Traffic encryption key generation in a wireless communication network

1. A method of generating a traffic encryption key, comprising:

receiving, at a base station, a message indicating that a mobile may handoff to the base station, the message including a count value, the count value indicative of network accesses by the mobile; and

generating a traffic encryption key based on a function having as input the count value associated with the mobile and a key count, the key count being set to an initial value in response to receipt of the message, the traffic encryption key for use encrypting communication traffic between the mobile and the base station.

2. The method of claim 1 , further comprising:

updating the traffic encryption key by generating the traffic encryption key using an updated key count.

3. The method of claim 2 , further comprising:

receiving the updated key count from the mobile.

4. The method of claim 2 , further comprising:

determining a secret key; and wherein

the generating step generates the traffic encryption key based on the count value, the key count and the secret key.

5. The method of claim 4 , wherein the determining step determines the secret key from an access key unique to the base station generating the traffic encryption key.

6. The method of claim 5 , further comprising:

receiving the access key in the message.

7. The method of claim 1 , wherein the generating generates the traffic encryption key before the mobile hands off to the base station.

8. The method of claim 7 , further comprising:

initializing a key count in response to receipt of the message.

9. The method of claim 8 , further comprising:

receiving an updated key count from the mobile; and

updating the traffic encryption key by generating the traffic encryption key using the updated key count.

10. A method of generating a traffic encryption key, comprising:

receiving, at a base station, a message indicating that a mobile may handoff to the base station, the message including a count value, the count value indicative of network accesses by the mobile;

generating a traffic encryption key based on a function having as input the count value associated with the mobile, the traffic encryption key being used for encrypting communication traffic between the mobile and the base station, the traffic encryption key being generated before the mobile hands off to the base station;

receiving a packet having an associated integrity signature from the mobile; and

verifying whether to accept the integrity signature based on the generated traffic encryption key.

11. The method of claim 10 , further comprising:

when verified not to accept the integrity signature,

incrementing the count value;

generating a new traffic encryption key based on the incremented count value; and

verifying whether to accept the integrity signature based on the new traffic encryption key.

12. A method of generating a traffic encryption key, comprising:

receiving, at a base station, a message indicating that a mobile may handoff to the base station, the message including an access key unique to the base station and a count value, the count value indicative of network accesses by the mobile;

determining a secret key based on the access key;

initializing a key count in response to receipt of the message; and

generating a traffic encryption key based on a function having as input the count value, the key count and the secret key, the traffic encryption key for use encrypting communication traffic between the mobile and the base station, the traffic encryption key being generated before the mobile hands off to the base station.

13. The method of claim 12 , wherein the receiving receives the message from an authenticator associated with the base station.

14. A method of generating a traffic encryption key, comprising:

receiving, at a base station, a message indicating that a mobile may handoff to the base station, the message including an access key unique to the base station and a count value, the count value indicative of network accesses by the mobile;

determining a secret key based on the access key; and generating a traffic encryption key based on a function having as an input the count value and the secret key, the traffic encryption key for use encrypting communication traffic between the mobile and the base station, the traffic encryption key being generated before the mobile hands off to the base station.

15. A method of updating a traffic encryption key, comprising:

receiving a new key count at a base station from a mobile;

generating, in response to receiving the new key count, a new traffic encryption key based on a function having as input the new key count and a count value associated with the mobile, the count value indicative of network accesses by the mobile, the traffic encryption key for encrypting communication traffic between the mobile and a base station.

16. The method of claim 15 , wherein

the receiving receives an integrity signature with the new key count from the mobile; and further comprising,

determining a reference integrity signature based on the new traffic encryption key; and

verifying the new traffic encryption key is acceptable based on the integrity signature received from the mobile and the reference integrity key.

17. A method of updating a traffic encryption key, comprising:

receiving an integrity signature from a base station at a mobile;

determining a reference integrity signature based on a traffic encryption key, the traffic encryption key generated based on a function having as an input a count value associated with the mobile, the count value indicative of network accesses by the mobile, the traffic encryption key for encrypting communication traffic between the mobile and the base station; and

verifying the traffic encryption key is acceptable based on the integrity signature received from the base station and the reference integrity signature.