Communication terminal, core network device, core network node, network node, and key deriving method
A communication terminal capable of preventing a reduction in security level that is caused at the time of establishing multiple connections via 3GPP Access and Non-3GPP Access. A communication terminal according to the present disclosure includes: a communication unit configured to communicate with gateway devices disposed in a preceding stage of a core network device via an Untrusted Non-3GPP Access; and a key derivation unit configured to derive a second security key used for security processing of a message transmitted using a defined protocol with the gateway device, from a first security key used for security processing of a message transmitted using a defined protocol with the core network device.
1 . A method performed by a User Equipment (UE), the method comprising:
deriving a first security key based on at least a first fixed value of an access type distinguisher, wherein the first fixed value indicates 3 rd Generation Partnership Project (3GPP) access and is different from a second fixed value of the access type distinguisher indicating Non-3GPP access;
deriving a second security key based on the first security key; and
protecting a Radio Resource Control (RRC) message transmitted between the UE and the 3GPP access, based on the second security key,
wherein the first security key is derived using the first fixed value and a count value for Non Access Stratum (NAS).
2 . The method of claim 1 , wherein the first security key is K AMF .
3 . The method of claim 1 , wherein the second security key is at least one of K gNB , K RRCint , or K RRCenc .
4 . The method of claim 1 , wherein the first security key is K AMF and the second security key is K RRCint or K RRCenc , and
wherein the deriving the second security key based on the first security key comprises:
driving an intermediate key, K gNB , from K AMF , and
driving K RRCint or K RRCenc from the intermediate key, K gNB .
5 . A User Equipment (UE) comprising:
at least one memory configured to store instructions; and
at least one processor configured to execute the instructions to:
derive a first security key based on at least a first fixed value of an access type distinguisher, wherein the first fixed value indicates 3 rd Generation Partnership Project (3GPP) access and is different from a second fixed value of the access type distinguisher indicating Non-3GPP access, and
derive a second security key based on the first security key, and
protect a Radio Resource Control (RRC) message transmitted between the UE and the 3GPP access, based on the second security key,
wherein the first security key is derived using the first fixed value and a count value for Non Access Stratum (NAS).
6 . The UE of claim 5 , wherein the first security key is K AMF .
7 . The UE of claim 5 , wherein the second security key is at least one of K gNB , K RRCint , or K RRCenc .
8 . The UE of claim 5 , wherein the first security key is KAMF and the second security key is K RRCint or K RRCenc , and
wherein the deriving the second security key based on the first security key comprises:
driving an intermediate key, K gNB , from K AMF , and
driving K RRCint or K RRCenc from the intermediate key, K gNB .