Key processing method, system and storage medium

Abstract

The present disclosure provides a key processing method, system and storage medium, wherein the method includes: the relay UE and the service UE respectively send a discovery key request to the corresponding network side device, and receive the discovery key and security parameters returned by the network side device; wherein the information carried in the discovery key request includes: a relay service code; the relay UE and the service UE respectively use the discovery key and security parameters to process the discovery message. The present disclosure can obtain the discovery key from the home network of the relay UE pointed to by the relay service code, and use the discovery key related to the relay service code to protect the discovery message sent and received between the source UE or the target UE and the relay UE, and can safely distribute the discovery key to the source UE, the target UE and the relay UE, provide security protection for the UE to UE relay discovery process, improve the security of the service, and enhance the user experience.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a key processing method, system and storage medium. Background Art

[0002] UE-to-UE Relay (U2U relay) is one of the key scenarios in 5G ProSe (Proximity-based Services) research. In 5G ProSe, the source UE completes the discovery and intent matching of the target UE through the relay UE. Currently, in the discovery process, there is no technical solution on how to distribute keys for protecting discovery messages to the UE source, relay UE, and target UE, and how to perform authorization checks on the UE source, relay UE, and target UE. Summary of the invention

[0003] In view of this, a technical problem to be solved by the present invention is to provide a key processing method, system and storage medium.

[0004] According to the first aspect of the present disclosure, a key processing method is provided, including: a relay UE and a service UE respectively send a discovery key request to a corresponding network side device, and receive a discovery key and security parameters returned by the network side device; wherein the information carried in the discovery key request includes: a relay service code; the relay service code is used to indicate the connection service provided by the relay UE to the service UE; the relay UE and the service UE respectively use the discovery key and security parameters to process the discovery message.

[0005] Optionally, the information carried by the relay service code includes: distance-based service ProSe application information, or the information carried by the relay service code includes: distance-based service ProSe application information and UE-to-UE relay service information; wherein the ProSe application information is used to indicate the ProSe application that the service UE expects to obtain; and the UE-to-UE relay service information is used to indicate the UE-to-UE relay service capability supported by the relay UE.

[0006] Optionally, the network side device includes: a first HPLMN network element device located in the HPLMN of the relay UE; the relay UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: the relay UE sends the discovery key request to the first HPLMN network element device; the relay UE receives the discovery key and security parameters returned by the first HPLMN network element device; wherein the first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, the first HPLMN network element device returns the discovery key and security parameters associated with the relay service code to the relay UE; wherein the first HPLMN network element device stores the discovery key and security parameters, and stores the binding relationship between the relay service code and the discovery key and security parameters.

[0007] Optionally, the first HPLMN network element device performs authorization verification processing on the relay UE, including: the first HPLMN network element device performs authorization verification processing on the relay UE based on locally stored contract and authorization data information corresponding to the relay UE, or based on the contract and authorization data information returned by a first data storage network element device located in the HPLMN of the relay UE; or, the first HPLMN network element device sends an authorization verification request corresponding to the relay UE to the first data storage network element device, and receives the authorization verification result returned by the first data storage network element device; or, the first HPLMN network element device sends an authorization verification request corresponding to the relay UE to a first ProSe application server or platform, and receives the authorization verification result returned by the first ProSe application server or platform.

[0008] Optionally, the network side device includes: a first VPLMN network element device located in a visited public land mobile network VPLMN where the relay UE roams; the relay UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: the relay UE sends the discovery key request to the first VPLMN network element device; the relay UE receives the discovery key and security parameters returned by the first VPLMN network element device; wherein the first VPLMN network element device forwards the discovery key request to the first HPLMN network element device based on the HPLMN ID information corresponding to the public land mobile network of the relay UE stored in the local core network; the first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, the first HPLMN network element device sends the discovery key and security parameters associated with the relay service code to the relay UE through the first VPLMN network element device.

[0009] Optionally, the first HPLMN network element device includes: a first HPLMN DDNMF located in the HPLMN of the relay UE; and the first VPLMN network element device includes: a first VPLMN DDNMF located in the VPLMN where the relay UE roams.

[0010] Optionally, the network side device includes: a second HPLMN network element device located in the HPLMN of the service UE; the service UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: the service UE sends the discovery key request to the second HPLMN network element device; the service UE receives the discovery key and security parameters returned by the second HPLMN network element device; wherein the second HPLMN network element device performs authorization verification processing on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code; after determining that the service UE passes the authorization verification processing, the second HPLMN network element device queries the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; after receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, the second HPLMN network element device based on the PLMN in the ProSe application layer ID of the relay UE ID information, sends a key request to the first HPLMN network element device, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE; wherein the ProSe application layer user ID carries the PLMN ID information, and the PLMN ID information is used to indicate the HPLMN of the relay UE.

[0011] Optionally, the second HPLMN network element device performs authorization verification processing on the service UE, including: the second HPLMN network element device performs authorization verification processing on the service UE based on locally stored contract and authorization data information corresponding to the service UE, or based on the contract and authorization data information returned by a second data storage network element device located in the HPLMN of the service UE; or, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second data storage network element device, and receives the authorization verification result returned by the second data storage network element device; or, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second ProSe application server or platform, and receives the authorization verification result returned by the second ProSe application server or platform.

[0012] Optionally, the network side device includes: a second VPLMN network element device located in the VPLMN where the service UE roams; the service UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: the service UE sends the discovery key request to the second VPLMN network element device; the service UE receives the discovery key and security parameters returned by the second VPLMN network element device; wherein the second VPLMN network element device forwards the discovery key request to the second HPLMN network element device based on the HPLMN ID information corresponding to the public land mobile network of the service UE stored in the local core network; the second HPLMN network element device performs authorization verification processing on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code, and after determining that the service UE passes the authorization verification processing, sends a key request to the first HPLMN network element device, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

[0013] Optionally, the second HPLMN network element device includes: a second HPLMN DDNMF located in the HPLMN of the service UE; and the second VPLMN network element device includes: a second VPLMN DDNMF located in the VPLMN where the service UE roams.

[0014] Optionally, the service UE includes: a source UE and a target UE; the discovery key includes: a confidentiality protection key, an integrity protection key, and an scrambling protection key; and the security parameters include: a timestamp and a validity period.

[0015] According to the second aspect of the present disclosure, a key processing system is provided, including a relay UE, a service UE and a network side device; the relay UE and the service UE are used to respectively send a discovery key request to the corresponding network side device, and receive the discovery key and security parameters returned by the network side device; wherein the information carried in the discovery key request includes: a relay service code; the relay service code is used to indicate the connection service provided by the relay UE to the service UE; the relay UE and the service UE are also used to process the discovery message using the discovery key and security parameters, respectively.

[0016] Optionally, the information carried by the relay service code includes: distance-based service ProSe application information, or the information carried by the relay service code includes: distance-based service ProSe application information and UE-to-UE relay service information; wherein the ProSe application information is used to indicate the ProSe application that the service UE expects to obtain; and the UE-to-UE relay service information is used to indicate the UE-to-UE relay service capability supported by the relay UE.

[0017] Optionally, the network side device includes: a first HPLMN network element device located in the HPLMN of the relay UE; the relay UE is used to send the discovery key request to the first HPLMN network element device, and receive the discovery key and security parameters returned by the first HPLMN network element device; the first HPLMN network element device is used to perform authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, returning the discovery key and security parameters associated with the relay service code to the relay UE; the first HPLMN network element device is used to store the discovery key and security parameters, and store the binding relationship between the relay service code and the discovery key and security parameters.

[0018] Optionally, the first HPLMN network element device is used to perform authorization verification on the relay UE based on locally stored contract and authorization data information corresponding to the relay UE, or based on the contract and authorization data information returned by a first data storage network element device located in the HPLMN of the relay UE; the first HPLMN network element device is also used to send an authorization verification request corresponding to the relay UE to the first data storage network element device, and receive the authorization verification result returned by the first data storage network element device; or, send an authorization verification request corresponding to the relay UE to a first ProSe application server or platform, and receive the authorization verification result returned by the first ProSe application server or platform.

[0019] Optionally, the network side device includes: a first VPLMN network element device located in the visited public land mobile network VPLMN where the relay UE roams; the relay UE, used to send the discovery key request to the first VPLMN network element device, and receive the discovery key and security parameters returned by the first VPLMN network element device; the first VPLMN network element device, used to forward the discovery key request to the first HPLMN network element device based on the HPLMN ID information corresponding to the home public land mobile network of the relay UE stored in the local core network; the first HPLMN network element device is used to perform authorization verification on the relay UE, confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and after determining that the relay UE passes the authorization verification, send the discovery key and security parameters associated with the relay service code to the relay UE through the first VPLMN network element device.

[0020] Optionally, the first HPLMN network element device includes: a first HPLMN DDNMF located in the HPLMN of the relay UE; and the first VPLMN network element device includes: a first VPLMN DDNMF located in the VPLMN where the relay UE roams.

[0021] Optionally, the network side device includes: a second HPLMN network element device located in the HPLMN of the service UE; the service UE is used to send the discovery key request to the second HPLMN network element device, and receive the discovery key and security parameters returned by the second HPLMN network element device; the second HPLMN network element device is used to perform authorization verification processing on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code; after determining that the service UE passes the authorization verification processing, querying the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; after receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, based on the PLMN ID information in the ProSe application layer ID of the relay UE, sending a key request to the first HPLMN network element device, and sending the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE; wherein the ProSe application layer user ID carries the PLMN ID information, and the PLMN ID information is used to indicate the HPLMN of the relay UE.

[0022] Optionally, the second HPLMN network element device is used to perform authorization verification on the service UE based on locally stored contract and authorization data information corresponding to the service UE, or based on the contract and authorization data information returned by a second data storage network element device located in the HPLMN of the service UE; the second HPLMN network element device is also used to send an authorization verification request corresponding to the service UE to the second data storage network element device, and receive the authorization verification result returned by the second data storage network element device; or, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second ProSe application server or platform, and receives the authorization verification result returned by the second ProSe application server or platform.

[0023] Optionally, the network side device includes: a second VPLMN network element device located in the VPLMN where the service UE roams; the service UE is used to send the discovery key request to the second VPLMN network element device, and receive the discovery key and security parameters returned by the second VPLMN network element device; the second VPLMN network element device is used to forward the discovery key request to the second HPLMN network element device based on the HPLMN ID information corresponding to the public land mobile network of the service UE stored in the local core network; the second HPLMN network element device is used to perform authorization verification processing on the service UE to confirm whether the service UE has the right to use the connection service indicated by the relay service code, and after determining that the service UE passes the authorization verification processing, query the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; after receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, based on the PLMN in the ProSe application layer ID of the relay UE ID information, sends a key request to the first HPLMN network element device, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

[0024] Optionally, the second HPLMN network element device includes: a second HPLMN DDNMF located in the HPLMN of the service UE; and the second VPLMN network element device includes: a second VPLMN DDNMF located in the VPLMN where the service UE roams.

[0025] Optionally, the service UE includes: a source UE and a target UE; the discovery key includes: a confidentiality protection key, an integrity protection key, and an scrambling protection key; and the security parameters include: a timestamp and a validity period.

[0026] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the instructions are executed by a processor to perform the method as described above.

[0027] The key processing method, system and storage medium disclosed in the present invention can obtain the discovery key from the home network of the relay UE pointed to by the relay service code, and use the discovery key related to the relay service code to protect the discovery message sent and received between the source UE or target UE and the relay UE. It can safely distribute the discovery key to the source UE, target UE and relay UE, provide security protection for the UE to UE relay discovery process, improve the security of the service, and enhance the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0029] Figure 1 A schematic diagram of a process flow of an embodiment of a key processing method according to the present disclosure;

[0030] Figure 2 A schematic diagram of a process for a relay UE to obtain a discovery key and a security parameter according to an embodiment of a key processing method disclosed herein;

[0031] Figure 3 A schematic diagram of a process for a relay UE to obtain a discovery key and a security parameter according to another embodiment of the key processing method disclosed herein;

[0032] Figure 4 A schematic diagram of a process for a service UE to obtain a discovery key and security parameters according to an embodiment of the key processing method disclosed herein;

[0033] Figure 5 A schematic diagram of a process for a service UE to obtain a discovery key and security parameters according to another embodiment of the key processing method disclosed herein;

[0034] Figure 6 A schematic diagram of a signaling interaction process according to an embodiment of a key processing method disclosed herein;

[0035] Figure 7 The module diagram of one embodiment of the key processing system according to the present disclosure is shown in FIG. DETAILED DESCRIPTION

[0036] The present disclosure is described more fully below with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are described. The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0037] The terms "first", "second", etc. in the following text are only used to distinguish between the two and have no other special meanings.

[0038] Figure 1 FIG. 1 is a flow chart of an embodiment of a key processing method according to the present disclosure, as shown in FIG. Figure 1 As shown:

[0039] Step 101, the relay UE and the service UE respectively send a discovery key request to the corresponding network side device, and receive the discovery key and security parameters returned by the network side device; wherein the information carried in the discovery key request includes a relay service code (RSC). The relay service code is used to indicate the connection service provided by the relay UE to the service UE, and the connection service includes the connection service for the ProSe application, etc.

[0040] Step 102: The relay UE and the service UE use the discovery key and security parameters to process the discovery message respectively.

[0041] In one embodiment, the service UE includes a source UE and a target UE, etc., and the UE may be a mobile phone, a tablet computer, etc. In the UE-to-UE relay discovery process, the source UE completes the discovery and intention matching of the target UE through the relay UE. UE-to-UE relay discovery may include mode A and mode B, which are two existing discovery modes. In the mode A discovery process, the discovery message includes a declaration (discovery) message sent and received between the source UE or target UE and the relay UE. In the mode B discovery process, the discovery message includes a discovery inquiry message and a discovery response message sent and received between the source UE or target UE and the relay UE, etc.

[0042] The discovery message sent and received between the source UE or the target UE and the relay UE can be protected by using a discovery key, which includes a confidentiality protection key, an integrity protection key, an scrambling protection key, etc. The security parameters include a timestamp, a validity period, etc. The relay UE and the service UE can respectively use the existing method and use the discovery key and the security parameters to encrypt, decrypt, integrity protect, and scramble the discovery message.

[0043] In one embodiment, the information carried by the relay service code includes information such as ProSe application information; the ProSe application information is used to indicate the ProSe application that the service UE expects to obtain, and the ProSe application information may be a ProSe application identifier, a ProSe application code, etc. The ProSe application may be an application such as public safety (police), emergency rescue (firefighting), and commercial services (industrial Internet). Alternatively, the information carried by the relay service code includes information such as ProSe application information and UE-to-UE relay service information, and the UE-to-UE relay service information is used to indicate the UE-to-UE relay service capabilities supported by the relay UE, such as supported QoS capabilities, supported radio technologies (WiFi or cellular), and other information.

[0044] Figure 2 The schematic diagram of the process of a relay UE acquiring a discovery key and a security parameter according to an embodiment of the key processing method disclosed herein, wherein the network side device includes a first HPLMN network element device located in the HPLMN of the relay UE, such as Figure 2 As shown:

[0045] Step 201: The relay UE sends a key discovery request to a first HPLMN network element device.

[0046] In one embodiment, the first HPLMN network element device performs authorization verification processing on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and whether the relay UE has the authority to request a discovery key related to the relay service code.

[0047] The first HPLMN network element device stores discovery keys and security parameters, and stores a binding relationship between the relay service code and the discovery keys and security parameters. For example, the first HPLMN network element device pre-establishes and stores a binding relationship between the ProSe application information in the relay service code and the discovery keys and security parameters, and when confirming that the relay UE has the authority to provide the connection service indicated by the relay service code, obtains the discovery keys and security parameters associated with the relay service code based on the binding relationship, and returns the discovery keys and security parameters associated with the relay service code to the relay UE through a secure channel. The secure channel can be a variety of existing secure channels.

[0048] The first HPLMN network element device may adopt a variety of methods to perform authorization verification processing on the relay UE. For example, the first HPLMN network element device performs authorization verification processing on the relay UE based on the locally stored contract and authorization data information corresponding to the relay UE. The first HPLMN network element device performs authorization verification processing on the relay UE locally based on the contract and authorization data information returned by the first data storage network element device (network function responsible for contract and authorization data storage) located in the HPLMN of the relay UE. The first data storage network element device may be a UDM (Unified Data Management) network element, etc.

[0049] The first HPLMN network element device sends an authorization verification request corresponding to the relay UE to the first data storage network element device, the authorization verification request includes information such as the identity information of the UE and the requested service information, and the first data storage network element device performs authorization verification, and the first HPLMN network element device receives the authorization verification result returned by the first data storage network element device. The first HPLMN network element device sends an authorization verification request corresponding to the relay UE to the first ProSe application server or platform, the authorization verification request includes information such as the identity information of the UE and the requested service information, and the first ProSe application server or platform performs authorization verification, and the first HPLMN network element device receives the authorization verification result returned by the first ProSe application server or platform.

[0050] Step 202: The relay UE receives the discovery key and security parameter returned by the first HPLMN network element device.

[0051] Figure 3 The flowchart of the relay UE acquiring the discovery key and security parameters according to another embodiment of the key processing method disclosed herein is as follows: the network side device includes: a first VPLMN network element device located in the visited public land mobile network VPLMN where the relay UE roams, such as Figure 3 As shown:

[0052] Step 301: The relay UE sends a key discovery request to a first VPLMN network element device.

[0053] In one embodiment, the first VPLMN network element device forwards the discovery key request to the first HPLMN network element device based on the HPLMN (Home Public Land Mobile Network) ID information corresponding to the home public land mobile network of the relay UE stored in the local core network. The first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and after determining that the relay UE passes the authorization verification, the first HPLMN network element device sends the discovery key and security parameters to the relay UE through the first VPLMN network element device. The first VPLMN network element device returns the discovery key and security parameters to the relay UE through a secure channel, and the secure channel can be a variety of existing secure channels.

[0054] Step 302: The relay UE receives the discovery key and security parameter returned by the first VPLMN network element device.

[0055] In one embodiment, the first HPLMN network element device includes a first HPLMN DDNMF (Direct Discovery Name Management Function) located in the HPLMN of the relay UE, etc.; the first VPLMN network element device includes a first VPLMN DDNMF located in the VPLMN where the relay UE roams.

[0056] Figure 4 The flow chart of a service UE acquiring a discovery key and a security parameter according to an embodiment of the key processing method disclosed herein is as follows: the network side device includes a second HPLMN network element device located in the HPLMN of the service UE, such as Figure 4 As shown:

[0057] Step 401: The service UE sends a key discovery request to a second HPLMN network element device.

[0058] In one embodiment, the second HPLMN network element device performs authorization verification processing on the service UE to confirm whether the service UE has the authority to play the role of the source UE or the target UE, and confirm whether the service UE has the authority to use the connection service indicated by the relay service code. After determining that the service UE passes the authorization verification processing, the second HPLMN network element device queries the second ProSe application server or platform for candidate relay UEs that meet the relay service code conditions, that is, queries the second ProSe application server or platform for relay UEs that can provide the connection service corresponding to the ProSe application information in the relay service code.

[0059] The ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform is received, the ProSe application layer user ID of the relay UE includes public land mobile network PLMN (Public Land Mobile Network) ID information, the PLMN ID information is used to indicate the HPLMN of the relay UE, and the access information of the first HPLMN network element device in the HPLMN of the relay UE can be obtained based on the PLMN ID information using the existing method. The second HPLMN network element device sends a key request to the first HPLMN network element device based on the PLMN ID information in the ProSe application layer ID of the relay UE, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE.

[0060] The second HPLMN network element device may use a variety of methods to perform authorization verification processing on the service UE. For example, the second HPLMN network element device performs authorization verification processing on the service UE based on the locally stored subscription and authorization data information corresponding to the service UE. The second HPLMN network element device performs authorization verification processing on the service UE locally based on the subscription and authorization data information returned by the second data storage network element device located in the HPLMN of the service UE.

[0061] The second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second data storage network element device. The authorization verification request includes information such as the identity information of the UE and the requested service information. The second data storage network element device performs authorization verification. The second HPLMN network element device receives the authorization verification result returned by the second data storage network element device. The second data storage network element device can be a UDM (Unified Data Management) network element, etc.

[0062] The second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second ProSe application server or platform. The authorization verification request includes information such as the UE's identity information and requested service information. The second ProSe application server or platform performs authorization verification, and the second HPLMN network element device receives the authorization verification result returned by the second ProSe application server or platform.

[0063] Step 402: The service UE receives the discovery key and security parameters returned by the second HPLMN network element device.

[0064] Figure 5 A schematic diagram of a process for a service UE to obtain a discovery key and security parameters according to another embodiment of the key processing method disclosed herein, wherein the network side device includes a second VPLMN network element device located in a VPLMN where the service UE roams, such as Figure 5 As shown:

[0065] Step 501: The service UE sends a key discovery request to a second VPLMN network element device.

[0066] In one embodiment, the second VPLMN network element device forwards the discovery key request to the second HPLMN network element device based on the HPLMN ID information corresponding to the public land mobile network of the service UE stored in the local core network. The second VPLMN network element device can use multiple existing methods to obtain the HPLMN ID information corresponding to the public land mobile network of the service UE stored in the local core network, and use multiple existing methods to obtain the access information of the second HPLMN network element device. The second HPLMN network element device performs authorization verification on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code. After determining that the service UE has passed the authorization verification process, the second HPLMN network element device sends a key request to the first HPLMN network element device, and sends the discovery key associated with the relay service code and security parameters returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

[0067] Step 502: The service UE receives the discovery key and security parameters returned by the second VPLMN network element device.

[0068] In one embodiment, the second HPLMN network element device includes a second HPLMN DDNMF and the like located in the HPLMN of the service UE; the second VPLMN network element device includes a second VPLMN DDNMF and the like located in the VPLMN where the service UE roams.

[0069] Figure 6 FIG. 1 is a schematic diagram of a signaling interaction process according to an embodiment of a key processing method disclosed in the present invention. Figure 6 As shown:

[0070] Step 601: The relay UE sends a Discovery key request message to the VPLMN DDNMF of the relay UE. The information carried in the Discovery key request message includes RSC (Relay Service Code), R-UE (Relay UE) information and other information.

[0071] Step 602: The VPLMN DDNMF of the relay UE forwards the Discovery key request to the EPLMN DDNMF of the relay UE.

[0072] Step 603: The EPLMN DDNMF of the relay UE performs verification processing on the relay UE.

[0073] Step 604: After determining that the verification is successful, the EPLMN DDNMF of the relay UE returns a Discovery key response message to the VPLMN DDNMF of the relay UE. The information carried in the Discovery key response message includes: discovery key, security parameters, RSC and other information.

[0074] Step 605: The VPLMN DDNMF of the relay UE returns a Discovery key response message to the relay UE. The information carried in the Discovery key response message includes a discovery key, security parameters, and RSC.

[0075] Step 606: The source or target UE sends a Discovery key request message to the VPLMN DDNMF of the source or target UE. The information carried in the Discovery key request message includes RSC (Relay Service Code) and source or target UE information.

[0076] Step 607: The VPLMN DDNMF of the source or target UE forwards the DiscoveryKey Request request to the EPLMN DDNMF of the source or target UE.

[0077] Step 608: The EPLMN DDNMF of the source or target UE performs verification processing on the source or target UE.

[0078] Step 609: After determining that the verification is successful, the EPLMN DDNMF of the source or target UE forwards the Discovery key request to the EPLMN DDNMF of the relay UE.

[0079] Step 610: The EPLMN DDNMF of the relay UE returns a Discovery key response message to the EPLMN DDNMF of the source or target UE. The information carried in the Discovery key response message includes a discovery key, security parameters, and RSC.

[0080] Step 611: The EPLMN DDNMF of the source or target UE sends a Discovery key response message to the VPLMN DDNMF of the source or target UE.

[0081] Step 612: The VPLMN DDNMF of the source or target UE sends a Discovery key response message to the source or target UE. The information carried in the Discovery key response message includes a discovery key, security parameters, and RSC.

[0082] Step 613: UE to UE relay discovery process processing.

[0083] The source UE can use existing methods to complete the discovery and intention matching of the target UE through the relay UE, and the discovery messages sent and received between the source UE, the target UE and the relay UE can be protected by using the discovery key related to the relay service code.

[0084] The key processing method disclosed in the present invention protects the discovery messages sent and received between the source UE or target UE and the relay UE by using the discovery key related to the relay service code. The discovery key is obtained from the core network function of the home network of the relay UE pointed to by the relay service code. The discovery key can be securely distributed to the source UE, target UE and relay UE, providing security protection for the UE to UE relay discovery process.

[0085] In one embodiment, Figure 7 As shown, the present disclosure provides a key processing system, including a relay UE 71, a service UE 72 and a network side device 73, wherein the service UE 72 includes a source UE and a target UE. The relay UE 71 and the service UE 72 respectively send a discovery key request to the corresponding network side device 73, and receive the discovery key and security parameters returned by the network side device 73. The information carried in the discovery key request includes a relay service code, and the relay service code is used to indicate the connection service provided by the relay UE to the service UE. The relay UE 71 and the service UE 72 respectively use the discovery key and security parameters to process the discovery message.

[0086] In one embodiment, the network side device 73 includes a first HPLMN network element device located in the HPLMN of the relay UE, and the first HPLMN network element device includes a first HPLMN DDNMF located in the HPLMN of the relay UE, etc. The relay UE 71 sends a discovery key request to the first HPLMN network element device, and receives the discovery key and security parameters returned by the first HPLMN network element device; the first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and after determining that the relay UE passes the authorization verification, returns the discovery key and security parameters associated with the relay service code to the relay UE; wherein the first HPLMN network element device stores the discovery key and security parameters, and stores the binding relationship between the relay service code and the discovery key and security parameters.

[0087] The network side device 73 includes a first VPLMN network element device located in the visited public land mobile network VPLMN where the relay UE roams; the first VPLMN network element device includes a first VPLMN DDNMF located in the VPLMN where the relay UE roams, etc. The relay UE 71 sends a discovery key request to the first VPLMN network element device, and receives the discovery key and security parameters returned by the first VPLMN network element device. The first VPLMN network element forwards the discovery key request to the first HPLMN network element device based on the HPLMN ID information corresponding to the home public land mobile network of the relay UE stored in the local core network; the first HPLMN network element device performs authorization verification processing on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and after determining that the relay UE passes the authorization verification, sends the discovery key and security parameters associated with the relay service code to the relay UE through the first VPLMN network element device.

[0088] In one embodiment, the network side device includes a second HPLMN network element device located in the HPLMN of the service UE; the second HPLMN network element device includes a second HPLMN DDNMF located in the HPLMN of the service UE, etc. The service UE 72 sends a discovery key request to the second HPLMN network element device, and receives the discovery key and security parameters returned by the second HPLMN network element device; the second HPLMN network element device performs authorization verification processing on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code, and after determining that the service UE passes the authorization verification processing, queries the second ProSe application server or platform for candidate relay UEs that meet the relay service code conditions.

[0089] After receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, the second HPLMN network element device sends a key request to the first HPLMN network element device based on the PLMN ID information in the ProSe application layer ID of the relay UE, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE.

[0090] The network side device 73 includes a second VPLMN network element device located in the VPLMN where the service UE roams; the second VPLMN network element device includes a second VPLMN DDNMF located in the VPLMN where the service UE roams, etc. The service UE 72 sends a discovery key request to the second VPLMN network element device, and receives the discovery key and security parameters returned by the second VPLMN network element device; the second VPLMN network element device forwards the discovery key request to the second HPLMN network element device based on the HPLMNID information corresponding to the home public land mobile network of the service UE stored in the local core network.

[0091] The second HPLMN network element device performs authorization verification on the service UE. After determining that the service UE has passed the authorization verification process, it queries the second ProSe application server or platform for candidate relay UEs that meet the relay service code conditions. After receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, the second HPLMN network element device sends a key request to the first HPLMN network element device based on the PLMN ID information in the ProSe application layer ID of the relay UE, and sends the discovery key and security parameters returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

[0092] In one embodiment, the present disclosure provides a computer-readable storage medium storing computer instructions, which implement the key processing method in any of the above embodiments when executed by a processor.

[0093] The key processing method, system and storage medium in the above-mentioned embodiments can obtain the discovery key from the home network of the relay UE pointed to by the relay service code, and use the discovery key related to the relay service code to protect the discovery messages sent and received between the source UE or target UE and the relay UE. The discovery key can be securely distributed to the source UE, target UE and relay UE, providing security protection for the UE-to-UE relay discovery process, thereby improving the security of the service.

[0094] The method and system of the present disclosure may be implemented in many ways. For example, the method and system of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0095] The description of the present disclosure is given for the purpose of illustration and description, and is not intended to be exhaustive or to limit the present disclosure to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present disclosure, and to enable those of ordinary skill in the art to understand the present disclosure and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A key processing method, comprising: The relay UE and the service UE respectively send a discovery key request to the corresponding network side device, and receive the discovery key and security parameters returned by the network side device; The information carried in the discovery key request includes: a relay service code; the relay service code is used to indicate the connection service provided by the relay UE to the service UE; the information carried by the relay service code includes distance-based service ProSe application information, or the information carried by the relay service code includes distance-based service ProSe application information and UE-to-UE relay service information; the ProSe application information is used to indicate the ProSe application that the service UE expects to obtain; the UE-to-UE relay service information is used to indicate the UE-to-UE relay service capability supported by the relay UE; The relay UE and the service UE respectively use the discovery key and the security parameter to process the discovery message; The network side device includes: a first HPLMN network element device located in the HPLMN of the relay UE; the relay UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: The relay UE sends the discovery key request to the first HPLMN network element device, and receives the discovery key and security parameters returned by the first HPLMN network element device; wherein the first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, the first HPLMN network element device returns the discovery key and security parameters associated with the relay service code to the relay UE; the first HPLMN network element device stores the discovery key and security parameters, and stores the binding relationship between the relay service code and the discovery key and security parameters.

2. The method according to claim 1, wherein the first HPLMN network element device performs authorization verification processing on the relay UE, comprising: The first HPLMN network element device performs authorization verification processing on the relay UE based on the locally stored subscription and authorization data information corresponding to the relay UE, or based on the subscription and authorization data information returned by the first data storage network element device in the HPLMN of the relay UE; Alternatively, the first HPLMN network element device sends an authorization verification request corresponding to the relay UE to the first data storage network element device, and receives an authorization verification result returned by the first data storage network element device; Alternatively, the first HPLMN network element device sends an authorization verification request corresponding to the relay UE to a first ProSe application server or platform, and receives an authorization verification result returned by the first ProSe application server or platform.

3. The method of claim 1, wherein: The network side device includes: a first VPLMN network element device located in a visited public land mobile network VPLMN where the relay UE roams; the relay UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: The relay UE sends the key discovery request to the first VPLMN network element device; The relay UE receives the discovery key and security parameter returned by the first VPLMN network element device; The first VPLMN network element device forwards the key discovery request to the first HPLMN network element device based on the HPLMNID information corresponding to the home public land mobile network of the relay UE stored in the local core network; The first HPLMN network element device performs authorization verification on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, the first HPLMN network element device sends the discovery key and security parameters associated with the relay service code to the relay UE through the first VPLMN network element device.

4. The method of claim 3, wherein: The first HPLMN network element device includes: a first HPLMN DDNMF located in the HPLMN of the relay UE; The first VPLMN network element device includes: a first VPLMN DDNMF located in the VPLMN where the relay UE roams.

5. The method of claim 1, wherein: The network side device includes: a second HPLMN network element device located in the HPLMN of the service UE; the service UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: The service UE sends the key discovery request to the second HPLMN network element device; The service UE receives the discovery key and security parameter returned by the second HPLMN network element device; The second HPLMN network element device performs authorization verification processing on the service UE to confirm whether the service UE has the right to use the connection service indicated by the relay service code; after determining that the service UE passes the authorization verification processing, the second HPLMN network element device queries the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; After receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, the second HPLMN network element device sends a key request to the first HPLMN network element device based on the PLMNID information in the ProSe application layer ID of the relay UE, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE; The ProSe application layer user ID carries the PLMN ID information, and the PLMN ID information is used to indicate the HPLMN of the relay UE.

6. The method according to claim 5, wherein the second HPLMN network element device performs authorization verification processing on the service UE, comprising: The second HPLMN network element device performs authorization verification processing on the service UE based on the locally stored subscription and authorization data information corresponding to the service UE, or based on the subscription and authorization data information returned by the second data storage network element device located in the HPLMN of the service UE; Alternatively, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second data storage network element device, and receives an authorization verification result returned by the second data storage network element device; Alternatively, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second ProSe application server or platform, and receives an authorization verification result returned by the second ProSe application server or platform.

7. The method of claim 6, wherein: The network side device includes: a second VPLMN network element device located in the VPLMN where the service UE roams; the service UE sends a discovery key request to the corresponding network side device, and receives the discovery key and security parameters returned by the network side device, including: The service UE sends the key discovery request to the second VPLMN network element device; The service UE receives the discovery key and security parameter returned by the second VPLMN network element device; The second VPLMN network element device forwards the key discovery request to the second HPLMN network element device based on the HPLMNID information corresponding to the home public land mobile network of the service UE stored in the local core network; The second HPLMN network element device performs authorization verification on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code. After determining that the service UE has passed the authorization verification, the second HPLMN network element device sends a key request to the first HPLMN network element device, and sends the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

8. The method of claim 7, wherein: The second HPLMN network element device includes: a second HPLMN DDNMF located in the HPLMN of the service UE; The second VPLMN network element device includes: a second VPLMN DDNMF located in the VPLMN where the service UE roams.

9. The method according to any one of claims 1 to 8, wherein: The service UE includes: a source UE and a target UE; The discovery key includes: a confidentiality protection key, an integrity protection key, and an scrambling protection key; the security parameters include: a timestamp and a validity period.

10. A key processing system, comprising: Relay UE, service UE and network side equipment; The relay UE and the service UE are used to send a discovery key request to the corresponding network side device respectively, and receive the discovery key and security parameters returned by the network side device; wherein the information carried in the discovery key request includes: a relay service code; the relay service code is used to indicate the connection service provided by the relay UE to the service UE; the information carried by the relay service code includes distance-based service ProSe application information, or the information carried by the relay service code includes distance-based service ProSe application information and UE-to-UE relay service information; the ProSe application information is used to indicate the ProSe application that the service UE expects to obtain; the UE-to-UE relay service information is used to indicate the UE-to-UE relay service capability supported by the relay UE; The relay UE and the service UE are further configured to process the discovery message using the discovery key and the security parameter respectively; The network side device includes: a first HPLMN network element device located in the HPLMN of the relay UE; The relay UE is used to send the discovery key request to the first HPLMN network element device, and receive the discovery key and security parameter returned by the first HPLMN network element device; The first HPLMN network element device is configured to perform authorization verification processing on the relay UE to confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code; after determining that the relay UE passes the authorization verification, return the discovery key and security parameter associated with the relay service code to the relay UE; The first HPLMN network element device is used to store the discovery key and security parameters, and store the binding relationship between the relay service code and the discovery key and security parameters.

11. The system of claim 10, wherein: The first HPLMN network element device is configured to perform authorization verification processing on the relay UE based on the locally stored subscription and authorization data information corresponding to the relay UE, or based on the subscription and authorization data information returned by the first data storage network element device located in the HPLMN of the relay UE; The first HPLMN network element device is also used to send an authorization verification request corresponding to the relay UE to the first data storage network element device, and receive an authorization verification result returned by the first data storage network element device; or send an authorization verification request corresponding to the relay UE to a first ProSe application server or platform, and receive an authorization verification result returned by the first ProSe application server or platform.

12. The system of claim 10, wherein: The network side device includes: a first VPLMN network element device located in a visited public land mobile network VPLMN where the relay UE roams; The relay UE is used to send the discovery key request to the first VPLMN network element device, and receive the discovery key and security parameter returned by the first VPLMN network element device; The first VPLMN network element device is configured to forward the key discovery request to the first HPLMN network element device based on the HPLMNID information corresponding to the home public land mobile network of the relay UE stored in the local core network; The first HPLMN network element device is used to perform authorization verification on the relay UE, confirm whether the relay UE has the authority to provide the connection service indicated by the relay service code, and after determining that the relay UE passes the authorization verification, send the discovery key and security parameters associated with the relay service code to the relay UE through the first VPLMN network element device.

13. The system of claim 12, wherein: The first HPLMN network element device includes: a first HPLMN DDNMF located in the HPLMN of the relay UE; The first VPLMN network element device includes: a first VPLMN DDNMF located in the VPLMN where the relay UE roams.

14. The system of claim 10, wherein: The network side device includes: a second HPLMN network element device located in the HPLMN of the service UE; The service UE is used to send the discovery key request to the second HPLMN network element device, and receive the discovery key and security parameter returned by the second HPLMN network element device; The second HPLMN network element device is configured to perform authorization verification processing on the service UE to confirm whether the service UE has the right to use the connection service indicated by the relay service code; after determining that the service UE passes the authorization verification processing, query the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; after receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, send a key request to the first HPLMN network element device based on the PLMN ID information in the ProSe application layer ID of the relay UE, and send the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE; The ProSe application layer user ID carries the PLMN ID information, and the PLMN ID information is used to indicate the HPLMN of the relay UE.

15. The system of claim 14, wherein: The second HPLMN network element device is used to perform authorization verification processing on the service UE based on the locally stored subscription and authorization data information corresponding to the service UE, or based on the subscription and authorization data information returned by the second data storage network element device located in the HPLMN of the service UE; The second HPLMN network element device is also used to send an authorization verification request corresponding to the service UE to the second data storage network element device, and receive the authorization verification result returned by the second data storage network element device; or, the second HPLMN network element device sends an authorization verification request corresponding to the service UE to the second ProSe application server or platform, and receives the authorization verification result returned by the second ProSe application server or platform.

16. The system of claim 15, wherein: The network side device includes: a second VPLMN network element device located in the VPLMN where the service UE roams; The service UE is used to send the discovery key request to the second VPLMN network element device, and receive the discovery key and security parameters returned by the second VPLMN network element device; The second VPLMN network element device is configured to forward the key discovery request to the second HPLMN network element device based on the HPLMNID information corresponding to the home public land mobile network of the service UE stored in the local core network; The second HPLMN network element device is used to perform authorization verification on the service UE to confirm whether the service UE has the authority to use the connection service indicated by the relay service code, and after determining that the service UE passes the authorization verification process, query the second ProSe application server or platform for the candidate relay UE that meets the relay service code condition; after receiving the ProSe application layer user ID of the relay UE returned by the second ProSe application server or platform, based on the PLMN ID information in the ProSe application layer ID of the relay UE, send a key request to the first HPLMN network element device, and send the discovery key and security parameters associated with the relay service code returned by the first HPLMN network element device to the service UE through the second VPLMN network element device.

17. The system of claim 16, wherein: The second HPLMN network element device includes: a second HPLMN DDNMF located in the HPLMN of the service UE; The second VPLMN network element device includes: a second VPLMN DDNMF located in the VPLMN where the service UE roams.

18. The system of any one of claims 10 to 17, wherein: The service UE includes: a source UE and a target UE; The discovery key includes: a confidentiality protection key, an integrity protection key, and an scrambling protection key; the security parameters include: a timestamp and a validity period.

19. A computer-readable storage medium storing computer instructions, wherein the instructions are executed by a processor to perform the method according to any one of claims 1 to 9.

Images