Method, device, and system for updating anchor key in a communication network for encrypted communication with service applications
This disclosure generally relates to encrypted communication between terminal devices and service applications via a communication network. Such encrypted communication may be based on various hierarchical levels of encryption keys that are generated and managed by the communication network. Such encrypted communication and key management may be provided by the communication network to the terminal devices as a service that can be subscribed to. The various levels of encryption keys may be managed to improve flexibility of the communication network and to reduce potential security breaches.
1 . A method for key regeneration in a terminal device for encrypted communication between the terminal device and a service application in a communication network, comprising:
in response to determining that the terminal device is subscribed to the encrypted communication with the service application as a subscribable security service:
detecting that a first key for enabling encrypted communication with the service application previously generated from a first authentication of the terminal device with the communication network has become invalid;
transmitting a request for a second authentication to the communication network;
generating a second key for enabling encrypted communication with the service application when the second authentication is successful;
replacing the first key with the second key; and
exchanging data with the service application based on the second key;
and in response to determining that the terminal device is not subscribed to the subscribable security service with respect to another service application, exchanging data with the another service application without encryption,
wherein the first key and the second key comprise, respectively, a first anchor key and a second anchor key, generated during the first authentication and the second authentication of the terminal device with the communication network, respectively; and
wherein encrypted communications with service applications are subscribable by the terminal device on a service application by service application basis as managed by the communication network and the service applications supporting the encrypted communications are registered with the communication network.
2 . The method of claim 1 , wherein:
each of the first anchor key and second anchor key is configured to be managed by an application key service; and
each of the first anchor key and second anchor key is configured to function as a basis for a generation of an application key for encrypted communication between the terminal device and the service application.
3 . The method of claim 2 , wherein each of the first anchor key and the second anchor key is associated with a key expiration time period and a key identifier.
4 . The method of claim 1 , wherein the first key and the second key comprise a first application key and a second application key for encrypted communication between the terminal device and the service application.
5 . The method of claim 4 , wherein:
each of the first application key and the second application key are respectively generated from the first anchor key and the second anchor key when the first authentication and the second authentication are successful; and
wherein the first application key, the second application key, the first anchor key and the second anchor key are managed by an application key service offered by the communication network to the terminal device for subscription.
6 . The method of claim 5 , wherein at least one of the first anchor key, the second anchor key, the first application key, and the second application key is associated with a key expiration time period and a key identifier.
7 . The method of claim 1 , wherein detecting that the first key has become invalid comprises determining that the first key has expired according to a predetermined expiration time period.
8 . The method of claim 1 , wherein detecting that the first key has become invalid comprises determining that the first key cannot be identified.
9 . The method of claim 1 , wherein detecting that the first key has become invalid comprises:
transmitting a communication request to the service application comprising an identifier corresponding to the first key; and
receiving a response from the service application indicating the first key has become invalid; and
determining that the first key has become invalid based on the response from the service application.
10 . The method of claim 1 , wherein the request for the second authentication comprises a subscription concealed identifier (SUCI) for identifying the terminal device or a global unique temporary identifier (GUTI) with key set identifier indicating that a security context for the terminal device is invalid.
11 . The method of claim 1 , wherein transmitting the request for the second authentication is initiated when the terminal device is idle.
12 . The method of claim 1 , wherein the terminal device is in an active communication session and wherein transmitting the request for the second authentication is initiated by switching the terminal device into an idle state prior to completion of the active communication session or initiated after the terminal device completes the active communication session and switches to an idle state.
13 . The method of claim 1 , wherein the terminal device is in an active communication session and wherein transmitting the request for the second authentication is initiated after the terminal device completes the active communication session and switches to an idle state when the active communication session is emergency and high-priority, and is initiated without completion of the active communication session if the active communication session is not emergency and low-priority.
14 . The method of claim 1 , wherein the terminal device is in an active communication session and wherein transmitting the request for the second authentication is initiated after the terminal device completes the active communication session and switches to an idle state.
15 . A method for key regeneration for encrypted communication between a terminal device and a service application in a communication network, the method performed by an application key management network node and comprising:
in response to determining that the terminal device is subscribed to the encrypted communication with the service application as a subscribable security service:
receiving a first request for an anchor key from the service application after the service application receives a communication request from the terminal device;
determining that the anchor key being requested is invalid; and
transmitting to the service application a response to the first request for the anchor key indicating that the anchor key being requested is invalid, causing the service application to transmit a second response to the terminal device indicating that the anchor key being requested is invalid and causing the terminal
device to initiate a request for an authentication procedure with the communication network to obtain a replacement to the anchor key; and
in response to determining that the terminal device is not subscribed to the subscribable security service with respect to another service application, enabling data exchange between the terminal device and the another service application without encryption; and
wherein encrypted communications with the service applications are subscribable by the terminal device on a service application by service application basis as managed by the communication network and the service applications supporting the encrypted communications are registered with the communication network.
16 . The method of claim 15 , wherein the first request for the anchor key comprises a first identifier for the anchor key.
17 . The method of claim 16 , wherein determining that the anchor key being requested is invalid comprises:
determining that the anchor key corresponding to the first identifier is non-existent in the application key management network node;
transmitting a second request for the anchor key to an authentication network node wherein the second request comprises the first identifier;
receiving from the authentication network node a response indicating to the second request that the anchor key corresponding to the first identifier is invalid; and
determining that the anchor key being requested is invalid based on the response from the authentication network node.
18 . The method of claim 15 , wherein the anchor key being requested is associated with an expiration time period and the requested anchor key has become invalid due to an end of the expiration time period.
19 . The method of claim 15 , wherein the request for the authentication procedure comprises a subscription concealed identifier (SUCI) for identifying the terminal device or a global unique temporary identifier (GUTI) with key set identifier indicating that a security context for the terminal device is invalid.
20 . A terminal device comprising one or more processors and one or more memories, wherein the one or more processors are configured to read computer code from the one or more memories to:
in response to determining that the terminal device is subscribed to an encrypted communication as a subscribable security service with a service application:
detect that a first key for enabling encrypted communication with the service application previously generated from a first authentication of the terminal device with a communication network has become invalid;
transmit a request for a second authentication to the communication network;
generate a second key for enabling encrypted communication with the service application when the second authentication is successful;
replace the first key with the second key; and
exchange data with the service application based on the second key; and
in response to determining that the terminal device is not subscribed to the subscribable security service with respect to another service application, exchanging data with the another service application without encryption,
wherein the first key and the second key comprise, respectively, a first anchor key and a second anchor key, generated during the first authentication and the second authentication of the terminal device with the communication network, respectively; and
wherein encrypted communications with the service applications are subscribable by the terminal device on a service application by service application basis as managed by the communication network and the service applications supporting the encrypted communications are registered with the communication network.