Method and apparatus for security key generation for dual connectivity
Techniques for the secure generation of a set of encryption keys to be used for communication between a wireless terminal and an assisting base station in a dual-connectivity scenario. An example method includes generating an assisting security key for the assisting base station, based on an anchor base station key. The generated assisting security key is sent to the assisting base station, for use by the assisting base station in encrypting data traffic sent to the wireless terminal or in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal while the wireless terminal is dually connected to the anchor base station and the assisting base station. The anchor base station key, or a key derived from the anchor base station key, is used for encrypting data sent to the wireless terminal by the anchor base station.
1. A method in a wireless terminal, for security key generation for secured communications between the wireless terminal and an assisting base station, wherein the wireless terminal is dually connected to an anchor base station and the assisting base station, wherein a primary security key is known to the anchor base station and the wireless terminal, the method comprising:
generating an assisting security key, based on the primary security key and a freshness parameter, wherein the freshness parameter has been received in a Radio Resource Control message from the anchor base station; and
using the assisting security key in generating one or more additional assisting security keys for encrypting data traffic, wherein the data traffic is sent from the wireless terminal to the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
2. The method of claim 1 , wherein the generated assisting security key comprises a base assisting security key for use in generating one or more additional assisting security keys for encrypting data traffic sent to the wireless terminal by the assisting base station.
3. The method of claim 1 , wherein generating the assisting security key comprises deriving the assisting security key from the primary security key using a one-way function.
4. The method of claim 3 , wherein the one-way function is an HMAC-SHA-256 cryptographic function.
5. A wireless terminal, for security key generation for secured communications between the wireless terminal and an assisting base station, the wireless terminal comprising interface circuitry and processing circuitry, wherein the wireless terminal is configured to be dually connected to an anchor base station and the assisting base station, and wherein the processing circuitry is configured to:
generate an assisting security key, based on a primary security key which is known to the anchor base station and the wireless terminal and a freshness parameter received from the anchor base station in a Radio Resource Control message; and
use the assisting security key in generating one or more additional assisting security keys for encrypting data traffic, wherein the data traffic is sent from the wireless terminal to the assisting base station while the wireless terminal is dually connected to the anchor base station and the assisting base station.
6. The wireless terminal of claim 5 , wherein the processing circuitry is further configured to generate the assisting security key by deriving the assisting security key from the primary security key using a one-way function.
7. The wireless terminal of claim 6 , wherein the one-way function is an HMAC-SHA-256 cryptographic function.
8. The wireless terminal of claim 5 , further configured to store the freshness parameter in a memory of the wireless terminal.
9. The wireless terminal of claim 5 , further configured to store the primary security key and/or the assisting security key in a memory of the wireless terminal.