Management of public keys for verification of public warning messages
View Patent ↗Techniques are disclosed for managing one or more public keys used for verification of one or more messages transferred over a communication network associated with a public warning system. In one example, a method comprises the following steps. A computing device of a communication network obtains key material for at least one source of a message generated for a public warning system. The computing device also obtains an identity of the source. A public key is computed by the computing device from the key material and the identity of the source. The public key is thus useable by the computing device to verify a message received from the source that is digitally signed using a corresponding private key of the source. In one example, the computing device comprises user equipment.
1. A method, comprising:
obtaining, at a first computing device of a communication network, key material for at least one source of a message generated for a public warning system;
obtaining, at the first computing device, an identity of the source; and
computing, at the first computing device, a public key from the key material and the identity of the source such that the public key is useable by the first computing device to verify a message received from the source that is digitally signed using a corresponding private key of the source;
wherein the source comprises a cell broadcast entity of a public warning system infrastructure;
wherein the key material for the source is securely obtained by the first computing device from a second computing device of the communication network; and
wherein the second computing device comprises a key generation function that is authenticated by the first computing device to obtain a list of public warning system message sources with corresponding key material for each source.
2. The method of claim 1 , further comprising the first computing device obtaining a public key of the key generation function from a third computing device via a control plane message generated and transmitted by the third computing device.
3. The method of claim 2 , wherein the control plane message comprises a non-access stratum security mode command message.
4. The method of claim 2 , wherein the third computing device comprises a mobility management entity.
5. The method of claim 1 , wherein the first computing device comprises user equipment.
6. The method of claim 1 , wherein the identity of the source is non-securely obtained by the first computing device via a cell broadcast service message.
7. The method of claim 1 , wherein the message received from the source that is digitally signed using a corresponding private key of the source is a warning notification message.
8. An article of manufacture comprising a processor-readable storage medium storing one or more software programs which when executed by a processor associated with the first computing device perform the steps of the method of claim 1 .
9. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory to form a first computing device of a communication network, which is configured to:
obtain key material for at least one source of a message generated for a public warning system;
obtain an identity of the source; and
compute a public key from the key material and the identity of the source such that the public key is useable by the first computing device to verify a message received from the source that is digitally signed using a corresponding private key of the source;
wherein the source comprises a cell broadcast entity of a public warning system infrastructure;
wherein the key material for the source is securely obtained by the first computing device from a second computing device of the communication network; and
wherein the second computing device comprises a key generation function that is authenticated by the first computing device to obtain a list of public warning system message sources with corresponding key material for each source.
10. The apparatus of claim 9 , wherein the processor of the first computing device is further configured to obtain a public key of the key generation function from a third computing device via a control plane message generated and transmitted by the third computing device.
11. The apparatus of claim 10 , wherein the control plane message comprises a non-access stratum security mode command message.
12. The apparatus of claim 10 , wherein the third computing device comprises a mobility management entity.
13. The apparatus of claim 9 , wherein the first computing device comprises user equipment.
14. The apparatus of claim 9 , wherein the identity of the source is non-securely obtained by the first computing device via a cell broadcast service message.
15. The apparatus of claim 9 , wherein the message received from the source that is digitally signed using a corresponding private key of the source is a warning notification message.
16. The apparatus of claim 9 , wherein the key material comprises a public key expiration date.