5G NAS Key Derivation for Secure Idle-Mode AMF Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in 5G networks is ensuring secure AMF changes without the need for re-authentication, as AMFs can be deployed in less secure locations, and existing mechanisms lack efficient methods for backward security during mobility management function changes.
Innovation Solution
The source AMF derives a new NAS key and sends it to the target AMF along with a key change indication (KCI), allowing the UE to derive the new key, and optionally provides a key generation parameter for secure context transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If re-authentication is performed during AMF change, then network security is improved, but authentication cost and time consumption increase
Solution Approach 1:
The source AMF performs preliminary key derivation and generates a new NAS key before the actual AMF change occurs. This new key is derived from the old NAS key using a key derivation function, and the source AMF sends this pre-computed new key to the target AMF. When the UE receives the new key, it can immediately use it for security contexts without needing to perform re-authentication, thus achieving both security maintenance and time efficiency.
2Adaptability or versatility
If AMF is deployed in less secure locations for flexibility, then network adaptability is improved, but security risk increases
Solution Approach 1:
The security architecture is segmented into two parts: the master key Kseaf remains securely stored in the SEAF (Security Anchor Function) which is assumed to be in a secure location, while the NAS key is derived and can be shared with AMFs in less secure locations. This segmentation allows AMFs to be deployed flexibly in edge locations while maintaining security through the hierarchical key structure where only the master key needs to remain protected.
Solution Approach 2:
The SEAF acts as an intermediary that holds the master key Kseaf and provides key derivation services to AMFs. When an AMF needs a new NAS key, it requests it from the SEAF which derives it from the master key. This intermediary mechanism allows AMFs to operate in less secure locations while the SEAF maintains the security anchor point.
3Reliability
If key material is shared between AMFs, then backward security is improved, but key management complexity increases
Solution Approach 1:
The patent extracts only the necessary key material (the new NAS key) for the target AMF to establish security contexts, rather than transferring the entire security context including the old NAS key. The source AMF derives the new NAS key from the old NAS key and sends only this derived key to the target AMF. This extraction approach provides backward security (target AMF can secure communications without knowing old keys) while reducing key management complexity by sharing only the essential new key material.
Data Source
AI summary
The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.