Connection establishment method, system, terminal and computer readable storage medium

Abstract

The present invention discloses a connection establishment method, system, terminal and computer-readable storage medium. The connection establishment method includes: in a discovery process of terminal-to-terminal relay communication, a first terminal sends a discovery message carrying an indication to a second terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal. The embodiment of the present invention provides a choice of whether to perform a network-assisted secure connection for terminal-to-terminal relay communication, increases the participation and control of the network side in the terminal-to-terminal relay communication process, improves service security, and enhances user experience.

Description

Technical Field

[0001] The present invention relates to the field of mobile communications, and in particular to a connection establishment method, system, terminal and computer-readable storage medium. Background Art

[0002] Terminal-to-terminal relay (UE-to-UE Relay) is one of the key scenarios studied in 5G Proximity Services (ProSe) in the Release 18 (R18) phase of the 3rd Generation Partnership Project (3GPP). Summary of the invention

[0003] In UE-to-UE Relay communication, how the source terminal (or source end terminal) and the target terminal (or target end terminal) establish a secure direct communication interface (PC5 interface) connection with the relay terminal is an issue to be studied and standardized.

[0004] A technical problem to be solved by the embodiments of the present invention is: how an end terminal establishes secure communication with a relay terminal in UE-to-UE Relay communication.

[0005] According to a first aspect of some embodiments of the present invention, a connection establishment method is provided, comprising: in a discovery process of terminal-to-terminal relay communication, a first terminal sends a discovery message carrying an indication to a second terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0006] In some embodiments, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal.

[0007] In some embodiments, when the relay terminal is within the coverage of the network, the indication is a network-assisted indication.

[0008] In some embodiments, when the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0009] In some embodiments, when the relay terminal is within the coverage of the network, the instruction is used to determine to use a network-assisted secure connection establishment procedure between the first terminal and the second terminal.

[0010] In some embodiments, the indication is used to indicate support for, or use of, a network-assisted secure connection establishment procedure.

[0011] In some embodiments, when the relay terminal is not within the network coverage, the indication is used to determine to use a secure connection establishment procedure without network assistance between the first terminal and the second terminal.

[0012] In some embodiments, when the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or when the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, an indication is used to determine the use of a network-assisted secure connection establishment process between a first terminal and a second terminal.

[0013] In some embodiments, the establishing method further comprises: in case of indicating support for, or use of, a network-assisted secure connection establishment process, using a network-assisted secure connection establishment process between the relay terminal and the end terminal.

[0014] In some embodiments, the establishment method further includes: when the indication indicates that the network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

[0015] In some embodiments, the indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

[0016] In some embodiments, the first terminal is a source end terminal and the second terminal is a relay terminal.

[0017] In some embodiments, the indication is used to indicate a preference of the source end terminal as to whether to use a network-assisted secure connection establishment procedure.

[0018] According to a second aspect of some embodiments of the present invention, a connection establishment method is provided, comprising: in a discovery process of terminal-to-terminal relay communication, a second terminal receives a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0019] In some embodiments, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal.

[0020] In some embodiments, when the relay terminal is within the coverage of the network, the indication is a network-assisted indication.

[0021] In some embodiments, when the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0022] In some embodiments, when the relay terminal is within the coverage of the network, the instruction is used to determine to use a network-assisted secure connection establishment procedure between the first terminal and the second terminal.

[0023] In some embodiments, the indication is used to indicate support for, or use of, a network-assisted secure connection establishment procedure.

[0024] In some embodiments, when the relay terminal is not within the network coverage, the indication is used to determine to use a secure connection establishment procedure without network assistance between the first terminal and the second terminal.

[0025] In some embodiments, when the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or when the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, an indication is used to determine the use of a network-assisted secure connection establishment process between a first terminal and a second terminal.

[0026] In some embodiments, the establishing method further includes: in case the indication is used to determine to use the network-assisted secure connection establishing process, the end terminal initiating the network-assisted secure connection establishing process to the relay terminal.

[0027] In some embodiments, the end terminal initiating a network-assisted secure connection establishment process to the relay terminal includes: the end terminal sending a direct communication request to the relay terminal, wherein the direct communication request is used to initiate a network-assisted secure connection establishment process to the relay terminal.

[0028] In some embodiments, the direct communication request includes a subscription encryption identifier SUCI of the end terminal, or a proximity communication remote user key identifier PRUK ID of a control plane or a user plane.

[0029] In some embodiments, the establishment method further includes: when the indication indicates that the network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

[0030] In some embodiments, the indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

[0031] In some embodiments, the establishment method also includes: the end terminal determines whether to use the network-assisted security connection establishment process based on the end terminal's support for the use of the network-assisted security connection establishment process, at least one of the end terminal's security policies, and an indication, wherein the security policy includes the priority of the network-assisted security connection establishment process.

[0032] In some embodiments, the terminal determines whether to use a network-assisted secure connection establishment process based on the terminal's support for the network-assisted secure connection establishment process, at least one of the terminal's security policies, and an indication, including: when the indication indicates that the relay terminal is within network coverage, or supports at least one of the network-assisted secure connection establishment processes, and when the terminal supports the network-assisted secure connection establishment process and the security policy indicates that the priority of using the network-assisted secure connection establishment process is higher than the priority of using a non-network-assisted secure connection establishment process, the terminal determines to use the network-assisted secure connection establishment process.

[0033] In some embodiments, the terminal determines whether to use a network-assisted secure connection establishment process based on the terminal's support for the network-assisted secure connection establishment process, at least one of the terminal's security policies, and an indication, including: when the indication indicates that the relay terminal is within network coverage, or supports at least one of the network-assisted secure connection establishment processes, and the terminal does not support the network-assisted secure connection establishment process, and the security policy indicates that the priority of using the network-assisted secure connection establishment process is lower than the priority of using the non-network-assisted secure connection establishment process, the terminal determines to use the non-network-assisted secure connection establishment process or ignores the discovery message.

[0034] In some embodiments, the terminal determines whether to use a network-assisted secure connection establishment process based on the terminal's support for the use of a network-assisted secure connection establishment process, at least one of the terminal's security policies, and an indication, including: when the indication indicates that the relay terminal is out of network coverage or does not support at least one of the network-assisted secure connection establishment processes, the terminal determines to use a non-network-assisted secure connection establishment process.

[0035] In some embodiments, the first terminal is a source end terminal and the second terminal is a relay terminal.

[0036] In some embodiments, the indication is used to indicate a preference of the source end terminal as to whether to use a network-assisted secure connection establishment procedure.

[0037] In some embodiments, the establishment method also includes: in a case where an indication indicates that the source end terminal prefers to use a network-assisted security connection establishment process, the relay terminal determines whether to use a network-assisted security connection establishment process between the first terminal and the second terminal based on whether the relay terminal supports the network-assisted security connection establishment process.

[0038] In some embodiments, whether the relay terminal supports the network-assisted secure connection establishment process is determined based on at least one of whether the relay terminal is within network coverage and whether it is authorized by the network to use the network-assisted secure connection establishment process.

[0039] In some embodiments, determining whether to use a network-assisted secure connection establishment process between a first terminal and a second terminal includes: when an indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment process and the relay terminal supports the network-assisted secure connection establishment process, the relay terminal determines to use the network-assisted secure connection establishment process; when an indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment process and the relay terminal does not support the network-assisted secure connection establishment process, the relay terminal determines to use a non-network-assisted secure connection establishment process or ignores the discovery message.

[0040] In some embodiments, the establishing method further comprises: when the indication indicates that the source end terminal prefers to use the secure connection establishment procedure without network assistance, the relay terminal determines to use the secure connection establishment procedure without network assistance.

[0041] In some embodiments, the indication is located in the relay service code, or the indication is a newly added indication in the discovery message.

[0042] In some embodiments, the establishment process using the network-assisted secure connection establishment process is a PC5 secure connection establishment process.

[0043] In some embodiments, the discovery message also carries information about the network assistance type, where the network assistance type includes control plane network assistance and user plane network assistance.

[0044] In some embodiments, the terminal-to-terminal relay communication is a terminal-to-terminal relay communication of 5G proximity communication.

[0045] According to a third aspect of some embodiments of the present invention, a terminal is provided, which is a first terminal, comprising: a sending module, configured to send a discovery message carrying an indication to a second terminal during a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted security connection establishment process between the first terminal and the second terminal.

[0046] According to a fourth aspect of some embodiments of the present invention, a terminal is provided, which is a second terminal and includes: a receiving module, configured to receive a discovery message carrying an indication from a first terminal during a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted security connection establishment process between the first terminal and the second terminal.

[0047] According to a fifth aspect of some embodiments of the present invention, there is provided a connection establishment system, comprising: a first terminal; and a second terminal.

[0048] According to a sixth aspect of some embodiments of the present invention, there is provided a terminal, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the aforementioned connection establishment methods based on instructions stored in the memory.

[0049] According to a seventh aspect of some embodiments of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements any one of the aforementioned connection establishment methods.

[0050] Some embodiments of the above invention have the following advantages or beneficial effects: the embodiments of the present invention provide a choice of whether to perform a network-assisted secure connection for terminal-to-terminal relay communication, increase the network side's participation and control during terminal-to-terminal relay communication, improve service security, and enhance user experience.

[0051] Further features and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0053] Figure 1 A schematic flow chart of a connection establishment method according to some embodiments of the present invention is shown.

[0054] Figure 2 A schematic flow chart of a connection establishment method according to some other embodiments of the present invention is shown.

[0055] Figure 3 A schematic flow chart of a connection establishment method according to some further embodiments of the present invention is shown.

[0056] Figure 4A schematic flowchart of a discovery process according to some embodiments of the present invention is shown.

[0057] Figure 5 A schematic flow chart of a connection establishment method according to some further embodiments of the present invention is shown.

[0058] Figure 6 A schematic flow chart of a discovery process according to some other embodiments of the present invention is shown.

[0059] Figure 7 A schematic structural diagram of a first terminal according to some embodiments of the present invention is shown.

[0060] Figure 8 A schematic structural diagram of a second terminal according to some embodiments of the present invention is shown.

[0061] Fig. 9 A schematic structural diagram of a connection establishment system according to some embodiments of the present invention is shown.

[0062] Fig.10 A schematic diagram of the structure of a terminal according to some embodiments of the present invention is shown.

[0063] Fig.11 Shown are schematic structural diagrams of terminals according to other embodiments of the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present invention and its application or use. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] The relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention unless specifically stated otherwise.

[0066] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0067] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0068] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0069] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0070] Figure 1 FIG. 2 is a flow chart showing a connection establishment method according to some embodiments of the present invention. Figure 1 As shown, the connection establishment method of this embodiment includes step S102.

[0071] In step S102, in a discovery procedure of UE-to-UE Relay Communication, a first terminal sends a discovery message carrying an indication to a second terminal, where the indication is used to determine whether to use a network-assisted security connection establishment procedure between the first terminal and the second terminal.

[0072] For example, the second terminal determines, according to the instruction, whether to use a network-assisted secure connection establishment procedure between the first terminal and the second terminal.

[0073] The process of establishing a secure connection is, for example, a relay service authentication and authorization process. In some embodiments, in the process of establishing a network-assisted secure connection, the existing PC5 secure connection establishment process of the terminal-to-network relay communication (UE-to-Network Relay Communication) can be reused, and the core network assists in establishing the PC5 secure connection. The end terminal can interact with the core network with the help of the Uu port network capability of the relay terminal. The core network is responsible for authorization checking, key generation and distribution, and the compatibility of the U2N Relay security process needs to be enhanced. In the relay service authentication and authorization process that supports no network assistance used by the end terminal, the existing Unicast PC5 secure connection establishment process can be reused. The end terminal can use the pre-configured application layer long-term credentials to perform two-way authentication and key derivation with the relay terminal. The actual authentication method implemented is determined by the application layer.

[0074] There are many types of discovery messages, including discovery announcement messages, discovery query messages, discovery response messages, etc.

[0075] In some embodiments, the indication is located in a relay service code (RSC), for example, a new field may be added to the RSC, or an existing field may be reused, so that the change to the message structure is relatively small.

[0076] For example, an indicator may be set in the RCS in the discovery message, and each value of the indicator has a preset meaning. In the case where the indicator indicates whether a network-assisted secure connection establishment process is supported or used, for example, a value of 1 is used to indicate support or use of a network-assisted secure connection establishment process, and a value of 0 is used to indicate that a network-assisted secure connection establishment process is not supported or not used.

[0077] In some embodiments, the indication is a newly added indication in the discovery message, for example, a newly added, separate parameter in the discovery message. In this way, the indication has better independence, which is convenient for further expansion in the future.

[0078] In some embodiments, the establishment process using the network-assisted secure connection establishment process is a PC5 secure connection establishment process.

[0079] In some embodiments, the terminal-to-terminal relay communication is a terminal-to-terminal relay communication of 5G proximity communication.

[0080] In some embodiments, the discovery message also carries information about the network assistance type, which includes network assistance on the control plane and network assistance on the user plane. Thus, network assistance can be performed on the control plane or the user plane according to the instruction of the first terminal.

[0081] The first terminal and the second terminal are different terminals involved in relay communication, and one of them is a relay terminal and the other is an end terminal (source end terminal or target end terminal). The source end terminal and the target end terminal are connected through relay terminal communication. The terminal types of the first terminal and the second terminal and the specific processing methods under the types will be further described below.

[0082] The above-mentioned embodiment provides a choice of whether to perform a network-assisted secure connection for terminal-to-terminal relay communication, increases the participation and control of the network side during the terminal-to-terminal relay communication process, improves service security, and enhances user experience.

[0083] The following describes an embodiment of the connection establishment method of the present invention by taking the first terminal as a relay terminal and the second terminal as an end terminal as an example.

[0084] In a discovery process of terminal-to-terminal relay communication, a relay terminal sends a discovery message carrying an indication to an end terminal, where the indication is used to determine whether to use a network-assisted secure connection establishment process between a first terminal and a second terminal.

[0085] In some embodiments, the indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

[0086] For example, the indication clearly indicates whether to use a network-assisted secure connection establishment process. After receiving the discovery message, the end terminal directly determines whether to use a network-assisted secure connection establishment process according to the content of the indication. For example, when the indication indicates that a network-assisted secure connection establishment process is used, the relay terminal and the end terminal use the network-assisted secure connection establishment process; when the indication indicates that a network-assisted secure connection establishment process is not used, the relay terminal and the end terminal do not use the network-assisted secure connection establishment process, for example, use a non-network-assisted secure connection establishment process.

[0087] For another example, the indication indicates whether the relay terminal supports the network-assisted secure connection establishment process. The end terminal can directly determine whether to use the network-assisted secure connection establishment process based on the support status of the relay terminal, that is, use the network-assisted secure connection establishment process if supported, and do not use the network-assisted secure connection establishment process if not supported. Alternatively, the end terminal can make further decisions based on the support status of the relay terminal and its own situation.

[0088] For another example, the indication indicates whether the relay terminal is within the coverage of the network, and the terminal makes a comprehensive decision based on the indication and other information.

[0089] The relay terminal can determine the meaning of the indication based on its own information. For example, when the relay terminal is within the network coverage, the indication is used to determine the network-assisted secure connection establishment process between the relay terminal and the end terminal. Figure 2 An embodiment in which a relay terminal determines indication content based on network coverage is exemplarily described.

[0090] Figure 2 FIG. 2 is a flow chart showing a connection establishment method according to some other embodiments of the present invention. Figure 2 As shown, the connection establishment method of this embodiment includes steps S202 to S206.

[0091] In step S202, the relay terminal determines whether the relay terminal is within the coverage of the network to determine the content indicated in the discovery message.

[0092] When the relay terminal is within the coverage of the network, the indication in the discovery message is used to determine whether to use the network-assisted secure connection establishment process. For example, the indication is used to indicate support for or use of the network-assisted secure connection establishment process.

[0093] When the relay terminal is not within the network coverage, the indication in the discovery message is determined to determine the use of a secure connection establishment procedure without network assistance. For example, the indication is used to indicate that a secure connection establishment procedure without network assistance is not supported or is not used.

[0094] In some embodiments, when the relay terminal is within the network coverage, the indication is a network-assisted indication. The network-assisted indication is, for example, a network-assisted secure connection establishment process indicator, which may also be embodied in other names or forms, which will not be described in detail here. In addition, in some embodiments, when the relay terminal is not within the network coverage, the indication is a no-network-assisted indication.

[0095] In some embodiments, when the indication is a network-assisted indication, the indication is used to determine whether a network-assisted secure connection establishment process is used between the first terminal and the second terminal; when the indication is a non-network-assisted indication, the indication is used to determine whether a non-network-assisted secure connection establishment process is used between the first terminal and the second terminal.

[0096] In step S204, in the discovery process of terminal-to-terminal relay communication, the relay terminal sends a discovery message to the end terminal.

[0097] In step S206, the end terminal determines whether to use a network-assisted secure connection establishment process between the relay terminal and the end terminal according to the instruction in the discovery message.

[0098] In case the indication is used to determine the use of the network-assisted secure connection establishment procedure, for example, in case the indication indicates support for or use of the network-assisted secure connection establishment procedure, the end terminal initiates the network-assisted secure connection establishment procedure to the relay terminal.

[0099] For example, the end terminal sends a direct communication request (Direct Communication Request) to the relay terminal, wherein the direct communication request is used to initiate a network-assisted secure connection establishment process to the relay terminal. The direct communication request may include parameters that can trigger or indicate a network-assisted secure connection establishment process, such as a Subscription Concealed Identifier (SUCI) of the end terminal, or a Prose Remote User Key Identifier (PRUK ID) of the control plane or user plane, and the like.

[0100] In some embodiments, when the indication indicates that a network-assisted secure connection establishment process is used or supported, the relay terminal and the end terminal use the network-assisted secure connection establishment process; when the indication indicates that a network-assisted secure connection establishment process is not used or supported, the relay terminal and the end terminal do not use the network-assisted secure connection establishment process, for example, use a non-network-assisted secure connection establishment process.

[0101] Through the above embodiment, the relay terminal can determine the content of the instruction according to the network coverage. When the relay terminal is within the network coverage, after the end terminal receives the instruction, it determines to use the network-assisted secure connection establishment process. Thus, the reliability of relay communication can be improved.

[0102] In addition to the condition of whether the relay terminal is within the network coverage, the relay terminal may also refer to other conditions to determine the content of the indication. For example, when the relay terminal is authorized by the network to use the network-assisted secure connection establishment process, the indication is used to determine the use of the network-assisted secure connection establishment process.

[0103] In addition, a judgment may be made in combination with multiple conditions. For example, when the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, the indication is used to determine the use of a network-assisted secure connection establishment process. When any one of the multiple conditions used is not met, the indication is used to determine the use of a non-network-assisted secure connection establishment process.

[0104] In some embodiments, after receiving the discovery message, the end terminal makes a decision on whether to use the network-assisted secure connection establishment process according to the content of the instruction in the discovery message. Figure 3 An embodiment of an end terminal decision method is described.

[0105] Figure 3 FIG. 2 shows a flow chart of a connection establishment method according to some other embodiments of the present invention. Figure 3 As shown, the connection establishment method of this embodiment includes steps S302 to S304.

[0106] In step S302, in the discovery process of terminal-to-terminal relay communication, the relay terminal sends a discovery message carrying an indication to the end terminal, such as whether the relay terminal is within the network coverage, whether it supports the network-assisted secure connection establishment process, etc.

[0107] In step S304, the terminal determines whether to use the network-assisted secure connection establishment process according to the terminal's support for the network-assisted secure connection establishment process, at least one of the terminal's security policies, and the indication.

[0108] The security policy is, for example, a security policy issued by the network, a locally stored security policy, or a security policy from the application layer. The security policy includes a priority of a network-assisted secure connection establishment process, which explicitly or implicitly indicates a priority order between a secure connection establishment process using network assistance and a secure connection establishment process not using network assistance (e.g., a secure connection establishment process without network assistance).

[0109] For example, the end terminal first determines the intermediate decision of the relay terminal on whether it can use the network-assisted secure connection establishment process based on the content of the indication. For example, when the judgment condition only includes that the relay terminal is within the network coverage, if the relay terminal is within the network coverage, it is determined that the relay terminal can use the network-assisted secure connection establishment process, otherwise it is determined that the relay terminal cannot use the network-assisted secure connection establishment process. When the judgment condition only includes whether the relay terminal supports the network-assisted secure connection establishment process, if it is supported, it is determined that the relay terminal can use the network-assisted secure connection establishment process, otherwise it is determined that the relay terminal cannot use the network-assisted secure connection establishment process. Of course, the two conditions can also be combined for judgment, that is, if the relay terminal is both within the network coverage and supports the network-assisted secure connection establishment process, it is determined that the relay terminal can use the network-assisted secure connection establishment process, otherwise it is determined that the relay terminal cannot use the network-assisted secure connection establishment process.

[0110] Next, in the case where the relay terminal is able to use the network-assisted secure connection establishment process, a decision is made based on whether the end terminal supports the network-assisted secure connection establishment process and the security policy of the end terminal.

[0111] For example, when the relay terminal is capable of using a network-assisted secure connection establishment process, and when the end terminal supports the network-assisted secure connection establishment process and the security policy indicates that the priority of using the network-assisted secure connection establishment process is higher than the priority of using a non-network-assisted secure connection establishment process, the end terminal determines to use the network-assisted secure connection establishment process.

[0112] For another example, when the relay terminal is capable of using a network-assisted secure connection establishment process, and the end terminal does not support the network-assisted secure connection establishment process, and the security policy indicates that the priority of using the network-assisted secure connection establishment process is lower than the priority of using the non-network-assisted secure connection establishment process, the end terminal determines to use the non-network-assisted secure connection establishment process or ignores the discovery message. Ignoring the discovery message may include not responding to the discovery message, not further processing the discovery message, etc., so as not to continue the secure connection establishment process according to the discovery message.

[0113] In the case where the relay terminal is unable to use the network-assisted secure connection establishment process, for example, when the indication indicates that the relay terminal is out of network coverage or does not support at least one of the network-assisted secure connection establishment processes, the end terminal determines to use a non-network-assisted secure connection establishment process.

[0114] Through the above embodiments, the relay terminal can inform the end terminal of its own information through instructions, and the end terminal makes a decision on whether to use the network-assisted secure connection establishment process.

[0115] Reference below Figure 4 The following describes a discovery process between a relay terminal and an end terminal, which is implemented based on the discovery mode A in the 3GPP standard.

[0116] Figure 4 FIG. 2 shows a flow chart of a discovery process according to some embodiments of the present invention. Figure 4 As shown, the discovery process of this embodiment includes steps S400 to S408.

[0117] In step S400, in the group member discovery process, the relay terminal (Relay UE) discovers the source terminal (source UE) and the target terminal (target UE).

[0118] In step S402, in the discovery process of the terminal-to-terminal relay communication, the relay terminal sends an announce message to the source terminal and the target terminal respectively, including discovery information indicating that it is a discovery message and an indication for determining to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0119] In step S404, the source terminal determines to use the network-assisted PC5 secure connection establishment process based on the indication.

[0120] In step S406, the target terminal determines to use the network-assisted PC5 secure connection establishment process based on the instruction.

[0121] The method for determining the source terminal and the target terminal may refer to other embodiments of the present invention and will not be described in detail here.

[0122] In step S408, both the source terminal and the target terminal establish a connection with the relay terminal through the PC5 secure connection and communicate through the relay terminal.

[0123] Through the above embodiment, the source terminal and the target terminal can establish a network-assisted PC5 secure connection establishment process with the relay terminal based on the instruction of the relay terminal. In addition, the above embodiment has little impact on the existing process of discovery mode A and has good compatibility.

[0124] The following describes an embodiment of the connection establishment method of the present invention by taking the first terminal as a source end terminal and the second terminal as a relay terminal as an example.

[0125] Figure 5 FIG. 2 shows a flow chart of a connection establishment method according to some further embodiments of the present invention. Figure 5 As shown, the connection establishment method of this embodiment includes steps S502 to S504.

[0126] In step S502, in the discovery process of terminal-to-terminal relay communication, the source terminal sends a discovery message carrying an indication to the relay terminal, where the indication is used to indicate the source terminal's preference for whether to use a network-assisted secure connection establishment process.

[0127] The indication in the discovery message may reflect the preference selection explicitly or implicitly.

[0128] In step S504, the relay terminal determines whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal according to the preference selection in the indication.

[0129] In some embodiments, when the indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment process, the relay terminal determines whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal according to whether the relay terminal supports the network-assisted secure connection establishment process. If supported, the relay terminal determines to use a network-assisted secure connection establishment process; if not supported, the relay terminal determines to use a non-network-assisted secure connection establishment process, or ignores the discovery message. Ignoring the discovery message may be not responding to the discovery message, or not further processing the discovery message, etc., so as not to continue the secure connection establishment process according to the discovery message.

[0130] In some embodiments, whether the relay terminal supports the network-assisted secure connection establishment process is determined based on whether the relay terminal is within the network coverage and whether the relay terminal is authorized by the network to use the network-assisted secure connection establishment process. For example, if the relay terminal is within the network coverage, or if the relay terminal is authorized by the network to use the network-assisted secure connection establishment process, or if the relay terminal is within the network coverage and authorized by the network to use the network-assisted secure connection establishment process, the relay terminal supports the network-assisted secure connection establishment process.

[0131] In some embodiments, if the indication indicates that the source end terminal prefers to use a secure connection establishment procedure without network assistance, the relay terminal determines to use a secure connection establishment procedure without network assistance.

[0132] Through the above embodiments, the relay terminal can make a decision on whether to use the network-assisted secure connection establishment process according to the preference selection of the source terminal. Thus, the decision can be made based on the preference selection of the source terminal and the actual situation of the relay terminal, thereby improving the reliability of communication and user experience.

[0133] Reference below Figure 6 The discovery process between a relay terminal and an end terminal is described. The discovery process is implemented based on the discovery mode B in the 3GPP standard.

[0134] Figure 6 FIG. 2 shows a flow chart of a discovery process according to some other embodiments of the present invention. Figure 6 As shown, the discovery process of this embodiment includes steps S602 to S612.

[0135] In step S602, the source terminal (source UE) sends a discovery solicitation message to the relay terminal (Relay UE), where the discovery solicitation message includes an indication indicating that the source terminal prefers to use a network-assisted secure connection establishment procedure.

[0136] The relay terminal determines to use the network-assisted secure connection establishment process based on the instruction content and its own situation.

[0137] The method for determining the relay terminal may refer to other embodiments of the present invention and will not be described in detail here.

[0138] In step S604, the relay terminal sends a discovery request to the target terminal, and the discovery query message includes an indication of using a network-assisted secure connection establishment process.

[0139] In step S606, the target terminal sends a discovery response message to the relay terminal.

[0140] In step S608, the relay terminal sends a discovery response message to the source terminal.

[0141] In step S610, a PC5 secure connection establishment process is performed between the source terminal and the relay terminal.

[0142] In step S612, a PC5 secure connection establishment process is performed between the relay terminal and the target terminal.

[0143] Through the above embodiment, the relay can determine whether to establish a network-assisted PC5 secure connection establishment process based on the instruction of the source terminal. Afterwards, the decision result is notified to the source terminal and the target terminal. The above embodiment has little impact on the existing process of discovery mode B and has good compatibility.

[0144] In some embodiments, the end terminal can use various existing methods to perform authentication and other operations with the relay terminal and establish a PC5 secure connection. For example, in the case of using a connection establishment process with network assistance, the end terminal interacts with the network side device through the Uu interface of the relay terminal to obtain a key and use this key to perform authentication processing with the relay terminal. The network side device can be a variety of devices for authorization checks, key generation and distribution processing, etc. In the case of using a connection establishment process without network assistance, the end terminal uses pre-configured application layer credential information to perform two-way authentication and key derivation with the relay terminal.

[0145] When using a connection establishment process with network assistance, the relay terminal and the end terminal respectively send key requests to the network side device. The information carried in the key requests includes a relay service code. The network side device generates keys for the relay terminal and the end terminal respectively based on the shared PRUK root key and using the relay service code; or, the network side device uses the relay service code to generate keys for the relay terminal and the end terminal respectively.

[0146] In some embodiments, when a PC5 secure connection is established using a network-assisted secure connection establishment process, the process of establishing a PC5 secure connection between a remote UE and a relay terminal in an existing UE-to-Network Relay Communication can be reused. The PC5 secure connection establishment process of U2N (UE-to-Network) Relay is divided into a user plane solution and a control plane solution. The Relay service code (RSC) is used to distinguish whether the process is triggered to establish a U2N Relay or a U2U Relay. By using different RSCs, the U2N relay service can share different levels of keys with the U2U relay service. RSC can indicate whether the current relay service is a U2N relay or a U2U relay.

[0147] In the reuse user plane solution, since PRUK is a PC5 root key specific to the relay terminal and the remote UE (end terminal), RSC uses K NRP Therefore, the U2N relay service can share the PRUK root key with the U2U relay service and use different RSCs to derive different K based on the common root key. NRP .

[0148] In the reuse control plane solution, since PRUK is a PC5 root key specific to the relay terminal and the remote UE, RSC is used as input when deriving PRUK. Therefore, the U2N relay service and the U2U relay service do not share the PRUK root key. When triggering different Relay services, the same authentication process will be triggered separately, using different RSCs from K ausf_p Different PRUKs were derived.

[0149] Reference below Figure 7 and Figure 8 Embodiments of a first terminal and a second terminal of the present invention are described.

[0150] Figure 7 FIG. 4 shows a schematic diagram of the structure of a first terminal according to some embodiments of the present invention. Figure 7As shown, the first terminal 700 of this embodiment includes a sending module 7100, which is configured to send a discovery message carrying an indication to the second terminal during the discovery process of terminal-to-terminal relay communication, and the indication is used to determine whether to use a network-assisted security connection establishment process between the first terminal and the second terminal.

[0151] In some embodiments, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal.

[0152] In some embodiments, when the relay terminal is within the coverage of the network, the indication is a network-assisted indication.

[0153] In some embodiments, when the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0154] In some embodiments, when the relay terminal is within the coverage of the network, the instruction is used to determine to use a network-assisted secure connection establishment procedure between the first terminal and the second terminal.

[0155] In some embodiments, the indication is used to indicate support for, or use of, a network-assisted secure connection establishment procedure.

[0156] In some embodiments, when the relay terminal is not within the network coverage, the indication is used to determine to use a secure connection establishment procedure without network assistance between the first terminal and the second terminal.

[0157] In some embodiments, when the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or when the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, an indication is used to determine the use of a network-assisted secure connection establishment process between a first terminal and a second terminal.

[0158] In some embodiments, when the indication indicates support for or use of a network-assisted secure connection establishment procedure, a network-assisted secure connection establishment procedure is used between the relay terminal and the end terminal.

[0159] In some embodiments, when the indication indicates that the network-assisted secure connection establishment process is not supported or is not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

[0160] In some embodiments, the indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

[0161] In some embodiments, the first terminal is a source end terminal and the second terminal is a relay terminal.

[0162] In some embodiments, the indication is used to indicate a preference of the source end terminal as to whether to use a network-assisted secure connection establishment procedure.

[0163] In some embodiments, the indication is located in the relay service code, or the indication is a newly added indication in the discovery message.

[0164] In some embodiments, the establishment process using the network-assisted secure connection establishment process is a PC5 secure connection establishment process.

[0165] In some embodiments, the discovery message also carries information about the network assistance type, where the network assistance type includes control plane network assistance and user plane network assistance.

[0166] In some embodiments, the terminal-to-terminal relay communication is a terminal-to-terminal relay communication of 5G proximity communication.

[0167] Figure 8 FIG. 4 shows a schematic diagram of the structure of a second terminal according to some embodiments of the present invention. Figure 8 As shown, the second terminal 800 of this embodiment includes: a receiving module 8100, which is configured to receive a discovery message carrying an indication from the first terminal during a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted security connection establishment process between the first terminal and the second terminal.

[0168] In some embodiments, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal.

[0169] In some embodiments, when the relay terminal is within the coverage of the network, the indication is a network-assisted indication.

[0170] In some embodiments, when the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

[0171] In some embodiments, when the relay terminal is within the coverage of the network, the instruction is used to determine to use a network-assisted secure connection establishment procedure between the first terminal and the second terminal.

[0172] In some embodiments, the indication is used to indicate support for, or use of, a network-assisted secure connection establishment procedure.

[0173] In some embodiments, when the relay terminal is not within the network coverage, the indication is used to determine to use a secure connection establishment procedure without network assistance between the first terminal and the second terminal.

[0174] In some embodiments, when the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or when the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, an indication is used to determine the use of a network-assisted secure connection establishment process between a first terminal and a second terminal.

[0175] In some embodiments, the second terminal 800 further includes: an initiating module 8200 configured to initiate a network-assisted secure connection establishment process to the relay terminal when the instruction is used to determine to use a network-assisted secure connection establishment process.

[0176] In some embodiments, the initiating module 8200 is further configured to send a direct communication request to the relay terminal, wherein the direct communication request is used to initiate a network-assisted secure connection establishment process to the relay terminal.

[0177] In some embodiments, the direct communication request includes a subscription encryption identifier SUCI of the end terminal or a proximity communication remote user key identifier PRUK ID of a control plane or a user plane.

[0178] In some embodiments, when the indication indicates that the network-assisted secure connection establishment process is not supported or is not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

[0179] In some embodiments, the indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

[0180] In some embodiments, the second terminal 800 also includes: a first determination module 8300, which is configured to determine whether to use a network-assisted security connection establishment process based on the terminal terminal's support for the use of a network-assisted security connection establishment process, at least one of the terminal terminal's security policies, and an indication, wherein the security policy includes a priority of the network-assisted security connection establishment process.

[0181] In some embodiments, the first determination module 8300 is further configured to determine to use a network-assisted security connection establishment process when the indication indicates that the relay terminal is within network coverage or supports at least one of network-assisted security connection establishment processes, and when the terminal supports the network-assisted security connection establishment process and the security policy indicates that the priority of using the network-assisted security connection establishment process is higher than the priority of using a non-network-assisted security connection establishment process.

[0182] In some embodiments, the first determination module 8300 is further configured to determine to use a security connection establishment process without network assistance or to ignore the discovery message when the indication indicates that the relay terminal is within network coverage or supports at least one of network-assisted security connection establishment processes, and the end terminal does not support the network-assisted security connection establishment process, and the security policy indicates that the priority of using a network-assisted security connection establishment process is lower than the priority of using a security connection establishment process without network assistance.

[0183] In some embodiments, the first determination module 8300 is further configured to determine to use a non-network-assisted secure connection establishment process when the indication indicates that the relay terminal is out of network coverage or does not support at least one of the network-assisted secure connection establishment processes.

[0184] In some embodiments, the first terminal is a source end terminal and the second terminal is a relay terminal.

[0185] In some embodiments, the indication is used to indicate a preference of the source end terminal as to whether to use a network-assisted secure connection establishment procedure.

[0186] In some embodiments, the second terminal 800 also includes: a second determination module 8400, which is configured to determine whether to use a network-assisted security connection establishment process between the first terminal and the second terminal based on whether the relay terminal supports the network-assisted security connection establishment process when an indication indicates that the source terminal prefers to use the network-assisted security connection establishment process.

[0187] In some embodiments, whether the relay terminal supports the network-assisted secure connection establishment process is determined based on at least one of whether the relay terminal is within network coverage and whether it is authorized by the network to use the network-assisted secure connection establishment process.

[0188] In some embodiments, the second determination module 8400 is further configured to determine to use the network-assisted security connection establishment process when the indication indicates that the source end terminal prefers to use the network-assisted security connection establishment process and the relay terminal supports the network-assisted security connection establishment process; and to determine to use the non-network-assisted security connection establishment process or to ignore the discovery message when the indication indicates that the source end terminal prefers to use the network-assisted security connection establishment process and the relay terminal does not support the network-assisted security connection establishment process.

[0189] In some embodiments, the second determination module 8400 is further configured to determine to use a secure connection establishment procedure without network assistance when the indication indicates that the source end terminal prefers to use a secure connection establishment procedure without network assistance.

[0190] In some embodiments, the indication is located in the relay service code, or the indication is a newly added indication in the discovery message.

[0191] In some embodiments, the establishment process using the network-assisted secure connection establishment process is a PC5 secure connection establishment process.

[0192] In some embodiments, the discovery message also carries information about the network assistance type, where the network assistance type includes control plane network assistance and user plane network assistance.

[0193] In some embodiments, the terminal-to-terminal relay communication is a terminal-to-terminal relay communication of 5G proximity communication.

[0194] Reference below Fig. 9 An embodiment of the connection establishment system of the present invention is described.

[0195] Fig. 9 FIG. 2 shows a schematic diagram of the structure of a connection establishment system according to some embodiments of the present invention. Fig. 9 As shown, the establishment system 90 of this embodiment includes: a first terminal 700; and a second terminal 800.

[0196] Fig.10 FIG. 2 shows a schematic diagram of the structure of a terminal according to some embodiments of the present invention. Fig.10 As shown, the terminal 100 of this embodiment includes: a memory 1010 and a processor 1020 coupled to the memory 1010 , and the processor 1020 is configured to execute the connection establishment method in any one of the aforementioned embodiments based on instructions stored in the memory 1010 .

[0197] The memory 1010 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0198] Fig.11 FIG. 2 shows a schematic diagram of the structure of a terminal according to some other embodiments of the present invention. Fig.11 As shown, the terminal 110 of this embodiment includes: a memory 1110 and a processor 1120, and may also include an input / output interface 1130, a network interface 1140, a storage interface 1150, etc. These interfaces 1130, 1140, 1150 and the memory 1110 and the processor 1120 may be connected, for example, via a bus 1160. Among them, the input / output interface 1130 provides a connection interface for input / output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 1140 provides a connection interface for various networked devices. The storage interface 1150 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0199] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the program implements any of the aforementioned connection establishment methods when executed by a processor.

[0200] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0201] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0202] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0203] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0204] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a first terminal sends a discovery message carrying an indication to a second terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal; when the relay terminal is not within the network coverage, the indication is used to determine a process for establishing a secure connection without network assistance between the first terminal and the second terminal.

2. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a first terminal sends a discovery message carrying an indication to a second terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; Among them, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal. When the indication indicates that a network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

3. The connection establishment method according to claim 1 or 2, wherein: In a case where the relay terminal is within network coverage, the indication is a network-assisted indication.

4. The connection establishment method according to claim 3, wherein: In the case where the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

5. The connection establishment method according to claim 1 or 2, wherein: In a case where the relay terminal is within network coverage, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

6. The connection establishment method according to claim 5, wherein: The indication is used to indicate support for or use of a network-assisted secure connection establishment procedure.

7. The connection establishment method according to claim 1 or 2, wherein: In the case where the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or in the case where the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, the indication is used to determine the use of a network-assisted secure connection establishment process between the first terminal and the second terminal.

8. The connection establishment method according to claim 6, further comprising: In a case where the indication indicates support for or use of the network-assisted secure connection establishment process, a network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

9. The connection establishment method according to claim 1 or 2, wherein: The indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

10. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a first terminal sends a discovery message carrying an indication to a second terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a source terminal, the second terminal is a relay terminal, and the indication is used to indicate the preferred selection of the source terminal for whether to use a network-assisted secure connection establishment process.

11. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a second terminal receives a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal. When the relay terminal is not within the network coverage, the indication is used to determine a process for establishing a secure connection without network assistance between the first terminal and the second terminal.

12. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a second terminal receives a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; Among them, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal. When the indication indicates that a network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

13. The connection establishment method according to claim 11 or 12, wherein: In a case where the relay terminal is within network coverage, the indication is a network-assisted indication.

14. The connection establishment method according to claim 13, wherein: In the case where the indication is a network-assisted indication, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

15. The connection establishment method according to claim 11 or 12, wherein: In a case where the relay terminal is within network coverage, the indication is used to determine to use a network-assisted secure connection establishment process between the first terminal and the second terminal.

16. The connection establishment method according to claim 15, wherein: The indication is used to indicate support for or use of a network-assisted secure connection establishment procedure.

17. The connection establishment method according to claim 11 or 12, wherein: In the case where the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, or in the case where the relay terminal is within network coverage and the relay terminal is authorized by the network to use a network-assisted secure connection establishment process, the indication is used to determine the use of a network-assisted secure connection establishment process between the first terminal and the second terminal.

18. The connection establishment method according to claim 11 or 12, further comprising: In a case where the indication is used to determine to use the network-assisted secure connection establishment process, the end terminal initiates the network-assisted secure connection establishment process to the relay terminal.

19. The connection establishment method according to claim 18, wherein: The process of the end terminal initiating the network-assisted secure connection establishment to the relay terminal includes: The end terminal sends a direct communication request to the relay terminal, wherein the direct communication request is used to initiate the network-assisted secure connection establishment process to the relay terminal.

20. The connection establishment method according to claim 19, wherein: The direct communication request includes a subscription encryption identifier SUCI of the terminal, or a proximity communication remote user key identifier PRUK ID of a control plane or a user plane.

21. The connection establishment method according to claim 11 or 12, wherein: The indication is used to indicate at least one of whether the relay terminal is within network coverage, whether a network-assisted secure connection establishment process is supported, and whether a network-assisted secure connection establishment process is used.

22. The connection establishment method according to claim 21, further comprising: The terminal determines whether to use the network-assisted secure connection establishment process based on the terminal's support for the network-assisted secure connection establishment process, at least one of the terminal's security policies, and the indication, wherein the security policy includes a priority for the network-assisted secure connection establishment process.

23. The connection establishment method according to claim 22, wherein: The terminal terminal determines whether to use the network-assisted secure connection establishment process according to the terminal terminal's support for the network-assisted secure connection establishment process, at least one of the security policies of the terminal terminal, and the indication, including: When the indication indicates that the relay terminal is within the network coverage or supports at least one of the network-assisted security connection establishment processes, and when the terminal supports the network-assisted security connection establishment process and the security policy indicates that the priority of using the network-assisted security connection establishment process is higher than the priority of using the non-network-assisted security connection establishment process, the terminal determines to use the network-assisted security connection establishment process.

24. The connection establishment method according to claim 22, wherein: The terminal terminal determines whether to use the network-assisted secure connection establishment process according to the terminal terminal's support for the network-assisted secure connection establishment process, at least one of the security policies of the terminal terminal, and the indication, including: When the indication indicates that the relay terminal is within the network coverage or supports at least one of the network-assisted security connection establishment procedures, and the terminal does not support the network-assisted security connection establishment procedure, and the security policy indicates that the priority of using the network-assisted security connection establishment procedure is lower than the priority of using the non-network-assisted security connection establishment procedure, the terminal determines to use the non-network-assisted security connection establishment procedure or ignore the discovery message.

25. The connection establishment method according to claim 22, wherein: The terminal terminal determines whether to use the network-assisted secure connection establishment process according to the terminal terminal's support for the network-assisted secure connection establishment process, at least one of the security policies of the terminal terminal, and the indication, including: In a case where the indication indicates that the relay terminal is out of network coverage or does not support at least one of the network-assisted secure connection establishment procedures, the end terminal determines to use a non-network-assisted secure connection establishment procedure.

26. A connection establishment method, comprising: In a discovery process of terminal-to-terminal relay communication, a second terminal receives a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a source terminal, the second terminal is a relay terminal, and the indication is used to indicate the preferred selection of the source terminal for whether to use a network-assisted secure connection establishment process.

27. The connection establishment method according to claim 26, further comprising: In a case where the indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment process, the relay terminal determines whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal based on whether the relay terminal supports the network-assisted secure connection establishment process.

28. The connection establishment method according to claim 26, further comprising: In a case where the indication indicates that the source terminal prefers to use a network-assisted secure connection establishment process, the relay terminal determines whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal based on at least one of whether the relay terminal is within network coverage and whether it is authorized by the network to use the network-assisted secure connection establishment process.

29. The connection establishment method according to claim 27, wherein: The process of determining whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal includes: In a case where the indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment procedure and the relay terminal supports the network-assisted secure connection establishment procedure, the relay terminal determines to use the network-assisted secure connection establishment procedure; In the case where the indication indicates that the source end terminal prefers to use a network-assisted secure connection establishment procedure and the relay terminal does not support the network-assisted secure connection establishment procedure, the relay terminal determines to use a non-network-assisted secure connection establishment procedure or ignores the discovery message.

30. The connection establishment method according to claim 26, further comprising: In a case where the indication indicates that the source end terminal prefers to use a secure connection establishment procedure without network assistance, the relay terminal determines to use a secure connection establishment procedure without network assistance.

31. The connection establishment method according to any one of claims 1, 2, 10, 11, 12, and 26, wherein: The indication is located in the relay service code, or the indication is a newly added indication in the discovery message.

32. The connection establishment method according to any one of claims 1, 2, 10, 11, 12, and 26, wherein: The process of establishing a secure connection using network assistance is a process of establishing a PC5 secure connection.

33. The connection establishment method according to any one of claims 1, 2, 10, 11, 12, and 26, wherein: The discovery message also carries information about a network assistance type, where the network assistance type includes control plane network assistance and user plane network assistance.

34. The connection establishment method according to any one of claims 1, 2, 10, 11, 12, and 26, wherein: The terminal-to-terminal relay communication is a terminal-to-terminal relay communication of 5G proximity communication.

35. A terminal, the terminal being a first terminal, comprising: a sending module configured to send a discovery message carrying an indication to a second terminal in a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal; when the relay terminal is not within the network coverage, the indication is used to determine a process for establishing a secure connection without network assistance between the first terminal and the second terminal.

36. A terminal, the terminal being a first terminal, comprising: a sending module configured to send a discovery message carrying an indication to a second terminal in a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; Among them, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal. When the indication indicates that a network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

37. A terminal, the terminal being a first terminal, comprising: a sending module configured to send a discovery message carrying an indication to a second terminal in a discovery process of terminal-to-terminal relay communication, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a source terminal, the second terminal is a relay terminal, and the indication is used to indicate the preferred selection of the source terminal for whether to use a network-assisted secure connection establishment process.

38. A terminal, the terminal being a second terminal, comprising: a receiving module configured to receive, in a discovery process of terminal-to-terminal relay communication, a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal; when the relay terminal is not within the network coverage, the indication is used to determine a process for establishing a secure connection without network assistance between the first terminal and the second terminal.

39. A terminal, the terminal being a second terminal, comprising: a receiving module configured to receive, in a discovery process of terminal-to-terminal relay communication, a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; Among them, the first terminal is a relay terminal, the second terminal is an end terminal, and the end terminal is a source end terminal or a target end terminal. When the indication indicates that a network-assisted secure connection establishment process is not supported or not used, a non-network-assisted secure connection establishment process is used between the relay terminal and the end terminal.

40. A terminal, the terminal being a second terminal, comprising: a receiving module configured to receive, in a discovery process of terminal-to-terminal relay communication, a discovery message carrying an indication from a first terminal, the indication being used to determine whether to use a network-assisted secure connection establishment process between the first terminal and the second terminal; The first terminal is a source terminal, the second terminal is a relay terminal, and the indication is used to indicate the preferred selection of the source terminal for whether to use a network-assisted secure connection establishment process.

41. A connection establishment system, comprising: The terminal according to any one of claims 35 to 37; as well as The terminal according to any one of claims 38 to 40.

42. A terminal, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the connection establishment method according to any one of claims 1 to 34 based on instructions stored in the memory.

43. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the connection establishment method according to any one of claims 1 to 34 is implemented.

Images