Method for deriving traffic encryption key

A method for generating at least one Traffic Encryption Key (TEK) for a mobile station and a base station in a wireless communication network, comprising:

• generating an Authorization Key (AK) context, wherein the AK context comprises at least one secret key shared between the mobile station and base station for protecting at least one message transmitted therebetween;
• obtaining an association of a service flow established between the mobile station and base station to transmit traffic data therebetween, wherein the association is identified by an identifier;
• obtaining a number associated with the TEK to be generated;
• and
• generating the TEK according to the secret key, the identifier and the number via a predetermined function, wherein the TEK is a secret key shared between the mobile station and the base station for encrypting or decrypting the traffic data.

A mobile station in a wireless communication network, comprising:

• a radio transceiver module;
• and
• a processor performing handover negotiation with a serving base station so as to handover communication services to a target base station by transmitting and receiving a plurality of handover negotiation messages via the radio transceiver module, updating a count value, generating an Authorization Key (AK) context comprising a plurality of secret keys shared with the target base station for protecting messages to be transmitted to the target base station, and transmitting the count value to at least one network device in the wireless communication network via the radio transceiver module,
• wherein the count value is used in AK context generation and capable of distinguishing between different generations of the AK context, and is relayed to the target base station via the network device.

A base station in a wireless communication network, comprising:

• one or more radio transceiver module;
• and
• a processor generating an Authorization Key (AK) context comprising at least one secret key shared with a mobile station, establishing an association of a service flow, obtaining a number, and generating at least one Traffic Encryption Key (TEK) according to the secret key, the number and an identifier associated with the association,
• wherein the service flow is established for traffic data transmission and reception with the mobile station via the radio transceiver, the number is associated with the TEK to distinguish between different generations of the TEK, and the TEK is a secret key shared with the mobile station for encrypting and/or decrypting the traffic data.