Pc5 root key processing method and apparatus, ausf, and remote terminal

Abstract

The application provides a PC5 root key processing method and device, an AUSF and a remote terminal, and the method comprises the following steps: the AUSF receives a relay key request message sent by a relay terminal; according to the relay key request message, the PC5 root key of the remote terminal is obtained; a first random number is generated, and a relay key is generated according to the first random number and the PC5 root key; the relay key response message is sent to the relay terminal through a target network element of the relay terminal; in the embodiment of the application, the PC5 root key is generated by the AUSF of the remote terminal, and the AUSF key of the remote terminal is generated after the authentication of the remote terminal is completed, which is consistent with the positioning of the AUSF in the 5G system. The PC5 root key generated by the AUSF is stored in the UDM, and the entity requiring the PC5 root key can obtain the PC5 root key through the identification of the PC5 root key, without generating the PC5 root key every time, so that the system efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a root key processing method, apparatus, AUSF, and remote terminal for a PC5 interface. Background Technology

[0002] Currently, 5G Proximity Service (ProSe) systems are under development, which allow user data to be transmitted directly between terminals without network relay. Because the 5G network architecture differs from the 4G network architecture, and the functions supported by the 5G ProSe system are also different from those of 4G ProSe, the security technologies of UE-to-Network Relay in 4G ProSe are not applicable to the 5G ProSe system.

[0003] Currently, 5G ProSe security research includes two technical solutions.

[0004] Technical Solution 1: A new PC5 communication key is generated each time a remote UE registers with the network. The key is generated by the Access and Mobility Management Function (AMF) based on the AMF key.

[0005] Technical Solution 2: The Authentication Server Function (AUSF) generates a key identifier for the remote terminal, and then generates a relay key according to the request when PC5 communication is required.

[0006] Regarding technical solution one, the inefficiency of generating a PC5 key for each terminal registration and the incomplete roaming scenario solution are due to the requirement. Generating the key in AMF is less efficient than generating it in AUSF.

[0007] As for technical solution two, it does not consider the scenario where remote terminals use SubscriptionConcealed Identifier (SUCI), the routing relationship is complex and impractical; and this technical solution does not have the concept of root key. Summary of the Invention

[0008] The purpose of this invention is to provide a root key processing method, apparatus, AUSF, and remote terminal for the PC5 interface, in order to solve the problems of low efficiency or lack of root key concept in existing 5G ProSe security technical solutions.

[0009] To address the above problems, embodiments of the present invention provide a PC5 root key processing method, the method comprising:

[0010] The authentication server network element (AUSF) of the remote terminal receives a relay key request message sent by the relay terminal through the target network element of the relay terminal;

[0011] The AUSF obtains the PC5 root key of the remote terminal according to the relay key request message;

[0012] The AUSF generates a first random number, and based on the first random number and the PC5 root key, generates a relay key for secure communication between the relay terminal and the remote terminal.

[0013] The AUSF sends a relay key response message to the relay terminal through the target network element of the relay terminal; the relay key response message includes: the relay key and the first random number.

[0014] Where the relay key request message includes an identifier of the PC5 root key,

[0015] The AUSF obtains the PC5 root key of the remote terminal according to the relay key request message, including:

[0016] The AUSF sends a first request message to the Unified Data Management Network Element (UDM), the first request message including: the SUPI of the remote terminal and the identifier of the PC5 root key;

[0017] The AUSF receives a first response message sent by the UDM, the first response message including: the PC5 root key corresponding to the identifier of the PC5 root key.

[0018] Specifically, if the relay key request message does not include an identifier for the PC5 root key, or if the AUSF determines to update the PC5 root key of the remote terminal,

[0019] The AUSF obtains the PC5 root key of the remote terminal according to the relay key request message, including:

[0020] The AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0021] The relay key response message also includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0022] Wherein, after the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal, the method further includes:

[0023] The AUSF sends the PC5 root key and its identifier to the UDM of the remote terminal, where the UDM stores them.

[0024] Wherein, the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal, including:

[0025] The AUSF generates a second random number, and based on the second random number and the AUSF key of the remote terminal, generates a PC5 root key and an identifier for the PC5 root key.

[0026] or,

[0027] The AUSF generates a second random number, and based on the second random number, the AUSF key of the remote terminal, and a third random number generated by the remote terminal, a PC5 root key and an identifier for the PC5 root key are generated.

[0028] The method further includes:

[0029] Using the PC5 root key or a derived key of the PC5 root key, a message verification code is generated to protect the integrity of the PC5 root key generation information.

[0030] The relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and the parameters required to generate the message verification code.

[0031] Where the relay key request message includes an identifier of the PC5 root key,

[0032] Before the AUSF receives a relay key request message sent by a relay terminal through the target network element of the relay terminal, the method includes:

[0033] The AUSF receives a PC5 root key request message sent by a remote terminal through the access network element of the remote terminal.

[0034] The AUSF performs an authorization check on the remote terminal based on the PC5 root key request message;

[0035] If the remote terminal is determined to be an authorized remote terminal, the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0036] The AUSF sends a PC5 root key response message to the remote terminal through the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0037] The AUSF obtains the PC5 root key of the remote terminal according to the relay key request message, including:

[0038] The AUSF performs an authorization check on the remote terminal based on the relay key request message;

[0039] If the remote terminal is determined to be an authorized remote terminal, the AUSF obtains the PC5 root key of the remote terminal.

[0040] The relay key request message includes: the user permanent identifier SUPI of the remote terminal, or the subscription hidden identifier SUCI of the remote terminal.

[0041] This invention also provides a PC5 root key processing method, the method comprising:

[0042] The remote terminal sends a direct communication key request message to the relay terminal;

[0043] The remote terminal receives a direct communication key response message from the relay terminal, the direct communication key response message including a first random number used by the remote terminal to generate the relay key using AUSF;

[0044] The remote terminal generates a relay key for secure communication between the relay terminal and the remote terminal based on the first random number and the PC5 root key.

[0045] Wherein, if the remote terminal stores the PC5 root key and the identifier of the PC5 root key,

[0046] The direct communication key request message includes: the identifier of the PC5 root key.

[0047] Where the remote terminal does not store the PC5 root key and its identifier, the direct communication key response message further includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0048] The method further includes:

[0049] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0050] The parameters required to generate the PC5 root key include: the second random number used by the AUSF to generate the PC5 root key;

[0051] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key, including:

[0052] The remote terminal generates the PC5 root key based on the AUSF key of the remote terminal and the second random number;

[0053] or,

[0054] The remote terminal generates the PC5 root key based on the remote terminal's AUSF key, the second random number, and the third random number generated by the remote terminal.

[0055] The relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and the parameters required to generate the message verification code; the message verification code is used to protect the integrity of the PC5 root key generation information.

[0056] Wherein, if the remote terminal stores the PC5 root key and the identifier of the PC5 root key, before the remote terminal sends a direct communication key request message to the relay terminal, the method further includes:

[0057] The remote terminal sends a PC5 root key request message to the AUSF of the remote terminal through the access network element of the remote terminal;

[0058] The remote terminal receives a PC5 root key response message from the AUSF via the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information. The PC5 root key generation information includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0059] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0060] The direct communication key request message includes either the SUCI of the remote terminal or the GUTI of the remote terminal.

[0061] This invention also provides a PC5 root key processing device, applied to the authentication server network element AUSF of a remote terminal, comprising:

[0062] The first receiving unit is used to receive a relay key request message sent by the relay terminal through the target network element of the relay terminal;

[0063] The first acquisition unit is used to acquire the PC5 root key of the remote terminal according to the relay key request message;

[0064] The first generation unit is used to generate a first random number and, based on the first random number and the PC5 root key, generate a relay key for secure communication between the relay terminal and the remote terminal.

[0065] The first sending unit is configured to send a relay key response message to the relay terminal through the target network element of the relay terminal; the relay key response message includes: the relay key and the first random number.

[0066] This invention also provides an authentication server network element (AUSF), including a memory, a transceiver, and a processor; the memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and perform the following operations:

[0067] Receive a relay key request message sent by the relay terminal through the target network element of the relay terminal;

[0068] According to the relay key request message, obtain the PC5 root key of the remote terminal;

[0069] Generate a first random number, and based on the first random number and the PC5 root key, generate a relay key for secure communication between the relay terminal and the remote terminal;

[0070] The target network element of the relay terminal sends a relay key response message to the relay terminal; the relay key response message includes: the relay key and the first random number.

[0071] This invention also provides a PC5 root key processing device for use in a remote terminal, comprising:

[0072] The second sending module is used to send a direct communication key request message to the relay terminal;

[0073] The second receiving module is used to receive the direct communication key response message fed back by the relay terminal, wherein the direct communication key response message includes the first random number used by the remote terminal to generate the relay key using AUSF;

[0074] The second generation module is used to generate a relay key for secure communication between the relay terminal and the remote terminal based on the first random number and the PC5 root key.

[0075] This invention also provides a remote terminal, including a memory, a transceiver, and a processor; the memory is used to store a computer program; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer program in the memory and perform the following operations:

[0076] Send a direct communication key request message to the relay terminal;

[0077] The system receives a direct communication key response message from the relay terminal, wherein the direct communication key response message includes a first random number used by the remote terminal to generate the relay key using AUSF.

[0078] Based on the first random number and the PC5 root key, a relay key for secure communication between the relay terminal and the remote terminal is generated.

[0079] This invention also provides a processor-readable storage medium storing a computer program for causing the processor to perform the method described above.

[0080] The above-described technical solution of the present invention has at least the following beneficial effects:

[0081] In the PC5 interface root key processing method, apparatus, AUSSF, and remote terminal of this invention, the PC5 root key is generated by the remote terminal's AUSSF. The AUSSF generates the root key using the remote terminal's AUSSF key after authenticating the remote terminal, which aligns with the positioning of AUSSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities requiring the PC5 root key can obtain it through the AUSSF using the identifier of the PC5 root key, eliminating the need for regeneration each time and improving system efficiency. Attached Figure Description

[0082] Figure 1 This represents one of the flowcharts illustrating the steps of the PC5 root key processing method provided in this embodiment of the invention.

[0083] Figure 2 This is a schematic diagram illustrating the interaction of a remote terminal directly accessing the network to pre-obtain the PC5 root key in the PC5 root key processing method provided in this embodiment of the invention.

[0084] Figure 3 This is the second flowchart illustrating the steps of the PC5 root key processing method provided in this embodiment of the invention.

[0085] Figure 4An interactive diagram illustrating an application example of the PC5 root key processing method provided in an embodiment of the present invention;

[0086] Figure 5 This is one of the structural schematic diagrams of the PC5 root key processing device provided in an embodiment of the present invention;

[0087] Figure 6 This is a schematic diagram of the structure of the AUSF provided in an embodiment of the present invention;

[0088] Figure 7 This is the second schematic diagram of the PC5 root key processing device provided in this embodiment of the invention;

[0089] Figure 8 This is a schematic diagram illustrating the structure of the remote terminal provided in an embodiment of the present invention. Detailed Implementation

[0090] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0091] In this embodiment of the invention, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0092] In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0093] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0094] The technical solutions provided in this application can be applied to various systems, especially 5G systems. For example, applicable systems include Global System for Mobile Communication (GSM), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA) General Packet Radio Service (GPRS), Long Term Evolution (LTE), LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), Long Term Evolution Advanced (LTE-A), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), and 5G New Radio (NR). All of these systems include terminal equipment and network equipment. The systems may also include a core network component, such as Evolved Packet System (EPS) and 5G system (5GS).

[0095] The remote terminal and / or relay terminal involved in the embodiments of this application can be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The names of the remote terminal and / or relay terminal may differ in different systems; for example, in a 5G system, the remote terminal and / or relay terminal can be called User Equipment (UE). Wireless terminal devices can communicate with one or more core networks (CNs) via a Radio Access Network (RAN). Wireless terminal devices can be mobile terminal devices, such as mobile phones (or "cellular" phones) and computers with mobile terminal devices, for example, portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile devices that exchange voice and / or data with the radio access network. Examples include Personal Communication Service (PCS) phones, cordless phones, Session Initiated Protocol (SIP) phones, Wireless Local Loop (WLL) stations, and Personal Digital Assistants (PDAs). Wireless terminal equipment can also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, remote terminal, access terminal, user terminal, user agent, or user device, but this application does not limit the terminology.

[0096] like Figure 1 As shown, this embodiment of the invention provides a PC5 root key processing method, which includes:

[0097] Step 101: The authentication server network element (AUSF) of the remote terminal receives the relay key request message sent by the relay terminal through the target network element of the relay terminal.

[0098] In this step, when the remote terminal needs to communicate with the relay terminal via PC5, it sends a direct communication key request message to the relay terminal. Upon receiving the direct communication key request message, the relay terminal sends a relay key request message to AUSF through the target network element it is connected to.

[0099] Step 102: The AUSF obtains the PC5 root key of the remote terminal according to the relay key request message; wherein, the PC5 root key can also be referred to as the root key of the PC5 interface between the remote terminal and the relay terminal. This PC5 root key is used to assist in generating the relay key between the remote terminal and the relay terminal.

[0100] Step 103: The AUSF generates a first random number, and based on the first random number and the PC5 root key, generates a relay key for secure communication between the relay terminal and the remote terminal.

[0101] In this step, when generating the relay key, AUSF can combine the first random number and the PC5 root key with a third random number generated by the remote terminal and / or the relay service code of the remote terminal. If AUSF can obtain the third random number and / or the relay service code, AUSF generates the relay key based on the first random number, the PC5 root key, the third random number, and the relay service code.

[0102] Step 104: The AUSF sends a relay key response message to the relay terminal through the target network element of the relay terminal; the relay key response message includes: the relay key and the first random number.

[0103] The target network element of the relay terminal can be the relay terminal's AMF, or the relay terminal's AMF and its ProSe Key Management Function (PKMF). The PKMF communicates with the remote terminal's AUSF via the AMF.

[0104] Furthermore, in the above embodiments of the present invention, after receiving the relay key response message, the relay terminal sends a first random number for generating the relay key to the remote terminal via a Direct Security Mode Command. The remote terminal uses the PC5 root key and the first random number to generate the relay key using the same method as AUSF, thereby enabling PC5 secure communication between the relay terminal and the remote terminal based on the aforementioned relay key.

[0105] In at least one embodiment of the present invention, if the remote terminal already possesses a PC5 root key, the direct communication key request message may carry the identifier of the PC5 root key (PC5 Key ID), and correspondingly, the relay key request message carries the identifier of the PC5 root key; if the remote terminal does not possess a PC5 root key, the direct communication key request message cannot carry the identifier of the PC5 root key, and correspondingly, the relay key request message cannot carry the identifier of the PC5 root key.

[0106] As an optional embodiment, if the relay key request message includes an identifier of the PC5 root key, step 102 includes:

[0107] The AUSF sends a first request message to the Unified Data Management Network Element (UDM), the first request message including: the SUPI of the remote terminal and the identifier of the PC5 root key;

[0108] The AUSF receives a first response message sent by the UDM, the first response message including: the PC5 root key corresponding to the identifier of the PC5 root key.

[0109] In other words, if the remote terminal provides the identifier of the PC5 root key, and the network decides that the remote terminal's PC5 root key does not need to be updated, then AUSF requests the PC5 root key corresponding to the identifier of the PC5 root key from UDM, and UDM obtains the specified PC5 root key and returns it to AUSF.

[0110] In this embodiment of the invention, the PC5 root key generated by AUSF is stored in UDM. Entities that need the PC5 root key can obtain it through AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0111] As another optional embodiment, if the relay key request message does not include the identifier of the PC5 root key, or if the AUSF determines to update the PC5 root key of the remote terminal (even if the relay key request message includes the identifier of the PC5 root key, the AUSF may still decide not to use the PC5 root key corresponding to the identifier of the PC5 root key, i.e., update the PC5 root key of the remote terminal), step 102 includes:

[0112] The AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0113] The relay key response message also includes: PC5 root key generation information (PC5 Key Info), which includes: the parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0114] For example, the parameters required to generate the PC5 root key include: a random number generated by AUSF for generating the PC5 root key.

[0115] Optionally, the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal, including:

[0116] The AUSF generates a second random number, and based on the second random number and the AUSF key of the remote terminal, generates a PC5 root key and an identifier for the PC5 root key.

[0117] or,

[0118] The AUSF generates a second random number, and based on the second random number, the AUSF key of the remote terminal, and a third random number generated by the remote terminal, a PC5 root key and an identifier for the PC5 root key are generated.

[0119] Furthermore, after the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal, the method further includes:

[0120] The AUSF sends the PC5 root key and its identifier to the UDM of the remote terminal, where the UDM stores them.

[0121] In other words, after AUSF generates a PC5 root key and its identifier each time, it stores the newly generated PC5 root key and its identifier in the UDM. Entities that need the PC5 root key can obtain it through AUSF using the PC5 root key's identifier, without having to regenerate it each time, thus improving system efficiency.

[0122] As another optional embodiment, the method further includes:

[0123] Using the PC5 root key or a derived key of the PC5 root key, a Message Authentication Code (MAC) is generated to protect the integrity of the PC5 root key generation information.

[0124] The relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and the parameters required to generate the message verification code.

[0125] It should be noted that if the relay key request message includes an identifier for the PC5 root key, it indicates that the remote terminal already possesses a PC5 root key; and regarding how the remote terminal acquires a PC5 root key, this embodiment of the invention provides two methods:

[0126] Method 1: When the remote terminal cannot directly connect to the network, a direct communication key request message without the PC5 root key identifier is sent to the relay terminal. The relay terminal sends a relay key request message without the PC5 root key identifier to the AUSF through the target network element. The AUSF generates a PC5 root key and a PC5 root key identifier for the remote terminal and sends the PC5 root key generation information to the remote terminal.

[0127] Method 2: When the remote terminal can connect directly to the network, the network element accessed through the remote terminal obtains the PC5 root key and the PC5 root key identifier in advance.

[0128] For method two, the method includes:

[0129] The AUSF receives a PC5 root key request message sent by the remote terminal through the remote terminal's access network element (e.g., the remote terminal's AMF).

[0130] The AUSF performs an authorization check on the remote terminal based on the PC5 root key request message;

[0131] If the remote terminal is determined to be an authorized remote terminal, the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0132] The AUSF sends a PC5 root key response message to the remote terminal through the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0133] like Figure 2 As shown, the process for a remote terminal to obtain the PC5 root key and its identifier in advance is as follows:

[0134] Step 21: The remote terminal registers and authenticates to the network;

[0135] Step 22: The remote terminal sends a PC5 root key request message to the AUSF of the remote terminal through the AMF of the remote terminal. The PC5 root key request message may include the GUTI or SUCI of the remote terminal. The AUSF can obtain the SUPI of the remote terminal based on the GUTI or SUCI of the remote terminal.

[0136] Step 23: AUSF performs an authorization check on the remote terminal based on the remote terminal's SUPI.

[0137] Step 24: If the AUSF determines that the remote terminal is an authorized terminal, the AUSF derives the PC5 root key based on the AUSF key of the remote terminal and generates the PC5 root key identifier and PC5 root key generation information.

[0138] Step 25: AUSF stores the PC5 root key and its identifier in the remote terminal's UDM.

[0139] Step 26: AUSF sends a PC5 root key response message to the remote terminal through the AMF of the remote terminal. The PC5 root key response message includes PC5 root key generation information.

[0140] Step 27: The remote terminal generates information based on the PC5 root key, exports the PC5 root key and its identifier, and stores them.

[0141] In at least one embodiment of the present invention, step 102 includes:

[0142] The AUSF performs an authorization check on the remote terminal based on the relay key request message;

[0143] If the remote terminal is determined to be an authorized remote terminal, the AUSF obtains the PC5 root key of the remote terminal;

[0144] The relay key request message includes: the user permanent identifier SUPI of the remote terminal, or the subscription hidden identifier SUCI of the remote terminal.

[0145] Specifically, AUSF determines the SUPI (SUbscriptionPermanent Identifier, the user's permanent identifier of the SIM card) of the remote terminal based on the relay key request message; AUSF then performs an authorization check on the remote terminal based on the SUPI of the remote terminal.

[0146] If the relay request message includes SUCI, the AUSF determines the SUPI of the remote terminal in the following ways: the remote terminal's AUSF requests an authentication vector (AV) from the UDM; the UDM returns an AV and the SUPI of the remote terminal.

[0147] If the relay request message includes the remote terminal's SUPI, the remote terminal's SUPI is obtained by the target network element of the relay terminal based on the remote terminal's GUTI (Globally Unique Temporary UE Identity).

[0148] It should be noted that if the remote terminal provides its own SUCI, then the remote terminal's AUSF, the relay terminal's AMF, and the remote terminal need to perform the primary authentication process through the relay terminal, which will be described in detail here.

[0149] In summary, in this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. The AUSF generates the key using the remote terminal's AUSF key after authentication, which aligns with the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities requiring the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, eliminating the need for regeneration each time and improving system efficiency.

[0150] like Figure 3 As shown, this embodiment of the invention also provides a PC5 root key processing method, which includes:

[0151] Step 301: The remote terminal sends a direct communication key request message to the relay terminal;

[0152] In this step, when the remote terminal needs to communicate with the relay terminal via PC5, it sends a direct communication key request message to the relay terminal. Upon receiving the direct communication key request message, the relay terminal sends a relay key request message to the AUSF through the target network element it accesses. The AUSF obtains the PC5 root key of the remote terminal based on the relay key request message. The AUSF generates a first random number and, based on the first random number and the PC5 root key, generates a relay key for secure communication between the relay terminal and the remote terminal.

[0153] Step 302: The remote terminal receives a direct communication key response message from the relay terminal, the direct communication key response message including a first random number used by the remote terminal to generate the relay key using AUSF;

[0154] In this step, after receiving the relay key response message, the relay terminal sends a first random number for generating the relay key to the remote terminal via a direct communication key response message. The direct communication key response message is a Direct Security Mode Command.

[0155] Step 303: The remote terminal generates a relay key for secure communication between the relay terminal and the remote terminal based on the first random number and the PC5 root key.

[0156] Furthermore, the relay terminal can generate a fourth random number and send it to the remote terminal along with the direct communication key response message. The relay terminal can use the relay key, the fourth random number, and the third random number generated by the remote terminal to generate a session key, and use the session key to protect the DirectSecurity Mode Command message. The remote terminal also uses the relay key, the fourth random number, and the third random number generated by the remote terminal to generate a session key, and uses the session key to protect the Direct Security Mode Complete message. Finally, the remote terminal and the relay terminal use the negotiated session key for secure communication.

[0157] In at least one embodiment of the present invention, if the remote terminal already possesses a PC5 root key, the direct communication key request message may carry the identifier of the PC5 root key (PC5 Key ID), and correspondingly, the relay key request message carries the identifier of the PC5 root key; if the remote terminal does not possess a PC5 root key, the direct communication key request message cannot carry the identifier of the PC5 root key, and correspondingly, the relay key request message cannot carry the identifier of the PC5 root key.

[0158] As an optional embodiment, if the remote terminal stores the PC5 root key and an identifier of the PC5 root key,

[0159] The direct communication key request message includes: the identifier of the PC5 root key.

[0160] In this case, when the remote terminal generates the relay key in step 303, it uses the PC5 root key stored locally on the remote terminal.

[0161] As another optional embodiment, if the remote terminal does not store the PC5 root key and the identifier of the PC5 root key, the direct communication key response message further includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key;

[0162] The method further includes:

[0163] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0164] In this case, when the remote terminal generates the relay key in step 303, it uses the PC5 root key generated by the remote terminal based on the AUSF key and the parameters required to generate the PC5 root key sent by AUSF.

[0165] For example, the parameters required to generate the PC5 root key include: the second random number used by the AUSF to generate the PC5 root key.

[0166] Optionally, the remote terminal generates the PC5 root key using the same method as AUSF, for example:

[0167] Generate the PC5 root key based on the AUSF key of the remote terminal and the second random number generated by AUSF;

[0168] or,

[0169] The PC5 root key is generated based on the AUSF key of the remote terminal, the second random number generated by AUSF, and the third random number generated by the remote terminal.

[0170] As another optional embodiment, the relay key response message further includes: the message verification code; or, the relay key response message further includes: the message verification code and parameters required to generate the message verification code; the message verification code is used to protect the integrity of the PC5 root key generation information. The remote terminal uses the message verification code to verify the integrity of the PC5 root key generation information, and, after confirming the integrity, generates the PC5 root key based on the remote terminal's AUSF key and the parameters required to generate the PC5 root key.

[0171] It should be noted that if the relay key request message includes an identifier for the PC5 root key, it indicates that the remote terminal already possesses a PC5 root key; and regarding how the remote terminal acquires a PC5 root key, this embodiment of the invention provides two methods:

[0172] Method 1: When the remote terminal cannot directly connect to the network, a direct communication key request message without the PC5 root key identifier is sent to the relay terminal. The relay terminal sends a relay key request message without the PC5 root key identifier to the AUSF through the target network element. The AUSF generates a PC5 root key and a PC5 root key identifier for the remote terminal and sends the PC5 root key generation information to the remote terminal.

[0173] Method 2: When the remote terminal can directly connect to the network, the network element accessed through the remote terminal obtains the PC5 root key and its identifier in advance. The specific process is as follows: Figure 2 As shown, it will not be repeated here.

[0174] For method two, where the remote terminal stores the PC5 root key and its identifier, before step 301, the method further includes:

[0175] The remote terminal sends a PC5 root key request message to the AUSF of the remote terminal through the access network element of the remote terminal;

[0176] The remote terminal receives a PC5 root key response message from the AUSF via the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information. The PC5 root key generation information includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0177] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0178] As an optional embodiment, the direct communication key request message includes: the SUCI of the remote terminal, or the GUTI of the remote terminal.

[0179] If the direct communication key request message includes the remote terminal's GUTI, then the remote terminal's SUPI is obtained by the target network element of the relay terminal based on the remote terminal's GUTI (Globally Unique Temporary UE Identity).

[0180] If the direct communication key request message includes the remote terminal's SUCI, the remote terminal's AUSF requests an Authentication Vector (AV) from the UDM; the UDM returns an AV and the remote terminal's SUPI. Furthermore, if the remote terminal provides its own SUCI, then the remote terminal's AUSF, the relay terminal's AMF, and the remote terminal need to perform a primary authentication process through the relay terminal, which is described in detail here.

[0181] In summary, in this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. The AUSF generates the key using the remote terminal's AUSF key after authentication, which aligns with the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities requiring the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, eliminating the need for regeneration each time and improving system efficiency.

[0182] To more clearly describe the PC5 root key processing method provided in the embodiments of the present invention, the process of obtaining the PC5 root key is described below with reference to an application example, such as... Figure 4 As shown:

[0183] Step 41: The remote terminal generates a random number 3 and then sends a direct communication key request to the relay terminal. The request includes either SUCI or GUTI; optionally, the request also includes: PC5 root key identifier (PC5 Key ID), relay service code, and random number 3. If the remote terminal is already registered with the network, the request should include GUTI (Globally Unique Temporary UE Identity); otherwise, it should include SUCI (Subscription Concealed Identifier). If the remote terminal already possesses a PC5 root key, the request includes the identifier of that PC5 root key (PC5 Key ID).

[0184] Step 42: The relay terminal sends a Relay Key Request to its AMF (or the relay terminal sends a Relay Key Request to the AMF via the PKMF). The request includes the SUCI or GUTI provided by the remote terminal; optionally, it also includes: PC5Key ID, Relay Service Code, and a random number 3. The relay key will be used to establish secure one-to-one direct communication between the remote terminal and the relay terminal.

[0185] Step 43: The relay terminal's AMF (or PKMF) checks whether the relay terminal is authorized as a relay UE. If the relay terminal is authorized as a relay terminal, the AMF continues with the following operations.

[0186] Step 44: If the remote terminal provides a GUTI, the relay terminal's AMF should obtain the corresponding SUPI based on the GUTI. The relay terminal's AMF sends a Relay Key Request to the remote terminal's ASF. The request includes the SUCI provided by the remote terminal or the SUPI obtained by the AMF; optionally, it also includes the Relay Key ID, Relay Service Code, and a random number 3.

[0187] Step 45: If the relay key request contains SUCI, the remote terminal's AUSF requests an authentication vector (AV) from the remote terminal's UDM.

[0188] Step 46: The remote terminal's UDM returns an AV and the remote terminal's SUPI.

[0189] Step 47: The remote terminal's AUSF checks whether the remote terminal is authorized as a remote terminal based on the remote terminal's SUPI. If the remote terminal is authorized as a remote terminal, proceed to the following steps.

[0190] Step 48: If the remote terminal provides a PC5 Key ID, the remote terminal's AUSF requests the PC5 root key from the UDM. The request message contains: SUPI, PC5 Key ID.

[0191] Step 49: UDM obtains the specified PC5 root key and returns it to AUSF.

[0192] Step 50: If the remote terminal provides SUCI, then the remote terminal's AUSF, the relay terminal's AMF, and the remote terminal perform the primary authentication process through the relay terminal.

[0193] Step 51: If the remote terminal does not provide a PC5 Key ID, or the network decides to update the remote terminal's PC5 root key, the remote terminal's AUSF uses the remote terminal's key Kausf to derive a new PC5 root key. AUSF generates a new root key identifier (PC5 Key ID) for this PC5 root key; AUSF generates PC5 root key generation information (PC5 Key Info). PC5 Key Info provides the parameters required to generate the new PC5 Key, such as the random number generated by AUSF for generating the PC5 root key. The key generation can also use information from the remote terminal, such as the random number 3. Optionally, PC5 Key Info can also be protected for integrity, for example, by generating a Message Authentication Code (MAC) using the newly generated root key or its derived keys. In this case, information indicating how to generate the MAC and the MAC itself should also be sent to the remote terminal.

[0194] Step 52: The remote terminal's AUSF stores the newly generated PC5 root key and PC5 Key ID in the UDM.

[0195] Step 53: The remote terminal's AUSF generates a random number 1 (Relay Key Freshness) to generate the relay key; using the PC5 root key, random number 1, and other parameters such as random number 3, Relay Service Code, etc., the relay key is derived.

[0196] Step 54: The remote terminal's AUSF sends the Relay Key, random number 1, and PC5 Key Info (if present) to the relay terminal's AMF.

[0197] Step 55: The relay terminal's AMF sends the Relay Key, random number 1, and PC5 Key Info (if it exists) to the relay terminal.

[0198] Step 56: The relay terminal generates a random number 4 and sends random number 1, random number 4, and PC5 Key Info (if present) to the remote terminal via a Direct Security Mode Command. The relay terminal can use the relay key, random number 3, random number 4, and other parameters to generate a session key and use the session key to protect the Direct Security Mode Command message.

[0199] Step 57: If the message contains PC5 Key Info, the remote terminal uses the local key Kausf and the parameters in PC5Key Info to derive the PC5 root key using the same method as AUSF, and obtains the identifier (PC5 Key ID) of the PC5 root key from the PC5 Key Info. The remote terminal stores the PC5 root key and the PC5 Key ID.

[0200] Step 58: The remote terminal uses the PC5 root key, random number 1, and other parameters to export the relay key using the same method as AUSF.

[0201] Step 59: The remote terminal sends a Direct Security Mode Complete message to the relay terminal. The remote terminal can generate a session key using parameters such as the relay key, random number 3, and random number 4, and use the session key to protect the Direct Security Mode Complete message.

[0202] Step 60: The remote terminal and the relay terminal use the negotiated session key to communicate securely.

[0203] In this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. After authenticating the remote terminal, the AUSF uses the remote terminal's AUSF key to generate the key, which conforms to the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities that need the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0204] like Figure 5 As shown, this embodiment of the invention also provides a PC5 root key processing device, applied to the authentication server network element AUSF of a remote terminal, comprising:

[0205] The first receiving unit 501 is used to receive a relay key request message sent by the relay terminal through the target network element of the relay terminal;

[0206] The first acquisition unit 502 is used to acquire the PC5 root key of the remote terminal according to the relay key request message;

[0207] The first generation unit 503 is used to generate a first random number and, based on the first random number and the PC5 root key, generate a relay key for secure communication between the relay terminal and the remote terminal.

[0208] The first sending unit 504 is used to send a relay key response message to the relay terminal through the target network element of the relay terminal; the relay key response message includes: the relay key and the first random number.

[0209] As an optional embodiment, if the relay key request message includes an identifier of the PC5 root key,

[0210] The first acquisition unit includes:

[0211] The first subunit is used to send a first request message to the unified data management network element UDM. The first request message includes: the SUPI of the remote terminal and the identifier of the PC5 root key.

[0212] The second subunit is used to receive a first response message sent by the UDM, the first response message including: the PC5 root key corresponding to the identifier of the PC5 root key.

[0213] As an optional embodiment, the PC5 root key identifier is not included in the relay key request message, or, if the AUSF determines to update the PC5 root key of the remote terminal,

[0214] The first acquisition unit includes:

[0215] The third subunit is used to generate a PC5 root key and an identifier of the PC5 root key based on the AUSF key of the remote terminal.

[0216] The relay key response message also includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0217] As an optional embodiment, the apparatus further includes:

[0218] The first storage unit is used to send the PC5 root key and its identifier to the UDM of the remote terminal for storage.

[0219] As an optional embodiment, the third subunit is further configured to:

[0220] Generate a second random number, and based on the second random number and the AUSF key of the remote terminal, generate a PC5 root key and an identifier for the PC5 root key;

[0221] or,

[0222] A second random number is generated. Based on the second random number, the AUSF key of the remote terminal, and a third random number generated by the remote terminal, a PC5 root key and an identifier of the PC5 root key are generated.

[0223] As an optional embodiment, the apparatus further includes:

[0224] The third generation unit is used to generate a message verification code that protects the integrity of the PC5 root key generation information using the PC5 root key or a derived key of the PC5 root key.

[0225] The relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and the parameters required to generate the message verification code.

[0226] As an optional embodiment, if the relay key request message includes an identifier of the PC5 root key, the apparatus includes:

[0227] The third receiving unit is used to receive a PC5 root key request message sent by the remote terminal through the access network element of the remote terminal;

[0228] The first inspection unit is used to perform an authorization check on the remote terminal based on the PC5 root key request message.

[0229] The fourth generation unit is used to generate a PC5 root key and an identifier of the PC5 root key based on the AUSF key of the remote terminal, when it is determined that the remote terminal is an authorized remote terminal.

[0230] The third sending unit is used to send a PC5 root key response message to the remote terminal through the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information, which includes parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0231] As an optional embodiment, the first acquisition unit includes:

[0232] The second inspection subunit is used to perform an authorization check on the remote terminal based on the relay key request message;

[0233] The acquisition subunit is used to acquire the PC5 root key of the remote terminal when it is determined that the remote terminal is an authorized remote terminal.

[0234] As an optional embodiment, the relay key request message includes: the user permanent identifier SUPI of the remote terminal, or the subscription hidden identifier SUCI of the remote terminal.

[0235] In this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. After authenticating the remote terminal, the AUSF uses the remote terminal's AUSF key to generate the key, which conforms to the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities that need the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0236] The method and apparatus are based on the same concept of the application. Since the methods and apparatus solve problems in similar ways, the implementation of the apparatus and methods can refer to each other, and the repeated parts will not be described again.

[0237] like Figure 6 As shown, this embodiment of the invention also provides an authentication server network element (AUSF), including a memory 620, a transceiver 610, and a processor 600; the memory 620 is used to store computer programs; the transceiver 610 is used to send and receive data under the control of the processor 600; the processor 600 is used to read the computer program in the memory 620 and perform the following operations:

[0238] Receive a relay key request message sent by the relay terminal through the target network element of the relay terminal;

[0239] According to the relay key request message, obtain the PC5 root key of the remote terminal;

[0240] Generate a first random number, and based on the first random number and the PC5 root key, generate a relay key for secure communication between the relay terminal and the remote terminal;

[0241] The target network element of the relay terminal sends a relay key response message to the relay terminal; the relay key response message includes: the relay key and the first random number.

[0242] As an optional embodiment, if the relay key request message includes an identifier of the PC5 root key, the processor 600 is further configured to read the computer program in the memory 620 and perform the following operations:

[0243] The AUSF sends a first request message to the Unified Data Management Network Element (UDM), the first request message including: the SUPI of the remote terminal and the identifier of the PC5 root key;

[0244] The AUSF receives a first response message sent by the UDM, the first response message including: the PC5 root key corresponding to the identifier of the PC5 root key.

[0245] As an optional embodiment, if the PC5 root key identifier is not included in the relay key request message, or if the AUSF determines to update the PC5 root key of the remote terminal, the processor 600 is further configured to read the computer program in the memory 620 and perform the following operations:

[0246] The AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0247] The relay key response message also includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0248] As an optional embodiment, after the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal, the processor 600 is further configured to read the computer program in the memory 620 and perform the following operations:

[0249] The AUSF sends the PC5 root key and its identifier to the UDM of the remote terminal, where the UDM stores them.

[0250] As an optional embodiment, the processor 600 is also configured to read the computer program in the memory 620 and perform the following operations:

[0251] The AUSF generates a second random number, and based on the second random number and the AUSF key of the remote terminal, generates a PC5 root key and an identifier for the PC5 root key.

[0252] or,

[0253] The AUSF generates a second random number, and based on the second random number, the AUSF key of the remote terminal, and a third random number generated by the remote terminal, a PC5 root key and an identifier for the PC5 root key are generated.

[0254] As an optional embodiment, the processor 600 is also configured to read the computer program in the memory 620 and perform the following operations:

[0255] Using the PC5 root key or a derived key of the PC5 root key, a message verification code is generated to protect the integrity of the PC5 root key generation information.

[0256] The relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and the parameters required to generate the message verification code.

[0257] As an optional embodiment, if the relay key request message includes an identifier of the PC5 root key, the processor 600 is further configured to read the computer program in the memory 620 and perform the following operations:

[0258] The AUSF receives a PC5 root key request message sent by a remote terminal through the access network element of the remote terminal.

[0259] The AUSF performs an authorization check on the remote terminal based on the PC5 root key request message;

[0260] If the remote terminal is determined to be an authorized remote terminal, the AUSF generates a PC5 root key and an identifier for the PC5 root key based on the AUSF key of the remote terminal.

[0261] The AUSF sends a PC5 root key response message to the remote terminal through the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0262] As an optional embodiment, the processor 600 is also configured to read the computer program in the memory 620 and perform the following operations:

[0263] The AUSF performs an authorization check on the remote terminal based on the relay key request message;

[0264] If the remote terminal is determined to be an authorized remote terminal, the AUSF obtains the PC5 root key of the remote terminal.

[0265] As an optional embodiment, the relay key request message includes: the user permanent identifier SUPI of the remote terminal, or the subscription hidden identifier SUCI of the remote terminal.

[0266] Among them, Figure 6In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 600) and memory (memory 620). The bus architecture can also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 610 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical fibers, etc. The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 during operation.

[0267] The processor 600 can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor can also adopt a multi-core architecture.

[0268] In this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. After authenticating the remote terminal, the AUSF uses the remote terminal's AUSF key to generate the key, which conforms to the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities that need the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0269] It should be noted that the AUSF provided in this embodiment of the invention is an AUSF capable of executing the above PC5 root key processing method. Therefore, all embodiments of the above PC5 root key processing method are applicable to this AUSF and can achieve the same or similar beneficial effects.

[0270] like Figure 7 As shown, this embodiment of the invention also provides a PC5 root key processing device, applied to a remote terminal, comprising:

[0271] The second sending unit 701 is used to send a direct communication key request message to the relay terminal.

[0272] The second receiving unit 702 is used to receive the direct communication key response message fed back by the relay terminal, wherein the direct communication key response message includes a first random number used by the remote terminal to generate the relay key using AUSF;

[0273] The second generation unit 703 is used to generate a relay key for secure communication between the relay terminal and the remote terminal based on the first random number and the PC5 root key.

[0274] As an optional embodiment, if the remote terminal stores the PC5 root key and an identifier of the PC5 root key,

[0275] The direct communication key request message includes: the identifier of the PC5 root key.

[0276] As an optional embodiment, if the remote terminal does not store the PC5 root key and its identifier, the direct communication key response message may further include: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key;

[0277] The device further includes:

[0278] The fifth generation unit is used to generate the PC5 root key based on the AUSF key of the remote terminal and the parameters required to generate the PC5 root key.

[0279] As an optional embodiment, the parameters required to generate the PC5 root key include: the second random number used by the AUSF to generate the PC5 root key;

[0280] The fifth generation unit is further used for:

[0281] The PC5 root key is generated based on the AUSF key of the remote terminal and the second random number;

[0282] or,

[0283] The PC5 root key is generated based on the AUSF key of the remote terminal, the second random number, and the third random number generated by the remote terminal.

[0284] As an optional embodiment, the relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and parameters required to generate the message verification code; the message verification code is used to protect the integrity of the PC5 root key generation information.

[0285] As an optional embodiment, when the remote terminal stores the PC5 root key and an identifier of the PC5 root key, before the remote terminal sends a direct communication key request message to the relay terminal, the apparatus further includes:

[0286] The third sending unit is used to send a PC5 root key request message to the AUSF of the remote terminal through the access network element of the remote terminal;

[0287] The sixth receiving unit is configured to receive a PC5 root key response message fed back by the AUSF through the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information. The PC5 root key generation information includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0288] The sixth generation unit is used to generate the PC5 root key based on the AUSF key of the remote terminal and the parameters required to generate the PC5 root key.

[0289] As an optional embodiment, the direct communication key request message includes: the SUCI of the remote terminal, or the GUTI of the remote terminal.

[0290] In this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. After authenticating the remote terminal, the AUSF uses the remote terminal's AUSF key to generate the key, which conforms to the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities that need the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0291] The method and apparatus are based on the same concept of the application. Since the methods and apparatus solve problems in similar ways, the implementation of the apparatus and methods can refer to each other, and the repeated parts will not be described again.

[0292] like Figure 8 As shown, this embodiment of the invention also provides a remote terminal, including a memory 820, a transceiver 810, and a processor 800; the memory 820 is used to store computer programs; the transceiver 810 is used to send and receive data under the control of the processor 800; the processor 800 is used to read the computer program in the memory 820 and perform the following operations:

[0293] Send a direct communication key request message to the relay terminal;

[0294] The system receives a direct communication key response message from the relay terminal, wherein the direct communication key response message includes a first random number used by the remote terminal to generate the relay key using AUSF.

[0295] Based on the first random number and the PC5 root key, a relay key for secure communication between the relay terminal and the remote terminal is generated.

[0296] As an optional embodiment, if the remote terminal stores the PC5 root key and an identifier of the PC5 root key,

[0297] The direct communication key request message includes: the identifier of the PC5 root key.

[0298] As an optional embodiment, if the remote terminal does not store the PC5 root key and its identifier, the direct communication key response message further includes: PC5 root key generation information, which includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key; the processor 800 is also configured to read the computer program in the memory 820 and perform the following operations:

[0299] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0300] As an optional embodiment, the parameters required to generate the PC5 root key include: the second random number used by the AUSF to generate the PC5 root key; the processor 800 is also configured to read the computer program in the memory 820 and perform the following operations:

[0301] The PC5 root key is generated based on the AUSF key of the remote terminal and the second random number;

[0302] or,

[0303] The PC5 root key is generated based on the AUSF key of the remote terminal, the second random number, and the third random number generated by the remote terminal.

[0304] As an optional embodiment, the relay key response message may further include: the message verification code; or, the relay key response message may further include: the message verification code and parameters required to generate the message verification code; the message verification code is used to protect the integrity of the PC5 root key generation information.

[0305] As an optional embodiment, if the remote terminal stores the PC5 root key and an identifier of the PC5 root key, before the remote terminal sends a direct communication key request message to the relay terminal, the processor 800 is further configured to read the computer program in the memory 820 and perform the following operations:

[0306] The remote terminal sends a PC5 root key request message to the AUSF of the remote terminal through the access network element of the remote terminal;

[0307] The remote terminal receives a PC5 root key response message from the AUSF via the access network element of the remote terminal. The PC5 root key response message includes PC5 root key generation information. The PC5 root key generation information includes: parameters required to generate the PC5 root key and the identifier of the PC5 root key.

[0308] The remote terminal generates the PC5 root key based on its AUSF key and the parameters required to generate the PC5 root key.

[0309] As an optional embodiment, the direct communication key request message includes: the SUCI of the remote terminal, or the GUTI of the remote terminal.

[0310] Among them, Figure 8 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 800 and memory represented by memory 820 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 810 can be multiple components, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium, including wireless channels, wired channels, optical fibers, etc. For different user equipment, the user interface 830 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0311] The processor 800 is responsible for managing the bus architecture and general processing, while the memory 820 can store the data used by the processor 800 during operation.

[0312] Optionally, the processor 800 can be a CPU (Central Processing Unit), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or CPLD (Complex Programmable Logic Device), and the processor can also adopt a multi-core architecture.

[0313] The processor executes any of the methods described in the embodiments of this application according to the obtained executable instructions by calling a computer program stored in memory. The processor and memory may also be physically separated.

[0314] In this embodiment of the invention, the PC5 root key is generated by the AUSF of the remote terminal. After authenticating the remote terminal, the AUSF uses the remote terminal's AUSF key to generate the key, which conforms to the positioning of AUSF in 5G systems. The PC5 root key generated by the AUSF is stored in the UDM. Entities that need the PC5 root key can obtain it through the AUSF using the identifier of the PC5 root key, without having to regenerate it each time, thus improving system efficiency.

[0315] It should be noted that the remote terminal provided in the embodiments of the present invention is a remote terminal capable of executing the above PC5 root key processing method. Therefore, all embodiments of the above PC5 root key processing method are applicable to the remote terminal and can achieve the same or similar beneficial effects.

[0316] It should be noted that the division of units in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0317] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0318] This invention also provides a processor-readable storage medium storing a computer program for causing the processor to execute the method embodiments described above. The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical memory (e.g., CD, DVD, BD, HVD, etc.), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0319] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0320] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0321] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0322] These processors can execute instructions that can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0323] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A PC5 root key processing method, characterized in that, The method comprises: An authentication server network element AUSF of a remote terminal receives a relay key request message sent by a target network element of the relay terminal; The AUSF obtains a PC5 root key of the remote terminal according to the relay key request message; The AUSF generates a first random number, and generates a relay key for secure communication between the relay terminal and the remote terminal according to the first random number and the PC5 root key; The AUSF sends a relay key response message to the relay terminal through the target network element of the relay terminal; the relay key response message comprises the relay key and the first random number; In a case where the relay key request message comprises an identifier of the PC5 root key, the AUSF obtaining the PC5 root key of the remote terminal according to the relay key request message comprises: The AUSF sends a first request message to a unified data management network element UDM, and the first request message comprises a SUPI of the remote terminal and an identifier of the PC5 root key; The AUSF receives a first response message sent by the UDM, and the first response message comprises a PC5 root key corresponding to the identifier of the PC5 root key; In a case where the relay key request message does not comprise the identifier of the PC5 root key, or the AUSF determines to update the PC5 root key of the remote terminal, the AUSF obtaining the PC5 root key of the remote terminal according to the relay key request message comprises: The AUSF generates the PC5 root key and the identifier of the PC5 root key based on an AUSF key of the remote terminal; The relay key response message further comprises PC5 root key generation information, and the PC5 root key generation information comprises parameters required for generating the PC5 root key and the identifier of the PC5 root key.

2. The method of claim 1, wherein, After the AUSF generates the PC5 root key and the identifier of the PC5 root key based on the AUSF key of the remote terminal, the method further comprises: The AUSF sends the PC5 root key and the identifier of the PC5 root key to the UDM of the remote terminal, and the UDM of the remote terminal stores the PC5 root key and the identifier of the PC5 root key.

3. The method of claim 1, wherein, The AUSF generating the PC5 root key and the identifier of the PC5 root key based on the AUSF key of the remote terminal comprises: The AUSF generates a second random number, and generates the PC5 root key and the identifier of the PC5 root key according to the second random number and the AUSF key of the remote terminal; Or, The AUSF generates a second random number, and generates the PC5 root key and the identifier of the PC5 root key according to the second random number, the AUSF key of the remote terminal, and a third random number generated by the remote terminal.

4. The method of claim 1, wherein, The method further comprises: Generating a message authentication code for integrity protection of PC5 root key generation information by using the PC5 root key or a derived key of the PC5 root key; The relay key response message further includes the message authentication code, or the relay key response message further includes the message authentication code and parameters required for generating the message authentication code.

5. The method of claim 1, wherein, In a case where the relay key request message includes an identifier of the PC5 root key, Before the AUSF receives the relay key request message sent by the relay terminal through a target network element of the relay terminal, the method includes: The AUSF receives a PC5 root key request message sent by a remote terminal through an access network element of the remote terminal; The AUSF performs authorization checking on the remote terminal according to the PC5 root key request message; In a case where it is determined that the remote terminal is an authorized remote terminal, the AUSF generates a PC5 root key and an identifier of the PC5 root key based on an AUSF key of the remote terminal; The AUSF sends a PC5 root key response message to the remote terminal through the access network element of the remote terminal, and the PC5 root key response message includes PC5 root key generation information, and the PC5 root key generation information includes parameters required for generating the PC5 root key and the identifier of the PC5 root key.

6. The method of claim 1, wherein, The AUSF acquires the PC5 root key of the remote terminal according to the relay key request message, including: The AUSF performs authorization checking on the remote terminal according to the relay key request message; In a case where it is determined that the remote terminal is an authorized remote terminal, the AUSF acquires the PC5 root key of the remote terminal.

7. The method of claim 6, wherein, The relay key request message includes a user permanent identifier (SUPI) of the remote terminal, or a subscription concealed identifier (SUCI) of the remote terminal. 8.A PC5 root key processing method, characterized in that, The method includes: The remote terminal sends a direct communication key request message to the relay terminal; The remote terminal receives a direct communication key response message fed back by the relay terminal, and the direct communication key response message includes a first random number used by the AUSF to generate a relay key of the remote terminal; The remote terminal generates a relay key for secure communication between the relay terminal and the remote terminal according to the first random number and a PC5 root key; In a case where the remote terminal stores the PC5 root key and an identifier of the PC5 root key, the direct communication key request message includes the identifier of the PC5 root key.

9. The method of claim 8, wherein, In a case where the remote terminal does not store the PC5 root key and the identifier of the PC5 root key, the direct communication key response message further includes PC5 root key generation information, and the PC5 root key generation information includes parameters required for generating the PC5 root key and the identifier of the PC5 root key. The method further includes: The remote terminal generates the PC5 root key according to the AUSF key of the remote terminal and the parameters required for generating the PC5 root key.

10. The method of claim 9, wherein, The parameters required for generating the PC5 root key include a second random number used by the AUSF to generate the PC5 root key; The remote terminal generates the PC5 root key according to an AUSF key of the remote terminal and parameters required for generating the PC5 root key. The remote terminal generates the PC5 root key according to the AUSF key of the remote terminal and the second random number. Or, The remote terminal generates the PC5 root key according to the AUSF key of the remote terminal, the second random number, and a third random number generated by the remote terminal.

11. The method of claim 9, wherein, The relay key response message further includes a message verification code, or the relay key response message further includes the message verification code and parameters required for generating the message verification code; and the message verification code is used for integrity protection of PC5 root key generation information.

12. The method of claim 8, wherein, In a case where the remote terminal stores a PC5 root key and an identifier of the PC5 root key, before the remote terminal sends a direct communication key request message to a relay terminal, the method further includes: The remote terminal sends a PC5 root key request message to an AUSF of the remote terminal through an access network element of the remote terminal; The remote terminal receives a PC5 root key response message fed back by the AUSF through the access network element of the remote terminal, and the PC5 root key response message includes PC5 root key generation information; the PC5 root key generation information includes parameters required for generating the PC5 root key and an identifier of the PC5 root key; The remote terminal generates the PC5 root key according to an AUSF key of the remote terminal and parameters required for generating the PC5 root key.

13. The method of claim 8, wherein, The direct communication key request message includes an SUCI of the remote terminal, or a globally unique temporary terminal identifier (GUTI) of the remote terminal. 14.A PC5 root key processing apparatus, applied to an authentication server network element AUSF of a remote terminal, characterized in that, Comprise: A first receiving unit, configured to receive a relay key request message sent by a relay terminal through a target network element of the relay terminal; A first obtaining unit, configured to obtain a PC5 root key of the remote terminal according to the relay key request message; A first generating unit, configured to generate a first random number, and generate a relay key for secure communication between the relay terminal and the remote terminal according to the first random number and the PC5 root key; A first sending unit, configured to send a relay key response message to the relay terminal through the target network element of the relay terminal; The relay key response message includes the relay key and the first random number. In a case where the relay key request message includes an identifier of the PC5 root key, the first obtaining unit comprises: A first sub-unit, configured to send a first request message to a unified data management network element (UDM), and the first request message includes an SUPI of the remote terminal and the identifier of the PC5 root key; A second sub-unit, configured to receive a first response message sent by the UDM, and the first response message includes a PC5 root key corresponding to the identifier of the PC5 root key; Or, the relay key request message does not include the identification of the PC5 root key, or the AUSF determines to update the PC5 root key of the remote terminal, the first acquisition unit comprises: A third sub-unit, configured to generate a PC5 root key and an identification of the PC5 root key based on the AUSF key of the remote terminal; The relay key response message further comprises: PC5 root key generation information, the PC5 root key generation information comprising: parameters required for generating the PC5 root key and the identification of the PC5 root key.

15. An authentication server network element AUSF, characterized by, Comprise memory, transceiver, processor; Memory, for storing computer programs; Transceiver, for transceiving data under the control of the processor; processor, for reading computer programs in the memory and performing the following operations: Receiving a relay key request message sent by a target network element of the relay terminal through the relay terminal; According to the relay key request message, the PC5 root key of the remote terminal is acquired; Generating a first random number, and generating a relay key for secure communication between the relay terminal and the remote terminal according to the first random number and the PC5 root key; Sending a relay key response message to the relay terminal through the target network element of the relay terminal; The relay key response message comprises: the relay key, the first random number; Wherein, in the case that the relay key request message includes the identification of the PC5 root key, the processor is further configured to read the computer programs in the memory and perform the following operations: Sending a first request message to a unified data management network element UDM, the first request message comprising: the SUPI of the remote terminal and the identification of the PC5 root key; Receiving a first response message sent by the UDM, the first response message comprising: the PC5 root key corresponding to the identification of the PC5 root key; Or, in the case that the relay key request message does not include the identification of the PC5 root key, or the AUSF determines to update the PC5 root key of the remote terminal, the processor is further configured to read the computer programs in the memory and perform the following operations: Generating a PC5 root key and an identification of the PC5 root key based on the AUSF key of the remote terminal; The relay key response message further comprises: PC5 root key generation information, the PC5 root key generation information comprising: parameters required for generating the PC5 root key and the identification of the PC5 root key. 16.A PC5 root key processing apparatus, applied to a remote terminal, characterized in that, Comprise: The second sending module is used for sending a direct communication key request message to the relay terminal; The second receiving module is used for receiving a direct communication key response message fed back by the relay terminal, the direct communication key response message comprising a first random number used by the AUSF of the remote terminal to generate a relay key; The second generation module is used for generating a relay key for secure communication between the relay terminal and the remote terminal according to the first random number and the PC5 root key; In a case where the remote terminal stores a PC5 root key and an identifier of the PC5 root key, the direct communication key request message comprises the identifier of the PC5 root key.

17. A remote terminal, characterized by The device comprises a memory, a transceiver, and a processor. The memory is configured to store a computer program. The transceiver is configured to transceive data under control of the processor. The processor is configured to read the computer program in the memory and perform the following operations: sending a direct communication key request message to a relay terminal; receiving a direct communication key response message fed back by the relay terminal, the direct communication key response message comprising a first random number used by an AUSF of the remote terminal to generate a relay key; generating, according to the first random number and a PC5 root key, a relay key for secure communication between the relay terminal and the remote terminal; In a case where the remote terminal stores a PC5 root key and an identifier of the PC5 root key, the direct communication key request message comprises the identifier of the PC5 root key.

18. A processor-readable storage medium, comprising: The processor readable storage medium stores a computer program, and the computer program is configured to make the processor execute the method in any one of claims 1 to 7; or the computer program is configured to make the processor execute the method in any one of claims 8 to 13.

Images