Application function key derivation and refresh

1. A non-transitory computer readable memory medium storing program instructions executable by processing circuitry to cause a user equipment device (UE) to:

communicate with an application function (AF) via a radio access network (RAN) using a first application function key (AF key), wherein the first AF key is associated with a lifetime;

determine that the first AF key has expired, including monitoring the lifetime of the first AF key and determining expiration of the lifetime of the first AF key;

derive a second AF key based on at least an Architecture for Authentication and Key Management for Applications (AKMA) anchor key (KAKMA) and a counter parameter;

transmit, after deriving the second AF key, a first message to an AKMA Anchor Function (AAnF), wherein the first message indicates expiration of the first AF key; and

communicate with the AF via the RAN using the second AF key.

2. The non-transitory computer readable memory medium of claim 1 ,

wherein, to determine that the first AF key has expired, the program instructions are further executable to cause the UE to:

receive, from an AKMA Anchor Function (AAnF), a first message, wherein the first message indicates expiration of the first AF key.

3. The non-transitory computer readable memory medium of claim 2 ,

wherein the first message includes the counter parameter, and wherein the counter parameter is incremented each time a new AF key associated with the first AF key is derived.

4. The non-transitory computer readable memory medium of claim 1 ,

wherein to determine expiration of the lifetime of the first AF key, the program instructions are further executable to cause the UE to:

determine that a duration of time since derivation of the first AF key has exceed a duration of time specified by the lifetime;

determine to revoke the first AF key; or

determine that the first AF key has been compromised.

5. The non-transitory computer readable memory medium of claim 1 ,

wherein the first message includes the counter parameter, and wherein the counter parameter is incremented each time a new AF key associated with the first AF key is derived.

6. The non-transitory computer readable memory medium of claim 1 ,

wherein the first message includes one or more of a KAKMA identifier (ID), an AF ID, or the first AF key.

7. The non-transitory computer readable memory medium of claim 1 ,

wherein, to derive the second AF key based on at least the KAKMA and the counter parameter, the program instructions are further executable to cause the UE to:

use a key derivation function (KDF) as specified in a 3GPP standard, wherein an input string to the KDF includes the counter parameter, wherein the counter parameter is one of a P0 or P1 parameter of the input string, and wherein the other of the P0 or P1 parameter is a fixed value.

8. The non-transitory computer readable memory medium of claim 7 ,

wherein, when the counter parameter is the P0 parameter of the input string, the P1 parameter of the input string is one of a first AF key identifier (ID) or the AF; and

wherein, when the counter parameter is the P1 parameter of the input string, the P0 parameter of the input string is one of a first AF key identifier (ID) or the AF.

9. The non-transitory computer readable memory medium of claim 1 ,

wherein the lifetime includes a duration of time from derivation that the first AF key is valid.

10. A network entity, comprising:

a memory; and

at least one processor in communication with the memory, wherein the at least one processor is configured to:

derive a first application function key (AF key) based on a request received from an application function (AF), wherein the first AF key is associated with a lifetime;

determine that the first AF key has expired, including monitoring the lifetime of the first AF key and determining expiration of the lifetime of the first AF key;

derive a second AF key based on at least an Architecture for Authentication and Key Management for Applications (AKMA) anchor key (KAKMA) and a counter parameter;

transmit, after deriving the second AF key, a first message to a user equipment device (UE) in communication with the AF, wherein the first message indicates expiration of the first AF key, wherein the first message includes the counter parameter, and wherein the counter parameter is incremented each time a new AF key associated with the first AF key is derived; and

notify the AF of the second AF key and associated lifetime.

11. The network entity of claim 10 ,

wherein, to derive the second AF key based on at least the KAKMA and the counter parameter, the at least one processor is further configured to:

use a key derivation function (KDF) as specified in a 3GPP standard, wherein an input string to the KDF includes the counter parameter, wherein the counter parameter is one of a P0 or P1 parameter of the input string, and wherein the other of the P0 or P1 parameter is a fixed value.

12. The network entity of claim 10 ,

wherein the at least one processor is configured to:

use a key derivation function (KDF) as specified in a 3GPP standard, wherein an input string to the KDF includes the counter parameter, wherein the counter parameter is one of a P0 or P1 parameter of the input string, and wherein the other of the P0 or P1 parameter is a fixed value; and

wherein, when the counter parameter is the P0 parameter of the input string, the P1 parameter of the input string is one of a first AF key identifier (ID) or the AF.

13. The network entity of claim 10 ,

wherein the at least one processor is configured to:

use a key derivation function (KDF) as specified in a 3GPP standard, wherein an input string to the KDF includes the counter parameter, wherein the counter parameter is one of a P0 or P1 parameter of the input string, and wherein the other of the P0 or P1 parameter is a fixed value; and

wherein, when the counter parameter is the P1 parameter of the input string, the P0 parameter of the input string is one of a first AF key identifier (ID) or the AF.

14. The network entity of claim 10 ,

wherein the lifetime includes a duration of time from derivation that the first AF key is valid.

15. A user equipment device (UE), comprising:

at least one antenna;

at least one radio, wherein the at least one radio is configured to perform cellular communication using at least one radio access technology (RAT); and

one or more processors coupled to the at least one radio, wherein the one or more processors and the at least one radio are configured to perform voice and/or data communications;

wherein the one or more processors are configured to cause the UE to:

communicate with an application function (AF) via a radio access network (RAN) using a first application function key (AF key), wherein the first AF key is associated with a lifetime, and wherein the lifetime includes a duration of time from derivation that the first AF key is valid;

determine that the lifetime of the first AF key has expired, including monitoring the lifetime of the first AF key and determining expiration of the lifetime of the first AF key;

derive a second AF key based on at least an Architecture for Authentication and Key Management for Applications (AKMA) anchor key (KAKMA) and a counter parameter;

transmit, after deriving the second AF key, a first message to an AKMA Anchor Function (AAnF), wherein the first message indicates expiration of the first AF key, wherein the first message includes the counter parameter, and wherein the counter parameter is incremented each time a new AF key associated with the first AF key is derived; and

communicate with the AF via the RAN using the second AF key.

16. The UE of claim 15 ,

wherein, to determine that the first AF key has expired, the one or more processors are further configured to cause the UE to:

receive, from an AKMA Anchor Function (AAnF), a first message, wherein the first message indicates expiration of the first AF key, wherein the first message includes the counter parameter, and wherein the counter parameter is incremented each time a new AF key associated with the first AF key is derived.

17. The UE of claim 15 ,

wherein, to

determine expiration of the lifetime of the first AF key, wherein to determine expiration of the lifetime of the first AF key, the one or more processors are further configured to cause the UE to:

determine that a duration of time since derivation of the first AF key has exceed a duration of time specified by the lifetime; or

determine to revoke the first AF key; or

determine that the first AF key has been compromised.

18. The UE of claim 15 ,

wherein, to derive the second AF key based on at least the KAKMA and the counter parameter, the one or more processors are further configured to cause the UE to:

use a key derivation function (KDF) as specified in a 3GPP standard, wherein an input string to the KDF includes the counter parameter, wherein the counter parameter is one of a P0 or P1 parameter of the input string, and wherein the other of the P0 or P1 parameter is a fixed value.

19. The UE of claim 18 ,

wherein, when the counter parameter is the P0 parameter of the input string, the P1 parameter of the input string is one of a first AF key identifier (ID) or the AF; and

wherein, when the counter parameter is the P1 parameter of the input string, the P0 parameter of the input string is one of a first AF key identifier (ID) or the AF.

20. The UE of claim 15 ,

wherein the lifetime includes a duration of time from derivation that the first AF key is valid.