BMSC-Specific Key Derivation in IMS MBMS Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IMS-based MBMS systems face security threats when multiple BMSCs are connected to a SCF, as they share the same NAF key, leading to potential impersonation and lack of key specificity in key management messages.
Innovation Solution
The SCF derives BMSC-specific keys from the shared NAF key using a key derivation function, and communicates these keys to each BMSC, ensuring each BMSC has a unique key and the UE can identify the correct key for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If multiple BMSCs share the same NAF key, then key management is simplified, but security is compromised due to potential impersonation and lack of key specificity
Solution Approach 1:
The patent segments the shared NAF key into multiple BMSC-specific keys by deriving unique keys for each BMSC from the common NAF key. This allows each BMSC to have its own cryptographic identity while maintaining a unified key management structure at the SCF level.
Solution Approach 2:
The patent applies local quality by making each BMSC's key derivation process specific to its identity. Each BMSC derives its unique key using its own identifier (such as BMSC ID or address) as input to the key derivation function, ensuring that each BMSC has locally unique cryptographic properties.
2Reliability
If each BMSC has a unique key, then security is improved by preventing impersonation, but key management complexity increases
Solution Approach 1:
The SCF acts as an intermediary that manages the key derivation process centrally. Instead of each BMSC independently managing complex key relationships, the SCF receives the NAF key, derives the appropriate BMSC-specific keys, and distributes them to the relevant BMSCs, simplifying the overall key management architecture.
Solution Approach 2:
The patent implements preliminary action by pre-establishing the key derivation relationships between the NAF key and each BMSC's unique key before actual MBMS operations begin. This allows the system to set up secure, unique key pairs in advance, avoiding the need for complex runtime key management decisions.
3Reliability
If the SCF derives BMSC-specific keys from the NAF key, then key specificity is improved, but the key derivation process adds complexity
Solution Approach 1:
The patent uses parameter changes by varying the input parameters to the key derivation function based on which BMSC is being served. The SCF changes the derivation parameters (such as BMSC identifier, address, or other unique attributes) to generate different cryptographic keys from the same NAF key, ensuring key specificity without requiring fundamentally different derivation mechanisms.
Data Source
AI summary
A system, method, and nodes for managing shared security keys between a User Equipment, UE, an authentication node such as an SCF/NAF, and a service node such as a BM-SC or AS. The SCF/NAF allocates to each BM-SC, a different SCF/NAF identifier such as a fully qualified domain name, FQDN, from the FQDN space the SCF/NAF administers. The SCF/NAF then locally associates these allocated FQDNs with the connected BM-SCs and with different services. The network sends the correct FQDN to the UE in a service description for a desired service, and the UE is able to derive a security key using the FQDN. When the UE requests the desired service, the SCF/NAF is able to associate the service identifier with the correct FQDN and an associated BM-SC. The SCF/NAF uses the FQDN to obtain the security key from a bootstrapping server and sends it to the associated BM-SC. As a result, the UE and the associated BM-SC share a specific security key.