Method and apparatus for handling keys used for encryption and integrity

A method, as executed in a service control node in a communication network comprising a plurality of service points, of providing keys for protecting communication between a terminal and said service points, the method comprising:

• establishing a basic key for the terminal and initializing a key version parameter corresponding to the terminal, to an initial value known by the service control node and the terminal, during a registration procedure when the terminal has entered the network;
• creating a modified key by applying a predetermined function to at least the basic key and the initial value of the key version parameter, when the terminal starts a communication session;
• sending the modified key to a first service point to which the terminal is attached, the modified key being usable to protect communication between the terminal and the first service point;
• after creating said modified key, updating said value of said key version by applying a predetermined scheme or algorithm to the initial value of said key version, said value of said key version thereby being updated in the same way as it is updated by the terminal;
• receiving a key request from a second service point to which the terminal is attached;
• creating a new modified key by applying said predetermined function to at least the basic key
• and said updated value of said key version parameter;
• sending the new modified key to the second service point, the new modified key being usable to protect communication between the terminal and the second service point.

An arrangement in a communication network comprising:

• a plurality of hardware service points;
• a service control node providing keys for protecting communication between a terminal and said service points, the service control node being configured to:
• establish a basic key for the terminal and initializing a key version parameter corresponding to the terminal, to an initial value known by the service control node and the terminal, during a registration procedure when the terminal has entered the network,
• create a modified key by applying a predetermined function to at least the basic key and the initial value of the key version parameter, when the terminal starts a communication session,
• send the modified key to a first service point to which the terminal is attached, the modified key being usable to protect communication between the terminal and the first service point,
• update said value of said key version to a new value obtained by applying a predetermined scheme or algorithm to the initial value of said key version, said value of said key version thereby being updated in the same way as it is updated by the terminal;
• receive a key request from a second service point to which the terminal is attached;
• create a new modified key by applying said predetermined function to at least the basic key and said updated value of said key version parameter;
• sending the new modified key to the second service point, the new modified key being usable to protect communication between the terminal and the second service point.