Method and apparatus for dynamic data encryption in a communication system with forward secrecy
The disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. A method performed by a terminal for dynamic data encryption in a communication system is provided. The method includes receiving, from a network entity, a list of network public keys including a plurality of network public keys and corresponding key indexes, generating a pair of keys including a user equipment (UE) public key and a UE private key in response to receiving the list of network public keys, randomly selecting a network public key from the list of network public keys received from the network entity, generating a shared secret key corresponding to the UE by using the randomly selected network public key and the UE private key, and encrypting data to be transferred between the UE and the network entity by using the generated shared secret key corresponding to the UE.
1 . A method performed by a terminal for dynamic data encryption in a communication system, the method comprising:
receiving, from a network entity, a list of network public keys including a plurality of network public keys and corresponding key indexes;
updating previously stored network public keys with the list of network public keys;
generating a pair of keys including a user equipment (UE) public key and a UE private key in response to receiving the list of network public keys;
selecting, for each of a plurality of sessions, a network public key from the list of network public keys received from the network entity;
generating a shared secret key corresponding to the terminal by using the selected network public key and the UE private key;
encrypting data to be transferred between the terminal and the network entity by using the generated shared secret key corresponding to the terminal; and
transmitting, to the network entity, the UE public key and a key index corresponding to the selected network public key for enabling the network entity to generate a shared secret key corresponding to the network entity using the UE public key and the key index corresponding to the selected network public key.
2 . The method of claim 1 , wherein the list of network public keys is received over one of a secured communication channel or an unsecured communication channel.
3 . The method of claim 2 , wherein the receiving of the list of network public keys from the network entity over the secured communication channel comprises:
establishing a radio resource control (RRC) channel with the network entity; and
receiving, from the network entity, the list of network public keys using at least one of a registration accept message, an N1 message, and an RRC connection message.
4 . The method of claim 2 , wherein the receiving of the list of network public keys from the network entity over the unsecured communication channel comprises:
receiving, from the network entity, the list of network public keys signed with a digital signature using a network private key.
5 . The method of claim 1 , wherein the data to be transferred between the UE and the network entity corresponds to a subscription permanent identifier (SUPI).
6 . The method of claim 1 , wherein the list of network public keys corresponds to a list of temporary public keys of a network provided during subscriber identity module (SIM) provisioning.
7 . A method performed by a network entity for dynamic data encryption in a communication system, the method comprising:
transmitting, to a terminal, a list of network public keys including a plurality of network public keys and corresponding key indexes;
receiving, from the terminal, a user equipment (UE) public key and a key index corresponding to a network public key selected from the transmitted list of network public keys for each of a plurality of sessions, in response to the transmitted list of network public keys;
generating a shared secret key corresponding to the network entity using the UE public key and the key index corresponding to the network public key; and
encrypting data to be transferred between the terminal and the network entity by using the generated shared secret key corresponding to the network entity.
8 . The method of claim 7 , wherein the list of network public keys is transmitted over one of a secured communication channel or an unsecured communication channel.
9 . The method of claim 8 , wherein the transmitting of the list of network public keys over the secured communication channel comprises:
establishing a radio resource control (RRC) channel with the terminal; and
transmitting, to the terminal, the list of network public keys using at least one of a registration accept message, an N1 message, and an RRC connection message.
10 . A terminal, comprising:
a transceiver;
memory storing one or more computer programs; and
one or more processors communicatively coupled to the transceiver and the memory,
wherein the one or more computer programs include computer-executable instructions that, when executed by the one or more processors individually or collectively, cause the terminal to:
receive, from a network entity via the transceiver, a list of network public keys including a plurality of network public keys and corresponding key indexes,
update previously stored network public keys with the list of network public keys,
generate a pair of keys including a user equipment (UE) public key and a UE private key in response to receiving the list of network public keys,
select, for each of a plurality of sessions, a network public key from the list of network public keys received from the network entity,
generate a shared secret key corresponding to the terminal by using the selected network public key and the UE private key,
encrypt data to be transferred between the terminal and the network entity by using the generated shared secret key corresponding to the terminal, and
transmit, to the network entity via the transceiver, the UE public key and a key index corresponding to the selected network public key for enabling the network entity to generate a shared secret key corresponding to the network entity using the UE public key and the key index corresponding to the selected network public key.
11 . The terminal of claim 10 , wherein the list of network public keys is received over one of a secured communication channel or an unsecured communication channel.
12 . The terminal of claim 11 , wherein the one or more computer programs further include computer-executable instructions that, when executed by the one or more processors, cause the terminal to:
establish a radio resource control (RRC) channel with the network entity; and
receive, from the network entity, the list of network public keys using at least one of a registration accept message, an N1 message, and an RRC connection message.
13 . The terminal of claim 11 , wherein the one or more computer programs further include computer-executable instructions that, when executed by the one or more processors, cause the terminal to:
receive, from the network entity via the transceiver, the list of network public keys signed with a digital signature using a network private key.
14 . The terminal of claim 10 , wherein the data to be transferred between the UE and the network entity corresponds to a subscription permanent identifier (SUPI).
15 . The terminal of claim 10 , wherein the list of network public keys corresponds to a list of temporary public keys of a network provided during subscriber identity module (SIM) provisioning.
16 . A network entity, comprising:
a transceiver;
memory storing one or more computer programs; and
one or more processors communicatively coupled to the transceiver and the memory,
wherein the one or more computer programs include computer-executable instructions that, when executed by the one or more processors, cause the network entity to:
transmit, to a terminal via the transceiver, a list of network public keys including a plurality of network public keys and corresponding key indexes,
receive, from the terminal via the transceiver, a user equipment (UE) public key and a key index corresponding to a network public key selected from the transmitted list of network public keys for each of a plurality of sessions, in response to the transmitted list of network public keys,
generate a shared secret key corresponding to the network entity using the UE public key and the key index corresponding to the network public key, and
encrypt data to be transferred between the terminal and the network entity by using the generated shared secret key corresponding to the network entity.
17 . The network entity of claim 16 , wherein the list of network public keys is transmitted over one of a secured communication channel or an unsecured communication channel.
18 . The network entity of claim 17 , wherein the one or more computer programs further include computer-executable instructions that, when executed by the one or more processors, cause the network entity to:
establish a radio resource control (RRC) channel with the terminal; and
transmit, to the terminal, the list of network public keys using at least one of a registration accept message, an N1 message, and an RRC connection message.