Techniques for deriving security keys for a cellular network based on performance of an extensible authentication protocol (EAP) procedure
Techniques are described for wireless communication. A method for wireless communication at a user equipment (UE) includes performing an extensible authentication protocol (EAP) procedure with an authentication server via an authenticator. The EAP procedure is based at least in part on a set of authentication credentials exchanged between the UE and the authentication server. The method also includes deriving, as part of performing the EAP procedure, a master session key (MSK) and an extended master session key (EMSK) that are based at least in part on the authentication credentials and a first set of parameters; determining a network type associated with the authenticator; and performing, based at least in part on the determined network type, at least one authentication procedure with the authenticator. The at least one authentication procedure is based on an association of the MSK or the EMSK with the determined network type.
1. A method for wireless communication at a cellular network having a network type, comprising:
receiving, from an authentication server, a first security key based at least in part on at least one of a master session key (MSK) or an extended master session key (EMSK) and based at least in part on an association of the MSK or the EMSK with the network type, wherein the at least one of the MSK or the EMSK is derived at the authentication server according to an extensible authentication protocol (EAP) procedure between the authentication server and a user equipment (UE) based at least in part on one or more authentication credentials and based at least in part on one or more parameters selected from the group consisting of: an identifier, a random number, a first network parameter, and a UE parameter; and
performing at least one authentication procedure with the UE based at least in part on the first security key.
2. The method of claim 1 , wherein performing the at least one authentication procedure with the UE comprises performing the at least one authentication procedure via an authenticator separate from the authentication server.
3. The method of claim 1 , wherein performing the at least one authentication procedure with the UE comprises performing the at least one authentication procedure via an authenticator separate from a security anchor function (SEAF).
4. The method of claim 1 , wherein the network type is a 3GPP network type, and wherein the first security key is based on an association of the EMSK with the 3GPP network type.
5. The method of claim 1 , wherein the network type is a non-3GPP network type, and wherein the first security key is based on an association of the MSK with the non-3GPP network type.
6. The method of claim 1 , wherein the network type is a 3GPP, and wherein the first security key is a session anchor key derived based on the EMSK and a second network parameter.
7. The method of claim 1 , wherein the at least one of the MSK or the EMSK is derived at the authentication server according to the EAP procedure based at least in part on the identifier, the random number, the first network parameter, and the UE parameter.
8. The method of claim 1 , further comprising:
deriving a second security key for a network node of the cellular network, the second security key based at least in part on the first security key and one or more second parameters; and
communicating with the UE via the network node based at least in part on the second security key.
9. An apparatus for wireless communication at a cellular network having a network type, comprising:
a processor; and
memory in electronic communication with the processor;
wherein the processor and the memory are configured to:
receive, from an authentication server, a first security key based at least in part on at least one of a master session key (MSK) or an extended master session key (EMSK) and based at least in part on an association of the MSK or the EMSK with the network type, wherein the at least one of the MSK or the EMSK is derived at the authentication server according to an extensible authentication protocol (EAP) procedure between the authentication server and a user equipment (UE) based at least in part on one or more authentication credentials and based at least in part on one or more parameters selected from the group consisting of: an identifier, a random number, a first network parameter, and a UE parameter; and
perform at least one authentication procedure with the UE based at least in part on the first security key.
10. The apparatus of claim 9 , wherein to perform the at least one authentication procedure with the UE, the processor and the memory are configured to perform the at least one authentication procedure via an authenticator separate from the authentication server.
11. The apparatus of claim 9 , wherein to perform the at least one authentication procedure with the UE, the processor and the memory are configured to perform the at least one authentication procedure via an authenticator separate from a security anchor function (SEAF).
12. The apparatus of claim 9 , wherein the network type is a 3GPP network type, and wherein the first security key is based on an association of the EMSK with the 3GPP network type.
13. The apparatus of claim 9 , wherein the network type is a non-3GPP network type, and wherein the first security key is based on an association of the MSK with the non-3GPP network type.
14. The apparatus of claim 9 , wherein the network type is a 3GPP, and wherein the first security key is a session anchor key derived based on the EMSK and a second network parameter.
15. The apparatus of claim 9 , wherein the at least one of the MSK or the EMSK is derived at the authentication server according to the EAP procedure based at least in part on the identifier, the random number, the first network parameter, and the UE parameter.
16. The apparatus of claim 9 , wherein the processor and the memory are configured to:
derive a second security key for a network node of the cellular network, the second security key based at least in part on the first security key and one or more second parameters; and
communicate with the UE via the network node based at least in part on the second security key.
17. A non-transitory computer-readable medium storing computer-executable code for wireless communication at a cellular network having a network type, the code executable by a processor to:
receive, from an authentication server, a first security key based at least in part on at least one of a master session key (MSK) or an extended master session key (EMSK) and based at least in part on an association of the MSK or the EMSK with the network type, wherein the at least one of the MSK or the EMSK is derived at the authentication server according to an extensible authentication protocol (EAP) procedure between the authentication server and a user equipment (UE) based at least in part on one or more authentication credentials and based at least in part on one or more parameters selected from the group consisting of: an identifier, a random number, a first network parameter, and a UE parameter; and
perform at least one authentication procedure with the UE based at least in part on the first security key.
18. The non-transitory computer-readable medium of claim 17 , wherein to perform the at least one authentication procedure with the UE, the code is executable by a processor to perform the at least one authentication procedure via an authenticator separate from the authentication server.
19. The non-transitory computer-readable medium of claim 17 , wherein to perform the at least one authentication procedure with the UE, the code is executable by a processor to perform the at least one authentication procedure via an authenticator separate from a security anchor function (SEAF).
20. The non-transitory computer-readable medium of claim 17 , wherein the network type is a 3GPP network type, and wherein the first security key is based on an association of the EMSK with the 3GPP network type.