# US 11,445,370 B2 · Method and device for verifying key requester > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,445,370 B2 - Document ID: US11445370B2 - Status: Granted - Kind: B2 - Application number: 16/453,833 - Filed: 2019-06-26 - Published: 2019-10-17 - Granted: 2022-09-13 - Earliest claimed: 2016-12-30 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: He Li; Jing Chen - Web page: https://patentgrep.com/patent/US11445370B2 ## CPC - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3247: {involving digital signatures} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 9/40: Network security protocols - H04W 12/062: Pre-authentication - H04W 12/069: using certificates or pre-shared keys - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and device for verifying a key requester are described. The method may include a security function entity receiving a request message sent by a user management function (UMF) entity. The method may also include decrypting information in the request message by using a private key of the security function entity, and obtaining the information carried in the request message after signature verification on decrypted information using a public key in a certificate of the UMF entity succeeds. Furthermore, the method may include determining to provide a key of a user equipment (UE) for the UMF entity, when determining that a first verification parameter carried in the request message is valid and determining that an identifier which is of the UMF entity and which is carried in the request message is the same as an identifier of a UMF entity to which the UE attaches. ## Claims ### Claim 1 A method for verifying a key requester, comprising: receiving, by a security function entity, a request message sent by a first core-network network element, wherein the request message carries an identifier of the first core-network network element, identity information of a user equipment (UE), and a first token; and determining, by the security function entity, to provide a key for the first core-network network element when determining, based on the identifier of the first core-network network element and the identity information of the UE, that the first token is valid, wherein before the receiving, by the security function entity, the request message sent by the first core-network network element, the method further comprises: generating, by the security function entity, a first fresh parameter; and sending, by the security function entity, the first fresh parameter to a second core-network network element, wherein the second core-network network element generate the first token based on the identifier of the first core-network network element to which the UE attaches, the identity information of the UE, the first fresh parameter, and a shared key. ### Claim 2 (depends on 1) The method according to claim 1, wherein the shared key is generated by the security function entity and sent by the security function entity to the second core-network network element, or the shared key is generated by the security function entity and the second core-network network element individually. ### Claim 3 (depends on 1) The method according to claim 1, wherein the determining, by the security function entity based on the identifier of the first core-network network element and the identity information of the UE, that the first token is valid comprises: generating, by the security function entity, a second token based on the identifier of the first core-network network element, the identity information of the UE, the first fresh parameter corresponding to the first core-network network element, and the shared key; and determining that the first token is valid when determining that the first token is the same as the second token. ### Claim 4 (depends on 1) The method according to claim 1, wherein the first token is generated by a second core-network network element using a private key of the second core-network network element, the identifier of the first core-network network element to which the UE attaches, the identity information of the UE, and a second fresh parameter. ### Claim 5 (depends on 1) The method according to claim 1, wherein the determining, by the security function entity based on the identifier of the first core-network network element and the identity information of the UE, that the first token is valid comprises: sending, by the security function entity, the identity information of the UE, the first token, and the identifier of the first core-network network element to the second core-network network element; and receiving, by the security function entity, a response message returned by the second core-network network element, wherein the response message is used to indicate that the first token is valid, and the response message is returned after the second core-network network element generates a second token based on the identity information of the UE, the identifier of the first core-network network element, a second fresh parameter corresponding to the identity information of the UE, and a private key of the second core-network network element that are provided by the security function entity, and determines that the first token is the same as the second token. ### Claim 6 A device for verifying a key requester, comprising: a transceiver, configured to receive a request message sent by a first core-network network element, wherein the request message carries an identifier of the first core-network network element, identity information of a user equipment (UE), and a first token; and at least one processor in communication with a memory storing one or more instructions, wherein the processor executes the instructions to: determine to provide a key for the first core-network network element when determining, based on the identifier of the first core-network network element and the identity information of the UE, that the first token is valid wherein the device further comprises: the at least one processor configured to: generate a first fresh parameter before receiving the request message sent by the first core-network network element; and the transceiver configured to: send the first fresh parameter to a second core-network network element, wherein the second core-network network element generates the first token based on the identifier of the first core-network network element to which the UE attaches, the identity information of the UE, the first fresh parameter, and a shared key. ### Claim 7 (depends on 6) The device according to claim 6, wherein the shared key is generated by the device and sent by the device to the second core-network network element, or the shared key is generated by the device and the second core-network network element individually. ### Claim 8 (depends on 6) The device according to claim 6, wherein the at least one processor is configured to: generate a second token based on the identifier of the first core-network network element, the identity information of the UE, the first fresh parameter corresponding to the first core-network network element, and the shared key; and determine that the first token is valid when determining that the first token is the same as the second token. ### Claim 9 (depends on 6) The device according to claim 6, wherein the first token is generated by a second core-network network element using a private key of the second core-network network element, the identifier of the first core-network network element to which the UE attaches, the identity information of the UE, and a second fresh parameter. ### Claim 10 (depends on 6) The device according to claim 6, further comprising the transceiver configured to: send the identity information of the UE, the first token, and the identifier of the first core-network network element to the second core-network network element; and receive a response message returned by the second core-network network element, wherein the response message is used to indicate that the first token is valid, and the response message is returned after the second core-network network element generates a second token based on the identity information of the UE, the identifier of the first core-network network element, a second fresh parameter corresponding to the identity information of the UE, and a private key of the second core-network network element that are provided by the device, and determines that the first token is the same as the second token.