integrity key based on one of the at least two quantum random numbers on the network side as an example, the function involved in key derivation is the MILENAGE function, which includes f1-f5 functions, and the partial variables involved include:

[0088] K: 128-bit user key (root key), core input to f1-f5 functions.

[0089] AK: 48-bit anonymity key.

[0090] AMF: Authentication Management Field, a 16-bit field containing information about the authentication algorithm and sequence number.

[0091] c1, c2, c3, c4, c5: 128-bit constants XORed with intermediate variables.

[0092] CK: 128-bit cipher key, based on output of function f3.

[0093] IK: 128-bit integrity key, based on output of function f4.

[0094] RAND: 128-bit quantum random number.

[0095] SQN: 48-bit sequence number.

[0096] From RAND, AMF, SQN, and K, generate message authentication codes (MAC) based on f1. From RAND and K, generate expected user authentication response (XRES) based on f2. From RAND and K, generate CK based on f3. From RAND and K, generate IK based on f4. From RAND and K, generate AK based on f5.

[0097] As shown in FIG. 6, taking the generation of a cipher key and an integrity key based on at least one quantum random number on the terminal side as an example, the function involved in key derivation is MILENAGE, which includes f1-f5 functions, and the partial variables involved include:

[0098] K: 128-bit user key (root key), core input to f1-f5 functions.

[0099] AK: 48-bit anonymity key.

[0100] AMF: Authentication Management Field, a 16-bit field containing information about the authentication algorithm and sequence number.

[0101] c1, c2, c3, c4, c5: 128-bit constants XORed with intermediate variables.

[0102] CK: 128-bit cipher key, based on output of function f3.

[0103] IK: a 128-bit integrity key, based on the output of function f4.

[0104] RAND: a 128-bit quantum random number.

[0105] SQN: a 48-bit sequence number.

[0106] AK is commonly generated by RAND and K based on f5. An expected message authentication code (XMAC) is generated by SQN 0 AK, K, RAND and AMF based on f1. A user authentication response (RES) is commonly generated by RAND and K based on f2. CK is generated by RAND and K based on f3. IK is generated by RAND and K based on f4.

[0107] It can be understood that the 128-bit quantum random number can be generated by embedding or externally connecting a quantum random number generation chip or device in the core network side, and embedding a quantum random number chip in the terminal side. According to the related standards, the signaling sent by the terminal to the core network finally contains the random number, and the terminal side and the core network side can form a series storage mode of two quantum random numbers (see FIG. 7), which is used on demand, and the series of random numbers also lays a foundation for the increase of key length in the subsequent 5G and evolved network, which is a lightweight way and meets the current network demand.

[0108] In some embodiments, the first encryption key and the first integrity key are generated based on at least two random numbers, including:

[0109] The second encryption key and the second integrity key are generated based on at least two random numbers, the second encryption key including an encryption key generated based on each of the at least two random numbers, and the second integrity key including an integrity key generated based on each of the at least two random numbers.

[0110] The first encryption key is obtained from the second encryption key, and the first integrity key is obtained from the second integrity key.

[0111] In this way, without the need to upgrade or lightly modify the network, the second encryption key includes an encryption key generated based on each of the at least two random numbers, and the second integrity key includes an integrity key generated based on each of the at least two random numbers, which can meet the generation of longer key length of CK and IK, and further meet the demand of the network on demand.

[0112] In some embodiments, the first encryption key and the first integrity key are both 128-bit.

[0113] In some embodiments, the second encryption key and the second integrity key are both 256 bits.

[0114] The following takes two random numbers as an example, and the two random numbers are referred to as a first random number and a second random number. An encryption key generated based on the first random number is referred to as CK1 (128 bits), and an integrity key generated based on the first random number is referred to as IK1 (128 bits). An encryption key generated based on the second random number is referred to as CK2 (128 bits), and an integrity key generated based on the second random number is referred to as IK2 (128 bits).

[0115] CK1 and CK2 are concatenated as CK1||CK2 (256 bits) and stored, and IK2 and IK1 are concatenated as IK1||IK2 (256 bits) and stored.

[0116] In this way, under the condition of no modification or lightweight modification, the generation of two pairs of CK and IK (that is, CK1, IK1, CK2, and IK2) is realized by introducing two random numbers under the demand of the current key derivation system. The so-called lightweight modification, such as increasing the storage capacity of one CK and IK, can realize the generation of two pairs of CK and IK by using two random numbers.

[0117] Some embodiments of the present disclosure can form a key length of 256 bits by concatenating two CKs and two IKs, respectively, to establish a foundation for the growth of key length in subsequent 5G networks and evolved networks, and realize elastic expansion (that is, CK1 and CK2 can be concatenated as CK1||CK2, with a length of 256 bits, which is referred to as a 256-bit CK and stored, and IK1 and IK2 can be concatenated as IK1||IK2, with a length of 256 bits, which is referred to as a 256-bit IK and stored). The advantage of this is that the current network equipment does not need to be modified, and the smooth transition of CK and IK from 128 bits to 256 bits can be realized, which provides a good technical reference for lightweight modification. In addition, when CK and IK are 256 bits, the concatenation of CK and IK forms 512 bits, which provides a guide for further enhancing the security of the key. Of course, the 512-bit method needs to consider other factors, such as storage, equipment upgrade and modification, and protocol modification.

[0118] FIG. 7 provides a key derivation process according to some embodiments of the present disclosure. As shown in FIG. 7, taking the network side as an example, two quantum random numbers, quantum random number 1 (referred to as RAND1) and quantum random number 2 (referred to as RAND2), are first generated.

[0119] The UDM / ARPF saves the same root key K as the terminal side; the UDM / ARPF generates 128-bit CK1 and 128-bit IK1 based on K and RAND1, and generates 128-bit CK2 and 128-bit IK2 based on K and RAND2.

[0120] In some embodiments, the network side can concatenate CK1 and CK2 to obtain a second encryption key (denoted as CK1||CK2), and concatenate IK1 and IK2 to obtain a second integrity key (denoted as IK1||IK2); then the first 128 bits of the second encryption key, i.e., CK1, and the last 128 bits of the second integrity key, i.e., IK2, can be concatenated to form a new combined parameter 1 (denoted as CK1||IK2), which is used as a generation parameter of an authentication service function key (denoted as K AUSF1 ) in the AKA mode. Similarly, the last 128 bits of the second encryption key, i.e., CK2, and the first 128 bits of the second integrity key, i.e., IK1, can be concatenated to form a new combined parameter 2 (denoted as CK2||IK1), which is used as a generation parameter of an authentication service function key (denoted as K AUSF2 ) in the EAP AKA' mode.

[0121] In some embodiments, the UDM / ARPF of the network side concatenates 128-bit CK1 and 128-bit IK2 to form a 256-bit combined parameter (denoted as CK1||IK2), which is used as a generation parameter of an authentication service function key (denoted as K AUSF1 ) in the AKA mode. The UDM / ARPF of the network side concatenates 128-bit CK2 and 128-bit IK1 to form a 256-bit combined parameter (denoted as CK2||IK1), which is used as a generation parameter of an authentication service function key (denoted as K AUSF2 ) in the EAP AKA' mode.

[0122] In the AKA mode, the UDM / ARPF generates K AUSF1 based on CK1||IK2 and sends it to the AUSF, or the UDM / ARPF can send CK1||IK2 to the AUSF, and the AUSF generates K AUSF1 based on CK1||IK2.

[0123] In the EAP AKA' mode, the UDM / ARPF generates K AUSF2 based on CK2||IK1 and sends it to the AUSF, or the UDM / ARPF can send CK2||IK1 to the AUSF, and the AUSF generates K AUSF2 based on CK2||IK1.

[0124] Continuing to refer to FIG. 7, taking the terminal side as an example, first, two quantum random numbers are generated, namely quantum random number 1 (denoted as RAND1) and quantum random number 2 (denoted as RAND2).

[0125] The terminal side stores the same root key K as the network side; the terminal side (for example, a universal subscriber identity module (USIM)) generates 128 bits of CK1 and 128 bits of IK1 according to K and RAND1, and generates 128 bits of CK2 and 128 bits of IK2 according to K and RAND2.

[0126] In some embodiments, the terminal side can concatenate CK1 and CK2 to obtain a second encryption key (denoted as CK1||CK2), and concatenate IK1 and IK2 to obtain a second integrity key (denoted as IK1||IK2); then the first 128 bits of the second encryption key, that is, CK1, and the last 128 bits of the second integrity key, that is, IK2, can be concatenated to form a new combined parameter 1 (denoted as CK1||IK2), which is used as a generation parameter of an authentication service function key (denoted as K AUSF1 ) in the AKA mode. Similarly, the last 128 bits of the first encryption key, that is, CK2, and the first 128 bits of the first integrity key, that is, IK1, can be concatenated to form a new combined parameter 2 (denoted as CK2||IK1), which is used as a generation parameter of an authentication service function key (denoted as K AUSF2 ) in the EAP AKA' mode.

[0127] In some embodiments, the terminal side concatenates 128 bits of CK1 and 128 bits of IK2 to form a 256-bit combined parameter (denoted as CK1||IK2), which is used as a generation parameter of an authentication service function key (denoted as K AUSF1 ) in the AKA mode. The terminal side concatenates 128 bits of CK2 and 128 bits of IK1 to form a 256-bit combined parameter (denoted as CK2||IK1), which is used as a generation parameter of an authentication service function key (denoted as K AUSF2 ) in the EAP AKA' mode.

[0128] In the AKA mode, the terminal side (for example, a mobile equipment (ME)) generates K AUSF1 in the AKA mode based on CK1||IK2.

[0129] In the EAP AKA' mode, the terminal side (for example, an ME) generates K AUSF2 in the EAP AKA' mode based on CK2||IK1.

[0130] In some embodiments, K AUSF1 and K AUSF2 may each have a length of 256 bits.

[0131] The derivation algorithm involved in the generation of the authentication service function key in some embodiments of the present disclosure is KDF(Key, S). Key is CK1||IK2 (or CK2||IK1). The KDF function is a key derivation function, for example, a hash function. S is a parameter, for example, S can include multiple sub-parameters in different derivation scenarios, for example, FC, P0, L0, P1, L1.

[0132] Based on Figure 7, it can be clearly seen that, compared with the background art, under the EAP AKA' authentication mode, CK and IK need to be derived to generate CK' and IK' based on the key derivation function, and then K AUSF , some embodiments of the present disclosure can generate 2 pairs of CK and IK based on the introduction of two quantum random numbers, by the terminal or the network side, can meet the requirements of key derivation of AKA and EAP-AKA' authentication modes at the same time, optimize the key derivation mode under the EAP-AKA' mode, reduce the complexity of the process under the EAP-AKA' authentication mode. Moreover, the technical scheme provided by some embodiments of the present disclosure improves the key generation efficiency and flexibility, and the security of the derived authentication service function key is also improved.

[0133] It can be understood that, in the case of generating an authentication service function key based on N random numbers, and N is an integer greater than 2, the N random numbers can be synthesized into two quantum random numbers through some calculation method, and then the generation of the authentication service function key is realized by referring to the method introduced in the above embodiments or examples, which will not be repeated here. For example, adjacent random numbers in N random numbers are synthesized into two quantum random numbers. For example, there are four quantum random numbers R1, R2, R3 and R4, wherein R1 and R2 are adjacent, R3 and R4 are adjacent, R1 and R2 are weighted and summed, or other calculation methods are used to synthesize a random number, R3 and R4 are weighted and summed, or other calculation methods are used to synthesize another random number. The adjacent random numbers here can refer to adjacent generated random numbers, or random numbers that are determined to have an adjacent relationship through some preset rules.

[0134] The above describes the schemes of some embodiments of the present disclosure mainly from the perspective of methods. A key generation apparatus is also shown below for performing the key generation method in any of the above embodiments and possible implementation manners thereof. It can be understood that the key generation apparatus contains hardware structures and / or software modules corresponding to performing respective functions in order to implement the key generation method; it should be easily realized by those skilled in the art that, in combination with the algorithm steps of each example described in some embodiments of the present disclosure, the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in hardware or in the form of computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present disclosure.

[0135] Some embodiments of the present disclosure can divide the key generation apparatus according to the method embodiments described above, for example, each function module can be divided according to each function, or two or more functions can be integrated into one function module. The above integrated module can be implemented in the form of hardware or in the form of software. It should be noted that the division of modules in the embodiments of the present disclosure is illustrative, and is only a logical functional division. There can be another division manner when actually implemented. The following will be described taking the example of dividing each function module according to each function.

[0136] FIG. 8 is a key generation apparatus provided by some embodiments of the present disclosure. The key generation apparatus 80 includes a processing component 81 and an obtaining component 82.

[0137] The processing component 81 is configured to generate an authentication service function key based on at least two random numbers.

[0138] In some embodiments, the authentication service function key includes at least one of: an authentication service function key in an authentication and key agreement (AKA) mode, and an authentication service function key in an extensible authentication protocol (EAP) AKA' mode.

[0139] In some embodiments, the processing component 81 can be configured to:

[0140] generate a first encryption key and a first integrity key based on the at least two random numbers, the first encryption key being an encryption key generated based on a part of the at least two random numbers, and the first integrity key being an integrity key generated based on another part of the at least two random numbers;

[0141] generate the authentication service function key based on the first encryption key and the first integrity key.

[0142] In some embodiments, the processing component 81 is configured to generate a second encryption key and a second integrity key based on the at least two random numbers, the second encryption key comprising an encryption key generated based on each of the at least two random numbers, and the second integrity key comprising an integrity key generated based on each of the at least two random numbers.

[0143] The obtaining component 82 is configured to obtain the first encryption key from the second encryption key, and obtain the first integrity key from the second integrity key.

[0144] In some embodiments, the first encryption key and the first integrity key are both 128 bits.

[0145] In some embodiments, the second encryption key and the second integrity key are both 256 bits.

[0146] In some embodiments, the random number is a quantum random number.

[0147] In the case of implementing the functions of the above integrated modules in the form of hardware, some embodiments of the present disclosure further provide a possible structure of a communication apparatus configured to perform the key generation method provided by some embodiments of the present disclosure. As shown in FIG. 9, the communication apparatus 900 includes a communication interface 903, a processor 902 and a bus 904. In some embodiments, the communication apparatus can further include a memory 901.

[0148] The processor 902 can be various exemplary logical blocks, modules and circuits described in combination with embodiments of the present disclosure. The processor 902 can be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. The processor 902 can implement or execute various exemplary logical blocks, modules and circuits described in combination with embodiments of the present disclosure. The processor 902 can also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor (DSP) and a microprocessor, etc.

[0149] The communication interface 903 is configured to connect with other devices through a communication network. The communication network can be an Ethernet, a wireless access network, a wireless local area network (WLAN), etc.

[0150] The memory 901 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0151] As an implementation manner, the memory 901 can exist independently of the processor 902, the memory 901 can be connected to the processor 902 through the bus 904, and is configured to store instructions or program code. When the processor 902 invokes and executes the instructions or program code stored in the memory 901, the key generation method provided by some embodiments of the present disclosure can be implemented.

[0152] In another implementation manner, the memory 901 can also be integrated with the processor 902.

[0153] The bus 904 can be an extended industry standard architecture (EISA) bus or the like. The bus 904 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 9, but it does not mean that there is only one bus or only one type of bus.

[0154] Some embodiments of the present disclosure provide a computer-readable storage medium (for example, a non-transitory computer-readable storage medium) having computer program instructions stored therein, and the computer program instructions, when executed on a computer, cause the computer to execute the key generation method described in any of the above embodiments.

[0155] In an exemplary implementation manner, the computer can be the key generation apparatus described above, and the present disclosure does not limit the form of the computer.

[0156] In some examples, the aforementioned computer readable storage medium can include, but is not limited to, a magnetic storage device (e.g., hard disk, floppy disk, or magnetic tape), an optical storage device (e.g., compact disk (CD), digital versatile disk (DVD), etc.), a smart card, and a flash memory device (e.g., EPROM, card, stick, or key drive). The various computer readable storage media described in the present disclosure can represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" can include, without being limited to, a wireless channel and various other media capable of storing, containing, and / or carrying instruction(s) and / or data.

[0157] The embodiments of the present disclosure provide a computer program product containing instructions, which, when executed on a computer, cause the computer to perform the key generation method described in any of the above embodiments.

[0158] The above is merely specific embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto, and any change or replacement within the technical scope disclosed by the present disclosure should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A method for generating a key, comprising: generating an authentication server function key based on at least two random numbers.

2. The method of claim 1, wherein, The authentication server function key comprises at least one of: an authentication server function key in an authentication and key agreement (AKA) mode, and an authentication server function key in an extensible authentication protocol (EAP) AKA' mode.

3. The method of claim 1 or 2, wherein, The generating the authentication server function key based on the at least two random numbers comprises: generating a first encryption key and a first integrity key based on the at least two random numbers, the first encryption key being generated based on a part of the at least two random numbers, and the first integrity key being generated based on another part of the at least two random numbers; generating the authentication server function key based on the first encryption key and the first integrity key.

4. The method of claim 3, wherein, The generating the first encryption key and the first integrity key based on the at least two random numbers comprises: generating a second encryption key and a second integrity key based on the at least two random numbers, the second encryption key comprising an encryption key generated based on each of the at least two random numbers, and the second integrity key comprising an integrity key generated based on each of the at least two random numbers; obtaining the first encryption key from the second encryption key and obtaining the first integrity key from the second integrity key.

5. The method of claim 4, wherein, The generating the second encryption key and the second integrity key based on the at least two random numbers comprises: concatenating the encryption keys generated based on each of the at least two random numbers in sequence to form the second encryption key; and concatenating the integrity keys generated based on each of the at least two random numbers in sequence to form the second integrity key.

6. The method of claim 5, wherein, The obtaining the first encryption key from the second encryption key and obtaining the first integrity key from the second integrity key comprises: selecting a first half of the second encryption key as the first encryption key and selecting a second half of the second integrity key as the first integrity key; or selecting a second half of the second encryption key as the first encryption key and selecting a first half of the second integrity key as the first integrity key.

7. The method of any one of claims 3-6, wherein, The generating the authentication server function key based on the first encryption key and the first integrity key comprises: concatenating the first encryption key and the first integrity key to generate the authentication server function key.

8. The method of any one of claims 3-7, wherein, The first encryption key and the first integrity key are both 128 bits.

9. The method of any one of claims 4-6, wherein, The second encryption key and the second integrity key are both 256 bits.

10. The method of any one of claims 1-9, wherein, Each of the at least two random numbers is a quantum random number.

11. The method of any one of claims 1-10, wherein, The at least two random numbers are stored in sequence. 12.A device for generating a key, comprising: a processing component configured to generate an authentication server function key based on at least two random numbers.

13. A communications device comprising: a memory and a processor; the memory and the processor are coupled; the memory is configured to store instructions executable by the processor; The processor executes the instructions to perform the method according to any one of claims 1-11.

14. A computer readable storage medium, wherein, The computer readable storage medium stores computer instructions, and when the computer instructions run on the communication device, the communication device performs the method according to any one of claims 1-11.

15. A computer program product, wherein, The computer program product, when executed, implements the method according to any one of claims 1-11.

Images