DERIVING A KEY BASED ON AN EDGE ENABLER CLIENT IDENTIFIER

Apparatuses, methods, and systems are disclosed for deriving a key based on an edge enabler client identifier. One method includes receiving, at a network function, a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). The method includes deriving a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. The method includes transmitting a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID.

FIELD

The subject matter disclosed herein relates generally to wireless communications and more particularly relates to deriving a key based on an edge enabler client identifier.

BACKGROUND

In certain wireless communications networks, a derived key may be used for multiple edge configuration servers and/or edge enabler servers. The reuse of the derived key may result in security issues.

BRIEF SUMMARY

Methods for deriving a key based on an edge enabler client identifier are disclosed. Apparatuses and systems also perform the functions of the methods. One embodiment of a method includes receiving, at a network function, a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In some embodiments, the method includes deriving a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. In certain embodiments, the method includes transmitting a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID.

One apparatus for deriving a key based on an edge enabler client identifier includes a network function. In some embodiments, the apparatus includes a receiver that receives a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID). The EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In various embodiments, the apparatus includes a processor that derives a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. In certain embodiments, the apparatus includes a transmitter that transmits a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID.

Another embodiment of a method for deriving a key based on an edge enabler client identifier includes deriving, at a user equipment, a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID). In some embodiments, the method includes transmitting a request message to an edge server function. The request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In certain embodiments, the method includes receiving a response message from the edge server function. The response message includes a second KAFEECused by the edge server function.

Another apparatus for deriving a key based on an edge enabler client identifier includes a user equipment. In some embodiments, the apparatus includes a processor that derives a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID). In various embodiments, the apparatus includes a transmitter that transmits a request message to an edge server function. The request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In certain embodiments, the apparatus includes a receiver that receives a response message from the edge server function. The response message includes a second KAFEECused by the edge server function.

DETAILED DESCRIPTION

FIG.1depicts an embodiment of a wireless communication system100for deriving a key based on an edge enabler client identifier. In one embodiment, the wireless communication system100includes remote units102and network units104. Even though a specific number of remote units102and network units104are depicted inFIG.1, one of skill in the art will recognize that any number of remote units102and network units104may be included in the wireless communication system100.

The network units104may be distributed over a geographic region. In certain embodiments, a network unit104may also be referred to and/or may include one or more of an access point, an access terminal, a base, a base station, a location server, a core network (“CN”), a radio network entity, a Node-B, an evolved node-B (“eNB”), a 5G node-B (“gNB”), a Home Node-B, a relay node, a device, a core network, an aerial server, a radio access node, an access point (“AP”), new radio (“NR”), a network entity, an access and mobility management function (“AMF”), a unified data management (“UDM”), a unified data repository (“UDR”), a UDM/UDR, a policy control function (“PCF”), a radio access network (“RAN”), a network slice selection function (“NSSF”), an operations, administration, and management (“OAM”), a session management function (“SMF”), a user plane function (“UPF”), an application function, an authentication server function (“AUSF”), security anchor functionality (“SEAF”), trusted non-3GPP gateway function (“TNGF”), or by any other terminology used in the art. The network units104are generally part of a radio access network that includes one or more controllers communicably coupled to one or more corresponding network units104. The radio access network is generally communicably coupled to one or more core networks, which may be coupled to other networks, like the Internet and public switched telephone networks, among other networks. These and other elements of radio access and core networks are not illustrated but are well known generally by those having ordinary skill in the art.

In one implementation, the wireless communication system100is compliant with NR protocols standardized in third generation partnership project (“3GPP”), wherein the network unit104transmits using an OFDM modulation scheme on the downlink (“DL”) and the remote units102transmit on the uplink (“UL”) using a single-carrier frequency division multiple access (“SC-FDMA”) scheme or an orthogonal frequency division multiplexing (“OFDM”) scheme. More generally, however, the wireless communication system100may implement some other open or proprietary communication protocol, for example, WiMAX, institute of electrical and electronics engineers (“IEEE”) 802.11 variants, global system for mobile communications (“GSM”), general packet radio service (“GPRS”), universal mobile telecommunications system (“UMTS”), long term evolution (“LTE”) variants, code division multiple access 2000 (“CDMA2000”), Bluetooth®, ZigBee, Sigfoxx, among other protocols. The present disclosure is not intended to be limited to the implementation of any particular wireless communication system architecture or protocol.

In various embodiments, a remote unit102may derive, at a user equipment, a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID). In some embodiments, the remote unit102may transmit a request message to an edge server function. The request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In certain embodiments, the remote unit102may receive a response message from the edge server function. The response message includes a second KAFEECused by the edge server function. Accordingly, the remote unit102may be used for deriving a key based on an edge enabler client identifier.

In certain embodiments, a network unit104may receive, at a network function, a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In some embodiments, the network unit104may derive a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. In certain embodiments, the network unit104may transmit a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID. Accordingly, the network unit104may be used for deriving a key based on an edge enabler client identifier.

In certain embodiments, the processor202derives a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID). In various embodiments, the transmitter210transmits a request message to an edge server function. The request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In certain embodiments, the receiver212receives a response message from the edge server function. The response message includes a second KAFEECused by the edge server function.

Although only one transmitter210and one receiver212are illustrated, the remote unit102may have any suitable number of transmitters210and receivers212. The transmitter210and the receiver212may be any suitable type of transmitters and receivers. In one embodiment, the transmitter210and the receiver212may be part of a transceiver.

In certain embodiments, the receiver312receives a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID). The EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In various embodiments, the processor302derives a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. In certain embodiments, the transmitter310transmits a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID.

In certain embodiments, authentication and key management for applications (“AKMA”) based on 3GPP credentials in a fifth generation (“5G”) system (“5GS”) may generate only a single key per application or application function (“AF”).

In some embodiments, a user equipment (“UE”) hosting an edge enabler client (“EEC”) may have multiple EECs connected to different edge configuration servers (“ECSs”). In various embodiments, there may be no restriction that multiple EECs may be connected to the same ECS. In certain embodiments, a UE hosting an EEC may have multiple EECs connected to different edge enabler servers (“EESs”). In some embodiments, there may be no restriction that multiple EECs may be connected to the same EES.

In various embodiments, the following may apply for enhanced data global system for mobile communication (“GSM”) evolution (“EDGE”) 1 (“EDGE-1”): 1) one EEC may communicate with one or more EESs for one or more application clients (“AC”) concurrently; and 2) one EES may communicate with one or more EECs concurrently.

In certain embodiments, the following may apply for EDGE 4 (“EDGE-4”): 1) one EEC may communicate with one or more ECSs concurrently; and 2) one ECS may communicate with one or more EECs concurrently.

In some embodiments, if AKMA is used for the authentication then a single AKMA application key (“KAF”) may be created and may be reused by all ECSs and EES. In such embodiments, the reuse of the same key in different endpoints may result in security issues.

In various embodiments, a legal interception (“LI”) requirement may be fulfilled and a unique key per EEC-ECS and/or EEC-EES pair may be provided.

FIG.4is a schematic block diagram illustrating one embodiment of a system400for authentication and interface protection between an EEC and an EES and/or an ECS. The system400includes a UE EEC (“EEC-UE”)402, a 3GPP network404(including a UDM406, an AKMA anchor function (“AAnF”)408, and a network exposure function (“NEF”)410), and an EES and/or an ECS (“EES/ECS”)412. It should be noted that each of the communications described may include one or more messages.

In a first communication414, the EEC-UE402and the 3GPP network404run primary authentication and derive an AKMA anchor key (“KAKMA”). The EEC-UE402learns an AKMA key identifier (“ID”) (“A-KID”) and the KAKMA(e.g., the UE generates the KAKMAand the A-KID from the KAUSFbefore initiating communication with an AKMA application function).

The EEC-UE402derives416a security key (“KAFEECbased on two options, but in the same way as the AAnF:1) include an EEC ID (or an application ID) in a KAFkey derivation (e.g., KAFEEC=KDF (KAKMA, EES-ID/ECS-ID, EEC-ID); or 2) add an extra layer in the key hierarchy (e.g., first derive the KAFnormally with KAF=KDF (KAKMA, EES-ID/ECS-ID) and derive a new key in the AAnF based on KAFand the EEC ID (e.g., KAFEEC=KDF (KAF, EEC-ID)). If there is no application ID like the EEC-ID available for a service, then the EEC-UE402derives the KAF(e.g., as defined in an AKMA procedure only with an AF-ID (e.g., ECS-ID and/or EES-ID)).

In a second communication418, the EEC-UE402sends a session establishment request to the EES/ECS412. The session establishment request includes the parameters A-KID and an EEC-ID (e.g., either unencrypted or encrypted with the KAKMA-E(KAKMA, EEC-ID)).

In a third communication420, the EES/ECS412requests KAFEECfrom the 3GPP network404. In this request, the EES/ECS412sends A-KID and AF-ID and either the encrypted EEC-ID e.g., (E(KAKMA, EEC-ID)) or the EEC-ID in cleartext (e.g., encrypted) depending on what is sent by the UE.

The 3GPP network404executes422authentication and authorization for the EES/ECS412(e.g., as defined in an AKMA procedure) and, if the result is successful, then the 3GPP decrypts the EEC-ID (e.g., if encrypted) with KAKMAand derives a security key KAFEECin the AAnF408based on two options, but in the same way as in the UE: 1) include EEC ID in the KAF key derivation (e.g., KAFEEC=KDF (KAKMA, EES-ID/ECS-ID, EEC-ID)); or 2) add an extra layer in the key hierarchy (e.g., first derive the KAFnormally with KAF=KDF (KAKMA, EES-ID/ECS-ID) and derive a new key in the AAnF based on KAFand the EEC ID (e.g., KAFEEC=KDF(KAF, EEC-ID)). If there is no application ID like the EEC-ID available for a service, then the EEC-UE402derives the KAF(e.g., as defined in the AKMA procedure only with the AF-ID (e.g., ECS-ID and/or EES-ID)). If LI needs to be performed in the serving network, a relevant network function for LI may query the AAnF408in a home public land mobile network (“HPLMN”) for the corresponding keys related to the active services bound to a specific subscription permanent identifier (“SUPI”).

In a fourth communication424, the 3GPP network404sends KAFEECand an expiration time for the key to the EES/ECS412. If the EEC-ID is encrypted, the AAnF408sends an unencrypted EEC-ID to the EES/ECS412.

In a fifth communication426, the EEC-UE402and the EES/ECS412use KAFEECin Ua*protocol, instead of KAF. The Ua*protocol is a protocol running between a UE and an AF (e.g., for carrying A-KID).

FIG.5is a flow chart diagram illustrating one embodiment of a method500for deriving a key based on an edge enabler client identifier. In some embodiments, the method500is performed by an apparatus, such as the network unit104. In certain embodiments, the method500may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

In various embodiments, the method500includes receiving502, at a network function, a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In some embodiments, the method500includes deriving504a unique key (KAFEEC) based on the edge server identifier and the EEC-ID. In certain embodiments, the method500includes transmitting506a response message to the edge server function. The response message includes: the KAFEEC; and an unencrypted EEC-ID.

In certain embodiments, the network function includes an AKMA anchor function. In some embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof. In various embodiments, the edge server identifier includes an edge configuration identifier, an edge enabler server identifier, or a combination thereof.

In one embodiment, the request message further includes an AKMA key identifier. In certain embodiments, the method500further includes, in response to the EEC-ID including the encrypted EEC-ID, decrypting the EEC-ID with the KAKMA. In some embodiments, decrypting the EEC-ID with the KAKMAincludes decrypting the EEC-ID in response to the EEC-ID being encrypted. In various embodiments, the response message further includes a KAFEECexpiry time.

FIG.6is a flow chart diagram illustrating another embodiment of a method600for deriving a key based on an edge enabler client identifier. In some embodiments, the method600is performed by an apparatus, such as the remote unit102. In certain embodiments, the method600may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

In various embodiments, the method600includes deriving602, at a user equipment, a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID). In some embodiments, the method600includes transmitting604a request message to an edge server function. The request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA). In certain embodiments, the method600includes receiving604a response message from the edge server function. The response message includes a second KAFEECused by the edge server function.

In certain embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof. In some embodiments, the request message further includes an AKMA key identifier.

In various embodiments, the method600further includes performing an authentication prior to deriving the first KAFEEC. In one embodiment, the method600further includes computing the KAKMA. In certain embodiments, the method600further includes computing an AKMA key identifier.

In one embodiment, a method of a network function includes: receiving a request message from an edge server function, wherein the request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA); deriving a unique key (KAFEEC) based on the edge server identifier and the EEC-ID; and transmitting a response message to the edge server function, wherein the response message includes: the KAFEEC; and an unencrypted EEC-ID.

In certain embodiments, the network function includes an AKMA anchor function.

In some embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof.

In various embodiments, the edge server identifier includes an edge configuration identifier, an edge enabler server identifier, or a combination thereof.

In one embodiment, the request message further includes an AKMA key identifier.

In certain embodiments, the method further includes, in response to the EEC-ID including the encrypted EEC-ID, decrypting the EEC-ID with the KAKMA.

In some embodiments, decrypting the EEC-ID with the KAKMAincludes decrypting the EEC-ID in response to the EEC-ID being encrypted.

In various embodiments, the response message further includes a KAFEECexpiry time.

In one embodiment, an apparatus includes a network function. The apparatus further includes: a receiver that receives a request message from an edge server function, wherein the request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA); a processor that derives a unique key (KAFEEC) based on the edge server identifier and the EEC-ID; and a transmitter that transmits a response message to the edge server function, wherein the response message includes: the KAFEEC; and an unencrypted EEC-ID.

In certain embodiments, the network function includes an AKMA anchor function.

In some embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof.

In various embodiments, the edge server identifier includes an edge configuration identifier, an edge enabler server identifier, or a combination thereof.

In one embodiment, the request message further includes an AKMA key identifier.

In certain embodiments, the processor, in response to the EEC-ID including the encrypted EEC-ID, decrypts the EEC-ID with the KAKMA.

In some embodiments, the processor decrypting the EEC-ID with the KAKMAincludes the processor decrypting the EEC-ID in response to the EEC-ID being encrypted.

In various embodiments, the response message further includes a KAFEECexpiry time.

In one embodiment, a method of a user equipment includes: deriving a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID); transmitting a request message to an edge server function, wherein the request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA); and receiving a response message from the edge server function, wherein the response message includes a second KAFEECused by the edge server function.

In certain embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof.

In some embodiments, the request message further includes an AKMA key identifier.

In various embodiments, the method further includes performing an authentication prior to deriving the first KAFEEC.

In one embodiment, the method further includes computing the KAKMA.

In certain embodiments, the method further includes computing an AKMA key identifier.

In one embodiment, an apparatus includes a user equipment. The apparatus further includes: a processor that derives a first unique key (KAFEEC) based an edge enabler client identifier (EEC-ID); a transmitter that transmits a request message to an edge server function, wherein the request message includes: an unencrypted EEC-ID; or an encrypted EEC-ID, wherein the encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (KAKMA); and a receiver that receives a response message from the edge server function, wherein the response message includes a second KAFEECused by the edge server function.

In certain embodiments, the edge server function includes an edge configuration server, an edge enabler server, or a combination thereof.

In some embodiments, the request message further includes an AKMA key identifier.

In various embodiments, the processor performs an authentication prior to deriving the first KAFEEC.

In one embodiment, the processor computes the KAKMA.

In certain embodiments, the processor computes an AKMA key identifier.