Dynamic User Plane Key Derivation for LTE Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face security risks due to the use of a single user plane encryption key for all data packets, making them vulnerable to interception and compromise in case the key is compromised, particularly susceptible to Man in the Middle attacks.
Innovation Solution
Deriving multiple user plane encryption keys from a shared key by hashing it with random numbers and transmitting these keys through a Packet Data Convergence Protocol (PDCP) control message, allowing dynamic rekeying and enhanced security for data packets between User Equipment (UE) and evolved NodeB (eNB).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single user plane encryption key (KUPenc) is used for all data packets, then encryption simplicity is maintained, but security is compromised due to vulnerability to interception and brute force attacks
Solution Approach 1:
The patent divides a single encryption key into multiple subordinate keys (KUPenc(1), KUPenc(2), ..., KUPenc(N)) that are derived from the master key KeNB using different random numbers. Each data packet is encrypted with a different subordinate key, so that compromise of one key does not affect others. This segmentation approach directly resolves the contradiction by maintaining security through key diversity while managing complexity through systematic key derivation.
Solution Approach 2:
The patent implements dynamic key selection where the subordinate key used for encrypting each data packet changes over time based on packet sequence numbers or random selection. This dynamic approach ensures that even if an attacker intercepts one encrypted packet, they cannot decrypt other packets encrypted with different keys, thereby improving security without requiring completely separate key management systems.
2Reliability
If multiple subordinate keys are generated from the same master key, then security against key compromise is improved, but key management complexity increases
Solution Approach 1:
The patent performs preliminary generation of multiple subordinate keys from the master key KeNB using predetermined random numbers before actual data transmission begins. These keys are prepared in advance and stored securely in both the UE and eNB. This preliminary action resolves the contradiction by establishing a robust multi-key security framework upfront, while the systematic derivation method keeps management complexity manageable through reuse of the same derivation function.
Solution Approach 2:
The patent uses random numbers as intermediaries between the master key KeNB and the subordinate keys KUPenc(i). The random numbers serve as a mediating element that transforms the single master key into multiple secure subordinate keys through a deterministic hashing process. This intermediary approach improves security by adding an layer of abstraction, while keeping key management simple through the consistent use of the random number mediator.
3Productivity
If the same encryption key is used for all user plane data, then processing overhead is minimized, but the system becomes vulnerable to Man in the Middle attacks and brute force methods
Solution Approach 1:
The patent implements periodic key usage where subordinate keys are selected in a systematic periodic manner based on packet sequence numbers or time intervals. For example, keys may be selected in round-robin fashion or based on modulo operations with packet counters. This periodic approach maintains processing efficiency through predictable key selection patterns, while simultaneously improving security by ensuring that different keys are used at different times, making brute force attacks significantly more difficult.
Data Source
AI summary
The method of securing secure communication between a User Equipment (UE) and evolved NodeB (eNB), involves deriving a user plane (UP) encryption key (KUPenc) from a shared key (KeNB) associated with the UE for an ongoing communication session. At the UE, the UP encryption key (KUPenc) may be hashed with a number of random numbers to generate a plurality UP encryption keys(KUPenc(n)), wherein the random numbers are transmitted to the eNB through a Packet Data Convergence Protocol (PDCP) control message. One or more data packets sent from the UE to the eNB may be encrypted, by the UE, using the plurality of UP encryption keys (KUPenc(n)).