Dual Connectivity Security Key Derivation With Freshness Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In dual connectivity scenarios in LTE, the security key S-K eNB for secondary base stations is derived from K eNB and a counter value, leading to potential security threats due to repetitive input parameters in ciphering/encryption, such as RB-id reuse and COUNT wrap-up, which existing solutions like intra-cell handover are inefficient and disruptive.
Innovation Solution
Derive a new security key S-K eNB based on an incremented freshness counter for the secondary base station communication, without requiring an intra-cell handover, using an RRC connection reconfiguration message to maintain secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intra-cell handover is performed to refresh security keys, then security is improved, but communication disruption and routing optimization are worsened
Solution Approach 1:
The patent changes the security key derivation parameter from using reused identifiers (RB-id, COUNT) to using a freshness counter that increments with each security key derivation. This parameter change ensures unique input parameters for ciphering/encryption without requiring handover, thus maintaining security while avoiding communication disruption.
2Device complexity
If security key derivation uses repetitive input parameters (RB-id reuse, COUNT wrap-up), then device complexity is reduced, but security is worsened
Solution Approach 1:
The patent introduces a freshness counter as an intermediary parameter in the security key derivation process. This intermediary ensures that input parameters remain unique across multiple derivations without complicating the overall system architecture, thus maintaining security while avoiding the need for complex handover procedures.
3Reliability
If freshness counter is incremented for each security key derivation, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the security key derivation process by separating the freshness counter management from the actual key derivation algorithm. The freshness counter is maintained and incremented independently, while the derivation algorithm remains unchanged, thus improving security without significantly increasing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to methods for establishing a secure communication link between a mobile station and a secondary base station in a mobile communication system. The invention is also providing mobile communication system for performing these methods, and computer readable media the instructions of which cause the mobile communication system to perform the methods described herein. Specifically, the invention suggests that in response to the detected or signaled potential security breach, the master base station increments a freshness counter for re-initializing the communication between the mobile station and the secondary base station; and the mobile station and the secondary base station re-initialize the communication there between. The reinitialization is performed under the control of the master base station and further includes deriving a same security key based on said incremented freshness counter, and establishing the secure communication link utilizing the same, derived security key.