DTLS Pre-Master Secret Generation via PSK Identity Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems lack a method to support the security requirements of the Ua interface for GBA and the Ua* interface for AKMA using Datagram Transport Layer Security (DTLS).
Innovation Solution
A method and apparatus for generating a DTLS pre-master secret by determining a pre-shared key (PSK) identity, obtaining a key, and generating the DTLS pre-master secret based on this identity, which supports security requirements for Ua and Ua* interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DTLS is used to support security requirements for Ua and Ua* interfaces, then security is improved, but the complexity of key management and authentication procedures increases
Solution Approach 1:
The patent segments the key management process into distinct phases: bootstrap phase (where keys are initially established) and application phase (where keys are derived and used). This segmentation allows the complex key management to be divided into manageable steps, reducing the operational complexity while maintaining security requirements for both Ua and Ua* interfaces.
Solution Approach 2:
The patent introduces a bootstrap server as an intermediary entity that facilitates the key exchange between the user equipment and the authentication server. This intermediary simplifies the authentication process by centralizing the bootstrap operations, thereby reducing the complexity of direct key management between endpoints while ensuring secure communication for both GBA and AKMA interfaces.
2Adaptability or versatility
If multiple PSK identities are supported for different authentication methods, then adaptability is improved, but the complexity of selecting and managing keys increases
Solution Approach 1:
The patent implements dynamic key selection based on the authentication method being used. The system automatically determines which PSK identity to use (GBA or AKMA) based on the authentication parameters received from the authentication server. This dynamic adaptation allows support for multiple authentication methods without requiring manual key selection, thereby reducing operational complexity while maintaining versatility.
Solution Approach 2:
The patent changes the parameter used for key identification from a static configuration to a dynamic selection based on authentication method. By using different PSK identities (GBA identifier vs. AKMA key identifier) depending on the authentication type, the system achieves adaptability to multiple methods while simplifying key management through automated parameter-based selection rather than manual intervention.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present disclosure belongs to the technical field of communications, and provides a method and apparatus for generating a premaster secret of datagram transport layer security (DTLS), a device, and a storage medium. The method comprises: receiving a DTLS message sent by a terminal device, wherein the DTLS message comprises shared key PSK identities supported by the terminal device; selecting one PSK identity from the shared key PSK identities supported by the terminal device; obtaining a key according to the selected PSK identity; and generating a premaster secret of DTLS according to the obtained key. The present disclosure provides a processing method for "generation for a premaster secret of DTLS", and by generating a premaster secret corresponding to a selected PSK identity, DTLS can support security requirements of a Ua interface for a GBA and a Ua* interface for AKMA, and the security during communication can be improved.