Information processing methods and apparatus, communication equipment and storage media

Abstract

This disclosure provides an information processing method and apparatus, a communication device, and a storage medium. The information processing method executed by a first UE may include: sending a first request message to a network device, wherein the first request message includes: identification information of the first UE; receiving a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the field of wireless communication technology, and particularly to an information processing method and apparatus, communication equipment and storage medium. Background Technology

[0002] Fifth generation mobile communication (5G) th 5G (Generation 5G) offers various services that may require the involvement of one or more User Equipment (UEs), rather than a single UE directly interacting with network devices. For example, two UEs can communicate directly via a sidelink (SL). This sidelink is typically based on the UE's PC5 interface. However, related research has revealed security issues with SL-based communication. Summary of the Invention

[0003] This disclosure provides an information processing method and apparatus, a communication device and a storage medium.

[0004] A first aspect of this disclosure provides an information processing method, executed by a first UE, the method comprising: sending a first request message, wherein the first request message includes: identification information of the first UE; receiving a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key being used by the first UE to establish a secure link.

[0005] A second aspect of this disclosure provides an information processing method, executed by a second UE, the method comprising: receiving a second request message, wherein the second request message includes: identification information of a source UE; sending a fourth request message according to the second request message; and receiving a fourth response message returned based on the fourth request message; wherein the fourth response message includes at least: a first key of the source UE, wherein the first key is used to establish a secure link.

[0006] A third aspect of this disclosure provides an information processing method, which is executed by a network device. The method includes: receiving and sending a first request message, wherein the first message includes: identification information of a first UE; returning a first response message based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used to establish a secure link.

[0007] A fourth aspect of this disclosure provides an information processing apparatus, comprising: a first sending module configured to send a first request message, wherein the first request message includes: identification information of a first UE; and a first receiving module configured to receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key being used to establish a secure link between the first UE and a second UE.

[0008] A fifth aspect of this disclosure provides an information processing apparatus, comprising: a second receiving module configured to receive a second request message, wherein the second request message includes: identification information of the source UE; a second sending module configured to send a fourth request message according to the second request message; the second receiving module is further configured to receive a fourth response message returned based on the fourth request message; wherein the fourth response message includes at least: a first key of the source UE, wherein the first key is used to establish a secure link.

[0009] A sixth aspect of this disclosure provides an information processing apparatus, comprising: a third receiving module configured to receive a first request message, wherein the first message includes: identification information of a first UE; and a third sending module configured to return a first response message based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key being used to establish a secure link.

[0010] A seventh aspect of this disclosure provides a communication device, including a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being executed by the processor, wherein when the processor executes the executable program, it performs an information processing method as provided in any one of the first to third aspects described above.

[0011] An eighth aspect of this disclosure provides a computer storage medium storing an executable program; the executable program, when executed by a processor, is capable of implementing the information processing method provided in any one of the first to third aspects.

[0012] A ninth aspect of this disclosure provides a communication system, including:

[0013] The first UE is configured to execute the information processing method provided by any of the aforementioned technical solutions in the first aspect;

[0014] The second UE is configured to execute the information processing method provided by any of the technical solutions in the second aspect mentioned above; the network device is configured to execute the information processing method provided by any of the technical solutions in the third aspect mentioned above.

[0015] The technical solution provided in this disclosure embodiment allows the first UE to send a first request message containing its own identification information. In this way, the first key used by the first UE to establish a secure link is generated separately based on the identification information of the first UE. Subsequently, the first UE can use this key to establish a secure link, thereby ensuring the communication security of the first UE.

[0016] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of embodiments of this disclosure.

[0018] Figure 1 This is a schematic diagram illustrating the structure of a wireless communication system according to an exemplary embodiment;

[0019] Figures 2A to 2G This is a schematic flowchart illustrating an information processing method performed by a first UE according to an exemplary embodiment;

[0020] Figures 3A to 3D This is a schematic flowchart illustrating an information processing method performed by a second UE according to an exemplary embodiment;

[0021] Figures 4A to 4D This is a schematic flowchart illustrating an information processing method performed by a network device according to an exemplary embodiment;

[0022] Figure 5A This is a flowchart illustrating an information processing method according to an exemplary embodiment;

[0023] Figure 5B This is a flowchart illustrating an information processing method according to an exemplary embodiment;

[0024] Figure 6A This is a schematic diagram of the structure of an information processing apparatus according to an exemplary embodiment;

[0025] Figure 6B This is a schematic diagram of the structure of an information processing apparatus according to an exemplary embodiment;

[0026] Figure 7This is a schematic diagram of the structure of an information processing apparatus according to an exemplary embodiment;

[0027] Figure 8 This is a schematic diagram of the structure of a UE according to an exemplary embodiment;

[0028] Figure 9 This is a schematic diagram of the structure of a network device according to an exemplary embodiment. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this disclosure.

[0030] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. The singular forms "a," "say," and "this" used herein are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms used herein refer to and / or include any or all possible combinations of one or more associated listed items. It should be understood that although the terms first, second, third, etc., may be used to describe various information in this disclosure, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of this disclosure, and similarly, second information may also be referred to as first information. Depending on the context, words used herein may be interpreted as meaning "when," "when," or "in response to a determination."

[0031] Please refer to Figure 1 This illustration shows a schematic diagram of the structure of a wireless communication system provided in an embodiment of this disclosure. Figure 1 As shown, the wireless communication system is a communication system based on cellular mobile communication technology. The wireless communication system may include: several UEs 11 and several access devices 12.

[0032] UE 11 can be a device that provides voice and / or data connectivity to a user. UE 11 can communicate with one or more core networks via a Radio Access Network (RAN). UE 11 can be an IoT terminal, such as a sensor device, a mobile phone (or cellular phone), or a computer with an IoT terminal, for example, a fixed, portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted device. Examples include a station (STA), subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, remote terminal, access terminal, user terminal, user agent, user device, or user equipment. Alternatively, UE 11 can also be a device for an unmanned aerial vehicle (UAV). Alternatively, UE 11 can also be a vehicle-mounted device, such as a vehicle computer with wireless communication capabilities, or a wireless communication device connected to an external vehicle computer. Alternatively, UE 11 can also be a roadside device, such as a street light, traffic light, or other roadside device with wireless communication capabilities.

[0033] Access device 12 can be a network device in a wireless communication system. This wireless communication system can be a fourth-generation mobile communication (4G) system, or it can be the next generation after 5G. In a 5G system, the access network can be called NG-RAN (New Generation-Radio Access Network), or an MTC system.

[0034] The access device 12 can be an evolved NB (eNB) used in a 4G system. Alternatively, the access device 12 can also be a gNB (gNB) using a centralized-distributed architecture in a 5G system. When the access device 12 adopts a centralized-distributed architecture, it typically includes a central unit (CU) and at least two distributed units (DUs). The central unit is equipped with a protocol stack of the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control (RLC) layer, and the Media Access Control (MAC) layer; the distributed units are equipped with a physical (PHY) layer protocol stack. This disclosure does not limit the specific implementation of the access device 12.

[0035] A U2U Proximity Services (ProSe) service has been proposed in 5G communication systems, allowing communication between a source User Equipment (UE) and a target UE via a User Equipment to User Equipment (U2U) relay. This means that if the source UE cannot directly reach the target UE, it will attempt to discover a U2U relay to reach the target UE. In other words, the source UE discovers and communicates with the target UE through a U2U relay. However, as an untrusted node, the U2U relay may be compromised, thus compromising the security of information between the peer UEs. A malicious U2U relay can establish unicast connections with both the source and target UEs, and launch a Man-in-the-Middle Attack (MITM) attack on the source and / or target UEs, jeopardizing fifth-generation mobile communication (5G). thSecurity of Generation 5G U2U Proximity Services (ProSe). 5G ProSe supports U2U relay, accommodating both Layer 2 (L) and Layer 3 (L3) U2U relay options. For L3 U2U relay, the source UE's PC5 Packet Data Convergence Protocol (PDCP) message must be converted into another PC5 PDCP message sent to the target UE. Therefore, with the presence of U2U relay, secure one-to-one PC5 communication between the source and target UEs cannot be established. The source and target UEs communicate indirectly via U2U relay, connected by two PC5 links: one between the source UE and the U2U relay, and another between the U2U relay and the target UE. This means that secure communication between the source and target UEs depends on the security protection of each PC5 link.

[0036] The first UE may include, but is not limited to, at least one of the following:

[0037] The source UE and / or target UE of the relay service, which includes, but is not limited to, the U2U ProSe service;

[0038] The reference UE and target UE of the ranging service (Ranging / Sidelink positioning service); the source UE of the ranging service can be the UE requesting ranging or the reference UE; the target UE of the ranging service can be the UE being measured.

[0039] The second UE may include, but is not limited to, at least one of the following:

[0040] U2U trunking for trunking services, such as U2U ProSe service U2U trunking.

[0041] Auxiliary UE for ranging UE.

[0042] Network devices may include any device located on the network side. For example, network devices include, but are not limited to, core network devices, which include, but are not limited to: the proximity key management function entity (PKMF) and / or the direct discovery name management function (DDNMF) of the first UE and / or the second UE. The PKMF is responsible for handling key management and providing security parameters. The DDNMF is responsible for providing security parameters during the discovery phase.

[0043] The UE's identification information can be any information that identifies the UE, such as User Info ID, Internet Protocol (IP) address, or the UE's Restricted ProSe Application User ID (RPAUID), Prose Remote User Key ID (PRUK ID), Subscription Concealed Identifier (SUCI), etc.

[0044] User information identifiers may include an application-layer identifier. For example, the format of the User Info ID may be the same as the Network Access Identifier (NAI) format, or it may be a 64-bit string. If the User Info ID is in NAI format, i.e., username@realm for example, ealm should include the UE's home network identifier. This home network identifier may be the identifier of the Home Public Land Mobile Network (HPLMN).

[0045] A secure link is one where all messages established using this link are protected by keys according to a security policy. Security protection may include, but is not limited to, confidentiality protection and integrity protection. Definitions of confidentiality and / or integrity protection can be found in relevant technical documents. The aforementioned secure links include, but are not limited to, PC5 links or SR5 links.

[0046] The service code can be used to identify a service, including but not limited to Relay Service Code (RSC) or Proximity Service Code (ProSe Code).

[0047] like Figure 2A As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0048] S1110: Send a first request message, wherein the first request message includes: the identification information of the first UE;

[0049] S1120: Receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link.

[0050] For example, the first request message could be a ProSe key request message.

[0051] The identification information of the first UE here can be any information that identifies the first UE. For example, the first UE's user information ID, network protocol (IP) address, or device identifier, etc. In short, the identification information of the first UE can be any information that can identify the first UE. The user information ID can be an application layer identifier.

[0052] The first key carried in the first request message can be used by the network device to generate a first key for its own use for the first UE.

[0053] The first response message can be any message returned based on the first request message. The peer device receiving the first request message can be the peer device that generated the first key, including but not limited to network devices and / or servers for the pre-defined service.

[0054] The first response message may include the first key.

[0055] The first key can be used in the link establishment message between the first UE and other UEs, thereby enabling the first UE to establish a secure link.

[0056] For example, the first key may be a root key or an intermediate key, which can be used to derive a session key for message interaction. For example, the first key may be a Prose Remote User Key (PRUK).

[0057] The security protections here include, but are not limited to: integrity protection and / or confidentiality protection.

[0058] In this embodiment of the disclosure, a secure link refers to a link established by using a key for security protection of all messages. In this embodiment, the first key can be directly used for establishing the secure link, or it can be used for key derivation of the key used during the establishment of the secure link.

[0059] For example, the other UE can be a second UE. The second UE can be any UE different from the first UE. For instance, the establishment of a secure link between the first UE and the second UE is based on the PC5 interface. That is, the secure link can be a secure PC5 link or an SR5 link.

[0060] In this way, the first UE can establish a secure link between the first UE and the second UE by exchanging information with the network device.

[0061] For example, such as Figure 2B As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0062] S1210: Send a first request message to the network device, wherein the first request message includes: the identification information of the first UE;

[0063] S1220: Receive a first response message returned by the network device, wherein the first response message includes: a first key generated based on the identification information of the first UE; the first key is used to establish a secure link between the first UE and the second UE.

[0064] The first request message can be any message sent by the first UE to the network device.

[0065] For example, a network device can provide key management and / or security parameter related services to multiple UEs. However, after each UE sends a first request message containing its own identification information, the network device can generate its own first key for each of these UEs.

[0066] For example, the first request message may further include a service code, so that the network device or other peer device generates a first key for the service identified by the service code for the first UE. After receiving the first request message, the network device will return a first response message, which may include at least a key for establishing a secure link between the first UE and the second UE.

[0067] In some embodiments, the first response message further includes: an identifier of the first key. For example, the first key has an identifier (ID).

[0068] In this embodiment of the disclosure, the ID of the first key is an optional part of the first response message.

[0069] If the first request message is the aforementioned Proximity Service Key Request Message, then the first response message can be a Proximity Service Key Response Message (ProSe key response).

[0070] It is worth noting that: Figure 2C The illustrated embodiments can be executed individually or in combination. Figure 2A Any of the embodiments can be combined for execution.

[0071] like Figure 2CAs shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0072] S1310: Send a first request message, wherein the first request message includes: the identification information of the first UE;

[0073] S1320: Receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link.

[0074] S1330: In response to the first UE being the source UE, a second request message is sent, wherein the second request message includes: the identification information of the first UE; the second request message is used to request the establishment of a secure link.

[0075] In one embodiment, the second request message may include an identifier of the source UE. In another embodiment, the second request message may further include an identifier of the target UE.

[0076] The receiving end of the second request message can be any device that assists in communication between the source UE and the target UE.

[0077] The first key of the source UE can be used at least to establish a secure link between the source UE and the peer receiving the second request message.

[0078] It is worth noting that: Figure 2C The illustrated embodiments can be executed individually or in combination. Figure 2A as well as Figure 2B Any of the embodiments can be combined for execution.

[0079] like Figure 2D As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0080] S1410: Send a first request message to the network device, wherein the first request message includes: the identification information of the first UE;

[0081] S1420: Receive a first response message returned by the network device, wherein the first response message includes: a first key generated based on the identification information of the first UE; the first key is used by the first UE to establish a secure link.

[0082] S1430: In response to the first UE being the source UE, a second request message is sent, wherein the second request message includes: the identification information of the first UE; the second request message is used to request the establishment of a secure link.

[0083] In this embodiment of the disclosure, since the first UE is the source UE of the U2U relay or the source UE that initiates the ranging service, after receiving the first key, it can broadcast a second request message when there is a U2U relay service requirement or a ranging requirement.

[0084] The second request message will include the source UE's own identification information and the target UE's identification information.

[0085] Thus, after any UE that can act as a second UE receives the broadcast second request message, it determines whether it can act as a U2U relay between the source UE and the target UE, or whether it can assist in ranging between the source UE and the target UE.

[0086] In some embodiments, the second request message includes, but is not limited to, a Direct Communication Request message.

[0087] If the first response message includes the ID of the first key, then the second request message may also include the ID of the first key.

[0088] In some embodiments, the second request message may further include a service code, which indicates the service requested by the source UE.

[0089] For example, the service code could be a Relay Service Code (RSC), in which case the source UE could be the source UE of a U2U relay. As another example, the service code could also be a Ranging Service Code (RSC), in which case the source UE could be the UE initiating the ranging or the UE at the starting position of the measured location. Yet another example, the service code could also be a Proximity Service Code (ProSe Code), in which case the source UE could be the source UE of a U2U relay.

[0090] It is worth noting that: Figure 2D The illustrated embodiments can be executed individually or in combination. Figure 2A as well as Figure 2B Any combination thereof is executed.

[0091] like Figure 2E As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0092] S1510: Send a first request message, wherein the first request message includes: the identification information of the first UE;

[0093] S1520: Receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link.

[0094] S1530: In response to the first UE being the source UE, a second request message is sent, wherein the second request message includes: the identification information of the first UE;

[0095] S1540: Receive a first specified message returned based on the second request message, wherein the first specified message is securely protected using a second key; the second key is generated based on a first intermediate key; wherein the first intermediate key is generated based on the first key;

[0096] S1550: Generate a second intermediate key based on the first key;

[0097] S1560: Generate a third key based on the second intermediate key;

[0098] S1570: Use the third key to perform security verification on the first designated message;

[0099] S1580: Determine whether to establish a secure link based on whether the first specified message passes security verification.

[0100] In the above embodiments, the first specified information may be a request message sent by the second UE. If the second UE is present in the vicinity of the first UE, the second UE will return the first specified information to the first UE after receiving the first request message.

[0101] The first specified message may include, but is not limited to, the Direct Security mode Command.

[0102] The first key may be a root key. The network device will derive or infer a first intermediate key based on the first key. The first intermediate key may include, but is not limited to, a new radio PC5 key (Knrp).

[0103] Both the second key and the third key are session keys. The session key may include: a confidentiality key for confidentiality protection, for example, for message encryption and decryption; and / or an integrity protection key for message integrity protection.

[0104] Thus, the first UE can generate the third key at once based on the first key, or, like a network device, it can first generate an intermediate key and then generate the third key based on the intermediate key.

[0105] After generating the third key, the first specified message is used to perform security verification, including but not limited to confidentiality verification and / or integrity verification.

[0106] If both confidentiality verification and integrity verification of the first specified message are required, the third key used for confidentiality verification and integrity verification can be the same or different. If the keys used for confidentiality verification and integrity verification are different, the security of the first specified message and the established link are further enhanced.

[0107] It is worth noting that: Figure 2E The illustrated embodiments can be executed individually or in combination. Figures 2A to 2D Any combination thereof is executed.

[0108] In some embodiments, the method further includes: sending a first request message to a network device, wherein the first request message includes: identification information of the first UE; receiving a first response message returned by the network device, wherein the first response message includes: a first key; the first key is used to establish a secure link between the first UE and a second UE; in response to the first UE being the source UE, sending a second request message, wherein the second request message includes: identification information of the first UE and identification information of a target UE; the identification information of the first UE is used for the second UE to obtain a key for establishing a secure link with the first UE; the identification information of the target UE is used for the second UE to obtain a key for connecting with the secure UE; receiving a first designated message returned by the second UE, wherein the first designated message uses a second key for security protection; the second key is generated based on a first intermediate key; wherein the first intermediate key is generated based on the first key; generating a second intermediate key based on the first key; generating a third key based on the second intermediate key; using the third key to perform security verification on the first designated message; and determining whether to establish a secure link based on whether the first designated message passes the security verification.

[0109] In some embodiments, determining whether to establish a secure link with the second UE based on whether the first specified message passes security verification includes: determining to establish a secure link with the second UE when the security verification passes; and / or, refusing to establish a secure link with the second UE when the security verification fails.

[0110] If the security verification passes, the first UE can send a message to the second UE indicating that a secure link has been established. This message includes, but is not limited to, a Direct Security Mode Complete message, indicating that the secure link has been successfully established. If the security verification fails, the first UE will not send a message indicating that a secure link has been established to the second UE. For example, it may not send the Direct Security Mode Complete message to the second UE.

[0111] In some embodiments, the second request message includes: a first fresh value; wherein the first fresh value is used to generate the first intermediate key after being provided by the second UE to the network device.

[0112] The first freshness value is provided by the first UE. For example, since the first key can be repeatedly used to generate session keys, a freshness parameter is introduced when generating intermediate keys to ensure that the generated session keys are different. The first freshness value may be related to the number of times the first UE generates the second intermediate key, or to the number of times the first UE initiates the generation of the second intermediate key. Thus, the first and second intermediate keys generated in different iterations will be different. Similarly, the first freshness value can also be used by the first UE itself to generate the second intermediate key. For example, the second UE locally generates the first intermediate key based on the first key provided by the network device and the first freshness value.

[0113] In some embodiments, the second request message may not contain the first fresh value, in which case both the first UE and the second UE can generate the first intermediate key and the second intermediate key respectively based on the first key obtained from the network device.

[0114] In one embodiment, the second request message includes a first random number, wherein the first random number and the second intermediate key are used together by the first UE to generate the third key. The first random number can be used to generate a session key. A first fresh value and a first key are used to generate a second intermediate key, and the first UE then combines the second intermediate key and the first random number to generate the third key. Since the second request message is sent directly to the second UE, after receiving the second request message, the second UE can generate the second key based on the first random number carried in the second request message and its own generated first intermediate key.

[0115] In this embodiment of the disclosure, the key generation algorithm may be an algorithm from the relevant technology, for example, it may be generated according to the algorithm agreed upon in the protocol, which will not be repeated here.

[0116] In some embodiments, the first designated message further includes: a second fresh value; wherein the second fresh value is further used by the network device to generate the first intermediate key; and the second fresh value is further used by the first UE to generate a second intermediate key.

[0117] When the second UE requests the first key from the network device, the network device also sends a second fresh value to the second UE. This second fresh value can also be used to generate the first intermediate key and the second intermediate key. For example, in one embodiment, the first UE and the second UE only need one fresh value to generate the first intermediate key and the second intermediate key, respectively. This fresh value comes from either the first UE or the network device, i.e., the aforementioned second fresh value. Alternatively, the first UE and the second UE need two fresh values ​​to generate the first intermediate key and the second intermediate key, namely the aforementioned first fresh value and the second fresh value. The second fresh value is carried in plaintext in the first designated message. Thus, after receiving the first designated message, the first UE can directly extract the second fresh value, generate the third key, and use the third key to perform security verification on the first designated message.

[0118] In one embodiment, the first designated message further includes: a second random number; the second random number and the second intermediate key are used for the first UE to generate the third key.

[0119] Due to the introduction of the first and second random numbers, even if the first UE and the second UE generate the second and third keys based on the same intermediate key, the second and third keys generated this time will be different as long as either the first or the second random number changes.

[0120] like Figure 2F As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0121] S1610: Send a first request message, wherein the first request message includes: the identification information of the first UE;

[0122] S1620: Receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link;

[0123] S1630: In response to the first UE being the target UE, a third request message is received; wherein, the third request message includes: a third freshness value;

[0124] S1640: Generate a third intermediate key based on the third freshness value and the first key;

[0125] S1650: Generate a fourth key based on the third intermediate key;

[0126] S1660: Send a second specified message that uses the fourth key for security protection.

[0127] If the first UE is the target UE, the first UE will first receive the third request message sent by the second UE. The third request message may include, but is not limited to, a direct communication request message.

[0128] The third request message may include a third fresh value received by the communication peer or from another device. This third information value may be any parameter value used to update the intermediate key corresponding to the target UE.

[0129] In this way, the target UE can establish a secure link based on the third intermediate key generated from the first key, and then based on the fourth key.

[0130] In another embodiment, the third request message may further include a fourth fresh value. If the third request message includes a third fresh value and a fourth fresh value, then a third intermediate key and a fourth intermediate key are generated based on the third fresh value and the fourth fresh value, respectively.

[0131] After generating the third intermediate key, a fourth key is generated by combining one or more random numbers.

[0132] After using the fourth key to protect the confidentiality and / or integrity of the second designated message, the second designated message is then sent to the second UE.

[0133] The second specified message may include, but is not limited to, the Direct Security Mode Command.

[0134] In another embodiment, the third and fourth intermediate keys can be generated based solely on a fresh value, which may be a fourth fresh value provided by the second UE. After generating the third intermediate key, the fourth key is further generated by combining it with one or more random numbers.

[0135] It is worth noting that: Figure 2F The illustrated embodiments can be executed individually or in combination. Figures 2A to 2E Any combination thereof is executed.

[0136] like Figure 2G As shown, this disclosure provides an information processing method, which is executed by a first UE, the method comprising:

[0137] S1710: Send a first request message to the network device, wherein the first request message includes: the identification information of the first UE;

[0138] S1720: Receive a first response message returned by the network device, wherein the first response message includes: a first key; the first key is used to establish a secure link between the first UE and the second UE;

[0139] S1730: In response to the first UE being the target UE, a third request message sent by the second UE is received; wherein, the third request message includes: a third fresh value provided by the network device;

[0140] S1740: Generate a third intermediate key based on the third freshness value and the first key;

[0141] S1750: Generate a fourth key based on the third intermediate key;

[0142] S1760: Send a second specified message to the second UE, which uses the fourth key for security protection.

[0143] After receiving the third request message, the third fresh value is extracted from the third request message, and the third intermediate key is generated by combining the third fresh value with the first key.

[0144] In another embodiment, the third request message may further include a fourth fresh value, which may be provided by the second UE. If the third request message includes a third fresh value and a fourth fresh value, then the first UE and the second UE generate a third intermediate key and a fourth intermediate key respectively based on the third fresh value and the fourth fresh value.

[0145] In one embodiment, the third freshness value is used to generate a fourth intermediate key; wherein the fourth intermediate key is used to generate a fifth key for verifying the second specified message.

[0146] For example, the third freshness value is used by the network device to generate a fourth intermediate key; wherein, the fourth intermediate key is used by the second UE to generate a fifth key to verify the second specified message.

[0147] For example, the third request message includes: a third random number; the third random number is used by the first UE to generate the fourth key and by the second UE to generate the fifth key.

[0148] The third random number can be generated by the second UE.

[0149] The second specified message includes at least: a fourth random number;

[0150] The fourth random number is used to generate the fourth key for the first UE and the fifth key for the second UE. That is, both the fourth key and the fifth key can be generated based on the third and fourth random numbers.

[0151] It is worth noting that: Figure 2G The illustrated embodiments can be executed individually or in combination. Figures 2A to 2F Any combination thereof is executed.

[0152] like Figure 3A As shown, this disclosure provides an information processing method, which is executed by a second UE, the method comprising:

[0153] S2110: Receive a second request message, wherein the second request message includes: the identification information of the source UE;

[0154] S2120: Send a fourth request message according to the second request message;

[0155] S2130: Receive a fourth response message returned based on the fourth request message; wherein the fourth response message includes at least: the first intermediate key of the source UE, wherein the first intermediate key of the source UE is used to establish a first secure link.

[0156] The second UE can receive a second request message forwarded by the source UE or other devices, and the second request message contains at least the identification information of the source UE.

[0157] The fourth request message contains the identification information of the source UE, which can be used to query the first key of the source UE generated based on the identification information of the source UE, or to query the first key bound to the identification information of the source UE and generate a first intermediate key based on the first key.

[0158] If the second UE is authorized to participate in the pre-defined service, it will receive a fourth response message carrying the first intermediate key of the source UE.

[0159] After receiving the first intermediate key from the source UE, the first secure link can be established with the source UE. A description of the secure link can be found in any of the foregoing embodiments. That is, the first secure link includes, but is not limited to, a secure link between the source UE and the second UE.

[0160] The pre-defined service may be a U2U relay service and / or a ranging service, etc. For example, the second UE may be a U2U relay for a U2U relay service or an auxiliary UE for a ranging UE.

[0161] If the second UE is not authorized to participate in the pre-defined service, the received fourth response message may be a rejection message, and the rejection message does not contain the first intermediate key of the source UE.

[0162] For example, such as Figure 3B As shown, this disclosure provides an information processing method, which is executed by a second UE, the method comprising:

[0163] S2210: Receive a second request message sent by the source UE, wherein the second request message includes: the identification information of the source UE and the identification information of the target UE;

[0164] S2220: Send a fourth request message to the network device according to the second request message;

[0165] S2230: Receive a fourth response message returned by the network device; wherein the fourth response message includes at least a first key of the first UE; the first key of the first UE is used to establish a first secure link.

[0166] The second UE will receive a second request message sent by the source UE, which can be the first UE provided by any of the aforementioned technical solutions.

[0167] After receiving the second request message from the source UE, the second UE will request the first intermediate key of the source UE and the fourth intermediate key corresponding to the target UE from the network device side based on the identifier of the source UE and the identifier of the target UE contained in the second request message. For example, the identifier information of the source UE will be carried in the fourth request message.

[0168] The identification information of the source UE may include user information identifier, IP address, or other identification information.

[0169] In some cases, the fourth request message in any of the above embodiments may also include the service code of the pre-booked service.

[0170] For example, if the second UE is authorized to provide a predetermined service to the source UE and the target UE, then the fourth response message may include at least: the first intermediate key of the source UE.

[0171] The first key can be used to establish a secure link between the second UE and the source UE. This secure link is a PC5 / SR5 link, or a PC5 / SR5 link, where messages are securely protected during link establishment. The PC5 link or SR5 link is based on a PC5 interface.

[0172] In some embodiments, the second request message includes: a first freshness value;

[0173] The first fresh value is used to generate a first intermediate key; wherein, the first intermediate key is used to generate a second key for establishing a secure connection.

[0174] For example, after the first fresh value is sent to the network device in the fourth request message, it is used by the network device to generate a first intermediate key; wherein, the first intermediate key is used by the second UE to generate a second key to establish a secure connection with the first UE.

[0175] In some embodiments, the second request message further includes: a first random number; the first random number is used to generate the second key and the third key.

[0176] The second and third keys here are both session keys.

[0177] The session key may include: an integrity protection key and / or a confidentiality protection key.

[0178] For example, the first random number is used by the second UE to generate the second key in combination with the first intermediate key.

[0179] For example, the first random number is also used by the source UE to generate a third key in combination with the second intermediate key.

[0180] It is worth noting that if no message has been tampered with, and both the source UE and the second UE are legitimate UEs, then the first intermediate key and the second intermediate key should be the same, and the second key and the third key will also be the same.

[0181] In some embodiments, the method further includes:

[0182] Based on the fourth response message, send the first specified message.

[0183] The first designated message can be the aforementioned direct connection security mode command message.

[0184] Exemplarily, the method further includes:

[0185] According to the fourth response message, a first designated message is sent to the source UE.

[0186] The first designated message can be the aforementioned direct connection security mode command message.

[0187] For example, if the third response message includes the first key of the source UE, then the first specified information is sent to the source UE to continue establishing the first secure link with the source UE.

[0188] In some embodiments, the first specified message includes: a second fresh value; the second fresh value is used to generate a third key for verifying the security of the first specified message.

[0189] For example, the second fresh value is used by the source UE to generate a third key to verify the security of the first specified message.

[0190] This second fresh value can be a parameter generated by the network device.

[0191] In one embodiment, the first key and the second fresh value can be used as input parameters for generating the first intermediate key and the second intermediate key.

[0192] In another embodiment, the second request message includes a first fresh value. In this case, the first fresh value, the second fresh value, and the first key are used to generate a first intermediate key and a second intermediate key, respectively.

[0193] In some embodiments, the fourth response message includes: a first intermediate key generated by the network device; the first intermediate key is used by the second UE to generate the second key.

[0194] In some embodiments, the method further includes:

[0195] After the first designated message passes security verification, a first secure link is established.

[0196] For example, after the first designated message passes security verification, a first secure link is established with the source UE.

[0197] For example, if the first specified message passes the security verification, the second UE will receive the direct connection security mode completion message sent by the source UE.

[0198] In one embodiment, the second UE simultaneously establishes secure links with both the source UE and the target UE. However, to further ensure link security, in this embodiment, the second UE only initiates the establishment of a secure link with the target UE after successfully establishing a secure link with the source UE.

[0199] like Figure 3C As shown, this disclosure provides an information processing method, which is executed by a second UE, the method comprising:

[0200] S2310: Receive a second request message, wherein the second request message includes: the identification information of the source UE;

[0201] S2320: Send a fourth request message according to the second request message;

[0202] S2330: Receive a fourth response message returned based on the fourth request message; wherein the fourth response message includes at least: the first intermediate key of the source UE, wherein the first intermediate key of the source UE is used to establish a first secure link;

[0203] S2340: Send the first specified message according to the fourth response message;

[0204] S2350: After the first designated message passes security verification, a first secure link is established;

[0205] S2360: After the first secure link is established, a fifth request message is sent; wherein, the fifth request message includes: the identification information of the target UE;

[0206] S2370: Receive a fifth response message returned based on the fifth request message; wherein the fifth response message includes: the first key of the target UE; wherein the first key of the target UE is used to establish a second secure link.

[0207] If the second UE is authorized to participate in the pre-defined service, the fifth response message may include the first key of the target UE bound to the identification information of the target UE.

[0208] For example, the fifth request message may or may not include a fourth fresh value. The fourth fresh value may be provided by the second UE.

[0209] If the fifth request message includes a fourth fresh value, the fourth intermediate key generated by the network device will be generated based on the first key, the third fresh value, and the fourth fresh value of the target UE.

[0210] If the fifth request message does not contain the fourth fresh value, the network device generates the fourth intermediate key based on the third fresh value and the first key of the target UE.

[0211] It is worth noting that: Figure 3C The illustrated embodiments can be executed individually or in combination. Figures 3A to 3B Any combination thereof is executed.

[0212] like Figure 3D As shown, this disclosure provides an information processing method, which is executed by a second UE, the method comprising:

[0213] S2410: Receive a second request message sent by the source UE, wherein the second request message includes: the identification information of the source UE and the identification information of the target UE;

[0214] S2420: Based on the second request message, send a fourth request message to the network device; wherein the fourth request message includes at least: the identification information of the source UE;

[0215] S2430: Receive a fourth response message returned by the network device; wherein the fourth response message includes at least: the first key of the source UE; the first key of the source UE is used to establish a first secure link;

[0216] S2440: Send a first designated message to the source UE according to the fourth response message;

[0217] S2450: After the first designated message passes security verification, a first secure link is established with the source UE;

[0218] S2460: After establishing a first secure link with the source UE, a fifth request message is sent to the network device; wherein, the fifth request message includes: the identification information of the target UE;

[0219] S2470: Receive a fifth response message returned based on the fifth request message; wherein the fifth response message includes: the first key of the target UE; wherein the first key of the target UE is used for the second secure link between the second UE and the target UE.

[0220] In this embodiment of the disclosure, after the second UE and the target UE establish a secure link, a fifth request message is sent to the serving network device of the target UE (e.g., the target UE's PKMF or DDNMF). This fifth request message may include at least: the target UE's identification information. The target UE's identification information includes, but is not limited to, the target UE's user information identifier.

[0221] If the second UE is authorized to provide the predetermined service to the source UE and the target UE, the fifth response message will be an acceptance message; otherwise, it may be a rejection message. Alternatively, if the second UE is not authorized to provide the predetermined service to the source UE and the target UE, the second UE may not receive the rejection message.

[0222] In some embodiments, the fifth response message includes: a third fresh value; wherein the third fresh value is used for the target UE to generate a third intermediate key, and the third fresh value is also used for the network device to generate a fourth intermediate key;

[0223] The third intermediate key is used by the target UE to generate a fourth key for establishing a secure link with the second UE;

[0224] The fourth intermediate key is used by the second UE to generate a fifth key for establishing a secure link with the target UE.

[0225] If the above messages during the link establishment process are not tampered with during transmission, and both the target UE and the second UE are legitimate UEs, then the third and fourth intermediate keys should be the same, and the fourth and fifth keys should be the same.

[0226] It is worth noting that: Figure 3D The illustrated embodiments can be executed individually or in combination. Figures 3A to 3C Any combination thereof is executed.

[0227] In some embodiments, the method further includes: sending a third request message according to the fifth response message; receiving a second specified message returned based on the third request message; verifying the security of the second specified message using the fifth key; and determining whether to establish a second secure link based on the verification result of the security of the second specified message.

[0228] If the fifth response message contains the first key of the target UE, then the second UE will send a third request message, which may include, but is not limited to, a direct communication request message.

[0229] At this point, the second UE will receive a returned second specified message, which can also be considered a request message. This second specified message can be, but is not limited to, a Direct Security Mode Command message.

[0230] Of course, the direct connection communication request message, direct connection security mode command message, and direct connection security mode completion message mentioned in this embodiment can all be replaced with other messages that can perform the corresponding functions, such as specially set messages.

[0231] For example, the method further includes: sending a third request message to the target UE according to the fifth response message; receiving a second specified message returned by the target UE based on the third request message; verifying the security of the second specified message using the fifth key; and determining whether to establish a secure link with the target UE based on the verification result of the security of the second specified message.

[0232] If the fifth response message contains the first key of the target UE, the second UE will send a third request message to the target UE. The third request message may include, but is not limited to, a direct communication request message.

[0233] At this point, the target UE will return a second specified message, which can also be considered a request message. This second specified message can be, but is not limited to, a Direct Security Mode Command message.

[0234] Of course, the direct connection communication request message, direct connection security mode command message, and direct connection security mode completion message mentioned in this embodiment can all be replaced with other messages that can perform the corresponding functions, such as specially set messages.

[0235] The second UE locally generates a fifth key. Upon receiving the second specified message, it can perform security verification on the message, such as confidentiality and integrity verification. If the second specified message completes the security verification, the message is considered secure, and a secure link can be established. Therefore, the second UE sends a direct connection security mode completion message to the target UE, signifying that the second UE and the target UE have established a secure link.

[0236] That is, determining whether to establish a secure link with the target UE based on the security verification result of the second specified message includes: establishing a secure link with the target UE after the verification of the second specified message is passed using the fifth key.

[0237] like Figure 4A As shown, this disclosure provides an information processing method, which is executed by a network device, and the method includes:

[0238] S3110: Receive and send a first request message, wherein the first message includes: identification information of the first UE;

[0239] S3120: Return a first response message based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used to establish a secure link.

[0240] The network device can be any device, and the counterpart that interacts with the network device to exchange the above information can be the aforementioned first UE, but does not include the aforementioned first UE, and can also be the access device or / or relay device of the first UE.

[0241] The first request message may be a ProSe key request message. For example, the first key may include, but is not limited to, PRUK.

[0242] If the first request message is a proximity business key request message, then the first response message can be a proximity business key response message.

[0243] The first key is generated based on the identification information of the first UE. This may include: the identification information of the first UE can be used as an input parameter for generating the first key of the first UE, or the identification information of the first UE can be not used as an output parameter, but the first key is different for different UEs. For example, after the first key of the first UE is generated, it will be bound to the identification information of the first UE and stored in the network device accordingly.

[0244] The generation of the first key can provide the necessary key for establishing a secure link for a single UE. This first key can serve as the root key and / or intermediate key for establishing a secure link for the first UE.

[0245] like Figure 4B As shown, this disclosure provides an information processing method, which is executed by a network device, and the method includes:

[0246] S3210: Receive a first request message sent by the first UE, wherein the first message includes: the identification information of the first UE;

[0247] S3220: Return a first response message to the first UE, wherein the first response message includes: a first key; the first key is used by the first UE to establish a secure link.

[0248] In this embodiment of the disclosure, a network device such as PKMF or DDNMF will provide a first key to the first UE. This first key can be the root key or intermediate key for establishing a secure link between the first UE and other UEs (e.g., the second UE).

[0249] The second UE can be any UE that has established an L3 secure link with the first UE. For example, if the predetermined service is a U2U relay service, then the second UE can be a U2U relay. If the predetermined service is a ranging service, then the second UE can be an auxiliary UE.

[0250] like Figure 4C As shown, this disclosure provides an information processing method, which is executed by a network device, and the method includes:

[0251] S3310: Receive a first request message, wherein the first message includes: the identification information of the first UE;

[0252] S3220: Return a first response message based on the first request message, wherein the first response message includes: a first key; the first key is used to establish a first secure link;

[0253] S3230: Receive a fourth request message; wherein the fourth request message includes: the identification information of the source UE;

[0254] S3240: In response to the second UE being authorized to participate in the predetermined service, a first intermediate key is generated based on the fourth request message; the first intermediate key is used as a second key to establish the second secure link;

[0255] S3250: Send a fourth response message containing the first intermediate key.

[0256] The first and second security links here can both involve three UEs, and these three UEs can communicate through the first and second security links.

[0257] It is worth noting that: Figure 4C The illustrated embodiments can be executed individually or in combination. Figures 4A to 4B Any combination thereof is executed.

[0258] like Figure 4D As shown, this disclosure provides an information processing method, which is executed by a network device, and the method includes:

[0259] S3410: Receive a first request message sent by the first UE, wherein the first message includes: the identification information of the first UE;

[0260] S3420: Return a first response message to the first UE, wherein the first response message includes: a first key; the first key is used to establish a secure link between the first UE and the second UE;

[0261] S3430: Receive a fourth request message sent by the second UE; wherein the fourth request message includes: the identification information of the source UE;

[0262] S3440: In response to the second UE being authorized to participate in the predetermined service, a first intermediate key is generated based on the fourth request message; the first intermediate key is used by the second UE to generate a second key for establishing a secure link with the source UE;

[0263] S3450: Send a fourth response message containing the first intermediate key to the second UE.

[0264] To establish a secure link with the first UE, during the process of establishing the secure link, the network device receives a fourth request message from the second UE. This fourth request message includes at least the identification information of the source UE. If the network device has generated a first key for the source UE, the network device will store the identification information of the source UE and its corresponding first key.

[0265] After receiving the fourth request message, the network device will query the preset storage location using the source UE's identification information to determine the first key generated for that UE.

[0266] If a first key has already been generated for the source UE, the network device can further generate a first intermediate key based on the first key.

[0267] The first intermediate key is carried in the fourth request message and returned to the second UE. In this way, the first key will not be disclosed to the second UE, reducing the security risk of the first key. At the same time, the first intermediate key can be used by the second UE to further generate a session key for establishing a secure link with the first UE, thereby assisting in establishing a secure link between the first UE and the second UE.

[0268] It is worth noting that: Figure 4D The illustrated embodiments can be executed individually or in combination. Figures 4A to 4C Any combination thereof is executed.

[0269] Determining whether a second UE is authorized to participate in a pre-booked service may involve querying the second UE's subscription data and / or service consent information, or interacting with the Prose Application Server, to determine whether the second UE is authorized to participate in the pre-booked service. For example, if the second UE has a pre-booked service subscription, then the second UE can be authorized to participate in the pre-booked service; if the second UE has not a pre-booked service subscription, then the second UE is not authorized to participate in the pre-booked service.

[0270] For example, if the service consent information provided by the server of the pre-ordered service reveals that the second UE has not activated the pre-ordered service or has not agreed to participate in the pre-ordered service, it can be considered that the second UE is not authorized to participate in the pre-ordered service. If the service consent information indicates that the second UE has activated the pre-ordered service or agreed to participate in the pre-ordered service, then it means that the second UE is authorized to participate in the pre-ordered service.

[0271] For example, by interacting with the Prose application server, the application server checks the authorization information of the second UE.

[0272] In some embodiments, the fourth request message includes: a first fresh value. The first fresh value is used to generate the first intermediate key.

[0273] For example, the first fresh value is used by the second UE to generate the first intermediate key after being provided to the network device by the second UE.

[0274] For example, the first fresh value may be provided by the first UE to the second UE, and then provided by the second UE to the network device.

[0275] After receiving the first fresh value, the network device will combine it with the first key configured for the first UE to generate the first intermediate key.

[0276] In another embodiment, if the source UE does not provide the first fresh value to the second UE, the network device can generate a fresh value itself and generate the first intermediate key based on the fresh value (i.e., the second fresh value) and the source UE's first key.

[0277] If the source UE provides a first fresh value, and the second UE sends it to the network device via a fourth request message, the network device will generate a first intermediate key based on the first fresh value generated by the source UE and the second fresh value generated by itself.

[0278] In some embodiments, the method further includes:

[0279] Receive a fifth request message; wherein the fifth request message includes at least: the identification information of the target UE;

[0280] In response to the second UE being authorized to participate in a predetermined service, a fourth intermediate key is generated based on the first key of the target UE; wherein, the fourth intermediate key is used to generate a fifth key for establishing a second secure link;

[0281] Send a fifth response message, wherein the fifth response message includes at least the fourth intermediate key.

[0282] The fifth request message may include: the identification information of the target UE. After receiving the fifth request message, the network device can query the first key generated for the target UE.

[0283] Then, based on the first key of the target UE, the network device can generate a fourth intermediate key. When the second UE is authorized to participate in the predetermined service, the fourth intermediate key will be carried in the fifth response message and returned to the sender of the fifth request message.

[0284] For example, the method may further include:

[0285] Receive a fifth request message sent by the second UE; wherein the fifth request message includes at least: the identification information of the target UE;

[0286] In response to the second UE being authorized to participate in a predetermined service, a fourth intermediate key is generated based on the first key of the target UE; wherein, the fourth intermediate key is used by the second UE to generate a fifth key for establishing a secure link with the target UE;

[0287] A fifth response message is sent to the second UE, wherein the fifth response message includes at least the fourth intermediate key.

[0288] For example, the fifth request message may be sent after the second UE and the source UE have established a secure link. Of course, the fifth request message is not limited to being sent after the second UE and the source UE have established a secure link.

[0289] In some embodiments, the fifth request message includes a fourth freshness value;

[0290] The fourth fresh value is used to generate the fourth intermediate key.

[0291] For example, if the fifth request message carries a fourth fresh value provided by the second UE, the network device can generate the second intermediate key based on the fourth fresh value.

[0292] If the fifth request message does not carry the fresh value provided by the second UE, the network device can generate a fresh value (i.e., the aforementioned third fresh value). In this case, the network device can combine the third and fourth fresh values ​​with the first key to generate a fourth intermediate key.

[0293] The information processing method provided in this disclosure can establish an L3 U2U secure link between a source terminal and a target terminal through a U2U relay, thereby providing the integrity and confidentiality of information transmitted through the terminal-to-terminal relay, ensuring that the source terminal / target terminal can monitor and identify malicious attackers, act as a terminal-to-terminal relay, and ensure that 5G PKMF can securely provide security parameters to the peer terminal and the U2U relay terminal.

[0294] like Figure 5A As shown, this disclosure provides an L3 PC5 link security establishment method that can be used in ranging / sidechain positioning services. In ranging / sidechain positioning services, the source UE and the target UE can be considered as reference UEs, and the U2U relay can be considered as an auxiliary UE.

[0295] 1a. The source UE / target UE sends a ProSe key request message to their respective 5G PKMF / DDNMF. The ProSe key request message may contain the user information identifier (ID) of the source UE / target UE. This ProSe key request message can be used when the source UE / target UE is requesting a PRUK from the 5G PKMF / DDNMF. If the source UE and target UE already have a PRUK from the 5G PKMF / DDNMF, the message may also include the PRUK ID of that PRUK in the request message.

[0296] 1b. The 5G PKMF / DDNMF verifies, either through self-checking or message interaction with the ProSe server, whether the source UE and target UE are authorized to use the U2U relay service. If the source UE and target UE are authorized to use the relevant service, the 5G PKMF / DDNMF sends a PRUK (corresponding to the aforementioned first key) and a PRUK ID to the source UE / target UE. The PRUK ID is an optional parameter in the parameters returned by the 5G PKMF to the UE. If the PRUK and PRUK ID are included, the source UE and target UE should store this information. If the source UE / target UE previously stored an old PRUK and PRUK ID, the currently stored PRUK and PRUK ID are updated using the received PRUK and PRUK ID.

[0297] 2. Using discovery parameters and discovery security parameters, perform the discovery and relay selection process between the peer UE and the U2U relay. Assume that after the discovery and relay selection process, the source UE and the target UE can discover each other and select the same U2U relay, establishing an L3 U2U relay link.

[0298] 3. The source UE sends a direct communication request to the U2U relay. The request includes the source UE user ID, U2U relay user ID, target UE user ID, RSC, Knrp freshness parameter 1, and nonce parameter 1. PRUK ID is an optional parameter in this direct communication request.

[0299] 4a. The U2U relay sends a U2U Key Request message to its 5G PKMF, including the source UE user information ID, U2U relay user information ID, relay service code (RSC), Knrp freshness parameter 1 (corresponding to the first freshness value), and PRUK ID. This U2U Key Request message can be used by the U2U Rely to request Knrp from the PKMF / DDNMF. The PRUK ID is an optional parameter in this U2U Key Request message; that is, the U2U Key Request message can carry the PRUK ID or not.

[0300] 4b. Upon receiving a U2U relay request (Key Request) message, the 5G PKMF / DDNMF of the U2U relay should check whether the U2U relay is authorized to provide relay services. If there is no authorization information for the U2U relay locally, the 5G PKMF should request authorization information from the U2U relay's UDM. If the U2U relay is authorized to provide relay services, the 5G PKMF / DDNMF of the U2U relay sends a U2U Key Request containing the source UE's user information ID, U2U relay user information ID, RSC, PRUK ID, and Knrp freshness parameter 1 to the source UE's 5G PKMF / ddnmf. This U2U relay request (Key Request) may or may not include the PRUK ID. Once the 5G PKMF / DDNMF of the U2U relay receives a U2U Key Request message, the source UE's 5G PKMF / DDNMF identifies the source UE's PRUK based on the received User Info ID, then generates Knrp freshness parameter 2, and derives the Knrp using the source UE's PRUK, RSC, Knrp freshness parameter 1, and Knrp freshness parameter 2. The source UE's 5G PKMF / DDNMF then sends a U2UKey Response message containing the Knrp and Knrp freshness parameter 2 to the U2U Relay's 5G PKMF / DDNMF.

[0301] 4c. The 5G PKMF / DDNMF of the U2U relay forwards the Knrp and Knrp freshness parameter 2 to the U2U relay by sending a U2U Key Request message.

[0302] 5. The U2U relay should derive the KNRP session key (KNRP-sess) from KNRP, and then derive the confidentiality protection key (NRPEK) and / or integrity protection key (NRPIK) (corresponding to the session key mentioned above) according to the PC5 security policy. The U2U relay sends a direct security mode command message to the source UE. This message should include the Knrp freshness parameter 2 (corresponding to the aforementioned second freshness value), a random number 2 (nonce 2), and should be protected in a specified manner.

[0303] 6. The source UE responds with a direct security mode completion message to the 5G ProSe U2U relay.

[0304] 7a. The U2U relay sends a U2U Key Request message to its 5G PKMF / DDNMF. This U2U Key Request may include the target UE user information ID, the U2U relay user information ID, RSC, and Knrp freshness parameter 1'. This U2U Key Request indicates that the U2U Rely is requesting Knrp.

[0305] 7b. If the U2U relay is authorized to provide relay services, the 5G PKMF / DDNMF of the U2U relay sends a U2U U2U Key Request containing the target UE's UserInfo ID, U2U relay UserInfo ID, RSC, and Knrp Freshness Parameter 1 to the target UE's 5G PKMF / DDNMF. Once the U2U Key Request message is received from the U2U relay's 5G PKMF / DDNMF, the target UE's 5G PKMF / DDNMF identifies the target UE's PRUK based on the received UserInfo ID, then generates Knrp Freshness Parameter 2, and derives the Knrp using the target UE's PRUK, RSC, Knrp Freshness Parameter 1, and Knrp Freshness Parameter 2. The target UE's 5G PKMF / DDNMF sends a U2U Key Response message containing Knrp and Knrp freshness parameter 2 to the U2U Relay's 5GPKMF / DDNMF.

[0306] 7c. The 5G PKMF / DDNMF of the U2U relay forwards the Knrp and Knrp freshness parameter 2 to the U2U relay by sending a U2U Key Request message.

[0307] 8. The U2U relay sends a direct communication request to the target UE. This direct communication request includes the user information ID of the source UE, the user information ID of the U2U relay, the user information ID of the target UE, RSC, Knrp fresh parameter 1', Knrp fresh parameter 2' (corresponding to the aforementioned third fresh value), and random parameter 1'.

[0308] 9. The target UE should derive the KnRP and KnRP session keys (KnRP-sess) from KnRP, and then derive the confidential key (NRPEK) (if applicable) and the integrity key (NRPIK) (corresponding to the session keys mentioned above) from the PC5 security policy. The target UE sends a Direct Security Mode command message to the U2U trunk. This message should include nonce 2'.

[0309] 10. The U2U relay responds with a direct safe mode completion message.

[0310] 11. After receiving the Direct Security Mode Complete message sent by the U2U relay, the target UE sends a Direct Communication Accept message to the U2U relay.

[0311] 12. After receiving the direct communication acceptance message, the U2U relay sends a direct communication acceptance message to the source UE.

[0312] 13. An L3 PC5 secure link is established between the source UE and the target UE via a U2U relay. The U2U relay enables traffic relay between peer UEs.

[0313] like Figure 5B As shown, this disclosure provides an information processing method that may include:

[0314] 1a. The source UE / target UE sends a ProSe key request message to their respective 5G PKMF / DDNMF. The ProSe key request message may contain the user information identifier (ID) of the source UE / target UE. This ProSe key request message can be used when the source UE / target UE is requesting a PRUK from the 5G PKMF / DDNMF. If the source UE / target UE already has a PRUK from the 5G PKMF / DDNMF, the message may also include the PRUK ID of that PRUK in the request message.

[0315] 1b. The 5G PKMF / DDNMF verifies, either through self-checking or message interaction with the ProSe server, whether the source UE and target UE are authorized to receive U2U relay services. If the source UE and target UE are authorized to use the relevant services, the 5G PKMF / DDNMF sends a PRUK (corresponding to the aforementioned first key) and a PRUK ID to the source UE / target UE. The PRUK ID is an optional parameter in the parameters returned by the 5G PKMF to the UE. If the PRUK and PRUK ID are included, the source UE and target UE should store this information. If the source UE / target UE previously stored an old PRUK and PRUK ID, the currently stored PRUK and PRUK ID are updated using the received PRUK and PRUK ID.

[0316] 2. Using discovery parameters and discovery security parameters, perform the discovery and relay selection process between the peer UE and the U2U relay. Assume that after the discovery and relay selection process, the source UE and the target UE can discover each other and select the same U2U relay, establishing an L3 U2U relay link.

[0317] 3. The source UE sends a direct communication request to the U2U relay. The request includes the source UE user ID, U2U relay user ID, target UE user ID, RSC, nonce parameter 1, and PRUK ID (optional).

[0318] 4a. The U2U relay sends a U2U Key Request message to its 5G PKMF / DDNMF, including the source UE user information ID, U2U relay user information ID, relay service code (RSC), and PRUK ID. This U2U Key Request message can be used by the U2U Rely to request Knrp from the PKMF / DDNMF. The PRUK ID is an optional parameter in this U2U Key Request message; that is, the U2U Key Request message can include the PRUK ID or not.

[0319] 4b. Upon receiving a U2U relay request (Key Request) message, the 5G PKMF / DDNMF of the U2U relay should check whether the U2U relay is authorized to provide relay services. If there is no authorization information for the U2U relay locally, the 5G PKMF / DDNMF should request authorization information from the U2U relay's UDM. If the U2U relay is authorized to provide relay services, the 5G PKMF / DDNMF of the U2U relay sends a U2U Key Request containing the source UE's user information ID, U2U relay user information ID, RSC, and PRUK ID to the source UE's 5G PKMF / DDNMF. This U2U relay request (Key Request) may or may not include the PRUK ID.

[0320] Once the 5G PKMF / DDNMF of the U2U relay receives a U2U Key Request message, the source UE's 5G PKMF / DDNMF identifies the source UE's PRUK based on the received user information ID, then generates Knrp freshness parameter 1, and derives the Knrp using the source UE's PRUK, RSC, and Knrp freshness parameter 1. The source UE's 5G PKMF / DDNMF then sends a U2U KeyResponse message containing the Knrp and Knrp freshness parameter 1 to the U2U Relay's 5G PKMF / DDNMF.

[0321] 4c. The 5G PKMF / DDNMF of the U2U relay forwards the Knrp and Knrp freshness parameter 1 to the U2U relay by sending a U2U Key Request message.

[0322] 5. The U2U relay should derive the KNRP session key (KNRP-sess) from KNRP, and then derive the confidentiality protection key (NRPEK) and / or integrity protection key (NRPIK) (corresponding to the session key mentioned above) according to the PC5 security policy. The U2U relay sends a Direct Security Mode Command message to the source UE. This message should include KNRP freshness parameter 1, a random number 2, and should be protected in a specified manner.

[0323] 6. The source UE responds with a direct security mode completion message to the 5G ProSe U2U relay.

[0324] 7a. The U2U relay sends a U2U Key Request message to its 5G PKMF / DDNMF. This U2U Key Request may include the target UE user information ID, the U2U relay user information ID, and RSC. This U2U Key Request indicates that the U2U Rely is requesting Knrp.

[0325] 7b. If the U2U relay is authorized to provide relay services, the 5G PKMF / DDNMF of the U2U relay sends a U2U Key Request containing the target UE user information ID, the U2U relay user information ID, and the RSC to the 5GPKMF / DDNMF of the target UE.

[0326] Once the 5G PKMF / DDNMF of the U2U relay receives a U2U Key Request message, the target UE's 5G PKMF / DDNMF identifies the target UE's PRUK based on the received User Info ID, then generates a Knrp freshness parameter 1', and derives the Knrp using the target UE's PRUK, RSC, and Knrp freshness parameter 1'. The target UE's 5G PKMF then sends a U2U Key Response message containing the Knrp and Knrp freshness parameter 1' to the U2U Relay's 5G PKMF / DDNMF.

[0327] 7c. The 5G PKMF / DDNMF of the U2U relay forwards the Knrp and Knrp freshness parameter 1' to the U2U relay by sending a U2U Key Request message.

[0328] 8. The U2U relay sends a direct communication request to the target UE. This direct communication request includes the user information ID of the source UE, the user information ID of the U2U relay, the user information ID of the target UE, RSC, Knrp fresh parameter 1', and random parameter 1'.

[0329] 9. The target UE should derive the Knrp and KNR session keys (Knrp-sess) from Knrp, and then derive the confidential key (NRPEK) (if applicable) and the integrity key (NRPIK) (corresponding to the session keys mentioned above) from the PC5 security policy. The target UE sends a Direct Security Mode command message to the U2U trunk. This message should include nonce 2'.

[0330] 10. The U2U relay responds with a direct safe mode completion message.

[0331] 11. After receiving the Direct Security Mode Complete message sent by the U2U relay, the target UE sends a Direct Communication Accept message to the U2U relay.

[0332] 12. After receiving the direct communication acceptance message, the U2U relay sends a direct communication acceptance message to the source UE.

[0333] 13. An L3 PC5 secure link is established between the source UE and the target UE via a U2U relay. The U2U relay enables traffic relay between peer UEs.

[0334] Optionally, the source UE / target UE should be able to request a PRUK from its PKMF / DDNMF by sending a ProSe key request containing the source UE / target UE's user information ID. This PRUK is the aforementioned first key.

[0335] Optionally, the U2U relay should be able to request a Knrp by sending a U2U Key Request message to its PKMF. The Knrp can be either the first intermediate key of the source UE or the fourth intermediate key of the target UE.

[0336] Optionally, the U2U relay sends a Direct Communication Request (DCR) message to the target UE. The U2U relay should be able to store the Knrp shared between the source UE and the U2U relay, as well as the Knrp shared between the target UE and the U2U relay.

[0337] Optionally, the U2U trunk should be able to include the User InfoID of the source UE / target UE and the User InfoID of the U2U trunk in the U2U key request message.

[0338] Optionally, the 5G PKMF / DDNMF should be able to generate a PRUK associated with the user information ID.

[0339] Optionally, the 5G PKMF / DDNMF should be able to store user information IDs.

[0340] Optionally, the 5G PKMF / DDNMF should be able to retrieve the corresponding PRUK based on the user information ID.

[0341] Optionally, the 5G / DDNMF of the U2U relay should be able to send a U2U key request message to the 5G PKMF / DDNMF of the source UE / target UE to obtain Knrp based on the received U2U key request message.

[0342] Optionally, the 5G PKMF / DDNMF of the U2U relay should be able to provide Knrp by sending a U2U key response message to the U2U relay.

[0343] Optionally, the 5G PKMF of the source UE / target UE should be able to check whether the source UE / target UE is authorized to receive U2U relay services or ranging services.

[0344] Optionally, the 5G PKMF / DDNMF of the U2U relay should be able to check whether the U2U relay is authorized to provide U2U relay services or ranging services.

[0345] Each of the above embodiments can be implemented individually or in any combination without conflict.

[0346] like Figure 6A As shown in the figure, this disclosure provides an information processing apparatus, wherein the apparatus includes: a first sending module 110 configured to send a first request message, wherein the first request message includes: identification information of the first UE; and a first receiving module 120 configured to receive a first response message returned based on the first request message, wherein the first response message includes: a first key generated according to the identification information of the first UE; the first key is used by the first UE to establish a secure link.

[0347] The information processing device may be the first UE.

[0348] In one embodiment, the first transmitting module 110 and the first receiving module 120 may correspond to a network interface and / or a transceiver antenna. Understandably, the first response message also includes an identifier of the first key.

[0349] Understandably, the first sending module 110 is also configured to send a second request message in response to the first UE being the source UE, wherein the second request message includes: identification information of the first UE; the second request message is used to request the establishment of a secure link.

[0350] Understandably, the first receiving module 120 is also configured to receive a first specified message returned based on the second request message, wherein the first specified message is secured using a second key; the second key is generated based on a first intermediate key; wherein the first intermediate key is generated based on the first key;

[0351] The information processing device may further include: a processing module configured to generate a second intermediate key based on the first key; generate a third key based on the second intermediate key; perform security verification on the first designated message using the third key; and determine whether to establish a secure link based on whether the first designated message passes the security verification.

[0352] The processing module may include, but is not limited to, a processor. It is understood that the processing module may be configured to determine to establish a secure link when the security verification passes; and / or, refuse to establish a secure link when the security verification fails.

[0353] In some embodiments, the second request message includes: a first fresh value; wherein the first fresh value is used to generate the first intermediate key and the second intermediate key.

[0354] For example, the second request message includes: a first random number, wherein the first random number and the second intermediate key are used together to generate the third key.

[0355] Understandably, the first specified message also includes: a second fresh value; wherein the second fresh value is further used by the network device to generate the first intermediate key and the second intermediate key.

[0356] Understandably, the first specified message also includes: a second random number; the second random number and the second intermediate key, used to generate the third key.

[0357] Understandably, the first receiving module 120 is configured to receive a third request message in response to the first UE being the target UE; wherein the third request message includes: a third freshness value;

[0358] The information processing device further includes: a processing module configured to generate a third intermediate key based on the third freshness value and the first key; and to generate a fourth key based on the third intermediate key; the first sending module 110 is further configured to send a second designated message using the fourth key for security protection.

[0359] In some embodiments, the third freshness value is used to generate a fourth intermediate key; wherein the fourth intermediate key is used to generate a fifth key for verifying the second specified message.

[0360] Understandably, the third request message includes: a third random number; the third random number is used to generate the fourth key and the fifth key.

[0361] Understandably, the second specified message includes at least: a fourth random number; the fourth random number generates the fourth key and the fifth key, respectively.

[0362] like Figure 6B As shown, this disclosure provides an information processing apparatus, which includes: a second receiving module 210 configured to receive a second request message, wherein the second request message includes: identification information of the source UE; a second sending module 220 configured to send a fourth request message according to the second request message; the second receiving module 210 is further configured to receive a fourth response message returned based on the fourth request message; wherein the fourth response message includes at least: a first key of the source UE, wherein the first key is used to establish a secure link.

[0363] The information processing device may be a second UE.

[0364] In one embodiment, the second transmitting module 220 and the second receiving module 210 may correspond to a network interface and / or a transceiver antenna.

[0365] For example, the second sending module 220 and the second receiving module 210 may be program modules; the program modules are processed by a processor.

[0366] Understandably, both the second request message and the fourth request message include: a first fresh value; the first fresh value is used by the network device to generate a first intermediate key and a second intermediate key; wherein, the first intermediate key is used to generate a second key for establishing a secure connection.

[0367] Understandably, the second request message also includes: a first random number;

[0368] The first random number is used to combine with the first intermediate key to generate the second key.

[0369] Understandably, the second sending module 220 is also configured to send a first specified message according to the fourth response message.

[0370] Understandably, the first specified message includes: a second fresh value; the second fresh value is used to generate a third key to verify the security of the first specified message.

[0371] Understandably, the fourth response message includes: a first intermediate key; the first intermediate key being used to generate the second key.

[0372] Understandably, the information processing device further includes a processing module, which is also configured to establish a first secure link after the first designated message passes security verification.

[0373] Understandably, the second sending module 220 is also configured to send a fifth request message after the first designated message passes security verification; wherein the fifth request message includes: the identification information of the target UE;

[0374] The second receiving module 210 is configured to receive a fifth response message returned based on the fifth request message.

[0375] Understandably, the fifth response message includes: a third fresh value; wherein the third fresh value is used to generate a third intermediate key and a fourth intermediate key;

[0376] The third intermediate key is used to generate the fourth key for establishing the second secure link;

[0377] The fourth intermediate key is used to generate the fifth key for establishing the second secure link.

[0378] Understandably, the second sending module 220 is also configured to send a third request message based on the fifth response message;

[0379] The second receiving module 210 is further configured to receive a second specified message returned based on the third request message;

[0380] The information processing device further includes:

[0381] The processing module is configured to use the fifth key to verify the security of the second specified message; and to determine whether to establish the second secure link based on the verification result of the security of the second specified message.

[0382] Understandably, the processing module is configured to establish the second secure link after the second specified message has been verified using the fifth key.

[0383] like Figure 7 As shown, this disclosure provides an information processing apparatus, wherein the apparatus includes:

[0384] The third receiving module 310 is configured to receive a first request message, wherein the first message includes: identification information of the first UE;

[0385] The third sending module 320 is configured to return a first response message based on the first request message, wherein the first response message includes: a first key generated based on the identification information of the first user equipment (UE);

[0386] The first key is used to establish a secure link.

[0387] The information processing device may include network equipment.

[0388] In one embodiment, the third receiving module 310 and the third transmitting module 320 may correspond to a network interface and / or a transceiver antenna.

[0389] For example, the third receiving module 310 and the third sending module 320 may be program modules; after the program module is executed by the processor, it can perform the above operations.

[0390] As another example, the third receiving module 310 and the third transmitting module 320 may be hardware-software hybrid modules, which may include, but are not limited to, programmable arrays; the programmable arrays may include, but are not limited to, field-programmable arrays and / or complex programmable arrays.

[0391] Again, by way of example, the first transmitting module and the first receiving module may be pure hardware modules; the pure hardware modules include, but are not limited to, application-specific integrated circuits.

[0392] Understandably, the third receiving module 310 is also configured to receive a fourth request message; wherein the fourth request message includes: the identification information of the source UE;

[0393] The information processing device further includes:

[0394] The processing module is configured to generate a first intermediate key based on the fourth request message; and send a fourth response message containing the first intermediate key to the second UE; wherein the first intermediate key is used to generate a second key for establishing a secure link.

[0395] In some embodiments, the fourth request message includes: a first fresh value; the first fresh value is used to generate the first intermediate key.

[0396] Understandably, the third receiving module 310 is also configured to receive a fifth request message; wherein the fifth request message includes at least: the identification information of the target UE;

[0397] The information processing device further includes:

[0398] The processing module is configured to generate a fourth intermediate key based on a first key of the target UE; wherein the fourth intermediate key is used to generate a fifth key for establishing a secure link;

[0399] The third sending module 320 is also configured to send a fifth response message, wherein the fifth response message includes at least the fourth intermediate key.

[0400] In some embodiments, the fifth request message includes a fourth fresh value; the fourth fresh value is used to generate the fourth intermediate key.

[0401] In some embodiments, the fifth request message further includes: a third fresh value, wherein the third fresh value is used to generate the fourth intermediate key.

[0402] This disclosure provides a communication system that may include: a first UE configured to execute any of the aforementioned information processing methods executed by the first UE; a second UE configured to execute any of the aforementioned information processing methods executed by the second UE; and a network device configured to execute any of the aforementioned information processing methods executed by the network device.

[0403] This disclosure provides a communication device, including: a memory for storing processor-executable instructions; and a processor connected to the memory; wherein the processor is configured to execute the information processing method provided by any of the foregoing technical solutions.

[0404] The processor may include various types of storage media, which are non-transitory computer storage media that can continue to store information after the communication device loses power.

[0405] Here, the communication equipment includes: the aforementioned first UE, the aforementioned second UE, and / or network equipment.

[0406] The processor can be connected to the memory via a bus or similar means to read executable programs stored in the memory, for example, such as... Figures 2A to 2G , Figures 3A to 3D ,as well as Figures 4A to 4D At least one of the methods shown.

[0407] Figure 8This is a block diagram illustrating a UE 800 according to an exemplary embodiment. For example, the UE 800 may be a mobile phone, computer, digital broadcast user equipment, messaging transceiver, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0408] Reference Figure 8 The UE 800 may include one or more of the following components: processing component 802, memory 804, power supply component 806, multimedia component 808, audio component 810, input / output (I / O) interface 812, sensor component 814, and communication component 816.

[0409] Processing component 802 typically controls the overall operation of UE 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 802 may include one or more processors 820 to execute instructions to generate all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0410] Memory 804 is configured to store various types of data to support operation of UE 800. Power supply component 806 provides power to various components of UE 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to UE 800.

[0411] The multimedia component 808 includes a screen that provides an output interface between the UE 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, the multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the UE 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0412] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC), and in some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0413] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0414] Sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for UE 800. Communication assembly 816 is configured to facilitate wired or wireless communication between UE 800 and other devices. In an exemplary embodiment, UE 800 may be implemented using one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0415] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of the UE 800 to generate the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0416] like Figure 9 As shown in the illustration, one embodiment of this disclosure illustrates the structure of an access device. For example, network device 900 can be provided as a network device. This network device may include, but is not limited to, the aforementioned PKMF.

[0417] Reference Figure 9 The network device 900 includes a processing component 922, which further includes one or more processors, and memory resources represented by a memory 932 for storing instructions, such as application programs, that can be executed by the processing component 922. The application programs stored in the memory 932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 922 is configured to execute instructions to perform any of the methods described above applied to the access device, such as... Figures 2A to 2G , Figures 3A to 3D ,as well as Figures 4A to 4D Any of the methods shown.

[0418] Network device 900 may also include a power supply component 1926 configured to perform power management of network device 900, a wired or wireless network interface 950 configured to connect network device 900 to a network, and an input / output (I / O) interface 958. Network device 900 can operate on an operating system stored in memory 932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0419] Other embodiments of the present disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the embodiments of this disclosure that follow the general principles of the embodiments of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the embodiments of this disclosure are indicated by the following claims.

[0420] It should be understood that the embodiments disclosed herein are not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from their scope. The scope of the embodiments disclosed herein is limited only by the appended claims.

Claims

1. An information processing method, wherein, The method is performed by a first user equipment (UE), and the method comprises: sending a first request message to a network device, wherein the first request message comprises identification information of the first UE; receiving a first response message returned based on the first request message, wherein the first response message comprises a first key bound with the identification information of the first UE, and the first key is used for the first UE to establish a secure link; in response to the first UE being a source UE, sending a second request message to a second UE, wherein the second request message comprises identification information of the source UE, and the second request message is used for requesting the second UE to establish a first secure link with the source UE; receiving a first designated message returned by the second UE based on the second request message, wherein the first designated message is securely protected by using a second key, the second key is generated based on a first intermediate key of the source UE, and the first intermediate key of the source UE is generated by the network device based on the first key bound with the identification information of the source UE; wherein the second UE is further configured to send a fifth request message to the network device and receive a fifth response message returned by the network device based on the fifth request message, wherein the fifth request message comprises identification information of a target UE, and in response to the second UE being authorized to participate in a predetermined service, the fifth response message at least comprises a fourth intermediate key of the target UE, the fourth intermediate key of the target UE is used for generating a fifth key, the fifth key is used for establishing a second secure link with the target UE, and the fourth intermediate key is generated based on a first key bound with the identification information of the target UE.

2. The method of claim 1, wherein, The first response message further comprises an identifier of the first key.

3. The method of claim 1, wherein, The method further comprises: generating a second intermediate key based on the first key; generating a third key based on the second intermediate key; performing security verification on the first designated message by using the third key; determining whether to establish a secure link according to whether the first designated message passes the security verification.

4. The method of claim 3, wherein, The determining whether to establish a secure link according to whether the first designated message passes the security verification comprises: when the security verification passes, determining to establish a secure link; and / or when the security verification fails, determining not to establish a secure link. The second request message comprises a first freshness value.

5. The method of claim 1, wherein, The first freshness value is used for generating the first intermediate key and a second intermediate key. The second request message comprises a first random number, and the first random number and the second intermediate key are used together to generate the third key.

6. The method of claim 1, wherein, The first designated message further comprises a second freshness value.

7. The method of claim 1, wherein, The second freshness value is further used by the network device to generate the first intermediate key and the second intermediate key. The first designated message further comprises a second random number.

8. The method according to claim 1, wherein, The second random number and the second intermediate key are used to generate the third key. The method further comprises:

9. The method of claim 1 or 2, wherein, in response to the first UE being a target UE, receiving a third request message, wherein the third request message comprises a third freshness value. ​ generating a third intermediate key according to the third freshness value and the first key; generating a fourth key according to the third intermediate key; sending a second designated message which is security protected using the fourth key.

10. The method of claim 9, wherein, the third freshness value is used to generate a fourth intermediate key; and the fourth intermediate key is used to generate a fifth key for verifying the second designated message.

11. The method of claim 10, wherein, the third request message comprises a third random number; and the third random number is used to generate the fourth key and the fifth key.

12. The method of claim 9, wherein, the second designated message comprises at least a fourth random number; the fourth random number is used to generate the fourth key and the fifth key, respectively.

13. An information processing method, wherein, The method is performed by a second user equipment (UE) and comprises: receiving a second request message sent by a source user equipment (UE), wherein the second request message comprises identification information of the source UE; sending, to a network device, a fourth request message according to the second request message, wherein the fourth request message comprises the identification information of the source UE; receiving a fourth response message returned by the network device based on the fourth request message; in response to the second UE being authorized to participate in a predetermined service, the fourth response message comprises at least a first intermediate key of the source UE, the first intermediate key of the source UE is used to establish a first secure link, and the first intermediate key of the source UE is generated by the network device based on a first key of the source UE, which is bound to the identification information of the source UE; sending, to the source UE, a first designated message according to the fourth response message, wherein the first designated message is security protected using a second key, and the second key is generated by the second UE based on the first intermediate key of the source UE; establishing the first secure link after the first designated message passes security verification; sending a fifth request message to the network device, wherein the fifth request message comprises identification information of a target UE; receiving a fifth response message returned by the network device based on the fifth request message; in response to the second UE being authorized to participate in the predetermined service, the fifth response message is an acceptance message, and the fifth response message comprises at least a fourth intermediate key of the target UE, the fourth intermediate key of the target UE is used to generate a fifth key, and the fifth key is used to establish a second secure link with the target UE; and the fourth intermediate key is generated based on a first key bound to the identification information of the target UE.

14. The method of claim 13, wherein, The second request message and the fourth request message both comprise a first freshness value; the first freshness value is used by the network device to generate a first intermediate key and a second intermediate key; and the first intermediate key is used to generate a second key for establishing a secure connection.

15. The method of claim 13, wherein, The second request message further comprises a first random number; the first random number is used in combination with the first intermediate key to generate the second key.

16. The method of claim 13, wherein, The first designated message comprises a second freshness value; the second freshness value is used to generate a third key for verifying security of the first designated message. the third request message comprises a third random number; and the third random number is used to generate the fourth key and the fifth key. the second designated message comprises at least a fourth random number; the fourth random number is used to generate the fourth key and the fifth key, respectively.

17. The method of claim 13, wherein, The fourth response message includes: a first intermediate key; and the first intermediate key is used to generate the second key.

18. The method of claim 13, wherein, The fifth response message includes: a third freshness value; and the third freshness value is used to generate a third intermediate key and a fourth intermediate key. The third intermediate key is used to generate a fourth key for establishing a second secure link. The fourth intermediate key is used to generate a fifth key for establishing the second secure link.

19. The method of claim 18, wherein, The method further includes: sending a third request message according to the fifth response message; receiving a second designated message returned based on the third request message; verifying security of the second designated message by using the fifth key; determining whether to establish the second secure link according to a verification result of the security of the second designated message.

20. The method of claim 19, wherein, The determining whether to establish the second secure link according to the verification result of the security of the second designated message includes: establishing the second secure link after the verification of the second designated message by using the fifth key is passed.

21. An information processing method, wherein, The method performed by a network device includes: receiving a first request message sent by a first user equipment (UE), wherein the first request message includes identification information of the first UE; returning a first response message to the first UE based on the first request message, wherein the first response message includes a first key bound to the identification information of the first UE; and the first key is used to establish a secure link; in response to the first UE being a source UE, receiving a fourth request message sent by a second UE; wherein the fourth request message includes identification information of the source UE; sending a fourth response message to the second UE based on the fourth request message; wherein, in response to the second UE being authorized to participate in a predetermined service, the fourth response message at least includes a first intermediate key of the source UE, the first intermediate key of the source UE is used for the second UE to establish a first secure link with the source UE, the first intermediate key of the source UE is generated by the network device based on a first key of the source UE, and the first key of the source UE is bound to the identification information of the source UE; receiving a fifth request message sent by the second UE; wherein the fifth request message at least includes identification information of a target UE; sending a fifth response message to the second UE based on the fifth request message; wherein, in response to the second UE being authorized to participate in the predetermined service, the fifth response message is an acceptance message, and the fifth response message at least includes a fourth intermediate key of the target UE, the fourth intermediate key of the target UE is used to generate a fifth key, the fifth key is used for the second UE to establish a second secure link with the target UE, and the fourth intermediate key is generated based on a first key bound to the identification information of the target UE.

22. The method of claim 21, wherein, The fourth request message includes a first freshness value. The first freshness value is used to generate the first intermediate key.

23. The method of claim 21, wherein, The fifth request message includes a fourth freshness value. The fourth freshness value is used to generate the fourth intermediate key.

24. The method of any one of claims 21 to 23, wherein, The fifth request message further includes a third freshness value, wherein the third freshness value is used to generate the fourth intermediate key.

25. An information processing apparatus, comprising: The apparatus includes: A first sending module configured to send a first request message to a network device, wherein the first request message includes identification information of a first UE; A first receiving module configured to receive a first response message returned based on the first request message, wherein the first response message includes a first key bound with the identification information of the first UE, and the first key is used to establish a secure link by the first UE; The first sending module is further configured to, in response to the first UE being a source UE, send a second request message to a second UE, wherein the second request message includes identification information of the source UE, and the second request message is used to request the second UE to establish a first secure link. The first receiving module is further configured to receive a first designated message returned by the second UE based on the second request message, wherein the first designated message is securely protected by using a second key, and the second key is generated based on a first intermediate key of the source UE, and the first intermediate key of the source UE is generated by the network device based on the first key bound with the identification information of the source UE.

26. An information processing apparatus, comprising: The apparatus includes: A second receiving module configured to receive a second request message sent by a source user equipment (UE), wherein the second request message includes identification information of the source UE; A second sending module configured to send a fourth request message to a network device according to the second request message, wherein the fourth request message includes the identification information of the source UE; The second receiving module is further configured to receive a fourth response message returned by the network device based on the fourth request message, wherein in response to a second UE being authorized to participate in a predetermined service, the fourth response message is an acceptance message, and the fourth response message at least includes a first intermediate key of the source UE, and the first intermediate key of the source UE is used to establish a first secure link, and the first intermediate key of the source UE is generated by the network device based on a first key of the source UE, and the first key of the source UE is bound with the identification information of the source UE; The second sending module is further configured to send a first designated message to the source UE according to the fourth response message, wherein the first designated message is securely protected by using a second key, and the second key is generated by the second UE based on the first intermediate key of the source UE; A processing module configured to establish the first secure link after the first designated message passes security verification; The second sending module is further configured to send a fifth request message to the network device, wherein the fifth request message includes identification information of a target UE; The second receiving module is further configured to receive a fifth response message returned by the network device based on the fifth request message; wherein, in response to the second UE being authorized to participate in the predetermined service, the fifth response message at least includes a fourth intermediate key of the target UE, the fourth intermediate key of the target UE being used to generate a fifth key, the fifth key being used to establish a second secure link with the target UE.

27. An information processing apparatus, comprising: The apparatus comprises: The third receiving module is configured to receive a first request message sent by a first user equipment (UE), wherein the first request message includes identification information of the first UE; The third sending module is configured to return a first response message to the first UE based on the first request message, wherein the first response message includes a first key bound with the identification information of the first UE; and the first key is used to establish a secure link; The third receiving module is further configured to receive a fourth request message sent by a second UE in response to the first UE being a source UE; wherein the fourth request message includes identification information of the source UE; The third sending module is further configured to send a fourth response message to the second UE based on the fourth request message; wherein, in response to the second UE being authorized to participate in the predetermined service, the fourth response message is an acceptance message, and the fourth response message at least includes a first intermediate key of the source UE, the first intermediate key of the source UE being used for the second UE to establish a first secure link with the source UE, the first intermediate key of the source UE being generated by a network device based on a first key of the source UE, the first key of the source UE being bound with the identification information of the source UE; The third receiving module is further configured to receive a fifth request message sent by the second UE; wherein the fifth request message at least includes identification information of a target UE; The third sending module is further configured to send a fifth response message to the second UE based on the fifth request message; wherein, in response to the second UE being authorized to participate in the predetermined service, the fifth response message at least includes a fourth intermediate key of the target UE, the fourth intermediate key of the target UE being used to generate a fifth key, the fifth key being used for the second UE to establish a second secure link with the target UE.

28. A communication device comprising a processor, a transceiver, a memory, and an executable program stored on the memory and executable with the processor, wherein, The processor executes the executable program to perform the method provided in any one of claims 1-12, 13-20, or 21-24. 29.A computer storage medium storing an executable program; the executable program, when executed by a processor, can implement the method provided in any one of claims 1-12, 13-20, or 21-24. 30.A communication system comprising: a first UE configured to perform the information processing method in any one of claims 1-12; a second UE configured to perform the information processing method in any one of claims 13-20; a network device configured to perform the information processing method in any one of claims 21-24.

Images