Adaptive Kausf Key Derivation Across 3GPP Authentication Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In current communication systems, user equipment (UE) cannot determine whether the authentication device is located inside or outside a 3GPP network, leading to inconsistent key derivation for authentication service keys (Kausf), which affects secure communication with the network.
Innovation Solution
UE determines the location of the authentication device using indication information (ABBA or preconfigured settings) to decide whether to derive Kausf from the EMSK or MSK, ensuring key consistency across network architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the UE uses a fixed key derivation method (always from EMSK or always from MSK), then the key derivation process is simple, but the Kausf generated by the UE will be inconsistent with the Kausf generated on the network side when the authentication device location changes
Solution Approach 1:
The patent applies dynamics by making the key derivation method adaptive rather than fixed. The UE dynamically selects between deriving Kausf from EMSK or from MSK based on the authentication device location indicator. This dynamic adjustment ensures that the key derivation process remains simple to execute while adapting to different network architectures (AUSF inside or outside 3GPP network), thereby maintaining both operational simplicity and key consistency reliability.
2Adaptability or versatility
If the UE adapts to different network architectures (AUSF inside or outside 3GPP network), then the system becomes more versatile, but the key derivation process becomes more complex
Solution Approach 1:
The patent applies preliminary action by having the network side send the authentication device location indicator (ABBA or similar) to the UE before the UE performs key derivation. This allows the UE to know in advance which derivation method to use (from EMSK or from MSK), eliminating the need for complex runtime detection or multiple derivation attempts. The UE simply follows the indication received, maintaining low complexity while achieving high adaptability to different network architectures.
3Device complexity
If the UE does not receive indication information about authentication device location, then the protocol remains simple, but the UE cannot determine which key derivation method to use
Solution Approach 1:
The patent introduces an intermediary indicator (ABBA - Anti-Bidding Down Between Architectures, or a similar indication field) that is transmitted from the network side to the UE. This intermediary element carries the authentication device location information without requiring complex protocols or multiple messages. The indicator acts as a simple signal that enables the UE to determine the correct key derivation method, adding minimal protocol complexity while preventing information loss about the authentication device location.
Data Source
AI summary
A key derivation method, an apparatus, and a system. The method includes: user equipment (UE) receives an authentication success message from a mobility management function network element, generates a master session key (MSK) and an extended master session key (EMSK) based on the authentication success message; and determines whether an authentication device is located outside a 3rd generation partnership project (3GPP) network, to determine whether to obtain Kausf based on the EMSK or the MSK. Therefore, the UE can be compatible with a key derivation manner used when the authentication device is located outside the 3GPP network and a key derivation manner used when the authentication device is located inside the 3GPP network.