Unified Anchor Key Derivation Across 5G Access Modes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G communication systems face challenges in generating a unified anchor key for different access modes, such as 3GPP and non-3GPP access, to ensure compatibility and secure key negotiation.
Innovation Solution
A method and system for generating a unified anchor key by receiving an indication identifier to distinguish access modes, using formulas involving key generation algorithms like KDF and PRF to derive intermediate and anchor keys, and separating lower-layer keys based on these anchor keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate key negotiation processes are used for different access modes (3GPP and non-3GPP), then each access mode can have optimized security parameters, but the system complexity increases and compatibility becomes difficult to manage
Solution Approach 1:
The patent implements a unified anchor key negotiation process that serves multiple access modes (3GPP and non-3GPP) simultaneously. The AMF performs a single anchor key negotiation with the UE that can derive multiple access mode-specific keys through key derivation functions, making the security system universal across different access types rather than requiring separate negotiation processes for each mode.
2Device complexity
If a unified anchor key negotiation process is implemented for different access modes, then system complexity is reduced and compatibility is improved, but the ability to optimize security parameters for each specific access mode is limited
Solution Approach 1:
The patent segments the key structure into hierarchical levels: a unified anchor key at the top level, and multiple access mode-specific keys derived from it. This segmentation allows the system to maintain a simple unified negotiation process while still providing optimized security parameters for each access mode through the derived keys (e.g., K access mode1, K access mode2).
Solution Approach 2:
The patent uses key derivation functions that take the unified anchor key and transform it into multiple access mode-specific keys with different parameters. By changing the derivation inputs (access mode identifiers, random values) and using different KDF algorithms, the system generates keys optimized for specific access modes while maintaining a single negotiation process.
3Productivity
If multiple access mode-specific keys are derived from a single anchor key, then key management efficiency is improved, but the risk of key compromise propagation increases
Solution Approach 1:
The unified anchor key acts as an intermediary between the single negotiation process and multiple access mode-specific keys. It provides a controlled transformation layer where the anchor key is derived through a secure process, and then systematically transformed into mode-specific keys through authenticated key derivation functions, ensuring that key compromise in one mode does not automatically compromise other modes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application provide an anchor key generation method, device, and system. The method includes: receiving, by a first communications device, an indication identifier sent by a second communications device, where the indication identifier is used to indicate an access mode of a terminal; sending, by the first communications device, the indication identifier to a third communications device; receiving, by the first communications device, an intermediate key returned by the third communications device, where the intermediate key is generated based on the indication identifier; generating, by the first communications device, an anchor key based on the intermediate key, where the anchor key is corresponding to the access mode of the terminal; and sending, by the first communications device, the anchor key to the second communications device, so that the second communications device derives a lower-layer key for the access mode based on the anchor key. In the method, a unified anchor key can be generated for different access modes, and the anchor key of the different access modes is separated from a lower-layer key generated based on the anchor key.