Method, device, and system for application key generation and management in a communication network for encrypted communication with service applications
This disclosure generally relates to encrypted communication between terminal devices and service applications via a communication network. Such encrypted communication may be based on various hierarchical levels of encryption keys that are generated and managed by the communication network. Such encrypted communication and key management may be provided by the communication network to the terminal devices as a service that can be subscribed to. The various levels of encryption keys may be managed to improve flexibility of the communication network and to reduce potential security breaches.
1. A method for generating an application key by a terminal device for encrypted data transmission via a communication network between the terminal device and a service application, the method comprising:
generating an initial application key based on an anchor key;
sending an initial communication request to the service application;
receiving a response from the service application wherein the response is encrypted by the service application using the initial application key derived at the service application as an encryption key;
extracting a key seed from the response by decrypting the response using the initial application key as a decryption key;
generating the application key based on the anchor key, and additionally based on the key seed such that the application key is distinct from the initial application key; and
sending a data transmission request to the service application to establish an encrypted data communication session with the service application based on the application key.
2. The method of claim 1 , wherein, prior to generating the initial application key, the method further comprises:
generating a base authentication key upon successful completion of an authentication process for registering the terminal device with the communication network; and
generating the anchor key based on the base authentication key.
3. The method of claim 2 , further comprising:
obtaining a subscription data packet for a subscription of the terminal device to an application anchor key management service provided by the communication network; and
extracting from the subscription data packet a subscription dataset for the service application.
4. The method of claim 3 , wherein the subscription dataset comprises an identifier of an application key management network node in the communication network that is associated with the service application and the application anchor key management service.
5. The method of claim 4 , wherein generating the anchor key comprises generating the anchor key based on the base authentication key and further based on at least one of the identifier of the application key management network node, an identifier of a user network module associated with the terminal device, a type of the user network module, an authentication dataset generated during the authentication process for registering the terminal device with the communication network, and a component of the subscription dataset for the service application.
6. The method of claim 5 , wherein:
the authentication dataset comprises a random number generated in the authentication process for registering the terminal device with the communication network; and
generating the anchor key comprises generating the anchor key based on the base authentication key, and at least one of the identifier of the application key management network node and the random number.
7. The method of claim 6 , wherein the initial communication request to the service application comprises an initial identifier for the anchor key, and wherein the initial identifier for the anchor key comprises at least one of the identifier of the application key management network node and the random number.
8. The method of claim 7 wherein:
the key seed comprises a second random number generated by the application key management network node.
9. The method of claim 7 , wherein:
The key seed comprises a second random number and a second identifier for the anchor key generated by the application key management network node; and
generating the application key comprises generating the application key based on the anchor key and the second random number.
10. The method of claim 9 , wherein:
the second identifier for the anchor key generated by the application key management network node comprises the second random number and the identifier for the application key management network node; and
data transmission request comprises the second identifier for the anchor key.
11. The method of claim 3 , wherein generating the anchor key, the initial application key, or the application key is further based on a secure Hash algorithm.
12. A device comprising one or more processors and one or more memories, wherein the one or more processors are configured to read computer code from the one or more memories to:
generate an initial application key based on an anchor key;
send an initial communication request to a service application;
receive a response from the service application wherein the response is encrypted by the service application using the initial application key derived at the service application as an encryption key;
extract a key seed from the response by decrypting the response using the initial application key as a decryption key;
generate the application key based on the anchor key, and additionally based on the key seed such that the application key is distinct from the initial application key; and
send a data transmission request to the service application to establish an encrypted data communication session with the service application based on the application key.