UE GBA Application Key Derivation for Multi-App Access Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing GBA and AKMA solutions fail to provide key diversity for multiple applications in UE, leading to potential key collisions and unauthorized access among applications.
Innovation Solution
Implement key derivation methods using Ks_NAF and APP_ID to generate unique Ks_APP keys for individual applications, with optional encryption and authentication protocols to ensure secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single Ks_NAF key is used for multiple applications in UE, then key management is simplified, but key collisions and unauthorized access occur
Solution Approach 1:
The patent segments the single Ks_NAF key into multiple application-specific keys (Ks_APP1, Ks_APP2, etc.) by deriving each key from the base Ks_NAF key combined with a unique application identifier (APP_ID). This segmentation ensures that each application has its own dedicated key while maintaining a centralized key management structure at the network level.
Solution Approach 2:
The patent applies local quality by making each application's key derivation process unique through the incorporation of APP_ID. Each application receives a key with properties tailored to its specific security requirements, while the overall system maintains uniform key management procedures.
2Reliability
If multiple application-specific keys are derived for each application, then security is enhanced, but key management complexity increases
Solution Approach 1:
The patent introduces the APP_ID as an intermediary parameter that bridges the base Ks_NAF key and the application-specific keys. This intermediary enables automatic key differentiation without requiring complex manual key management, as the APP_ID serves as a unique identifier that naturally segments the key space.
Solution Approach 2:
The patent changes the key derivation parameters by incorporating APP_ID into the key derivation function. This parameter change transforms the single Ks_NAF key into multiple distinct Ks_APP keys through a systematic variation of the derivation input, maintaining procedural simplicity while achieving key diversity.
3Reliability
If application identifiers are encrypted using application-specific keys, then authentication security is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary action by pre-establishing the application-specific keys (Ks_APP) during the key derivation phase before actual authentication operations. This preliminary key preparation enables efficient authentication processing later, as the encryption/decryption operations use pre-computed keys rather than requiring complex real-time key generation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for Generic Bootstrapping Authentication (GBA) are disclosed herein. A method performed by a User Equipment (UE) for GBA may include: communicating, at a GBA application, with a network node to run a GBA procedure during which the GBA application obtains a key, Ks, and a Bootstrapping Transaction Identifier (B-TID); providing to the GBA application, at an application, an application key request, the request including a Network Application Function (NAF) identifier; at the GBA application: verifying that the application is entitled to use a NAF corresponding to the NAF identifier; and responsive to successful verification: deriving the application key for the application based on the key, Ks, the NAF identifier, and an additional parameter generated by the GBA application or an application identifier; and sending a response to the application; and receiving, at the application, the response from the GBA application.