Supporting remote user equipment authentication via relay user equipment

Abstract

Systems and methods for supporting remote user equipment (UE) authentication via a relay UE are disclosed. In one embodiment, a method performed by a relay UE includes receiving a first message communicated by a remote UE and transmitting a second message to a relay access and mobility function (AMF), where the second message includes a UE-to-network (U2N) connection mapping identification (ID) identifying the remote UE. In this manner, the relay UE and the relay AMF can identify that a second message (e.g., an authentication-related message) is for the remote UE. Embodiments of a relay UE and embodiments of a relay AMF and methods of operation thereof are also disclosed.

Description

[0001] This application is a divisional application of the Chinese patent application "Supporting remote user device authentication via relay user equipment" with application number 202280085815.7 (filing date is August 23, 2022).

[0002] Related Applications

[0003] This application claims the benefit of provisional patent application serial number 63 / 294,920 filed on December 30, 2021, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0004] Embodiments related to functionality supporting remote UE authentication via a relay User Equipment (UE) are disclosed. Background Art

[0005] Background of a control plane based solution for remote UE authorization

[0006] The 3rd Generation Partnership Project (3GPP) Technical Specification (TS) 33.503v0.2.0 clause 6.3.3.3 reproduced below specifies a control plane based solution for remote user equipment (UE) authorization. In 3GPP TS 33.503v0.2.0 clause 6.3.3.3, PC5 is a reference point for a UE to communicate directly with another UE, ID stands for Identity, AMF stands for Access and Mobility Function, AUSF stands for Authentication Server Function, UDM stands for Unified Data Management, 5G stands for Next Generation, PCF stands for Policy Control Function, DCR stands for Direct Communication Request, SUCI stands for Subscription Hidden Identifier, U2N stands for UE to Network, NAS stands for Non Access Stratum, SMC stands for Security Mode Command, and FFS stands for Further Study. Figure 1 3GPP TS 33.503v0.2.0 shows Figure 6 .3.3.3.2-1.

[0007] *****Start excerpt from 3GPP TS 33.503*****

[0008] 6.3.3.3 Security Process on Control Surface

[0009] Editor's Note: This clause describes the security procedures that rely on the primary authentication procedure to authenticate / authorize the UE during 5G ProSe UE to network relay communications.

[0010] 6.3.3.3.1 Overview

[0011] This subclause describes the security mechanisms for L3 U2N relay authentication, authorization and key management using the master authentication for PC5 key establishment. The network entities AMF, AUSF and UDM are involved for key derivation and key distribution for UE to network relay communication. The UE shall be provided with the necessary policies and parameters for using 5G ProSe services as part of the UE ProSe policy information as defined in clause 4.2.2 of TS23.503…. The PCF shall provide the authorization policies and parameters for 5G UE to network relay discovery and communication as specified in 5.1.4 of TS23.304….

[0012] 6.3.3.3.2 Connection with UE to Network Relay Connection during PC5 Link Establishment where Network ProSe Security Context is set up

[0013] This subclause describes the procedure for a remote UE to establish a PC5 link between the remote UE and a UE-to-network relay. The procedure includes how the remote UE is authenticated by the AUSF via the relay UE and the AMF of the relay UE during 5G ProSe PC5 establishment. This mechanism can be used by the remote UE when it is out of coverage.

[0014] [ Figure 1 3GPP TS 33.503v0.2.0 shows Figure 6 .3.3.3.2-1]

[0015] Figure 6 .3.3.3.2-1: UE to Network Relay Security Procedures during PC5 Link Establishment, where Network Prose

[0016] Security context

[0017] 0. Remote UE and relay UE shall register with the network. UE to network relay shall be authenticated and authorized by the network to support acting as a relay UE. Remote UE shall be authenticated and authorized by the network to act as a remote UE.

[0018] 1. The remote UE shall initiate the discovery procedure using either the Model A or Model B method as specified in clauses 6.3.1.2 or 6.3.1.3 of TS 23.304, respectively.

[0019] 2-5. After discovering the UE to network relay, the remote UE shall send a direct communication request to the relay UE for establishing a secure PC5 unicast link. The remote UE shall include its security capabilities and security policies in the DCR message as specified in TS 33.536…. The message shall also include SUCI, relay service code, Nonce_1. After receiving the DCR message, the relay UE shall send a relay key request to the relay AMF, including the parameters received in the DCR message. The relay AMF shall verify whether the relay UE is authorized to act as a U2N relay. The relay AMF shall select the AUSF based on the SUCI and forward the key request to the AUSF in the Nausf_UEAuthentication_Authenticate request message.

[0020] 6-7.The AUSF shall retrieve the authentication vector from the UDM and trigger the primary authentication of the remote UE using the existing procedures as specified in TS 33.501…. This authentication is performed between the AUSF and the remote UE via the relaying AMF and the relaying UE. The AUSF shall not consider the newly derived KAUSF as the latest KAUSF. At the remote UE, since the NASSMC procedure is not performed between the remote UE and the relaying AMF, the newly derived KAUSF shall not be considered as the latest KAUSF.

[0021] Editor's note: Further details on the authentication message handling in the UE, AMF relaying the UE and AUSF is FFS. Editor's note: There are basically two different KAUSF keys. Different key names should be used to avoid confusion and misleading. This is FFS.

[0022] Editor's note: A new service operation should be used for Prose authentication to distinguish it from the main authentication defined in 33.501 to separate the different functions and service logic. This is FFS.

[0023] 8. After successful primary authentication, the AUSF and the remote UE shall use the newly derived KAUSF to generate a 5GPRUK (as specified in Appendix A.2) and a 5GPRUK ID as specified in Appendix A.3.

[0024] 9. The AUSF shall generate the KNR_ProSe keys as defined in Appendix A.4.

[0025] 10-11.AUSF shall send 5GPRUK ID, KNR_ProSe, Nonce_2 in the Nausf_UEAuthentication_Authenticate response message to the UE to Network Relay via the relaying AMF. When receiving KNR_ProSe from AUSF, the AMF shall not attempt to trigger the NAS SMC procedure with the remote UE. The relaying UE derives the PC5 session key Krelay- from KNR_ProSe using the KDF defined in clause 6.3.3.3.4 of this document.

[0026] sess and confidentiality and integrity keys. KNR_ProSe ID and Krelay-sess ID are consistent with TS 33.536[6]

[0027] The KNRP ID in the SSH session is established in the same way as the KNRP-sess ID.

[0028] 12. The UE to Network Relay shall send the received 5GPR UKID, Nonce_2 to the remote UE in a Direct Security Mode Command message.

[0029] 13-14. The remote UE shall use the 5GPRUK ID to locate KAUSF / 5GPRUK for PC5 link security. The remote UE shall generate KNR_ProSe keys for remote access via the relay UE in the same way as defined in step 9. The remote UE shall derive the PC5 session key Krelay-ses and confidentiality and integrity keys from KNR_ProSe in the same way as defined in step 11. The remote UE shall send a Direct Security Mode Complete message to the UE to Network Relay.

[0030] Further communications between the remote UE and the network occur securely via the UE-to-network relay.

[0031] Editor's note: Further details on the need and use of 5GPRUK IDs are FFS.

[0032] *****END Excerpt from 3GPP TS 33.503*****

[0033] Background technology about UE authentication

[0034] 3GPP TS24.501 v17.4.0 clause 5.4.1.2 specifies the primary authentication and key agreement procedure based on the Extensible Authentication Protocol (EAP) and is reproduced below. In 3GPP TS24.501, ngKSI stands for Key Set Identifier for Next Generation Radio Access Networks and 5GMM stands for 5G System Mobility Management. Figure 23GPP TS24.501 shows Figure 5 .4.1.2.1.1.

[0035] *****Beginning excerpt from 3GPP TS24.501*****

[0036] 5.4.1.2 EAP-based primary authentication and key negotiation process

[0037] 5.4.1.2.1 Overview

[0038] The purpose of the EAP-based primary authentication and key agreement procedure is to provide mutual authentication between the UE and the network and to agree on the keys KAUSF, KSEAF and KAMF (see 3GPP TS 33.501...).

[0039] The Extensible Authentication Protocol (EAP) as specified in IETF RFC 3748... can perform authentication using various EAP methods.

[0040] EAP defines four types of EAP messages:

[0041] a) EAP request message;

[0042] b) EAP response message;

[0043] c) EAP success message; and

[0044] d) EAP failure message.

[0045] Several rounds of exchange of EAP request messages and associated EAP response messages may be required to achieve authentication (see FIG.

[0046] example in 5.4.1.2.1.1).

[0047] The primary authentication and key negotiation process based on EAP is always initiated and controlled by the network.

[0048] The EAP request message, ngKSI and ABBA are transmitted from the network to the UE using the AUTHENTICATIONREQUEST message of the EAP message reliable transmission procedure.

[0049] The EAP response message is transmitted from the UE to the network using the AUTHENTICATION RESPONSE message of the EAP message reliable transmission procedure.

[0050] If authentication of the UE is completed successfully, the serving AMF intends to initiate the Security Mode Control procedure following the EAP-based Primary Authentication and Key Agreement procedure, and the Security Mode Control procedure intends to use part of the native 5G NAS security context created by the EAP-based Primary Authentication and Key Agreement procedure, the EAP Success message and the ngKSI are transmitted from the network to the UE using the SECURITY MODE COMMAND message of the Security Mode Control procedure (see subclause 5.4.2).

[0051] If the authentication of the UE is completed successfully and the serving AMF does not intend to initiate the Security Mode Control procedure using the partial native 5G NAS security context created by the EAP-based main authentication and key agreement procedure, the EAP Success message and ngKSI are transmitted from the network to the UE using the AUTHENTICATION RESULT message of the EAP Result message transfer procedure.

[0052] NOTE 1: The serving AMF shall not initiate the Security Mode Control procedure after the EAP based Primary Authentication and Key Agreement procedure in case of AMF relocation, for example during the Registration procedure.

[0053] If the UE's authentication is not successfully completed, the EAP failure message is transmitted from the network to the UE using the AUTHENTICATION RESULT message or AUTHENTICATION REJECT message of the EAP result message transmission process, or in a response to the initial 5GMM process (the EAP-based main authentication and key agreement process is performed as part of the initial 5GMM process).

[0054] The AMF shall set the Authenticator Retransmission Timer as specified in IETF RFC 3748

[34] subclause 4.3 to an infinite value. NOTE 2: The EAP Message Reliable Transport procedure provides for reliable transport of EAP messages, therefore, retransmission at the EAP layer does not occur.

[0055] AUSF and AMF support exchanging EAP messages using N12.

[0056] The UE shall detect and handle any duplication of EAP messages as specified in IETF RFC 3748….

[0057] [ Figure 2 3GPP TS24.501 shows Figure 5 .4.1.2.1.1]

[0058] Figure 5 .4.1.2.1.1: EAP-based primary authentication and key negotiation process

[0059] *****End Excerpt from 3GPP TS24.501*****

[0060] 3GPP TS 24.501 clauses 8.2.1 to 8.2.5 define the messages used for UE authentication. These clauses are reproduced below.

[0061] *****Beginning excerpt from 3GPP TS24.501*****

[0062] 8.2.1 Authentication Request

[0063] 8.2.1.1 Message Definition

[0064] The AUTHENTICATION REQUEST message is sent by the AMF to the UE to initiate authentication of the UE identity. See Table 8.2.1.1.1.

[0065] Message Type: AUTHENTICATION REQUEST (Authentication Request)

[0066] Importance: Double

[0067] Direction: Network to UE

[0068] Table 8.2.1.1.1: AUTHENTICATION REQUEST message content

[0069]

[0070] 8.2.2 Authentication Response

[0071] 8.2.2.1 Message Definition

[0072] The AUTHENTICATION RESPONSE message is sent by the UE to the AMF to deliver the calculated authentication response to the network. See Table 8.2.2.1.1.

[0073] Message Type: AUTHENTICATION RESPONSE

[0074] Importance: Double

[0075] Direction: UE to network

[0076] Table 8.2.2.1.1: AUTHENTICATION RESPONSE message content

[0077]

[0078] 8.2.3 Authentication results

[0079] 8.2.3.1 Message Definition

[0080] The AUTHENTICATION RESULT message is sent by the AMF to the UE to provide the result of the EAP authentication of the UE identity. See Table 8.2.3.1.1.

[0081] Message Type: AUTHENTICATION RESULT (Authentication result)

[0082] Importance: Double

[0083] Direction: Network to UE

[0084] Table 8.2.3.1.1: AUTHENTICATION RESULT message content

[0085]

[0086] 8.2.4 Authentication Failure

[0087] 8.2.4.1 Message Definition

[0088] The AUTHENTICATION FAILURE message is sent by the UE to the AMF to indicate that authentication with the network has failed. See Table 8.2.4.1.1.

[0089] Message Type: AUTHENTICATION FAILURE (Authentication failure)

[0090] Importance: Double

[0091] Direction: UE to network

[0092] Table 8.2.4.1.1: AUTHENTICATION FAILURE message content

[0093]

[0094] 8.2.5 Authentication Rejection

[0095] 8.2.5.1 Message Definition

[0096] The AUTHENTICATION REJECT message is sent by the AMF to the UE to indicate that the authentication procedure has failed and the UE will abort all activities. See Table 8.2.5.1.1.

[0097] Message Type: AUTHENTICATION REJECT (Authentication Rejection)

[0098] Importance: Double

[0099] Direction: Network to UE

[0100] Table 8.2.5.1.1: AUTHENTICATION REJECT message content

[0101]

[0102] *****End Excerpt from 3GPP TS24.501***** Summary of the invention

[0103] A system and method for supporting remote UE authentication via a relay user equipment (UE) is disclosed. In one embodiment, a method performed by a relay UE includes: receiving a first message delivered by a remote UE, and sending a second message to a relay access and mobility function (AMF), wherein the second message includes a UE-to-network (U2N) connection mapping identifier (ID) identifying the remote UE. In this way, the relay UE and the relay AMF can identify that the second message (e.g., an authentication-related message) is for the remote UE.

[0104] In one embodiment, the second message also includes a subscription hidden ID of the remote UE. In one embodiment, the second message also includes: a relay service code received in the first message, a random number received in the first message, or both the relay service code received in the first message and the random number received in the first message.

[0105] In one embodiment, the second message is a relay key request.

[0106] In one embodiment, the first message is a direct communication request (DCR) message.

[0107] In one embodiment, the method further includes: receiving a first authentication message delivered by a relay AMF, wherein the authentication message includes a U2N connection mapping ID identifying a remote UE, and sending a second authentication message to the remote UE identified by the U2N connection mapping ID included in the first authentication message. In one embodiment, the first authentication message also includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the second authentication message includes the EAP message and / or one or more parameters. In one embodiment, the second authentication message is a PC5-S message. In one embodiment, the first authentication message is a relay authentication request.

[0108] In one embodiment, the method further comprises: receiving a third authentication message transmitted by the remote UE, and sending a fourth authentication message to the relay AMF, wherein the fourth authentication message comprises a U2N connection mapping ID identifying the remote UE. In one embodiment, the third authentication message comprises an EAP message and / or one or more parameters, and the fourth authentication message comprises an EAP message and / or one or more parameters. In one embodiment, the third authentication message is a PC5-S message.

[0109] In one embodiment, the method further comprises: receiving a relay key response message delivered by the relay AMF, wherein the relay key response comprises a U2N connection mapping ID identifying the remote UE, and sending a message to the remote UE identified by the U2N connection mapping ID included in the relay key response message. In one embodiment, the relay key response message further comprises 5GPRUK ID, K NR_ProSe and / or Nonce_2, and the message sent includes 5GPRUK ID and / or Nonce_2. In one embodiment, the method further includes: NR_ProSe The PC5 session key Krelay-sess and / or confidentiality and integrity keys are derived. In one embodiment, the message sent is a direct security mode command.

[0110] In one embodiment, the method further comprises: receiving a direct security completion message transmitted by the remote UE.

[0111] In one embodiment, the method further comprises: assigning a U2N connection mapping ID to the remote UE.

[0112] In one embodiment, the U2N connection mapping ID is a temporary ID.

[0113] In one embodiment, the method further comprises: storing a mapping between the U2N connection mapping ID and the ID of the remote UE. In one embodiment, the ID of the remote UE is a layer 2 ID of the remote UE.

[0114] In one embodiment, the U2N Connection Mapping ID is the layer 2 ID of the remote UE.

[0115] In one embodiment, the U2N connection mapping ID is the Universal Public Subscription Identifier (GPSI) of the remote UE.

[0116] In one embodiment, the U2N connection mapping ID is the user information ID of the remote UE.

[0117] An embodiment of a corresponding relay UE is also disclosed. In one embodiment, the relay UE is adapted to receive a first message delivered by a remote UE and send a second message to the relay AMF, wherein the second message includes a U2N connection mapping ID identifying the remote UE.

[0118] In one embodiment, the relay UE includes a communication circuit and a processing circuit associated with the communication circuit. The processing circuit is configured to cause the relay UE to receive a first message delivered by the remote UE and send a second message to the relay AMF, wherein the second message includes a U2N connection mapping ID identifying the remote UE.

[0119] An embodiment of a method performed by a relay AMF is also disclosed. In one embodiment, a method performed by a relay AMF includes: receiving a first message delivered by a relay UE, wherein the first message includes a U2N connection mapping ID identifying a remote UE. The method also includes: selecting an authentication server function (AUSF), storing a mapping between the U2N connection mapping ID and an ID of the selected AUSF, and sending a second message to the selected AUSF.

[0120] In one embodiment, the first message further includes a subscription hidden identifier of the remote UE. In one embodiment, the first message further includes: a relay service code, a random number, or both the relay service code and the random number.

[0121] In one embodiment, the first message is a relay key request.

[0122] In one embodiment, the second message sent to the selected AUSF includes: (a) a subscription hidden identifier of the remote UE, (b) a relay service code, (c) a random number, or (d) a combination of any two or more of (a)-(d).

[0123] In one embodiment, the second message sent to the selected AUSF includes a subscription hiding identifier of the remote UE, and selecting the AUSF includes: selecting the AUSF based on the subscription hiding ID of the remote UE.

[0124] In one embodiment, the message sent to the selected AUSF is a Nausf_UEAuthentication_Authenticate request message.

[0125] In one embodiment, the method further comprises: verifying that the relay UE is authorized to act as a U2N relay.

[0126] In one embodiment, the method further comprises: sending a first authentication message to the relay UE, wherein the first authentication message comprises the U2N connection mapping ID. In one embodiment, the first authentication message further comprises an EAP message and / or one or more parameters.

[0127] In one embodiment, the method further includes: receiving a second authentication message delivered by the relay UE, wherein the second authentication message includes a U2N connection mapping ID, and sending a third authentication message to the AUSF mapped to the USN connection mapping ID included in the second authentication message. In one embodiment, the second authentication message also includes an EAP message and / or one or more parameters, and the third authentication message includes the EAP message and / or one or more parameters included in the second authentication message. In one embodiment, sending the third authentication message to the AUSF includes calling the Nausf_UEAuthentication service of the AUCF. In one embodiment, the method further includes: receiving an authentication response message delivered by the AUSF, wherein the authentication response message includes one or more parameters, and sending an authentication response message to the relay UE, wherein the authentication response message includes one or more parameters included in the received authentication response and the U2N connection mapping ID. In one embodiment, the sent authentication response message is a relay key response. In one embodiment, the one or more parameters included in the received authentication response include 5G PRUK ID, K NR_ProSe , and / or Nonce_2.

[0128] In one embodiment, the U2N connection mapping ID is a temporary ID.

[0129] In one embodiment, the U2N Connection Mapping ID is the layer 2 ID of the remote UE.

[0130] In one embodiment, the U2N connection mapping ID is the GPSI of the remote UE.

[0131] In one embodiment, the U2N connection mapping ID is the user information ID of the remote UE (302).

[0132] An embodiment of a corresponding relay AMF is also disclosed. In one embodiment, the relay AMF is adapted to receive a first message delivered by a relay UE, wherein the first message includes a U2N connection mapping ID identifying a remote UE. The relay AMF is further adapted to select an AUSF, store a mapping between the U2N connection mapping ID and an ID of the selected AUSF, and send a second message to the selected AUSF.

[0133] In one embodiment, the relay AMF includes a network interface and a processing circuit associated with the network interface. The processing circuit is configured to cause the relay AMF to receive a first message delivered by the relay UE, wherein the first message includes a U2N connection mapping ID identifying the remote UE. The processing circuit is also configured to cause the relay AMF to select an AUSF, store a mapping between the U2N connection mapping ID and an ID of the selected AUSF, and send a second message to the selected AUSF. BRIEF DESCRIPTION OF THE DRAWINGS

[0134] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate various aspects.

[0135] Figure 1 The UE to Network Relay Security procedure during PC5 link establishment is shown, where the Network Prose security context is set up.

[0136] Figure 2 The EAP-based primary authentication and key negotiation process is shown.

[0137] Figure 3 Systems and flow diagrams according to some aspects are shown.

[0138] Figure 4A is a flow chart illustrating a process according to some aspects.

[0139] Figure 4B is a flow chart illustrating a process according to some aspects.

[0140] Figure 5 is a flow chart illustrating a process according to some aspects.

[0141] Figure 6 A user device according to some aspects is shown.

[0142] Figure 7 An apparatus according to some aspects is shown. DETAILED DESCRIPTION

[0143] In the present application, the term "node" may be a network node or a user equipment (UE). Examples of network nodes include, but are not limited to, a Node B, a base station (BS), a multi-standard radio (MSR) radio node (such as an MSR BS), an eNodeB, a gNodeB, a master eNB (MeNB), a secondary eNB (SeNB), an integrated access backhaul (IAB) node, a network controller, a radio network controller (RNC), a base station controller (BSC), a relay, a donor node controlling a relay, a base transceiver station (BTS), a central unit (e.g., in a gNB), a distributed unit (e.g., in a gNB), a baseband unit, a centralized baseband, a C-RAN, an access point (AP), a transmission point, a transmission node, a remote radio unit (RRU), a remote radio head (RRH), a node in a distributed antenna system (DAS), a core network node (e.g., a mobile switching center (MSC), a mobility management entity (MME), etc.), an operations management (O&M), an operations support system (OSS), a self-organizing network (SON), a positioning node (e.g., an evolved serving mobile positioning center (E-SMLC)).

[0144] In this application, the term "user equipment" or "UE" refers to a non-limiting term for any type of wireless device that communicates with a network node and / or with another UE in a cellular or mobile communication system. Examples of UEs include, but are not limited to, target devices, device-to-device (D2D) UEs, vehicle-to-vehicle (V2V), machine-type UEs, machine-type communication (MTC) UEs, UEs capable of machine-to-machine (M2M) communication, PDAs, tablets, (one or more) mobile terminals, smart phones, laptop embedded devices (LEEs), laptop mounted devices (LMEs), and USB dongles.

[0145] In this application, the terms "radio network node", "network node" and "NW node" are general terms that refer to any type of network node, including but not limited to base station, radio base station, base transceiver station, base station controller, network controller, evolved Node B (eNB), Node B, gNodeB (gNB), relay node, access point (AP), radio access point, remote radio unit (RRU), remote radio head (RRH), central unit (e.g., in gNB), distributed unit (e.g., in gNB), baseband unit, centralized baseband, and C-RAN.

[0146] In this application, the term "radio access technology" or "RAT" may refer to any RAT, including but not limited to UTRA, E-UTRA, Narrowband Internet of Things (NB-IoT), WiFi, Bluetooth, Next Generation RAT, New Radio (NR), 4G and 5G. Any device represented by the term "node", "network node" or "radio network node" may be capable of supporting a single or multiple RATs.

[0147] The 3rd Generation Partnership Project (3GPP) Technical Specification (TS) 33.503v0.2.0 clause 6.3.3.3.2 states that further details on the authentication message processing in the UE, the access and mobility function (AMF) of the relay UE, and the authentication server function (AUSF) are for further study. In other words, 3GPP TS 33.503v0.2.0 does not provide Figure 6 .3.3.3.2-1(in Figure 1 ) in detail of step 7.

[0148] The existing authentication process is between the UE and the network (e.g., AMF). If the same authentication message as defined in 3GPP TS24.501 is used, when the relay UE receives the authentication message from the AMF, the relay UE cannot determine whether the message is (a) for itself or (b) for a remote UE. In addition, if the message is for a remote UE, the relay UE cannot determine which remote UE the message is for. Similarly, when the relay UE forwards the authentication message from the remote UE to the AMF, the AMF does not know whether the message is (a) for the relay UE or (b) for the remote UE. In addition, if the message is for a remote UE, the AMF does not know which remote UE the message is for. Therefore, the AMF does not know which AUSF the AMF needs to contact to perform the authentication process.

[0149] Aspects of the solution(s) disclosed herein may overcome one or more problems of existing solutions by having the relay UE use a UE-to-network (U2N) connection mapping identifier (ID) (e.g., a temporary ID) to identify the remote UE to the AMF. In some aspects, the relay UE may provide the U2N connection mapping ID to the AMF. In some aspects where the U2N connection mapping ID is a temporary ID, the relay UE may allocate a temporary ID to the remote UE and provide the temporary ID to the AMF. In some aspects, the relay UE may maintain a mapping between the remote UE L2 ID and the temporary ID. In some aspects, when the AMF sends an authentication message for the remote UE to the relay UE, the AMF may include the U2N connection mapping ID (e.g., a temporary ID) in the authentication message. In some aspects, the relay UE may use the U2N connection mapping ID in the message from the AMF to know which remote UE the authentication message is for. In some aspects, the AMF may maintain a mapping between the U2N connection mapping ID of the remote UE and the AUSF ID. In some aspects, the AMF may use the mapping to forward an extensible authentication protocol (EAP) message to the correct AUSF.

[0150] In one embodiment, the relay UE may use the U2N connection mapping ID in the authentication message to identify the remote UE to which the authentication message is intended. The relay UE may include the U2N connection mapping ID in a message to the relay AMF (e.g., an authentication and / or relay key request message). The relay AMF may store a mapping between the U2N connection mapping ID and the ID of the authentication server function (AUSF). The relay AMF may receive a message (e.g., an authentication and / or authentication response message) from the AUSF, use the mapping to select the U2N connection mapping ID, and include the U2N connection mapping ID in the message forwarded to the relay UE. The relay UE may receive an authentication message including the U2N connection mapping ID, use the U2N connection mapping ID to identify the remote UE, and send a PC5-S message to the remote UE.

[0151] Aspects of the solution(s) disclosed herein may provide the following advantages: providing details about authentication message processing in the UE, the AMF and the AUSF of the relay UE with little impact on current standards. Aspects of the solution(s) disclosed herein may additionally or alternatively provide the advantage that the relay UE and the AMF are able to recognize that the authentication is for a remote UE. In some aspects, in this way, the remote UE may be enabled to authenticate itself to the network via the relay UE. Aspects of the solution(s) disclosed herein may additionally or alternatively provide the advantage of enabling multiple remote UEs to be authenticated simultaneously via the same relay UE.

[0152] One aspect of the solution(s) disclosed herein may provide a method performed by a relay UE. The method may include: receiving a message delivered by a remote UE. The method may include: sending a message to a relay AMF. The sent message may include a U2N connection mapping ID identifying the remote UE.

[0153] In some aspects, the message transmitted by the remote UE may be a direct communication request (DCR) message. In some aspects, the message transmitted by the remote UE may include the security capabilities of the remote UE, the security policy of the remote UE, a subscription concealment identifier (SUCI), a relay service code, and / or Nonce_1. In some aspects, the message sent including the U2N connection mapping ID may also include the ID of the remote UE, the SUCI, the relay service code, and / or the Nonce_1. In some aspects, the message sent including the U2N connection mapping ID may be a relay key request.

[0154] In some aspects, the method may further include: receiving an authentication message delivered by a relay AMF. The received authentication message may include a U2N connection mapping ID. In some aspects, the method may further include: identifying a remote UE using the received U2N connection mapping ID. In some aspects, the method may further include: sending an authentication message to the identified remote UE. In some aspects, the received authentication message also includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the sent authentication message may include an EAP message and / or one or more parameters. In some aspects, the sent authentication message may be a PC5-S message (e.g., a dedicated PC5-S message). In some aspects, the sent authentication message may include a U2N connection mapping ID. In some alternative aspects, the sent authentication message does not include a U2N connection mapping ID.

[0155] In some aspects, the method may further include: receiving an authentication message delivered by a remote UE, and the received authentication message may include the U2N connection mapping ID. In some aspects, the method may further include: sending an authentication message to a relay AMF, and the sent authentication message may include the U2N connection mapping ID.

[0156] In some aspects, the method may further include: receiving an authentication message delivered by a remote UE, and the received authentication message does not include the U2N connection mapping ID. In some aspects, the method may further include: sending an authentication message to a relay AMF, and the sent authentication message may include the U2N connection mapping ID.

[0157] In some aspects, the authentication message transmitted by the remote UE may include an EAP message and / or one or more parameters, and the authentication message sent to the relay AMF may include an EAP message and / or one or more parameters. In some aspects, the received authentication message is a PC5-S message (e.g., a dedicated PC5-S message).

[0158] In some aspects, the method may further include: receiving a relay key response message delivered by the relay AMF, and the relay key response may include a U2N connection mapping ID. In some aspects, the method may further include: identifying a remote UE using the received U2N connection mapping ID. In some aspects, the method may further include: sending a message to the identified remote UE. In some aspects, the received relay key response message may also include a 5GPRUK ID, a KNR_ProSe, and / or a Nonce_2, and the message sent may include a 5GPRUK ID and / or a Nonce_2. In some aspects, the method may further include: deriving a PC5 session key Krelay-sess and / or a confidentiality and integrity key from the KNR_ProSe. In some aspects, the message sent by so may be a direct security mode command.

[0159] In some aspects, the method may also include receiving a direct security completion message communicated by the remote UE.

[0160] In some aspects, the method may further include: assigning a U2N connection mapping ID to the remote UE. In some aspects, the U2N connection mapping ID may be a temporary ID. In some aspects, the method may further include: storing a mapping between the U2N connection mapping ID and the ID of the remote UE. In some aspects, the ID of the remote UE may be a layer 2 ID of the remote UE.

[0161] In some aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a universal public subscription identifier (GPSI) of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE.

[0162] Another aspect of the solution(s) disclosed herein may provide a relay user equipment UE. The relay UE may be configured to receive a message delivered by a remote UE. The relay UE may be configured to send a message to a relay AMF, and the sent message may include a U2N connection mapping ID identifying the remote UE.

[0163] Another aspect of the solution(s) disclosed herein may provide a method performed by a relay AMF. The method may include receiving a message delivered by a relay UE, the message may include a U2N connection mapping ID. The method may include selecting an AUSF. The method may include storing a mapping between the U2N connection mapping ID and an ID of the selected AUSF. The method may include sending a message to the selected AUSF.

[0164] In some aspects, the message communicated by the relay UE may be a relay key request.

[0165] In some aspects, the message delivered by the relay UE may also include the remote UE's ID, the remote UE's SUCI, the relay service code, and / or Nonce_1. In some aspects, the remote UE's ID may be the remote UE's layer 2 ID. In some aspects, the message sent to the selected AUSF may include the remote UE's SUCI, the relay service code, and / or Nonce_1. In some aspects, the AUSF may be selected based on the remote UE's SUCI.

[0166] In some aspects, the message sent to the selected AUSF may be a Nausf_UEAuthentication_Authenticate request message.In some aspects, the method may also include verifying that the relay UE is authorized to act as a U2N relay.

[0167] In some aspects, the method may further include: sending an authentication message to the relay UE, and the authentication message may include the U2N connection mapping ID. In some aspects, the authentication message may also include an Extensible Authentication Protocol (EAP) message and / or one or more parameters.

[0168] In some aspects, the method may further include: receiving an authentication message delivered by a relay UE, and the received authentication message may include a U2N connection mapping ID. In some aspects, the method may further include: using the received U2N connection mapping ID and mapping to identify the selected AUSF. In some aspects, the method may further include: sending an authentication message to the identified AUSF. In some aspects, the received authentication message may also include an EAP message and / or one or more parameters, and the sent authentication message may include an EAP message and / or one or more parameters. In some aspects, sending the authentication message to the identified AUSF may include invoking the Nausf_UEAuthentication service of the identified AUSF.

[0169] In some aspects, the method may further include: receiving an authentication response message delivered by the AUSF, and the authentication response message may include one or more parameters. In some aspects, the method may further include: using a mapping to select a U2N connection mapping ID. In some aspects, the method may further include: sending an authentication response message to the relay UE, and the authentication response message may include one or more parameters and the selected U2N connection mapping ID. In some aspects, the authentication response message sent may be a relay key response. In some aspects, the one or more parameters may include a 5GPRUK ID, KNR_ProSe, and / or Nonce_2.

[0170] In some aspects, the U2N connection mapping ID may be a temporary ID. In some alternative aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a GPSI of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE.

[0171] Another aspect of the present invention may provide a relay AMF. The relay AMF may be configured to receive a message delivered by the relay UE, and the message may include a U2N connection mapping ID. The relay AMF may be configured to select an AUSF. The relay AMF may be configured to store a mapping between the U2N connection mapping ID and the ID of the selected AUSF. The relay AMF may be configured to send a message to the selected AUSF.

[0172] Another aspect of the solution(s) described herein may provide a method performed by a relay UE. The method may include receiving an authentication message delivered by a relay AMF, and the received authentication message may include an EAP message and / or one or more parameters. The method may include sending a PC5-S message to a remote UE, and the PC5-S message may include an EAP message and / or one or more parameters.

[0173] In some aspects, the received authentication message may include a U2N connection mapping ID, and the method may further include: using the U2N connection mapping ID to identify the remote UE. In some aspects, the sent authentication message may include the U2N connection mapping ID. In some alternative aspects, the sent authentication message does not include the U2N connection mapping ID.

[0174] In some aspects, the method may further include receiving a DCR message communicated by the remote UE.

[0175] In some aspects, the method may further include: sending a relay key request including the U2N connection mapping ID. In some aspects, the DCR message may include the security capabilities of the remote UE, the security policy of the remote UE, the SUCI, the relay service code, and / or the Nonce_1. In some aspects, the relay key request may also include the ID of the remote UE, the SUCI, the relay service code, and / or the Nonce_1.

[0176] In some aspects, the method may further include: assigning a U2N connection mapping ID to the remote UE. In some aspects, the method may further include: storing a mapping between the U2N connection mapping ID and the ID of the remote UE. In some aspects, using the U2N connection mapping ID to identify the remote UE may include using the U2 connection mapping ID and the mapping to identify the remote UE. In some aspects, the ID of the remote UE may be a layer 2 ID of the remote UE.

[0177] In some aspects, the method may further include: receiving an authentication message delivered by a remote UE, and the received authentication message may include a U2N connection mapping ID. In some aspects, the method may further include: sending an authentication message to a relay AMF, and the sent authentication message may include a U2N connection mapping ID. In some alternative aspects, the method may further include: receiving an authentication message delivered by a remote UE, and the received authentication message does not include a U2N connection mapping ID. In some aspects, the method may further include: identifying a U2N connection mapping ID, and sending an authentication message to a relay AMF, and the sent authentication message may include the identified U2N connection mapping ID.

[0178] In some aspects, the authentication message delivered by the remote UE may include an EAP message and / or one or more parameters, and the authentication message sent to the relay AMF may include an EAP message and / or one or more parameters. In some aspects, the received authentication message may be a PC5-S message (e.g., a dedicated PC5-S message).

[0179] In some aspects, the method may further include: receiving a relay key response message delivered by the relay AMF, and the relay key response may include a U2N connection mapping ID. In some aspects, the method may further include: using the received U2N connection mapping ID to identify the remote UE. In some aspects, the method may further include: sending a direct security mode command to the identified remote UE. In some aspects, the received relay key response message may also include a 5GPRUK ID, a KNR_ProSe, and / or a Nonce_2, and the direct security mode command may include a 5GPRUK ID and / or a Nonce_2. In some aspects, the method may further include: deriving a PC5 session key Krelay-sess and / or a confidentiality and integrity key from the KNR_ProSe.

[0180] In some aspects, the U2N connection mapping ID may be a temporary ID. In some alternative aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a GPSI of the remote UE. In some alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE.

[0181] In some aspects, the method may further include receiving a direct security complete message communicated by the remote UE. In some aspects, the PC5-S message is a dedicated PC5-S message.

[0182] Another aspect of the solution(s) described herein may provide a relay UE. The relay UE may be configured to receive an authentication message delivered by the relay AMF. The relay UE may be configured to send an authentication message to the remote UE, and the authentication message sent may be a PC5-S message.

[0183] Another aspect of the solution(s) described herein may provide a computer program comprising instructions for adapting an apparatus to perform any of the methods set forth above. Another aspect of the invention may provide a carrier containing the computer program, and the carrier may be one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium.

[0184] Yet another aspect of the solution(s) described herein may provide an apparatus comprising a processing circuit and a memory. The memory contains instructions executable by the processing circuit, whereby the apparatus is operable to perform any of the methods set forth above.

[0185] A further aspect of the solution(s) described herein may provide an apparatus suitable for any of the methods set forth above.

[0186] A further aspect of the solution(s) described herein may provide any combination of the aspects set forth above.

[0187] Figure 3 A system 300 according to some aspects is shown. In some aspects, such as Figure 3 As shown, the system 300 may include one or more nodes. In some aspects, the nodes of the system 300 may include a remote UE 302, a relay UE 304, a remote AMF 306, a relay AMF 308, an AUSF 310 (e.g., a remote AUSF), and / or a unified data management (UDM) 310. In some aspects, the system 300 may perform a process 350.

[0188] In some aspects, process 350 may include step 1, which may include: Figure 1 That is, in some aspects, step 1 of process 350 may include remote UE 302 and / or relay UE 304 registering with the network, such as Figure 1 0a and / or 0b of and / or described in step 0 of clause 6.3.3.3.2 of 3GPP TS 33.503v0.2.0. In some aspects, a UE-to-network relay (e.g., relay UE 304) may be authenticated and authorized by the network to support functioning as a relay UE. In some aspects, remote UE 302 shall be authenticated and authorized by the network to function as a remote UE. In some aspects, step 1 of process 350 may additionally or alternatively include the remote UE 302 initiating a discovery process (e.g., using either a Model A or Model B approach as specified in clauses 6.3.1.2 or 6.3.1.3 of TS23.304, respectively), as Figure 1 In some aspects, step 1 of process 350 may include, after discovering the UE to network relay, the remote UE 302 sending a direct communication request (DCR) message to the relay UE 304 for establishing a secure PC5 unicast link, such as Figure 1 2 and / or described in steps 2-5 of clause 6.3.3.3.2 of 3GPP TS 33.503v0.2.0. In some aspects, the remote UE 302 may include the security capabilities and / or security policies of the remote UE 302 in the DCR message (e.g., as specified in 3GPP TS 33.536). In some aspects, the DCR message may additionally or alternatively include a subscription concealment identifier (SUCI), a relay service code, and / or Nonce_1.

[0189] In some aspects, process 350 may include step 2, where relay UE 304, upon receiving the DCR message, assigns a temporary ID to remote UE 302. In some aspects, relay UE 102 may maintain a mapping between the temporary ID and the ID of remote UE 302 (e.g., the layer 2 ID of remote UE 302).

[0190] In some aspects, the process 350 may include step 3, where the relay UE 304 sends a relay key request to the relay AMF 308, and the relay AMF 308 receives the relay key request. In some aspects, the relay key request may include one or more of a temporary ID, an ID of the remote UE 302 (e.g., a layer 2 ID of the remote UE 302), and / or parameters received in the DCR message (e.g., a SUCI of the remote UE 302, a relay service code, and / or Nonce_1).

[0191] In some aspects, the process 350 may include step 4, in which the relay AMF 308 verifies whether the relay UE 304 is authorized to act as a UE-to-network (U2N) relay. In some aspects, in step 4, the relay AMF 308 may select the AUSF 310 based on the SUCI of the remote UE 302 that may be received in the relay key request in step 3. For example, in some aspects, the relay AMF 308 may select the AUSF 310 based on the routing indicator in the SUCI of the remote UE 302. In some aspects, the relay AMF 308 may maintain a mapping between a temporary ID (e.g., the temporary ID received in the relay key request in step 3) and the ID of the AUSF 310 selected for the remote UE 302. In some aspects, in step 4, the relay AMF 308 may forward the relay key request to the selected AUSF 310 in a Nausf_UEAuthentication_Authenticate request message. In some aspects, the Nausf_UEAuthentication_Authenticate request message may include one or more of the ID of the remote UE 302 (e.g., the layer 2 ID of the remote UE 302) and / or the parameters received by the relay UE 304 in the DCR message (e.g., the SUCI of the remote UE 302, the relay service code, and / or Nonce_1).

[0192] In some aspects, in step 4, the AUSF 310 may receive the forwarded Relay Key Request. In some aspects, in step 4, the AUSF 310 may retrieve an authentication vector from the UDM 312 (e.g., using a Nudm_UEAuthentication_Get message). In some aspects, in step 4, the AUSF 310 may trigger a primary authentication of the remote UE 302 (e.g., using existing procedures as specified in 3GPP TS 33.501).

[0193] In some aspects, step 4 of process 350 may be similar to Figure 1Steps 4-6 shown and described in 3GPP TS 33.503v0.2.0 clause 6.3.3.3.2, wherein the relay AMF 308 additionally maintains a mapping between the temporary ID and the AUSF ID. In some aspects, the relay AMF 308 may then use the mapping to forward the EAP message to the correct AUSF 310.

[0194] In some aspects, the process 350 may include steps 5 and 6, wherein the remote UE 302 and the relay AMF 308 exchange authentication messages via the relay UE 304. That is, in some aspects, the process 350 may include step 5, wherein the relay AMF 308 sends an authentication message to the remote UE 302 via the relay UE 304. In some aspects, the authentication message may be, for example, an authentication request, rejection, failure, or result message. In some aspects, the authentication message sent by the relay AMF 308 and received by the relay UE 304 in step 5 may include a temporary ID, an EAP message, and / or one or more parameters. In some aspects, the relay UE 304 may use the temporary ID and the mapping to identify the remote UE 302 to which the authentication message should be forwarded.

[0195] In some aspects, step 5 may include step 5a, in which the relay UE 304 forwards the authentication message to the remote UE 302 identified by the temporary ID and the mapping. In some aspects, the relay UE 304 may use a PC5-S message (e.g., a dedicated PC5-S message) to forward the authentication message to the remote UE 302. In some aspects, the relay UE 304 may determine the destination layer 2 ID of the PC5-S message based on the mapping between the layer 2 ID of the remote UE 302 and the temporary ID. In some aspects, the authentication message forwarded by the relay UE 304 to the remote UE 302 may include an EAP message and / or one or more parameters. In some aspects, the authentication message forwarded by the relay UE 304 to the remote UE 302 may additionally include the temporary ID. In some alternative aspects, the relay UE 304 may remove the temporary ID from the authentication message forwarded by the relay UE 304 to the remote UE 302. In some aspects, in step 5, the remote UE 302 may receive the authentication message forwarded by the relay UE 304.

[0196] In some aspects, the process 350 may include step 6, wherein the remote UE 302 sends an authentication message to the relay AMF 308 via the relay UE 304. In some aspects, the authentication message may be, for example, an authentication request, a rejection, a failure, or a result message. In some aspects, step 6 may include step 6a, wherein the remote UE 302 sends the authentication message and the relay UE 304 receives the authentication message. In some aspects, the remote UE 302 may send the authentication message to the relay UE 304 using a PC5-S message (e.g., a dedicated PC5-S message). In some aspects, the authentication message sent by the remote UE 302 and received by the relay UE 304 in step 6a may include an EAP message and / or one or more parameters. In some aspects, if the authentication message received by the remote UE 302 in step 5a includes a temporary ID, the remote UE 302 may include the temporary ID in the authentication message sent by the remote UE 302 and received by the relay UE 304 in step 6a.

[0197] In some aspects, step 6 may include the relay UE 304 forwarding the authentication message to the relay AMF 308. In some aspects, the authentication message forwarded by the relay UE 304 to the relay AMF 308 may include the EAP message and / or one or more parameters. In some aspects, the authentication message forwarded by the relay UE 304 to the remote UE 302 may additionally include a temporary ID. In some aspects, if the authentication message sent by the remote UE 302 and received by the relay UE 304 in step 6 includes a temporary ID (e.g., a temporary ID included in the authentication message received by the remote UE 302 in step 5), the authentication message forwarded by the relay UE 304 to the relay AMF 308 may include the temporary ID in the authentication message sent by the remote UE 302 and received by the relay UE 302 in step 6. In some aspects, if the authentication message sent by the remote UE 302 and received by the relay UE 304 in step 6 does not include a temporary ID (e.g., because the relay UE 304 removed the temporary ID from the authentication message forwarded to the remote UE 302 in step 5), the relay UE 304 may add the temporary ID assigned to the remote UE 302 (e.g., the temporary ID assigned to the remote UE 302 in step 2). In various aspects, in step 6, the relay AMF 308 may receive the authentication message forwarded by the relay UE 304.

[0198] In some aspects, the authentication messages exchanged in steps 5 and 6 may be messages defined in 3GPP TS 24.501 (e.g., AUTHENTICATION REQUEST, AUTHENTICATION RESPONSE, AUTHENTICATION REJECT, AUTHENTICATION FAILURE, or AUTHENTICATION RESULT). In some alternative aspects, the authentication messages exchanged in steps 5 and 6 may be new types of messages (e.g., remote UE authentication request, response, rejection, failure, or result).

[0199] In some aspects, the process 350 may include step 7, where the relay AMF 308 forwards the EAP message (e.g., the EAP message of the authentication message received by the relay AMF in step 6) to the AUSF 310. In some aspects, the relay AMF 308 may use the temporary ID in the authentication message received in step 6 and the mapping between the temporary ID and the AUSF ID to identify the correct AUSF 310 to which the EAP message should be forwarded. In some aspects, the relay AMF 308 may invoke the Nausf_UEAuthentication service of the AUSF 310 to forward the EAP message (e.g., based on the mapping between the temporary ID and the ID of the AUSF 310 selected for the remote UE 302). In some aspects, in step 7, the AUSF 310 may receive the EAP message.

[0200] In some aspects, process 350 may include step 8, which may include steps similar to Figure 1 One or more of steps 8-14 as shown and described in 3GPP TS 33.503 v0.2.0 clause 6.3.3.3.2, wherein the relay AMF 308 includes the temporary ID in the relay key response message sent to the relay UE 304. That is, in some aspects, step 8 of process 350 may include that upon successful primary authentication (e.g., in steps 5-7 of process 350), the AUSF 310 and the remote UE 102 may generate a 5GPRUK (e.g., as specified in Annex A.2 of 3GPP TS 33.503) and a 5GPRUK ID (e.g., as specified in Annex A.3 of 3GPP TS 33.503) using the newly derived KAUSF. In some aspects, step 8 of process 350 may include the AUSF 310 generating a K NR_ProSeIn some aspects, step 8 of process 350 may include the AUSF 310 sending 5GPRU KID, KID, and KID to the UE-to-network relay via the relay AMF 308 in a Nausf_UEAuthentication_Authenticate response message. NR_ProSe , and / or Nonce_2.

[0201] In some aspects, the relay AMF 308 may receive the 5GPRUK ID, K NR_ProSe In some aspects, the relay AMF 308 may include the temporary ID in the relay key response. In some aspects, the relay AMF 308 may select the temporary ID to include in the relay key response based on a mapping between the temporary ID and the ID of the AUSF 310 that was selected for the remote UE 302 and sent the 5G RUK ID, K ID, and / or Nonce_2 (e.g., in a Nausf_UEAuthentication_Authenticate response message), and send a relay key response to the relay UE 304. ... NR_ProSe In some aspects, when receiving K from AUSF 310, NR_ProSe , the relay AMF 308 may not attempt to trigger a NAS SMC procedure with the remote UE 302. In some aspects, the relay UE 304 may use a KDF (e.g., as defined in clause 6.3.3.3.4 of 3GPP TS 33.503) to obtain the K NR_ProSe The PC5 session key Krelay-sess and confidentiality and integrity keys are derived. In some aspects, K can be established in the same manner as the KNRP ID and KNRP-sess ID in TS 33.536. NR_ProSe ID and Krelay-sess ID.

[0202] In some aspects, step 8 of process 350 may include the relay UE 304 receiving a relay key response (e.g., including 5G PR UK ID, K NR_ProSe, Nonce_2, and / or temporary ID). In some aspects, the UE-to-network relay (e.g., the relay UE 304) may send the received 5GPRUK ID and / or Nonce_2 to the remote UE 302 (e.g., in a direct security mode command message). In some aspects, the relay UE 304 may use the received temporary ID and the mapping between the temporary ID and the remote UE ID to identify the remote UE 302 to send the 5GPRUK ID and / or Nonce_2. In some aspects, the relay UE 304 may include the received temporary ID in the direct security mode command message to the remote UE 302. However, this is not required, and in some alternative aspects, the relay UE 304 may include the received temporary ID in the direct security mode command message to the remote UE 302.

[0203] In some aspects, step 8 of process 350 may include the remote UE 302 using the 5GPRUK ID (e.g., received in the direct security mode command message) to locate the KAUSF and / or 5GPRUK for PC5 link security. In some aspects, the remote UE 302 may generate K in the same manner as described above. NR_ProSe The remote UE 302 may obtain a key from K in the same manner as defined above. NR_ProSe The PC5 session key Krelay-ses and confidentiality and integrity keys are derived. In some aspects, the remote UE 302 may send a Direct Security Mode Complete message to the UE-to-Network Relay.

[0204] In some aspects, process 350 may include relay UE 304 removing or discarding the temporary ID after remote UE 302 completes its authentication process.

[0205] In some aspects, the temporary ID may be used as a UE-to-network (U2N) connection mapping identity (ID). In some alternative aspects, instead of the temporary ID assigned by the relay UE 304 in step 2 of process 350, an existing remote UE 302 ID (e.g., a layer 2 ID of the remote UE 302, a universal public subscription identifier (GPSI) of the remote UE 302, a user information ID of the remote UE 302 from the application layer) is used.

[0206] Figure 4A 4 shows a process 400 performed by a relay UE 302 according to some aspects. In some aspects, such as Figure 4A As shown, process 400 may include step 402 , in which relay UE 304 receives a message communicated by remote UE 302 .

[0207] In some aspects, such as Figure 4A As shown, process 400 may include step 408, in which relay UE 304 sends a message to relay access and mobility function (AMF) 308. The sent message may include a UE-to-network (U2N) connection mapping identification (ID) identifying remote UE 302.

[0208] In some aspects, such as Figure 4A As shown, process 400 may include optional step 404, wherein relay UE 304 assigns a U2N connection mapping ID to remote UE 302. In some aspects, the U2N connection mapping ID may be a temporary ID. In some aspects, such as Figure 4A As shown, process 400 may include optional step 406, in which relay UE 304 stores a mapping between the U2N connection mapping ID and the ID of the remote UE 302. In some aspects, the ID of the remote UE 302 may be a layer 2 ID of the remote UE 302. In some alternative aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE 302. In some other alternative aspects, the U2N connection mapping ID may be a universal public subscription identifier (GPSI) of the remote UE 302. In some further alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE 302 (e.g., from an application layer). In some aspects (e.g., in some aspects where the U2N connection mapping ID is a layer 2 ID of the remote UE 302), process 400 may not include steps 404 and 406. In some alternative aspects (e.g., in some aspects where the U2N connection mapping ID is the GPSI or user information ID of the remote UE 302), process 450 may not include step 404, but may include step 406, and the mapping may be between the GPSI or user information ID of the remote UE 302 and the layer 2 ID of the remote UE 302.

[0209] In some aspects, the message passed by the remote UE 302 and received by the relay UE 304 in step 408 may be a direct communication request (DCR) message. In some aspects, the message passed by the remote UE 302 and received by the relay UE 304 in step 408 may include the security capabilities of the remote UE 302, the security policy of the remote UE 302, a subscription concealment identifier (SUCI), a relay service code, and / or Nonce_1. In some aspects, the message including the U2N connection mapping ID sent to the relay AMF 308 in step 408 may also include the ID of the remote UE 302, the SUCI, the relay service code, and / or Nonce_1. In some aspects, the message including the U2N connection mapping ID sent to the relay AMF 308 in step 408 may be a relay key request.

[0210] In some aspects, such as Figure 4A As shown, process 400 may include optional step 410, in which the relay UE 304 receives an authentication message delivered by the relay AMF 308. In some aspects, the received authentication message may include a U2N connection mapping ID. In some aspects, optional step 410 may also include: using the received U2N connection mapping ID to identify the remote UE 302. In some aspects, the remote UE 302 may be identified using a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302 (e.g., if the relay UE 304 assigns a temporary ID to the remote UE 302) or using the U2N connection mapping ID itself (e.g., if the U2N connection mapping ID is a layer 2 ID, GPSI, or user information ID of the remote UE 302).

[0211] In some aspects, such as Figure 4A As shown, process 400 may include optional step 412, in which the relay UE 304 sends an authentication message to the remote UE 302 identified in step 410. In some aspects, the authentication message received in step 410 may also include an extensible authentication protocol (EAP) message and / or one or more parameters, and the authentication message sent in step 412 may include the EAP message and / or one or more parameters. In some aspects, the authentication message sent in step 412 may be a PC5-S message (e.g., a dedicated PC5-S message). In some aspects, the authentication message sent in step 412 may include a U2N connection mapping ID. In some alternative aspects, the authentication message sent in step 412 does not include the U2N connection mapping ID.

[0212] In some aspects, such as Figure 4A As shown, process 400 may include optional step 414, in which relay UE 304 receives an authentication message communicated by remote UE 302. In some aspects, the authentication message received in step 414 may include a U2N connection mapping ID. In some alternative aspects, the authentication message received in step 414 does not include the U2N connection mapping ID. In some aspects where the authentication message received in step 414 does not include the U2N connection mapping ID, step 414 may include identifying the U2N connection mapping ID (e.g., using a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302). In some aspects, as Figure 4AAs shown, process 400 may include optional step 416, wherein the relay UE 304 sends an authentication message to the relay access and mobility function (AMF) 308, and the authentication message sent in step 416 may include the U2N connection mapping ID. In some aspects, the authentication message communicated by the remote UE 302 and received by the relay UE 304 in step 414 may include an extensible authentication protocol (EAP) message and / or one or more parameters, and the authentication message sent to the relay AMF 308 in step 416 may include the EAP message and / or one or more parameters. In some aspects, the authentication message received in step 414 may include a PC5-S message (e.g., a dedicated PC5-S message).

[0213] In some aspects, such as Figure 4A As shown, process 400 may include optional step 418, wherein the relay UE 304 receives a relay key response message delivered by the relay AMF 308, and the relay key response may include the U2N connection mapping ID. In some aspects, step 418 may also include: using the received U2N connection mapping ID to identify the remote UE 302. In some aspects, the relay UE 308 may use a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302 (e.g., if the relay UE 304 assigns a temporary ID to the remote UE 302) or use the U2N connection mapping ID itself (e.g., if the U2N connection mapping ID is the layer 2 ID, GPSI, or user information ID of the remote UE 302) to identify the remote UE 302.

[0214] In some aspects, such as Figure 4A As shown, process 400 may include optional step 420, in which the relay UE 304 sends a message to the identified remote UE 302. In some aspects, the relay key response message received in step 418 may also include a 5GPRUK ID, KNR_ProSe, and / or Nonce_2, and the message sent in step 420 may include the 5GPRUK ID and / or Nonce_2. In some aspects, process 400 also includes deriving a PC5 session key Krelay-sess and / or confidentiality and integrity keys from KNR_ProSe. In some aspects, the message sent in step 420 may be a direct security mode command.

[0215] In some aspects, such as Figure 4A As shown, process 400 may include optional step 422 , in which relay UE 304 receives a direct security completion message communicated by remote UE 302 .

[0216] Figure 4BA process 450 is shown that is performed by a relay UE 302 according to some aspects. In some aspects, as Figure 4B As shown, process 450 may include optional step 452 , in which relay UE 304 receives a direct communication request (DCR) message communicated by remote UE 302 .

[0217] In some aspects, such as Figure 4B As shown, process 450 may include optional step 458, in which the relay UE 304 sends a relay key request including the U2N connection mapping ID. In some aspects, the DCR message received in step 452 may include the security capabilities of the remote UE 302, the security policy of the remote UE 302, a subscription concealed identifier (SUCI), a relay service code, and / or Nonce_1. In some aspects, the relay key request sent in step 458 may also include the ID of the remote UE 302, the SUCI, the relay service code, and / or Nonce_1.

[0218] In some aspects, such as Figure 4B As shown, process 450 may include optional step 454, wherein the relay UE 304 assigns the U2N connection mapping ID to the remote UE 302. In some aspects, the U2N connection mapping ID may be a temporary ID. In some aspects, such as Figure 4B As shown, process 450 may include optional step 456, in which relay UE 304 stores a mapping between the U2N connection mapping ID and the ID of the remote UE 302. In some aspects, the ID of the remote UE 302 may be a layer 2 ID of the remote UE 302. In some alternative aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE 302. In some other alternative aspects, the U2N connection mapping ID may be a universal public subscription identifier (GPSI) of the remote UE 302. In some further alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE 302 (e.g., from an application layer). In some aspects (e.g., in some aspects where the U2N connection mapping ID is a layer 2 ID of the remote UE 302), process 450 may not include steps 454 and 456. In some alternative aspects (e.g., in some aspects where the U2N connection mapping ID is the GPSI or user information ID of the remote UE 302), process 450 may not include step 454, but may include step 456, and the stored mapping may be, for example, between the GPSI or user information ID of the remote UE 302 and the layer 2 ID of the remote UE 302.

[0219] In some aspects, such as Figure 4BAs shown, the process 450 may include step 460, in which the relay UE 304 receives the authentication message delivered by the relay AMF 308, and the received authentication message may include the EAP message and / or one or more parameters. In some aspects, the authentication message received in step 460 may include a UE-to-network (U2N) connection mapping identification (ID), and step 460 may also include using the U2N connection mapping ID to identify the remote UE 302. In some aspects, the relay UE 304 may use a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302 (e.g., if the relay UE 304 assigns a temporary ID to the remote UE 302) or use the U2N connection mapping ID itself (e.g., if the U2N connection mapping ID is the layer 2 ID, GPSI, or user information ID of the remote UE 302) to identify the remote UE 302 in step 460.

[0220] In some aspects, such as Figure 4B As shown, process 450 may include step 462, wherein the relay UE 304 sends a PC5-S message to the remote UE 302, and the PC5-S message may include an EAP message and / or one or more parameters. In some aspects, the PC5-S message is a dedicated PC5-S message. In some aspects, the authentication message sent in step 462 may include a U2N connection mapping ID. In some alternative aspects, the authentication message sent in step 462 does not include the U2N connection mapping ID.

[0221] In some aspects, such as Figure 4B As shown, process 450 may include optional step 464, in which relay UE 304 receives an authentication message communicated by remote UE 302. In some aspects, the received authentication message may include a U2N connection mapping ID. In some alternative aspects, the received authentication message does not include the U2N connection mapping ID. In some aspects where the received authentication message does not include the U2N connection mapping ID in step 414, step 414 may include identifying the U2N connection mapping ID (e.g., using a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302).

[0222] In some aspects, such as Figure 4BAs shown, process 450 may include optional step 466, in which the relay UE 304 sends an authentication message to the relay AMF 308, and the sent authentication message may include the U2N connection mapping ID. In some aspects, the authentication message transmitted by the remote UE 302 and received by the relay UE 304 in step 464 may include an EAP message and / or one or more parameters, and the authentication message sent to the relay AMF in step 466 may include the EAP message and / or one or more parameters. In some aspects, the authentication message received in step 464 may be a PC5-S message (e.g., a dedicated PC5-S message).

[0223] In some aspects, such as Figure 4B As shown, process 450 may include optional step 468, wherein the relay UE 304 receives a relay key response message delivered by the relay AMF 308, and the relay key response may include the U2N connection mapping ID. In some aspects, step 468 may also include: using the received U2N connection mapping ID to identify the remote UE 302. In some aspects, the relay UE 308 may use a stored mapping between the U2N connection mapping ID and the ID of the remote UE 302 (e.g., if the relay UE 304 assigns a temporary ID to the remote UE 302) or use the U2N connection mapping ID itself (e.g., if the U2N connection mapping ID is the layer 2 ID, GPSI, or user information ID of the remote UE 302) to identify the remote UE 302.

[0224] In some aspects, such as Figure 4B As shown, process 450 may include optional step 470, in which the relay UE 304 sends a direct security mode command to the identified remote UE 302. In some aspects, the relay key response received in step 468 may also include a 5GPRUK ID, KNR_ProSe, and / or Nonce_2, and the direct security mode command sent in step 470 may include the 5GPRUK ID and / or Nonce_2. In some aspects, process 450 may also include the relay UE 304 deriving a PC5 session key Krelay-sess and / or confidentiality and integrity keys from KNR_ProSe.

[0225] In some aspects, such as Figure 4B As shown, process 450 may include optional step 472 , in which relay UE 304 receives a direct security completion message communicated by remote UE 302 .

[0226] Figure 5 A process 500 performed by a relay access and mobility function (AMF) 308 is shown.

[0227] In some aspects, process 500 may include step 502, wherein the relay AMF 308 receives a message delivered by the relay user equipment (UE) 304, and the message may include a UE-to-network (U2N) connection mapping identification (ID). In some aspects, the U2N connection mapping ID may be a temporary ID. In some alternative aspects, the U2N connection mapping ID may be a layer 2 ID of the remote UE 302. In some other alternative aspects, the U2N connection mapping ID may be a universal public subscription identifier (GPSI) of the remote UE 302. In some further alternative aspects, the U2N connection mapping ID may be a user information ID of the remote UE 302.

[0228] In some aspects, the message passed by the relay UE 304 and received by the relay AMF 308 in step 502 may be a relay key request. In some aspects, the message passed by the relay UE 304 and received by the relay AMF 308 in step 502 may also include an ID of the remote UE 302, a subscription concealed identifier (SUCI) of the remote UE 302, a relay service code, and / or Nonce_1. In some aspects, the ID of the remote UE 302 may be a layer 2 ID of the remote UE 302.

[0229] In some aspects, process 500 may include optional step 504, in which relay AMF 308 verifies that relay UE 304 is authorized to act as a U2N relay.

[0230] In some aspects, process 500 may include step 506, where the relay AMF 308 selects an authentication server function (AUSF) 310. In some aspects, the AUSF may be selected based on the SUCI of the remote UE 302.

[0231] In some aspects, process 500 may include step 508 , where the relay AMF 308 stores a mapping between the U2N connection mapping ID and the ID of the selected AUSF 310 .

[0232] In some aspects, process 500 may include step 510, in which the relay AMF 308 sends a message to the selected AUSF 310. In some aspects, the message sent to the selected AUSF in step 510 may include a SUCI, a relay service code, and / or a Nonce_1 of the remote UE 302. In some aspects, the message sent to the selected AUSF 310 in step 510 may be a Nausf_UEAuthentication_Authenticate request message.

[0233] In some aspects, process 500 may include optional step 512, wherein relay AMF 308 sends an authentication message to relay UE 304, and the authentication message may include the U2N connection mapping ID. In some aspects, the authentication message may also include an EAP message and / or one or more parameters.

[0234] In some aspects, process 500 may include optional step 514, wherein the relay AMF 308 receives an authentication message delivered by the relay UE 304, and the received authentication message may include the U2N connection mapping ID. In some aspects, step 514 may also include identifying the selected AUSF 310 using the received U2N connection mapping ID and the mapping.

[0235] In some aspects, process 500 may include optional step 516, wherein the relay AMF 308 sends an authentication message to the identified AUSF 310. In some aspects, the authentication message received in step 514 may also include an EAP message and / or one or more parameters, and the authentication message sent in step 516 may include the EAP message and / or one or more parameters. In some aspects, sending the authentication message to the identified AUSF in step 516 may include invoking a Nausf_UEAuthentication service of the identified AUSF 310.

[0236] In some aspects, process 500 may include optional step 518, wherein the relay AMF 308 receives the authentication response message delivered by the AUSF 310, and the authentication response message may include one or more parameters. In some aspects, step 518 may also include: using a mapping to select a U2N connection mapping ID. In some aspects, process 500 may include optional step 520, wherein the relay AMF 308 sends an authentication response message to the relay UE 304, and the authentication response message may include one or more parameters and the selected U2N connection mapping ID. In some aspects, the authentication response message sent in step 520 may be a relay key response. In some aspects, the one or more parameters may include 5GPRUK ID, KNR_ProSe, and / or Nonce_2.

[0237] Figure 6 6 is a block diagram of a UE 600 (eg, UE 302 or 304) according to some aspects. Figure 6As shown, UE 600 may include: processing circuit (PC) 602, which may include one or more processors (P) 655 (e.g., one or more general-purpose microprocessors and / or one or more other processors, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), etc.); communication circuit 648, which is coupled to an antenna arrangement 649 including one or more antennas, and includes a transmitter (Tx) 645 and a receiver (Rx) 647 for enabling UE 600 to transmit data and receive data (e.g., wirelessly transmit / receive data); and a local storage unit (also referred to as a "data storage system") 608, which may include one or more non-volatile storage devices and / or one or more volatile storage devices. In some aspects where PC 602 includes a programmable processor, a computer program product (CPP) 641 may be provided. CPP 641 includes a computer-readable medium (CRM) 642 storing a computer program (CP) 643, and computer program (CP) 643 includes computer-readable instructions (CRI) 644. The CRM 642 may be a non-transitory computer-readable medium, such as a magnetic medium (e.g., a hard disk), an optical medium, a memory device (e.g., a random access memory, a flash memory), etc. In some aspects, the CRI 644 of the computer program 643 is configured such that when executed by the PC 602, the CRI causes the UE 600 to perform the steps described herein (e.g., with reference to the flowchart of FIG. Figure 3 , Figure 4A and / or Figure 4B In other aspects, the UE 600 may be configured to perform the steps described herein without requiring code. That is, for example, the PC 602 may consist of only one or more ASICs. Thus, the features of the various aspects described herein may be implemented in hardware and / or software.

[0238] Figure 7 is a block diagram of a network node 700 (e.g., AMF 306, AMF 308, AUSF 310, and / or AUSF 312) according to some aspects. Figure 7As shown, the network node 700 may include: a processing circuit (PC) 702, which may include one or more processors (P) 755 (for example, one or more general-purpose microprocessors and / or one or more other processors, such as application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), etc.); these processors may be co-located in a single housing or in a single data center, or may be geographically distributed (i.e., the network node 704 may be a distributed computing device); a network interface 768, including a transmitter (Tx) 765 and a receiver (Rx) 767, for enabling the network node 700 to communicate with the network node 700; The network node 700 may include a computer program product (CPP) 741 and a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer readable medium (CRM) 742 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer readable medium (CRM) 742 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRM) 742 storing a computer program (CP) 743. The computer program (CP) 743 may include a computer readable medium (CRI) 744. CRM 742 may be a non-transitory computer readable medium, such as a magnetic medium (e.g., a hard disk), an optical medium, a memory device (e.g., a random access memory, a flash memory), etc. In some aspects, CRI 744 of computer program 743 is configured such that when executed by PC 702, CRI causes network node 700 to perform the steps described herein (e.g., the steps described herein with reference to Figure 5 In other aspects, the network node 700 can be configured to perform the steps described herein without requiring code. That is, for example, the PC 702 can be composed of only one or more ASICs. Therefore, the features of the aspects described herein can be implemented in hardware and / or software.

[0239] Some example embodiments of the present disclosure are as follows:

[0240] Embodiment A1: A method (400) performed by a relay user equipment UE (304), the method comprising: receiving a message transmitted by a remote UE (302); and sending a message to a relay access and mobility function AMF (308), wherein the sent message includes a UE-to-network U2N connection mapping identifier ID that identifies the remote UE.

[0241] Embodiment A2: The method according to embodiment A1, wherein the message transmitted by the remote UE is a direct communication request DCR message.

[0242] Embodiment A3: A method according to embodiment A1 or A2, wherein the message transmitted by the remote UE includes the security capability of the remote UE, the security policy of the remote UE, a subscription hidden identifier (SUCI), a relay service code, and / or Nonce_1.

[0243] Embodiment A4: The method according to embodiment A3, wherein the message sent including the U2N connection mapping ID also includes the ID of the remote UE, the SUCI, the relay service code, and / or the Nonce_1.

[0244] Embodiment A5: The method of any one of embodiments A1 to A4, wherein the message sent including the U2N connection mapping ID is a relay key request.

[0245] Embodiment A6: The method according to any one of embodiments A1 to A5 further includes: receiving an authentication message transmitted by a relay access and mobility function AMF (308), wherein the received authentication message includes the U2N connection mapping ID; using the received U2N connection mapping ID to identify the remote UE; and sending an authentication message to the identified remote UE.

[0246] Embodiment A7: A method according to Embodiment A6, wherein the received authentication message further includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the sent authentication message includes the EAP message and / or the one or more parameters.

[0247] Embodiment A8: The method according to embodiment A6 or A7, wherein the authentication message sent is a PC5-S message (e.g., a dedicated PC5-S message).

[0248] Embodiment A9: A method according to any one of embodiments A6 to A8, wherein the sent authentication message includes the U2N connection mapping ID.

[0249] Embodiment A10: A method according to any one of embodiments A6 to A8, wherein the sent authentication message does not include the U2N connection mapping ID.

[0250] Embodiment A11: The method according to any one of embodiments A1 to A10 further includes: receiving an authentication message transmitted by the remote UE, wherein the received authentication message includes the U2N connection mapping ID; and sending an authentication message to a relay access and mobility function AMF (308), wherein the sent authentication message includes the U2N connection mapping ID.

[0251] Embodiment A12: The method according to any one of embodiments A1 to A10 further includes: receiving an authentication message transmitted by the remote UE, wherein the received authentication message does not include the U2N connection mapping ID; and sending an authentication message to a relay access and mobility function AMF (308), wherein the sent authentication message includes the U2N connection mapping ID.

[0252] Embodiment A13: A method according to embodiment A11 or A12, wherein the authentication message transmitted by the remote UE includes an Extensible Authentication Protocol EAP message and / or one or more parameters, and the authentication message sent to the relay AMF includes the EAP message and / or the one or more parameters.

[0253] Embodiment A14: A method as described in any one of embodiments A11 to A13, wherein the received authentication message is a PC5-S message (e.g., a dedicated PC5-S message).

[0254] Embodiment A15: The method according to any one of Embodiments A1 to A14 further includes: receiving a relay key response message transmitted by a relay access and mobility function AMF (308), wherein the relay key response includes the U2N connection mapping ID; using the received U2N connection mapping ID to identify the remote UE; and sending a message to the identified remote UE.

[0255] Embodiment A16: The method according to embodiment A15, wherein the received relay key response message further includes 5GPRUK ID, K NR_ProSe , and / or Nonce_2, and the message sent includes the 5GPRUK ID and / or the Nonce_2.

[0256] Embodiment A17: The method according to embodiment A16, further comprising: NR_ProSe Export the PC5 session key Krelay-sess and / or confidentiality and integrity keys.

[0257] Embodiment A18: A method according to any one of embodiments A15 to A17, wherein the message sent is a direct security mode command.

[0258] Embodiment A19: The method according to any one of embodiments A1 to A18 further includes: receiving a direct security completion message transmitted by the remote UE.

[0259] Embodiment A20: The method according to any one of embodiments A1 to A19 further includes: allocating the U2N connection mapping ID to the remote UE.

[0260] Embodiment A21: The method according to embodiment A20, wherein the U2N connection mapping ID is a temporary ID.

[0261] Embodiment A22: The method according to embodiments A1 to A21 further includes: storing a mapping between the U2N connection mapping ID and the ID of the remote UE.

[0262] Embodiment A23: The method according to embodiment A22, wherein the ID of the remote UE is a layer 2 ID of the remote UE.

[0263] Embodiment A24: A method according to any one of embodiments A1 to A19, wherein the U2N connection mapping ID is a layer 2 ID of the remote UE.

[0264] Embodiment A25: The method of any one of Embodiments A1 to A19, A22, and A23, wherein the U2N connection mapping ID is a universal public subscription identifier (GPSI) of the remote UE.

[0265] Embodiment A26: A method according to any one of embodiments A1 to A19, A22 and A23, wherein the U2N connection mapping ID is a user information ID of the remote UE.

[0266] Embodiment B1: A relay user equipment UE (304) is configured to: receive a message transmitted by a remote UE (302); and send a message to a relay access and mobility function AMF (308), wherein the sent message includes a UE-to-network U2N connection mapping identifier ID that identifies the remote UE.

[0267] Embodiment C1: A method (500) performed by a relay access and mobility function AMF (308), the method comprising: receiving a message transmitted by a relay user equipment UE (304), wherein the message comprises a UE to network U2N connection mapping identifier ID; selecting an authentication server function AUSF (310); storing a mapping between the U2N connection mapping ID and the ID of the selected AUSF; and sending a message to the selected AUSF.

[0268] Embodiment C2: The method of embodiment C1, wherein the message transmitted by the relay UE includes a relay key request.

[0269] Embodiment C3: The method according to embodiment C1 or C2, wherein the message delivered by the relay UE includes the ID of the remote UE (302), the subscription hidden identifier (SUCI) of the remote UE, the relay service code, and / or Nonce_1.

[0270] Embodiment C4: The method according to embodiment C3, wherein the ID of the remote UE is a layer 2 ID of the remote UE.

[0271] Embodiment C5: A method according to embodiment C3 or C4, wherein the message sent to the selected AUSF includes the SUCI of the remote UE, the relay service code, and / or the Nonce_1.

[0272] Embodiment C6: The method of any one of Embodiments C3 to C5, wherein the AUSF is selected based on the SUCI of the remote UE.

[0273] Embodiment C7: The method of any one of Embodiments C1 to C6, wherein the message sent to the selected AUSF is a Nausf_UEAuthentication_Authenticate request message.

[0274] Embodiment C8: The method according to any one of embodiments C1 to C7 further includes: verifying that the relay UE is authorized to act as a U2N relay.

[0275] Embodiment C9: The method according to any one of embodiments C1 to C8 further includes: sending an authentication message to the relay UE, wherein the authentication message includes the U2N connection mapping ID.

[0276] Embodiment C10: A method according to embodiment C9, wherein the authentication message further includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters.

[0277] Embodiment C11: The method according to any one of Embodiments C1 to C11 further includes: receiving an authentication message transmitted by the relay UE, wherein the received authentication message includes the U2N connection mapping ID; using the received U2N connection mapping ID and the mapping to identify the selected AUSF; and sending the authentication message to the identified AUSF.

[0278] Embodiment C12: A method according to embodiment C11, wherein the received authentication message also includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the sent authentication message includes the EAP message and / or the one or more parameters.

[0279] Embodiment C13: The method according to embodiment C11 or C12, wherein sending the authentication message to the identified AUSF includes calling the Nausf_UEAuthentication service of the identified AUSF.

[0280] Embodiment C14: The method according to any one of embodiments C1 to C13 further includes: receiving an authentication response message transmitted by the AUSF, wherein the authentication response message includes one or more parameters; using the mapping to select the U2N connection mapping ID; and sending an authentication response message to the relay UE, wherein the authentication response message includes the one or more parameters and the selected U2N connection mapping ID.

[0281] Embodiment C15: A method according to embodiment C14, wherein the authentication response message sent is a relay key response.

[0282] Embodiment C16: The method of embodiment C14 or C15, wherein the one or more parameters include 5GPRUK ID, K NR_ProSe , and / or Nonce_2.

[0283] Embodiment C17: The method of any one of Embodiments C1 to C16, wherein the U2N connection mapping ID is a temporary ID.

[0284] Embodiment C18: The method of any one of Embodiments C1 to C16, wherein the U2N connection mapping ID is a layer 2 ID of a remote UE (302).

[0285] Embodiment C19: The method of any one of Embodiments C1 to C16, wherein the U2N connection mapping ID is a universal public subscription identifier (GPSI) of a remote UE (302).

[0286] Embodiment C20: The method of any one of Embodiments C1 to C16, wherein the U2N connection mapping ID is a user information ID of a remote UE (302).

[0287] Embodiment D1: A relay access and mobility function AMF (308) is configured to: receive a message transmitted by a relay user equipment UE (304), wherein the message includes a UE to network U2N connection mapping identifier ID; select an authentication server function AUSF (310); store a mapping between the U2N connection mapping ID and the ID of the selected AUSF; and send a message to the selected AUSF.

[0288] Embodiment E1: A method (450) performed by a relay user equipment UE (304), the method comprising: receiving an authentication message transmitted by a relay access and mobility function AMF (308), wherein the received authentication message also includes an extensible authentication protocol EAP message and / or one or more parameters; and sending a PC5-S message to a remote UE (302), wherein the PC5-S message includes the EAP message and / or the one or more parameters.

[0289] Embodiment E2: A method according to embodiment E1, wherein the received authentication message includes a UE-to-network U2N connection mapping identification ID, and the method further includes using the U2N connection mapping ID to identify the remote UE.

[0290] Embodiment E3: The method of embodiment E2, wherein the sent authentication message includes the U2N connection mapping ID.

[0291] Embodiment E4: The method of embodiment E2, wherein the sent authentication message does not include the U2N connection mapping ID.

[0292] Embodiment E5: The method according to any one of embodiments E2 to E4 further includes: receiving a direct communication request DCR message transmitted by the remote UE; and sending a relay key request including the U2N connection mapping ID.

[0293] Embodiment E6: A method according to embodiment E5, wherein the DCR message includes the security capability of the remote UE, the security policy of the remote UE, a subscription concealed identifier (SUCI), a relay service code, and / or Nonce_1.

[0294] Embodiment E7: The method according to embodiment E6, wherein the relay key request also includes the ID of the remote UE, the SUCI, the relay service code, and / or the Nonce_1.

[0295] Embodiment E8: The method according to any one of embodiments E5 to E7 further includes: allocating the U2N connection mapping ID to the remote UE; and storing a mapping between the U2N connection mapping ID and the ID of the remote UE.

[0296] Embodiment E9: The method according to embodiment E8, wherein using the U2N connection mapping ID to identify the remote UE includes: using the U2 connection mapping ID and the mapping to identify the remote UE.

[0297] Embodiment E10: The method according to embodiment E9 or E10, wherein the ID of the remote UE is a layer 2 ID of the remote UE.

[0298] Embodiment E11: The method according to any one of Embodiments E2 to E10 further includes: receiving an authentication message transmitted by the remote UE, wherein the received authentication message includes the U2N connection mapping ID; and sending an authentication message to the relay AMF, wherein the sent authentication message includes the U2N connection mapping ID.

[0299] Embodiment E12: The method according to any one of Embodiments E2 to E10 further includes: receiving an authentication message transmitted by the remote UE, wherein the received authentication message does not include the U2N connection mapping ID; and sending an authentication message to the relay AMF, wherein the sent authentication message includes the U2N connection mapping ID.

[0300] Embodiment E13: A method according to embodiment E11 or E12, wherein the authentication message transmitted by the remote UE includes an Extensible Authentication Protocol EAP message and / or one or more parameters, and the authentication message sent to the relay AMF includes the EAP message and / or the one or more parameters.

[0301] Embodiment E14: A method according to any one of embodiments E11 to E13, wherein the received authentication message is a PC5-S message (e.g., a dedicated PC5-S message).

[0302] Embodiment E15: The method according to any one of Embodiments E2 to E14 further includes: receiving a relay key response message transmitted by the relay AMF, wherein the relay key response includes the U2N connection mapping ID; using the received U2N connection mapping ID to identify the remote UE; and sending a direct security mode command to the identified remote UE.

[0303] Embodiment E16: The method according to embodiment E15, wherein the received relay key response message further includes 5GPRUK ID, K NR_ProSe , and / or Nonce_2, and the direct security mode command includes the 5GPRUK ID and / or the Nonce_2.

[0304] Embodiment E17: The method according to embodiment E16, further comprising: NR_ProSe Export the PC5 session key Krelay-sess and / or confidentiality and integrity keys.

[0305] Embodiment E18: The method of any one of embodiments E2 to E17, wherein the U2N connection mapping ID is a temporary ID.

[0306] Embodiment E19: A method according to any one of embodiments E2 to E17, wherein the U2N connection mapping ID is a layer 2 ID of the remote UE.

[0307] Embodiment E20: The method of any one of Embodiments E2 to E17, wherein the U2N connection mapping ID is a universal public subscription identifier (GPSI) of the remote UE.

[0308] Embodiment E21: The method of any one of claims E2 to E17, wherein the U2N connection mapping ID is a user information ID of the remote UE.

[0309] Embodiment E22: The method according to any one of embodiments E1 to E21 further includes: receiving a direct security completion message transmitted by the remote UE.

[0310] Embodiment E23: A method according to any one of embodiments E1 to E22, wherein the PC5-S message is a dedicated PC5-S message.

[0311] Embodiment F1: A relay user equipment UE (304) is configured to: receive an authentication message transmitted by a relay access and mobility function AMF (308); and send an authentication message to a remote UE (302), wherein the authentication message sent is a PC5-S message.

[0312] Embodiment G1: A computer program comprising instructions for adapting an apparatus to perform the method according to any one of Embodiments A1 to A26, C1 to C20, and E1 to E23.

[0313] Embodiment H1: A carrier comprising the computer program according to Embodiment G1, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

[0314] Embodiment I1: A device (304 or 308), comprising: a processing circuit (602 or 702); and a memory (642 or 742), wherein the memory contains instructions (644 or 744) executable by the processing circuit, whereby the device is operable to perform a method according to any one of embodiments A1 to A26, C1 to C20, and E1 to E23.

[0315] Embodiment J1: An apparatus (304 or 308) adapted to perform the method of any one of Embodiments A1 to A26, C1 to C20, and E1 to E23.

[0316] Embodiment K1: Any combination of the embodiments set forth above.

[0317] Although various embodiments are described herein, it should be understood that they are presented by way of example only and not limitation. Therefore, the breadth and scope of the present disclosure should not be limited by any of the exemplary embodiments described above. Moreover, unless otherwise specified herein or clearly contradictory to the context, any combination of the elements described above in all possible variations thereof is encompassed by the present disclosure.

[0318] Furthermore, although the processes described above and illustrated in the accompanying drawings are shown as a sequence of steps, this is for illustration purposes only. Therefore, it is contemplated that some steps may be added, some steps may be omitted, the order of the steps may be rearranged, and some steps may be performed in parallel.

Claims

1. A method (400) performed by a relay user equipment UE (304), the method comprising: Receive (Figure 3, step 1; 402; 452) a first message delivered by a remote UE (302); as well as Sending ( FIG. 3 , step 3; 408; 458) a second message to a relay access and mobility function AMF (308), wherein the second message includes a UE-to-network U2N connection mapping identifier ID identifying the remote UE (302).

2. The method according to claim 1, wherein: The second message also includes a subscription hidden identifier ID of the remote UE (302).

3. The method according to claim 2, wherein: The second message further includes: the relay service code received in the first message, the random number received in the first message, or both the relay service code received in the first message and the random number received in the first message.

4. The method according to any one of claims 1 to 3, wherein: The second message is a relay key request.

5. The method according to any one of claims 1 to 4, wherein: The first message is a direct communication request DCR message.

6. The method according to any one of claims 1 to 5, further comprising: Receive (Figure 3, step 5; 410; 460) a first authentication message delivered by the relay AMF (308), wherein the authentication message includes the U2N connection mapping ID identifying the remote UE (302); as well as A second authentication message is sent (Fig. 3, 5a) to the remote UE identified by the U2N connection mapping ID included in the first authentication message.

7. The method according to claim 6, wherein: The first authentication message further includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the second authentication message includes the EAP message and / or the one or more parameters.

8. The method according to claim 6 or 7, wherein: The second authentication message is a PC5-S message.

9. The method according to any one of claims 6 to 8, wherein: The first authentication message is a relay authentication request.

10. The method according to any one of claims 1 to 9, further comprising: Receiving (FIG. 3, step 6a; 414; 464) a third authentication message transmitted by the remote UE; as well as Sending ( FIG. 3 , steps 6b; 416; 466) a fourth authentication message to the relay AMF ( 308 ), wherein the fourth authentication message includes the U2N connection mapping ID identifying the remote UE ( 302 ).

11. The method according to claim 10, wherein: The third authentication message includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the fourth authentication message includes the EAP message and / or the one or more parameters.

12. The method according to claim 10 or 11, wherein: The third authentication message is a PC5-S message.

13. The method according to any one of claims 1 to 12, further comprising: receiving ( FIG. 3 , step 8; 418; 468) a relay key response message delivered by the relay AMF (308), wherein the relay key response includes the U2N connection mapping ID identifying the remote UE (302); and A message is sent (FIG. 3, step 8; 420; 470) to the remote UE (302) identified by the U2N Connection Mapping ID included in the Relay Key Response message.

14. The method according to claim 13, wherein: The relay key response message also includes 5GPRUK ID, K NR_ProSe , and / or Nonce_2, and the message sent includes the 5GPRUK ID and / or the Nonce_2.

15. The method according to claim 14, further comprising: From K NR_ProSe Export the PC5 session key Krelay-sess and / or confidentiality and integrity keys.

16. The method according to any one of claims 13 to 15, wherein: The message sent is a direct safe mode command.

17. The method according to any one of claims 1 to 16, further comprising: A direct security completion message transmitted by the remote UE (302) is received (FIG. 3, step 8; 422; 472).

18. The method according to any one of embodiments 1 to 17, further comprising: The U2N connection mapping ID is allocated (FIG. 3, step 2; 404； 454) to the remote UE.

19. The method according to any one of claims 1 to 18, wherein: The U2N connection mapping ID is a temporary ID.

20. The method according to any one of claims 1 to 19, further comprising: Storage (Figure 3, step 2; 406; 456) Mapping between the U2N connection mapping ID and the ID of the remote UE.

21. The method according to claim 20, wherein: The remote UE ID is the layer 2 ID of the remote UE.

22. The method according to any one of claims 1 to 17, wherein: The U2N connection mapping ID is the layer 2 ID of the remote UE.

23. The method according to any one of claims 1 to 17, 20 and 21, wherein: The U2N connection mapping ID is a universal public subscription identifier GPSI of the remote UE.

24. The method according to any one of claims 1 to 17, 20 and 21, wherein: The U2N connection mapping ID is the user information ID of the remote UE.

25. A relay user equipment UE (304), adapted to: receiving ( FIG. 3 , step 1; 402; 452) a first message delivered by a remote UE (302); and Sending ( FIG. 3 , step 3; 408; 458) a second message to the relay access and mobility function AMF (308), wherein: The second message includes a UE-to-network U2N connection mapping identification ID identifying the remote UE (302).

26. The relay UE (304) according to claim 25, further adapted to perform the method according to any one of claims 2 to 24.

27. A relay user equipment UE (304), comprising: Communications circuit (648); as well as A processing circuit (602) associated with the communication circuit (648), the processing circuit (602) being configured to cause the UE (304): Receiving ( FIG. 3 , step 1; 402; 452 ) a first message delivered by a remote UE ( 302 ); as well as Sending ( FIG. 3 , step 3; 408; 458) a second message to a relay access and mobility function AMF (308), wherein the second message includes a UE-to-network U2N connection mapping identifier ID identifying the remote UE (302).

28. The relay UE (304) according to claim 27, wherein: The processing circuit (602) is further configured to cause the UE (304) to perform the method according to any one of claims 2 to 24.

29. A method (500) performed by a relay access and mobility function (AMF) (308), the method comprising: Receive (Figure 3, step 3; 502) A first message transmitted by a relay user equipment UE (304), wherein the first message includes a UE-to-network U2N connection mapping identifier ID identifying a remote UE (302); Selecting ( FIG. 3 , step 4; 506 ) an authentication server function AUSF ( 310 ); storing ( FIG. 3 , step 4; 508 ) a mapping between the U2N connection mapping ID and the ID of the selected AUSF; as well as A second message is sent (Fig. 3, step 4; 510) to the selected AUSF.

30. The method of claim 29, wherein: The first message also includes a subscription hidden identifier (ID) of the remote UE (302).

31. The method according to claim 30, wherein: The first message also includes: a relay service code, a random number, or both a relay service code and a random number.

32. The method according to any one of claims 29 to 31, wherein: The first message is a relay key request.

33. The method according to any one of claims 29 to 32, wherein: The second message sent to the selected AUSF includes: (a) a subscription hidden identifier ID of the remote UE (302), (b) a relay service code, (c) a random number, or (d) a combination of any two or more of (a)-(d).

34. A method according to any one of claims 29 to 33, wherein: The second message sent to the selected AUSF includes a subscription hidden identifier (ID) of the remote UE (302), and selecting the AUSF includes selecting the AUSF based on the subscription hidden ID of the remote UE (302).

35. The method according to any one of claims 29 to 34, wherein: The message sent to the selected AUSF is a Nausf_UEAuthentication_Authenticate request message.

36. The method according to any one of claims 29 to 35, further comprising: It is verified (504) that the relay UE is authorized to act as a U2N relay.

37. The method according to any one of claims 29 to 36, further comprising: A first authentication message is sent to the relay UE ( FIG. 3 , step 5; 512 ), wherein the first authentication message includes the U2N connection mapping ID.

38. The method of claim 37, wherein: The first authentication message also includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters.

39. The method according to any one of claims 29 to 38, further comprising: receiving ( FIG. 3 , step 6; 514 ) a second authentication message transmitted by the relay UE ( 302 ), wherein the second authentication message includes the U2N connection mapping ID; and A third authentication message is sent (Fig. 3, step 7; 516) to the AUSF mapped to the USN Connection Mapping ID included in the second authentication message.

40. The method of claim 39, wherein: The second authentication message further includes an Extensible Authentication Protocol (EAP) message and / or one or more parameters, and the third authentication message includes the EAP message and / or the one or more parameters included in the second authentication message.

41. The method according to claim 39 or 40, wherein: Sending (FIG. 3, step 7; 516) the third authentication message to the AUSF includes calling (FIG. 3, step 7; 516) the Nausf_UEAuthentication service of the AUSF.

42. The method according to any one of claims 39 to 41, further comprising: receiving ( FIG. 3 , step 8; 518) an authentication response message transmitted by the AUSF, wherein the authentication response message includes one or more parameters; Sending ( FIG. 3 , step; 520 ) an authentication response message to the relay UE, wherein the authentication response message includes the U2N connection mapping ID and the one or more parameters included in the received authentication response.

43. The method of claim 42, wherein: The authentication response message sent is a relay key response.

44. The method according to claim 42 or 43, wherein: The one or more parameters included in the received authentication response include 5GPRUK ID, K NR_ProSe , and / or Nonce_2.

45. A method according to any one of claims 29 to 44, wherein: The U2N connection mapping ID is a temporary ID.

46. ​​The method of any one of embodiments 29 to 45, wherein: The U2N connection mapping ID is the layer 2 ID of the remote UE (302).

47. The method of any one of embodiments 29 to 45, wherein: The U2N connection mapping ID is a universal public subscription identifier GPSI of the remote UE (302).

48. The method of any one of embodiments 29 to 45, wherein: The U2N connection mapping ID is the user information ID of the remote UE (302).

49. A relay access and mobility function AMF (308), adapted to: receiving (FIG. 3, step 3; 502) a first message transmitted by a relay user equipment UE (304), wherein: The first message includes a UE-to-network U2N connection mapping identifier ID identifying a remote UE (302); Selecting ( FIG. 3 , step 4; 506 ) an authentication server function AUSF ( 310 ); storing ( FIG. 3 , step 4; 508 ) a mapping between the U2N connection mapping ID and the ID of the selected AUSF; as well as A second message is sent (Fig. 3, step 4; 510) to the selected AUSF.

50. The relay AMF (308) according to claim 49, further adapted to perform the method according to any one of claims 30 to 48.

51. A relay access and mobility function AMF (308; 700), comprising: Network Interface (768); as well as A processing circuit (702) associated with the network interface (768), the processing circuit (702) being configured to cause the relay AMF (308; 700): Receiving ( FIG. 3 , step 3; 502 ) a first message transmitted by a relay user equipment UE ( 304 ), wherein the first message includes a UE-to-network U2N connection mapping identifier ID identifying a remote UE ( 302 ); Selecting ( FIG. 3 , step 4; 506 ) an authentication server function AUSF ( 310 ); storing ( FIG. 3 , step 4; 508 ) a mapping between the U2N connection mapping ID and the ID of the selected AUSF; as well as A second message is sent (Fig. 3, step 4; 510) to the selected AUSF.

52. The relay AMF (308) according to claim 51, wherein: The processing circuit (702) is further configured to cause the relay AMF (308; 700) to perform the method according to any one of claims 30 to 48.

Images