Security key generation for dual connectivity
Techniques for the secure generation of a set of encryption keys to be used for communication between a wireless terminal and an assisting base station in a dual-connectivity scenario. An example method includes generating ( 810 ) an assisting security key for the assisting base station, based on an anchor base station key. The generated assisting security key is sent ( 820 ) to the assisting base station, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal while the wireless terminal is dually connected to the anchor base station and the assisting base station. The anchor base station key, or a key derived from the anchor base station key, is used ( 830 ) for encrypting data sent to the wireless terminal by the anchor base station.
1. A method, in an anchor base station, for security key generation for secure communications between a wireless terminal and an assisting base station, wherein the wireless terminal is or is about to be dually connected to the anchor base station and the assisting base station, wherein a primary security key is known to the anchor base station and the wireless terminal, the method comprising:
generating an assisting security key for the assisting base station, based, at least in part, on the primary security key;
sending, to the assisting base station, the generated assisting security key, for use by the assisting base station in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
2. The method of claim 1 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
3. The method of claim 1 , wherein generating the assisting security key comprises deriving the assisting security key from the primary key using a one-way function.
4. The method of claim 3 , wherein the one-way function is an HMAC-SHA-256 cryptographic function, where HMAC denotes Hashed Message Authentication Code and SHA denotes Secure Hash Algorithm.
5. The method of claim 1 , wherein generating the assisting security key is further based on a freshness parameter.
6. An anchor base station for security key generation for secure communications between a wireless terminal and an assisting base station, wherein the wireless terminal is, or is about to be, dually connected to the anchor base station and the assisting base station, and wherein a primary security key is known to the anchor base station and the wireless terminal, the anchor base station comprising interface circuitry configured to communicate with the assisting base station and further comprising processing circuitry configured to:
generate an assisting security key for the assisting base station, based, at least in part, on the primary security key;
send to the assisting base station, via the interface circuitry, the generated assisting security key, for use by the assisting base station in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
7. The anchor base station of claim 6 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
8. The anchor base station of claim 6 , wherein the processing circuitry is configured to generate the assisting security key by deriving the assisting security key from the primary key using a one-way function.
9. The anchor base station of claim 8 , wherein the one-way function is an HMAC-SHA-256 cryptographic function, where HMAC denotes Hashed Message Authentication Code and SHA denotes Secure Hash Algorithm.
10. The anchor base station of claim 6 , wherein the processing circuitry is configured to generate the assisting security key based further on a freshness parameter.