Methods and devices for security key renewal in a communication system

1. A method for security key renewal performed in a key management device of a communication system, the communication system comprising two or more communication devices communicating data packets by using a first security key for transmission and reception, the method comprising:

transmitting, to the two or more communication devices, a second security key for transmission and reception of the data packets;

after transmitting, to the two or more communication devices, the second security key for transmission and reception of the data packets, transmitting, to the two or more communication devices, an activation message for activating use of the second security key for reception of the data packets;

after transmitting, to the two or more communication devices, the activation message for activating use of the second security key for reception of the data packets, transmitting, to the two or more communication devices, an activation message for activating use of the second security key for transmission of the data packets;

transmitting, to the two or more communication devices, a deactivation message for deactivating use of the first security key for transmission of the data packets; and

transmitting, to the two or more communication devices, a deactivation message for deactivating use of the first security key for reception of the data packets.

2. The method as claimed in claim 1 , wherein the first security key comprises a first pair of security keys comprising a presently used security key for reception and a presently used security key for transmission of the data packets.

3. The method as claimed in claim 2 , wherein the second security key comprises a second pair of security keys comprising a renewed security key for reception and a renewed security key for transmission of the data packets.

4. The method as claimed in claim 2 , comprising awaiting acknowledgments from the two or more communication devices confirming the revoked use of the first security key for transmission of data packets, before transmitting the deactivation message for deactivating use of the first security key for reception of the data packets.

5. The method as claimed in claim 2 , wherein the transmitting of an activation message for activating use of the second security key for transmission of the data packets and transmitting a deactivation message for deactivating use of the first security key for transmission of the data packets, is performed in a single message.

6. The method as claimed in claim 1 , wherein the second security key comprises a second pair of security keys comprising a renewed security key for reception and a renewed security key for transmission of the data packets.

7. The method as claimed in claim 6 , wherein the transmitting of an activation message for activating use of the second security key for transmission of the data packets and transmitting a deactivation message for deactivating use of the first security key for transmission of the data packets, is performed in a single message.

8. The method as claimed in claim 1 , comprising awaiting acknowledgments from the two or more communication devices confirming reception of the second security key before transmitting the activation message for activating use of the second security key for reception of the data packets.

9. The method as claimed in claim 8 , wherein the transmitting of an activation message for activating use of the second security key for transmission of the data packets and transmitting a deactivation message for deactivating use of the first security key for transmission of the data packets, is performed in a single message.

10. The method as claimed in claim 1 , comprising awaiting acknowledgments from the two or more communication devices confirming the revoked use of the first security key for transmission of data packets, before transmitting the deactivation message for deactivating use of the first security key for reception of the data packets.

11. The method as claimed in claim 1 , wherein the transmitting of an activation message for activating use of the second security key for transmission of the data packets and transmitting a deactivation message for deactivating use of the first security key for transmission of the data packets, is performed in a single message.

12. A key management device in a communication system for security key renewal, the communication system comprising two or more communication devices communicating data packets by using a first security key for transmission and reception of the data packets, the key management device comprising a processor coupled to a memory configured to:

transmit, to the two or more communication devices, a second security key for reception and transmission of the data packets;

after transmitting, to the two or more communication devices, the second security key for transmission and reception of the data packets, transmit, to the two or more communication devices, an activation message for activating use of the second security key for reception of the data packets;

after transmitting, to the two or more communication devices, the activation message for activating use of the second security key for reception of the data packets, transmit, to the two or more communication devices, an activation message for activating use of the second security key for transmission of the data packets;

transmit, to the two or more communication devices, a deactivation message for deactivating use of the first security key for transmission of the data packets; and

transmit, to the two or more communication devices, a deactivation message for deactivating use of the first security key for reception of the data packets.

13. A method for security key renewal performed in a communication device of a communication system, the communication device communicating data packets by using a first security key for reception and transmission of the data packets, the communication system comprising a key management device, the method comprising:

receiving, from the key management device, a second security key for reception and transmission of data packets;

after receiving, from the key management device, the second security key for reception and transmission of data packets, activating use of the second security key for reception of the data packets, and committing in response thereto to use of the second security key for reception of data packets;

after activating use of the second security key for reception of the data packets, and committing in response thereto to use of the second security key for reception of data packets, activating use of the second security key for transmission of the data packets, and committing in response thereto to the use of the second security key for transmission of data packets;

deactivating use of the first security key for transmission of the data packets, and revoking in response thereto the use of the first security key for transmission; and

deactivating use of the first security key for reception of the data packets, and revoking in response thereto the use of the first security key for reception.

14. The method as claimed in claim 13 , wherein the activating use of the second security key for reception comprises receiving, from the key management device, an activation message for activating use of the second security key for reception of the data packets, and committing in response thereto to use of the second security key for reception of data packets.

15. The method as claimed in claim 13 , wherein the activating use of the second security key for transmission comprises receiving, from the key management device, an activation message for activating use of the second security key for transmission of the data packets, and committing in response thereto to the use of the second security key for transmission of data packets.

16. The method as claimed in claim 13 , wherein the deactivating use of the first security key for transmission comprises receiving, from the key management device, a deactivation message for deactivating use of the first security key for transmission of the data packets, and revoking in response thereto the use of the first security key for transmission.

17. The method as claimed in claim 13 , wherein the deactivating use of the first security key for reception comprises receiving, from the key management device, a deactivation message for deactivating use of the first security key for reception of the data packets, and revoking in response thereto the use of the first security key for reception.

18. A communication device of a communication system for security key renewal, the communication device communicating data packets by using a first security key for transmission and reception of the data packets, the communication system comprising a key management device, the communication device comprising a processor coupled to a memory configured to:

receive, from the key management device, a second security key for reception and transmission of data packets;

after receiving, from the key management device, the second security key for reception and transmission of data packets, activate use of the second security key for reception of the data packets, and committing in response thereto to use of the second security key for reception of data packets;

after activating use of the second security key for reception of the data packets, and committing in response thereto to use of the second security key for reception of data packets, activate use of the second security key for transmission of the data packets, and committing in response thereto to the use of the second security key for transmission of data packets;

deactivate use of the first security key for transmission of the data packets, and revoking in response thereto the use of the first security key for transmission; and

deactivate use of the first security key for reception of the data packets, and revoking in response thereto the use of the first security key for reception.

19. The communication device as claimed in claim 18 , comprising means configured to handle a respective security key for reception.

20. The communication device as claimed in claim 18 , comprising means configured to handle a respective security key for transmission.