Anchor key generation method, device, and system
An anchor key generation method, device, and system, where the method includes generating, by a unified data management network element (UDM), an intermediate key based on a cipher key (CK), an integrity key (IK), and indication information regarding an operator; sending, by the UDM, the intermediate key to an authentication server function (AUSF); receiving, by the AUSF, the intermediate key; generating, by the AUSF, an anchor key based on the intermediate key; sending, by the AUSF, the anchor key to a security anchor function (SEAF); and generating, by the SEAF, a key (Kamf) based on the anchor key, where the Kamf is used to derive a 3 rd Generation Partnership Project (3GPP) key.
1. A method for generating an anchor key in a communication system, comprising:
generating, by a unified data management network element (UDM), an intermediate key based on a cipher key (CK), an integrity key (IK), and indication information regarding an operator;
sending, by the UDM, the intermediate key to an authentication server function (AUSF);
receiving, by the AUSF, the intermediate key;
generating, by the AUSF, the anchor key based on the intermediate key;
sending, by the AUSF, the anchor key to a security anchor function (SEAF); and
generating, by the SEAF, a key (Kamf) based on the anchor key, wherein the Kamf is used to derive a 3 rd Generation Partnership Project (3GPP) key,
wherein generating, by the AUSF, the anchor key based on the intermediate key comprises:
generating, by the AUSF, an extended master session key (EMSK′) based on the intermediate key;
generating, by the AUSF, a key (K left ) by truncating a bit of the EMSK′; and
obtaining, by the AUSF, the anchor key based on the K left and a service network identifier.
2. The method according to claim 1 , further comprising:
receiving, by the AUSF, the indication information from the SEAF; and
sending, by the AUSF, the indication information to the UDM.
3. The method according to claim 1 , wherein the indication information is configured to indicate the operator.
4. The method according to claim 1 , wherein the indication information comprises an access network identity and a serving network identity.
5. The method according to claim 1 , wherein the indication information indicates a serving network name.
6. The method according to claim 1 , wherein the 3GPP key comprises a non-access stratum (NAS) integrity protection key used to perform integrity protection on a NAS message.
7. The method according to claim 1 , further comprising generating, by the UDM, the CK and the IK based on a root key.
8. A communication system, comprising:
a unified data management network element (UDM);
an authentication server function (AUSF) coupled to the UDM; and
a security anchor function (SEAF) coupled to the AUSF,
wherein the UDM is configured to generate an intermediate key based on a cipher key (CK), an integrity key (IK), and indication information regarding an operator, and send the intermediate key to the AUSF,
wherein the AUSF is configured to:
receive the intermediate key;
generate an extended master session key (EMSK′) based on the intermediate key;
generate a key (K left ) by truncating a bit of the EMSK′;
obtain an anchor key based on the K left and a service network identifier; and
send the anchor key to the SEAF,
wherein the SEAF is configured to generate a key (Kamf) based on the anchor key, and wherein the Kamf is used to derive a 3 rd Generation Partnership Project (3GPP) key.
9. The communication system according to claim 8 , wherein the AUSF is further configured to receive the indication information from the SEAF and send the indication information to the UDM.
10. The communication system according to claim 8 , wherein the indication information comprises an access network identity and a serving network identity.
11. The communication system according to claim 8 , wherein the indication information is an operator type identifier.
12. The communication system according to claim 8 , wherein the indication information indicates a serving network name.
13. The communication system according to claim 8 , wherein the 3GPP key comprises a non-access stratum (NAS) integrity protection key used to perform integrity protection on a NAS message.
14. The communication system according to claim 8 , wherein the UDM is further configured to generate the CK and the IK based on a root key.
15. A method for generating an anchor key in a communication system, comprising:
receiving, by an authentication server function (AUSF), indication information regarding an operator from a security anchor function (SEAF);
sending, by the AUSF, the indication information to a unified data management network element (UDM);
receiving, by the AUSF, an intermediate key from the UDM, wherein the intermediate key is generated based on a cipher key (CK), an integrity key (IK), and the indication information regarding the operator; and
generating, by the AUSF, the anchor key based on the intermediate key, wherein the anchor key is used to derive a 3 rd Generation Partnership Project (3GPP) key,
wherein generating, by the AUSF, the anchor key based on the intermediate key comprises:
generating, by the AUSF, an extended master session key (EMSK′) based on the intermediate key;
generating, by the AUSF, a key (K left ) by truncating a bit of the EMSK′; and
obtaining, by the AUSF, the anchor key based on the K left and a service network identifier.
16. The method according to claim 15 , wherein the 3GPP key comprises a non-access stratum (NAS) integrity protection key used to perform integrity protection on a NAS message.
17. The method according to claim 15 , wherein the indication information comprises an access network identity and a serving network identity.
18. An apparatus, comprising:
a processor coupled to a transmitter and a receiver; and
a memory storing computer program instructions which, when executed by the processor, cause the apparatus to:
receive, via the receiver, indication information regarding an operator from a security anchor function (SEAF);
send, via the transmitter, the indication information to a unified data management network element (UDM);
receive, via the receiver, an intermediate key from the UDM, wherein the intermediate key is generated based on a cipher key (CK), an integrity key (IK), and the indication information regarding the operator; and
generate an anchor key based on the intermediate key, wherein the anchor key is used to derive a 3 rd Generation Partnership Project (3GPP) key wherein generating anchor key based on the intermediate key comprises:
generating an extended master session key (EMSK′) based on the intermediate key;
generating a key (K left ) by truncating a bit of the EMSK′; and
obtaining the anchor key based on the K left and a service network identifier.
19. The apparatus according to claim 18 , wherein the 3GPP key comprises a non-access stratum (NAS) integrity protection key used to perform integrity protection on a NAS message.
20. The apparatus according to claim 18 , wherein the indication information comprises an access network identity and a serving network identity.