MTC-IWF Key Derivation for Secure IoT Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 3GPP system lacks a secure communication solution between an MTC device and an MTC-IWF, which is essential for ensuring the integrity and confidentiality of messages exchanged between them, particularly in scenarios where unauthorized triggering can lead to attacks causing power consumption, DoS, resource waste, and privacy issues.
Innovation Solution
A communication system comprising a User Equipment (UE), a Service Capability Server (SCS), and a Home Subscriber Server (HSS) that derives and uses a confidentiality key and an integrity key for secure communication between the MTC device and the MTC-IWF, ensuring mutual authentication and protection against eavesdropping and alteration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure communication solution is implemented between MTC device and MTC-IWF, then security and reliability are improved, but device complexity and system complexity increase
Solution Approach 1:
The patent introduces the MTC-IWF as an intermediary entity that manages key derivation and distribution between the MTC device and the network. The MTC-IWF receives device trigger messages from the SCS, obtains key material from the HSS, derives the root key and subkeys, and provides security parameters to both the MTC device and the SCS. This intermediary approach centralizes complex key management operations, improving security while preventing the complexity from being distributed to individual devices or network elements.
Solution Approach 2:
The patent segments the security architecture into distinct functional components: the MTC device handles only basic key derivation using provided parameters, the MTC-IWF handles key material management and subkey derivation, and the HSS stores master key material. This segmentation allows each component to have simplified responsibilities, with the MTC device needing only to perform straightforward key derivation operations rather than managing the entire key hierarchy.
2Reliability
If key derivation is performed at both UE and network, then mutual authentication is achieved, but communication time and processing time increase
Solution Approach 1:
The patent implements preliminary action by having the MTC-IWF perform key material retrieval from the HSS and root key derivation before the actual communication between the MTC device and SCS begins. The MTC-IWF obtains the master key material from the HSS, derives the root key, and generates the necessary subkeys and security parameters in advance. These pre-derived parameters are then provided to both the MTC device and the SCS, allowing them to immediately use the keys for secure communication without performing time-consuming derivation operations during the communication process.
3Reliability
If device trigger message is processed through HSS, then authorization and security are improved, but message processing time increases
Solution Approach 1:
The patent extracts the security-critical functions from the normal message processing path. The MTC-IWF separates the authorization and key management functions from the device trigger message routing function. When the MTC-IWF receives a device trigger message from the SCS, it extracts the necessary security operations (obtaining key material from HSS, deriving keys) and handles them separately from the message forwarding operation. This allows the message processing to be optimized while maintaining secure authorization through the extracted security functions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a new IWF SMC procedure for establishing security association between an MTC UE (10) and an MTC-IWF (20). The MTC-IWF (20) sends to the UE (10) at least an algorithm identifier which instructs the UE (10) to select one of algorithms for deriving a root key (K_iwf). The UE (10) derives the root key (K_iwf) in accordance with the selected algorithm, and derives at least a subkey for checking the integrity of messages transferred between the UE (10) and the MTC-IWF (20) by using the derived root key (K_iwf). The UE (10) protects uplink messages transmitted to the MTC-IWF (20) with the derived subkey. The MTC-IWF (20) protects downlink messages transmitted to the UE (10) with the same subkey derived at a core network.