Security Key Generation for Dual Connectivity
Techniques for the secure generation of a set of encryption keys to be used for communication between a wireless terminal and an assisting base station in a dual-connectivity scenario. An example method includes generating an assisting security key for the assisting base station, based on an anchor base station key. The generated assisting security key is sent to the assisting base station, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal while the wireless terminal is dually connected to the anchor base station and the assisting base station. The anchor base station key, or a key derived from the anchor base station key, is used for encrypting data sent to the wireless terminal by the anchor base station.
1 . A method, in a network node, for security key generation for secured communications between a wireless terminal and an anchor base station and between the wireless terminal and an assisting base station, wherein the wireless terminal is or is about to be dually connected to the anchor base station and the assisting base station, the method comprising:
generating an assisting security key for the assisting base station, based, at least in part, on an anchor base station key;
sending, to the assisting base station, the generated assisting security key, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station; and
using the anchor base station key, or a key derived from the anchor base station key, for encrypting data sent to the wireless terminal by the anchor base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
2 . The method of claim 1 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
3 . The method of claim 2 , wherein using the anchor base station key comprises deriving an encryption key, or an integrity key, or both, from the anchor base station key, and using the derived key or keys for protecting data sent to the wireless terminal by the anchor base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
4 . A method, in a network node, for security key generation for secured communications between a wireless terminal and an anchor base station and between the wireless terminal and an assisting base station, wherein the wireless terminal is or is about to be dually connected to the anchor base station and the assisting base station, the method comprising:
sharing a primary security key with the wireless terminal;
generating an assisting security key for the assisting base station, based, at least in part, on the primary security key;
sending, to the assisting base station, the generated assisting security key, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
5 . The method of claim 4 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
6 . A network node for security key generation for secured communications between a wireless terminal and an assisting base station, wherein the wireless terminal is, or is about to be, dually connected to the anchor base station and the assisting base station, the network node comprising interface circuitry configured to communicate with the assisting base station and further comprising processing circuitry, characterized in that the processing circuitry is configured to:
generate an assisting security key for the assisting base station, based, at least in part, on an anchor base station key;
send to the assisting base station, using the interface circuitry, the generated assisting security key, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station; and
use the anchor base station key, or a key derived from the anchor base station key, for encrypting data sent to the wireless terminal by the anchor base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
7 . The network node of claim 6 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
8 . The network node of claim 7 , wherein the processing circuitry is configured to use the anchor base station key to derive an encryption key, or an integrity key, or both, from the anchor base station key, and to use the derived key or keys for protecting data sent to the wireless terminal by the anchor base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
9 . A network node for security key generation for secured communications between a wireless terminal and an assisting base station, wherein the wireless terminal is, or is about to be, dually connected to the anchor base station and the assisting base station, the network node comprising interface circuitry configured to communicate with the assisting base station and further comprising processing circuitry, characterized in that the processing circuit is configured to:
share a primary security key with the wireless terminal;
generate an assisting security key for the assisting base station, based, at least in part, on the primary security key; and
send to the assisting base station, via the interface circuitry, the generated assisting security key, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
10 . The network node of claim 9 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.