Wireless Handoff Key Derivation via Segmented Master Transient Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless communication networks face challenges in maintaining secure and low-latency handoffs between access terminals and access points, as current methods either introduce security risks by sharing master keys or increase latency through repeated authentication processes.
Innovation Solution
A centralized key management scheme is implemented, where an authenticator generates and distributes new security keys based on a master transient key, access point identifier, and access terminal identifier, allowing secure communication without exposing the master key, and enabling access terminals to independently generate matching keys for new access points during handoffs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication process is repeated at each handoff, then security is maintained, but handoff latency increases to an unacceptable level
Solution Approach 1:
The patent segments the authentication process by separating long-term authentication (performed once during initial network attachment) from short-term key derivation (performed quickly during handoff). The master key is divided into multiple session keys, each valid for specific time periods or locations, allowing fast handoff without repeating full authentication.
Solution Approach 2:
The patent performs preliminary authentication and master key establishment during initial network attachment before handoff occurs. This preliminary action creates a foundation of security that enables rapid subsequent handoffs without repeating the entire authentication process, thus reducing handoff latency while maintaining security.
2Loss of time
If the master key is shared among access points to reduce latency, then handoff speed improves, but security is compromised if an access point is breached
Solution Approach 1:
The patent segments the master key into multiple separate session keys, each distributed to specific access points. This segmentation ensures that if one access point is compromised, the attacker only obtains one session key valid for a limited scope, not the entire master key or other session keys. This maintains security while enabling fast handoff through pre-distributed keys.
Solution Approach 2:
The patent implements local quality by giving each access point a specific session key tailored to its location and time of operation, rather than a universal master key. This localized key distribution maintains security boundaries while enabling efficient local handoff operations without exposing the overall system security.
3Reliability
If new security keys are generated and distributed for each handoff, then security is maintained, but communication overhead and latency increase
Solution Approach 1:
The patent implements periodic key derivation where session keys are generated at regular intervals or for predetermined time windows, rather than creating entirely new keys for every handoff event. This periodic approach reduces key management complexity while maintaining security, as keys can be pre-computed and cached for use during their validity period.
Solution Approach 2:
The patent uses key derivation functions to create session keys as cryptographic copies of the master key, rather than generating entirely new independent keys. This copying approach simplifies key management by maintaining a hierarchical relationship where session keys can be efficiently derived from the master key through deterministic algorithms, reducing the burden of key distribution and management.
Data Source
AI summary
A novel key management approach is provided for securing communication handoffs between a UE and two base stations. A UE establishes a secure communication session with a first base station based on a first master session key based on a master transient key. The UE obtains a second base station identifier associated with a second base station and sends a message associated with a handoff to either the first base station or the second base station. The UE generates a second master session key based on at least the master transient key and the second base station identifier. The second master session key is used for secure communications with the second base station in connection with an intra-authenticator handoff from the first base station to the second base station. The UE then moves the secure communication session to the second base station.