Method, device, and system for updating anchor key in a communication network for encrypted communication with service applications

A method for key regeneration for encrypted communication between a terminal device and a service application in a communication network, the method performed by an application key management network node and comprising:

• in response to determining that the terminal device is subscribed to the encrypted communication with the service application as a subscribable security service:
• receiving a first request for an anchor key from the service application after the service application receives a communication request from the terminal device;
• determining that the anchor key being requested is invalid;
• and
• transmitting to the service application a response to the first request for the anchor key indicating that the anchor key being requested is invalid, causing the service application to transmit a second response to the terminal device indicating that the anchor key being requested is invalid and causing the terminal
• device to initiate a request for an authentication procedure with the communication network to obtain a replacement to the anchor key;
• and
• in response to determining that the terminal device is not subscribed to the subscribable security service with respect to another service application, enabling data exchange between the terminal device and the another service application without encryption;
• and
• wherein encrypted communications with the service applications are subscribable by the terminal device on a service application by service application basis as managed by the communication network and the service applications supporting the encrypted communications are registered with the communication network.

A terminal device comprising one or more processors and one or more memories, wherein the one or more processors are configured to read computer code from the one or more memories to:

• in response to determining that the terminal device is subscribed to an encrypted communication as a subscribable security service with a service application:
• detect that a first key for enabling encrypted communication with the service application previously generated from a first authentication of the terminal device with a communication network has become invalid;
• transmit a request for a second authentication to the communication network;
• generate a second key for enabling encrypted communication with the service application when the second authentication is successful;
• replace the first key with the second key;
• and
• exchange data with the service application based on the second key;
• and
• in response to determining that the terminal device is not subscribed to the subscribable security service with respect to another service application, exchanging data with the another service application without encryption,
• wherein the first key and the second key comprise, respectively, a first anchor key and a second anchor key, generated during the first authentication and the second authentication of the terminal device with the communication network, respectively;
• and
• wherein encrypted communications with the service applications are subscribable by the terminal device on a service application by service application basis as managed by the communication network and the service applications supporting the encrypted communications are registered with the communication network.