Ue discovery message protection method, apparatus, communication device, and storage medium

Abstract

This disclosure provides a UE discovery message protection method, apparatus, communication device, and storage medium. The UE discovery message protection method is executed by a first UE and includes: sending a first announcement message when the first UE is outside the network coverage area, wherein the first announcement message includes: a discovery message encrypted based on a discovery key, and an LTK identifier information ID indicating an LTK; wherein the discovery key is determined based on the LTK received when the first UE is within the network coverage area; the LTK ID is used for a second UE to determine a key request to request a discovery key or to request an intermediate key to generate a discovery key.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the field of communication technology, and in particular to a UE discovery message protection method, apparatus, communication device, and storage medium. Background Technology

[0002] In wireless communication systems, such as 5G systems, some user equipment (UEs) are within 5G network coverage, while others are outside. Ranging services can be supported regardless of whether the UE is within 5G coverage.

[0003] Before ranging a target UE, the observer UE needs to use the ranging discovery message to detect and identify nearby target UEs. For a Type B restricted ranging discovery process, the discoverer UE announces a discovery message on the Direct Communication (PC5) interface, which may contain information about the discovery of interest. The receiving discoverer UE can respond using some information related to the discovery message sent by the discoverer UE. In a Type B restricted ranging discovery process without privacy protection mechanisms, the discovery message contains the privacy of the UEs participating in the ranging process. In 5G network communications, discovery messages can be protected when all ranging-enabled UEs are covered by 5G by providing a discovery key with an expiration date to the ranging-enabled UE.

[0004] However, in some 5G coverage scenarios, when a UE with ranging enabled has an expired discovery key and is not covered by the 5G network, the discovery message cannot be protected; this will make the discovery key vulnerable to leakage and reduce the user experience. Summary of the Invention

[0005] This disclosure provides a UE discovery message protection method, apparatus, communication device, and storage medium.

[0006] According to a first aspect of this disclosure, a UE discovery message protection method is provided, executed by a first UE, comprising:

[0007] When the first UE is outside the network coverage area, a first announcement message is sent, wherein the first announcement message includes: a discovery message encrypted based on the discovery key, and LTK identification information (ID) indicating the long-term key (LTK);

[0008] The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine the key request to request the discovery key or to request the intermediate key (KD) for generating the discovery key.

[0009] According to a second aspect of this disclosure, a UE discovery message protection method is provided, executed by a second UE, comprising:

[0010] Based on the first announcement message being detected, a key request is sent to the Ranging Key Management Function (RKMF) network element; wherein, the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0011] The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes: LTK ID; the key request is used to request the discovery key or to request the KD that generates the discovery key.

[0012] According to a third aspect of this disclosure, a UE discovery message protection method is provided, executed by RKMF, comprising:

[0013] The system receives a key request sent by a second UE, wherein the key request is sent by the second UE after it has detected a first announcement message; wherein the first announcement message is sent by the first UE when it is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on a discovery key, and an LTK ID indicating the LTK; wherein the discovery key is determined by the first UE based on the LTK received when it is within the network coverage area; the key request includes: the LTK ID;

[0014] Based on the key request, determine the discovery key corresponding to the LTK ID or generate the KD for the discovery key.

[0015] According to a fourth aspect of this disclosure, a UE discovery message protection device is provided, applied to a first UE, comprising:

[0016] The first sending module is configured to send a first announcement message when the first UE is outside the network coverage area, wherein the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0017] The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine the key request to request the discovery key or to request the generation of the discovery key.

[0018] According to a fifth aspect of this disclosure, a UE discovery message protection device is provided, applied to a second UE, comprising:

[0019] The second sending module is configured to send a key request to the RKMF based on the first announcement message being detected; wherein the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0020] The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes: LTK ID; the key request is used to request the discovery key or to request the KD that generates the discovery key.

[0021] According to a sixth aspect of this disclosure, a UE discovery message protection device is provided, applied to RKMF, comprising:

[0022] The third receiving module is configured to receive a key request sent by the second UE, wherein the key request is sent by the second UE after it has detected the first announcement message; wherein the first announcement message is sent by the first UE when it is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK; wherein the discovery key is determined by the first UE based on the LTK received when it is within the network coverage area; the key request includes: the LTK ID;

[0023] The third processing module is configured to determine the discovery key corresponding to the LTK ID or generate the discovery key KD based on the key request.

[0024] According to a seventh aspect of this disclosure, a communication device is provided, comprising:

[0025] processor;

[0026] Memory used to store processor-executable instructions;

[0027] The processor is configured to implement the UE discovery message protection method of any embodiment of this disclosure when running executable instructions.

[0028] According to an eighth aspect of this disclosure, a computer storage medium is provided that stores a computer-executable program, which, when executed by a processor, implements the UE discovery message protection method of any embodiment of this disclosure.

[0029] The technical solutions provided in this disclosure may have the following beneficial effects:

[0030] In this embodiment, a first announcement message can be sent by a first UE when it is outside network coverage. The first announcement message includes a discovery message encrypted based on a discovery key and an LTK ID indicating the LTK. This allows the first UE to still announce the first announcement message even when it is outside network coverage. The discovery key is determined based on the LTK received when the first UE is within network coverage. The LTK ID is used by a second UE to determine a key request to request the discovery key or to request a key to generate the discovery key. This allows the second UE to obtain the discovery key or the key to generate the discovery key, enabling UEs within network coverage to decrypt the discovery message based on the discovery key or the key to generate the discovery key. Thus, this embodiment allows a second UE within network coverage to receive encrypted discovery messages from a first UE outside network coverage, achieving protection for the discovery message. This provides protection for discovery messages in partial network coverage scenarios (e.g., partial 5G network coverage scenarios), thereby improving user experience.

[0031] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the structure of a wireless communication system.

[0033] Figure 2 This is a schematic diagram illustrating a position determination according to an exemplary embodiment.

[0034] Figure 3 This is a schematic diagram illustrating network coverage according to an exemplary embodiment.

[0035] Figure 4 This is a schematic diagram illustrating network coverage according to an exemplary embodiment.

[0036] Figure 5 This is a schematic diagram illustrating network coverage according to an exemplary embodiment.

[0037] Figure 6 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0038] Figure 7 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0039] Figure 8 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0040] Figure 9 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0041] Figure 10 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0042] Figure 11 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0043] Figure 12 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0044] Figure 13 This is a flowchart illustrating a UE discovery message protection method according to an exemplary embodiment.

[0045] Figure 14 This is a block diagram illustrating a UE discovery message protection device according to an exemplary embodiment.

[0046] Figure 15 This is a block diagram illustrating a UE discovery message protection device according to an exemplary embodiment.

[0047] Figure 16 This is a block diagram illustrating a UE discovery message protection device according to an exemplary embodiment.

[0048] Figure 17 This is a block diagram illustrating a UE according to an exemplary embodiment.

[0049] Figure 18 This is a block diagram illustrating a base station according to an exemplary embodiment. Detailed Implementation

[0050] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of those embodiments.

[0051] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the embodiments of this disclosure. The singular forms “a” and “the” as used in this disclosure are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0052] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of embodiments of this disclosure, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0053] Please refer to Figure 1 This illustration shows a schematic diagram of the structure of a wireless communication system provided in an embodiment of this disclosure. Figure 1 As shown, the wireless communication system is a communication system based on cellular mobile communication technology. The wireless communication system may include: several user equipment 110 and several base stations 120.

[0054] User equipment 110 can be a device that provides voice and / or data connectivity to a user. User equipment 110 can communicate with one or more core networks via a Radio Access Network (RAN). User equipment 110 can be an Internet of Things (IoT) user equipment, such as sensor devices, mobile phones (or "cellular" phones), and computers with IoT user equipment capabilities. For example, it can be a fixed, portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted device. Examples include a station (STA), subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, remote terminal, access terminal, user terminal, user agent, user device, or user equipment. Alternatively, user equipment 110 can also be a device from an unmanned aerial vehicle (UAV). Alternatively, user equipment 110 can also be a vehicle-mounted device, such as a vehicle computer with wireless communication capabilities, or a wireless user equipment connected to an external vehicle computer. Alternatively, user equipment 110 can also be a roadside device, such as a street light, traffic light, or other roadside device with wireless communication capabilities.

[0055] Base station 120 can be a network-side device in a wireless communication system. This wireless communication system can be a 4G system (also known as Long Term Evolution, LTE); or it can be a 5G system (also known as a New Radio, 5G NR, or 5G NR system). Alternatively, it can be the next generation after 5G. In this case, the access network in the 5G system can be called a New Generation-Radio Access Network (NG-RAN).

[0056] The base station 120 can be an evolved NB (eNB) used in a 4G system. Alternatively, the base station 120 can also be a gNB (gNB) using a centralized-distributed architecture in a 5G system. When the base station 120 adopts a centralized-distributed architecture, it typically includes a central unit (CU) and at least two distributed units (DUs). The central unit is equipped with a protocol stack of the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control (RLC) layer, and the Medium Access Control (MAC) layer; the distributed units are equipped with a physical (PHY) layer protocol stack. This disclosure does not limit the specific implementation of the base station 120.

[0057] Base station 120 and user equipment 110 can establish a wireless connection via a wireless air interface. In different implementations, the wireless air interface is a wireless air interface based on the fourth-generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth-generation mobile communication network technology (5G) standard, such as a new air interface; or, the wireless air interface can also be a wireless air interface based on a next-generation mobile communication network technology standard based on 5G.

[0058] In some embodiments, user equipment 110 can also establish E2E (End to End) connections. Examples include vehicle-to-vehicle (V2V) communication, vehicle-to-infrastructure (V2I) communication, and vehicle-to-pedestrian (V2P) communication in vehicle-to-everything (V2X) communication.

[0059] Here, the user equipment mentioned above can be considered as the terminal equipment in the following embodiments.

[0060] In some embodiments, the wireless communication system described above may further include a network management device 130.

[0061] Several base stations 120 are connected to network management device 130. Network management device 130 can be a core network device in a wireless communication system, such as a Mobility Management Entity (MME) in an Evolved Packet Core (EPC). Alternatively, it can be other core network devices, such as a Serving Gateway (SGW), a Public Data Network Gateway (PGW), a Policy and Charging Rules Function (PCRF), or a Home Subscriber Server (HSS). The implementation of network management device 130 is not limited in this embodiment.

[0062] To facilitate understanding by those skilled in the art, this disclosure provides multiple embodiments to clearly illustrate the technical solutions of the embodiments of this disclosure. Of course, those skilled in the art will understand that the multiple embodiments provided in this disclosure can be executed individually, or in combination with the methods of other embodiments in this disclosure, or individually or in combination with some methods in other related technologies; this disclosure does not limit these aspects.

[0063] To better understand the technical solutions described in any embodiment of this disclosure, the positioning in the related art will first be explained:

[0064] In one embodiment, ranging service refers to determining at least one of the following information via a direct communication connection: the distance between two UEs; the direction from one UE to another.

[0065] In one embodiment, such as Figure 2As shown, the observer UE has a reference plane and a reference direction. The direction from the target UE to the observer UE is the angle between the line connecting the observer UE and the target UE and the reference direction. This angle is represented by the azimuth direction and / or elevation direction. The azimuth direction of the target UE is the angle formed by the reference direction and the projection of the line from the observer UE to the target UE onto a plane perpendicular to the zenith. The elevation direction of the target UE is the angle between the two in the vertical direction (above the horizontal plane).

[0066] In one embodiment, ranging services can be supported regardless of whether the location is within 5G network coverage. For example... Figure 3 The diagram shows the coverage of the 5G network; both UE1 and UE2 are within the 5G network coverage area. Figure 4 A partial illustration of 5G network coverage is provided; UE1 is within the 5G network coverage area and UE2 is outside the 5G network coverage area. Figure 5 An illustration is provided showing an area without 5G network coverage; neither UE1 nor UE2 is within 5G network coverage. In one embodiment, if a licensed band is used for ranging, it can be entirely controlled by the operator.

[0067] like Figure 6 As shown in the embodiments of this disclosure, a UE discovery message protection method is provided, executed by a first UE, including:

[0068] Step S61: When the first UE is outside the network coverage area, send a first announcement message, wherein the first announcement message includes: a discovery message encrypted based on the discovery key, and LTK identification information (ID) indicating the long-term key (LTK);

[0069] The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine the key request to request the discovery key or to request the intermediate key (KD) for generating the discovery key.

[0070] In one embodiment, the first UE and the second UE can be, but are not limited to, various mobile terminals or fixed terminals; for example, the first UE and the second UE can be, but are not limited to, mobile phones, computers, servers, wearable devices, game control platforms, or multimedia devices. In all embodiments of this disclosure, the first UE can be a declaring UE, which can be an observer UE or a discoverer UE; the second UE can be a listening UE, which can be an observer UE or a discoverer UE. Alternatively, the first UE can be a listening UE, which can be an observer UE or a discoverer UE; the second UE can be a declaring UE, which can be an observer UE or a discoverer UE. In all embodiments of this disclosure, when the first UE sends a first declaring message, the second UE listens to the first declaring message; when the second UE sends a second declaring message, the first UE listens to the second declaring message. The first UE and the second UE can be each other's listening UE or sending UE, and the first UE and the second UE can both be discoverer UEs or observer UEs.

[0071] In one embodiment, the first UE is located outside the network coverage area, and the second UE is located within the network coverage area. In another embodiment, the first UE is located outside the network coverage area, and the second UE is located within the network coverage area; and the second UE is a UE located near the first UE.

[0072] In one embodiment, network coverage can refer to the coverage of various networks; for example, network coverage can be, but is not limited to, 4G network coverage, 5G network coverage, or other evolved network coverage. For instance, when the first UE is outside the 5G network coverage area, it sends a first announcement message.

[0073] Sending the first announcement message in step S61 includes: sending the first announcement message based on the direct communication (PC5) interface.

[0074] This disclosure provides a UE discovery message protection method, executed by a first UE, including: when the first UE is outside the network coverage area, sending a first announcement message on the PC5 interface.

[0075] Here, the first UE and the second UE can communicate using the PC5 interface regardless of whether they are within network coverage. For example, if the first UE is outside network coverage and the second UE is within network coverage, they can communicate using the PC5 interface.

[0076] The first announcement includes, but is not limited to, at least one of the following:

[0077] Discovery messages encrypted using the discovery key;

[0078] Indicates the LTK ID of the LTK;

[0079] Security algorithm identifier, used to identify the security algorithm used in the first announcement message;

[0080] Distance lookup code used to identify the first announcement message;

[0081] A random number, used together with the LTK to determine the discovery key;

[0082] A timestamp is used to indicate the validity period of the discovery key.

[0083] Here, the random number can also be used together with the discovery key to decrypt the discovery message.

[0084] In one embodiment, the security algorithm can be any encryption algorithm, and there is no limitation herein.

[0085] In one embodiment, the ranging query code can be used to identify the target UE indicated in the first announcement message. For example, different first announcement messages may correspond to different ranging query codes; the target ranging layer ID in the different first announcement messages may be the same or different.

[0086] In one embodiment, if the ranging query code is located in the encrypted discovery message, the ranging query code can be used to indicate the target UE that needs to be ranging; or, if the ranging query code is included in the first announcement message but not included in the encrypted discovery message, the ranging query code can be used to indicate the first announcement message.

[0087] The discovery message includes, but is not limited to, at least one of the following:

[0088] A timestamp is used to indicate the validity period of the discovery key;

[0089] Target ranging layer identification information (ID) is used to indicate the target UE that needs to be ranged;

[0090] Distance measurement requirement information, used to indicate the distance measurement requirements.

[0091] In one embodiment, the timestamp can be included in the discovery message of the first announcement message. Therefore, the timestamp needs to be decrypted to obtain the discovery message.

[0092] In another embodiment, the timestamp is included in the first announcement message but not in the discovery message. This allows the timestamp to be obtained simply by verifying the integrity of the first announcement message, which is beneficial for detecting replay attacks on the first announcement message without decrypting the discovery message.

[0093] Here, the first UE can determine the target UE that needs to be ranged before moving out of the network coverage area.

[0094] The discovery key includes at least one of the following:

[0095] The Ranging Encryption Key (REK) is used to encrypt discovery messages;

[0096] The Ranging Integrity Key (RIK) is used to protect the integrity of the first announcement message.

[0097] Here, the discovery message includes sensitive information. This sensitive information is at least a portion of the discovery message. For example, the discovery message may include the target ranging layer ID and ranging requirement information; the sensitive information could be the ranging time within the ranging requirement information.

[0098] In one embodiment, REK can be used to encrypt sensitive information in discovery messages.

[0099] For example, if the sensitive information is part of the discovery message, such as the discovery message including the target ranging layer ID and ranging requirement information, the sensitive information could be the ranging time in the ranging requirement information; then REK can be used to encrypt the ranging time, but not to encrypt other information in the ranging requirement information other than the ranging time or the target ranging layer ID.

[0100] For example, if the sensitive information is all the information in the discovery message, the PEK can be used to encrypt the entire discovery message.

[0101] In one embodiment, the discovery message encrypted based on the discovery key in step S61 can be: a discovery message encrypted based on REK in the discovery key.

[0102] In one embodiment, the discovery message is encrypted using REK and the integrity of the first announcement message is protected using RIK, i.e., the first announcement message is protected based on the discovery key. For example, the first UE uses REK to encrypt the discovery message in the first announcement message, for example, encrypting at least one of the ranging requirement information, target ranging layer ID, timestamp, and ranging query code; the first UE uses RIK to protect the integrity of at least one of the security algorithm identifier, the encrypted discovery message, and a random number to form the first announcement message; the first UE announces the first announcement message on the PC5 interface.

[0103] In this embodiment, a first announcement message can be sent by a first UE when it is outside network coverage. The first announcement message includes a discovery message encrypted based on a discovery key and an LTK ID indicating the LTK. This allows the first UE to still announce the first announcement message even when it is outside network coverage. The discovery key is determined based on the LTK received when the first UE is within network coverage. The LTK ID is used by a second UE to determine a key request to request the discovery key or to request a key to generate the discovery key. This allows the second UE to obtain the discovery key or the key to generate the discovery key, enabling UEs within network coverage to decrypt the discovery message based on the discovery key or the key to generate the discovery key. Thus, this embodiment allows a second UE within network coverage to receive encrypted discovery messages from a first UE outside network coverage, achieving protection for the discovery message. This provides protection for discovery messages in partial network coverage scenarios (e.g., partial 5G network coverage scenarios), thereby improving user experience.

[0104] This disclosure provides a UE discovery message protection method, executed by a first UE, including:

[0105] The system receives a second announcement message sent by a second UE, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

[0106] In some embodiments, the second announcement message is sent by the second UE based on the ranging query code in the first announcement message matching the ranging query filter.

[0107] The second announcement message is: a second announcement message based on discovery key protection. Here, the protection includes integrity protection and / or confidentiality protection; the confidentiality protection portion is customized by the first UE.

[0108] In one embodiment, the second announcement message protected based on the discovery key includes: encrypting sensitive information in the second announcement message based on REK in the discovery key, and / or protecting the integrity of the second announcement message based on RIK in the discovery key.

[0109] The receiving of the second announcement message sent by the second UE includes: receiving the second announcement message sent by the second UE on the PC5 interface.

[0110] The receiving of the second announcement message sent by the second UE includes: receiving the second announcement message sent by the second UE based on the ranging response filter.

[0111] The second announcement message can be referred to in other embodiments of this disclosure, and will not be repeated here.

[0112] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0113] In some embodiments, before sending the first announcement message, the following is included:

[0114] Send an LTK request carrying the identifier of the first UE to the Ranging Key Management Function (RKMF);

[0115] Receive the LTK and LTK ID returned by RKMF based on the LTK request.

[0116] like Figure 7 As shown, this disclosure provides a UE discovery message protection method, executed by a first UE, including:

[0117] Step S71: Send an LTK request carrying the identifier of the first UE to RKMF;

[0118] Step S72: Receive the LTK and LTK ID returned by RKMF based on the LTK request.

[0119] The RKMF can be, but is not limited to, a physical device or a function performed by a physical device, and is not limited thereto. In one embodiment, the RKMF is located within the network coverage area.

[0120] The LTK request carries the identifier of the first UE; the LTK request is used to request the LTK of the first UE and / or the LTK ID corresponding to the LTK.

[0121] Step S71 can be: when the first UE is within network coverage, send an LTK request carrying the identifier of the first UE to RKMF;

[0122] Step S72 may be, when the first UE is within network coverage, receiving the LTK and LTK ID sent by RKMF based on the LTK request.

[0123] Thus, in this embodiment of the disclosure, when the first UE is within the network coverage area, it can obtain the LTK from the RKMF within the network coverage area; this facilitates the subsequent generation of a new discovery key based on the LTK to encrypt the discovery message.

[0124] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: determining a discovery key based on LTK. The discovery key includes REK and / or RIK.

[0125] In one embodiment, determining the discovery key KD based on LTK includes: determining KD based on LTK; determining a temporary key (KD-SESS) based on KD; and determining REK and / or RIK in the discovery key based on KD-SESS.

[0126] In one embodiment, determining KD based on LTK includes: determining KD based on LTK and a random number;

[0127] KD-based temporary key determination (KD-SESS) includes: determining KD-SESS based on KD and random numbers;

[0128] Based on KD-SESS, determine REK and / or RIK in the discovery key, including: determining REK and / or RIK in the discovery key based on KD-SESS and random numbers.

[0129] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: determining KD based on LTK. For example, the first UE determines KD based on LTK and a random number.

[0130] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: determining an intermediate key based on LTK; determining KD based on LTK; determining KD-SESS based on KD; and determining REK and / or RIK in the discovery key based on KD-SESS. For example, the first UE determines KD based on LTK and a random number; determines KD-SESS based on KD and a random number; and determines REK and / or RIK based on KD-SESS and a random number.

[0131] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: encrypting the discovery message based on REK; and / or, performing integrity protection on a first announcement message based on RIK. Here, encrypting the discovery message based on REK includes: encrypting the discovery message based on a security algorithm indicated by REK and a security algorithm identifier.

[0132] Thus, in this embodiment of the disclosure, the first UE can generate a discovery key including REK and / or RIK based on the LTK obtained from RKMF; thereby enabling the first UE to encrypt the discovery message based on REK and / or perform integrity protection on the first announcement message including the discovery message based on RIK, reducing the risk of the first announcement message being leaked.

[0133] The discovery key is determined based on LTK, including: if the available key sent by the network device is invalid, the discovery key is determined based on LTK.

[0134] In the embodiments disclosed herein, any method that causes the available key to become invalid is acceptable; for example, the invalidation of the available key may be, but is not limited to, the expiration of the validity period of the available key.

[0135] Here, network equipment can refer to access network equipment or core network equipment. For example, network equipment could be a base station or an RKMF (Remote Knocked Down Module).

[0136] Here, the available key refers to the key received by the first UE within the network coverage area.

[0137] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: determining a discovery key based on LTK after an available key sent by a network device has expired.

[0138] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: determining a discovery key based on LTK after an available key sent by a network device has expired.

[0139] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: when the first UE is located outside the network coverage area and the available key sent by the network device is invalid, determining a discovery key based on LTK.

[0140] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: when the first UE is located outside the network coverage area and the validity period of the available key sent by the network device has expired, determining a discovery key based on LTK.

[0141] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0142] like Figure 8 As shown, this disclosure provides a UE discovery message protection method, executed by a first UE, including:

[0143] Step S81: Receive a second announcement message sent by the second UE, wherein the second announcement message carries a ranging response code corresponding to the ranging query code.

[0144] The ranging response code can be used to indicate that the second UE has received the first announcement message. In one possible implementation, the first announcement message can be the first announcement message as in other embodiments of this disclosure, or it can be other types of first announcement messages; this disclosure does not limit this type of message.

[0145] The second announcement message is: a second announcement message based on discovery key protection. Here, the protection includes integrity protection and / or confidentiality protection; the confidentiality protection portion is customized by the first UE.

[0146] In one embodiment, the second announcement message protected based on the discovery key includes: encrypting sensitive information in the second announcement message based on REK in the discovery key, and / or performing integrity protection on the second announcement message based on RIK in the discovery key. Here, the second announcement message protected based on the discovery key is also: the second announcement message encrypted based on the discovery key.

[0147] This disclosure provides a UE discovery message protection method, executed by a first UE, including: performing integrity verification and / or decryption of a second announcement message based on a discovery key. Here, performing integrity verification and / or decryption of the second announcement message based on the discovery key includes: verifying the integrity of the second announcement message based on the RIK in the discovery key; and / or decrypting sensitive information in the second announcement message based on the REK in the discovery key.

[0148] Step S81 includes: listening to the second announcement message sent by the second UE on the PC5 interface, wherein the second announcement message carries a ranging response code corresponding to the ranging query code.

[0149] This disclosure provides a UE discovery message protection method, executed by a first UE, which may include: listening for a second announcement message sent by a second UE on the PC5 interface. Here, the first UE is located outside the network coverage area.

[0150] The first UE is configured with a ranging response filter, which is used to match ranging response codes.

[0151] This disclosure provides a UE discovery message protection method, executed by a first UE, including: receiving a second announcement message sent by a second UE based on a ranging response filter.

[0152] For example, the first UE uses a locally configured ranging response filter to listen for the second announcement message sent by the second UE on the PC5 interface in order to obtain the second announcement message corresponding to the ranging response code that matches the ranging response filter.

[0153] Thus, in this embodiment of the disclosure, the first UE can also receive a second announcement message sent by the second UE, the second announcement message carrying a ranging response code corresponding to the ranging query code; this allows the first UE to accurately know whether the second UE has received the first announcement message.

[0154] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0155] The following UE discovery message protection method is executed by a second UE and is similar to the UE discovery message protection method executed by the first UE described above. For technical details not disclosed in the embodiment of the UE discovery message protection method executed by the second UE, please refer to the description of the example of the UE discovery message protection method executed by the first UE, which will not be described in detail here.

[0156] like Figure 9 As shown, this disclosure provides a UE discovery message protection method, executed by a second UE, including:

[0157] Step S91: Based on the first announcement message being detected, a key request is sent to the RKMF; wherein, the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0158] The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes: LTK ID; the key request is used to request the discovery key or to request the KD that generates the discovery key.

[0159] This key request is used to request the discovery key determined by the LTK corresponding to the LTK ID, or to request the KD that generates the discovery key.

[0160] In some embodiments of this disclosure, the first announcement message is the first announcement message in step S61; the discovery message and the discovery key are the discovery message and the discovery key in step S61, respectively; the LTK ID is the LTK ID in step S61; and the KD is the KD in step S61.

[0161] For example, the first announcement includes, but is not limited to, at least one of the following:

[0162] Discovery messages encrypted using the discovery key;

[0163] Indicates the LTK ID of the LTK;

[0164] Security algorithm identifier, used to identify the security algorithm used in the first announcement message;

[0165] Distance lookup code used to identify the first announcement message;

[0166] A random number, used together with the LTK to determine the discovery key;

[0167] A timestamp is used to indicate the expiration date of the discovery key.

[0168] This random number can also be used together with the discovery key to decrypt the discovery message.

[0169] For example, the discovery message includes, but is not limited to, at least one of the following:

[0170] A timestamp is used to indicate the validity period of the discovery key;

[0171] Target ranging layer ID is used to indicate the target UE that needs to be ranged;

[0172] Distance measurement requirement information, used to indicate the distance measurement requirements.

[0173] For example, the discovery key includes at least one of the following:

[0174] REK is used to encrypt discovery messages;

[0175] RIK is used to protect the integrity of the first announcement message.

[0176] In one embodiment, REK is used to encrypt sensitive information in the discovery message.

[0177] The first announcement message is detected in step S91, including: listening for the first announcement message on the PC5 interface.

[0178] This disclosure provides a UE discovery message protection method, executed by a second UE, which may include: listening for a first announcement message on the PC5 interface; and sending a key request to RKMF based on the first announcement message being listened to on the PC5 interface.

[0179] For example, when the second UE is within the network coverage area, it listens for the first announcement message sent by the first UE located outside the network coverage area on the PC5 interface; if the first announcement message is heard, it sends a key request to RKMF.

[0180] Thus, in this embodiment, after receiving the first announcement message, the second UE can request a discovery key determined by the LTK corresponding to the LTK ID or generate a discovery key (KD) based on the LTK ID in the first announcement message. This allows the second UE within network coverage to receive the first announcement message carrying the discovery message sent by the first UE outside network coverage, and to decrypt the discovery message based on the obtained discovery key or the discovery key generated based on the KD. Therefore, this embodiment allows the second UE within network coverage to receive the discovery message sent by the first UE outside network coverage while still protecting the discovery message; that is, it can protect the discovery message in partial network coverage scenarios, improving user experience.

[0181] The first announcement message is detected in step S91, which includes: listening to the first announcement message based on the discovery response sent by RKMF; wherein the discovery response is used to indicate that the second UE has the right to listen to the first announcement message.

[0182] This disclosure provides a UE discovery message protection method, executed by a second UE, including:

[0183] The system receives a first announcement message, wherein the first announcement message is sent when the first UE is outside the network coverage area, and the first announcement message includes: a discovery message encrypted based on a discovery key, and an LTK ID indicating an LTK; wherein the discovery key is determined based on the LTK received when the first UE is within the network coverage area; the LTK ID is used by the second UE to determine a key request to request the discovery key or to request a KD for generating the discovery key.

[0184] Here, the descriptions of other embodiments of this disclosure can be referenced in the first announcement message, and will not be repeated here.

[0185] like Figure 10 As shown, this disclosure provides a UE discovery message protection method, executed by a second UE, including:

[0186] Step S101: Based on the discovery response received from RKMF, listen for the first announcement message; wherein, the discovery response is used to indicate that the second UE has the right to listen.

[0187] In step S101, listening to the first announcement message can refer to listening to the first announcement message sent by a network device. For example, the second UE can listen to the first announcement message sent by the first UE.

[0188] In one embodiment, the discovery response is used to indicate that the second UE has the right to listen to the first announcement message.

[0189] In another embodiment, the discovery response is used to indicate that the second UE has the right to listen on the PC5 interface.

[0190] The response to this discovery includes, but is not limited to, at least one of the following:

[0191] Distance query filter, used to match distance query codes;

[0192] The ranging response code corresponding to the ranging query code;

[0193] LTK ID.

[0194] The detection response includes: an identifier indicating the target UE being monitored.

[0195] The LTK ID is the LTK ID of the first UE; the LTK ID is used to identify the LTK.

[0196] For example, when the second UE receives the discovery response sent by RKMF, it can listen on the PC5 interface based on the discovery response; the second UE can match the ranging query code in the first announcement message based on the ranging query filter to obtain the first announcement message with the ranging query code that matches the ranging query filter.

[0197] In one embodiment, prior to receiving a discovery response, the method includes: sending a discovery request carrying the identifier of the second UE to the RKMF; wherein the discovery request is used to request authorization for the second UE to listen.

[0198] This disclosure provides a UE discovery message protection method, executed by a second UE, which may include: sending a discovery request carrying the identifier of the second UE to the RKMF, wherein the sending request is used to request authorization for the second UE to listen.

[0199] In one embodiment, the discovery request is used to request authorization for a second UE to listen to the first announcement message.

[0200] In another embodiment, the discovery request is used to request authorization for a second UE to listen on the PC5 interface.

[0201] Thus, in this embodiment, the second UE can request permission from RKMF to listen on the PC5 interface; and only when the second UE receives a discovery response granting listening permission will it listen to the first announcement message. This improves both the success rate of listening to the first announcement message and the confidentiality of the first announcement message (e.g., the discovery message), reducing the risk of untrusted UEs listening to the discovery message.

[0202] In some embodiments of this disclosure, step S101 can also be: based on the second UE's determination that it has the right to listen on the PC5 interface, it listens for the first announcement message on the PC5 interface. Thus, in this embodiment of the disclosure, as long as the second UE determines that it has the right to listen on the PC5 interface, it can listen on the PC5 interface.

[0203] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0204] In some embodiments, after the first UE sends a key request to the RKMF, it may include: receiving a discovery key sent by the RKMF based on the RKMF or generating a discovery key using a KD.

[0205] In some embodiments of this disclosure, the key request is the key request in step S91. For example, the key request includes: LTK ID.

[0206] In other embodiments, the key request further includes a random number. This random number, along with the LTK ID, is used by RKMF to determine the discovery key or to generate the discovery key's KD.

[0207] For example, a key request includes: a random number and an LTK ID obtained from a first announcement message; the random number, together with the LTK ID, is used by RKMF to determine the discovery key or generate a discovery key's KD.

[0208] like Figure 11 As shown, this disclosure provides a UE discovery message protection method, executed by a second UE, including:

[0209] Step S111: If a discovery key is received from RKMF, decrypt the discovery message based on the discovery key; or, if a KD is received from RKMF, determine the discovery key based on the KD; and decrypt the discovery message based on the discovery key.

[0210] In some embodiments of this disclosure, the discovery message is the discovery message in step S61; the discovery key is the discovery key in step S61.

[0211] In one embodiment, decrypting the discovery message includes: decrypting sensitive information in the discovery message.

[0212] For example, the second UE receives the discovery key sent by RKMF, and based on the discovery key, performs integrity verification on the first announcement message and / or decrypts the discovery message.

[0213] For example, the second UE receives the intermediate key (KD) sent by RKMF; then, based on KD and the random number included in the first announcement message, it determines the temporary key (KD-SESS); and based on KD-SESS, it determines REK and / or RIK in the discovery key.

[0214] Thus, in this embodiment of the disclosure, the second UE can decrypt the discovery message using the discovery key obtained from the RKMF; or it can obtain the KD from the RKFM and generate a discovery key based on the KD to decrypt the discovery message. If the second UE obtains the KD from the RKFM and generates a discovery key based on the KD to decrypt the discovery message, it can also reduce the workload of the RKMF, allowing the RKMF to have more resources to process other services.

[0215] In some embodiments, the method includes: determining whether the first announcement message is complete based on the RIK in the discovery key;

[0216] Based on the discovery key, decrypt the discovery message, including: if the first announcement message is determined to be complete, decrypt the discovery message based on the ranging confidentiality protection key REK in the discovery key.

[0217] This disclosure provides a UE discovery message protection method, executed by a second UE, which may include:

[0218] Based on the discovery key RIK, determine whether the first announcement message is complete;

[0219] If the first announcement message is determined to be complete, the discovery message is decrypted based on the ranging confidentiality protection key REK in the discovery key.

[0220] This disclosure provides a UE discovery message protection method, executed by a second UE, which may include: discarding the first announcement message if it is determined that the first announcement message is incomplete.

[0221] For example, the second UE performs integrity verification on the first announcement message based on RIK; if the integrity verification is successful (i.e., the first announcement message is complete), it obtains the discovery message in the first announcement message and decrypts the discovery message based on REK; if the integrity verification fails (i.e., the first announcement message is not complete), it discards the first announcement message. Here, if the second UE fails the integrity verification, it can also stop listening to the announcement messages sent by the first UE within a predetermined time range, which include the first announcement message and / or other announcement messages.

[0222] Thus, in this embodiment of the disclosure, the second UE can perform integrity verification on the first announcement message based on the RIK in the discovery key and / or decrypt the discovery message based on the REK in the discovery key; this can protect the discovery message in certain network coverage scenarios and facilitate ranging using the decrypted discovery message. Furthermore, this embodiment of the disclosure can decrypt the discovery message based on the REK only when the first announcement message is complete, thereby obtaining a more reliable discovery message.

[0223] This disclosure provides a UE discovery message protection method, executed by a second UE, comprising: determining whether the first announcement message is an announcement message subject to replay attack based on a timestamp and / or random number obtained from a first announcement message.

[0224] Here, the timestamp may be carried in the first announcement message, for example, it may be carried in the discovery message in the first announcement message, or it may be carried in the first announcement message but not included in the discovery message.

[0225] Here, if the timestamp is included in the discovery message; the second UE obtains the timestamp and / or random number from the first announcement message, including: the second UE verifies the integrity of the first announcement message based on RIK; if the integrity verification is successful, the second UE decrypts the discovery message based on REK to obtain the timestamp and / or random number.

[0226] Here, if the timestamp is not included in the discovery message, the second UE can directly obtain the timestamp and / or the number of times from the first announcement message.

[0227] For example, the second UE determines that the first announcement message is a replay attack announcement message because the current time is not within the validity period of the timestamp indication; or, it determines that the first announcement message is not a replay attack announcement message because the current time is within the validity period of the timestamp indication.

[0228] For example, the second UE determines that the first announcement message is an announcement message that has been replayed and attacked based on the fact that it has previously received a random number that is the same as the random number in the first announcement message; or it determines that the first announcement message is an announcement message that has not been replayed and attacked based on the fact that it has not previously received a random number that is the same as the random number in the first announcement message.

[0229] For example, the second UE determines that the first announcement message is an announcement message that has not been replay attacked based on the fact that the current time is within the validity period indicated by the timestamp and that it has not previously received a random number that is the same as the random number in the first announcement message.

[0230] Thus, in this embodiment of the disclosure, the second UE can also determine whether the first announcement message has been replayed by a replay attack by obtaining the timestamp and / or random number from the first announcement message; thereby improving the protection of the discovery message.

[0231] In some embodiments of this disclosure, if the second UE determines that the first announcement message is incomplete or that the first announcement message is an announcement message that has been replayed, it determines not to send the second announcement message.

[0232] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0233] This disclosure provides a UE discovery message protection method, executed by a second UE, including:

[0234] Send a second announcement message, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

[0235] This ranging response code can be used to indicate that the second UE has received the first announcement message.

[0236] This disclosure provides a UE discovery and protection method, executed by a second UE, which may include: sending a second announcement message on the PC5 interface.

[0237] Sending the second announcement message includes: sending the second announcement message based on the matching of the ranging query code in the first announcement message with the ranging query filter.

[0238] Here, the ranging query filter can be obtained by the second UE from the core network equipment. For example, the second UE can obtain it from a received discovery response, which is sent by RKMF after determining that the second UE has the right to listen.

[0239] This disclosure provides a UE discovery message protection method, executed by a second UE, which may include: sending a second announcement message based on matching the ranging query code in the first announcement message with the ranging query filter.

[0240] The second announcement message is: a second announcement message encrypted based on the discovery key. Here, the second announcement message encrypted based on the discovery key includes: encrypting sensitive information in the second announcement message based on REK in the discovery key, and / or protecting the integrity of the second announcement message based on RIK in the discovery key.

[0241] The above implementation methods can be specifically described on the first UE side, and will not be repeated here.

[0242] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0243] The following UE discovery message protection method is executed by RKMF and is similar to the UE discovery message protection method executed by the first UE and / or the second UE described above. For technical details not disclosed in the embodiment of the UE discovery message protection method executed by RKMF, please refer to the description of the example of the UE discovery message protection method executed by the first UE and / or the second UE, which will not be described in detail here.

[0244] like Figure 12 As shown, this disclosure provides a UE discovery message protection method, executed by RKMF, including:

[0245] Step S121: Receive a key request sent by the second UE, wherein the key request is sent by the second UE after it has listened to the first announcement message;

[0246] The first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK; wherein the discovery key is determined by the first UE based on the LTK received when it is within the network coverage area; the key request includes: LTK ID;

[0247] Step S122: Based on the key request, determine the discovery key corresponding to the LTK ID or generate the KD of the discovery key.

[0248] In some embodiments of this disclosure, the first announcement message is the first announcement message in step S61; the discovery message and the discovery key are the discovery message and the discovery key in step S61, respectively; the LTK ID is the LTK ID in step S61; and the KD is the KD in step S61. For example, the discovery key includes: REK and / or RIK.

[0249] In step S122, the key request is used to determine the KD corresponding to the LTK ID, which includes: determining the KD based on the LTK corresponding to the LTK ID.

[0250] In step S122, the discovery key corresponding to the LTK ID is determined based on the key request, including: determining KD based on the LTK corresponding to the LTK ID in the key request; determining the temporary key KD-SESS based on KD; and determining the discovery key based on KD-SESS.

[0251] Here, RKMF includes: LTK ID, and the LTK corresponding to the LTK ID.

[0252] In some embodiments, the key request includes: a random number;

[0253] Based on the key request, determine the discovery key corresponding to the LTK ID, including: determining the discovery key based on the LTK corresponding to the LTK ID and the random number in the key request.

[0254] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include: determining LTK based on LTK ID; and determining KD based on LTK and a random number.

[0255] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include: determining LTK based on LTK ID; determining KD based on LTK and a random number; determining KD-SESS based on KD and a random number; and determining REK and / or RIK based on KD-SESS.

[0256] In some embodiments, the password request includes: an identifier of the second UE;

[0257] Based on the key request, determine the discovery key corresponding to the LTK ID, including: determining that the second UE has the right to listen based on the identifier of the second UE, and determining the discovery key corresponding to the LTK ID.

[0258] This disclosure provides a UE discovery and protection method, executed by RKMF, which may include: determining that the second UE has the right to eavesdrop based on the identifier of the second UE, and determining the discovery key corresponding to the LTK ID.

[0259] This disclosure provides a UE discovery protection method, executed by RKMF, which may include: determining that the second UE is entitled to listen to the first announcement message based on the identifier of the second UE, and determining the discovery key corresponding to the LTK ID.

[0260] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include sending a discovery key or an intermediate key to a second UE.

[0261] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0262] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include:

[0263] Receive an LTK request sent by the first UE, wherein the LTK request includes the identifier of the first UE;

[0264] Send the LTK and LTK ID corresponding to the identifier of the first UE to the first UE.

[0265] This LTK request is used to request the LTK and / or LTK ID of the first UE.

[0266] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include: storing the identifier of a first UE, the LTK corresponding to the identifier of the first UE, and the LTK ID.

[0267] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include:

[0268] Receive a discovery request sent by the second UE; wherein the discovery request includes: the identifier of the second UE;

[0269] Based on the identifier of the second UE, determine whether the second UE has the right to eavesdrop;

[0270] If it is determined that the second UE has the right to listen, a discovery response is sent to the second UE; wherein, the discovery response is used to indicate that the second UE has the right to listen to the first announcement message.

[0271] In some embodiments of this disclosure, the discovery request and discovery response are the discovery request and discovery response in the above embodiments, respectively.

[0272] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include:

[0273] Receive a discovery request sent by the second UE; wherein the discovery request includes: the identifier of the second UE;

[0274] Based on the identifier of the second UE, determine whether the second UE has the right to listen to the first announcement message;

[0275] If it is determined that the second UE has the right to listen to the first announcement message, a discovery response is sent to the second UE; wherein, the discovery response is used to indicate that the second UE has the right to listen to the first announcement message.

[0276] This configuration information can be determined by the application layer.

[0277] Determining whether the second UE has the right to eavesdrop includes: determining whether the second UE has the right to eavesdrop based on the second UE's identifier and configuration information; wherein, the configuration information includes: the eavesdropping permissions corresponding to each second UE.

[0278] This disclosure provides a UE discovery message protection method, executed by RKMF, which may include: determining whether the second UE has the right to listen based on the identifier and configuration information of the second UE.

[0279] This configuration information includes: the identifier of each second UE, and the listening permissions of each second UE. These listening permissions include: having the right to listen, or not having the right to listen.

[0280] For example, RKMF stores configuration information, which includes: the identifier of at least one second UE, and the listening permissions of the second UE corresponding to the identifier of the second UE; RKMF can query the configuration information based on the identifier of the second UE to determine the listening permissions corresponding to the identifier of the second UE.

[0281] This configuration information includes: the identifier of each second UE, and the listening permissions of each second UE to listen to each first UE. These listening permissions include: having the right to listen to at least one first UE, or not having the right to listen to at least one first UE.

[0282] For example, RKMF stores configuration information, which includes: the identifier of at least one second UE, and the listening permission of the second UE to listen to at least one first UE; RKMF can determine the listening permission of the second UE corresponding to the identifier of the second UE to listen to the first UE based on the query configuration information of the second UE.

[0283] In one embodiment, the listening permissions of the second UE included in the configuration information include: the listening permissions of the second UE on the PC5 interface. For example, the listening permissions of the second UE included in the configuration information may include: the second UE having the right to listen to the announcement messages of the first UE on the PC5 interface; or the second UE having no right to listen to the announcement messages of the first UE on the PC5 interface.

[0284] Thus, in this embodiment of the disclosure, RKMF can determine whether the second UE has the right to listen based on the discovery request sent by the second UE, and based on the identifier of the second UE and the configured information in the discovery request; and if the second UE has the right to listen, it will send a discovery response indicating that the second UE has the right to listen to the first announcement message to the second UE. This ensures that the second UE only listens to the first announcement message if the condition of having the right to listen is met.

[0285] The above implementation methods can be specifically described on the first UE side, and will not be repeated here.

[0286] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0287] To further explain any of the embodiments of this disclosure, several specific embodiments are provided below.

[0288] Example 1:

[0289] First, the application scenarios of the UE discovery message protection method are explained as follows: In the scenario of secure ranging discovery process under 5G network coverage, the UE discovery message protection method can be introduced; in this UE discovery message protection method, the security algorithm identifier can be set according to 3GPP TS 33.501. Here, the first UE leaving the 5G network coverage area has been pre-configured by the network device or has been provided with information about the discoverable target UE. Here, in order to protect the communication between the UE and RKMF, the UE and RKMF should support the security conditions and procedures in Clause 5.2.5 of 3GPP TS 33.503. Here, the second UE supports the security algorithm used by the first UE.

[0290] like Figure 13 As shown, this disclosure provides a UE discovery message protection method, executed by a communication device, which includes: a first UE, a second UE, and an RKMF; the method includes:

[0291] Step S1301: When the first UE is within the 5G network coverage area, it sends an LTK request;

[0292] In one alternative embodiment, the first UE, within the 5G network coverage area, sends an LTK request carrying the identifier of the first UE to obtain the LTK from the RKMF.

[0293] Step S1302: When the first UE is within the 5G network coverage area, it receives the LTK response;

[0294] In an optional embodiment, before step S132, after receiving the LTK request, RKMF generates and sends the LTK and LTK ID of the first UE.

[0295] In one optional embodiment, when the first UE is within the coverage area of ​​the 5G network, it receives an LTK response sent by RKMF; wherein the LTK response includes: an LTK and an LTK ID corresponding to the identifier of the first UE.

[0296] Step S1303: When the first UE is outside the network coverage area and the previous discovery key expires, a discovery key is generated;

[0297] Here, the previous discovery key is the available key sent by the network device in the above embodiment.

[0298] In an optional embodiment, when the first UE is outside the network coverage area and the previous discovery key has expired, the first UE generates a new discovery key. For example, the first UE may first generate a KD based on the LTK based on the key generation function (KDF) specified in Appendix B of TS 33.220; then generate a KD-SESS based on the KD; and finally derive the REK and RIK based on the KD to protect the confidentiality and integrity of the message.

[0299] Step S1304: Announce the first announcement message on the PC5 interface;

[0300] The first announcement message includes: a ranging query code, a timestamp, a target ranging layer ID, and ranging requirement information; the first announcement message also includes: an LTK ID and a random number used to derive the discovery key. Here, at least one of the ranging query code, the target ranging layer ID, and the ranging requirement information can be the information in the discovery message in the above embodiments.

[0301] In one optional embodiment, the first UE first uses REK to encrypt sensitive information in the first announcement message; then it uses RIK to perform integrity protection on the encrypted sensitive information, the first UE's LTK ID, and the nonce used to derive the discovery key, to obtain the first announcement message; the first UE announces the first announcement message on the PC5 interface. This sensitive information is at least a portion of the information in the discovery message.

[0302] Step S1305: Send a discovery request;

[0303] In an alternative embodiment, the second UE sends a transmission request carrying the identifier of the second UE to RKMF to request listening on the PC5 interface.

[0304] Step S1306: Receive discovery response;

[0305] In one optional embodiment, RKMF authorizes the second UE to listen based on configuration information according to the discovery request sent by the second UE; RKMF sends a discovery response to the UE to indicate that the second UE has the right to listen. Here, the configuration information includes: a service configuration file; the service configuration file is defined by the application layer.

[0306] In one optional embodiment, the second UE receives a discovery response, wherein the discovery response includes information about a set of target UEs, a corresponding ranging query filter, a corresponding ranging response code, and the LTK ID of the first UE. Here, the information about the set of target UEs includes: an identifier for the set of target UEs. In one embodiment, the target UEs include the first UE.

[0307] Step S1307: Listen for and receive the first announcement message on the PC5 interface;

[0308] In an alternative embodiment, the second UE uses information from a set of target UEs to listen for the first announcement message on the PC5 interface.

[0309] Step S1308: Send a key request;

[0310] In one optional embodiment, when the second UE is within the 5G network coverage area and receives a first announcement message from the first UE, it sends a key request including the first UE's LTK ID and a random number used to generate the key ID (KD) to the RKMF. Here, the key request includes the first UE's LTK ID and the random number.

[0311] Step S1309: Generate KD;

[0312] In one optional embodiment, RKMF determines whether the second UE has the right to listen to the first UE based on the service configuration file; if it is determined that the second UE does not have the right to listen to the first UE, the discovery process is terminated; if it is determined that the second UE has the right to listen to the first UE, RKMF determines KD based on the first UE's LTK and a random number.

[0313] Step S1310: Send KD;

[0314] In an alternative embodiment, RKMF sends the newly generated KD to the second UE.

[0315] Step S1311: Decrypt the discovery message;

[0316] In one optional embodiment, the second UE generates a KD-SESS based on the received KD; and generates REK and RIK based on the KD-SESS and a random number; the second UE verifies the integrity of the first announcement message based on RIK; if the integrity verification fails, UE2 suspends the first announcement message of the first UE; otherwise, the second UE decrypts the discovery message based on REK.

[0317] In one optional embodiment, the second UE may check the timestamp and random number of the integrity protection; if the timestamp and / or random number indicate a replay attack, the second UE may suspend the announcement message from the first UE.

[0318] Here, "the second UE stops listening to the announcement message of the first UE" can mean that the second UE stops listening to the announcement message of the first UE.

[0319] Step S1312: Announce the second announcement message;

[0320] In an optional embodiment, if the second UE determines that the ranging query code of the first UE matches the ranging query filter of the second UE, it generates a second announcement message including the corresponding ranging response code and announces the second announcement message on the PC5 interface. The second UE uses REK to encrypt sensitive information in the second announcement message, and then uses RIK to protect the integrity of the entire second announcement message.

[0321] Step S1313: Listen on the PC5 interface.

[0322] In an optional embodiment, the first UE uses a locally configured ranging response filter to listen on the PC5 interface; verifies and decrypts a second announcement message from the second UE, the second announcement message including a ranging response code that matches the ranging response filter.

[0323] Example 2:

[0324] This disclosure provides a key derivation method.

[0325] Step A: To calculate KD based on LTK, the following parameters should be used as inputs to the KDF:

[0326] FC = 0x58;

[0327] P0 = Nonce_1;

[0328] L0=length of Nonce_1(ie0x00 0x03);

[0329] P1 = Nonce_2;

[0330] L1=length of Nonce_2(ie0x00 0x10);

[0331] P2 = Nonce_3;

[0332] L2=length of Nonce_3 (ie0x00 0x10).

[0333] Here, the input key should be a 256-bit LTK.

[0334] Step B: Calculate KD-SESS based on KD. The following parameters should be used as inputs to the KDF:

[0335] FC = 0x5E;

[0336] P0 = Nonce_4;

[0337] L0=length of Nonce_4(ie0x00 0x10);

[0338] P1 = Nonce_5;

[0339] L1=length of Nonce_5 (ie0x00 0x10).

[0340] Here, the input key should be a 256-bit KD.

[0341] Step C: Calculate RIK or REK based on KD-SESS. The following parameters should be used to form the input to KDF:

[0342] FC = 0x5B;

[0343] P0=0x00 if REK is being derived or 0x01 if RIK is being derived;

[0344] L0=length of P0(ie0x00 0x01);

[0345] P1 = algorithm identity;

[0346] L1=length of algorithm identity(ie0x00 0x01);

[0347] NOTE: Void.

[0348] Here, the input key should be a 256-bit KD-SESS.

[0349] Here, for an input key of length n bits, where n is less than or equal to 256, the n least significant bits of the 256 bits output by the KDF are used as the input key.

[0350] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0351] like Figure 14 As shown in the figure, this disclosure provides a UE discovery message protection device, applied to a first UE, comprising:

[0352] The first sending module 51 is configured to send a first announcement message when the first UE is outside the network coverage area, wherein the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0353] The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine the key request to request the discovery key or to request the intermediate key (KD) for generating the discovery key.

[0354] This disclosure provides a UE discovery message protection device for a first UE, comprising: a first sending module 51 configured to send a first announcement message based on a direct communication PC5 interface.

[0355] This disclosure provides a UE discovery message protection device, applied to a first UE, comprising:

[0356] The first sending module 51 is configured to send an LTK request carrying the identifier of the first UE to the RKMF;

[0357] The first receiving module is configured to receive the LTK and LTK ID returned by RKMF based on the LTK request.

[0358] This disclosure provides a UE discovery message protection device for a first UE, comprising: a first processing module configured to determine a discovery key based on LTK.

[0359] In some embodiments, the discovery key includes at least one of the following:

[0360] REK is used to encrypt discovery messages;

[0361] RIK is used to protect the integrity of the first announcement message.

[0362] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to determine a discovery key based on LTK if an available key sent by a network device fails.

[0363] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to determine a discovery key based on LTK if the validity period of an available key sent by a network device expires.

[0364] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to determine KD based on LTK.

[0365] This disclosure provides a UE discovery message protection device applied to a first UE, including: a first processing module configured to determine KD based on LTK and a random number.

[0366] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to determine KD based on LTK; determine KD-SESS based on KD; and determine REK and / or RIK in the discovery key based on KD-SESS.

[0367] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to determine KD based on LTK and a random number; determine KD-SESS based on KD and a random number; and determine REK and / or RIK in the discovery key based on KD-SESS and a random number.

[0368] In some embodiments, the first announcement message further includes at least one of the following:

[0369] Security algorithm identifier, used to identify the security algorithm used in the first announcement message;

[0370] Distance lookup code used to identify the first announcement message;

[0371] A random number, used together with the LTK to determine the discovery key;

[0372] A timestamp is used to indicate the expiration date of the discovery key.

[0373] In some embodiments, the discovery message includes at least one of the following:

[0374] Target ranging layer ID is used to indicate the target UE that needs to be ranged;

[0375] Distance measurement requirement information, used to indicate the distance measurement requirements.

[0376] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first receiving module configured to receive a second announcement message sent by a second UE, wherein the second announcement message carries a ranging response code corresponding to a ranging query code.

[0377] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first receiving module configured to receive a second announcement message sent by a second UE, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

[0378] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first receiving module configured to receive a second announcement message sent by a second UE based on a ranging response filter.

[0379] In some embodiments, the second announcement message is: a second announcement message protected by the discovery key.

[0380] This disclosure provides a UE discovery message protection device applied to a first UE, comprising: a first processing module configured to perform integrity verification and / or decryption of a second announcement message based on a discovery key.

[0381] This disclosure provides a UE discovery message protection device, applied to a first UE, comprising:

[0382] The second receiving module is configured to receive a first announcement message, wherein the first announcement message is sent when the first UE is outside the network coverage area, and the first announcement message includes: a discovery message encrypted based on a discovery key, and an LTK ID indicating an LTK; wherein the discovery key is determined based on the LTK received when the first UE is within the network coverage area; the LTK ID is used by the second UE to determine a key request to request the discovery key or to request a key to generate the discovery key.

[0383] like Figure 15 As shown, this disclosure provides a UE discovery message protection device, applied to a second UE, comprising:

[0384] The second sending module 61 is configured to send a key request to the RKMF based on the first announcement message being detected; wherein the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key, and an LTK ID indicating the LTK;

[0385] The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes: LTK ID; the key request is used to request the discovery key or to request the KD that generates the discovery key.

[0386] This disclosure provides a UE discovery message protection device applied to a second UE, comprising: a second receiving module configured to listen to a first announcement message based on receiving a discovery response sent by RKMF; wherein the discovery response is used to indicate that the second UE has the right to listen.

[0387] This disclosure provides a UE discovery message protection device for a second UE, comprising: a second receiving module configured to listen for a first announcement message on a direct communication PC5 interface.

[0388] This disclosure provides a UE discovery message protection device for a second UE, comprising: a second sending module 61 configured to send a discovery request carrying the identifier of the second UE to an RKMF, wherein the sending request is used to request authorization for the second UE to listen.

[0389] In some embodiments, the discovery response includes at least one of the following:

[0390] Distance query filter, used to match distance query codes;

[0391] The ranging response code corresponding to the ranging query code;

[0392] LTK ID.

[0393] This disclosure provides a UE discovery message protection device applied to a second UE, comprising: a second processing module configured to, upon receiving a discovery key sent by RKMF, decrypt a discovery message based on the discovery key; or...

[0394] The second processing module is configured to, upon receiving a KD sent by RKMF, determine the discovery key based on the KD; and decrypt the discovery message based on the discovery key.

[0395] This disclosure provides a UE discovery message protection device for a second UE, comprising: a second processing module configured to determine whether a first announcement message is complete based on the RIK in the discovery key;

[0396] The second processing module is configured to decrypt the discovery message based on REK in the discovery key if it is determined that the first announcement message is complete.

[0397] In some embodiments, a key request includes: a random number obtained from a first announcement message; the random number, together with the LTKID, is used by the RKMF to determine a discovery key or to generate a discovery key KD.

[0398] This disclosure provides a UE discovery message protection device applied to a second UE, including: a second processing module configured to determine whether the first announcement message is an announcement message subject to replay attack based on a timestamp and / or random number obtained from a first announcement message.

[0399] This disclosure provides a UE discovery message protection device applied to a second UE, comprising: a second sending module configured to send a second announcement message, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

[0400] This disclosure provides a UE discovery message protection device applied to a second UE, comprising: a second sending module configured to send a second announcement message based on matching the ranging query code in a first announcement message with a ranging query filter.

[0401] In some embodiments, the discovery message includes at least one of the following:

[0402] Target ranging layer ID is used to indicate the target UE that needs to be ranged;

[0403] Distance measurement requirement information, used to indicate the distance measurement requirements.

[0404] like Figure 16 As shown, this disclosure provides a UE discovery message protection device applied to RKMF, comprising:

[0405] The third receiving module 71 is configured to receive a key request sent by the second UE, wherein the key request is sent by the second UE after it has detected the first announcement message; wherein the first announcement message is sent by the first UE when it is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on a discovery key, and an LTK ID indicating the LTK; wherein the discovery key is determined by the first UE based on the LTK received when it is within the network coverage area; the key request includes: the LTK ID;

[0406] The third processing module 72 is configured to determine the discovery key corresponding to the LTK ID or the intermediate key for generating the discovery key based on the key request.

[0407] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third sending module configured to send a discovery key or an intermediate key to a second UE.

[0408] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third receiving module 71 configured to receive an LTK request sent by a first UE, wherein the LTK request includes the identifier of the first UE;

[0409] The third sending module is configured to send the LTK and LTK ID corresponding to the identifier of the first UE to the first UE.

[0410] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third receiving module 71 configured to receive a discovery request sent by a second UE; wherein the discovery request includes: the identifier of the second UE;

[0411] The third processing module 72 is configured to determine whether the second UE has the right to listen based on the identifier of the second UE;

[0412] The third sending module is configured to send a discovery response to the second UE if it is determined that the second UE has the right to listen; wherein the discovery response is used to indicate that the second UE has the right to listen to the first announcement message.

[0413] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third processing module 72 configured to determine whether a second UE has the right to listen based on the identifier and configuration information of the second UE; wherein, the configuration information includes: the listening permissions corresponding to each second UE.

[0414] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third processing module 72 configured to determine an intermediate key KD based on the LTK corresponding to the LTK ID in the key request.

[0415] In some embodiments, the key request includes: a random number;

[0416] The third processing module 72 is configured to determine the discovery key based on the LTK corresponding to the LTK ID in the key request and the random number.

[0417] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third processing module 72 configured to determine an intermediate key KD based on the LTK corresponding to the LTK ID in the key request and a random number.

[0418] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third processing module 72 configured to determine KD based on the LTK corresponding to the LTK ID in the key request; determine KD-SESS based on KD; and determine the discovery key based on KD-SESS.

[0419] This disclosure provides a UE discovery message protection device applied to RKMF, including: a third processing module 72 configured to determine KD based on the LTK corresponding to the LTK ID in the key request and a random number; determine KD-SESS based on KD and the random number; and determine the discovery key based on KD-SESS and the random number.

[0420] In some embodiments, the discovery key includes at least one of the following:

[0421] REK is used to encrypt discovery messages;

[0422] RIK is used to protect the integrity of the first announcement message.

[0423] In some embodiments, the password request includes: an identifier of the second UE;

[0424] The third processing module 72 is configured to determine that the second UE has the right to listen based on the identifier of the second UE, and to determine the discovery key corresponding to the LTKID.

[0425] It should be noted that those skilled in the art will understand that the apparatus provided in the embodiments of this disclosure can be executed alone or together with some apparatus in the embodiments of this disclosure or some apparatus in related technologies.

[0426] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0427] This disclosure provides a communication device, including:

[0428] processor;

[0429] Memory used to store processor-executable instructions;

[0430] The processor is configured to implement the positioning method of any embodiment of this disclosure when running executable instructions.

[0431] In one embodiment, the communication device may include, but is not limited to, at least one of: a core network device, an access network device, and a UE. The UE may be the first UE or the second UE in the above embodiments; the core network device may be the RKMF in the above embodiments.

[0432] The processor may include various types of storage media, which are non-transitory computer storage media that can continue to store information after the user equipment loses power.

[0433] The processor can connect to memory via a bus or similar means to read executable programs stored in memory, for example... Figures 6 to 13 At least one of the methods shown.

[0434] This disclosure also provides a computer storage medium storing a computer-executable program, which, when executed by a processor, implements the positioning method of any embodiment of this disclosure. For example, such as... Figures 6 to 13 At least one of the methods shown.

[0435] Regarding the apparatus or storage medium in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0436] Figure 17 This is a block diagram illustrating a user equipment 800 according to an exemplary embodiment. For example, user equipment 800 may be a mobile phone, computer, digital broadcast user equipment, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0437] Reference Figure 17 User equipment 800 may include one or more of the following components: processing component 802, memory 804, power supply component 806, multimedia component 808, audio component 810, input / output (I / O) interface 812, sensor component 814, and communication component 816.

[0438] Processing component 802 typically controls the overall operation of user equipment 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0439] Memory 804 is configured to store various types of data to support the operation of user equipment 800. Examples of this data include instructions for any application or method operating on user equipment 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0440] Power supply component 806 provides power to various components of user equipment 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to user equipment 800.

[0441] Multimedia component 808 includes a screen that provides an output interface between the user equipment 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the user equipment 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0442] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when user equipment 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0443] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0444] Sensor assembly 814 includes one or more sensors for providing status assessments of various aspects of user equipment 800. For example, sensor assembly 814 may detect the on / off state of user equipment 800, the relative positioning of components such as the display and keypad of user equipment 800, changes in position of user equipment 800 or a component of user equipment 800, the presence or absence of user contact with user equipment 800, orientation or acceleration / deceleration of user equipment 800, and temperature changes of user equipment 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0445] Communication component 816 is configured to facilitate wired or wireless communication between user equipment 800 and other devices. User equipment 800 can access wireless networks based on communication standards, such as WiFi, 4G, or 5G, or combinations thereof. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 816 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0446] In an exemplary embodiment, the user equipment 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0447] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of a user device 800 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0448] like Figure 18 As shown, one embodiment of this disclosure illustrates the structure of a base station. For example, base station 900 can be provided as a network-side device. (Refer to...) Figure 18 The base station 900 includes a processing component 922, which further includes one or more processors, and memory resources represented by a memory 932 for storing instructions executable by the processing component 922, such as application programs. The application programs stored in the memory 932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 922 is configured to execute instructions to perform any of the methods described above applied to the base station, such as... Figures 6 to 13 The method shown.

[0449] Base station 900 may also include a power supply component 926 configured to perform power management of base station 900, a wired or wireless network interface 950 configured to connect base station 900 to a network, and an input / output (I / O) interface 958. Base station 900 can operate on an operating system stored in memory 932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0450] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0451] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for protecting UE discovery messages, wherein, Performed by the first user equipment (UE), including: When the first UE is outside the network coverage area, a first announcement message is sent, wherein the first announcement message includes: a discovery message encrypted based on the discovery key and LTK identification information ID indicating the long-term key LTK; The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine a key request to request the discovery key or to request an intermediate key KD for generating the discovery key.

2. The method according to claim 1, wherein, Before sending the first announcement message, the following is included: Send an LTK request carrying the identifier of the first UE to the ranging key management function network element RKMF; Receive the LTK and LTK ID returned by the RKMF based on the LTK request.

3. The method according to claim 2, wherein, The method includes: Based on the LTK, the discovery key is determined; wherein the discovery key includes at least one of the following: The ranging confidentiality protection key REK is used to encrypt the discovery message; The ranging integrity protection key RIK is used to protect the integrity of the first announcement message.

4. The method according to claim 3, wherein, Determining the discovery key based on the LTK includes: If the available key sent by the network device fails, the discovery key is determined based on the LTK; wherein the available key is the key received by the first UE within the network coverage area; the network device includes access network device or core network device.

5. The method according to claim 3, wherein, Determining the discovery key based on the LTK includes: The KD is determined based on the LTK; Based on the KD, a temporary key KD-SESS is determined; Based on the KD-SESS, determine the REK and / or the RIK in the discovery key.

6. The method according to claim 5, wherein, Determining the KD based on the LTK includes: Based on the LTK and the random number, determine the KD; The determination of the temporary key KD-SESS based on the KD includes: Based on the KD and the random number, the KD-SESS is determined; The step of determining the REK and / or RIK in the discovery key based on the KD-SESS includes: Based on the KD-SESS and the random number, determine the REK and / or the RIK in the discovery key.

7. The method according to claim 1, wherein, Sending the first announcement message includes: The first announcement message is sent via the direct communication PC5 interface.

8. The method according to any one of claims 1 to 7, wherein, The first announcement message also includes at least one of the following: A timestamp is used to indicate the validity period of the discovery key; Security algorithm identifier, used to identify the security algorithm used in the first announcement message; The ranging query code used to identify the first announcement message; A random number, used together with the LTK, to determine the discovery key.

9. The method according to claim 1, wherein, The method includes: The system receives a second announcement message sent by a second UE, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

10. The method according to claim 9, wherein, The second announcement message is: a second announcement message protected by the discovery key; The method further includes: performing integrity verification and / or decryption on the second announcement message based on the discovery key.

11. The method according to any one of claims 1 to 7, wherein, The discovery message includes at least one of the following: Target ranging layer ID is used to indicate the target UE that needs to be ranged; Distance measurement requirement information, used to indicate the distance measurement requirements.

12. A method for protecting UE discovery messages, wherein, Performed by the second user equipment (UE), including: Based on the first announcement message being detected, a key request is sent to the ranging key management function network element RKMF; wherein, the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key and LTK identification information ID indicating the long-term key LTK; The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes the LTK ID; the key request is used to request the discovery key or to request an intermediate key KD for generating the discovery key.

13. The method according to claim 12, wherein, The first announcement message being monitored includes: Based on the discovery response received from the RKMF, the second UE listens for the first announcement message; wherein the discovery response is used to indicate that the second UE has the right to listen.

14. The method according to claim 13, wherein, The listening to the first announcement message includes: Listen for the first announcement message on the PC5 direct communication interface.

15. The method according to claim 13, wherein, The method includes: Send a discovery request carrying the identifier of the second UE to the RKMF, wherein the sending request is used to request authorization for the second UE to listen.

16. The method according to claim 13, wherein, The discovery response includes at least one of the following: Distance query filter, used to match distance query codes; The ranging response code corresponding to the ranging query code; The LTK ID.

17. The method according to any one of claims 12 to 16, wherein, The method includes: If the discovery key sent by the RKMF is received, the discovery message is decrypted based on the discovery key; or, If the KD sent by the RKMF is received, the discovery key is determined based on the KD; the discovery message is decrypted based on the discovery key.

18. The method according to claim 17, wherein, The method includes: Based on the ranging integrity protection key RIK in the discovery key, determine whether the first announcement message is complete; The process of decrypting the discovery message based on the discovery key includes: If the first announcement message is determined to be complete, the discovery message is decrypted based on the ranging confidentiality protection key REK in the discovery key.

19. The method of claim 17, wherein, The key request includes: a random number obtained from the first announcement message; the random number, together with the LTK ID, is used by the RKMF to determine the discovery key or the KD that generates the discovery key.

20. The method according to claim 18, wherein, The method includes: Based on the timestamp and / or random number obtained from the first announcement message, determine whether the first announcement message is an announcement message that has been subjected to a replay attack.

21. The method according to claim 17, wherein, The method includes: Send a second announcement message, wherein the second announcement message carries a ranging response code corresponding to the ranging query code included in the first announcement message.

22. The method according to claim 21, wherein, Sending the second announcement message includes: Based on the match between the ranging query code in the first announcement message and the ranging query filter, the second announcement message is sent.

23. The method according to any one of claims 12 to 16, wherein, The discovery message includes at least one of the following: Target ranging layer ID is used to indicate the target UE that needs to be ranged; Distance measurement requirement information, used to indicate the distance measurement requirements.

24. A method for protecting UE discovery messages, wherein, Performed by the ranging key management function network element RKMF, including: The system receives a key request from a second UE, wherein the key request is sent by the second UE after it has detected a first announcement message; wherein the first announcement message is sent by the first UE when it is outside network coverage; the first announcement message includes: a discovery message encrypted based on a discovery key and an LTK identifier information ID indicating a long-term key (LTK); wherein the discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes: LTK ID; Based on the key request, determine the discovery key corresponding to the LTK ID or the intermediate key KD for generating the discovery key.

25. The method according to claim 24, wherein, The method includes: Send the discovery key or the KD to the second UE.

26. The method according to claim 24, wherein, The method includes: Receive an LTK request sent by the first UE, wherein the LTK request includes the identifier of the first UE; Send the LTK and the LTK ID corresponding to the identifier of the first UE to the first UE.

27. The method according to any one of claims 24 to 26, wherein, The method includes: Receive a discovery request sent by the second UE; wherein the discovery request includes: the identifier of the second UE; Based on the identifier of the second UE, determine whether the second UE has the right to eavesdrop; If it is determined that the second UE has the right to eavesdrop, a discovery response is sent to the second UE; wherein the discovery response is used to indicate that the second UE has the right to eavesdrop.

28. The method according to claim 27, wherein, Determining whether the second UE has the right to eavesdrop based on the identifier of the second UE includes: Based on the identifier and configuration information of the second UE, it is determined whether the second UE has the right to listen; wherein, the configuration information includes: the listening permissions corresponding to each second UE.

29. The method according to claim 25, wherein, The step of determining the discovery key corresponding to the LTK ID based on the key request includes: The intermediate key KD is determined based on the LTK corresponding to the LTK ID in the key request; Based on the KD, a temporary key KD-SESS is determined; The discovery key is determined based on the KD-SESS.

30. The method according to claim 29, wherein, The discovery key includes at least one of the following: The ranging confidentiality protection key REK is used to encrypt the discovery message; The ranging integrity protection key RIK is used to protect the integrity of the first announcement message.

31. The method according to claim 29, wherein, The key request includes: a random number; The step of determining the discovery key corresponding to the LTK ID based on the key request includes: The discovery key is determined based on the LTK corresponding to the LTK ID in the key request and the random number.

32. The method according to claim 29, wherein, The key request includes: the identifier of the second UE; The step of determining the discovery key corresponding to the LTK ID based on the key request includes: Based on the identifier of the second UE, it is determined that the second UE has the right to eavesdrop, and the discovery key corresponding to the LTK ID is determined.

33. A UE discovery message protection device, wherein, Applied to the first user equipment (UE), including: The first sending module is configured to send a first announcement message when the first UE is outside the network coverage area, wherein the first announcement message includes: a discovery message encrypted based on the discovery key and LTK identification information ID indicating the long-term key LTK; The discovery key is determined based on the LTK received when the first UE is within network coverage; the LTK ID is used by the second UE to determine a key request to request the discovery key or to request an intermediate key KD for generating the discovery key.

34. A UE discovery message protection device, wherein, Applied to the second user equipment (UE), including: The second sending module is configured to send a key request to the ranging key management function network element RKMF based on the first announcement message being detected; wherein, the first announcement message is sent when the first UE is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on the discovery key and LTK identification information ID indicating the long-term key LTK; The discovery key is determined by the first UE based on the LTK received when it is within network coverage; the key request includes the LTK ID; the key request is used to request the discovery key or to request an intermediate key KD for generating the discovery key.

35. A UE discovery message protection device, wherein, The network element RKMF, which is used for ranging key management functions, includes: The third receiving module is configured to receive a key request sent by the second UE, wherein the key request is sent by the second UE after it has detected a first announcement message; wherein the first announcement message is sent by the first UE when it is outside the network coverage area; the first announcement message includes: a discovery message encrypted based on a discovery key and LTK identifier information ID indicating a long-term key LTK; wherein the discovery key is determined by the first UE based on the LTK received when it is within the network coverage area; the key request includes: LTK ID; The third processing module is configured to determine, based on the key request, the discovery key corresponding to the LTK ID or the intermediate key KD for generating the discovery key.

36. A communication device, wherein, The communication device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to implement the UE discovery message protection method according to any one of claims 1 to 11, or claims 12 to 23, or claims 24 to 32 when running the executable instructions.

37. A computer storage medium, wherein, The computer storage medium stores a computer-executable program, which, when executed by a processor, implements the UE discovery message protection method according to any one of claims 1 to 11, or claims 12 to 23, or claims 24 to 32.

Images