Granted Patent B2

US 12,592,919 · App. 17/904,691 · Granted Mar 31, 2026

Inventors: Sheeba Backia Mary Baskaran (Friedrichsdorf, DE); Andreas Kunz (Ladenburg, DE)

Assignee: Lenovo (Singapore) Pte. Ltd.

H04L63/083

Abstract

Claims (48)

1 . A method performed by a network entity in a cellular network, the method comprising:

generating a re-authentication key; and

transmitting the re-authentication key with a key set identifier (ID) in an extensible authentication protocol message, wherein the re-authentication key is generated using three or more of:

a public land mobile network (PLMN) ID;

a trusted gateway function ID;

a subscription permanent identifier (SUPI); or

a user equipment (UE) ID.

2 . The method of claim 1 , wherein transmitting the re-authentication key with the key set ID in the extensible authentication protocol message comprises transmitting the re-authentication key from an authentication server function to a security anchor functionality, the re-authentication key comprises a re-authentication root key, a domain-specific root key, or a serving network re-authentication key, and the re-authentication key is generated by a key derivation function of an authentication server function, or a home public land mobile network, or both.

3 . The method of claim 1 , wherein the re-authentication key is further generated using a separator that comprises “\0”, a length of a parameter comprises a length of each S parameter of a set of S parameters, and the set of S parameters comprises one or more of: the PLMN ID; a serving network name ID; a trusted network domain name ID; a trusted gateway function ID; the SUPI; a network access identifier; the UE ID; and the separator.

4 . The method of claim 1 , wherein a re-authentication integrity key is generated using one or more of the trusted gateway function ID, the UE ID, a re-authentication integrity key label, an anti-bidding down between architecture parameter, and a separator.

5 . The method of claim 1 , wherein a trusted access point key or re-authentication master session key is generated using one or more of a trusted access point ID, trusted access point information, a trusted access point mobility counter, an anti-bidding down between architecture parameter, and a separator.

6 . The method of claim 1 , wherein the re-authentication key is generated by a key derivation function of an authentication server function, or a home public land mobile network, or both.

7 . A network entity in a cellular network, the network entity comprising:

at least one memory; and

at least one processor coupled with the at least one memory and configured to cause the network entity to:

generate a re-authentication key; and

transmit the re-authentication key with a key set identifier (ID) in an extensible authentication protocol message, wherein the re-authentication key is generated using three or more of:

a public land mobile network (PLMN) ID;

a trusted gateway function ID;

a subscription permanent identifier (SUPI); or

a user equipment (UE) ID.

8 . The network entity of claim 7 , wherein the at least one processor is configured to cause the network entity to transmit the re-authentication key from an authentication server function to a security anchor functionality, the re-authentication key comprises one or more of a re-authentication root key, a domain-specific root key, or a serving network re-authentication key, and the re-authentication key is generated by a key derivation function of an authentication server function, and a home public land mobile network.

9 . The network entity of claim 7 , wherein the re-authentication key is further generated using a separator comprising comprises “\0”, a length of a parameter comprises a length of each S parameter of a set of S parameters, and the set of S parameters comprises one or more of: the PLMN ID; a serving network name ID; a trusted network domain name ID; a trusted gateway function ID; the SUPI ID; a network access ID; the UE ID; and the separator.

10 . The network entity of claim 7 , wherein a re-authentication integrity key is generated using one or more of the trusted gateway function ID, the UE ID, a re-authentication integrity key label, an anti-bidding down between architecture parameter, and a separator.

11 . The network entity of claim 7 , wherein a trusted access point key or re-authentication master session key is generated using one or more of a trusted access point ID, trusted access point information, a trusted access point mobility counter, an anti-bidding down between architecture parameter, and a separator.

12 . The network entity of claim 7 , wherein the re-authentication key is generated by a key derivation function of an authentication server function, or a home public land mobile network, or both.

13 . The network entity of claim 7 , wherein the re-authentication key comprises a re-authentication root key, a domain-specific root key, or a serving network re-authentication key.

14 . A processor for cellular network communication, the processor comprising:

at least one controller coupled with at least one memory and configured to cause the processor to:

generate one or more of a re-authentication root key, a serving network re-authentication key, a re-authentication integrity key, an access point key, and a re-authentication master session key using three or more of:

a public land mobile network (PLMN) identifier (ID);

a trusted gateway function ID;

a subscription permanent identifier (SUPI);

a user equipment (UE) ID;

a re-authentication integrity key label;

an anti-bidding down between architecture parameter;

a trusted access point ID;

trusted access point information; or

a trusted access point mobility counter; and

transmit one or more of the re-authentication root key, the serving network re-authentication key, the re-authentication integrity key, the access point key, or the re-authentication master session key to the UE.

15 . The processor of claim 14 , wherein the at least one controller is configured to cause the processor to generate the re-authentication root key after a successful primary authentication.

16 . The processor of claim 14 , wherein the at least one controller is configured to cause the processor to generate the re-authentication integrity key during re-authentication and to generate the access point key, or the re-authentication master session key, or both during re-authentication or in response to a re-authentication request.

17 . The processor of claim 14 , wherein the re-authentication master session key is further generated using a separator that comprises “\0”, a length of a parameter comprises a length of each S parameter of a set of S parameters, and the set of S parameters comprises one or more of: the PLMN ID; a serving network name ID; a trusted network domain name ID; a trusted gateway function ID; the subscription permanent ID; a network access ID; the UE ID; the separator; the re-authentication integrity key label; the anti-bidding down between architecture parameter; the trusted access point ID; the trusted access point information; and the trusted access point mobility counter.

18 . The processor of claim 14 , wherein the at least one controller is configured to cause the processor to receive a re-authentication key set ID, trusted access point identification information, and trusted gateway function identification information in an extensible authentication protocol success message;

receive an extensible authentication protocol initiate re-authentication start message along with a target trusted access point ID; and

transmit a registration request to a target trusted access point with the re-authentication key set ID, wherein the registration request is transmitted in an extensible authentication protocol initiate request or a re-authentication request.

19 . The processor of claim 14 , wherein one or more of the re-authentication root key, the serving network re-authentication key, the re-authentication integrity key, the access point key, and the re-authentication master session key is generated by a key derivation function of an authentication server function, or a home public land mobile network, or both.

20 . The processor of claim 14 , wherein one or more of the re-authentication root key, the serving network re-authentication key, the re-authentication integrity key, the access point key, and the re-authentication master session key comprises a domain-specific root key.

Assignments (1)

Continuity (2)

References Cited (14)