Communication terminal, core network device, core network node, network node, and key deriving method
A communication terminal capable of preventing a reduction in security level that is caused at the time of establishing multiple connections via 3GPP Access and Non-3GPP Access. A communication terminal according to the present disclosure includes: a communication unit configured to communicate with gateway devices disposed in a preceding stage of a core network device via an Untrusted Non-3GPP Access; and a key derivation unit configured to derive a second security key used for security processing of a message transmitted using a defined protocol with the gateway device, from a first security key used for security processing of a message transmitted using a defined protocol with the core network device.
1. A communication terminal comprising:
at least one processor; and
at least one memory operatively coupled with the processor, wherein the at least one processor is configured to:
initiate registration in a network node over 3GPP access and Non-3GPP access; and
establish a first Non-Access Stratum (NAS) connection for the 3GPP access and a second NAS connection for the Non-3GPP access with the network node in a network,
wherein the first NAS connection is specified by a first parameter,
wherein the second NAS connection is specified by a second parameter,
wherein the first parameter and the second parameter are for NAS security,
wherein the first parameter is a first fixed value corresponding to the 3GPP access,
wherein the second parameter is a second fixed value corresponding to the Non-3GPP access, and
wherein the at least one processor is further configured to:
derive a first security key using at least the first fixed value;
derive a second security key using the first security key; and
protect a Radio Resource Control (RRC) message using the second security key.
2. The communication terminal according to claim 1 , wherein the first security key is derived using the first fixed value and a count value for NAS.
3. A method for a communication terminal, the method comprising:
initiating registration in a network node over 3GPP access and Non-3GPP access; and
establishing a first Non-Access Stratum (NAS) connection for the 3GPP access and a second NAS connection for the Non-3GPP access with the network node in a network,
wherein the first NAS connection is specified by a first parameter,
wherein the second NAS connection is specified by a second parameter,
wherein the first parameter and the second parameter are for NAS security,
wherein the first parameter is a first fixed value corresponding to the 3GPP access,
wherein the second parameter is a second fixed value corresponding to the Non-3GPP access, and
wherein the method further comprises:
deriving a first security key using at least the first fixed value;
deriving a second security key using the first security key; and
protecting a Radio Resource Control (RRC) message using the second security key.
4. The method according to claim 3 , wherein the first security key is derived using the first fixed value and a count value for NAS.