TW200915814A - Method, apparatus, system and computer program for key parameter provisioning - Google Patents

Abstract

A method includes receiving, for a specific user equipment, an inquiry for key generation-related information, and user equipment processing instruction information, generating first key information on the received user equipment processing instruction information, encrypting at least core-network related dynamic identity information based on the generated key information, and sending the key generation-related information comprising at least the encrypted core-network related dynamic identity information and the received user equipment processing instruction information. Also described is a method that includes receiving key generation-related information that has at least encrypted core-network related dynamic identity information and user equipment processing instruction information, generating first key information on the received user equipment processing instruction information, decrypting the received encrypted core-network related dynamic identity information based on the generated first key information, and deriving second key information based on the decrypted core-network related dynamic identity information.

Description

200915814 IX. Invention Description:

TECHNICAL FIELD OF THE INVENTION: 1. Field of the Invention Exemplary embodiments of the present invention generally relate to authentication and security techniques, and more particularly to the use of any network application function utilizing a Generic Bootstrapping Architecture (GBA) service (NAF) and User Equipment (UE) key parameter provisioning. In particular, Multimedia Broadcast/Multicast Service (MBMS), Mobile TV (TV), and device management are exemplary services in which a keying parameter provisioning can be deployed in accordance with an exemplary embodiment of the present invention. 10 [Prior Art] Background of the Invention Operators are now required to provide a Third Generation Partnership Project (3GPP) MBMS system for Mobile TV services. For security purposes, an MBMS may use the 3GPP Universal Bootstrapping Architecture (GBA) or broadcast scheme, which typically includes Internet Protocol (IP) TVs and applications (eg, set-top boxes), which may also be used. Derivatives of GBA, such as extensions to support core or other specific networks. The 3GPP Universal Authentication Architecture (GAA) is based on 3GPP's Action Algorithms AKA (Identification and Gold Acceptance Agreement) and 3 (Jpp2's Interrogation-Handshake Authentication Protocol (CHAP) and Honeycomb Authentication and Voice Encryption (CAVE). gba also applies to 20 (for example) the specific needs of cable network operators and considering their security agreement preferences. The use of GBA for Open Actors (OMA) broadcast content protection and multimedia broadcast multicast services has resulted in a new 3gpp GBA specification ( Technical Specification (TS) 33.223 GBA Push.) GBA is based on the security features of a network and a device. 200915814 In 3GPP TS 33.220 (for example, Bootstrap Server Function (BSF), GBA), Section 4.4.11, The following definitions are given: "When referring to the GBA key, the following key is specified: Ks specific NAF derived from this Ks. 5 When referring to a NAF-specific key, the following record is specified:

Ks_ext/int_NAF (in GBA-U (with GBA-based enhanced GBA) context) (...)' and any gold records derived from such keys. The symbol Ks_(ext/int)_NAF indicates 10 Ks_ext/int_NAF in the context of GBA_U(...) 〇 The symbol Ks_(eXt)_NAF represents Ks_ext_NAF in the context of GBAJJ(...). According to 3GPP TS 33.223 sections 3.1 and 4.3.9, the term GBA-PUSH-INFO may contain information about the export of the gold record in the GBA push, such as AUTN (*), RAND, NAF ID, B-TID. The GBA-PUSH-INFO can be sent from the NAF to the UE via, for example, an Upa-reference point. In addition, the Bootstrap Transaction Identifier (B-TID) may be included, for example, within the push message to correct the push information of the GBA-PUSH-INFO and the security combined protection generated by the GBA-PUSH-INFO. Reverse order case (in the case where the 20 GBA-PUSH-INFO and the push message are sent separately). That is, the B-TID can be used, for example, as a key identifier used in the agreement of the reference points Upa and Ua (which will be described below). In 3GPP TS 33.233, it is currently assumed that a bootstrap transaction identifier (B-TID) identifying a cryptographic key is used for Ua-message identification (for example, see SA3 #47 6 200915814 S 456 朦 conference file) and additionally The coffee message is transmitted. 3GPP TS 33.233 does not include any user identification within Upa. In addition, it can be assumed that the UE identity is transmitted with the Upa message, which is a message for delivering at least the GBA-PUSH-INFO. 5 SUMMARY OF THE INVENTION In a first level, an exemplary embodiment of the present invention provides a method that includes the steps of: receiving a user device processing instruction information and a key generation related information query; generating and Receiving, by the received device, the first key information related to the instruction information; encrypting at least the core network related dynamic identity information; and responsive to the key to generate the related information, the key generation related information includes at least the The core network related dynamic identity information and the received user equipment processing instruction information are encrypted. In another aspect, an exemplary embodiment of the present invention provides a memory medium that is grouped 15 to store program instructions. Execution of the program instructions results in performing an operation including: receiving a user device processing instruction information and a key generation related information query; generating a first key information related to the received user equipment processing instruction information Encrypting at least the core network related dynamic identity information; and generating the relevant information by the key to reply to the query, the key generation related information including at least the encrypted core network related dynamic identity information and the received user equipment Processing Instruction # In another aspect, an exemplary embodiment of the present invention provides an apparatus, including: a receiver configured to receive a user equipment processing instruction information and a key generation related information-request; The generator 'is configured to 200915814 to generate first key information related to the received user equipment processing instruction information; an encrypter' is configured to encrypt at least core network related dynamic identity information; and a transmitter Is configured to generate a related information with the key, and the key generates a related information packet. Containing at least the encrypted 5 core network related dynamic identity information and the received user equipment processing instruction information. In still another aspect, an exemplary embodiment of the present invention provides an apparatus, including: means for receiving a user equipment processing instruction information and a query for a related information generated by a golden record; for generating and receiving the received use 10 Means for processing first key information related to the instruction information; means for adding at least core network related dynamic identity information; and means for replying the query with the key to generate related information, the key generation The related information includes at least the encrypted core network related dynamic identity information and the received user equipment processing instruction information. In another aspect, an exemplary embodiment of the present invention provides a method comprising the steps of: receiving user equipment processing instruction information and generating key related information including at least encrypted core network related dynamic identity information, generating a key message related to the received user equipment processing instruction information, a solution, a received encrypted core network related dynamics, and a dynamic identity information based on the decrypted core network Export the second key information. In another aspect, an exemplary embodiment of the present invention provides a memory medium that is configured to store program instructions. The execution of the program instructions causes the following steps of the execution of the package 3: receiving the user equipment processing instruction information and the information about the gold record containing at least the encrypted core network status information; generating and receiving the information The user equipment processes the information related to the first information, the encrypted core network 5 10 related dynamic identity information received by the solution; and the second key is derived based on the decrypted core network related dynamic identity information News. In another aspect, an exemplary embodiment of the present invention provides an apparatus, including: a receiver configured to receive user equipment processing instruction information and a key including at least an encrypted core, road phase identity information Generating relevant information; a generator configured to generate first key information related to the received user equipment processing instruction information; and a decoder configured to decrypt the received encrypted core The network-related dynamic identity information is used to derive the second-level information based on the dynamic identity information of the decrypted core network. In another aspect, an exemplary embodiment of the present invention provides a device, the device comprising: receiving a user equipment processing instruction information and a key generation related information including at least an encrypted core network related dynamic identity information. Means for generating a first key information related to the received user equipment processing instruction information; means for decrypting the received encrypted core network related dynamic identity information; Means for deriving second key information based on 20 the decrypted core network related dynamic identity information. In yet another aspect, an exemplary embodiment of the present invention provides a method of: receiving user device processing instruction information and a general bootstrap architecture push information (GPI) query; generating and receiving the received 200915814 The user equipment processes the first key information related to the instruction information (Ks "ext/int)_BSF); encrypts at least one network application function domain name server (NAF DNS) name, wherein one of the GPI E_GPI parts contains the already The NAF DNS name is encrypted; and the query is replied to with the received message information of the user device. In yet another aspect, an exemplary embodiment of the present invention provides a method comprising the steps of: receiving a message including a generic bootstrap architecture push information (GPI) pushed by a network application function (NAF) And the user equipment processing instruction information, wherein the E_GPI portion of the GPI includes a 10 encrypted network application function domain name server (NAF DNS) name; generating a first information related to the received user equipment processing instruction information Key information (Ks "ext/int)_BSF); decrypts the received encrypted NAF DNS name; and derives second key information (Ks_(ext/int)_NAF) based on the decrypted NAF DNS name. BRIEF DESCRIPTION OF THE DRAWINGS Exemplary embodiments of the present invention are described below with reference to the accompanying drawings in which: FIG. 1 shows an individual method for the supply of key parameters in accordance with an exemplary embodiment of the present invention; and FIG. Individual devices (e.g., a user device and NAF/BSF) for the provisioning of key 20 parameters in accordance with an exemplary embodiment of the present invention are shown.

C embodiment; J. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Note that 'for this specification, the acronym GPI (GBA pushes into the education), Ks_(ext/int)_BSF, Ks-(ext)NAF, NAF DNS Name, etc. 10 200915814 is the security-related information stored in the database, the information of the first-key money, the dynamic information of the core network, and the unique user identity information for the security purpose of the step-by-step ( The specific technique of not applying the following words to the baseline vouchers applied to the acronyms or used for service traits derivation (ie KS "ext/int)_NAF), such as in the case of security or application security, etc.) Or implement the details of the situation. Exemplary embodiments of the present invention are now described with reference to Figures 2 and 2. First, however, it should be noted that one of the main features of GBA push and the difference from the GBA outlined in 3GPP TS 33.220 can be considered to cover the fact that 10 3GppTS 33.223 can be bootstrapped for the key of the broadcast network, ie One-way use, such as network initialization of a secure connection between at least one network node and a UE or terminal, as an example. However, the use of GBA push within a broadcast network requires special considerations associated with the key derivation techniques used in 3GPP TS 33.220. One of these levels may be the name of the NAF that was used for the cryptographic key export. It is not possible to assume that all broadcast networks use domain name server (D N S) names for so-called headends, in the case of them as a NAF that sends GBA push messages. The use of GBA push in one-way mode does not preclude the possibility of having a possible back channel for the UE, for example if the key delivery is unsuccessful. 20 For example, when performing a broadcast on an Internet Protocol (IP) network (such as Digital Video Broadcasting - Handheld (DVB-Η)), the DNS name is not used. In addition, it can be assumed that a user cannot perform an uplink reverse DNS query to resolve the DNS name associated with the source IP address. Moreover, the EPG (Electronic Program Guide) used in DVB-Η does not contain information on the mapping of IP addresses to DNS names. 200915814 So 'clear DNS name transfer (along with the Ua security protocol identifier 'when it cannot be exported by other means) can be considered as one of the solutions to this problem, and can maintain the GBA push solution and UE initialization Some compatibility with the GBA concept. 5 However, if the user identity and NAFID are transmitted on the broadcast network

When clearly visible, transmitting the NAF identifier (in short, NAF-ID, NAF DNS name, and Ua protocol ID) may cause a privacy issue. This type of operation makes it possible to track user behavior and may therefore be annoying. Q In view of the above, an exemplary embodiment of the present invention provides enhanced keying parameter 10 provisioning. For example, a first method may include: receiving, by a specific user equipment, one of the information related to the key generation and the user equipment processing instruction information; generating a fifteenth item related to the received user equipment processing instruction information Key information; encrypting at least core network related dynamic identity information based on the generated key information; and transmitting a key generation information including at least the encrypted core network related dynamic identity information and the received user equipment processing instruction information relevant information. The method may further comprise the steps of: obtaining an authentication vector comprising one of a random number and a cryptographic key content; and deriving the generic key information for subsequent generation of the key information. The method can further include the steps of: obtaining a user identity token from a user database; and deriving generic 12 200915814 key information for subsequent generation of the first key information. The received user equipment processing instruction information can further include a mobile application identifier, and the method can further include generating second key information based on the received user equipment processing instruction information. Further in accordance with an exemplary embodiment of the present invention, a second method includes the following steps: receiving key generation related information including at least encrypted core network related dynamic identity information and user equipment processing instruction information; generating and receiving The user equipment processes the first record information related to the instruction information; 10 decrypts the received encrypted core network related dynamic identity information based on the generated first key information; and based on the decrypted core network related dynamics Identity information exports the second record information. The method can further include the steps of: receiving a first 15 key generation identifier when received, and generating, when generated, the first key information also associated with the received key generation identifier. A first key generation identifier can be pre-assigned, and when generated, first key information associated with the pre-assigned key generation identifier can also be generated. Upon receipt, a Ua message is received, and the method further includes processing the accepted message based on the derived second key 20 information, and the Ua message is protected and encapsulated using the key generation related information. Further, according to the above method, the core network related dynamic identity information includes at least one of a network application function domain name server name and a U a interface protocol identifier. The key generation related information may include at least the following: ... unique user identifier of 13 200915814; - at least one of a random number and a result. The version is pushed from the code key content; the general bootstrapping architecture Incoming information - the encrypted part; the universal bootstrap architecture pushes the information - the integrity protection part; the derived _ and second keys; - the key lifetime; and the 5 10 V universal bootstrapping user setting . The user equipment processing command information includes at least an unencrypted information element indicating an action selection. Further in accordance with the exemplary embodiments, there may be a step of generating generic information based on the authenticator, and the method may further include integrity protection based on the general bootstrapping framework of the first information section. The above method can be implemented as a result of execution of computer program instructions stored in any suitable type of computer readable memory medium. The exemplary embodiments further include a first device, the first device including a receiver, the receiver being configured to receive a key to generate information related information for a particular user device 15 and to process the user device Command information; a generator configured to generate first record information related to the user's processing instruction received by the receiver; an encryptor configured to be based on the generator Generating the key information to encrypt at least core network related dynamic identity information; and a transmitter configured to send the key 20 to generate related information, the key generation related information including at least the core encrypted by the encryptor The network related dynamic identity information and the user equipment processing instruction information received by the receiver. The apparatus can further include an obtainer and an exporter configured to obtain an authentication to 200915814 containing a random number and cryptographic key content, the exporter being configured to be derived for subsequent use by the group Coordinated with the generic key information of the generator that generated the information. The apparatus may further include an acquirer configured to obtain a user identity token from a user database; and an exporter, 5 being configured to derive and then used to be configured Generating the universal key information of the generator of the first gold correction information. The user equipment processing instruction information received by the receiver may further include a mobile application identifier, and wherein the generator is further configured to generate and output the user equipment processing instruction information received by the receiver. The second key information of the off. The exemplary embodiments further include a second device, the second device including a receiver configured to receive gold including at least encrypted core network related dynamic identity information and user device processing instruction information The clock generates a correlation negative sil, and a generator is configured to generate first key information related to the user equipment processing instruction information received by the 15 receiver; a decryptor configured to generate based on the generation The encrypted core network related dynamic identity information received by the receiver after the first golden record information is solved, and an exporter configured to be based on the core network decrypted by the decryptor The relevant dynamic identity information is used to derive the second key information. Further in accordance with this aspect, the receiver is further configured to receive a first key generation identifier, and the generator is further configured to generate a number associated with the key generation identifier received by the receiver A key information. A first key generation identifier is pre-assigned, and the generator is further configured to generate first key information that is also associated with the pre-assigned key generation identifier. The receiver is further configured to receive a Ua message, and the apparatus further includes a processor configured to process the message received by the receiver based on the derived second key §fl. 5 The device may comprise a universal integrated circuit card and a secure memory, and an interface, the interface being configured to provide at least a portion of the key generation related information to the universal integrated circuit card Or the secure memory. Corresponding to the above apparatus, the core network related dynamic identity information includes at least one of a network application function domain name server name and a Ua interface agreement identifier; and the key generation related information includes the following At least one of: a unique user identifier; at least one of a random number and a sign result; a cryptographic key content; an encrypted portion of a generic bootstrapping push information; the generic bootstrapping architecture One of the push information integrity margins is 'exported first and second keys; - key lifetime; and to I5 less - universal bootstrapping user settings (〇聪). The user device processing instruction information includes at least one unencrypted information element indicating an action selection. 4 - the device may further include a creator configured to generate a universal information based on the 4 discriminator s; and a discriminator, the 4α device being configured to be based on the first gold The information identifies the integrity protection portion of the generic bootstrapping architecture 20 push information. The first device can be composed of a bootstrap server function and a network application function, and the second device can be composed of one of a user device, a mobile device and a universal integrated circuit card. . Further in accordance with the exemplary embodiments, another apparatus includes means for invoking 16 200915814 - special user equipment to receive information related to the generation of information - query and use = device processing instruction information; for generating and using The first gold record accommodating information related to the user equipment processing instruction information received by the receiving device is used to encrypt at least the core network related dynamic identity information generated by the device for generating the device And a device for generating a signal by the key, the key generating the relevant information packet eight times, the device for adding the device, and at least the core network related dynamic body and The user equipment processing instruction information received by the apparatus for receiving. ία (4) The exemplary embodiments, and the apparatus comprise: i=at least the encrypted core network related dynamic identity information and the user = means for processing the instruction information; for generating and processing the received money, the user equipment processing instruction, the message has been used for the production of the device based on the production The key information solution 15 t ^ ^ is received by the receiving device _ the encrypted H-channel related dynamic information I set; and the _ heart network related dynamic identity information for decrypting based on the device for decryption and derivation derives the second gold The device of the key information provides some advantages. For example, there is no need to pass the source IP address from the 1P layer to the -GBA client, so there is no need for 20 to have inter-layer communication. The use of exemplary embodiments, for example, provides insensitivity to changes in the course of the NAF and is therefore applicable, for example, to networks with poor connectivity whose IP addresses may change frequently. Further examples of such The use of the exemplary embodiment provides the invariance of the NAF bit 17 200915814. For example, if, for example, the naf is used behind a firewall or a network address interpretation traversal server, then the proximity server and firewall are not A further problem arises. Further examples, the use of such exemplary embodiments provides a mitigation of DoS (Service 5 Rejection) attacks (because core IP addresses are vulnerable to such DoS attacks). By way of example, the use of the exemplary embodiments removes the need for both Ua endpoints to implement an additional key derivation mechanism and to choose between them based on usage scenarios. 10 Further example, the exemplary embodiments are removed (for example) the need to make changes to a smart card (eg, UICC) within a terminal. Figure 1 shows an individual method of supplying gold record parameters in accordance with an exemplary embodiment of the present invention. The horizontal direction is indicated, and the time plane between the transmissions is reflected in the vertical arrangement of the transmission sequence and the serial number. 15 As shown in FIG. 1, a communication system 100 can include an access network 104 and a user equipment UE. 102. The access network 104 can then include a network application function NAF 101, a bootstrap server function bSf 1〇3, and a retrievable base station BS 104' for providing an access technology to the UE 102. As described herein below. It should be noted that the NAf ι〇1 and the bsf 103 can be independent functions of communication via the Zpn interface point, for example, within the access network 104. Alternatively, the NAF 1〇1 and the BSF 1〇3 may also be functions included in, for example, a single server (a dotted square around the symbol of the NAf ι〇1 and the BSF 103) Point out). As a further alternative, the BSF 103 can be combined to function as a NAF 1〇1. If the BSF 1〇3 and the 18 200915814

The NAF 101 is set together and the Zpn reference point can be deleted. Without being limited thereto, in order to simplify the description, the following description only describes the latter option 'and the reference symbol "NAF/BSF 101" is used to describe the BSF 103 ° 5 as the NAF 101, in addition to the NAF 101 and the UE. 102 can be configured to pass, for example, an application agreement via the Ua reference point, and pass an AKA agreement via the Upa reference point. The BS 104 can be located within the signal path between the NAF 101 and the UE 102 to provide compliance with the access technology of interest. As shown in FIG. 1, according to a first method, in step S1-1, the 10 NAF 101 (or NAF/BSF 101) can perform key generation related information on a specific user equipment (for example, a GBA). One of the -PUSH-INFO GH) queries and user device processing (security) command information (eg, one of the instructions used by Upa).

In step S1-2, the NAF 101 may perform to generate a first key information related to the received user device processing instruction information (eg, an indication of Upa usage) (eg, Ks-(ext/int) ) _BSF) steps. As an alternative to this first-key export procedure, there are several different possibilities. For example, the BSF 103 name (and the specified specific Ua agreement identity), or any other generally known (non-private information cracking) information (or pre-formed information) can be used as long as it conforms to the NAF-ID format. (Therefore, there is no need to change (for example) a smart card issued under 3GPP Release 6 or 3GPP Release 7, and if it is used in a similar manner as 2G GBA TR 33.920, there is no need to change the user identity module SIM card). The key derivation can be performed in the BSF 103. In step S1-3, the NAF 101 can perform encryption to at least the core network phase 19 200915814. The dynamic identity information (eg, encrypting the NAF DNS name, resulting in encryption of one of the GPIs) The part 'below is called 'E_GPI'). The £_0?1 can also contain (for example) unencrypted information. For example, information about selecting an endpoint of a bootstrap ME or UICC (Upa-Use), or (for example, an endpoint based on generated key information (eg, Ks_(ext/int)_BSF) (eg, Information about the type of bootstrapping of a permanent or short-term key. In step S1-4, the NAF 101 may perform a key generation related to the at least the encrypted core network related dynamic identity information (eg, the encrypted NAF DNS name) and the received user equipment processing instruction information. A 10 message (e.g., push GPI) is sent to the UE 102. According to a second method, the UE 102 can perform receiving, in step S2-1, at least the encrypted core network related dynamic identity information (eg, E_GPI including the encrypted NAF DNS name) and the user equipment processing instruction. The key to the information (for example, the instructions used by Upa) generates information (for example, the GPI pushed by 15 of the NAF/BSF 101). In step S2-2, the UE 102 may perform to generate first key information related to the received user equipment processing instruction information (eg, related to the indication used by Upa) (eg, presence in the UE 102) Ks_(ext)_BSF on a UICC. As an alternative to the export of this first gold record, it can have different possibilities. For example, the BSF name (and the specified specific Ua agreement identity) or any other generally known (non-private information cracking) information, or pre-formed information, can be used as long as it conforms to the NAF-ID format (and therefore does not need to be changed) (For example) a smart card issued under 3GPP Release 6 or 3GPP Release 7, or 20 200915814 in a similar manner as 2GGBATR 33.920). It should be noted that the BSF name is used as a non-limiting example. In step S2-3, the UE 102 may perform decryption of the received encrypted core network 5 related dynamic identity information (eg, decrypt E_GPI, based on the generated first record information (eg, Ks_(ext)_BSF), The DNS name that caused the NAF/BSF 1 〇1). In step S2-4, the UE 102 may perform the export of the second key information based on the decrypted core network related dynamic body information (e.g., the DNS name of the NAF/BSF 101). 10 In accordance with a further embodiment of the first method above and refinement, in step S1-1-1, the NAF/BSF 101 may further perform obtaining an authentication vector (AV) that is included, for example, for further use. The master key data of the application specific certificate (hereinafter also referred to as cryptographic key content), including at least one random number (RAND), one authentication token (AUTN), one expected response (XREs), 15 a key (CK) and an integrity key (DQ, and exporting generic key information (eg, 'Ks) for subsequent generation of key information (eg, Ks_(ext/int)_BSF) may be performed. Alternatively, a user identity token can be obtained during the acquisition described above. In addition, the received user device processing instruction information can further include a mobile application 20 identifier (eg, Ua-appli- Id), such that in step S1-2-1, the NAF/BSF 101 can generate second key information (eg, Ks_(ext/int)_NAF) based on the received user equipment processing instruction information. In addition, in the first and second methods, the core network related dynamic body The information may include a web application functional domain name server 21 200915814 5 10 (NAF DNS) name and/or a Ua interface protocol identifier. In addition, the 1 key generates relevant information (eg 'GPD may include - unique user identification ^ For example, Internet Protocol Multimedia Subsystem Private User Identity (ΐΜρι), Internet Protocol Multimedia Subsystem Public User Identity (IMpu) or other user identifier, at least one random number (RAND) or - sign result (SRES), cryptographic key content, the encrypted portion (E_GPI) mentioned in 1 for the general bootstrapping structure, and the integrity protection part (hereinafter referred to as I_GPI) of the general bootstrap architecture push information, The exported first and second gold 2 (Ks_(ext/int)_NAF), one key lifetime and/or at least the general bootstrapping user setting (GUSS). Moreover, the user equipment processing instruction information may include Instructing at least one unencrypted information element (eg, one bit) used by Upa. In addition to the further embodiment and refinement of the second method above, in step S2-1-1, the UE 102 may Further basis The random number 15 and the discriminator are executed to generate general key information (Ks). Further, in step S2-2-1, the UE 102 may perform discriminating the universal bootstrapping architecture based on the first key information. Information integrity protection part (I_GPI). Alternatively, when receiving (step S1-1) 'a first key generation identifier can be received' and in the generating step, with the received gold The first key information of the key generation identifier having 20 levels can also be generated. Alternatively, the first key generation identifier may be pre-assigned, and in the generating (step S1_2), the first information about the pre-assigned key generation identifier may also be produce. Alternatively, for example, the UE 102 may further perform reception of a Ua message, and in step S2-5, the UE 102 may perform further based on the second key information (Ks_(ext)_N AF) derived from 22 200915814. The received message (eg, a Ua message) is processed. Figure 2 shows individual devices (e.g., NAF/BSF 101 and user equipment UE 5 1〇2) for the provisioning of key parameters in accordance with an exemplary embodiment of the present invention. As an example, the UE 102 can be a terminal that can access the IP capability of the access network 104. The ue 102 can further include a security module in a given form, such as a smart card, a separate chip. Or a security software module. As shown in FIG. 2, the NAF 101 (or 10 BSF 103 as the NAF 101) may include a central processing unit CPU 1011, a memory 1012, a transmitter (Tx) 1013, and a receiver (Rx). I〇i4, a generator 1015, an encryptor 1〇16, a deductible exporter ion, and at least one optional additional CPU 1011a. It is to be noted that, for the sake of simplicity of description, each reference to the CPU 1011 of the NAF/BSF may also refer to at least one of the additional CPUs 1011a that are less than one alternative. The generator 1015, the encryptor 1016, and the optional exporter ion can be implemented, for example, as software or individual entities executing on the CPU 1011 as indicated by the dashed line of the functional blocks of the CPU 1011. It should be noted that the functions of the transmitter 1013 and the receiver 1014 may be individual entities as shown in FIG. 20 or alternatively may be performed by an integrated transceiver (not shown). The CPU 1011 can be configured to process various data inputs and to control the memory 1012, the transmitter 1013, the receiver 1014, the generator 1015, the encryptor 1016, the optional exporter ion, and the at least 23 200915814 An additional option to CPU 1011a. The memory 1 可用 2 can be used to store program instruction code (more generally, a code device) for performing an individual method in accordance with an exemplary embodiment of the present invention when executed on the CPU 1011. The receiver 丨〇13 of the 5 NAF/BSF 101 can be configured to receive one of the key generation related information (eg, GPI) queries and user equipment as described in connection with an individual method in accordance with an embodiment of the present invention. Process instruction information (for example, instructions for use by Upa). It should be noted that the query may originate from another network element (not shown) in the access network 104. The generator 1015 of the NAF/BSF 101 can be configured to generate first key information A1 (e.g., Ks_(ext/int)_BSF) related to user equipment processing instruction information received by the receiver 1013. The NAF/BSF 101 cipher 1016 can then be configured to encrypt at least the core network related dynamics information (dynamic ID information, such as encrypting the NAF/BSF 101) based on the key information A1 generated by the generator 1015. The DNS name, resulting in E_GPI). The transmitter 1014 of the NAF/BSF 101 can be configured to transmit at least the core network related dynamic identity information (encrypted dynamic ID information) encrypted by the encryptor 1015 and the user received by the receiver 1013. 20 The key of the device processing instruction information (for example, the indicator used by Upa) generates relevant information (for example, GPI). As shown in FIG. 2, the UE 102 can include a CPU 1021, a memory 1022, a transmitter (Tx) 1023, a receiver (rx) i24, a generator 1025, and a decrypter 1026. An exporter 1 〇 27, a removable creation 24 200915814 1028, a tamper discriminator 1029, and a removable interface (I/F) 10210. As indicated by the dashed line range of the functional blocks of the CPU 1021, the generator 1025, the decryptor 1026, the exporter 〇27, the removable creator 5 1028, the evasive discriminator 1 〇 29, and the alternative The interface 1〇21〇 can be implemented as software executed on the CPU 1021 or as an individual entity. It should be noted that the functions of the transmitter 1023 and the receiver 1 24 may be separate entities as shown in FIG. 2, or alternatively may be performed by an integrated transceiver (not shown). 10 The CPU 1021 can be configured to process various data inputs and to control the suffix 1022, the transmitter 1 〇 23, the receiver 1 〇 24, the generator 1025, the decryptor 1 〇 26, the export The device 1 〇 27, the tamper creator 1028, the evaluable discriminator 1 〇 29, and the function of the removable interface 1 〇 21 。. The memory 1022 can be used to store program devices for performing, for example, individual methods in accordance with the present invention when executed on the cpu 1〇21. The receivers 〇23 of the UE 102, as described in connection with the individual methods in accordance with the exemplary embodiments of the present invention, can be configured for a particular user equipment to receive dynamic identity information including at least an encrypted core network. (eg 'E-GPI' encrypted NAF/BSFDNS name) and the key generated by the user device processing 20 command information (eg, instructions for use by Upa) to generate relevant information (eg 'GPI'). Alternatively, the receiver 1 〇 23 of the uE 1 〇 2 can be further configured to receive a Ua message. It should be noted that this trade-off message (msg) can be derived from the NAF/BSF 101 °. In this case, subsequent operations of generating, decrypting, exporting, and processing 25 200915814 may generate the sfl (msg) A successful overall treatment. The alternative way 疋's sfl (msg) can be derived from another naf/bsf 101 in the communication system 1 〇〇. In this case, subsequent operations of generating, decrypting, exporting, and processing may partially or completely fail' thus resulting in one of the selectable messages (msg) not being a successful overall processing. The generator 102 of the UE 102 can be configured to generate first key information A2 (eg, Ks_(ext) related to user equipment processing instruction information (eg, an indication of use at 3) received by the receiver 1023. BSF). The decryptor 1026 of the UE 102 can be configured to then decrypt the encrypted core network related dynamic identity information received by the receiver 1023 based on the first key information A2 generated by the generator 10 1025 (eg, decryption) E_GPI, which causes the NAF DNS name). The exporter 1027 of the UE 102 can be configured to derive a second key information B2 (eg, Ks "ext)_NAF based on core network related dynamic identity information (eg, NAF DNSS 15) decrypted by the decryptor 1026. ). According to a further embodiment of the above NAF/BSF 101, for example, the CPU 1011 may be further combined to obtain an authentication vector in conjunction with the memory 1012 of the NAF/BSF 101 (which may be considered an acquirer). (AV), the AV contains primary key 20 key data (also referred to as cryptographic key content) used for further specific application credentials, including at least one random number (RAND), one authentication token (AUTN), one At least one of a desired response (XRES), a key (CK), and an integrity key (IK). The retractable exporter 1017 can be configured to derive generic key information (e.g., 'Ks, indicated by a dashed key symbol) for subsequent use to be assembled to generate key information A1 (Example 26 200915814 as 'Ks-(ext /int) A generator 1015 of a BSF). Alternatively, the obtainer can be configured to obtain a user identity token. In addition, the received user equipment processing instruction information may further include a mobile application identifier (eg, Ua-appli-id) such that the generator 1 15 may be further configured to be based on the The received user equipment processing instruction information generates first key information B1 (eg, Ks_(ext/int)_NAF). Alternatively, the universal key information (Ks) may also be based on a 2G discrimination vector (2G discrimination vector (AV = RAND, SRES (signal response), Kc (secure)). In addition, in the NAF/BSF 101 and the UE 102 10 according to the present invention, the core network related dynamic identity information (Dynamic ID information) may include a network application function domain name server (for example, NAF DNS). Name and / or a Ua interface protocol identifier. In addition, the key generation related information (eg, GPI) may include a unique user identifier, such as ΙΜρι, IMpu or other user identifier, at least one random number (RAND) or a sign result 15 (SRES), The encrypted key content (E_GPI) mentioned above for the cryptographic key content, the general bootstrapping architecture push information, one integrity protection part of the general bootstrapping architecture push information (I_GI>I), the first and the first derived Two keys, one key lifetime and/or at least one universal bootstrap architecture user setting (GUSS). The user device processing instruction information may include at least one unencrypted information element (e.g., one bit) indicating, for example, Up a. In addition, in accordance with further embodiments and refinements of the UE 102, the removable creator 1 28 of the UE 102 can be configured to be based on the random number (RAND) and the authentication token (AUTN). Generic key information (Ks, as indicated by the dashed key symbol) is generated. In addition, the UE 102 retrievable authenticator 27 200915814 1029 can be configured to authenticate the integrity protection portion of the general bootstrapping architecture push information (I_GPI) based on the first key information. The first key information A1' may be key information corresponding to the key information A1 generated by the generator 1015 of the NAF/BSF 101. Alternatively, the receiver 1023 can be configured to receive a first key generation identifier, and the generator 1025 can be configured to generate the gold also received with the receiver 1 〇2 3 The key generates the first key information related to the identifier. Alternatively, the first key generation identifier can be pre-assigned, and the generator 1025 can be further configured to generate a first gold 10 that is also associated with the pre-assigned key generation identifier. Key information. As an additional option, for example, the CPU 1021 of the UE 102 can be further configured to be processed by the receiver 1 based on the second key information B2 (e.g., Ks_(ext)_NAF) derived by the exporter 1027. 23 receives the optional message (eg, Ua message) described above. In addition to this, the UE 102 can alternatively be comprised of a mobile device or a universal 15 integrated circuit card. Moreover, the removable creator 1028 can also be comprised of a universal integrated circuit card that can be inserted into the UE 102 by a chipset (indicated by functional blocks extending to the function splicer 1028 of the functional block of the UE 102). The UE 102 can further include the universal integrated circuit card (1028) or a secure memory (not shown) and the removable interface (10210), the selectable 20 interface (10210) can be configured to provide the gold The key generates at least a portion of the related information (eg, a portion of the GPI or GPI) to the universal integrated circuit card or the secure memory. The UE 102 can also be implemented as a chip or module. An exemplary embodiment of the present invention also provides a system comprising at least one of the NAF/BSF 101 and the UE 102 in accordance with the present invention in accordance with 28 200915814. Exemplary embodiments of the present invention can be summarized as follows, and are not limited to the given techniques and implementation details. For NAF key derivation of the UE 102, the NAFID needs to be available before the 5 keys Ks_ext/int_NAF can be derived from Ks. Therefore, the latter key is not useful for confidentially protecting the NAF ID. One possible solution to provide confidential protection for this NAF ID transmission is to use an additional record. An additional (intermediate) key export can be used for this purpose. As an input to this key export, there are different possibilities. The BSF name (and the specified 10 special Ua-contracted identity) or any other generally known (non-private information cracking) information can be used as long as it conforms to the NAFD format (and therefore does not need to be attached to a previously issued UICC) . This means that this NAF ID compliance information can be pre-allocated in the UE (Smart Card or GBA-ME and GBA_U ME) or transmitted/broadcast before bootstrapping, as two examples. Since this key export 15 needs to be executed within the BSF', a BSF name can be used. Otherwise, a claim is added to the Zpn-Request message. In addition, the key derived from the BSF using the NAF-ID=BSF name is not passed to the request NAF. This provides the ability to modify (for the integrity protection of the Qpi) and read the protected portion of the GPI. In this case, the BSF 20 is a trusted server, and the encryption needs to be passed to the NAF ID of the UE. This data cannot be modified by this NAF. A UE with the ability to resolve 1^8: ID from an ιρ address can check and match this data. At the same time, the encrypted value is used as an authorization token (similar but not equal to an authentication method, wherein the B-TID of this form is used as a device for checking whether the UE is involved), and the encrypted value is 29 200915814 is verified by the UE to prove that the sending NAF is authorized to push information to the UE. If the bootstrap lifetime is explicitly included in the GPI and is protected by Ks_(ext)_BSF integrity, then when a NAF stores the GPI in the network for too long (by validating the lifetime before bootstrapping), It allows to deny a UE's bootstrapping. A 5 NAF that sends a tampering GPI with an invalid RAND AUTN cannot be blocked, but the bootstrap attempt will fail. A NAF that sends a tampering GPI with a valid (but unused) RAND AUTN cannot be blocked, and if the NAF is not allowed as a push NAF, it will not be able to integrity protect the GPI, so it is It is detected (the NAF will use the Zn interface to request a NAF key as specified by 3GPP Specification 10 TS 33.220), which may result in a successful bootstrapping. For proper key export, the DNS name and other key export data may need to be securely passed to the user and integrated into the key exporter at the terminal and network. This mechanism ensures the integrity protection of the passed Dns name and ensures confidentiality protection (privacy). The security of a DNS name is important to prevent a possible so-called phishing attack. This confidentiality protection may be important to avoid a user being able to link to a certain content via the host name. The mechanism also has the following characteristics: The broadcast servo state (NAF, possibly in the visited network) cannot modify the bootstrapping related data to be sent to the UE. This allows the roaming use of 20 in other countries to be as normal-like "no listening, information. The solution according to an exemplary embodiment of the present invention provides a means for protection - network initialization GBA bootstrapping (4) - some information Protected from tampering and observation mechanisms, particularly when there is no basic carrier network security (eg, in a broadcast mode network), material embodiments are needed and important. 30 200915814 Others of the invention Embodiments may also be provided. For the purposes of the present invention as described herein above, it should be noted that 'an access technology may be any technology by which a user can access an access network. Any current or Future technologies such as Wireless Zone Access Network 5 (WLAN), Cable Networking, Microwave Access World Collaboration (WiMAX), Bluetooth, Infrared, and the like can be used. It should be further noted that The fetch network can be any device, unit or device that a mobile station entity or other user device can connect to and/or use for services provided by the access network. And/or (audio_) visual communication, data 10 download, etc. In general, the exemplary embodiments of the present invention are also applicable to such network/terminal environments relying on a data packet-based transmission scheme, data may be According to the data packet-based transmission scheme, the data packet is transmitted, and the like, for example, may be based on the Internet Protocol Ip. However, the exemplary embodiments are not limited thereto, m any other present or future (four) or line New (Μιρ) version, or more generally, an agreement that follows a similar principle to (M)IPv4/6 can also be applied. - User device entity can be - system user can borrow from - access network experience service Any device, unit or device. 20 彳 indicates that the method steps that may be implemented as part of the software code and are used by the processor are software code independent and may be specified using any known or future developed programming language. As long as the overall functionality defined by the method steps is preserved. - Generally, any method step is implemented as a corpus or by hardware 31 200915814, according to The functions implemented do not alter the nature of the exemplary embodiments of the present invention. The method steps and/or devices, units or devices that may be implemented as a hardware component or network component or a module thereof in a mobile station are hardware independent. And can be implemented using any known or future developed hardware technology or any combination thereof, such as metal oxide semiconductor (MOS), complementary MOS (CMOS), bipolar MOS (BiMOS), bipolar CMOS ( BiCMOS), emitter-coupled logic (ECL) 'Crystal-Crystal Logic (TTL), etc., utilizing, for example, a specific application integrated circuit (1C) component (ASIC), field programmable gate array (FPGA) element 10 Pieces, complex programmable logic device (CPLD) components or digital signal processor (DSP) components. In addition, any method steps and/or devices, units or devices that may be implemented as software components may, for example, be based on Multimedia Broadcast Multicast Service (MBMS); in particular, MBMS Security compliant software modules may be used. Although I5 security MBMS is used herein as an example for a security service for description purposes, any security architecture capable of, for example, authentication, authorization, key protection, and/or protection of traffic can be applied. A device, unit or device (eg, user equipment, BSF, and NAF) may be implemented as an individual device, unit, or device, but this does not preclude that they are implemented in the system in a two-knife manner, as long as the device The function of the unit, unit or device is maintained. Bu is used for the described parameters, functions, message types, interfaces and classes (10) (eg 'BSF, Gpi, Win, etc.) various names: U day is limited to any level, because these parameters, functions, messages class 32 200915814 type The interface, and the like, can be identified by any suitable name.

It should be noted that the words "connected," "', or any change thereof mean any connection or _ between two or more elements, either directly or indirectly, and may include "connected," Or "minus," there are more than 4 centerpieces between the two components. The _subtraction or connection of the components may be physical, logical or the like-combination. As used herein, two elements may be considered to be "connected" or "bonded" by using - a wire, a rib, and/or a printed electrical connection, and by using electromagnetic energy, for example, Radio frequency range, microwave range, and optical (visible and invisible) electromagnetic energy of wavelengths within 10 turns' as a few non-limiting and non-exhaustive examples. Furthermore, some of the various non-limiting and exemplary embodiments of the present invention Features may be used to provide advantages without the corresponding use of the other features. Thus, the above descriptions are intended to be merely illustrative of the principles, teachings, and exemplary embodiments of the invention, and are not limiting. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 shows an individual method for the supply of a key parameter in accordance with an exemplary embodiment of the present invention; and FIG. 2 shows a supply of a key parameter for use in accordance with an exemplary embodiment of the present invention. Individual devices (for example, a user device and ]^8 1/8517). 20 [Description of main component symbols] 100...Communication system 101·.·Network application function 102...User device 103··· Bootstrap servo The function 104 is connected to the network 1011... the central processing unit 1011a... the central processing unit 1012...the memory 33 200915814 1013...the transmitter 1026···the decryptor 1014...the receiver 1027...the exporter 1015...the generator 1028...creator 1016... encryptor 1029... discriminator 1017... exporter 10210... interface 1021---CPU S1-1 'S1-1-1 * S1-2 > S1-2-1 ' 1022...memory Sl-3, S1 -4, S2-1 > S2-1-1 ' 1023... Transmitter S2-2 'S2-2-1, S2-3, S2-4, 1024··· Receiver S2-5...Step 1025...Generate 34

Claims (1)

200915814 X. Patent application scope: 1. A method includes the following steps: receiving a user equipment processing instruction information and a key generation related information query; generating a first gold related to the received user equipment processing instruction information Key information; encrypting at least core network related dynamic identity information; and replying the query with the key generating relevant information, the key generation related information including at least the encrypted core network related dynamic identity information and the received user equipment Process instruction information. 2. The method of claim 2, wherein the query for generating the relevant information comprises a GBA-PUSH-INFO General Bootstrapping Architecture Push Information (GPI). 3. The method of claim 1, wherein the user equipment processing instruction information includes an indication of an Upa use. 4. The method of claim 1, wherein the first key information is generated to consider a bootstrap server function (BSF) name and a specified specific Ua agreement identity. 5. The method of claim 1, wherein the first key information comprises Ks"ext/int)_BSF, wherein the core network related dynamic identity information comprises a network application function domain name server ( NAF DNS) name, where encryption is based on the generated Ks "ext/int"_BSF to encrypt the NAF DNS name, resulting in a universal bootstrapping architecture push information (GPI) encrypted portion (E_GPI). 35 200915814 6. The method of claim 5, wherein the E_GPI also includes unencrypted information. 7. The method of claim 6, wherein the unencrypted information comprises Upa use. 8. The method of claim 6, wherein the unencrypted information comprises a Universal Integrated Circuit Card (UICC) selection information. 9. The method of claim 1, wherein generating comprises obtaining an authentication vector (AV). 10. The method of claim 9, wherein the AV comprises a cryptographic key content, the cryptographic key content comprising a random number (RAND) for generating the first key information, a discriminator At least one of (AUTN), a desired response (XRES), a key (CK), and an integrity key (IK). 11. The method of claim 1, wherein the received user device processing instruction information comprises a mobile application identifier Ua-appli-id. 12. The method of claim 1, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier. . 13. The method of claim 1, wherein the key generation related information comprises a unique user identifier. 14. The method of claim 1, wherein the key generation related information comprises an Internet Protocol Multimedia Subsystem Private User Identity (IMPI) or an Internet Protocol Multimedia Subsystem Public Use 36 200915814 Identity (IMPU). & such as the scope of patent application! The method of the item, wherein the gold output generates a correlation poverty comprising at least one of a random number and a _ sign result; a cryptographic gold correction content; a universal bootstrap architecture push information - an encrypted portion; The architecture pushes the information into the integrity protection part; the derived first and first gold records, one golden wheel life; and at least one universal bootstrap architecture user setting. 16. The method of claim i, wherein the user equipment processing instruction information comprises at least one unencrypted asset fli 7L indicating an action selection. 17-- is grouped into the memory (4) system of the program instructions, the execution of the program instructions causes the execution of the following steps: receiving the user equipment processing instruction information and the gold record generation related information query; generating and The received user equipment processes the first information related to the instruction information; encrypts at least the core network related dynamic identity information; and replies to the query by generating the related information, the key generation related information includes at least the encrypted core The network related dynamic identity information and the received user equipment processing instruction information. 18. The memory medium of claim 17, wherein the query for generating the relevant information includes a GBA_PUSH_INF〇General Bootstrapping Structure Push Information (GPI). 19. The memory medium of claim 17, wherein the device processing instruction information comprises an indication of an Upa usage. 20. The memory medium of claim 17, wherein the first key information is generated to consider a bootstrap server function (BSF) name and a specified specific-Ua agreement identity. 21. The memory medium according to claim 17, wherein the first record information comprises an inverse 8_(6\1/丨11〇_:88?, wherein the core network related dynamic identity information includes one The network application functional domain name server (NAF DNS) name, where the encryption encrypts the NAF DNS name based on the generated Ks_(ext/int)_BSF, resulting in an encrypted portion of one of the generic bootstrap architecture push information (GPI) (E_GPI) 22. The memory medium of claim 21, wherein the E+GM also includes unencrypted information. 23. The memory medium of claim 22, wherein the The encrypted information includes the use of the Upa 24. The memory medium of claim 22, wherein the unencrypted information comprises a Universal Integrated Circuit Card (UICC) selection information. 25. As described in claim 17 The memory medium, wherein the generating comprises obtaining an authentication vector (AV). 26. The memory medium of claim 25, wherein the AV comprises a cryptographic key content, the cryptographic key content comprising a random number (RAND), a discriminator At least one of (AUTN), a desired response (XRES), a key (CK), and an integrity key (IK) for generating the first key information. The memory medium of claim 17, wherein the user equipment processing instruction information received by the terminal 38 200915814 includes a mobile application identifier Ua-appli-id. 28. The memory according to claim 17 The medium, wherein the core network related dynamic identity information includes at least one of a network application functional domain name server (NAF DNS) name and a Ua interface protocol identifier. 29. The memory medium, wherein the key generation related information comprises a unique user identifier. 30. The memory medium of claim 17, wherein the key generation related information comprises an internet protocol Multimedia Subsystem Private User Identity (IMPI) or an Internet Protocol Multimedia Subsystem Public User Identity (IMPU). 31. The memory medium of claim 17 wherein the gold The key generation related information includes at least one of a random number and a positive sign result; the cryptographic key content; one of the universal bootstrap architecture push information encrypted portion; the universal bootstrapping architecture push information one integrity protection a knives, derived first and second keys; a key lifetime; and at least one universal bootstrapping user setting. 32. The memory medium of claim 17, wherein the user device The processing instruction information includes at least one unencrypted information element indicating an action selection. 33. If you apply for the New York media as described in Item 17, the Bootstrap Servo Function (BSF) is implemented. 34. The memory medium as described in claim 17 of the patent application is implemented as a chip or module. 35. A device, comprising: a receiver configured to receive a user device processing instruction information and a request for information related to a key generation; a generator configured to generate a user device with the received user device Processing first information related to the instruction information; an encryptor configured to encrypt at least core network related dynamic identity information; and a sender configured to generate a related information response request by the key, The key generation related information includes at least the encrypted core network related dynamic identity information and the received user equipment processing instruction information. 36. The device of claim 35, wherein the request for the key to generate the relevant information comprises a GBA-PUSH-INFO universal bootstrapping architecture push (GPI). 37. The device of claim 35, wherein the user device processing instruction information includes an indication of an Upa use. 38. The device of claim 35, wherein the generator generates the first key information to consider a bootstrap server function (BSF) name and a specified specific-Ua agreement identity. 39. The device of claim 35, wherein the first information includes Ks_(ext/int) BSF, wherein the core network related dynamic identity information includes a web application function domain name server ( NAF DNS) name, where encryption is based on the generated Ks-(ext/int)_BSF to encrypt the NAF DNS name, resulting in one of the generic bootstrap architecture push information (GPI) plus 40 200915814 secret portion (E_GPI). 40. The device of claim 39, which also contains unencrypted information. 41. The device of claim 39, wherein the unencrypted information comprises Upa use. 42. The device of claim 39, wherein the unencrypted information comprises a Universal Integrated Circuit Card (UICC) selection information. 43. The device of claim 35, wherein the generator is further assembled to obtain an authentication vector (AV). 44. The device of claim 4, wherein the AV comprises a cryptographic key content, the cryptographic key content comprising a random number (RAND), an authentication token (AUTN), and an expected response. (XRES), a key (CK), and at least one of an integrity key (IK) for generating the first key information. 45. The device of claim 35, wherein the received user device processing instruction information comprises a mobile application identifier Ua-appli-id. 46. The device of claim 35, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier. . 47. The device of claim 35, wherein the key generation related information comprises a unique user identifier. 48. The device of claim 35, wherein the key generation related information comprises an internet protocol multimedia subsystem private user 41 200915814 identity (IMPI) or an internet protocol multimedia subsystem public use Identity (IMPU). 49. The device of claim 35, wherein the gold record generating related hole comprises at least one of a random number and a positive sign result; the password key content; the general bootstrapping structure push information One of the encrypted portions; the universal bootstrapping architecture pushes one of the integrity protection portions of the information; the derived first and first keys, a key lifetime; and at least - the general bootstrap architecture user settings. 50. The device of claim 35, wherein the user device processing instruction information comprises at least one unencrypted information element indicating an action selection. 5L is implemented as a bootstrap server function (BSF) as described in claim 35. 52. The device of claim 35, which is implemented as an integrated circuit chip or module. The device includes: means for receiving a query of the user equipment processing instruction information and one of the key generation related information; and generating the first key information related to the received user equipment processing instruction information Means for encrypting at least core network related dynamic identity information; and means for replying the query with the key to generate related information, the key generation related information including at least the encrypted core network related activity 42 200915814 Status information and received user equipment processing instruction information. 54. The device of claim 53, wherein the query for the key generation related information comprises a GBA-PUSH-INFO General Bootstrapping Structure Push Information (GPI), wherein the user equipment processing instruction information includes One of the Upa uses one indication. 55. The device of claim 53, wherein the first key information comprises Ks_(ext/int)_BSF, wherein the core network related dynamic identity information comprises a network application function domain name server ( NAF DNS) name, wherein the encryption device encrypts the NAF DNS name based on the generated Ks_(extAnt)_BSF, resulting in a general bootstrapping architecture push information (GPI) encrypted portion (E J3PI) 'where the E_GPI is also Contains unencrypted information. 56. The device of claim 53, wherein the core network related dynamic identity information comprises at least one of a network application functional domain name server (NAF DNS) name and a Ua interface protocol identifier. . 57. The device of claim 53 is implemented in an access network coupled to the user equipment through a base station. 58. The device described in claim 53 is implemented as a bootstrap server function (BSF). 59. The device described in claim 53 is implemented as an integrated circuit chip or module. 60. A method comprising the steps of: receiving a user device at a command message and generating a key containing at least 43 200915814 confidential core network related dynamic identity information; generating and receiving the user device Processing the first key information related to the instruction information; decrypting the received encrypted core network related dynamic identity information; and deriving the second key information based on the decrypted core network related dynamic identity information. 61. The method of claim 60, wherein the received gold generated related information comprises a generic bootstrap architecture push information (GPI) pushed by a network application function (NAF). 62. The method of claim 60, wherein the encrypted core network related dynamic identity information comprises an encrypted portion (E_GPI) of a generic bootstrap architecture push information (GPI), the E_GPI includes a The encrypted network application functional area name server (NAF DNS) name, and the user equipment processing instruction information includes an indication of the use of Upa. 63. The method of claim 60, wherein generating the first key information uses Ks_(ext)_BSF of a Universal Integral Circuit Card (UICC) present in the user equipment. 64. The method of claim 60, wherein the first key information consideration generates a bootstrap server function (BSF) name and a specified specific Ua-agree identity. 65. The method of claim 60, wherein decrypting the received encrypted core network related dynamic identity information is based on the generated first key information decrypting an encrypted universal bootstrap architecture push information 44 200915814 (GPI), which causes one of the Network Application Functions (NAF) DNS names. 66_ The method of claim 60, wherein the second key information is derived to derive Ks_(ext)_NAF. 67. The method of claim 60, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier. . 68. The method of claim 60, wherein the key generation related information comprises a unique user identifier. 69. The method of claim 60, wherein the key generation related information comprises an Internet Protocol Multimedia Subsystem Private User Identity (IMPI) or an Internet Multimedia Subsystem public user identity ( IMPU). 70. The method of claim 60, wherein the key generation related information comprises at least one of a random number and a positive sign result; the cryptographic key content; one of the general bootstrapping push information The encrypted portion; the universal bootstrapping architecture pushes one of the information integrity protection portions; the derived first and second keys; a key lifetime; and at least one universal bootstrap architecture user setting. The method of claim 60, wherein the user equipment processing instruction information includes at least one unencrypted information element indicating an action selection. 72. A memory medium configured to store program instructions, the execution of which results in performing an operation comprising: receiving user equipment processing instruction information and including at least 45 200915814 confidential core network related dynamic identity information Generating relevant information; generating first record information related to the received user equipment processing instruction information; decrypting the received encrypted core network related dynamic identity information; and correlating based on the decrypted core network The dynamic identity information derives the second key information. 73. The memory medium of claim 72, wherein the received key generation related information comprises a universal bootstrap architecture push information (GPI) pushed by a network application function (NAF). . 74. The memory medium of claim 72, wherein the encrypted core network related dynamic identity information comprises an encrypted portion (E-GPI) of a general bootstrap architecture push information (GPI), Contains an encrypted network application functional area name server (NAF DNS) name, and an indication that the user equipment processing instruction information includes an Upa usage. 75. The memory medium of claim 72, wherein the first key information is generated using Ks_(ext)_BSF on a universal integrated circuit card (UICC) within the user equipment. 76. The memory medium of claim 72, wherein the first key information is generated to consider a bootstrap server function (BSF) name and a specified specific Ua-agreement identity. 77. The memory medium of claim 72, wherein decrypting the received encrypted core network related dynamic identity information is based on the first key information decrypted by the product. Architecture Push Information (GPI), which results in a DNS name for one of the Network Application Functions (NAF). 78. The memory medium of claim 72, wherein the second key information is derived to derive Ks_(ext)_NAF. 79. The memory medium of claim 72, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier. One. 80. The memory medium of claim 72, wherein the key generation related information comprises a unique user identifier. 81. The memory medium of claim 72, wherein the key generation related information comprises an Internet Protocol Multimedia Subsystem Private User Identity (IMPI) or an Internet Multimedia Subsystem public user. Identity (IMPU). 82. The memory medium of claim 72, wherein the key generation related information comprises at least one of a random number and a positive sign result; the password key content; the general bootstrapping structure push information One of the encrypted portions; the universal bootstrapping architecture pushes one of the information integrity protection portions; the derived first and second keys; a key lifetime; and at least one universal bootstrap architecture user setting. 83. The memory medium of claim 72, wherein the user device processing instruction information comprises at least one unencrypted information element indicating an action selection. 84. A device, comprising: 47 200915814 a receiver configured to receive user equipment processing instruction information and a key generation information including at least an encrypted core network related dynamic identity information; a generator that is grouped Configuring to generate first key information related to the received user equipment processing instruction information; and a decryptor configured to decrypt the received encrypted core network related dynamic identity information for use based on the The core network related dynamic identity information has been decrypted to derive the second record information. 85. The device of claim 84, wherein the received key generation related information comprises a generic bootstrap architecture push information (GPI) pushed by a network application function (NAF). 86. The device of claim 84, wherein the encrypted core network related dynamic identity information comprises an encrypted portion (E_GPI) of a generic bootstrap architecture push information (GPI), the E_GPI includes a The encrypted network application functional area name server (NAFDNS) name, and the user equipment processing instruction information includes an indication of the use of Upa. 87. The device of claim 84, wherein the generator generates the first key based at least in part on a Ks_(ext)_BSF on a universal integrated circuit card (UICC) in a user equipment. News. 88. The device of claim 84, wherein the generator generates the first key information based at least in part on a bootstrap server function (BSF) name and a specified specific Ua-agree identity. 89. The device of claim 84, wherein the decryptor decrypts an encrypted universal bootstrapping architecture based on the generated first key information to push 48 200915814 information (GPI), resulting in a network application function. (NAF) One of the DNS names. 90. The device of claim 84, wherein the derived second information comprises Ks_(ext)_NAF. 91. The device of claim 84, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier. . 92. The device of claim 84, wherein the key generation related information comprises a unique user identifier. 93. The device of claim 84, wherein the key generation related information comprises at least one of a random number and a positive sign result; the cryptographic key content; one of the general bootstrap architecture push information The encrypted portion; the universal bootstrapping architecture pushes one of the information integrity protection portions; the derived first and second keys; a key lifetime; and at least one universal bootstrap architecture user setting. 94. The device of claim 84, wherein the user device processing instruction information comprises at least one unencrypted information element indicating an action selection. 95. The device of claim 84, which is implemented as an integrated circuit chip or module. The device includes: means for receiving user equipment processing instruction information and key generation information including at least encrypted core network related dynamic identity information; and generating processing information with the received user equipment processing instruction 49 200915814 means for first key information; means for decrypting the received encrypted core network related dynamic identity information; and for deriving a second key based on the decrypted core network related dynamic identity information Information device. 97. The device of claim 96, wherein the received key generation related information comprises a generic bootstrap architecture push information (GPI) pushed by a network application function (NAF). 98. The device of claim 96, wherein the encrypted core network related dynamic identity information comprises an encrypted portion (E-GPI) of a generic bootstrap architecture push information (GPI), the E_GPI Encapsulation—The encrypted network application function domain name server (NAFDNS) name, and the user device processing instruction information includes an indication of the use of Upa. 99. The device of claim 96, wherein the decryption device decrypts an encrypted universal bootstrapping architecture push information (GPI) 5 resulting in a DNS function function (NAF), and wherein The second key information contains Ks_(ext)_NAF. 100. The device of claim 96, wherein the core network related dynamic identity information comprises at least one of a network application function domain name server (NAF DNS) name and a Ua interface protocol identifier, And wherein the key generation related information includes a unique user identifier. 101. The device of claim 96, which is implemented as an integrated circuit chip or module. 102. The device of claim 96, wherein the decrypting 50 200915814 is further configured to decrypt the received encrypted core network related dynamic identity information based on the generated first key information. . 103. A method comprising the steps of: receiving user equipment processing instruction information and one of a general bootstrap architecture push information (GH) query; generating a first gold related to the received user equipment processing instruction information Key information (Ks_(ext/int)_BSF); encrypting at least one network application function domain name server (NAF DNS) name, wherein one of the GPI E_GPI parts contains the encrypted NAF DNS name; and the E_G PI and The received user device processing instruction information replies to the query. 104. A method comprising the steps of: receiving a message comprising a generic bootstrap architecture push information (GPI) pushed by a network application function (NAF) and user device processing instruction information, wherein One of the GPI E_GH parts contains an encrypted network application function area name server (NAF DNS) name; generates first key information related to the received user equipment processing instruction information (Ks_(ext/int)_BSF Decrypting the received encrypted NAF DNS name; and deriving the second key information (Ks_(ext/int)-NAF) based on the decrypted NAF DNS name. 51