Security context handling in 5G during idle mode
The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.
1. A method for transferring a security context for a user equipment in an idle mode, the method implemented by one or more core network nodes in a core network of a wireless communication network, wherein the one or more core network nodes provide a source Access and Mobility Management Function, the method comprising:
receiving, from a target Access and Mobility Management Function, a request for a security context for the user equipment;
generating a new non-access stratum key responsive to determining that an operator specific policy is met; and
sending, responsive to the request, the new non-access stratum key and a key change indicator flag to the target Access and Mobility Management Function, the key change indicator flag set to a value indicating that a non-access stratum key has been changed.
2. The method of claim 1 wherein generating a new non-access stratum key comprises:
generating a key derivation parameter; and
generating the new non-access stratum key from a current non-access stratum key and the key derivation parameter.
3. The method of claim 1 further comprising sending, responsive to the request, a key derivation parameter used to generate the new non-access stratum key.
4. The method of claim 1 wherein the request for a security context is received from the target Access and Mobility Management Function in a context request message.
5. The method of claim 1 wherein the new non-access stratum key is sent to the target Access and Mobility Management Function in a context request response message.
6. The method of claim 1 wherein the non-access stratum key is a core network key.
7. A core network node in a core network of a wireless communication network, the core network node providing a source Access and Mobility Management Function, the core network node comprising:
an interface circuit for communicating with a target Access and Mobility Management Function in a core network of the wireless communication network; and
a processing circuit configured to:
receive, from the target Access and Mobility Management Function, a request for a security context for a user equipment;
generate a new non-access stratum key responsive to determining that an operator specific policy is met; and
send, responsive to request, the new non-access stratum key and a key change indicator flag to the target Access and Mobility Management Function, the key change indicator flag set to a value indicating that a non-access stratum key has been changed.
8. The core network node of claim 7 wherein the processing circuit is further configured to generate a new non-access stratum key by:
generating a key derivation parameter; and
generating the new non-access stratum key from a current non-access stratum key and the key derivation parameter.
9. The core network node of claim 8 wherein the processing circuit is further configured to send, responsive to the request, the key derivation parameter used to generate the new non-access stratum key.
10. The core network node of claim 7 wherein the processing circuit is further configured to receive the request for the security context in a context request message.
11. The core network node of claim 7 wherein the processing circuit is further configured to send the new non-access stratum key to the target Access and Mobility Management Function in context request response message.
12. The core network node of claim 7 wherein the non-access stratum key is a core network key.
13. A method implemented by a user equipment, during an idle mode, the method comprising:
sending, while in the idle mode, a registration message to a target Access and Mobility Management Function in a wireless communication network;
receiving from the target Access and Mobility Management Function, responsive to the sent registration message, a key change indicator flag indicating that a non-access stratum key has been changed based on an operator specific policy; and
generating, responsive to the key change indicator flag, a new non-access stratum key.
14. The method of claim 13 further comprising:
establishing, a new security context with the target Access and Mobility Management Function, the new security context including the new non-access stratum key; and
communicating with the target Access and Mobility Management Function using the new non-access stratum key.
15. The method of claim 13 wherein generating a new non-access stratum key comprises generating the new non-access stratum key using a current non-access stratum key and a key derivation parameter.
16. The method of claim 15 wherein the key derivation parameter comprises static information known to the user equipment and a source Access and Mobility Management Function.
17. The method of claim 15 wherein the key derivation parameter is received with the key change indicator flag.
18. The method of claim 13 wherein the new non-access stratum key is received in a security establishment message.
19. The method of claim 13 wherein the non-access stratum key is a core network key.
20. A user equipment in a wireless communication network, the user equipment comprising:
an interface circuit for communicating with a target Access and Mobility Management Function in a core network of the wireless communication network; and
a processing circuit configured to:
send, while in an idle mode, a registration message to the target Access and Mobility Management Function;
receive from the target Access and Mobility Management Function, responsive to the sent registration message, a key change indicator flag indicating that a non-access stratum key has been changed based on an operator specific policy; and
generate, responsive to the key change indicator flag, a new non-access stratum key.
21. The user equipment of claim 20 wherein the processing circuit is further configured to:
establish, a new security context with the target Access and Mobility Management Function, the new security context including the new non-access stratum key; and
communicate with the target Access and Mobility Management Function using the new non-access stratum key.
22. The user equipment of claim 20 wherein generating a new non-access stratum key comprises generating the new non-access stratum key using a current non-access stratum and a key derivation parameter.
23. The user equipment of claim 22 wherein the key derivation parameter comprises static information known to the user equipment and a source Access and Mobility Management Function.
24. The user equipment of claim 22 wherein the key derivation parameter is received with the key change indicator flag in a security mode command message.
25. The user equipment of claim 20 wherein the processing circuit is further configured to receive the key change indicator flag in a security establishment message.
26. The user equipment of claim 20 wherein the non-access stratum key is a core network key.