A method, device and system for generating and distributing the key based on the diameter server

FIELD OF THE INVENTION

0001The present invention relates to mobile communication, and in particular, to a method, an apparatus, and a system for generating and distributing keys based on a Diameter server.

BACKGROUND

0002The MIP6 protocol provides a method for a Mobile Node (MN) to communicate through a home IP address while the MN roams in an Internet Protocol version 6 (IPv6) network. The method requires the MN to register a Care-of-Address (CoA) at the Home Agent (HA) when the MN moves to a foreign network. When an MN hands over from a foreign access router to another router, the MN needs to regain the CoA and register the CoA at the HA. The solution provided by the basic protocol of the MIP6 is to obtain the new CoA only after the MN moves to the New Access Router (NAR).

0003The basic protocol of the MIP6 is defective in the following aspects: <ol id="ol0001" compact="compact"><li>(1) The MN obtains the CoA only after moving to a new router. Before the MN obtains the new CoA, the communication between the MN and the communication node is interrupted, thus leading to a long handover delay.</li><li>(2) In the time period after the MN hands over to the new router before the MN registers the new CoA at the HA, the packets directed toward the MN are still routed to the old CoA of the MN. Because the old CoA is no longer available, the packets directed toward the MN are discarded.</li></ol>

0004The FMIP6 protocol extends the basic protocol of the MIP6, and solves the foregoing problem of the MIP6 protocol. The FMIP6 protocol provides a method of obtaining the CoA from the NAR before the MN moves to the new router, thus reducing communication delay. The FMIP6 protocol also sets up a tunnel between the Previous Access Router (PAR) and the MN. The data directed toward the old CoA are routed to the MN through the tunnel.

0005In order to ensure security of data transmission between the PAR and the MN, a security association needs to be set up between the PAR and the MN. The linchpin of setting up the security association is to distribute a key shared between the PAR and MN.

0006A method for distributing a handover key is provided in the prior art. As shown in <figref idref="f0001">Figure 1</figref>, the method includes the following steps: <ul id="ul0001" list-style="none" compact="compact"><li>Step 101: The MN sends a Handover Key Request (HKReq) to the NAR, requesting a NAR-MN key.</li><li>Step 102: After receiving the HKReq, the NAR sends the HKReq message to the PAR, requesting a root key of the handover key.</li><li>Step 103: Through a Handover Key Response (HKResp), the PAR sends the root key of the handover key to the NAR.</li><li>Step 104: According to the root key, the NAR generates a NAR-MN key, and sends an HKResp to the MN.</li></ul>

0007The HKReq and HKResp messages may be a sub-option of the MIP6, and may be embedded in an FMIP6 message or MIP6 message and sent to the NAR.

0008The signaling in the foregoing method may be carried in the signaling of the FMIP6 protocol for transmitting. In this case, the key distribution signaling data is part of the FMIP6 signaling data. The foregoing method also provides a key distribution signaling transmission mode under the pre-handover mode and reaction mode.

0009As shown in <figref idref="f0001">Figure 2</figref>, a key distribution method in the pre-handover mode in the prior art includes the following steps: <ul id="ul0002" list-style="none" compact="compact"><li>Step 201: The MN attaches the HKReq directed toward the NAR into the Fast Binding Update (FBU) message, and sends the message to the PAR, requesting the PAR to forward the data directed toward the MN to the NAR.</li><li>Step 202: When the PAR sends a Handover Initiation (HI) message to the NAR, the HI message carries the HKReq message.</li><li>Step 203: After receiving the HKReq message, the NAR sends a Fast Binding Acknowledgement (FBack) to the PAR, and returns the HKResp message to the PAR.</li><li>Step 204: After receiving the HKResp message, the PAR sends the HKResp message to the MN.</li></ul>

0010As shown in <figref idref="f0002">Figure 3</figref>, a key distribution method in the reaction mode in the prior art includes the following steps: <ul id="ul0003" list-style="none" compact="compact"><li>Step 301: The MN attaches an HKReq message into a Fast Neighbor Advertisement (FNA) message, and sends the FNA message to the NAR, notifying start of using a new CoA.</li><li>Step 302: After receiving the HKReq message, the NAR sends an FBU message carrying the HKReq message to the PAR.</li><li>Step 303: After receiving the HKReq message, the PAR sends the HKResp message to the NAR.</li><li>Step 304: After receiving the HKResp message, the NAR sends the HKResp message to the MN.</li></ul>

0011The following security problems are involved in the prior art: <ul id="ul0004" list-style="none" compact="compact"><li>Domino effect: Domino effect means that among the dominos placed together, the moment one of the dominoes collapses, all the remaining dominoes are affected and collapse consequently. The domino effect occurs when the NAR obtains the handover root key from the PAR. Once an Access Router (AR) in a domain is cracked, the handover key after the MN passes through the AR is vulnerable to interception.</li><li>Costly deployment: The PAR is responsible for authentication, which means that all ARs must be capable of authentication. Deploying such a network is rather costly.</li></ul>

SUMMARY

0012In order to enhance security of data transmission at the time of MN handover and relieve the costliness of network deployment, the present invention provides a method, an apparatus, and a system for generating and distributing keys based on the Diameter server.

0013The embodiments of the present invention are fulfilled through the following technical solution.

0014A method for generating and distributing keys based on a Diameter server in an embodiment of the present invention includes: <ul id="ul0005" list-style="none" compact="compact"><li>receiving, by the Diameter server, a message sent by the PAR before handover of the MN, where the message carries an identifier of a NAR after handover of the MN and an identifier of the MN;</li><li>generating a random number, and generating a key shared between the MN and NAR according to the random number;</li><li>sending the key shared between the MN and NAR to the NAR; and</li><li>sending the random number to the MN as a parameter for calculating the key shared between the MN and NAR.</li></ul>

0015A system for generating and distributing keys based on a Diameter server in an embodiment of the present invention includes: an MN, a PAR, a NAR, and a Diameter server.

0016The Diameter server includes: <ul id="ul0006" list-style="none" compact="compact"><li>a Diameter key generating module, adapted to generate a random number, and generate a key shared between the MN and NAR according to the random number; and</li><li>a sending module, adapted to send the shared key to the NAR, and send the random number to the MN as a parameter for calculating the key shared between the MN and NAR.</li></ul>

0017A Diameter server provided in an embodiment of the present invention includes: <ul id="ul0007" list-style="none" compact="compact"><li>a Diameter key generating module, adapted to generate a random number, and generate a key shared between the MN and NAR according to the random number; and</li><li>a sending module, adapted to send the shared key to the NAR, and send the random number to the MN as a parameter for calculating the key shared between the MN and NAR.</li></ul>

0018The technical solution under the present invention brings these benefits: <ul id="ul0008" list-style="none" compact="compact"><li>In this technical solution, the Diameter server does not send a key to the MN directly, but sends a random number instead, and the MN calculates the shared key, thus preventing the shared key from being obtained by the PAR and avoiding the domino effect in the prior art.</li><li>Because the generation of the shared key between the MN and NAR is never dependent of the PAR, the distribution of the key between the NAR and MN is not affected even if the PAR is cracked.</li><li>Moreover, in the embodiment of the present invention, it is not necessary for the PAR to perform authentication, thus reducing the expenses of network deployment.</li></ul>

BRIEF DESCRIPTION OF THE DRAWINGS

0019<figref idref="f0001">Figure 1</figref> shows signaling transmission of a method for distributing handover keys in the prior art;

0020<figref idref="f0001">Figure 2</figref> is a flowchart of a key distribution method in the pre-handover mode in the prior art;

0021<figref idref="f0002">Figure 3</figref> is a flowchart of a key distribution method in the reaction mode in the prior art;

0022<figref idref="f0003">Figure 4</figref> is a flowchart of a method for generating and distributing keys in an embodiment of the present invention; and

0023<figref idref="f0004">Figure 5</figref> shows a system for generating and distributing keys in an embodiment of the present invention.

DETAILED DESCRIPTION

0024The present invention is hereinafter described in detail by reference to embodiments and accompanying drawings, but the present invention is not limited to the following embodiments.

0025A method and a system for generating and distributing keys based on a Diameter server are provided in an embodiment of the present invention. Before the MN moves to the next router, the Diameter server distributes a key to the MN and NAR, and the key is applied when the NAR becomes a PAR.

0026As shown in <figref idref="f0003">Figure 4</figref>, a method for generating and distributing keys based on a Diameter server includes the following steps.

0027Step 401: The MN sends an HKReq message to the PAR, where the HKReq message carries information on a NAR identifier (NAR_ID). The NAR_ID may be an IP address of the NAR.

0028Step 402: After receiving the HKReq, the PAR resolves the HKReq information, generates a first AAA req message, and sends the first AAA req message to the Diameter server.

0029The AAA req message is a Diameter message sent by the PAR to the Diameter server in order to request a handover key. The message carries a NAR_ID and an MN identifier (MN_ID). The MN_ID is generally an access identifier of the MN, and may be in this format: mn@home.net.

0030Step 403: After receiving the first AAA req message, the Diameter server generates a random number "nonce", and generates a shared key "NAR-MN-Key" through a PRF function by using the nonce, NAR_ID, AAA_ID, MN_ID, validity time, and AAA-MN-Key as input.

0031The nonce is a random number. The AAA_ID is an identifier of the Diameter server, and is generally an IP address of the Diameter server. The validity time is a validity period of the key. The PRF function is a pseudo random generation function, and it is difficult to deduce the input of the PRF function according to the output of the PRF function. The AAA-MN-Key is a key shared between the Diameter server and MN and the NAR-MN-Key is a key shared between the NAR and MN and expected to be generated in an embodiment of the present invention.

0032The formula for calculating the shared key is: <maths id="math0001"><math display="block"><mi>NAR</mi><mo>-</mo><mi>MN</mi><mo>-</mo><mi>Key</mi><mo>=</mo><mi>PRF</mi><mo>⁢</mo><mfenced><mi>AAA</mi><mo>-</mo><mi>MN</mi><mo>-</mo><mi>Key</mi><mo>,</mo><mi>nonce</mi><mfenced open="|" close="|"><mi>NAR_ID</mi></mfenced><mo>⁢</mo><mi>AAA_ID</mi><mfenced open="|" close="|"><mi>MN_ID</mi></mfenced><mspace width="1em" /><mi>validity time</mi></mfenced><mn>.</mn></math><img file="EP2051433A1_D0001.tif" /></maths>

0033Step 404: The Diameter server sends the NAR-MN-Key to the NAR through a second AAA req message.

0034Step 405: After receiving the second AAA req message, the NAR returns a second response message to the Diameter server.

0035Step 406: After receiving the second response message from the NAR, the Diameter server returns a first response message carrying "nonce" to the PAR.

0036Step 407: After receiving the first response message from the Diameter server, the PAR sends the "nonce" received from the Diameter server to the MN.

0037Step 408: After moving to the NAR, the MN calculates out the shared key "NAR-MN-Key" according to the "nonce". Likewise, the formula for calculating the shared key is: <maths id="math0002"><math display="block"><mi>NAR</mi><mo>-</mo><mi>MN</mi><mo>-</mo><mi>Key</mi><mo>=</mo><mi>PRF</mi><mspace width="1em" /><mfenced><mi>AAA</mi><mo>-</mo><mi>MN</mi><mo>-</mo><mi>Key</mi><mo>,</mo><mi>nonce</mi><mfenced open="|" close="|"><mi>NAR_ID</mi></mfenced><mo>⁢</mo><mi>AAA_ID</mi><mfenced open="|" close="|"><mi>MN_ID</mi></mfenced><mo>⁢</mo><mi>validity time</mi></mfenced><mn>.</mn></math><img file="EP2051433A1_D0002.tif" /></maths>

0038It is understandable to those skilled in the art that the MN may also calculate out the shared key "NAR-MN-Key" according to the "nonce" before moving to the NAR, which can cope with fast moving of the MN.

0039The technical solution to generating and distributing keys in an embodiment of the present invention is secure in that: <ul id="ul0009" list-style="none" compact="compact"><li>In step 402, the PAR does not generate any key. Instead, the Diameter server generates a key in the subsequent steps. Therefore, the key shared between the NAR and MN is not affected even if the PAR is cracked, thus preventing the domino effect.</li><li>In steps 406, 407 and 408, the Diameter server transmits the "nonce" value to the MN through the PAR. Therefore, the PAR knows only the nonce, and is unable to calculate out the NAR-MN-Key, thus preventing the NAR-MN-Key from being disclosed to the PAR.</li></ul>

0040Because a security association exists between the Diameter server and NAR, it is secure to distribute keys between them.

0041Moreover, the AR in this embodiment needs to support the Diameter client because the AR generally needs to support the access authentication function.

0042As shown in <figref idref="f0004">Figure 5</figref>, a system for generating and distributing keys based on a Diameter server in an embodiment of the present invention includes: an MN, a PAR, a NAR, and a Diameter server.

0043The MN includes: <ul id="ul0010" list-style="none" compact="compact"><li>a sending module, adapted to send a NAR_ID to a PAR; and</li><li>a key generating module, adapted to: receive a random number from a Diameter server, and generate a key shared between the MN and NAR according to the random number.</li></ul>

0044The PAR includes: <ul id="ul0011" list-style="none" compact="compact"><li>a receiving and sending module, adapted to: receive the NAR_ID from the MN, send the NAR_ID and MN_ID to the Diameter server, and forward the random number sent by the Diameter server to the MN.</li></ul>

0045The Diameter server includes: <ul id="ul0012" list-style="none" compact="compact"><li>a Diameter key generating module, adapted to: generate a random number, and generate a key shared between the MN and NAR according to the random number; and</li><li>a sending module, adapted to: send the key shared between the MN and NAR to the NAR, and send the random number to the MN.</li></ul>

0046The NAR includes: <ul id="ul0013" list-style="none" compact="compact"><li>a receiving and responding module, adapted to receive the key shared between the MN and NAR sent by the Diameter server, and send the received response message to the Diameter server.</li></ul>

0047In order to improve security, the Diameter server further includes: <ul id="ul0014" list-style="none" compact="compact"><li>a key calculating unit, adapted for the Diameter server to calculate the key shared between the MN and NAR according to the formula "shared key = PRF (key shared between the server and MN, random number | NAR_ID | Diameter server identifier | MN_ID | validity period of the key)".</li></ul>

0048Accordingly, the MN further includes: <ul id="ul0015" list-style="none" compact="compact"><li>a key calculating unit, adapted for the MN to calculate the key shared between the MN and NAR according to the formula "shared key = PRF (key shared between the server and MN, random number | NAR_ID | Diameter server identifier | MN_ID | validity period of the key)".</li></ul>

0049Although the invention has been described through several preferred embodiments, the invention is not limited to such embodiments. It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. The invention is intended to cover the variations and substitutions provided that they fall in the scope of protection defined by the following claims or their equivalents.