Title of Invention

"METHOD FOR CREATING AND DISTRIBUTING CRYPTOGRAPHIC KEYS IN A MOBILE RADIO SYSTEM, AND CORRESPONDING MOBILE RADIO SYSTEM"

Abstract

A first cryptographic key (318) and a second cryptographic key (322) are created by a mobile radio terminal (103) and by a computer of the home communications network (108, 109) by using authentication key materials (312). The first cryptographic key (318) is transmitted to the computer of the visited communications network (113), and the second cryptographic key (3220 is transmitted to an application server computer 106,107).

Full Text

The invention relates to a method for creating and distributing cryptographic keys in a mobile radio system and a corresponding mobile radio system. As part of the Universal Mobile Telecommunications Systems (UMTS), Internet based multimedia services are developed in order to enhance the implementation capability of the UMTS mobile radio system and to extend the areas of application. In the 3GPP (3rd Generation Partnership Project) a so-called IP-based Multimedia Subsystem (IMS), which is described in the UMTS Release 5 - Architecture, was standardized as a platform for Internet based multimedia services for a mobile radio system. If a mobile radio terminal of a mobile radio subscriber logs on in a communications network in a mobile radio system with IMS to make use of Internet based multimedia services, then an authentication procedure is carried out for the mobile radio terminal in accordance with the 3GPP standard described in [1] in accordance with the IMS Authentication and Key Agreement Protocol (IMS AKA Protocol). In accordance with the IMS AKA Protocol, the mobile radio terminal and the communications network, in whose range the mobile radio terminal is currently sited, authenticate each other and two cryptographic keys are generated, the so-called integrity key and the so-called transfer key. In accordance with UMTS Release 5, to protect the IMS signaling the integrity key is used between the mobile radio terminal and a computer of the visited communications network (Visited Network). The computer of the visited communications network is set up as a Call State Control Function Computer (CSCF Computer) and is called a Proxy CSCF Computer (P-CSCF Computer) . The transfer key is used for encryption, i.e. to protect the confidentiality of the data exchanged. in addition to using the integrity keys to protect the IMS Signaling messages, it can be specified that when IP based services are to be provided, additional electronic messages are to be exchanged in a confidential manner between an application server computer and the mobile radio terminal. In this description an application server computer on the network side is in particular a computer that offers services in accordance with a service provided on the application layer (OSI layer 7) , preferably multimedia services, and that communicates in accordance with a layer 7 protocol, i.e. an application layer-protocol. The application server computer can, for example, be equipped as an HTTP server computer (Hypertext Transfer Protocol) arid can communicate with the mobile radio terminal in accordance with the HTTP protocol.• Over and above? the basic functionality of the IMS, application server computers are for example, used for the administration of network side user settings and to store and manage profile data relating to the mobile radio system subscribers. Some examples of such applications between mobile users (in particular those using an IMS mobile radio system) and application server computers in the communications network, who use the HTTP protocol, are: • access lists on presence servers with which lists it is possible? to use position information about the current position of a mobile radio terminal within the mobile radio system (for example, GPS data), • buddy lists of chat, applications, i.e. lists of authorized subscribers for a chat application, • group management services and • settings for electronic multimedia conferences At; a further example for such an application, mention must be made of the fact that multicast connections between a mobile radio terminal arid between a multicast service center are set up u s i n g the IMS syst em. In order to secure the protocols used between the mobile radio terminal and the application server computer cryptographically, their messages must be protected, with respect to, for example, authentication, data integrity and/or data confidentiality. Depending on the actual implementation scenario and the application layer protocol used, different security protocols are used to secure the application layer protocol, for example; for HTTP, the security protocol HTTP Digest, the TLS protocol. (Transport Layer Security Protocol) or WTLS (Wireless Transport Layer Security Protocol) and • for allocating keys for multicast communication links, MIKEY (Multimedia Internet: KEYing) . With all cryptographic application layer protocols, the communication partners involved, in particular, the mobile radio terminal and the application server computer, i.e. the application server computer in the communications network, must have secret key material, i.e. secret keys, which material is available right from the start of the transmission of the first secured electronic message. In the case; of the IMS, the key infrastructure is based on symmetrical keys used to authenticate the IMS users as part of the IMS registration procedure, i.e. as part of the authentication and key exchange protocol described in [1] . As described in [1. ] , a mobile radio terminal registers in the IMS for an IMS communication session at its home communications network (Homo Network) at the computer designated for this purpose, which computer is also called the S-CSCF computer (Serving Call State1 Control Function Computer) . The communication takes place using a local proxy computer, the above described P-CSCF computer, in the visited communications network, which represents the first IMS contact point for the mobile radio terminal arid hence for the mobile user. The authentication according to [1] takes place between the mobile radio terminal and the S-CSCF computer with the participation of a so-called HSS computer (Home Subscriber Server Computer). Within the course of the authentication, the integrity key and the transfer key are generated in the mobile radio terminal arid in the HSS computer and transmitted in a cryptographically secure manner to the S-CSCF computer. The integrity key is transmitted, cryptographically secured, from the S-CSCF computer to the P-CSCF computer. The integrity protection and the authenticity of the subsequent IMS related signaling messages is provided locally between the mobile radio terminal and the P-CSCF computer and is based on the integrity key. According to UMTS Release 5, the transfer key is not used at the moment, but there are plans to include the transfer key in future versions of the UMTS Standard (Release 6 and subsequent standards) in order to provide additional protection for the confidentiality of transmitted data. A problem arises it the transfer key and the integrity key, which are created as session keys from an IMS AKA authentication and key generation, are used to secure different applications than for IMS signaling. The mobile radio terminal and the home communications network, in other words, the user and the home communications network operator are regarded as mutually trustworthy. However, the visited communication network (in the case of roaming; where it is not a case of roaming, this corresponds to the home communications network) is given the integrity key and the transfer key. If an application server computer were also to be given the integrity key arid the transfer key, then, theoretically, the application server computer would be able to compromise the security of the IMS signaling between the mobile radio terminal and the visited communications network. Conversely, the visited communications network, i.e. a computer of the visited communications network would be able to compromise the security of the communication between the mobile radio terminal and the application server computer, if said security were to be based directly on the integrity key or the transfer key. Where a mobile radio terminal wants to communicate with several application server computers at the same time, it is also desirable, and frequently even a requirement, that it is not possible to make inferences from the cryptographic key that has been given to a particular application server computer as to the cryptographic key that another application server computer has been given. A possible method of solving the above described problem is to derive a new cryptographic key from the integrity key and/or the transfer key, and to do so both in the home communications network and in the mobile radio terminal of the user. An application server computer receives the derived cryptographic key, thus recognizes neither the integrity key nor the transfer key, provided that the cryptographic function used to derive the key does not allow any meaningful inferences to be made as to the integrity key and/or the transfer key for the application server computer. The problem that arises with this method is that one needs a key derivation function that cannot be reconstructed by the computer of the visited communications network. A so-called keyed hash, which uses, for example, the integrity key or the transfer key as input parameter and the random parameter generated within the course of the authentication carried out in accordance with [1] as random value, can also be calculated by the computer in the visi ted communi ca tions network. A new random parameter that was agreed between the mobile radio terminal of the user and the home communications network for the purposes of key derivation could only be achieved by making a modification to existing communications or security protocols, i.e. by a modification, for example, to the IMS AKA protocol or in the communication between the SCSCF computer and the HSS computer. However, such a modification should be avoided, there is no simple way to modify existing communications standards or security standards and it is thus very cost intensive. For an overview of the security mechanisms provided in the UMTS Standard Release 5, see [2] . The message authentication functions and key generation functions used as part of the EMS AKA protocol are described in [3] and [4 | , Further,a block cipher encryption function, known as Rijndael function, is described in [4] . For an overview of the security mechanisms provided in the UMTS Standard Release 5, see [2] . The message authentication functions and key generation functions used ac part; of the IMS AKA protocol are described in [3] and [4]. Further, a block cipher encryption function, known as R.i jndael function, is described in [4] . For an overview of various key derivation functions see [5] . A further key derivation method is described in [6] . A radio communication device and a method for radio communication is known from the EP 1 156 694 Al, which enable a mobile device to provide an encryption function and also an integration function on the data transmission levels two or higher. To this end the mobile terminal has an encryption or integrity unit, which is switched between a radio communication control unit and a terminal multiplexer. Thereby, the encryption integrity processing unit only carries out an encryption processing action on so-called transparent data, such as, for example, speech data transmitted between the terminal multiplexer and the radio communication unit. Further, the encryption integrity processing unit carries out encryption and/or integrity processing on non-transparent data transmitted to and from the radio communication control device. The problem of how to increase the cryptographic security in a mobile radio system forms the basis of the invention. The problem is solved by the method for creating and distributing cryptographic keys in a mobile radio system and by the mobile radio system with features in accordance with the independent We [6] D. Harkins und D. Carrel, the Internet Key Exchange (IKE), RFC 2409, Pages 17 to 19, November 1998. According to the invention a mobile radio system with at least one mobile radio terminal (103), comprises at least one mobile radio terminal (103) in which authentication key materials (312, 314) resulting from an authentication are stored, first computer (113) of a home communications network (109) in which computer the authentication Key materials (312, 314) resulting from an authentication are stored with at least second computer (106, 107) wherein the mobile radio terminal (103) and the computer of the home communications network (109) each have a crypto unit for creating a first cryptographic key (318) and a second cryptographic key (322) by using the authentication key materials (312, 314), whereby the first cryptographic key (318) and the second cryptographic key (322) are created in such a way that - no inference can be made from the first cryptographic key (318) as to the second cryptographic key (322), - no inference can be made from the second cryptographic key (318) or from the second cryptographic (322) as to the authentication key materials (312, 314), the first computer (113) has a memory for storing the first cryptographic key (318), and the second computer (106, 107) has a memory for storing the second cryptographic key (322) . Claim:- 1. A mobile radio system with at least one mobile radio terminal (103), comprising at least one mobile radio terminal (103) in which authentication key materials (312, 314) resulting from an authentication are stored, first computer (113) of a home communications network (109) in which computer the authentication Key materials (312, 314) resulting from an authentication are stored with at least second computer (106, 107) wherein the mobile radio terminal (103) and the computer of the home communications network (109) each have a crypto unit for creating a first cryptographic key (318) and a second cryptographic key (322) by using the authentication key materials (312, 314), whereby the first cryptographic key (318) and the second cryptographic key (322) are created in such a way that - no inference can be made from the first cryptographic key (318) as to the second cryptographic key (322), - no inference can be made from the second cryptographic key (318) or from the second cryptographic (322) as to the authentication key materials (312, 314), the first computer (113) has a memory for storing the first cryptographic key (318), and the second computer (106, 107) has a memory for storing the second cryptographic key (322) . 2. A system as claimed in claim 1, wherein the first computer (113) is a computer of a visited communications network, the mobile radio terminal (103) is situated in the visited communications network and second computer is an application server computer (106, 107) . 3. A system as claimed in claim 1, wherein the first computer is a first application server computer wherein the first computer (113) is a first application server computer (106) and a second computer is a second application server computer (107). 4. A system as claimed in claim 1, wherein the first cryptographic key (318) and second cryptographic key are created by using at least one key derivation function (317). 5. A system as claimed in claim 1, wherein the authentication key materials comprises at least two cryptographic keys. 6. A system as claimed in claim 6, wherein the mobile radio system comprises an Internet Protocol multimedia subsystem. 7. A system as claimed in claim 1, wherein the authentication key materials (312, 314) have in integrity key (314) and a transfer key (312). 8. A system as claimed in claim 7, when the first cryptographic key (318) and the second cryptographic key (322) are derived from the transfer key (312) . 9. A system as claimed in claim 1, wherein a cryptographic key are created by a mobile radio terminal and by the computer of the home communications network for application server computers (107) by using the authentication key materials and are transmitted to the respective application server computers. 10. A system as claimed in claim 1, when the same key derivation function is used to create the cryptographic keys (318, 322, 323, 324) . 11. A system as claimed in claim 1, wherein the parameters created during authentication are used as additional input parameters (319) for the key derivation function (317). 12. A system as claimed in claim 13, wherein at least one of the previously created cryptographic keys (318, 322, 323, 324) are used as additional input parameters for the key derivation function. 13. A mobile radio system with at least one mobile radio terminal substantially as hereinbefore described with reference to the accompanying drawings.

Documents:

3499-delnp-2005-abstract.pdf

3499-DELNP-2005-Claims-(05-11-2008).pdf

3499-Delnp-2005-Claims-07-04-2008.pdf

3499-DELNP-2005-Correspondence-Others-(25-02-2010).pdf

3499-Delnp-2005-Correspondence-Others--07-04-2008.pdf

3499-delnp-2005-correspondence-others.pdf

3499-Delnp-2005-Description (Complete)-07-04-2008.pdf

3499-delnp-2005-description (complete).pdf

3499-DELNP-2005-Form-1-(25-02-2010).pdf

3499-delnp-2005-form-1.pdf

3499-delnp-2005-form-13.pdf

3499-delnp-2005-form-18.pdf

3499-delnp-2005-form-2.pdf

3499-delnp-2005-form-3.pdf

3499-delnp-2005-form-5.pdf

3499-delnp-2005-gpa.pdf

3499-delnp-2005-pct-210.pdf

3499-delnp-2005-pct-304.pdf