PDU Session Key Derivation for Base Station Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In LTE systems, the security of data transmission is compromised when a key generated during the initial setup of a protocol data unit (PDU) session is cracked, leading to inadequate security for subsequent services.
Innovation Solution
A method where each PDU session derives a unique user plane key based on a base key and a session identifier, ensuring different keys are used for each session, enhancing security by implementing key derivation and exchange at a PDU session granularity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single user plane key is used for all PDU sessions, then key management is simplified, but data transmission security deteriorates when the key is cracked
Solution Approach 1:
The patent divides the single user plane key into multiple session-specific keys. Each PDU session has its own user plane key derived from the base key using a key derivation algorithm that incorporates the session identifier. This segmentation ensures that compromise of one session key does not affect other sessions, resolving the security issue while maintaining manageable complexity through automated key derivation.
2Reliability
If different user plane keys are derived for each PDU session, then data transmission security is improved, but key derivation and management complexity increases
Solution Approach 1:
The patent uses parameter changes in the key derivation process. A deterministic key derivation algorithm is applied that takes the base key and session-specific parameters (including session identifier) as inputs. This allows different keys to be generated for each session through parameter variation rather than complex cryptographic operations, improving security while keeping the derivation process manageable and automated.
3Ease of operation
If the same key is used for initial setup and subsequent services, then operational simplicity is maintained, but security protection is insufficient
Solution Approach 1:
The patent implements preliminary key derivation for each PDU session before data transmission begins. The user plane key is derived from the base key and session identifier in advance, ensuring that each session starts with a secure, dedicated key. This preliminary action eliminates the need for manual key management while preventing security vulnerabilities associated with key reuse across sessions.
Data Source
AI summary
Example data security processing methods and apparatus are described. One example method includes setting up a first PDU session. A first base station derives a first user plane key based on a received base key and performs security processing on user plane data in the first PDU session by using the first user plane key and a security algorithm. A second PDU session is set up. The first base station derives a second user plane key based on the base key and performs security processing on user plane data in the second PDU session by using the second user plane key and the security algorithm. The user plane key includes a user plane encryption key and/or a user plane integrity protection key.