DEVICES AND METHOD FOR MTC GROUP KEY MANAGEMENT

Abstract

In order to improve security upon distributing a group key, there is provided a gateway (20) to a core network for a group of MTC devices (10_1-10_n) communicating with the core network. The gateway (20) protects confidentiality and integrity of a group key, and distributes the protected group key to each of the MTC devices (10_1-10_n). The protection is performed by using: a key (Kgr) that is preliminarily shared between the gateway (20) and each of the MTC devices (10_1-10_n), and that is used for the gateway (20) to authenticate each of the MTC devices (10_1-10_n) as a member of the group; or a key (K_iwf) that is shared between an MTC-IWF (50) and each of the MTC devices (10_1-10_n), and that is used to derive temporary keys for securely conducting individual communication between the MTC-IWF (50) and each of the MTC devices (10_1-10_n).

Claims

1. A network node comprising: a memory storing instructions; and a processor configured to process the instructions to: receive key information from a server in response to a request to the server, generate, based on the key information, a group key shared by a group of User Equipment (UE)s, and send a group identification (ID), the group key, and an identifier of the group key toward the group of UEs, wherein the group key is encrypted.

2. The network node as claimed in claim 1, wherein the processor is configured to process the instructions to further: update the group key if a group member is removed from the group of UEs.

3. A method of a network node, the method comprising: receiving key information from a server in response to a request to the server; generating, based on the key information, a group key shared by a group of User Equipment (UE)s; and sending a group identification (ID), the group key, and an identifier of the group key toward the group of the UEs, wherein the group key is encrypted.

4. The method as claimed in claim 3, further comprising: updating the group key if a group member is removed from the group of UEs.

5. A User Equipment (UE) comprising: a memory storing instructions; and a processor configured to process the instructions to: form a group with other UEs, receive, from a network node, a group identification (ID), a group key, and an identifier of the group key, wherein the group key is encrypted, and share the group key with the other UEs.

6. The UE as claimed in claim 5, wherein the group key is updated if a group member is removed from the group.,

7. A method of a User Equipment (UE), the method comprising: forming a group with other UEs; receiving, from a network node, a group identification (ID), a group key, and an identifier of the group key, wherein the group key is encrypted; and sharing the group key with the other UEs.

8. The method as claimed in claim 7, wherein the group key is updated if a group member is removed from the group.

Description

BRIEF DESCRIPTION OF DRAWINGS

[0019] FIG. 1 is a block diagram showing a configuration example of a communication system according to an exemplary embodiment of the present invention.

[0020] FIG. 2 is a sequence diagram showing a first operation example of the communication system according to the exemplary embodiment.

[0021] FIG. 3 is a sequence diagram showing a second operation example of the communication system according to the exemplary embodiment.

[0022] FIG. 4 is a sequence diagram showing a third operation example of the communication system according to the exemplary embodiment.

[0023] FIG. 5 is a sequence diagram showing a fourth operation example of the communication system according to the exemplary embodiment.

[0024] FIG. 6 is a sequence diagram showing a fifth operation example of the communication system according to the exemplary embodiment.

[0025] FIG. 7 is a sequence diagram showing a sixth operation example of the communication system according to the exemplary embodiment.

[0026] FIG. 8 is a block diagram showing a configuration example of a MTC UE according to the exemplary embodiment.

[0027] FIG. 9 is a block diagram showing a configuration example of a group GW according to the exemplary embodiment.

[0028] FIG. 10 is a block diagram showing a configuration example of an HSS according to the exemplary embodiment.

[0029] FIG. 11 is a block diagram showing a configuration example of an MTC-IWF according to the exemplary embodiment.

DESCRIPTION OF EMBODIMENTS

[0030] Hereinafter, an exemplary embodiment of the present invention will be described with the accompany drawings.

[0031] In this exemplary embodiment, there will be proposed details for group keys derivation at a core network, key distribution to proper network nodes and UEs, key management and how the group keys are used for securing communication. Key derivation parameters can be either sent from an HSS (Home Subscriber Server) to an MTC-IWF, or from the MTC-IWF to the HSS. The derivation algorithms are available in the network node.

[0032] As shown in FIG. 1, a communication system according to this exemplary embodiment includes a core network (3GPP network), and one or more MTC UEs 10 which are UEs equipped for MTC and connect to the core network through a RAN (Radio Access Network). In this exemplary embodiment, the MTC UEs 10 are grouped to communicate with the core network. Note that while the illustration is omitted, the RAN is formed by a plurality of base stations (e.g., eNBs (evolved Node Bs)).

[0033] The MTC UE 10 attaches to the core network. The MTC UE 10 can host one or multiple MTC Applications. The corresponding MTC Applications in the external network are hosted on an SCS 60. The SCS 60 connects to the core network to communicate with the MTC UE 10.

[0034] Further, the core network includes an MME 30, an HSS 40 and an MTC-IWF 50 as a part of its network nodes. The MME 30 relays traffic between the RAN and the MTC-IWF 50. The HSS 40 manages subscription information on the MTC UEs 10, and the like. The MTC-IWF 50 serves as an entering point to the core network for the SCS 60, and if necessary, acquires the subscription information and the like from the HSS 40. The core network also includes, as other network nodes, an SGSN (Serving GPRS (General Packet Radio Service) Support Node), an MSC (Mobile Switching Centre) and the like. The SGSN and the MSC function as with the MME 30.

[0035] While the illustration is omitted in FIG. 1, the core network includes a gateway to the core network for the group of MTC UEs 10. Hereinafter, this gateway is referred to as “group GW” and denoted by the symbol 20. Typically, the group GW 20 distributes to each of the MTC UEs 10 a group key for securely conducting group communication between the group GW 20 and the group of MTC UEs 10. The group GW 20 can be either deployed in a network node or be an independent node.

[0036] Next, operation examples of this exemplary embodiment will be described in detail with reference to FIGS. 2 to 7. Note that configuration examples of the MTC UE 10, the group GW 20, the HSS 40 and the MTC-IWF 50 will be described later with reference to FIGS. 8 to 11.

1. Key distribution

[0037] Group communication requires the group GW 20 and group member of MTC UEs 10 share the same group key.

[0038] There are two options that the group GW 20 can obtain the group keys. One of options is a case where the group GW 20 itself derives the group key. There will be described later how to derive the group key. Another one of options is a case where the group GW 20 receives the group key from another network node. This exemplary embodiment further considers that whether the group GW 20 is configured at the MTC-IWF 50 or not.

(1) Case where the MTC-IWF 50 is not group GW 20 but shares the group key

[0039] In this case, as shown in FIG. 2, the HSS 40 derives the group key and sends it to the MTC-IWF 50 together with group ID in a Subscriber Information Response message (Steps Sla to Slc).

[0040] Alternatively, the MTC-IWF 50 derives the group key, when it has received the group ID and optionally key derivation parameters from the HSS 40 in the Subscriber Information Response message (Steps S2a to S2c).

[0041] The derived group key is sent, to the group GW 20 through the MME 30, together with the group ID and a KSI (Key Set Identifier) of the group key (Step S3).

[0042] Then, the group GW 20 distributes the group key to MTC UEs 10_1 to 10_n (n≥2) which are members of MTC group (Steps S4_1 to S4_n).

[0043] There are two ways to protect the group key upon the distribution to the MTC UEs 10_1 to 10_n.

[0044] One of ways is to use a pre-configured authentication used group key Kgr. The key Kgr is preliminarily shared between the group GW 20 and each of the MTC UEs 10_1 to 10_n, and used for the group GW 20 to authenticate each of the MTC UEs 10_1 to 10_n as a member of the MTC group.

[0045] Upon the authentication, each of the MTC UEs 10_1 to 10_n receives an Authentication Request message from the group GW 20, and then computes e.g., a RES (authentication response) with the key Kgr. Each of the MTC UEs 10_1 to 10_n sends to the group GW 20 an Authentication Response message containing the computed RES. The group GW 20 checks the received RES with the key Kgr, thereby authenticating each of the MTC UEs 10_1 to 10_n.

[0046] Upon the distribution, the group GW 20 encrypts the group key with the key Kgr to protect the confidentiality of group key, and also ensures the integrity of group key with the key Kgr. Each of the MTC UEs 10_1 to 10_n decrypts the received group key with the key Kgr, and also checks the integrity of the received group key with the key Kgr.

[0047] Another one of ways is to use a root key K_iwf. The root key K_iwf is shared between the MTC-IWF 50 and each of the MTC UEs 10_1 to 10_n, and used to derive temporary keys for securely conducting individual communication between the MTC-IWF 50 and each of the MTC UEs 10_1 to 10_n.

[0048] One of temporary keys is a confidentiality key for encrypting and decrypting messages transferred between the MTC-IWF and the MTC UE. Another one of temporary keys is an integrity key for checking the integrity of message transferred between the MTC-IWF and the MTC UE.

[0049] Upon the distribution, the group GW 20 encrypts the group key with the key K_iwf to protect the confidentiality of group key, and also ensures the integrity of group key with the key K_iwf. Each of the MTC UEs 10_1 to 10_n decrypts the received group key with the key K_iwf, and also checks the integrity of the received group key with the key K_iwf.

[0050] According to this exemplary embodiment, both of the confidentiality and integrity of group key is ensured upon the distribution to the group member, so that it is possible to greatly improve security compared with the above-mentioned PTL 1 and NPL 3.

(2) Case where the MTC-IWF 50 is the group GW 20

[0051] In this case, as shown in FIG. 3, the HSS 40 or an MTC-IWF 50A (which also serves as the group GW) derives the group key in a similar manner to FIG. 2 (Steps S11a to S12c).

[0052] Then, the MTC-IWF 50A distributes the group key to the MTC UEs 10_1 to 10_n in a similar manner to FIG. 2 (Steps S14_1 to S14_n).

(3) Case where the MTC-IWF 50 is not group GW 20 and does not need to share the group key

[0053] In this case, as shown in FIG. 4, the HSS 40 derives the group key and sends it to the MME 30 during UE authentication procedure in e.g., an Authentication Data Response message (Steps S21 and S22). In the case of including the group key in the Authentication Data Response message, it is possible to reduce the impact to communication protocols. This is because the Authentication Data Response message is the existing message transferred between typical MME and HSS.

[0054] The MME 30 can send the group key to the group GW 20 in a new message or include it in the forwarded trigger (Step S23).

[0055] The group key can be only activated after each of the MTC UEs 10_1 to 10_n is authenticated to the core network as the group member and individually. Thereafter, the MME 30 can also send the group key to the group GW 20 after it confirmed that each of the MTC UEs 10_1 to 10_n is authenticated as the group member and individually.

[0056] Then, the group GW 20 distributes the group key to the MTC UEs 10_1 to 10_n in a similar manner to FIG. 2 (Steps S24_1 to S24_n).

2. Key Derivation

[0057] For deriving the group key, the KDF (Key Derivation Function) defined in 3GPP TS 33.401 can be re-used.

[0058] There are four options of input parameter:

[0059] (1) the pre-configured key Kgr (in MTC UE and group GW);

[0060] (2) the key K_iwf that shared between MTC-IWF and MTC UE;

[0061] (3) Kasme defined in 3GPP TS 33.401; and

[0062] (4) random number.

[0063] Other parameters can be: internal group ID, group gateway ID, key derivation algorithm identifier, counter.

[0064] A lifetime value can be also generated when the new group keys are derived.

[0065] Key derivation parameters can be sent from the HSS 40 to the MTC-IWF 50 (or 50A), or from the MTC-IWF 50 (or 50A) to the HSS 40. The derivation algorithms are configured in the network node which derives the group key.

3. Key Management

[0066] The group key can be updated when:

[0067] the lifetime of the group key is expired;

[0068] a group member is deleted from the group;

[0069] the derivation parameter (e.g., the root key K_iwf) has been updated; or

[0070] derive and store new group keys before transit to inactive state.

[0071] Examples of key update procedure are shown in FIGS. 5 to 7.

(1) Case where the MTC-IWF 50 is not group GW 20 but shares the group key

[0072] In this case, as shown in FIG. 5, the HSS 40 updates the group key and sends it to the MTC-IWF 50 together with group ID in a Subscriber Information Update message (Steps S31a and S31b).

[0073] Alternatively, the MTC-IWF 50 updates the group key, and optionally retrieves key derivation parameters from the HSS 40 (Steps S32a and S32b).

[0074] The updated group key is sent, to the group GW 20 through the MME 30, together with the group ID and a KSI of the updated group key (Step S33).

[0075] Then, the group GW 20 re-distributes the updated group key to MTC UEs 10_1 to 10_n (Steps S34_1 to S34_n). At this time, the updated group key is protected by using the key Kgr or K_iwf.

(2) Case where the MTC-IWF 50 is the group GW 20

[0076] In this case, as shown in FIG. 6, the HSS 40 or the MTC-IWF 50A updates the group key in a similar manner to FIG. 5 (Steps S41a to S42b).

[0077] Then, the MTC-IWF 50A re-distributes the updated group key to the MTC UEs 10_1 to 10_n in a similar manner to FIG. 5 (Steps S44_1 to S44_n).

(3) Case where the MTC-IWF 50 is not group GW 20 and does not need to share the group key

[0078] In this case, as shown in FIG. 7, the HSS 40 updates the group key and sends it to the MME 30 in e.g., an Insert Subscriber Data message (Steps S51 and S52). In the case of including the updated group key in the Insert Subscriber Data message, it is possible to reduce the impact to communication protocols. This is because the Insert Subscriber Data is the existing message transferred between typical MME and HSS.

[0079] The MME 30 can send the updated group key to the group GW 20 in a new message (Step S53).

[0080] Then, the group GW 20 re-distributes the updated group key to the MTC UEs 10_1 to 10_n in a similar manner to FIG. 5 (Steps S54_1 to S54_n).

[0081] Next, configuration examples of the MTC UE 10, the group GW 20, the HSS 40 and the MTC-IWF 50 (50A) according to this exemplary embodiment will be described with reference to FIGS. 8 to 11.

[0082] As shown in FIG. 8, the MTC UE 10 includes a reception unit 11 that receives the protected group key from the group GW 20. The reception unit 11 can be configured by, for example, a transceiver which wirelessly conducts communication with the core network through the RAN, and a controller such as a CPU (Central Processing Unit) which controls this transceiver.

[0083] As show in FIG. 9, the group GW 20 includes at least a protection unit 21 and a distribution unit 22. The protection unit 21 protects the group key by using the key Kgr or K_iwf. The distribution unit 22 distributes the protected group key to the MTC UE 10. In the case where the HSS 40 or the MTC-IWF 50 (not the Group GW 20) derives the group key, the group GW 20 further includes a reception unit 23 that receives the group key from the HSS 40 or the MTC-IWF 50. The reception unit 23 also receives the updated group key. As a substitute for the reception unit 23, the group GW 20 may include a derivation unit 24 that derives the group key by using, as the key derivation parameters, the key Kgr, the key K_iwf, the Kasme or the random number. The derivation unit 24 also updates the group key. In either case, the protection unit 21 protects the updated group key by using the key Kgr or K_iwf, and the distribution unit 22 re-distributes the protected and updated group key. Note that these units 21 to 24 are mutually connected with each other through a bus or the like. These units 21 to 24 can be configured by, for example, transceivers which conduct communication with other nodes within the core network, and a controller such as a CPU which controls these transceivers.

[0084] As show in FIG. 10, the HSS 40 can include a derivation unit 41 and a send unit 42 in addition to elements of a typical HSS. The derivation unit 41 derives the group key by using, as the key derivation parameters, the key Kgr, the key K_iwf, the Kasme or the random number. The send unit 42 sends the group key to the group GW 20 and/or the MTC-IWF 50. The derivation unit 41 may update the group key, and the send unit 42 may send the updated group key to the group GW 20 and/or the MTC-IWF 50. Note that these units 41 and 42 are mutually connected with each other through a bus or the like. These units 41 and 42 can be configured by, for example, transceivers which conduct communication with other nodes within the core network, and a controller such as a CPU which controls these transceivers.

[0085] As show in FIG. 11, the MTC-IWF 50 (50A) can include a derivation unit 51 and a send unit 52 in addition to elements of a typical MTC-IWF. The derivation unit 51 derives the group key by using, as the key derivation parameters, the key Kgr, the key K_iwf, the Kasme or the random number. The send unit 52 sends the group key to the group GW 20 or the MTC UE 10. The derivation unit 51 may update the group key, and the send unit 52 may send the updated group key to the group GW 20 or the MTC UE 10. Note that these units 51 and 52 are mutually connected with each other through a bus or the like. These units 51 and 52 can be configured by, for example, transceivers which conduct communication with other nodes within the core network, and a controller such as a CPU which controls these transceivers.

[0086] Note that the present invention is not limited to the above-mentioned exemplary embodiment, and it is obvious that various modifications can be made by those of ordinary skill in the art based on the recitation of the claims.

[0087] This application is based upon and claims the benefit of priority from Japanese patent application No. 2013-158881, filed on Jul. 31, 2013, the disclosure of which is incorporated herein in its entirety by reference.

REFERENCE SIGNS LIST

[0088] 10, 101-10n MTC UE [0089] 11, 23 RECEPTION UNIT [0090] 20 Group GW [0091] 21 PROTECTION UNIT [0092] 22 DISTRIBUTION UNIT [0093] 24, 41, 51 DERIVATION UNIT [0094] 30 MME [0095] 40 HSS [0096] 42, 52 SEND UNIT [0097] 50, 50A MTC-IWF [0098] 60 SCS