Exchange of key material
AssigneeNokia Corporation
InventorsDan Forsberg, Lauri Tarkkala
Life of this patent
Estimating the term…
Abstract
A communication network manages key material. A method generates and provides session keys from a security node to an access node for further propagation during handoff procedures, without requiring the security node to take part in the handoff procedures.
Claims25
A method for a mobile terminal for a communications network, the method comprising the steps of:
- receiving a key from a security node:
- deriving a session key based at least on the key;
- and
- encrypting at least a part of a message with the session key for transmission of the message to an access node.
A method for an access node of a communications network, the method comprising the steps of:
- receiving session context information;
- extracting a session key from the session context information;
- decrypting the session key with a key associated with a security association between an access node and a security node of a communications network;
- and
- encrypting at least part of a message with the session key for transmission of the message to a mobile terminal.
A method for a security network element for a communications network, the method comprising the steps of:
- establishing a first security association with a first access node;
- establishing a second security association with a second access node;
- generating a first session key for communications between the first access node and a mobile terminal;
- generating a second session key for communications between the second access node and the mobile terminal;
- encrypting the first session key with a first key associated with the first security association;
- encrypting the second session key with a second key associated with the second security association;
- and
- transmitting the first and second keys to the first access node.
A mobile terminal for a communications network, the mobile terminal comprising:
- receiving means for receiving a key from a security node;
- deriving means for deriving a session key based on at least the keys;
- and
- encrypting means for encrypting at least a part of a message with the session key for transmission of the message to an access node.
An access node for a communications network, the access node comprising:
- first receiving means for receiving session context information, extracting means for extracting a session key from the session context information;
- first decrypting means for decrypting the session key with a key associated with a security association between an access node and a security node of a communications network;
- and
- encrypting means for encrypting at least part of a message with the session key for transmission of the message to a mobile terminal.
A security node for a communications network, the security node comprising:
- establishing means for establishing a security association with an access node;
- and
- first generating means for generating a session key for communications between the access node and a mobile terminal;
- first encrypting means for encrypting the session key with a key associated with the security association with the access node;
- first transmitting means for transmitting the session key to the access node.
A method for handoff between a first access node and a second access node in a communications network, the method comprising the steps of:
- receiving a handoff request from a mobile terminal by a second access node;
- transmitting a session context request by the second access node to a first access node;
- transmitting session context information from the first access node to the second access node;
- extracting a session key from the session context information by the second access node;
- decrypting the session key with a key associated with a security association between the second access node and a security node of the communications network;
- encrypting at least part of a message with the session key for transmission of the message to the mobile terminal;
- and
- transmitting the message to the mobile terminal.
A computer program embodied on a computer-readable medium, the computer program configured to control a computer to perform the steps of:
- receiving a key from a security node;
- deriving a session key based on at least the key;
- and
- encrypting at least a part of a message with the session key for transmission of the message to an access node.
A computer program embodied on a computer-readable medium, the computer program configured to control a computer to perform the steps of:
- receiving session context information;
- extracting a session key from the session context information;
- decrypting the session key with a key associated with a security association between an access node and a security node of a communications network;
- and
- encrypting at least a part of a message with the session key for transmission of the message to a mobile terminal.
A computer program embodied on a computer-readable medium, the computer program configured to control a computer to perform the steps of:
- establishing a first security association with a first access node,
- establishing a second security association with a second access node;
- generating a first session key for communications between the first access node and a mobile terminal;
- generating a second session key for communication between the second access node and the mobile terminal;
- encrypting the first session key with a first key associated with the first security association;
- encrypting the second session key with a second key associated with the second security association;
- and
- transmitting the first and second keys to the first access node.
An access node for a communications network, the access node comprising:
- a receiver for receiving session context information, an extractor for extracting a session key from the session context information;
- a decryptor for decrypting the session key with a key associated with a security association between an access node and a security node of a communications network;
- and
- an encryptor for encrypting at least part of a message with the session key for transmission of the message to a mobile terminal.
A security node for a communications network, the security node comprising:
- a processor for establishing a security association with an access node;
- and
- a session key generator for generating a session key for communications between the access node and a mobile terminal;
- an encryptor for encrypting the session key with a key associated with the security association with the access node;
- a transmitter for transmitting the session key to the access node.
Dependencies are inferred from the claim text.