Vehicle-to-Everything (V2X) Security Policy Negotiation between Peer User Equipments (UEs)

Abstract

The various techniques discussed herein can facilitate improving the security establishment process for vehicle-to-everything (V2X) direct communication. Various embodiments can employ or include a user equipment and can initiate and / or receive a V2X security establishment connection, where based on the capabilities / policies of the initiating UE, the receiving UE can reject the connection, and / or where at least based on receiving security policy and capability information from the receiving UE, the initiating UE can make a final decision regarding the connection.

Description

Background Art

[0001] Mobile communications in the next-generation wireless communication system 5G or New Radio (NR) network will provide ubiquitous connectivity and access to information and the ability to share data globally. The 5G network and network slicing will be a unified, service-based framework that aims to meet common and sometimes conflicting performance criteria and provide services to a very diverse range of application domains ranging from enhanced mobile broadband (eMBB) to massive machine type communication (mMTC), ultra-reliable low-latency communication (URLLC), and other communications. Generally speaking, NR will evolve based on the Third Generation Partnership Project (3GPP) Long-Term Evolution (LTE) Advanced technology and additional enhanced radio access technologies (RATs) to achieve seamless and faster wireless connection solutions.

[0002] Some services have ultra-low latency, high data capacity, and strict reliability requirements because any failure or performance issue in the network can lead to service failures, which in turn can result in property damage and physical injury. One type of mobile communication includes vehicle communication, where vehicles transmit or exchange vehicle-related information. Vehicle communication can include vehicle-to-everything (V2X), which can include vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-pedestrian (V2P), etc., where each can include a user equipment (UE) or a base station device, such as a next-generation NodeB (gNB), eNB (enhanced UMTS (Universal Mobile Telecommunications System) Terrestrial Radio Access Network (E-UTRAN) NodeB), or other devices / nodes. For example, when referring to a V2X node herein, the node can include a New Radio NodeB (gNB), eNodeB (eNB), user equipment (UE), roadside unit (RSU), drone, or other vehicle equipment or network equipment. In some cases, vehicle-related information is intended for a single vehicle or other entity. In other cases (such as emergency alerts), vehicle-related information is intended for a large number of vehicles or other device entities. Emergency alerts can include collision warnings, loss of control warnings, collision avoidance, pedestrian safety, and other coordination to ensure safe and efficient traffic flow, especially in vehicle-to-vehicle communications (e.g., cars, boats, drones, etc.). Brief Description of the Drawings

[0003] Figure 1 is a block diagram showing the architecture of a system including a core network (CN), such as a fifth-generation (5G) CN (5GC), according to various embodiments.

[0004] Figure 2 is an illustration showing exemplary components of a device that can be employed in accordance with the various aspects discussed herein.

[0005] Figure 3is a diagram showing an exemplary interface of a baseband circuit that can be employed in accordance with various aspects discussed herein.

[0006] Figure 4 is a block diagram showing a system that facilitates V2X (Vehicle-to-Everything) security policy negotiation between peer UEs in accordance with various embodiments discussed herein.

[0007] Figure 5 is a diagram showing an existing process for V2X security establishment during connection setup in combination with various aspects discussed herein.

[0008] Figure 6 is a diagram showing an exemplary method for V2X security establishment that provides higher security during connection setup in accordance with various aspects discussed herein.

[0009] Figure 7 is a flowchart showing an exemplary method for facilitating V2X security policy negotiation between peer UEs that can be employed at an initiating UE in accordance with various embodiments discussed herein.

[0010] Figure 8 is a flowchart showing an exemplary method for facilitating V2X security policy negotiation between peer UEs that can be employed at a receiving UE in accordance with various embodiments discussed herein. DETAILED DESCRIPTION

[0011] The present disclosure will now be described with reference to the accompanying drawings, in which like reference numerals are used throughout to refer to like elements, and in which the structures and devices shown are not necessarily drawn to scale. As used herein, the terms "component", "system", "interface", etc. are intended to refer to entities related to a computer, including hardware, software (e.g., in execution), and / or firmware. For example, a component can be a processor (e.g., a microprocessor, a controller, or other processing device), a process running on the processor, a controller, an object, an executable file, a program, a storage device, a computer, a tablet, and / or a user device with a processing device (e.g., a mobile phone or other device configured to communicate via a 3GPP RAN, etc.). By way of example, an application running on a server and the server can also be components. One or more components can reside in a process, and components can be located on one computer and / or distributed between two or more computers. A group of elements or a group of other components can be described herein, and the term "group" can be interpreted as "one or more" unless the context indicates otherwise (e.g., "an empty group", "a group of two or more X", etc.).

[0012] In addition, these components can be executed from various computer-readable storage media on which various data structures are stored, such as, for example, utility modules. The components can communicate, for example, according to a signal having one or more data packets via local and / or remote processes (e.g., data from one component interacts with another component in a local system, a distributed system, and / or across a network such as the Internet, a local area network, a wide area network, or a similar network of other systems via the signal).

[0013] As another example, a component can be a device having a specific function provided by a mechanical component operated by an electrical or electronic circuit, where the electrical or electronic circuit can be operated by a software application or a firmware application executed by one or more processors. The one or more processors can be inside or outside the device and can execute at least a portion of the software or firmware application. As yet another example, a component can be a device that provides a specific function through an electronic component without a mechanical component; the electronic component can include one or more processors therein to execute software and / or firmware that at least partially imparts the function of the electronic component.

[0014] The use of the term "exemplary" is intended to present concepts in a concrete fashion. As used in this application, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X employs A or B" is intended to mean any natural inclusive permutation. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied in any of the foregoing instances. In addition, the articles "a" and "an" as used in this application and the appended claims should generally be construed to mean "one or more" unless otherwise specified or clear from the context to be directed to the singular form. Moreover, to the extent that the terms "comprising," "comprises," "having," "has," "with," or variants thereof are used in the detailed description and claims, such terms are intended to be inclusive in a manner similar to the term "including." Further, in the case of discussing one or more numbered items (e.g., "a first X," "a second X," etc.), generally, the one or more numbered items can be different or they can be the same, but in some instances, the context can indicate that they are different or indicate that they are the same.

[0015] As used herein, the term "circuitry" may refer to, be part of, or include: an application specific integrated circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) and / or a memory (shared, dedicated, or group) that execute one or more software or firmware programs, combinational logic circuitry, and / or other suitable hardware components that provide the described functionality. In some embodiments, the circuitry may be implemented in one or more software or firmware modules, or the functionality associated with the circuitry may be implemented by one or more software or firmware modules. In some embodiments, the circuitry may include logic that is at least partially operable in hardware.

[0016] Various aspects discussed herein may relate to facilitating wireless communications, and the nature of these communications may vary.

[0017] It is well known that the use of personally identifiable information should follow privacy policies and practices that are generally recognized to meet or exceed industry or government requirements for maintaining user privacy. Specifically, personally identifiable information data should be managed and processed to minimize the risk of inadvertent or unauthorized access or use, and the nature of authorized use should be clearly explained to users.

[0018] The embodiments described herein may be implemented into a system using any appropriately configured hardware and / or software. Figure 1 An architecture of a system 100 including a core network (CN) 120 (e.g., a fifth generation (5G) CN (5GC)) is shown in accordance with various embodiments. System 100 is shown to include: a UE 101, which may be the same as or similar to one or more other UEs discussed herein; a 3rd Generation Partnership Project (3GPP) radio access network (radio AN or RAN) or other (e.g., non-3GPP) AN, (R)AN 210, which may include one or more RAN nodes (e.g., evolved Node B (eNB)), next generation Node B (gNB and / or other nodes) or other nodes or access points; and a data network (DN) 203, which may be, for example, a carrier service, Internet access, or a third-party service; and a fifth generation core network (5GC) 120. 5GC 120 may include one or more of the following functions and network components: an authentication server function (AUSF) 122; an access and mobility management function (AMF) 121; a session management function (SMF) 124; a network exposure function (NEF) 123; a policy control function (PCF) 126; a network repository function (NRF) 125; a unified data management (UDM) 127; an application function (AF) 128; a user plane (UP) function (UPF) 102; and a network slice selection function (NSSF) 129.

[0019] The UPF 102 can act as an anchor point for mobility within and between RATs, an external protocol data unit (PDU) session point interconnected with the DN 103, and a branching point for supporting multi-homed PDU sessions. The UPF 102 can also perform packet routing and forwarding, perform packet inspection, perform the user plane part of policy rules, legally intercept packets (UP collection), perform traffic usage reporting, perform QoS processing on the user plane (e.g., packet filtering, gating, uplink (UL) / downlink (DL) rate enforcement), perform uplink traffic verification (e.g., service data flow (SDF) to QoS flow mapping), perform transport-level packet marking in the uplink and downlink, and perform downlink packet buffering and downlink data notification triggering. The UPF 102 can include an uplink classifier for supporting routing traffic to a data network. The DN 103 can represent various network operator services, Internet access, or third-party services. The DN 103 can include or be similar to an application server. The UPF 102 can interact with the SMF 124 via the N4 reference point between the SMF124 and the UPF 102.

[0020] The AUSF 122 can store authentication data for the UE 101 and process authentication-related functions. The AUSF 122 can facilitate a common authentication framework for various access types. The AUSF 122 can communicate with the AMF 121 via the N12 reference point between the AMF 121 and the AUSF 122; and can communicate with the UDM 127 via the N13 reference point between the UDM 127 and the AUSF 122. Additionally, the AUSF 122 can present an Nausf service-based interface.

[0021] The AMF 121 can be responsible for registration management (e.g., responsible for registering the UE 101, etc.), connection management, reachability management, mobility management, and legal interception of AMF-related events, and access authentication and authorization. The AMF 121 can be the termination point of the N11 reference point between the AMF 121 and the SMF124. The AMF 121 can provide transmission for SM messages between the UE 101 and the SMF 124, and act as a transparent proxy for routing SM messages. The AMF 121 can also be for the UE 101 and the short message service (SMS) function (SMSF)( Figure 1Provide transmission of SMS messages between (not shown in the figure). The AMF 121 can act as a Security Anchor Function (SEAF), which may include interactions with the AUSF 122 and the UE 101 and / or receive intermediate keys established due to the UE 101 authentication process. In the case of using Global User Identity Module (USIM)-based authentication, the AMF 121 can retrieve security materials from the AUSF 122. The AMF 121 can also include a Single Connectivity Mode (SCM) function that receives keys from the SEA for deriving access network-specific keys. Additionally, the AMF 121 can be a termination point of the Radio Access Network (RAN) control plane (CP) interface, which may include or be the N2 reference point between the (R)AN 110 and the AMF 121; and the AMF 121 can be a termination point of the Non-Access Stratum (NAS) (N1) signaling and perform NAS encryption and integrity protection.

[0022] The AMF 121 can also support NAS signaling with the UE 101 through a Non-3GPP (N3) Interworking Function (IWF) interface. The N3IWF can be used to provide access to untrusted entities. The N3IWF can be a termination point of the N2 interface between the (R)AN 110 and the AMF 121 in the control plane and can be a termination point of the N3 reference point between the (R)AN 110 and the UPF 102 in the user plane. Therefore, the AMF 121 can process N2 signaling for PDU sessions and QoS from the SMF 124 and the AMF 121, encapsulate / decapsulate packets for Internet Protocol (IP) security (IPSec) and N3 tunnels, mark N3 user plane packets on the uplink, and enforce QoS requirements corresponding to the N3 packet marking, taking into account the QoS requirements associated with such markings received via N2. The N3IWF can also relay uplink and downlink control plane NAS signaling between the UE 101 and the AMF 121 via the N1 reference point between the UE 101 and the AMF 121 and relay uplink and downlink user plane packets between the UE 101 and the UPF 102. The N3IWF also provides a mechanism for establishing an IPsec tunnel with the UE 101. The AMF 121 can present a Namf service-based interface and can be a termination point of the N14 reference point between two AMF 121s and the N17 reference point between the AMF 121 and the 5G Equipment Identity Register (5G-EIR) ( Figure 1 not shown in the figure).

[0023] UE 101 can register with the AMF 121 to receive network services. Registration Management (RM) is used to register the UE 101 with the network (e.g., AMF 121) or deregister the UE 101, and establish a UE context in the network (e.g., AMF 121). The UE 101 can operate in the RM-REGISTERED state or the RM-DEREGISTERED state. In the RM-DEREGISTERED state, the UE 101 is not registered with the network, and the UE context in the AMF 121 does not hold the valid location or routing information of the UE 101, so the AMF 121 cannot reach the UE 101. In the RM-REGISTERED state, the UE 101 is registered with the network, and the UE context in the AMF 121 can hold the valid location or routing information of the UE 101, so the AMF 121 can reach the UE 101. In the RM-REGISTERED state, the UE 101 can perform a mobility registration update process, perform a periodic registration update process triggered by the expiration of the periodic update timer (e.g., notify the network that the UE 101 is still active), and perform a registration update process to update UE capability information or renegotiate protocol parameters with the network, etc.

[0024] The AMF 121 can store one or more RM contexts of the UE 101, where each RM context is associated with a specific access to the network. The RM context can be a data structure, a database object, etc., which particularly indicates or stores the registration status and the periodic update timer for each access type. The AMF 121 can also store a 5GC Mobility Management (MM) context, which can be the same as or similar to the (Enhanced Packet System (EPS)) MM ((E)MM) context. In various embodiments, the AMF 121 can store the Coverage Enhancement (CE) mode B restriction parameters of the UE 101 in the associated MM context or RM context. The AMF 121 can also derive values from the usage setting parameters of the UE that have been stored in the UE context (and / or MM / RM context) when needed.

[0025] Connection Management (CM) can be used to establish and release a signaling connection between the UE 101 and the AMF 121 via the N1 interface. The signaling connection is used to enable NAS signaling exchange between the UE 101 and the CN 120, and includes a signaling connection between the UE and the AN (e.g., an RRC connection for non-3GPP access or a UE-N3IWF connection) and an N2 connection between the UE 101 and the AMF 121 via the AN (e.g., the RAN 110). The UE 101 can operate in one of two CM states (CM IDLE mode or CM-CONNECTED mode). When the UE 101 operates in the CM-IDLE state / mode, the UE 101 may not have a NAS signaling connection established with the AMF 121 via the N1 interface, and there may be an (R)AN 110 signaling connection (e.g., N2 and / or N3 connection) for the UE 101. When the UE 101 operates in the CM-CONNECTED state / mode, the UE 101 may have a NAS signaling connection established with the AMF 121 via the N1 interface, and there may be an (R)AN 110 signaling connection (e.g., N2 and / or N3 connection) for the UE 101. Establishing an N2 connection between the (R)AN 110 and the AMF 121 may cause the UE 101 to transition from the CM-IDLE mode to the CM-CONNECTED mode, and when the N2 signaling between the (R)AN 110 and the AMF 121 is released, the UE 101 may transition from the CM-CONNECTED mode to the CM-IDLE mode.

[0026] The SMF 124 may be responsible for session management (SM) (e.g., session establishment, modification, and release, including tunnel maintenance between the UPF and the AN node); UE IP address allocation and management (including optional authorization); selection and control of the UPF function; configuring the traffic steering of the UPF to route traffic to the correct destination; terminating the interface towards the policy control function; the policy enforcement and the control part of QoS; lawful interception (for SM events and the interface with the lawful interception (LI) system); terminating the SM part of the NAS message; downlink data notification; initiating AN-specific SM information sent to the AN via the AMF over N2; and determining the session and service continuity (SSC) mode of the session. SM may refer to the management of the PDU session, and the PDU session or "session" may refer to the PDU connection service that provides or enables the PDU exchange between the UE 101 and the data network (DN) 103 identified by the data network name (DNN). The PDU session may be established upon request by the UE 101 using the NAS SM signaling exchanged between the UE 101 and the SMF 124 over the N1 reference point, modified upon request by the UE 101 and the 5GC 120, and released upon request by the UE 101 and the 5GC 120. The 5GC 120 may trigger a specific application in the UE 101 upon request from the application server. In response to receiving the trigger message, the UE101 may pass the trigger message (or the relevant part / information of the trigger message) to one or more identified applications in the UE 101. The identified applications in the UE 101 may establish a PDU session with a specific DNN. The SMF 124 may check whether the UE101 request complies with the user subscription information associated with the UE 101. In this regard, the SMF 124 may retrieve and / or request an update notification of the subscription data at the SMF 124 level received from the UDM 127.

[0027] The SMF 124 may include the following roaming functions: handling local enforcement to apply the QoS service level agreement (SLA) (visited public land mobile network (VPLMN)); charging data collection and charging interface (VPLMN); lawful interception (for SM events and the interface with the LI system, in the VPLMN); and supporting the interaction with the external DN to transmit the signaling for PDU session authorization / authentication via the external DN. In the roaming scenario, the N16 reference point between two SMF 124s may be included in the system 100, which may be between the SMF 124 in the visited network and another SMF 124 in the home network. Additionally, the SMF 124 may present an Nsmf service-based interface.

[0028] The NEF 123 can provide components for securely exposing the services and capabilities provided by 3GPP network functions to third parties, internal exposure / re-exposure, application functions (e.g., AF 128), edge computing or fog computing systems, etc. In such embodiments, the NEF 123 can authenticate, authorize, and / or restrict the AF. The NEF 123 can also transform the information exchanged with the AF 128 and the information exchanged with internal network functions. For example, the NEF 123 can transform between AF service identifiers and internal 5GC information. The NEF 123 can also receive information from other network functions (NFs) based on the exposure capabilities of other network functions. This information can be stored at the NEF 123 as structured data, or stored at a data storage NF using a standardized interface. Then, the stored information can be re-exposed by the NEF 123 to other NFs and AFs, and / or used for other purposes such as analysis. Additionally, the NEF123 can present an interface based on the Nnef service.

[0029] The NRF 125 can support a service discovery function, receive NF discovery requests from NF instances, and provide information about the discovered NF instances to NF instances. The NRF 125 also maintains information about available NF instances and the services they support. As used herein, terms such as "instantiation" can refer to the creation of an instance, and an "instance" can refer to a specific occurrence of an object, which can occur, for example, during the execution of program code. Additionally, the NRF 125 can present an interface based on the Nnrf service.

[0030] The PCF 126 can provide control plane functions for executing their policy rules, and can also support a unified policy framework for managing network behavior. The PCF 126 can also implement an FE to access subscription information related to policy decisions in the UDR of the UDM 127. The PCF 126 can communicate with the AMF 121 via the N15 reference point between the PCF 126 and the AMF 121, which can include the PCF 126 in a visited network and the AMF 121 in a roaming scenario. The PCF 126 can communicate with the AF 128 via the N5 reference point between the PCF 126 and the AF 128; and communicate with the SMF 124 via the N7 reference point between the PCF 126 and the SMF 124. The system 100 and / or the CN 120 can also include an N24 reference point between the PCF 126 (in a home network) and the PCF 126 in a visited network. Additionally, the PCF 126 can present an interface based on the Npcf service.

[0031] The UDM 127 can process subscription-related information to support the handling of communication sessions by network entities and can store the subscription data of the UE 101. For example, the subscription data can be transmitted between the UDM 127 and the AMF 121 via the N8 reference point between the UDM 127 and the AMF. The UDM 127 can include two parts: an Application Function Entity (FE) and a Unified Data Repository (UDR) (the FE and the UDR are not shown in Figure 1 ). The UDR can store the subscription data and policy data of the UDM 127 and the PCF 126, and / or the structured data for exposure and the application data of the NEF123 (including the Packet Flow Description (PFD) for application detection, the application request information of multiple UEs 101). The Nudr service-based interface can be presented by the UDR 221 to allow the UDM 127, the PCF 126, and the NEF 123 to access a specific set of the stored data, and to read, update (e.g., add, modify), delete, and subscribe to notifications of relevant data changes in the UDR. The UDM can include a UDM-FE, which is responsible for handling credentials, location management, subscription management, etc. In different transactions, several different FEs can serve the same user. The UDM-FE accesses the subscription information stored in the UDR and performs authentication credential processing, user identification processing, access authorization, registration / mobility management, and subscription management. The UDR can interact with the SMF 124 via the N10 reference point between the UDM 127 and the SMF 124. The UDM 127 can also support SMS management, where the SMS-FE implements similar application logic as discussed elsewhere in this document. Additionally, the UDM 127 can present a Nudm service-based interface.

[0032] The AF 128 can provide the impact of the application on traffic routing, provide access to the NEF 123, and interact with the policy framework for policy control. The 5GC 120 and the AF 128 can provide information to each other via the NEF 123, which can be used for edge computing implementation. In such implementations, the network operator and third-party services can be hosted near the attachment UE101 access point to achieve efficient service delivery by reducing the end-to-end latency and the load on the transport network. For edge computing implementation, the 5GC can select the UPF 102 near the UE 101 and perform traffic steering from the UPF 102 to the DN 103 via the N6 interface. This can be based on the UE subscription data, the UE location, and the information provided by the AF 128. In this way, the AF 128 can affect the UPF (re)selection and traffic routing. Based on the operator deployment, when the AF 128 is considered a trusted entity, the network operator can allow the AF 128 to directly interact with the relevant NF. Additionally, the AF 128 can present a Naf service-based interface.

[0033] The NSSF 129 may select a set of network slice instances to serve the UE 101. The NSSF 129 may also appropriately determine the allowed Network Slice Selection Assistance Information (NSSAI) and the mapping to the subscribed single NSSAI (S-NSSAI). The NSSF 129 may also determine, based on appropriate configuration and possibly by querying the NRF 125, the set of AMFs, or a list of candidate AMFs 121, that will be used to serve the UE 101. The selection of a set of network slice instances for the UE 101 may be triggered by the AMF 121, where the UE 101 registers by interacting with the NSSF 129, which may cause the AMF 121 to change. The NSSF 129 may interact with the AMF 121 via the N22 reference point between the AMF 121 and the NSSF 129; and may communicate with another NSSF 129 in the visited network via the N31 reference point ( Figure 1 not shown in the figure). Additionally, the NSSF 129 may present an interface based on the Nnssf service.

[0034] As previously discussed, the CN 120 may include an SMSF, which may be responsible for SMS subscription checking and verification, and relaying SM messages to / from the UE 101 to / from other entities such as the SMS-Gateway Mobile Switching Center (GMSC) / Interworking MSC (IWMSC) / SMS Router. The SMSF may also interact with the AMF 121 and the UDM 127 for a notification procedure that the UE 101 can use for SMS transmission (e.g., setting the UE unreachable flag and notifying the UDM 127 when the UE 101 is available for SMS).

[0035] The CN 120 may also include Figure 1 other elements not shown, such as data storage systems / architectures, 5G-EIR, Security Edge Protection Proxy (SEPP), etc. The data storage system may include a Structured Data Storage Function (SDSF), an Unstructured Data Storage Function (UDSF), etc. Any NF may store unstructured data into or retrieve it from the UDSF (e.g., UE context) via the N18 reference point between any NF and the UDSF ( Figure 1 not shown in the figure). Each NF may share the UDSF for storing its respective unstructured data, or each NF may have its own UDSF located at or near each NF. Additionally, the UDSF may present an interface based on the Nudsf service. Figure 1(not shown in the figure). The 5G-EIR can be an NF that checks the status of the Permanent Equipment Identifier (PEI) to determine whether to blacklist a specific device / entity from the network; and the SEPP can be a non-transparent proxy that performs topology hiding, message filtering, and policing on the inter-PLMN control plane interface.

[0036] In addition, there can be more reference points and / or service-based interfaces between NF services in the NF; however, for clarity, Figure 1 these interfaces and reference points are omitted. In one example, the CN 120 can include an Nx interface, which is an inter-CN interface between the MME (e.g., non-5G MME) and the AMF 121 to enable interworking between the CN 120 and a non-5G CN. Other exemplary interfaces / reference points can include the N5g-EIR service-based interface presented by the 5G-EIR, the N27 reference point between the Network Repository Function (NRF) in the visited network and the NRF in the home network; and the N31 reference point between the NSSF in the visited network and the NSSF in the home network.

[0037] Figure 2 Exemplary components of the device 200 according to some embodiments are shown. In some embodiments, the device 200 can include at least the application circuit 202, the baseband circuit 204, the Radio Frequency (RF) circuit 206, the Front End Module (FEM) circuit 208, one or more antennas 210, and the Power Management Circuit (PMC) 212 coupled together as shown. The illustrated components of the device 200 can be included in a UE or a RAN node. In some embodiments, the device 200 can include fewer elements (e.g., a RAN node cannot utilize the application circuit 202, but includes a processor / controller to process IP data received from a CN such as the 5GC 120 or the Evolved Packet Core (EPC)). In some embodiments, the device 200 can include additional elements, such as a memory / storage device, a display, a camera, a sensor, or an Input / Output (I / O) interface. In other embodiments, the following components can be included in more than one device (e.g., the circuits can be separately included in more than one device for a Cloud-RAN (C-RAN) implementation).

[0038] The application circuit 202 may include one or more application processors. For example, the application circuit 202 may include circuitry such as, but not limited to, one or more single-core or multi-core processors. The processor may include any combination of general-purpose processors and dedicated processors (e.g., graphics processors, application processors, etc.). The processor may be coupled to the memory / storage or may include the memory / storage, and may be configured to execute instructions stored in the memory / storage to enable various applications or operating systems to run on the device 200. In some embodiments, the processor of the application circuit 202 may process IP data packets received from the EPC.

[0039] The baseband circuit 204 may include circuitry such as, but not limited to, one or more single-core or multi-core processors. The baseband circuit 204 may include one or more baseband processors or control logic components to process baseband signals received from the receive signal path of the RF circuit 206 and generate baseband signals for the transmit signal path of the RF circuit 206. The baseband processing circuit 204 may interact with the application circuit 202 to generate and process baseband signals and control the operation of the RF circuit 206. For example, in some embodiments, the baseband circuit 204 may include a third-generation (3G) baseband processor 204A, a fourth-generation (4G) baseband processor 204B, a fifth-generation (5G) baseband processor 204C, or other baseband processors 204D of other existing generations, generations under development, or generations to be developed in the future (e.g., second-generation (2G), sixth-generation (6G), etc.). The baseband circuit 204 (e.g., one or more of the baseband processors 204A - 204D) may process various radio control functions that may communicate with one or more radio networks via the RF circuit 206. In other embodiments, some or all of the functions of the baseband processors 204A - 204D may be included in modules stored in the memory 204G and executed via the central processing unit (CPU) 204E. The radio control functions may include, but are not limited to, signal modulation / demodulation, encoding / decoding, radio frequency shifting, etc. In some embodiments, the modulation / demodulation circuit of the baseband circuit 204 may include fast Fourier transform (FFT), precoding, or constellation mapping / demapping functions. In some embodiments, the encoding / decoding circuit of the baseband circuit 204 may include convolution, tail-biting convolution, turbo, Viterbi, or low-density parity-check (LDPC) encoder / decoder functions. The embodiments of the modulation / demodulation and encoder / decoder functions are not limited to these examples and may include other suitable functions in other embodiments.

[0040] In some embodiments, baseband circuit 204 may include one or more audio digital signal processors (DSPs) 204F. The audio DSP 204F may include elements for compression / decompression and echo cancellation, and in other embodiments may include other suitable processing elements. In some embodiments, the components of the baseband circuit may be appropriately combined on a single chip, in a single chipset, or disposed on the same circuit board. In some embodiments, some or all of the constituent components of baseband circuit 204 and application circuit 202 may be implemented together, such as, for example, on a system on a chip (SOC).

[0041] In some embodiments, baseband circuit 204 may provide communication compatible with one or more radio technologies. For example, in some embodiments, baseband circuit 204 may support communication with NG-RAN, evolved universal terrestrial radio access network (EUTRAN), or other wireless metropolitan area network (WMAN), wireless local area network (WLAN), wireless personal area network (WPAN), etc. Embodiments in which baseband circuit 204 is configured to support radio communication of more than one wireless protocol may be referred to as multi-mode baseband circuits.

[0042] RF circuit 206 may communicate with a wireless network using modulated electromagnetic radiation through a non-solid medium. In various embodiments, RF circuit 206 may include switches, filters, amplifiers, etc. to facilitate communication with the wireless network. RF circuit 206 may include a receive signal path that may include circuitry for down-converting an RF signal received from FEM circuit 208 and providing a baseband signal to baseband circuit 204. RF circuit 206 may also include a transmit signal path that may include circuitry for up-converting a baseband signal provided by baseband circuit 204 and providing an RF output signal to FEM circuit 208 for transmission.

[0043] In some embodiments, the receive signal path of RF circuit 206 may include mixer circuit 206a, amplifier circuit 206b, and filter circuit 206c. In some embodiments, the transmit signal path of RF circuit 206 may include filter circuit 206c and mixer circuit 206a. RF circuit 206 may also include synthesizer circuit 206d for synthesizing the frequencies used by mixer circuit 206a of the receive signal path and the transmit signal path. In some embodiments, mixer circuit 206a of the receive signal path may be configured to down-convert the RF signal received from FEM circuit 208 based on the synthesized frequency provided by synthesizer circuit 206d. Amplifier circuit 206b may be configured to amplify the down-converted signal, and filter circuit 206c may be a low-pass filter (LPF) or a band-pass filter (BPF) configured to remove unwanted signals from the down-converted signal to generate an output baseband signal. The output baseband signal may be provided to baseband circuit 204 for further processing. In some embodiments, although not required, the output baseband signal may be a zero-frequency baseband signal. In some embodiments, mixer circuit 206a of the receive signal path may include a passive mixer, although the scope of the embodiments is not limited in this regard.

[0044] In some embodiments, mixer circuit 206a of the transmit signal path may be configured to up-convert an input baseband signal based on the synthesized frequency provided by synthesizer circuit 206d to generate an RF output signal for FEM circuit 208. The baseband signal may be provided by baseband circuit 204 and may be filtered by filter circuit 206c.

[0045] In some embodiments, mixer circuit 206a of the receive signal path and mixer circuit 206a of the transmit signal path may include two or more mixers and may be arranged for quadrature down-conversion and up-conversion, respectively. In some embodiments, mixer circuit 206a of the receive signal path and mixer circuit 206a of the transmit signal path may include two or more mixers and may be arranged for image rejection (e.g., Hartley image rejection). In some embodiments, mixer circuit 206a of the receive signal path and mixer circuit 206a may be arranged for direct down-conversion and direct up-conversion, respectively. In some embodiments, mixer circuit 206a of the receive signal path and mixer circuit 206a of the transmit signal path may be configured for superheterodyne operation.

[0046] In some embodiments, the output baseband signal and the input baseband signal may be analog baseband signals, although the scope of the embodiments is not limited in this regard. In some alternative embodiments, the output baseband signal and the input baseband signal may be digital baseband signals. In these alternative embodiments, the RF circuit 206 may include an analog-to-digital converter (ADC) and a digital-to-analog converter (DAC) circuit, and the baseband circuit 204 may include a digital baseband interface to communicate with the RF circuit 206.

[0047] In some dual-mode embodiments, a separate radio IC circuit may be provided to process signals for each spectrum, although the scope of the embodiments is not limited in this regard.

[0048] In some embodiments, the synthesizer circuit 206d may be a fractional-N synthesizer or a fractional-N / N+1 synthesizer, although the scope of the embodiments is not limited in this regard, as other types of frequency synthesizers may be suitable. For example, the synthesizer circuit 206d may be a delta-sigma synthesizer, a frequency multiplier, or a synthesizer including a phase-locked loop with a frequency divider.

[0049] The synthesizer circuit 206d may be configured to synthesize an output frequency based on a frequency input and a frequency divider control input for use by the mixer circuit 206a of the RF circuit 206. In some embodiments, the synthesizer circuit 206d may be a fractional-N / N+1 synthesizer.

[0050] In some embodiments, the frequency input may be provided by a voltage-controlled oscillator (VCO), although this is not required. The frequency divider control input may be provided by the baseband circuit 204 or the application processing circuit 202 based on the desired output frequency. In some embodiments, the frequency divider control input (e.g., N) may be determined from a look-up table based on the channel indicated by the application processing circuit 202.

[0051] The synthesizer circuit 206d of the RF circuit 206 may include a frequency divider, a delay-locked loop (DLL), a multiplexer, and a phase accumulator. In some embodiments, the frequency divider may be a dual-mode divider (DMD), and the phase accumulator may be a digital phase accumulator (DPA). In some embodiments, the DMD may be configured to divide an input signal by N or N+1 (e.g., based on a carry) to provide a fractional division ratio. In some example embodiments, the DLL may include a cascaded, tunable, set of delay elements, a phase detector, a charge pump, and D-type flip-flops. In these embodiments, the delay elements may be configured to divide the VCO period into Nd equal phase bins, where Nd is the number of delay elements in the delay line. In this way, the DLL provides negative feedback to help ensure that the total delay through the delay line is one VCO period.

[0052] In some embodiments, the synthesizer circuit 206d may be configured to generate a carrier frequency as the output frequency, while in other embodiments, the output frequency may be a multiple of the carrier frequency (e.g., twice the carrier frequency, four times the carrier frequency), and is used in conjunction with the quadrature generator and divider circuits to generate multiple signals having multiple different phases relative to each other at the carrier frequency. In some embodiments, the output frequency may be the LO frequency (fLO). In some embodiments, the RF circuit 206 may include an IQ / polarity converter.

[0053] The FEM circuit 208 may include a receive signal path that may include circuitry configured to operate on RF signals received from one or more antennas 210, amplify the received signals, and provide an amplified version of the received signals to the RF circuit 206 for further processing. The FEM circuit 208 may also include a transmit signal path that may include circuitry configured to amplify transmit signals provided by the RF circuit 206 for transmission via one or more of the one or more antennas 210. In various embodiments, amplification through the transmit or receive signal paths may be accomplished only in the RF circuit 206, only in the FEM 208, or in both the RF circuit 206 and the FEM 208.

[0054] In some embodiments, the FEM circuit 208 may include a TX / RX switch to switch between transmit mode and receive mode operations. The FEM circuit may include a receive signal path and a transmit signal path. The receive signal path of the FEM circuit may include an LNA to amplify received RF signals and provide the amplified received RF signals as an output (e.g., to the RF circuit 206). The transmit signal path of the FEM circuit 208 may include a power amplifier (PA) to amplify an input RF signal (e.g., provided by the RF circuit 206), and one or more filters to generate an RF signal for subsequent transmission (e.g., via one or more of the one or more antennas 210).

[0055] In some embodiments, the PMC 212 may manage the power provided to the baseband circuit 204. Specifically, the PMC 212 may control power selection, voltage scaling, battery charging, or DC-DC conversion. When the device 200 is capable of being powered by a battery, e.g., when the device is included in a UE, the PMC 212 is typically included. The PMC 212 may improve power conversion efficiency while providing desired implementation size and thermal characteristics.

[0056] While Figure 2PMC 212 is shown coupled only to the baseband circuitry 204. However, in other embodiments, PMC 212 may be additionally or alternatively coupled to other components such as, but not limited to, application circuitry 202, RF circuitry 206, or FEM 208, and perform similar power management operations.

[0057] In some embodiments, PMC 212 may control or otherwise be part of various power saving mechanisms of device 200. For example, if device 200 is in the RRC_Connected state, where it is still connected to the RAN node as expected to receive traffic soon, it may enter a state called discontinuous reception mode (DRX) after a period of inactivity. During this state, device 200 may power down for short intervals, thus saving power.

[0058] If there is no data traffic activity for an extended period, device 200 may transition to the RRC_Idle state, where it is disconnected from the network and does not perform operations such as channel quality feedback, handover, etc. Device 200 enters a very low power state, and it performs paging, where it wakes up periodically again to listen for the network and then powers down again. Device 200 may not receive data while in this state; to receive data, the device may transition back to the RRC_Connected state.

[0059] Additional power saving modes may cause device 200 to be unavailable to the network for a time period longer than the paging interval (ranging from a few seconds to a few hours). During this period, the device is completely unable to connect to the network and may be powered down completely. Any data sent during this period will incur a significant delay, and it is assumed that the delay is acceptable.

[0060] The processors of application circuitry 202 and the processors of baseband circuitry 204 may be used to execute elements of one or more instances of the protocol stack. For example, the processors of baseband circuitry 204 may be used alone or in combination to perform functions of layer 3, layer 2, or layer 1, while the processors of application circuitry 204 may utilize the data received from these layers (e.g., packet data) and further perform functions of layer 4 (e.g., transport control protocol (TCP) and user datagram protocol (UDP) layers). As mentioned herein, layer 3 may include the radio resource control (RRC) layer, which will be described in further detail below. As mentioned herein, layer 2 may include the media access control (MAC) layer, radio link control (RLC) layer, and packet data convergence protocol (PDCP) layer, which will be described in further detail below. As mentioned herein, layer 1 may include the physical (PHY) layer of the UE / RAN node, which will be described in further detail below.

[0061] Figure 3Shows an exemplary interface of a baseband circuit according to some embodiments. As discussed above, Figure 2 The baseband circuit 204 of Figure 2 may include processors 204A - 204E and a memory 204G utilized by the processors. Each of the processors 204A - 204E may include a memory interface 304A - 304E respectively to send / receive data to / from the memory 204G.

[0062] The baseband circuit 204 may also include: one or more interfaces to communicatively couple to other circuits / devices, such as a memory interface 312 (e.g., an interface for sending / receiving data to / from a memory external to the baseband circuit 204); an application circuit interface 314 (e.g., an interface for sending / receiving data to / from Figure 2 the application circuit 202 of Figure 2 ); an RF circuit interface 316 (e.g., an interface for sending / receiving data to / from Figure 2 the RF circuit 206 of Figure 2 ); a wireless hardware connection interface 318 (e.g., an interface for sending / receiving data to / from a near - field communication (NFC) component, a component (e.g., Low Energy), a component, and other communication components); and a power management interface 320 (e.g., an interface for sending / receiving power or control signals to / from the PMC 212).

[0063] As discussed in more detail herein, various embodiments may facilitate enhanced vehicle - to - everything (V2X) security policy negotiation between peer user equipment (UE). Various embodiments may employ the techniques discussed herein, such as providing higher security by addressing existing security issues, thereby improving existing V2X security policy negotiation.

[0064] Referring to Figure 4, which shows a block diagram of a system 400 that can be employed at a UE (User Equipment), a next-generation Node B (gNodeB or gNB), or another BS (Base Station) / TRP (Transmit / Receive Point) or component of a 3GPP (Third Generation Partnership Project) network (e.g., a 5GC (Fifth Generation Core Network) component or function such as a UPF (User Plane Function)), facilitating V2X (Vehicle-to-Everything) security policy negotiation between peer UEs. The system 400 may include a processor 410, a communication circuit 420, and a memory 430. The processor 410 (e.g., which may include one or more of 202 and / or 204A - 204F, etc.) may include processing circuitry and associated interfaces (e.g., a communication interface for communicating with the communication circuit 420 (e.g., an RF circuit interface 316), a memory interface for communicating with the memory 430 (e.g., a memory interface 312), etc.). The communication circuit 420 may include, for example, circuitry for wired and / or wireless connections (e.g., 206 and / or 208), which may include a transmitter circuit (e.g., associated with one or more transmission chains) and / or a receiver circuit (e.g., associated with one or more receiving chains), where the transmitter circuit and the receiver circuit may employ common and / or different circuit elements, or a combination thereof. The memory 430 may include one or more memory devices (e.g., a memory 204G, local memory (e.g., including the CPU registers of the processor discussed herein), etc.), which may have any of various storage media (e.g., volatile and / or non-volatile according to any of various technologies / constructions, etc.), and may store instructions and / or data associated with one or more of the processor 410 or the communication circuit 420.

[0065] A particular type of implementation of the system 400 (e.g., a UE implementation) may be indicated via a subscript (e.g., system 400 UE includes a processor 410 UE , a communication circuit 420 UE and a memory 430 UE ). In some implementations, such as a BS implementation (e.g., system 400 gNB ) and a network component (e.g., a UPF (User Plane Function), etc.) implementation (e.g., system 400 UPF ), the processor 410 gNB (etc.), the communication circuit (e.g., 420 gNB etc.) and the memory (e.g., 430 gNBetc.) may be in a single device or may be included in different devices, such as part of a distributed architecture. In an embodiment, signaling or messaging between different embodiments of system 400 (e.g., 4001 and 4002) may be generated by processor 4101, transmitted by communication circuit 4201 via a suitable interface or reference point (e.g., 3GPP air interface N3, N4, etc.), received by communication circuit 4202, and processed by processor 4102. Depending on the type of interface, additional components (e.g., antennas, network ports, etc. associated with systems 4001 and 4002) may participate in this communication.

[0066] In various aspects discussed herein, signals and / or messages may be generated and output for transmission, and / or the transmitted messages may be received and processed. Depending on the type of signal or message generated, output for transmission (e.g., by processor 410, etc.) may include one or more of the following operations: generating a set of associated bits indicating the content of the signal or message, encoding (e.g., may include adding cyclic redundancy check (CRC) and / or encoding via one or more of turbo codes, low density parity check (LDPC) codes, truncated convolutional codes (TBCC), etc.), scrambling (e.g., based on a scrambling seed), modulating (e.g., via one of binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), or some form of quadrature amplitude modulation (QAM), etc.) and / or resource mapping to one or more resource elements (REs) (e.g., a scheduled resource set, a set of time and frequency resources authorized for uplink transmission, etc.), where each RE may span one subcarrier in the frequency domain and one symbol in the time domain (e.g., where the symbol may be according to any of a variety of access schemes, such as orthogonal frequency division multiplexing (OFDM), single carrier frequency division multiple access (SC-FDMA), etc.). Depending on the type of signal or message received, processing (e.g., by processor 410, etc.) may include one or more of the following operations: identifying the physical resources associated with the signal / message, detecting the signal / message, resource element group deinterleaving, demodulating, descrambling, and / or decoding.

[0067] In various aspects, one or more of information (e.g., system information, resources associated with signaling, etc.), features, parameters, etc. may be signaled (e.g., associated with one or more layers, such as L1 signaling or higher layer signaling (e.g., MAC, RRC, etc.)) from a gNB or other access point (e.g., via being generated by processor 410 gNB generated, transmitted by communication circuit 420 gNB transmitted, received by communication circuit 420 UE received, and processed by processor 410 UEThe processed signaling) is configured for the UE. Depending on the type, characteristics, parameters, etc. of the information, the type of signaling adopted and / or the exact details of the operations performed at the UE and / or gNB during processing (e.g., signaling structure, handling of PDU / SDU, etc.) may vary. However, for convenience, such operations may be referred to herein as configuring information / characteristics / parameters / etc. for the UE, generating or processing configuration signaling, or via similar terms.

[0068] In 3GPP (Third Generation Partnership Project) TS (Technical Specification) 33.536, the general process for V2X security establishment between peer UEs in existing systems is discussed. Currently, in TS 33.536, for NR (New Radio) PC5 (Proximity-based Communication (Interface) 5) unicast, the following security policies are provided for the UE during the service authorization process, together with the V2X service list (e.g., PSID (Provider Service Identifier) of the V2X application or ITS (Intelligent Transport System)-AID (Application Identifier)) and the geographical area and its security policy, and this security policy indicates the following policies: (1) Signaling integrity protection (which can be one of REQUIRED / PREFERRED / OFF); (2) Signaling confidentiality protection (which can be one of REQUIRED / PREFERRED / OFF); (3) User plane integrity protection (which can be one of REQUIRED / PREFERRED / OFF); and (4) User plane confidentiality protection (which can be one of REQUIRED / PREFERRED / OFF).

[0069] Referring to Figure 5 , a diagram of an existing process 500 for V2X security establishment during connection establishment is shown in combination with the various aspects discussed herein. In process 500, the initiating UE 5021 (UE_1) sends its security policy in a direct communication request, the receiving UE 5022 (UE_2) accepts the security policy, selects an algorithm supported by the initiating UE 5021 (UE_1) and sends it back. Then the initiating UE 5021 (UE_1) can use this algorithm to protect the direct security mode complete message.

[0070] At 510, UE_1 5021 sends a direct communication request to UE_2 5022, thereby indicating the security capabilities of UE_1 5021 and the signaling security policy of UE_1 5021.

[0071] At 520, UE_2 5022 can initiate a direct authentication and key establishment process with UE_1 5021. If UE_25022 does not have the K indicated at 510 NRP and K NRPFor an ID pair, this can be mandatory, and signaling can be used to establish keys for specific usage scenarios.

[0072] At 530, UE_2 5022 can send a direct security mode command message to UE_1 5021. UE_2 5021 can include a Chosen_algs ("chosen algorithms") parameter to indicate which security algorithms UE 5021 and UE 5022 will use to protect the data in the message. The Chosen_algs can indicate the use of the NULL integrity algorithm only when the signaling security policy of UE_2 5022 has an integrity such as OFF or PREFERRED. Based on the chosen algorithms, UE_2 5022 can derive confidentiality and integrity keys. Before sending the direct security mode command to UE_1 5021, UE_2 5022 can perform integrity protection on it. After sending the direct security mode command, at 540, UE_2 5022 is ready to receive the user plane and signaling with the new context.

[0073] At 550, UE_1 5021 can also check the integrity protection for the direct security mode command message. UE_1 can accept the NULL integrity algorithm only when its security policy for signaling indicates that integrity protection is OFF or PREFERRED.

[0074] However, the existing security establishment process has the following security issues: (1) Only UE_2 5022 has the ability to determine the final security algorithm; and (2) Even when the security capabilities and / or policies of UE_1 5021 cannot match the policy of UE_2 5022, UE_2 5022 cannot reject the connection.

[0075] In various embodiments, the techniques discussed herein can be used to establish security when establishing a V2X direct connection. These techniques can include an improved process for security establishment at connection establishment, which can provide: (1) UE_2 5022 (receiving UE) indicates its security policy and security capabilities to UE_1 5021 (initiating UE), and then based on the policy and security capabilities of UE_2 5022, UE_1 5021 can make a decision on the chosen algorithms; and (2) Based on one or more of the capabilities and / or policies of UE_1 5021 and / or the policy of UE_2 5022, UE_2 5022 can reject the connection.

[0076] Secure establishment process

[0077] Contrary to existing V2X security establishment procedures, security establishment according to various embodiments discussed herein can provide flexibility in negotiating security policies to both the initiating UE 5021 (UE_1) and the receiving UE 5022 (UE_2). In various embodiments, after UE_1 5021 sends a direct communication request (DCR) to UE_2 5022, UE_2 5022 can decide whether to accept the connection based on the security capabilities and security policies of UE_1 5021 and the security policy of UE_2 5022. If UE_2 5022 decides to accept the security policy of UE_1 5022, UE_2 5022 can include its security capabilities and security policies in a direct security mode command, and based at least on this command, UE_1 5021 can determine whether to accept the connection. Additionally, although various embodiments and examples discuss scenarios for establishing security (or rejecting the connection) for a single V2X connection, in various embodiments, a direct communication request from an initiating UE can be sent to more than one peer UE, and the initiating UE can establish (or reject or have rejected) security with the peer UE for direct V2X communication.

[0078] In V2X communication, various embodiments can employ the security policies discussed herein to establish security policies between peer UEs. These techniques discuss: security policies and how UEs handle the policies, both in terms of the overall process for negotiating security policies between a pair of peer UEs; and the respective methods for the initiating UE 5021 and the receiving UE 5022. When an overall security context can be established, there are two different cases: establishing a new connection and performing a key update for an existing connection. The techniques discussed herein facilitate establishing a new connection.

[0079] The New Radio (NR) PC5 (Proximity-based Communication (interface) 5) link can support activating or deactivating security based on network security policies similar to those of Uu (the radio interface between the 3rd Generation Partnership Project (3GPP) radio access network (RAN) and a user equipment), as defined in TS 33.501. A security policy for the PC5 link can be provided for NR PC5 V2X communication, as discussed in more detail below.

[0080] To handle the security policy for the NR PC5 link, the PCF can also provide a User Plane (UP) security policy for each V2X application during the service authorization and information provision process as defined in TS 23.287.

[0081] For NR PC5 unicast, the following security policies can be provided to the UE: a V2X service list, such as the PSID or ITS-AID of a V2X application; and a geographical area and its security policy, which indicates the following: (1) signaling integrity protection (REQUIRED / PREFERRED / OFF); (2) signaling confidentiality protection (REQUIRED / PREFERRED / OFF); (3) user plane integrity protection (REQUIRED / PREFERRED / OFF); and / or (4) user plane confidentiality protection (REQUIRED / PREFERRED / OFF). Integrity protection for signaling traffic cannot enable services that do not require security, such as emergency services. Although OFF is discussed herein as the third security policy option, in various embodiments, NOTNEEDED can be used instead of OFF.

[0082] The security policy for signaling integrity protection being OFF means that the UE will only establish a connection without security. The security policy for signaling integrity protection being PREFFERED means that the UE can attempt to establish security but will accept a connection lacking security. In the case where the integrity protection security policy is set to REQUIRED, the UE will only accept the connection if a non-NULL integrity algorithm is used to protect the signaling traffic.

[0083] For other cases, the OFF setting means that the UE will only use the NULL confidentiality algorithm for that traffic or will not apply integrity protection, while the REQUIRED setting means that the UE will use a non-NULL algorithm. If the security policy is PREFERRED, the UE can accept any algorithm for that particular protection. One use of PREFERRED is to enable the security policy to change without updating all UEs at the same time.

[0084] At the initial connection, the initiating UE can include its signaling security policy in the direct communication request message. When selecting an algorithm in the direct security mode command message, the UE responding to the message can take this into account. If the algorithm selection does not match its policy, the initiating UE can reject the direct security mode command.

[0085] When adding a V2X service to an existing connection, if the signaling security in use does not match the policy for the new application, the UE responding to the request can reject the request.

[0086] The combination of security policies for UP integrity protection can lead to the activation of integrity protection based on one or more of the following conditions. Condition 1, where both UP security policies indicate "required" UP integrity protection, or one UP security policy indicates "required" and the other indicates "preferred", when establishing a PC5 unicast, can lead to the individual activation of UP integrity protection for each user plane bearer of that service type. Condition 2, where both UP security policies indicate "preferred" UP integrity protection, when establishing a PC5 unicast based on a local policy, can lead to the individual activation or deactivation of UP integrity protection for each user plane bearer of that service type. Condition 3, for other scenarios other than Condition 1 and Condition 2, when establishing a PC5 unicast, can lead to the individual deactivation of UP integrity protection for each user plane bearer of that service type.

[0087] For UP encryption protection (e.g., UP confidentiality protection), the resulting activation can be the same as the UP integrity protection activation, but based on the corresponding security policy for UP confidentiality protection rather than the security policy for UP integrity protection.

[0088] Referring Figure 6 , a diagram of an exemplary method 600 for V2X security establishment for providing higher security during connection establishment in accordance with various aspects discussed herein is shown. Method 600 describes an example of how the various embodiments discussed herein establish security during connection establishment.

[0089] At 610, UE_1 5021 may send a Direct Communication Request (DCR) to UE_2 5022. The message may include Nonce_1 (for generating the session key K NRP-sess ), the UE_1 5021 security capabilities (the list of algorithms that UE_1 5021 will accept for the connection), the signaling security policy for UE_1 5021, and the 8 most significant bits of the K NRP-sess ID. These bits may be selected such that UE_1 5021 will be able to locally identify the security context created by method 600. If UE_1 5021 has an existing K NRP of the UE (UE_2 5022) it is attempting to communicate with, the DCR may also include the K NRP ID. The absence of the K NRP ID parameter may indicate that UE_1 5021 does not have the K NRP of UE_2 5021. The message may also include Key_Est_Info ("key establishment information", e.g., it may be a container including different data for each step of the key establishment process).

[0090] At 620, UE_2 5022 can accept (continue method 600) or reject (end method 600, e.g., send a direct security mode reject message) the direct communication request. For example, if the security capabilities of UE_1 5021 are NULL, or the signaling security policy of UE_1 5021 is OFF, while the security policy of UE_2 5022 is REQUIRED, then UE_2 5021 can reject the direct communication request. In the same or other embodiments, UE_2 5022 can accept or reject the direct communication request based on the decision strategy shown in Table 1 below.

[0091] Table 1: Exemplary UE_2 decision strategies for accepting / rejecting direct communication requests

[0092]

[0093] At 630, if UE_2 5022 can initiate a direct authentication and key establishment process with UE_1 5021. If UE_2 does not have the K NRP and K NRP ID pair indicated at 610, this can be mandatory and signaling can be exchanged to establish keys for a specific use case.

[0094] At 640, UE_2 5022 can send a direct security mode command message to UE_1 5021. If a new K NRP is to be generated, the message can include the nth MSB of K NRP ID (where n is an integer, e.g., it can be predefined (e.g., 8, etc.) or selected by UE_2 5022), and optionally include Key_Est_Info (see clause 5.3.3.1.3). UE_2 5022 can include Nonce_2 so that the session key can be calculated and the Chosen_algs ("chosen algorithms") parameter can be used to indicate which security algorithms UE will use to protect the data in the message. Chosen_algs can depend on the signaling security policy of UE_2 5022. For example, if the signaling security policy of UE_2 5022 has an integrity such as OFF or PREFERRED, they can only indicate the use of the NULL integrity algorithm. UE_2 5022 can also include its security capabilities and signaling security policy in the information for UE_1 5021 so that UE_1 5021 can make a decision based on the security policy and security capabilities of UE_2 5022. UE_2 5022 can also return the security capabilities and signaling security policy to UE_1 5021 to provide protection against downgrading attacks. UE_2 5022 can also include K NRP-sessThe m (where m is an integer, such as 8, etc.) least significant bits of the ID. These bits can be selected such that UE_2 5022 can locally identify the security context created by the process. UE_2 5022 can be derived from K NRP along with Nonce_1 and Nonce_2 to calculate K NRP-Sess , and then, based on the selected algorithm, confidentiality and integrity keys can be derived. Before sending the direct security mode command to UE_1 5021, UE_2 5022 can perform integrity protection on it. After sending the direct security mode command, UE_2 5022 is ready to receive signaling and user plane traffic protected by the new security context. UE_2 5022 can form K from the following NRP-sess ID: the most significant bits received in the direct communication request at 610; and the least significant bits sent in the direct security mode command.

[0095] At 650, after receiving the direct security mode command, UE_1 5021 can decide whether to reject the connection based on its local policy and the security policy and security capabilities of UE_25022. In various embodiments, UE_1 5021 can accept or reject the connection based on the decision-making policy shown in Table 2 below.

[0096] Table 2: Exemplary UE_1 decision strategies for accepting / rejecting connections

[0097]

[0098] UE_1 5021 can also check whether the LSB of the received K NPR-sess ID is unique, i.e., at 610, it has not been sent by another UE in response to the direct communication request. If the LSB of the K NPR-sess ID is not unique, then UE_1 5021 can respond with a direct security mode reject message including a cause value to indicate that the LSB of the K NPR-sess ID is not unique. The peer UE_2 5022 that receives the direct security mode reject message should check the cause value, and if the cause is related to session identifier uniqueness, then UE_2 5022 can generate a new LSB of the K NPR-sess ID, and reply to UE_1 5021 again (for example, method 600 can return to 640, where UE_2 5022 can send a new direct security mode command message with the new LSB of the K NPR-sess ID), and UE-2 5022 can erase the previous LSB of the K NPR-sess ID from its memory. When receiving this new direct security mode command, UE_1 5021 can process the messages starting from step 640. If the K NPR-sessIf the least significant bit of the ID is unique, UE_1 5021 can calculate K in the same manner as UE_2 5022. NRP-sess and confidentiality and integrity keys. UE_1 5021 can check whether the returned UE_1 5021 security capabilities and signaling security policies are the same as those sent at 610. UE_1 5021 can also check the integrity protection for the message. If its security policy for signaling indicates that integrity protection is OFF, UE_1 5021 only accepts the NULL integrity algorithm.

[0099] At 660, if all the checks in 650 pass, UE_1 5021 is ready to send and receive signaling and user plane traffic with the new security context. UE_1 5021 can send a directly secured mode complete message that is integrity protected and confidentiality protected (using the selected algorithm, which can be the null algorithm) to UE_2 5022. UE_1 5021 can form K from NRP-sess the ID: the most significant bits sent at 610 and the least significant bits received at 630.

[0100] At 670, UE_2 5022 can check the integrity protection for the directly secured mode complete message received at 660. If the check passes, UE_2 5022 can send user plane data and control signaling protected with the new security context. UE_2 5022 can also delete any old security context it has for UE_1 5021.

[0101] Referring Figure 7 , a flowchart of an exemplary method for facilitating V2X security policy negotiation between peer UEs that can be employed at an initiating UE in accordance with various embodiments discussed herein is shown. In other aspects, a machine-readable medium can store instructions associated with method 700 that, when executed, can cause a UE (e.g., employing system 400 UE ) to perform the actions of method 700.

[0102] At 710, an initiating UE (e.g., UE_1 5021) can transmit a direct communication request (DCR) to a peer UE (e.g., UE_2 5022), where the DCR can indicate the security capabilities of the initiating UE and the signaling security policy of the initiating UE.

[0103] At 720, in response to the peer UE accepting the request, a direct verification and key establishment process can be performed between the initiating UE and the peer UE. Alternatively, the peer UE can reject the connection (e.g., the initiating UE can receive a directly secured mode reject message that can indicate the reason), thus ending method 700.

[0104] At 730, a direct security mode command indicating the security capabilities and signaling security policies of the initiating UE, the security capabilities and signaling security policies of the peer UE, and the selected security algorithms (e.g., it can be empty) can be received.

[0105] At 740, based on the security policy for signaling integrity protection of the initiating UE, the selected algorithm, and the security capabilities and signaling security policies of the peer UE, it can be determined whether to accept or reject the connection.

[0106] At 750, in response to accepting the connection, a direct security mode complete message can be transmitted based on the new security context (e.g., at least partially based on the selected algorithm). Alternatively, in response to rejecting the connection, a direct security mode reject message indicating the reason can be transmitted.

[0107] At 760, user plane data and control signaling can be received from the peer UE, which can be protected by the new security context.

[0108] Additionally or alternatively, method 700 can include: when the UE acts as the initiating UE for V2X security establishment during connection establishment (e.g., UE_1 5021), one or more other actions as described in various embodiments of the UE and / or system 400 UE described herein.

[0109] Referring to Figure 8 , a flowchart of an exemplary method for facilitating V2X security policy negotiation between peer UEs that can be employed at a receiving UE according to various embodiments discussed herein is shown. In other aspects, a machine-readable medium can store instructions associated with method 800, which when executed can cause the UE (e.g., employing system 400 UE ) to perform the actions of method 800.

[0110] At 810, at a receiving UE (e.g., UE_2 5022), a direct communication request (DCR) can be received from a peer UE (e.g., UE_1 5021), where the DCR can indicate the security capabilities of the peer UE and the signaling integrity protection security policy of the peer UE.

[0111] At 820, based on the security capabilities and signaling security policies of the peer UE and the signaling security policy of the receiving UE, it can be determined whether to accept or reject the DCR.

[0112] At 830, in response to accepting the DCR, the selected security algorithm can be determined, and direct authentication and key establishment can be performed with the peer UE. Alternatively, in response to rejecting the connection (e.g., transmitting a direct security mode reject message indicating the reason to the peer UE), method 800 can end.

[0113] At 840, a direct security mode command may be sent, which may indicate the security capabilities and signaling security policies of the initiating (peer) UE, receive the security capabilities and signaling security policies of the UE, and the selected security algorithms (e.g., it may be empty).

[0114] At 850, in response to the peer UE accepting the connection, a direct security mode complete message may be received based on a new security context (e.g., at least partially based on the selected algorithm). Alternatively, the peer UE may reject the connection, and a direct security mode reject message indicating the reason may be received.

[0115] At 860, user plane data and control signaling may be sent to the peer UE, which may be protected by the new security context.

[0116] Additionally or alternatively, method 800 may include: when the UE acts as a receiving UE for V2X security establishment at connection establishment (e.g., UE_2 5022), one or more other actions described in various embodiments of the UE and / or system 400 UE as described herein.

[0117] Additional embodiments

[0118] Examples herein may include a subject matter such as a method, components for performing actions or blocks of the method, at least one machine-readable medium including executable instructions that, when executed by a machine (e.g., a processor with a memory, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc.), cause the machine to perform actions of a method or apparatus or system for concurrent communication using multiple communication technologies according to the described embodiments and examples.

[0119] Example 1 is an apparatus configured to be employed in a user equipment (UE), the apparatus including: one or more processors configured to: generate a direct communication request for a peer UE, where the direct communication request indicates the security capabilities of the UE and the signaling security policies of the UE; perform a direct authentication and key establishment process with the peer UE; process a direct security mode command from the peer UE, where the direct security mode command indicates the security capabilities of the UE, the signaling security policies of the UE, a selected set of algorithms for data protection, the security capabilities of the peer UE, and the signaling security policies of the peer UE; determine whether to accept the connection based at least on the signaling security policies of the UE, the security capabilities of the peer UE, and the signaling security policies of the peer UE; and in response to determining to accept the connection, generate a direct security mode complete message for the peer UE based at least on the selected set of algorithms.

[0120] Embodiment 2 includes the subject matter of any variation of any one of Embodiment 1, wherein the one or more processors are further configured to process one or more of user plane data or control signaling from a peer UE, wherein the one or more of user plane data or control signaling are at least based on a selected set of algorithms.

[0121] Embodiment 3 includes the subject matter of any variation of any one of Embodiments 1-2, wherein, when the selected set of algorithms includes a NULL integrity algorithm, the one or more processors are configured to determine to accept the connection only when the signaling security policy of the UE is OFF.

[0122] Embodiment 4 includes the subject matter of any variation of any one of Embodiments 1-2, wherein, when the selected set of algorithms includes a NULL integrity algorithm, the one or more processors are configured to determine to accept the connection at least when the signaling security policy of the UE is OFF, or when the signaling security policy of the UE is PREFERRED and for signaling integrity protection, the security capabilities of the peer UE include NULL.

[0123] Embodiment 5 includes the subject matter of any variation of any one of Embodiments 1-4, wherein, when the selected set of algorithms includes an integrity algorithm other than NULL, the one or more processors are configured to determine to accept the connection when the signaling security policy of the UE is REQUIRED or PREFERRED.

[0124] Embodiment 6 includes the subject matter of any variation of any one of Embodiments 1-5, wherein, in response to determining to reject the connection, the one or more processors are further configured to generate a direct security mode reject message for the peer UE.

[0125] Embodiment 7 is a UE that includes the subject matter of any variation of any one of Embodiments 1-6.

[0126] Embodiment 8 is a device configured to be employed in a user equipment (UE), the device comprising: one or more processors configured to: process a direct communication request from a peer UE, wherein the direct communication request indicates the security capabilities of the peer UE and the signaling security policy of the peer UE; determine whether to accept or reject the direct communication request based at least on the security capabilities of the peer UE, the signaling security policy of the peer UE, and the signaling security policy of the UE; and in response to determining to accept the direct communication request: perform a direct authentication and key establishment process with the peer UE; generate a direct security mode command for the peer UE, wherein the direct security mode command indicates the security capabilities of the UE, the signaling security policy of the UE, a selected set of algorithms for data protection, the security capabilities of the peer UE, and the signaling security policy of the peer UE; and process a direct security mode complete message from the peer UE based at least on the selected set of algorithms.

[0127] Embodiment 9 includes the subject matter of any variation of any one of Embodiments 8, wherein the one or more processors are further configured to generate one or more of user plane data or control signaling for the peer UE, wherein the one or more of user plane data or control signaling are based at least on the selected set of algorithms.

[0128] Embodiment 10 includes the subject matter of any variation of any one of Embodiments 8 - 9, wherein, when the signaling security policy of the UE is REQUIRED, the one or more processors are configured to determine to reject the request when the security capabilities of the peer UE include NULL for signaling integrity protection.

[0129] Embodiment 11 includes the subject matter of any variation of any one of Embodiments 8 - 10, wherein, when the signaling security policy of the UE is REQUIRED, the one or more processors are configured to determine to reject the request when the signaling security policy of the peer UE is OFF.

[0130] Embodiment 12 includes the subject matter of any variation of any one of Embodiments 8 - 11, wherein the one or more processors are configured to determine to accept the request unless the signaling security policy of the UE is REQUIRED and one or more of the security capabilities of the peer UE include NULL for signaling integrity protection, or the signaling security policy of the peer UE is OFF.

[0131] Embodiment 13 includes the subject matter of any variation of any one of Embodiments 8 - 12, wherein, in response to determining to reject the request, the one or more processors are further configured to generate a direct security mode reject message for the peer UE.

[0132] Embodiment 14 is a UE that includes the subject matter of any variation of any one of Embodiments 8 - 13.

[0133] Example 15 is a machine-readable medium including instructions that, when executed, cause a user equipment (UE) to: send a direct communication request to a peer UE, where the direct communication request indicates the security capabilities of the UE and the signaling security policy of the UE; perform a direct authentication and key establishment process with the peer UE; receive a direct security mode command from the peer UE, where the direct security mode command indicates the security capabilities of the UE, the signaling security policy of the UE, a selected set of algorithms for data protection, the security capabilities of the peer UE, and the signaling security policy of the peer UE; determine whether to accept the connection based at least on the signaling security policy of the UE, the security capabilities of the peer UE, and the signaling security policy of the peer UE; and in response to determining to accept the connection, send a direct security mode complete message to the peer UE based at least on the selected set of algorithms.

[0134] Example 16 includes the subject matter of any variation of any one of Examples 15, where when the selected set of algorithms includes the NULL integrity algorithm, the instructions, when executed, cause the UE to determine to accept the connection only if the signaling security policy of the UE is OFF.

[0135] Example 17 includes the subject matter of any variation of any one of Examples 15 - 16, where when the selected set of algorithms includes an integrity algorithm other than NULL, the instructions, when executed, cause the UE to determine to accept the connection when the signaling security policy of the UE is REQUIRED or PREFERRED.

[0136] Example 18 is a machine-readable medium including instructions that, when executed, cause a user equipment (UE) to: receive a direct communication request from a peer UE, where the direct communication request indicates the security capabilities of the peer UE and the signaling security policy of the peer UE; determine whether to accept or reject the direct communication request based at least on the security capabilities of the peer UE, the signaling security policy of the peer UE, and the signaling security policy of the UE; and in response to determining to accept the direct communication request: perform a direct authentication and key establishment process with the peer UE; send a direct security mode command to the peer UE, where the direct security mode command indicates the security capabilities of the UE, the signaling security policy of the UE, a selected set of algorithms for data protection, the security capabilities of the peer UE, and the signaling security policy of the peer UE; and receive a direct security mode complete message from the peer UE based at least on the selected set of algorithms.

[0137] Embodiment 19 includes the subject matter of any variation of any of Embodiment 18, wherein when the signaling security policy of the UE is REQUIRED, these instructions, when executed, cause the UE to reject the request when, for signaling integrity protection, one or more of the security capabilities of the peer UE include NULL, or when the signaling security policy of the peer UE is OFF.

[0138] Embodiment 20 includes the subject matter of any variation of any of Embodiments 18 - 19, wherein these instructions, when executed, cause the UE to determine to accept the request, unless the signaling security policy of the UE is REQUIRED and, for signaling integrity protection, one or more of the security capabilities of the peer UE include NULL, or the signaling security policy of the peer UE is OFF.

[0139] Embodiment 21 includes an apparatus that includes means for performing any of the operations described in Embodiments 1 - 20.

[0140] Embodiment 22 includes a machine - readable medium that stores instructions for execution by a processor to perform any of the operations described in Embodiments 1 - 20.

[0141] Embodiment 23 includes an apparatus that includes: a memory interface; and a processing circuit configured to perform any of the operations described in Embodiments 1 - 20.

[0142] The foregoing description of illustrative embodiments of the disclosed subject matter, which includes what is set forth in the Abstract of the Disclosure, is not intended to be exhaustive or to limit the disclosed embodiments to the precise forms disclosed. While specific embodiments and examples are described herein for illustrative purposes, various modifications can be contemplated within the scope of such embodiments and examples, as will be recognized by those of ordinary skill in the relevant art.

[0143] In this regard, while the disclosed subject matter of the present invention has been described in connection with various embodiments and the corresponding drawings, it should be understood that other similar embodiments may be used or modifications and additions may be made to the described embodiments to perform the same, similar, alternative, or substitute functions of the disclosed subject matter without departing from the described embodiments. Accordingly, the disclosed subject matter should not be limited to any single embodiment described herein, but should be construed in accordance with the breadth and scope of the following appended claims.

[0144] Particularly with respect to the various functions performed by the above-described components or structures (assemblies, devices, circuits, systems, etc.), unless otherwise specified, the terms used to describe such components (including references to "means") are intended to correspond to any component or structure that performs the specified function of the described component (e.g., functionally equivalent), even if not structurally equivalent to the disclosed structure that performs the function in the exemplary specific implementations shown herein. Additionally, although a particular feature has been disclosed with respect to only one of a plurality of specific implementations, for any given or particular application, such feature may be combined with one or more other features of one or more other specific implementations, which may be desirable and advantageous.

Claims

1. A baseband processor, the baseband processor being configured to perform operations including the following: Generate a direct communication request at a user equipment (UE) for a connection to a peer UE, wherein the direct communication request indicates the security capabilities of the UE and the signaling security policy of the UE; In response to the peer UE rejecting the direct communication request, receive an indication from the peer UE that the peer UE has rejected the direct communication request, wherein the peer UE rejects the direct communication request based on a comparison of at least one of the security policy of the peer UE and the signaling security policy or the security capabilities of the UE, wherein the security policy of the peer UE is one of REQUIRED, PREFERRED, or NOT NEEDED, and wherein the signaling security policy of the UE is one of REQUIRED, PREFERRED, or NOT NEEDED; And In response to the peer UE accepting the direct communication request: Process a direct security mode command from the peer UE, wherein the direct security mode command indicates the security capabilities of the UE, the signaling security policy of the UE, and a selected set of algorithms for data protection; Determine whether to accept the connection based at least on the signaling security policy of the UE; And In response to determining to accept the connection, generate a direct security mode complete message for the peer UE based at least on the selected set of algorithms.

2. The baseband processor according to claim 1, wherein the operations further include processing one or more of user plane data or control signaling from the peer UE, wherein the one or more of user plane data or control signaling are based at least on the selected set of algorithms.

3. The baseband processor according to claim 1, wherein When the selected set of algorithms includes a NULL integrity algorithm, determine to accept the connection only when the signaling security policy of the UE is NOT NEEDED.

4. The baseband processor according to claim 1, wherein, When the selected set of algorithms includes a NULL integrity algorithm, determine to accept the connection at least when the signaling security policy of the UE is NOT NEEDED, or when the signaling security policy of the UE is PREFERRED and for signaling integrity protection, the security capabilities of the peer UE include NULL.

5. The baseband processor according to claim 1, wherein, When the selected set of algorithms includes an integrity algorithm other than NULL, determine to accept the connection when the signaling security policy of the UE is REQUIRED or PREFERRED.

6. The baseband processor according to claim 1, wherein The operations further include generating a direct security mode reject message for the peer UE in response to determining to reject the connection.

7. The baseband processor according to claim 1, wherein when the signaling security policy of the UE is NOT NEEDED and the security policy of the peer UE is REQUIRED, receive the indication at the UE.

8. The baseband processor according to claim 1, wherein the direct security mode command further indicates the security capabilities of the peer UE and the security policy of the peer UE, and further determine whether to accept the connection based on the security capabilities of the peer UE and the security policy of the peer UE.

9. A UE, the UE including the baseband processor according to claim 1.

10. A baseband processor, the baseband processor being configured to perform operations including the following: Process a direct communication request from a peer UE at a user equipment (UE), wherein the direct communication request indicates the security capabilities of the peer UE and the signaling security policy of the peer UE; Determine whether to accept the direct communication request based on a comparison of at least one of the security capabilities of the peer UE or the signaling security policy of the peer UE with the security policy of the UE, where the signaling security policy of the peer UE is one of REQUIRED, PREFERRED, or NOT NEEDED, and where the security policy of the UE is one of REQUIRED, PREFERRED, or NOT NEEDED; And In response to determining to accept the direct communication request: Generate a direct security mode command for the peer UE, where the direct security mode command indicates a selected set of algorithms for data protection, the security capabilities of the peer UE, and the signaling security policy of the peer UE; And Process a direct security mode complete message from the peer UE based at least on the selected set of algorithms.

11. The baseband processor according to claim 10, wherein the operation further includes generating one or more of user plane data or control signaling for the peer UE, where the one or more of the user plane data or control signaling are at least based on the selected set of algorithms.

12. The baseband processor according to claim 10, wherein, When the security policy of the UE is REQUIRED, when the security capabilities of the peer UE include NULL for signaling integrity protection, determine to reject the direct communication request.

13. The baseband processor according to claim 10, wherein, When the security policy of the UE is REQUIRED, when the signaling security policy of the peer UE is NOT NEEDED, determine to reject the direct communication request.

14. The baseband processor according to claim 10, wherein the direct communication request is accepted unless the security policy of the UE is REQUIRED and one or more of the security capabilities of the peer UE include NULL for signaling integrity protection, or the signaling security policy of the peer UE is NOT NEEDED.

15. The baseband processor according to claim 10, wherein, The operation further includes generating an indication that the UE rejects the direct communication request for the peer UE in response to determining to reject the direct communication request.

16. The baseband processor according to claim 10, wherein the direct security mode command further indicates the security capabilities of the UE and the security policy of the UE.

17. A UE, the UE includes the baseband processor according to claim 10.

18. A machine-readable medium including instructions that, when executed, cause a user equipment UE to perform operations including the following: Send a direct communication request for a connection to a peer UE, where the direct communication request indicates the security capabilities of the UE and the signaling security policy of the UE; In response to the peer UE rejecting the direct communication request, receive an indication from the peer UE that the peer UE has rejected the direct communication request, wherein the peer UE rejects the direct communication request based on a comparison of at least one of the security policy of the peer UE and the signaling security policy or the security capabilities of the UE, wherein the security policy of the peer UE is one of REQUIRED, PREFERRED, or NOT NEEDED, and wherein the signaling security policy of the UE is one of REQUIRED, PREFERRED, or NOT NEEDED; And In response to the peer UE accepting the direct communication request: Receive a direct security mode command from the peer UE, where the direct security mode command indicates the security capabilities of the UE, the signaling security policy of the UE, and a selected set of algorithms for data protection; Determine whether to accept the connection based at least on the signaling security policy of the UE; and In response to determining to accept the connection, send a direct security mode complete message for the peer UE based at least on the selected algorithm set.

19. The machine-readable medium according to claim 18, wherein, When the selected algorithm set includes the NULL integrity algorithm, determine to accept the connection only if the signaling security policy of the UE is NOT NEEDED.

20. The machine-readable medium according to claim 18, wherein, When the selected algorithm set includes an integrity algorithm other than NULL, determine to accept the connection when the signaling security policy of the UE is REQUIRED or PREFERRED.

Images