# US 11,445,367 B2 · Apparatus and method for managing security keys in wireless communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,445,367 B2 - Document ID: US11445367B2 - Status: Granted - Kind: B2 - Application number: 16/614,109 - Filed: 2018-05-15 - Published: 2021-05-27 - Granted: 2022-09-13 - Earliest claimed: 2017-05-15 - Assignees: Samsung Electronics Co., Ltd. - Applicants: Samsung Electronics Co., Ltd. - Inventors: Himke Vandervelde; Rajavelsamy Rajadurai; Jaehyuk Jang - Web page: https://patentgrep.com/patent/US11445367B2 ## CPC - H04W 12/0433: Key management protocols - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04W 12/041: Key generation or derivation - H04W 76/15: Setup of multiple wireless link connections - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure relates to a pre-5th-Generation (5G) or 5G communication system to be provided for supporting higher data rates Beyond 4th-Generation (4G) communication system such as Long Term Evolution (LTE). Disclosed is method of refreshing a security key in a secondary cell group (SCG) controlled by a secondary node (SN) of a wireless communication system, wherein the network is configured to operate in dual connectivity (DC) mode and further comprises a master cell group (MCG) controlled by a master node (MN) the method comprising: the SN indicating in a first message to a user equipment (UE) that security key refresh is to be performed; the UE generating the refreshed security key and transmitting a second message to the SN, wherein the second message indicates that the security key has been refreshed. ## Claims ### Claim 1 A method performed by a secondary node (SN) controlling a secondary cell group (SCG) in a wireless communication system, wherein the wireless communication system is configured to operate in dual connectivity (DC) mode and further comprises a master cell group (MCG) controlled by a master node (MN), the method comprising: transmitting, to a user equipment (UE), a first message informing that a security key refresh is to be performed; and receiving, from the UE, a second message indicating that a security key for the SN has been refreshed, wherein the security key for the SN is generated based on a counter value of the SN and a security key for the MN, wherein, at initialization, the MN provides an initial security key, and wherein the refreshed security key is generated by deriving the refreshed security key from a current security key. ### Claim 2 (depends on 1) The method of claim 1, wherein the first message comprises the counter value of the SN to be used in generating the refreshed security key. ### Claim 3 (depends on 1) The method of claim 1, wherein the counter value of the SN is different to a counter value of the MN. ### Claim 4 (depends on 1) The method of claim 1, wherein the MN provides the SN with a plurality of security keys in advance. ### Claim 5 (depends on 1) The method of claim 1, wherein the first message and second message are transparently forwarded by the MN. ### Claim 6 (depends on 1) The method of claim 1, wherein the first message and second messages are transferred via SCG Signaling Radio Bearers. ### Claim 7 (depends on 1) The method of claim 1, wherein the DC is new radio (NR)-NR mode. ### Claim 8 A method performed by a user equipment (UE) in a wireless communication system, wherein the wireless communication system is configured to operate in dual connectivity (DC) mode and further comprises a master cell group (MCG) controlled by a master node (MN) and a secondary cell group (SCG) controlled by a secondary node (SN), the method comprising: receiving, from the SN, a first message informing that a security key refresh is to be performed; and transmitting, to the SN, a second message indicating that a security key has been refreshed, wherein the security key for the SN is generated based on a counter value of the SN and a security key for the MN, wherein, at initialization, the MN provides an initial security key, and wherein the refreshed security key is generated by deriving the refreshed security key from a current security key. ### Claim 9 (depends on 8) The method of claim 8, wherein a presence of the counter value of the SN in the first message indicates that the security key is to be refreshed. ### Claim 10 (depends on 8) The method of claim 8, wherein the first message comprises the counter value of the SN to be used in generating the refreshed security key. ### Claim 11 (depends on 8) The method of claim 8, wherein the counter value of the SN is different to a counter value of the MN. ### Claim 12 (depends on 8) The method of claim 8, wherein the MN provides the SN with a plurality of security keys in advance. ### Claim 13 (depends on 8) The method of claim 8, wherein the first message and second message are transparently forwarded by the MN. ### Claim 14 (depends on 8) The method of claim 8, wherein the DC is new radio (NR)-NR mode. ### Claim 15 A secondary node (SN) controlling a secondary cell group (SCG) in a wireless communication system, wherein the wireless communication system is configured to operate in dual connectivity (DC) mode and further comprises a master cell group (MCG) controlled by a master node (MN), the secondary node comprising: a transceiver; and at least one processor operably coupled to the transceiver, wherein the at least one processor is configured to: transmit, to a user equipment (UE), a first message informing that a security key refresh is to be performed, and receive, from the UE, a second message indicating that a security key has been refreshed, and wherein the security key for the SN is generated based on a counter value of the SN and a security key for the MN, wherein, at initialization, the MN provides an initial security key, and wherein the refreshed security key is generated by deriving the refreshed security key from a current security key. ### Claim 16 (depends on 15) The secondary node of claim 15, wherein the first message comprises the counter value of the SN to be used in generating the refreshed security key.