WO2007109994A1 - Method and apparatus for generating sequence number of encryption key in network - Google Patents

Abstract

A method and an apparatus for generating the sequence number of the encryption key in the network. The user equipment and the encryption key generator in the network side generate the sequence number RK1_SN of the first primary encryption key and the sequence number RK2_SN of the second primary encryption key respectively. The bits in RK1_SN and RK2_SN are added or connected to obtain the sub encryption key for the user equipment and the network side. The method and apparatus for generating the sequence number of the sub encryption key by the sequence numbers of two parent encryption keys can increase the security of the network

Description

 Method and device for generating key serial number in network

 The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for generating a key sequence number in a network. Background of the invention

 Currently, the key generated during the authentication process is generally generated by a parent key. The serial number of the subkey should be equivalent to the parent key serial number. However, if the subkey is generated by two parent keys through an algorithm, and each parent key maintains its own key sequence number, how to generate the subkey serial number, and no specific solution is given at present. . Summary of the invention

 The purpose of the embodiments of the present invention is to provide a method and a device for generating a key sequence number in a network, so as to generate a subkey serial number in the network, thereby improving network security.

 An embodiment of the present invention provides a method for generating a key sequence number in a network, including: a user equipment and a network side key generator respectively generate a first master key sequence number and a second master key sequence number;

 The bits in the first master key sequence number and the second master key sequence number are added or bit-connected to obtain a subkey sequence number of the user equipment and the network side.

 An embodiment of the present invention provides a device for generating a key sequence number in a network, including: a master key sequence number obtaining unit, configured to acquire a first time generated by a user equipment and a network side key generator in an authentication process Master key serial number and second master key serial number;

a sub-key sequence number generating unit, configured to add or bit-connect the bits in the first master key sequence number and the second master key sequence number acquired by the master key sequence number obtaining unit, Obtain the subkey serial number of the user equipment and the network side. The embodiment of the present invention provides a method and an apparatus for generating a subkey serial number by using two parent key serial numbers, where specifically, the bits in two serial numbers generated by the authentication process are added or connected, thereby obtaining The required subkey serial number can be provided in the wireless network system, thereby improving the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

 1 is a flowchart of generating a universal key sequence number in an embodiment of the present invention;

 FIG. 2 is a flowchart of a key sequence number generation process applied to a network authentication process according to an embodiment of the present invention; FIG. 3 is a schematic structural diagram of an apparatus according to an embodiment of the present invention. Mode for Carrying Out the Invention In the communication process, the authentication process is to mutually authenticate the terminal device and the network device by interacting with the authentication message between the terminal and the network device. In the embodiment of the present invention, determining the sequence number of the subkey needs to be generated from the sequence numbers of the two parent keys, and providing an implementation scheme for deriving the sequence number of the subkey from the sequence numbers of the two parent keys. To improve the security of the network communication process. An implementation solution provided by the embodiment of the present invention adds the key sequence numbers generated by the two authentications to obtain the authorized key sequence numbers of the user equipment and the network side. The implementation will be described below in conjunction with two specific application embodiments.

 Example 1

Assuming that the first authentication process is generated by the user equipment and the key generator RM, the corresponding first master key sequence number is RK1 - SN (4 bits); the second authentication process is at the user equipment and the secret The key RK2 generated by the key generator, the corresponding second master key sequence number is RK2-SN (4 bits); the subkey is the authorization key AK, and the serial number of the authorization key AK is AK_SN. When the authentication process is initial authentication, RK1-SN and RK2_SN must start from an initial value. Initialization, if initialized with 0, 1, 2 or 3; When re-authentication, the values of RK1_SN and RK2-SN are respectively increased by one.

 The method of obtaining AK-SN is to add the post-module 4 by using two bits of each sequence number, that is, AK_SN=( RK1_SN+RK2_SN ) modulo 4; (1)

 In equation (1), only two bits in RK1-SN and RK2-SN are added, such as using two bits lower for RK1-SN and two bits higher for RK2-SN; or

 RK1_SN uses the lower two bits, RK2_SN uses the lower two bits; or,

 RK1-SN uses two bits higher, RK2-SN uses two bits higher; or,

 RK1 - SN uses the upper two bits, and RK2 - SN uses the lower two bits.

 Thus, the key generators on the terminal and network side respectively generate a 2-bit authorized key sequence number according to the above formula.

 A flowchart for generating a serial number on the terminal and the network side is shown in FIG. 1 , wherein after the network side generates the license key serial number, the generator (such as an authenticator) may distribute the serial number of the subkey to use the Authorizer (such as a base station) that authorizes the key sequence number AK-SN.

 The specific implementation process of the embodiment of the present invention will be described below by taking an embodiment of the present invention in a WiMAX network as an example. 2 is a flowchart of a key sequence number generation process applied to a WiMAX network authentication process according to an embodiment of the present invention. As shown in FIG. 2, the sequence number generation method in this embodiment includes the following steps:

 (1) Perform two EAP (Extended Authentication Protocol) authentication procedures between the subscription station and the authentication server. After this process, the first dual master key is generated on the subscription station and the authenticator (Authenticator) respectively. PMK and its serial number PMK_SN and second dual master key PMK2 and its serial number PMK2_SN, wherein the PMK_SN and PMK2-SN are both 4 bits.

 (2) Generate the serial number 'J number of the authorization key ( AK: Authorization Key ) on the subscription station (mobile station) and the authenticator according to the following formula:

Add the modulo 4 using the two bits of each sequence number, ie: AK SN = (PMK_SN + PMK2_SN) modulo 4, and the obtained authorization key AK has a sequence number of 2 bits.

 For the selection of bits in PMK-SN and PMK2-SN, the following methods can be used:

PMK-SN uses the lower two bits, PMK2-SN uses the upper two bits; or,

 PMK—SN uses the lower two bits, PMK2-SN uses the lower two bits; or,

 PMK—SN uses two bits higher, PMK2—SN uses two bits higher; or,

 PMK—The SN uses the upper two bits, and the PMK2—SN uses the lower two bits.

 For example, if both PMK-SN and PMK2-SN use two lower bits, if PMK-SN is lower two bits are 01; if PMK2_SN lower two bits is 00, then (01 +00) modulo 4 - 01, that is, get 2 bits Authorization key serial number AK-SN.

 Thus, the serial number of the authorization key is obtained on the subscription station and the authenticator, respectively.

 Then, the network side authenticator sends a key material transmission message carrying the authorized key sequence number to the base station, where the message further includes an authorization key and a lifetime of the authorization key.

 Then, a negotiation of a new authorized key sequence number is performed between the subscribing station and the base station. Specifically, it can be negotiated with reference to the standards defined in IEEE802.16e-D12. Since the distribution of the key sequence number and the negotiation process of the serial number are the same as those of the prior art, they are not described herein.

 Example 2

Assume that the key RK1 generated by the first authentication process has the sequence number RK1_SN (4 bits); the key RK2 generated by the second authentication process, the sequence number is RK2_SN (4 bits); the subkey is the authorization The key AK, the serial number of the authorization key AK is AK_SN. When the authentication process is initial authentication, both RK1_SN and RK2_SN are initialized from an initial value, such as 0, 1, 2 or 3 initialization. RK1—SN always uses two bits that are meaningless, while RK2—SN always uses two bits that are meaningful (signal bits, including MSB (most significant bit) and LSB (least significant bit)). The meaningless two bits of the RM-SN and the meaningful two-bit value of the RK2-SN are accumulated from an initial value (the initial value may be 0, 1, 2, or 3), and then Mode 4. Or, for the same reason, it is also possible to always use meaningful two bits for RM SN, and RK2_SN always uses two bits that are meaningless.

 The method of obtaining AK-SN is that the meaningless two bits of RK1-SN are added to the meaningful two bits of RK2-SN:

 AK_SN = RK1_SN + RK2 - SN.

 Thus, a 2-bit key sequence number is generated on the terminal and the network side according to the above formula. Then, the serial number of the subkey is distributed to the user (e.g., base station) by the generator (e.g., the authentication server) on the network side. Similarly, in the case of being applied to a WiMAX network, the method for generating the license key serial number includes the following steps:

 (1) Two EAP authentication processes are performed between the subscription station (mobile station) and the authentication server. After this process, the first dual master key PMK and its sequence number PMK are generated on the subscription station and the authenticator, respectively. – SN and second dual master key PMK2 and their sequence number PMK2_SN.

 Here, for the PMK-SN, two meaningless two bits are always used, and the meaningless two bits may be two bits lower or two bits higher, and the values of the two bits are from an initial value (such as 0, 1 , 2, or 3) accumulate the back mode 4;

 For PMK2 - SN, always use meaningful two bits, the meaningful two bits can be two bits lower or two higher, the value of the two bits from an initial value (such as 0, 1, 2, or 3) Add the back mode 4.

 (2) Generate the authorization key AK serial number AK_SN on the subscription station and the authenticator according to the following formula:

 The SN of AK is equal to the meaningless two bits of PMK-SN and the meaningful two-bit addition of PMK2-SN, ie, AK_SN = PMK_SN + PMK2_SN.

For example, assuming that the meaningless two bits of the PMK-SN are the lower two bits, the meaningful two bits of the PMK2-SN are two bits higher. If the initial values of the two authentications are 0 and 3 respectively, the meaningless two bits of PMK_SN are from the initial value (0). The force p 1 is the modulo 4, which is 'Ό; the meaningful two bits of PMK2_SN are from the initial value. (3) Add 1 after the modulo 4, which is ' Ό 0', then AK - SN = 01 + 00 = 01.

 Thus, the serial number of the 2-bit authorization key is obtained on the subscription station and the authentication server respectively. The steps after the authorization serial number is generated are the same as in the first embodiment.

 In addition, the embodiment of the present invention may further add RK2_SN to RK2_SN to obtain a 4-bit subkey sequence number, wherein only two bits or two bits lower may be used. The basic principle of another implementation solution provided by the embodiment of the present invention is that the key sequence numbers generated by the two authentications are bit-connected to obtain the user equipment and the network side key sequence number. The implementation will be described below in conjunction with two specific application embodiments.

 Example 3

 Assume that the key RM generated by the first authentication process has the serial number RK1_SN; the key RK2 generated by the second authentication process, the serial number is RK2_SN; the subkey is the authorization key AK, and the sequence of the authorization key AK The number is AK-SN. The serial numbers are all 4 bits. When the authentication process is initial authentication, both RK1_SN and RK2_SN are initialized from an initial value, such as 0, 1, 2 or 3 initialization. The meaningless two bits are always used for RK1-SN, and RK2_SN always uses meaningful two bits. The meaningless two bits of the RK1 - SN and the meaningful two bit values of the RK2_SN are accumulated from an initial value (the initial value may be 0, 1, 2, or 3), and then the modulo 4 . Or, for the same reason, it is also possible to use meaningful two bits for RK1-SN, and RK2-SN always uses meaningless^two bits.

 The method of obtaining AK-SN is that the meaningless two bits of RK1_SN are connected with the meaningful two bits of RK2-SN:

 AK_SN= RK1_SN + RK2_SN , where "+" is the connector (1).

 Thus, a 4-bit key sequence number is generated on the terminal and the network side according to the above formula (1), respectively, wherein only the upper two bits or the lower two bits can be used.

Then, the serial number of the subkey is distributed to the user (such as the base station) by the generator (such as the authentication server) on the network side. The specific implementation process of the embodiment of the present invention is described below by taking an embodiment of the present invention in a WiMAX network as an example. As shown in FIG. 2, FIG. 2 is a flowchart of a key sequence number generation process applied to a WiMAX network authentication process according to an embodiment of the present invention. As shown in FIG. 2, the sequence number generation method in this embodiment includes the following steps:

 (1) Two EAP authentication processes are performed between the subscription station (mobile station) and the authentication server. After this process, the first dual master key PMK and its sequence number PMK are generated on the subscription station and the authenticator, respectively. - SN and second dual master key PMK2 and its sequence number PMK2 - SN.

 Here, for PMK-SN, two bits of meaningless are always used, and the meaningless two bits may be two bits lower or two bits higher, and the values of the two bits are from an initial value (such as 0, 1 , 2, or 3) accumulate the back mode 4;

 For PMK2 - SN, always use meaningful two bits, the meaningful two bits can be two bits lower or two higher, the value of the two bits from an initial value (such as 0, 1, 2, or 3) Add the back mode 4.

 (2) Generate the authorization key AK serial number AK_SN on the subscription station and the authenticator according to the following formula:

 The SN of AK is equal to the meaningless two bits of PMK-SN connected to the meaningful two bits of PMK2-SN, ie, AK_SN = PMK-SN + PMK2 - SN, where "+" is the connector.

 For example, suppose the meaningless two bits of the PMK-SN are the lower two bits, and the meaningful two bits of the PMK2-SN are the upper two bits. If the initial values of the two are 0 and 3 respectively, the meaningless two bits of PMK-SN are accumulated from the initial value (0) by 1 modulo 4, which is ' Ό ; meaningful two-bit from PMK2-SN The initial value (3) plus 1 modulo 4, which is ' Ό 0', then AK_SN = 01 + 00 = 0100, that is, the 4-bit authorized key sequence number is obtained, which can only use the upper two bits or two Bit.

 Then, the network side authentication server sends a key material transmission message carrying the authorized key sequence number to the base station, where the message further includes an authorization key and a lifetime of the authorization key.

Then, a negotiation of a new authorized key sequence number is performed between the subscribing station and the base station. Specific Negotiation is made with reference to the standards defined in IEEE802.16e-D12. Since the distribution of the key sequence number and the negotiation process of the serial number are the same as those of the prior art, they are not mentioned here. Example 4

 Assume that the first authentication process is generated by the user equipment and the key generator RK1, the serial number is RK1_SN; the second authentication process is generated by the user equipment and the key generator RK2, the serial number is RK2_SN The subkey is the authorization key AK, and the serial number of the authorization key AK is AK__SN. The serial numbers are all 4 bits. When the authentication process is initial authentication, RK1_SN and RK2-SN must be initialized from an initial value, such as 0, 1, 2 or 3 initialization; when re-authentication, RK1-SN and RK2-SN Add one value to each.

 The method of obtaining AK_SN is to connect two bits using each sequence number, that is,

 AK_SN= ( RK1 — SN+RK2 — SN ), where “+” is the connector ( 2 )

 In equation (2), only two bits in RK1_SN and RK2_SN are connected, such as using the lower two bits for RK1_SN and the upper two bits for RK2-SN; or

 RK1—the SN uses the lower two bits, and the RK2-SN uses the lower two bits; or,

 RK1-SN uses two bits higher, and RK2-SN uses two bits higher; or,

 RK1 - SN uses the upper two bits, and RK2 - SN uses the lower two bits.

 Thus, the key generators at the terminal and the network side respectively generate a 4-bit authorized key sequence number in which only the upper two bits or the lower two bits are used. The flow chart for generating the serial number on the terminal and network side is shown in Figure 1.

 Then, the serial number of the subkey is distributed to the user (e.g., base station) by the generator (e.g., the authenticator) on the network side.

 Similarly, for the WiMAX network as an example (as shown in Figure 2), the authorization key serial number generation method includes the following steps:

(1) Perform two EAP authentication procedures between the subscription station and the authentication server. After this process, the first dual master key PMK and its serial number are respectively generated on the subscription station and the authenticator (Authenticator). PMK-SN and second dual master key PMK2 and their serial numbers PMK2_SN, the PMK_SN and PMK2-SN are both 4 bits.

 (2) Generate the authorization key (AK: Authorization Key) according to the following formula on the subscription station (mobile station) and the power controller respectively.

 Use two bits of each serial number to connect, ie:

 AK SN=(PMK_SN + PMK2_SN), "+" is the connector, and the obtained authorization key AK has a serial number of 4 bits.

 For the selection of bits in PMK-SN and PMK2-SN, the following methods can be used:

PMK-SN uses the lower two bits, PMK2-SN uses the upper two bits; or,

 PMK—SN uses the lower two bits, PMK2—SN uses the lower two bits; or,

 PMK-SN uses two bits higher, PMK2-SN uses two bits higher; or,

 The PMK-SN uses the upper two bits, and the PMK2_SN uses the lower two bits.

 For example, if both PMK-SN and PMK2-SN use lower two bits, then if PMK-SN is lower two bits is 01; if PMK2-SN lower two bits is 00, then (01 +00) = 0100, "+,, As a connector, a 4-bit authorized key sequence number AK_SN is obtained, wherein, specifically, only two bits high or two bits of four bits can be used.

 Thereafter, the steps after the generation of the corresponding authorization sequence number are the same as those of Embodiment 3, and thus the description will not be repeated here. The embodiment of the present invention further provides a device for generating a key sequence number in a network. The specific structure is as shown in FIG. 3, and includes the following processing units:

 (1) Master key serial number acquisition unit

 The unit is configured to obtain a first master key sequence number and a second master key sequence number generated by the user equipment and the network side key generator in an authentication process (such as an EAP authentication process, etc.), and provide the sub-secret A key sequence number generating unit for generating a subkey sequence number.

 (2) Subkey serial number generation unit

The unit is configured to add or bit-connect the bits in the first master key sequence number and the second master key sequence number acquired by the master key sequence number obtaining unit to obtain user equipment and Subkey serial number on the network side;

 The subkey serial number generating unit may specifically include an adding or connecting unit and a modulo unit, where:

 (21) The adding or connecting unit is configured to add or connect two bits of the first master key sequence number and the second bit of the second master key sequence number, and add the added The result is sent to the modulo unit, and the connected result is directly used as the subkey sequence 歹|) number;

 Moreover, the adding or connecting unit is further in communication with the bit information extracting unit, the bit information extracting unit is configured to extract the lower two bits of the first master key sequence number, and the second two of the second master key sequence number Or; extract the lower two bits of the first master key sequence number, the lower two bits of the second master key sequence number; or, extract the upper two bits of the first master key sequence number, the second time The lower two bits of the master key sequence number; or, the upper two bits of the first master key sequence number, and the upper two bits of the second master key sequence number;

 Furthermore, for the first master key sequence number, two meaningless two bits are used, and for the second master key sequence number, meaningful two bits are used; or, for the first master a key sequence number, using meaningful two bits, using two meaningless two bits for the second master key sequence number;

 (22) The modulo unit is configured to perform modulo 4 processing on the added result obtained by the adding or connecting unit to obtain a subkey sequence number of the user equipment and the network side.

 (3) Subkey serial number sending unit

 Optionally, the apparatus further includes the unit, configured to send the subkey sequence number generated by the network side key generator to the user through the key material transmission message.

The apparatus provided by the embodiment of the present invention may be specifically, but not limited to, being configured in a WiMAX network. In this case, the terminal is a mobile station MS, the network side key generator is an authenticator, and the RK1 is a dual master key. PMK, RK2 is the second dual master key PMK2; the sequence numbers corresponding to the PMK and PMK2 are PMK_SN and PMK2-SN, respectively, and the entity using the subkey serial number is the base station. The embodiments of the present invention are applicable not only to WiMAX networks, but also to other network systems. As described above, the embodiment of the present invention provides a method and apparatus for generating a subkey sequence number from two parent key serial numbers, which ensures the security of data transmission in the network.

 The above specific embodiments are merely illustrative of the invention and are not intended to limit the invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request  A method for generating a key sequence number in a network, comprising the steps of: a user equipment and a network side key generator respectively generating a first master key sequence number and a second master key sequence number; ;  The bits in the first master key sequence number and the second master key sequence number are added or connected to each other to obtain a subkey sequence number of the user equipment and the network side.  The method according to claim 1, wherein the step of obtaining the subkey serial number of the user equipment and the network side generator specifically includes:  Using the two bits of the first master key sequence number and the second master key sequence number, add the modulo 4 as the sub-key sequence number of the user equipment and the network side;  Or,  The four bits of the first master key sequence number and the four bits of the second master key sequence number are added, and the upper two bits or the lower two bits of the added four-bit information are used as the user equipment and the network. Side subkey serial number;  Or,  The two primary bit numbers of the first master key sequence number and the second master key sequence number are used to be connected, and serve as a subkey sequence number of the user equipment and the network side.  3. The method of claim 2, wherein:  For the first master key sequence number, the two bits are two bits lower; for the second master key sequence number, the two bits are two bits higher; or  For the first master key sequence number, the two bits are the lower two bits; for the second master key sequence number, the two bits are the lower two bits; or  For the first master key sequence number, the two bits are two bits high; for the second master key sequence number, the two bits are two bits lower; or For the first master key sequence number, the two bits are two bits high; for the second master key sequence number, the two bits are two bits high. 4. The method of claim 1 wherein:  During the process of generating the first master key sequence number, the initial master key sequence number starts from 0, 1, 2, or 3 during initial authentication; when re-authenticating, the first master key sequence The value of the number is increased by one;  In the process of generating the second master key sequence number, at the initial authentication, the value of the second master key sequence number is initialized from 0, 1, 2 or 3; when re-authenticating, the second master key sequence The value of the number is incremented by one.  5. The method of claim 1 wherein:  Using the meaningless two bits for the first master key sequence number and the meaningful two bits for the second master key sequence number;  Or,  For the first master key sequence number, meaningful two bits are used, and for the second master key sequence number, meaningless two bits are used.  6. The method of claim 5, wherein:  At the time of authentication, the meaningless two-bit value is accumulated from 0, 1, 2 or 3 4;  At the time of authentication, the meaningful two-bit value is accumulated from 0, 1, 2 or 3 4.  7. The method of claim 5 wherein:  The meaningless two bits of the first master key sequence number are two bits lower, and the meaningful two bits of the second master key sequence number are two bits higher; or  The meaningless two bits of the first master key sequence number are the lower two bits, and the meaningful two bits of the second master key sequence number are the lower two bits; or  The meaningless two bits of the first master key sequence number are two bits high, and the meaningful two bits of the second master key sequence number are two bits lower; or The meaningless two bits of the first master key sequence number are two bits high, the second primary key The meaningful two bits of the key sequence number are two bits high.  The method according to any one of claims 1 to 7, wherein in the microwave access global interworking WiMAX network, the user equipment is a mobile station MS, and the network side key generator is a reference The first master key sequence number is a dual master key PMK, and the second master key sequence number is a second dual master key PMK2; the serial numbers corresponding to the PMK and the PMK2 are respectively PMK - SN and PMK2 - SN, and the entity using the subkey sequence number is a base station.  A method for transmitting a subkey serial number, comprising:  The network side key generator generates a subkey serial number and transmits the subkey serial number to the user through the key material transmission message.  The method according to claim 9, wherein the key material transmission message includes: an authorization key, an authorization key serial number, and a lifetime of the authorization key.  A device for generating a key sequence number in a network, comprising: a master key sequence number obtaining unit, configured to acquire a first time generated by a user equipment and a network side key generator in an authentication process Master key serial number and second master key serial number;  a sub-key sequence number generating unit, configured to add or bit-connect the bits in the first master key sequence number and the second master key sequence number acquired by the master key sequence number obtaining unit, Obtain the subkey serial number of the user equipment and the network side.  The apparatus according to claim 11, wherein the subkey serial number generating unit specifically includes an adding or connecting unit and a modulo unit, wherein:  Adding or connecting units, adding or connecting two bits in the first master key sequence number and the second master key sequence number, and adding the result to the modulo unit, after being connected The result is directly used as the subkey serial number;  The modulo unit performs the modulo 4 processing on the added result obtained by the adding or connecting unit to obtain the subkey serial number of the user equipment and the network side. The apparatus according to claim 12, wherein the adding or connecting unit is further in communication with a bit information extracting unit, and the bit information extracting unit is configured to extract the first primary key The lower two bits of the key sequence number, the upper two bits of the second master key sequence number; or, the lower two bits of the first master key sequence number, and the lower two bits of the second master key sequence number; Or extracting the upper two bits of the first master key sequence number and the lower two bits of the second master key sequence number; or, extracting the upper two bits of the first master key sequence number, the second primary key The upper two bits of the key sequence number.  14. Apparatus according to claim 11 wherein:  Using the meaningless two bits for the first master key sequence number and the meaningful two bits for the second master key sequence number;  Or,  For the first master key sequence number, meaningful two bits are used, and for the second master key sequence number, meaningless two bits are used.  The device according to claim 11, further comprising a subkey serial number transmitting unit, configured to send the subkey serial number generated by the network side key generator to the use by using a key material transmission message Device.  The device according to any one of claims 11 to 15, wherein the device is disposed in a WiMAX network, the user equipment is a mobile station MS, and the network side key generator is an authenticator. RK1 is the dual master key PMK, RK2 is the second dual master key PMK2; the sequence numbers corresponding to the PMK and PMK2 are PMK_SN and PMK2-SN, respectively, and the entity using the subkey serial number is used. For the base station.