Path switching and security procedure between relays

Abstract

Embodiments of the present disclosure relate to path switching and security procedures between relays. The terminal device obtains a selection policy for selecting an RSC from a plurality of RSCs, the RSC of the plurality of RSCs being associated with an indicator for indicating whether the RSC supports a CP security procedure or a UP security procedure. Based on a determination that a path switch from a source relay terminal device having a source RSC is triggered, the terminal device selects a target RSC based on a selection policy, a source indicator associated with the source RSC, and a plurality of indicators associated with the plurality of RSCs. The terminal device selects a target relay terminal device for path switching based on the target RSC. As such, service continuity after path switching between relays may be improved, and delay or interruption of service may be avoided.

Description

Technical Field

[0001] Various example embodiments relate to the field of communications, and in particular, to devices, methods, apparatuses, and computer-readable storage media for path switching and security procedures between relays. Background Art

[0002] User equipment (UE) to network relay may involve one or more relays, such as layer-3 UE to network (U2N) relay and layer-2 UE to network relay. Path switching between two indirect network communication paths for UE to network relay may involve several path switching scenarios. During path switching, service continuity and delay or interruption of service may be considered. Summary of the invention

[0003] In general, example embodiments of the present disclosure provide devices, methods, apparatuses, and computer-readable storage media for relaying path switching between security processes.

[0004] In a first aspect, a remote terminal device is provided. The remote terminal device includes at least one processor and at least one memory storing instructions. When the instructions are executed by the at least one processor, the remote terminal device at least: obtains a selection policy for selecting a relay selection code (RSC) from a plurality of RSCs, wherein the RSC in the plurality of RSCs is associated with an indicator, and the indicator is used to indicate whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; based on determining that a path switch from a source relay terminal device having a source RSC is triggered, selects a target RSC based on the selection policy, wherein a source indicator is associated with the source RSC, and a plurality of indicators are associated with the plurality of RSCs; and selects a target relay terminal device for the path switch based on the target RSC.

[0005] In a second aspect, a remote terminal device is provided. The remote terminal device includes at least one processor and at least one memory storing instructions. The instructions, when executed by the at least one processor, cause the remote terminal device to at least: obtain an authentication policy, the authentication policy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication process; and determine to trigger a ProSe authentication process based at least on the authentication policy.

[0006] In a third aspect, an authentication server function (AUSF) device is provided. The AUSF device includes at least one processor and at least one memory storing instructions. The instructions, when executed by the at least one processor, cause the AUSF device to at least: generate a root key independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; and send a ProSe key registration request without RSC to a ProSe anchor function (PAnF) device.

[0007] In a fourth aspect, a method is provided. The method includes: obtaining, at a remote terminal device, a selection policy for selecting a relay selection code (RSC) from a plurality of RSCs, an RSC in the plurality of RSCs being associated with an indicator, the indicator being used to indicate whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; based on determining that a path switch from a source relay terminal device having a source RSC is triggered, selecting a target RSC based on the selection policy, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; and selecting a target relay terminal device for the path switch based on the target RSC.

[0008] In a fifth aspect, a method is provided. The method includes: obtaining an authentication policy at a remote terminal device, the authentication policy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication process; and determining to trigger a ProSe authentication process based at least on the authentication policy.

[0009] In a sixth aspect, a method is provided. The method includes: generating a root key at an authentication server function (AUSF) device independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; and sending a ProSe key registration request without the RSC to a ProSe anchor function (PAnF) device.

[0010] In a seventh aspect, a device is provided, comprising components for executing the method according to the third aspect, the fourth aspect or the fifth aspect.

[0011] In an eighth aspect, a computer-readable medium including program instructions is provided. When the instructions are executed by a device, the device executes the method according to the third aspect, the fourth aspect or the fifth aspect.

[0012] In a ninth aspect, there is provided a computer program comprising instructions which, when executed by an apparatus, cause the apparatus to at least perform the method according to the third aspect, the fourth aspect or the fifth aspect.

[0013] In a tenth aspect, a device is provided. The device includes a circuit system for performing the following: obtaining, at a remote terminal device, a selection policy for selecting a relay selection code (RSC) from a plurality of RSCs, an RSC in the plurality of RSCs being associated with an indicator, the indicator being used to indicate whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; based on determining that a path switch from a source relay terminal device having a source RSC is triggered, selecting a target RSC based on the selection policy, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; and selecting a target relay terminal device for the path switch based on the target RSC.

[0014] In an eleventh aspect, a device is provided. The device includes a circuit system for performing the following: obtaining an authentication policy at a remote terminal device, the authentication policy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication process; and determining to trigger a ProSe authentication process based at least on the authentication policy.

[0015] In a twelfth aspect, a device is provided. The device includes a circuit system for performing the following: generating a root key independently of a relay selection code (RSC) at an authentication server function (AUSF) device, the root key being used to generate at least one proximity-based service (ProSe) key, the at least one ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; and sending a ProSe key registration request without the RSC to a ProSe anchor function (PAnF) device.

[0016] Other features and advantages of embodiments of the present disclosure will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The embodiments of the present disclosure are presented in the form of examples, and advantages of the embodiments are explained in more detail below with reference to the accompanying drawings, in which:

[0018] Figure 1A illustrates an example communication environment in which embodiments of the present disclosure may be implemented;

[0019] Figure 1B illustrates the PC5 security establishment procedure for 5G ProSe UE to network relay communications over the user plane;

[0020] Figure 1C illustrates the PC5 security establishment procedure for 5G ProSe UE to network relay communications over the control plane;

[0021] Figure 2 illustrates an example flow chart showing an example process of RSC selection according to some embodiments of the present disclosure;

[0022] Figure 3 illustrates an example signaling diagram showing an example process of RSC selection according to some embodiments of the present disclosure;

[0023] Figure 4 An example flow chart illustrating an example process for selecting an RSC and a relay based on a CP security indicator according to some embodiments of the present disclosure is illustrated;

[0024] Figure 5 An example flow chart illustrating an example process for optimizing a security process according to some embodiments of the present disclosure is illustrated;

[0025] Figure 6 An example flow chart illustrating an example process for optimizing a CP security process according to some embodiments of the present disclosure is illustrated;

[0026] Figure 7 illustrates an example signaling diagram showing an optimized UP security procedure according to some embodiments of the present disclosure;

[0027] Figure 8 illustrates an example signaling diagram showing a CP security procedure optimized according to some embodiments of the present disclosure;

[0028] Fig. 9 shows a simplified block diagram of a device suitable for implementing an example embodiment of the present disclosure; and

[0029] Fig.10 A block diagram of an example computer-readable medium is shown in accordance with some embodiments of the present disclosure.

[0030] Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. DETAILED DESCRIPTION

[0031] The principles of the present disclosure will now be described with reference to some example embodiments. It should be understood that these embodiments are described only for ease of understanding and to help those skilled in the art understand and implement the present disclosure, and do not represent any limitation on the scope of the present disclosure. The disclosure described herein can be implemented in various other ways except for the way described below.

[0032] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0033] In this disclosure, references to "one embodiment," "an embodiment," and "an example embodiment" indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment must include the particular feature, structure, or characteristic. In addition, such phrases do not necessarily refer to the same embodiment. In addition, when a particular feature, structure, or characteristic is described in conjunction with an example embodiment, those skilled in the art believe that it is within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0034] It should be understood that although the terms "first" and "second" etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish the functions of the various elements. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0035] The term used herein is only used to describe specific embodiments, but is not intended to limit exemplary embodiments. The singular form "one", "a kind of" and "the" used herein also include plural forms, unless the context clearly states otherwise. It is further understood that the term "include", "comprise", "have", "contain", "include" and / or "comprises" specifies the existence of the features, elements and / or components when used in this article, but does not exclude the existence or addition of one or more other features, elements, components and / or their combinations. As used in this article, "at least one of the following: <list of two or more elements>" and "at least one of the lists of <two or more elements>" and similar wording (wherein the list of two or more elements is connected by "and" or "or") refer to at least any one element in these elements, or at least any two or more elements in these elements, or at least all elements in these elements.

[0036] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0037] (a) a pure hardware circuit implementation (such as an implementation using only analog and / or digital circuitry), and

[0038] (b) a combination of hardware circuitry and software such as (where applicable):

[0039] (i) a combination of analog and / or digital hardware circuits and software / firmware, and

[0040] (ii) any portion of hardware processor(s) (including digital signal processor(s)) with software, software and memory(s) that work together to cause a device (such as a mobile phone or server) to perform various functions), and

[0041] (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portion(s) of microprocessor(s), that require software (e.g., firmware) to operate, but which may not be present when the software is not required for operation.

[0042] This definition of circuitry applies to all uses of the term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0043] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as a fifth generation (5G) system, long term evolution (LTE), advanced LTE (LTE-A), wideband code division multiple access (WCDMA), high speed packet access (HSPA), narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal device and the network device in the communication network can be performed according to any suitable generation of communication protocols, including but not limited to the fourth generation (4G), 4.5G, the future fifth generation (5G) new radio (NR) communication protocol, and / or any other protocol currently known or to be developed in the future. The embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communication, there will certainly be communication technologies and systems that can be used to embody future types of the present disclosure. It should not be regarded as limiting the scope of the present disclosure to the above-mentioned systems.

[0044] As used herein, the term "network device" refers to a node in a communication network, via which a terminal device accesses the network and receives services from the network. Depending on the terminology and technology applied, a network device may refer to a base station (BS) or an access point (AP), such as a NodeB (NodeB or NB), an evolved NodeB (eNodeB or eNB), a NR next-generation NodeB (gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, a low-power node (such as a femto, a micro), etc. The RAN split architecture includes a gNB-CU (centralized unit, which hosts RRC, SDAP, and PDCP), which controls multiple gNB-DUs (distributed units, which host RLC, MAC, and PHY). A relay node may correspond to the DU portion of an IAB node.

[0045] The term "terminal device" refers to any terminal device capable of wireless communication. As an example and not limitation, the terminal device may also be referred to as a communication device, UE, subscriber station (SS), portable subscriber station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device (such as a digital camera), a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop embedded device (LEE), a laptop mounted device (LME), a USB dongle, a smart device, a wireless customer premises equipment (CPE), an Internet of Things (IoT) device, a watch or other wearable device, a head mounted display (HMD), a vehicle, a drone, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in industrial and / or automated processing chain environments), consumer electronic devices, equipment operating on commercial and / or industrial wireless networks, etc. The terminal device may also correspond to the mobile terminal (MT) part of an integrated access and backhaul (IAB) node (also known as a relay node). In the following description, the terms "terminal device", "communication device", "terminal", "user equipment" and "UE" may be used interchangeably.

[0046] Although in various example embodiments, the functions described herein may be performed in fixed and / or wireless network nodes, in other example embodiments, the functions may be implemented in a user equipment device (such as a mobile phone or tablet or laptop or desktop computer or mobile IoT device or fixed IoT device). For example, the user equipment device may be equipped with corresponding functions described in combination with fixed and / or mobile and / or wireless network nodes as required. The user equipment device may be a user equipment control device, such as a chipset or processor, which is configured to control the user equipment when installed in the user equipment. Examples of such functions include boot server functions and / or home subscriber servers, which may be implemented in the user equipment device by providing software to the user equipment device, which is configured to cause the user equipment device to perform from the perspective of these functions / nodes.

[0047] As described, path switching between two indirect network communication paths for UE to network relay can involve several path switching scenarios, for example, layer-3UE with non-3GPP interworking function (N3IWF) to network relay, switching from / to layer-3UE with N3IWF to network relay; layer-3UE without N3IWF to network relay, switching from / to layer-3UE without N3IWF to network relay; layer-3UE without N3IWF to network relay, switching from / to layer-3UE with N3IWF to network relay; layer-2UE to network relay, switching from / to layer-2UE to network relay; layer-2UE to network relay, switching from / to layer-3UE without N3IWF to network relay; and layer-2UE to network relay, switching from / to layer-3UE with N3IWF to network relay.

[0048] It should be understood that service continuity in different path switching situations can be achieved via application layer or session continuity. For service continuity during path switching, some aspects can be considered, such as what are the triggers and criteria for path switching, how to select UE-to-network relays for path switching, find path switching procedures with service continuity considerations, and figure out how to achieve service continuity for solutions in path switching.

[0049] For triggers and criteria for path switching, the remote UE may perform path switching when the measurement thresholds and criteria configured by the NG-RAN are met, or based on reselection rules from the application layer (if any). In addition, if multiple UE-to-network relay UEs meet the relay reselection criteria, the remote UE selects a target UE-to-network relay for path switching based on 5G ProSe policies or UE routing policy (URSP) rules and remote UE service processing, and considers: the remote UE first selects a target relay UE of the same type as the original relay UE, and if this fails, the remote UE re-evaluates the URSP for target relay selection or continues to evaluate the next routing descriptor (RSD) of the selected URSP. In addition, the remote UE may use reselection rules from the application layer (e.g., provided by an application server), and the remote UE may find that there are multiple UE-to-network relay UEs that meet the reselection rules, and then select the target UE-to-network relay UE based on the priority in the reselection rules from the application layer.

[0050] For the path switching case between two indirect layer-3 UE to network relay paths using N3IWF, the use of Mobility and Multi-Homing Protocol (MOBIKE) may be selected for specification work.

[0051] However, when the remote UE hands over to another relay UE, it may trigger new authentication and Prose Remote User Key (PRUK) generation, which may take time and resources, thereby affecting service continuity and causing interruption to the service.

[0052] In some embodiments, the present disclosure proposes a solution to optimize the relay selection process based on the CP security indicator associated with the RSC, further optimize the security authentication process, and then improve the service continuity after the path switch between ProSe L3 relays.

[0053] The following will refer to Figures 1A to 10 The principles and implementations of the present disclosure are described in detail. Figure 1A 1 illustrates a schematic diagram of an example communication environment 100 in which embodiments of the present disclosure may be implemented. Figure 1A As shown, the communication environment 100 may involve a remote UE 110, UE-to-network relays 121 and 122, NG-RAN 131 and 132, a 5G core (5GC) 140, and a data network 145. In addition, it should be understood that the number of devices is only for ease of understanding and does not represent any limitation. The communication environment 100 may include any suitable number or type of devices adapted to implement the embodiments of the present disclosure.

[0054] like Figure 1AAs shown, the remote UE 110 can be connected to the UE-to-network relay 121 via the PC5 interface, and communicate with the data network 145 via the UE-to-network relay or the UE-to-network relay with N3IWF access. In addition, the communication environment 100 can support the remote UE 110 connected to the data network 145 via the 5G ProSe UE-to-network relay 121 (i.e., an indirect network communication path), switching to another indirect network communication path (e.g., via the 5G ProSe UE-to-network relay 122) for service continuity.

[0055] In the context of the present disclosure, the term "UE to network relay" may be used interchangeably with "5G ProSe layer-3 UE to network relay", "5G ProSe UE to network relay", "U2N relay", "relay UE" or "relay terminal device". The term "remote UE" may be used interchangeably with "5G ProSe remote UE" or "relay terminal device".

[0056] It is known that ProSe can be a service that can be provided by the 3rd Generation Partnership Project (3GPP) system based on the proximity of UEs to each other. This feature was introduced in LTE and evolved in the 5G system (5GS). The 5GS enablers for ProSe include the following functions: 5G ProSe direct discovery; 5G ProSe direct communication; and 5G ProSe U2N relay.

[0057] PC5 is a reference point between ProSe-enabled UEs used for the control plane and user plane of 5G ProSe direct discovery, 5G ProSe direct communication, and 5G ProSe U2N relay.

[0058] The communication in the communication environment 100 can be implemented according to any appropriate (multiple) communication protocols, including but not limited to cellular communication protocols such as the first generation (1G), the second generation (2G), the third generation (3G), the fourth generation (4G), the fifth generation (5G) or the future sixth generation (6G), wireless local area network communication protocols such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11, and / or any other protocol currently known or to be developed in the future. In addition, the communication can utilize any appropriate wireless communication technology, including but not limited to: code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplex (FDD), time division duplex (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiplexing (OFDM), discrete Fourier transform spread OFDM (DFT-s-OFDM) and / or any other technology currently known or to be developed in the future.

[0059] Figure 1BA PC5 security establishment process 150 for 5G ProSe UE to network relay communication over a user plane (UP) is illustrated. The process 150 may involve a remote UE 110, a UE to network relay 121, a 5G Direct Discovery Name Management Function (DDNMF) 151 of the remote UE 110, a ProSe Key Management Function (PKMF) 152 of the remote UE 110, a 5G DDNMF 153 of the relay 121, a PKMF 154 of the relay 121, and a Unified Data Management (UDM) (or a Binding Support Function (BSF) or a Home Subscriber Server (HSS)) 155 of the remote UE 110.

[0060] When in coverage, the 5G ProSe Remote UE may be provisioned with discovery security material and a ProSe Remote User Key (i.e., UP-PRUK). These security materials may be associated with an expiration time after which they become invalid. If the UE does not have valid discovery security material, the 5G ProSe Remote UE may need to connect to the 5G ProSe Key Management Function (PKMF) and obtain fresh discovery security material in order to use the 5G ProSe UE to network relay services.

[0061] The process is described for the scenario where the 5G PKMF for the 5G ProSe remote UE is different from the 5G PKMF for the 5G ProSe UE to the network relay. If both the 5G ProSe remote UE and the 5G ProSe UE to the network relay are served by a single 5G PKMF, the 5G PKMF may play the role of both the 5G PKMF for the 5G ProSe remote UE and the 5G PKMF for the 5G ProSe UE to the network relay, and inter-5G PKMF message exchange may not be required.

[0062] like Figure 1B As shown, at 160a, the 5G ProSe remote UE may obtain the 5G PKMF address from the 5G DDNMF of its HPLMN. Alternatively, the 5G ProSe remote UE may be provisioned with the 5G PKMF address by the Policy Control Function (PCF). If the 5G ProSe remote UE is provisioned with the 5G PKMF address, the 5G ProSe remote UE may directly access the 5G PKMF without requesting it from the 5G DDNMF. If the 5G ProSe remote UE cannot access the 5G PKMF using the provisioned 5G PKMF address, the 5G ProSe remote UE may request the 5G PMKF address from the 5G DDNMF.

[0063] At 160b, the 5G ProSe remote UE may establish a secure connection with the 5G PKMF via the PC8 reference point. Security for the PC8 interface relies on Ua security if Generic Bootstrapping Architecture (GBA) is used, or relies on Ua* security if Authentication and Key Management for Applications (AKMA) is used. The 5G PKMF of the 5G ProSe remote UE may check whether the 5G ProSe remote UE is authorized to receive UE-to-network relay services, and if the UE is authorized, the 5G PKMF of the 5G ProSe remote UE provides discovery security material to the 5G ProSe remote UE. If the 5G ProSe remote UE provides a list of visited networks, the 5G PKMF of the 5G ProSe remote UE may request discovery security material from the 5G PKMF of potential 5G ProSe UE-to-network relays from which the 5G ProSe remote UE obtains relay services. The 5G PKMF from 5G ProSe UE to network relay may include PC5 security policy for 5G ProSe remote UE.

[0064] Note that the 5G PKMF may be locally configured with the UE's authorization information. Otherwise, the 5G PKMF may interact with the UE's UDM to retrieve the UE's authorization information. In addition, the 5G ProSe remote UE may be supplied by the PCF with a list of potential visited networks for the 5G ProSe UE to network relay service (which is identified by the RSC).

[0065] At 160c, the 5G ProSe UE to Network Relay may obtain a 5G PKMF address from its Home Public Land Mobile Network (HPLMN) in the same manner as described in step 160a.

[0066] At 160d, the 5G ProSe UE to network relay may establish a secure connection with the 5G PKMF via the PC8 reference point as in step 160b. The 5G PKMF of the 5G ProSe UE to network relay may check whether the 5G ProSe UE to network relay is authorized to provide the 5G ProSe UE to network relay service, and if the UE is authorized, the 5G PKMF of the 5G ProSe UE to network relay may provide discovery security material to the 5G ProSe UE to network relay. The 5G PKMF of the 5G ProSe UE to network relay may include a PC5 security policy for the 5G ProSe UE to network relay.

[0067] At 161a, the 5G ProSe Remote UE may send a PRUK Request message to its 5G PKMF. The message may indicate that the 5G ProSe Remote UE is requesting a UP-PRUK from the 5G PKMF. If the 5G ProSe Remote UE already has a UP-PRUK from the 5GPKMF, the message may also contain a UP-PRUK ID of the UP-PRUK.

[0068] The UP-PRUK identifier (ID) may be in the form of a network access identifier (NAI) format or a 64-bit string. If the UP-PRUK ID is in the NAI format, i.e. username@realm, the realm part may include the HPLMN ID. The username part may include a 64-bit string.

[0069] At 161b, the 5G PKMF may check whether the 5G ProSe Remote UE is authorized to receive UE-to-network relay services. This may be done by using an identity of the 5G ProSe Remote UE, which is associated with the key used to establish a secure connection between the 5G ProSe Remote UE and the 5G PKMF in step 160b. If the 5G ProSe Remote UE is authorized to receive services, the 5G PKMF may send a UP-PRUK and a UP-PRUK ID to the 5G ProSe Remote UE. If the UP-PRUK and the UP-PRUK ID are included, the 5G ProSe Remote UE may store them and delete any previously stored UP-PRUK and UP-PRUK ID for the 5G PKMF.

[0070] Note that steps 160a, 160b, 161a, 161b are performed when the 5G ProSe Remote UE is within coverage.

[0071] At 162 , a discovery procedure may be performed between the 5G ProSe remote UE and the 5G ProSe UE-to-network relay using the discovery parameters and the discovery security material.

[0072] At 163, if the remote UE does not have a valid UP-PRUK, an RSC served by the 5G ProSe UE to the network relay, and a key for NR PC5 (KNRP) freshness parameter 1, the 5G ProSe remote UE may send a direct communication request (DCR) including a UP-PRUK ID or a subscription concealment identifier (SUCI) to the 5G ProSe UE to the network relay. If the UP-PRUK ID is not in NAI format, the DCR message may include the HPLMN ID of the 5G ProSe remote UE. The PC5 security establishment procedure between the 5G ProSe remote UE and the 5G ProSe UE to the network relay, including the negotiation of security parameters and security policies and protection of messages thereafter, may follow a one-to-one security establishment.

[0073] At 164a, the 5G ProSe UE to Network Relay may send a key request message to its 5G PKMF, the key request message including UP-PRUK ID or SUCI, RSC, and KNRP freshness parameter 1. If the HPLMN ID of the 5G ProSe remote UE is included in the DCR, the key request message may also include the HPLMN ID of the 5G ProSe remote UE.

[0074] At 164b, upon receiving the key request message, the 5G PKMF of the 5G ProSe UE to network relay can check whether the 5G ProSe UE to network relay is authorized to provide relay services to the 5G ProSe remote UE based on the identity of the 5G ProSe UE to network relay associated with the key used to establish the secure PC8 connection and the received RSC.

[0075] Note that the 5G PKMF of the 5G ProSe UE to the Network Relay may need authorization for RSC based on its implementation. In addition, if the authorization information of the 5G ProSe UE to the Network Relay is not available locally, the 5G PKMF may request the authorization information from the UDM (not shown) of the 5G ProSe UE to the Network Relay using the Nudm_SDM_Get service. If the 5G ProSe UE to the Network Relay is authorized to provide relay services based on the ProSe subscription data, the 5G PKMF of the 5G ProSe UE to the Network Relay may send a key request with UP-PRUK ID or SUCI to the 5G PKMF of the 5G ProSe Remote UE. The 5G PKMF of the 5G ProSe UE to the Network Relay identifies the 5G PKMF address of the 5G ProSe Remote UE based on the UP-PRUK ID or HPLMN ID or SUCI of the 5G ProSe Remote UE if it is included in the key request message.

[0076] Note that the 5G PKMF of the 5G ProSe remote UE may need to be authorized by the RSC based on its implementation.

[0077] At 164c, upon receiving the key request message from the 5G PKMF of the 5G ProSe remote UE to the network relay, the 5G PKMF of the 5G ProSe remote UE may check whether the 5G ProSe remote UE is authorized to use the relay service. The relay service authorization check may be based on the UP-PRUK ID and RSC included in the key request message, or based on the SUPI and RSC of the remote UE included in the key request message. If SUCI is included in the key request message, the 5G PKMF of the 5G ProSe remote UE may use the Nudm_UEIdentifier_Deconceal service to request the UDM of the 5G ProSe remote UE to de-hide the SUCI to obtain the SUPI, and the UDM invokes a subscription identifier de-hiding function (SIDF) to de-hide the SUCI to obtain a subscription permanent identifier (SUPI). If the authorization information of the 5G ProSe remote UE is not available locally, the 5G PKMF may request the authorization information from the UDM (not shown) of the 5G ProSe remote UE.

[0078] Note that privacy issues may need to be considered when determining whether a SUPI will be sent to a PKMF. For privacy control, the UDM may authorize the PKMF based on the NF type or service provider domain of the PKMF.

[0079] If a new UP-PRUK is required, the 5G PKMF may perform one of the following procedures (as shown in step 164c):

[0080] If the 5G PKMF of the 5G ProSe remote UE supports the Zpn interface to the BSF of the 5G ProSe remote UE, the 5G PKMF of the 5G ProSe remote UE may request GBA Push Information (GPI) for the 5G ProSe remote UE from the BSF. When requesting GPI, the 5G PKMF may include the UP-PRUK ID in the P-TID field. Upon receiving the GPI, the 5G PKMF may use Ks(_ext)_NAF as the UP-PRUK.

[0081] If the 5G PKMF of the 5G ProSe remote UE supports the SBI (Service Based Interface) interface to the BSF of the 5G ProSe remote UE, the 5G PKMF may request GPI via the SBI interface. Upon receiving the GPI, the 5G PKMF may use Ks(_ext)_NAF as UP-PRUK.

[0082] If the 5G PKMF of the 5G ProSe remote UE supports the PC4a interface to the HSS of the UE, the 5G PKMF of the 5G ProSe remote UE may request the GBA authentication vector (AV) for the 5G ProSe remote UE from the HSS. Upon receiving the AV, the 5G PKMF forms a GPI locally, which includes the UP-PRUK ID in the P-TID field. The 5G PKMF may use Ks(_ext)_NAF as the UP-PRUK.

[0083] If the 5G PKMF of the 5G ProSe remote UE is co-located or integrated with the BSF function and supports the SBI interface to the UDM / HSS of the 5G ProSe remote UE, the 5G PKMF can request the GBA AV via the SBI interface. Upon receiving the AV, the 5G PKMF forms a GPI locally, which includes the UP-PRUK ID in the P-TID field. The 5G PKMF can use Ks(_ext)_NAF as the UP-PRUK.

[0084] Note that GPI is only supported when using the GBA.

[0085] At 164d, the 5G PKMF of the 5G ProSe remote UE may generate a KNRP freshness parameter 2 and derive the KNRP using the UP-PRUK, RSC, KNRP freshness parameter 1 and KNRP freshness parameter 2 identified by the UP-PRUK ID. The 5G PKMF of the 5G ProSe remote UE may then send a key response message including the KNRP and the KNRP freshness parameter 2 to the 5G PKMF of the 5G ProSe UE to network relay. If a GPI is generated, the message may include the GPI. The 5GPKMF of the 5G ProSe remote UE may also include the remote user ID of the 5G ProSe remote UE in the key response message to the 5G ProSe UE to network relay. The UP-PRUK ID may be used as the remote user ID in this document.

[0086] At 164e, the 5G PKMF of the 5G ProSe UE to the network relay may send a key response message to the 5G ProSe UE to the network relay, the key response message including the remote user ID, KNRP, KNRP freshness parameter 2, GPI (if used to calculate a fresh UP-PRUK for the UE to the network relay).

[0087] At 165a, the 5G ProSe UE to Network Relay may derive a session key (KNRP-SESS) from the KNRP, and then derive a confidentiality key (NRPEK) (if applicable) and an integrity key (NRPIK) based on the PC5 security policy. The 5G ProSe UE to Network Relay may store the remote user ID received in step 4d. The 5G ProSe UE to Network Relay may send a Direct Security Mode Command message to the 5G ProSe Remote UE. The message may also include a KNRP Freshness Parameter 2.

[0088] At 165b, if the 5G ProSe remote UE receives a message containing GPI, it processes the GPI. The 5G ProSe remote UE may derive UP-PRUK and obtain UP-PRUK ID from GPI.

[0089] The 5G ProSe Remote UE may derive the KNRP from its UP-PRUK, RSC, KNRP freshness parameter 1 and the received KNRP freshness parameter 2. It may then derive the session key (KNRP-SESS) and the confidentiality key (NRPEK) (if applicable) and integrity key (NRPIK) in the same manner as the 5G ProSe UE to Network Relay based on the PC5 security policy and process the Direct Security Mode Command. Successful verification of the Direct Security Mode Command assures the 5G ProSe Remote UE that the 5G ProSe UE to Network Relay is authorized to provide relay services.

[0090] The handling of synchronization failure (for the details of synchronization failure) is performed when the UE processes the authentication challenge in GPI. The 5G ProSe remote UE may send a direct security mode failure message and include RAND and AUTS in the message. Upon receiving the direct security mode failure message from the 5G ProSe remote UE, the 5G ProSe UE to network relay may send a key request message to the 5G PKMF of the 5G ProSe remote UE via the 5G PKMF of the 5G ProSe UE to network relay. The key request message may include the HPLMN ID of the 5G ProSe remote UE, the relay service code and the KNRP freshness parameter 1, as well as the RAND and AUTS received from the 5G ProSe remote UE. If the 5G PKMF of the 5G ProSe remote UE decides to retry the GBA push process, the 5G PKMF of the 5G ProSe remote UE may request GPI, as described in step 164c.

[0091] At 165c, the 5G ProSe remote UE may respond to the 5G ProSe UE to network relay with a Direct Security Mode Complete message.

[0092] At 165d, upon receiving the direct security mode complete message, the 5G ProSe UE to network relay may verify the direct security mode complete message. Successful verification of the direct security mode complete message ensures the 5G ProSe UE to network relay that the 5G ProSe remote UE is authorized to obtain relay services.

[0093] At 165e, after successful authentication, the 5G ProSe UE to Network Relay responds with a Direct Communication Accept message to the 5G ProSe Remote UE to complete the PC5 connection establishment process.

[0094] At 166, the 5G ProSe Remote UE and the 5G ProSe UE to Network Relay proceed with the remainder of the process for relay service over the secure PC5 link, such as establishing a new protocol data unit (PDU) session or modifying an existing PDU session for relaying (if necessary), etc.

[0095] When the 5G ProSe layer-3 UE to network relay sends a remote UE report to the session management function (SMF), the 5G ProSe layer-3 UE to network relay may include the remote user ID received in step 164d. If the PRUK ID used as the remote user ID is not in the NAI format, the 5G ProSe layer-3 UE to network relay may include the HPLMN ID of the 5G ProSe remote UE in the remote UE report.

[0096] Figure 1C A PC5 security establishment process 170 for 5G ProSe UE to network relay communication over a control plane (CP) is illustrated. The process 170 may involve a remote UE 110, a UE to network relay 121, an access and mobility management function (AMF) 171 of the remote UE 110, an AMF 172 of the relay 121, an authentication server function (AUSF) 173 of the remote UE 110, a UDM 155 of the remote UE 110, and a ProSe anchor function (PAnF) 174 of the remote UE 110.

[0097] Procedure 170 describes a procedure for establishing a PC5 link between a 5G ProSe remote UE and a 5G ProSe UE to network relay. The procedure includes how the 5G ProSe remote UE is authenticated by the AUSF of the 5G ProSe remote UE via the 5G ProSe UE to network relay and the AMF of the 5G ProSe UE to network relay during the 5G ProSe PC5 establishment. This mechanism can be used when the 5G ProSe remote UE is out of coverage.

[0098] At 180, the 5G ProSe remote UE and the 5G ProSe UE-to-network relay may register with the network. The 5G ProSe UE-to-network relay may be authenticated and authorized by the network to provide UE-to-network relay services. The 5G ProSe remote UE may be authenticated and authorized by the network to receive UE-to-network relay services. During this authorization and information provisioning process, PC5 security policies are provisioned to the 5G ProSe remote UE and the 5G ProSe UE-to-network relay, respectively.

[0099] At 181 , the 5G ProSe remote UE or relay UE may initiate a discovery process using any of the Model A or Model B methods.

[0100] At 182, after the discovery of the 5G ProSe UE to the network relay, the 5G ProSe remote UE may send a direct communication request to the 5G ProSe UE to the network relay for establishing a secure PC5 unicast link. The 5G ProSe remote UE may include its security capabilities and PC5 signaling security policy in the DCR message. The message may also include a relay service code, Nonce_1.

[0101] If the 5G ProSe remote UE does not have a valid 5G ProSe Remote User Key (CP-PRUK), the 5G ProSe remote UE may include SUCI in the DCR to trigger 5G ProSe remote UE-specific authentication and establish the CP-PRUK.

[0102] If the 5G ProSe remote UE already has a valid CP-P for the relay service code, the 5G ProSe remote UE may include the associated CP-PRUK ID in the DCR to indicate that the 5G ProSe remote UE wants to use the CP-PRUK to acquire the relay connection.

[0103] At 183, upon receiving the DCR message, the 5G ProSe UE to Network Relay may send a Relay Key Request to the AMF of the 5G ProSe UE to Network Relay, including the SUCI or CP-PRUK ID, RSC and Nonce_1 received in the DCR message. The 5G ProSe UE to Network Relay may also include a transaction identifier in the message, which identifies the 5G ProSe Remote UE for subsequent messages of the NAS message through the 5G ProSe UE to Network Relay.

[0104] At 184, the AMF of the 5G ProSe UE-to-network relay may verify with the UDM whether the 5G ProSe UE-to-network relay is authorized to provide the UE-to-network relay service.

[0105] At 185, the 5G ProSe UE to network relayed AMF may select an AUSF based on the SUCI or CP-PRUK ID and forward the parameters received in the relay key request to the AUSF in a Nausf_UEAuthentication_ProseAuthenticate request message. The Nausf_UEAuthentication_ProseAuthenticate request message may contain the SUCI or CP-PRUK ID of the 5G ProSe remote UE, the relay service code, and Nonce_1. If the CP-PRUK ID is received from the 5G ProSe UE to network relayed AMF, the 5G ProSe remote AUSF may temporarily store Nonce_1 and the UE skips steps 186-189. If the SUCI of the 5G ProSe remote UE is received from the 5G ProSe UE to network relayed AMF, the 5G ProSe remote UE's AUSF temporarily stores Nonce_1 and the relay service code and skips step 190.

[0106] At 186, the AUSF may initiate 5G ProSe remote UE-specific authentication using the received ProSe-specific parameters (ie, RSC, etc.).

[0107] The AUSF of the 5G ProSe remote UE may retrieve the authentication vector and routing indicator of the 5G ProSe remote UE from the UDM via a Nudm_UEAuthentication_GetProseAv request message. Upon receiving the Nudm_UEAuthentication_GetProSeAv request, the UDM may call the SIDF to hide the SUCI to obtain the SUPI before the UDM may process the request. The UDM checks whether the UE is authorized to use the ProSe UE to Network Relay Service based on the authorization information in the UE's subscription data. If the UE is authorized, the UDM may select the Extensible Authentication Protocol Authentication and Key Agreement (EAP-AKA)' authentication method based on the received Nudm_UEAuthentication_GetProseAv request.

[0108] At 187a, the AUSF may temporarily store the XRES, the routing indicator, and the SUPI. The AUSF of the 5G ProSe remote UE may trigger authentication of the 5G ProSe remote UE based on EAP-AKA'. The AUSF of the 5G ProSe remote UE may generate an EAP request / AKA' challenge message and send the EAP request / AKA' challenge message to the AMF of the 5G ProSe remote UE to the network relay in a Nausf_UEAuthentication_ProSeAuthenticate response message.

[0109] At 187b, the AMF of the 5G ProSe UE to Network Relay may forward the Relay Authentication Request (including EAP Request / AKA' Challenge) to the 5G ProSe UE to Network Relay via a NAS message, including the transaction identifier of the 5G ProSe Remote UE in the message. The NAS message is protected using the NAS security context created for the 5G ProSe UE to Network Relay.

[0110] At 187c, based on the transaction identifier, the 5G ProSe UE to Network Relay may forward the EAP Request / AKA' Challenge to the 5G ProSe Remote UE via a PC5 message.

[0111] The USIM in the 5G ProSe remote UE can verify the freshness of the received value by checking whether the AUTN can be accepted.

[0112] For EAP-AKA', the USIM calculates the response RES. The USIM may return RES, CK, IK to the ME. The ME may derive CK' and IK'.

[0113] At 187d, the 5G ProSe remote UE may return an EAP response / AKA' challenge to the 5G ProSe UE to network relay via a PC5 message.

[0114] At 187e, the 5G ProSe UE to Network Relay may forward the EAP Response / AKA' Challenge together with the transaction identifier of the 5G ProSe Remote UE in the NAS message Relay Authentication Response to the AMF of the 5G ProSe UE to Network Relay.

[0115] At 187f, the 5G ProSe UE to Network Relay AMF may forward the EAP Response / AKA' Challenge to the AUSF of the 5G ProSe Remote UE via the Nausf_UEAuthentication_ProSeAuthenticate request.

[0116] The AUSF of the 5G ProSe remote UE can perform UE authentication by verifying the received information.

[0117] For EAP-AKA', the AUSF of the 5G ProSe remote UE and the 5G ProSe remote UE may exchange EAP request / AKA' notification messages and EAP response / AKA' notification messages via the AMF of the 5G ProSe UE to the network relay and the 5G ProSe UE to the network relay. After the exchange, the AUSF of the 5G ProSe remote UE and the 5G ProSe remote UE may derive KAUSF_P in the same manner as KAUSF is derived.

[0118] At 188, upon successful authentication, the AUSF of the 5G ProSe Remote UE and the 5G ProSe Remote UE may generate a CP-PRUK and a CP-PRUK ID.

[0119] The CP-PRUK ID may be in the NAI format, ie, username@realm. The username portion includes the CP-PRUK ID and the routing indicator from step 186, and the realm portion includes the home network identifier.

[0120] At 189a, the AUSF of the 5G ProSe remote UE may select a PAnF based on the CP-PRUK ID and send SUPI, RSC, CP-PRUK and CP-PRUK ID to the PAnF in an Npanf_ProseKey_Register request message.

[0121] At 189b, the PAnF may store the Prose context information (ie, SUPI, RSC, CP-PRUK, CP-PRUK ID) for the 5G ProSe remote UE and send an Npanf_ProseKey_Register response message to the AUSF.

[0122] At 190a, the AUSF of the 5G ProSe remote UE may select a PAnF based on the CP-PRUK ID and send the received CP-PRUK ID and RSC in an Npanf_ProseKey_get request message.

[0123] At 190b, the PAnF may retrieve the CP-PRUK based on the CP-PRUK ID and check whether the 5G ProSe remote UE is authorized to use the UE-to-network relay service based on the received RSC. If the 5G ProSe remote UE is authorized and the retrieved CP-PRUK is valid, the PAnF may send an Npanf_ProseKey_get response message with the CP-PRUK to the AUSF.

[0124] At 191, the AUSF of the 5G ProSe remote UE may generate Nonce_2 and derive the KNR_ProSe key using the CP-PRUK, Nonce_1 and Nonce_2 defined in item A.4.

[0125] At 192, the AUSF of the 5G ProSe remote UE may send KNR_ProSe, Nonce_2 to the 5G ProSe UE to network relay in a Nausf_UEAuthentication_ProseAuthenticate response message via the AMF of the 5G ProSe UE to network relay. If step 187 is successfully performed, an EAP success message may be included. The AUSF of the 5G ProSe remote UE may also include the CP-PRUK ID in the message.

[0126] At 193, when KNR_ProSe is received from the AUSF of the 5G ProSe remote UE via the AMF of the 5G ProSe UE to Network Relay, the 5G ProSe UE to Network Relay may derive the PC5 session key Krelay-sess and the confidentiality key Krelay-enc (if applicable) and the integrity key Krelay-int from the KNR_ProSe. The KNR_ProSe ID and Krelay-sess ID are established in the same manner as the KNRP ID and KNRP-sess ID. The 5GPRUK ID may be sent from the AMF of the 5G ProSe UE to the UE to Network Relay. If an EAP success message is received from the AUSF, an EAP success message may also be sent from the AMF of the 5G ProSe UE to the UE to Network Relay.

[0127] At 194, the 5G ProSe UE to Network Relay may send the received Nonce_2 and the PC5 signaling security policy of the 5G ProSe Remote UE in a Direct Security Mode Command message, which is integrity protected using Krelay-int. If an EAP Success message is received from the 5G ProSe UE to Network Relay's AMF, the EAP Success message may be included.

[0128] At 195, the 5G ProSe remote UE may generate a KNR_ProSe key to be used for remote access to the network relay via the 5G ProSe UE in the same manner as defined in step 191. The 5G ProSe remote UE may derive the PC5 session key Krelay-sess and the confidentiality key and integrity key from the KNR_ProSe in the same manner as defined in step 193.

[0129] The 5G ProSe remote UE may verify the direct security mode command message. Successful verification of the direct security mode command message ensures the 5G ProSe remote UE that the 5G ProSe UE to network relay is authorized to provide relay services.

[0130] At 196, the 5G ProSe remote UE may send a direct security mode complete message containing its PC5 user plane security policy to the 5G ProSe UE to network relay, the direct security mode complete message being protected by Krelay-int or / and Krelay-enc, which are derived from Krelay-sess according to the PC5 signaling policy negotiated between the 5G ProSe remote UE and the 5G ProSe UE to network relay.

[0131] Upon receiving the direct security mode complete message, the 5G ProSe UE to network relay may verify the direct security mode complete message at 197. Successful verification of the direct security mode complete message assures the 5G ProSe UE to network relay that the 5G ProSe remote UE is authorized to acquire relay services.

[0132] After successful verification of the direct security mode completion message, the 5G ProSe UE to network relay can respond with a direct communication acceptance message to the 5G ProSe remote UE to complete the PC5 connection establishment procedure and store the CP-PRUK ID in the security context associated with the PC5 link with the 5G ProSe remote UE.

[0133] Further communication between the 5G ProSe remote UE and the network can be carried out securely via the 5G ProSe UE to network relay.

[0134] When the 5G ProSe layer-3 UE to network relay sends a remote UE report to the SMF, the 5G ProSe layer-3 UE to network relay may include the remote user ID (i.e., the 5G PRUK ID received in step 13) in the message.

[0135] As described, a remote UE may be handed off between different UE-to-network (U2N) relays, including handing off between U2N L3 relays.

[0136] In addition, before the remote UE uses the relay to send traffic, a secure link may be established between the remote UE and the U2N relay. Security procedures may be performed to authenticate and authorize the UE to use the ProSe relay service, and to generate keys to protect the link between the remote UE and the U2N relay. 3GPP supports two security procedure modes for authentication and key generation for L3 relays, one is UP-based and the other is CP-based.

[0137] There are 6 possible use cases. In some cases, CP-based re-authentication and key generation may be triggered, in some cases, UP-based re-authentication and key generation may be triggered, in some cases, re-authentication will not be triggered and the same PRUK can be used to derive communication keys. Table 1 below shows the path switching scenarios and whether re-authentication and key generation can be triggered for each scenario.

[0138] Table 1

[0139]

[0140] As shown in the above table, when a remote UE hands over to another relay UE, it may trigger new authentication and PRUK generation, which may take time and resources, thus may cause service interruption and affect service continuity.

[0141] In some embodiments, the present disclosure proposes a solution to optimize the relay selection process based on the CP security indicator associated with the RSC. For example, the remote UE (i.e., the remote terminal device) may select an RSC with a valid security context, for example, if the corresponding CP-PRUK is valid, select an RSC with a CP security indication, and include the CP-PRUK ID in the DCR. In some embodiments, if the corresponding UP-PRUK is valid, the remote UE may select an RSC without a CP security indication, and include the UP-PRUK ID in the DCR. In some embodiments, if both the CP-PRUK and UP-PRUK corresponding to the RSC are valid, the remote UE may select an RSC with the same CP / UP mode as the current RSC, and include the CP / UP-PRUK ID in the DCR. In some embodiments, if both the CP-PRUK and UP-PRUK corresponding to the RSC are invalid, the remote UE may give priority to an RSC with the same CP / UP mode as the current RSC, and include the SUCI in the DCR. In some embodiments, the priority order may be pre-configured by the HPLMN of the remote UE through the authorization and provisioning process, or may depend on the UE implementation.

[0142] Figure 2 An example flow chart showing an example process 200 of RSC selection according to some embodiments of the present disclosure is illustrated. For ease of understanding, the process 200 may involve the following: Figure 1A-Figure 1C A remote UE 110 (which may also be referred to as a remote terminal equipment) is shown.

[0143] At block 210, the remote UE 110 obtains a selection policy for selecting an RSC from a plurality of RSCs. An RSC from the plurality of RSCs is associated with an indicator (eg, a CP security indicator) for indicating whether the RSC supports CP security procedures or UP security procedures.

[0144] At box 220, based on determining that a path switch from a source relay terminal device having a source RSC is triggered, the remote UE 110 selects a target RSC based on a selection policy. A source indicator is associated with the source RSC, and multiple indicators are associated with multiple RSCs. At box 230, the remote UE 110 selects a target relay UE (i.e., a target terminal device) for the path switch based on the target RSC.

[0145] In some embodiments, remote UE 110 may select a target relay terminal device having a target RSC identical to the source RSC. In some embodiments, remote UE 110 may determine multiple RSCs and obtain multiple indicators. In addition, remote UE 110 may determine whether the source RSC and multiple RSCs support CP security procedures or UP security procedures based on the source RSC and multiple indicators.

[0146] In some embodiments, the remote UE 110 may select one of the multiple RSCs as the target RSC for which the remote terminal device has a valid root key. In some embodiments, based on determining that the source RSC supports the CP security process, the remote UE 110 may select one of the multiple RSCs as the target RSC for which the remote terminal device has a valid root key and which supports the CP security process.

[0147] Alternatively or additionally, based on determining that the source RSC supports UP security procedures, the remote UE 110 may select one of the multiple RSCs as a target RSC for which the remote terminal device has a valid root key and which supports UP security procedures.

[0148] In some embodiments, the remote UE 110 may generate a DCR including an ID of a valid root key. The valid root key may be used to generate at least one security key for establishing a secure link for direct communication between the remote terminal device and the target relay terminal device.

[0149] In some embodiments, based on determining that the source RSC supports the CP security procedure, the remote UE 110 may select a candidate RSC that supports the CP security procedure from at least one candidate RSC as the target RSC. Alternatively or additionally, based on determining that the source RSC supports the UP security procedure, the remote UE 110 may select one RSC that supports the UP security procedure from multiple RSCs as the target RSC. Alternatively or additionally, the remote UE 110 may randomly select one RSC from multiple RSCs as the target RSC.

[0150] In some embodiments, the remote UE 110 may generate a DCR including a SUCI that is used to trigger a ProSe authentication procedure for the remote terminal device.

[0151] In some embodiments, the selection policy may include a selection order based on the CP security procedures or UP security procedures supported by the source RSC and the target RSC, and may also be based on an authentication policy. Alternatively or additionally, the selection policy may include an authentication policy to be used by the remote terminal device to determine whether to trigger the ProSe authentication procedure. In some embodiments, the selection policy and / or the authentication policy may be pre-configured by the HPLMN of the remote UE, or based on the implementation of the remote UE.

[0152] Figure 3 An example signaling diagram illustrating an example process 300 for RSC selection according to some embodiments of the present disclosure is illustrated. The example process 300 may involve the remote UE 110, the relays 121 and 122, the AMF 171 of the remote UE 110 or the PKMF 152 of the remote UE 110 (referred to as 201), the PKMF 154 of the relay 121, the PKMF 202 of the relay 122, the PCF 203 of the remote UE 110, and the AUSF 173 of the remote UE 110.

[0153] like Figure 3 As shown, the remote UE 110 may be provisioned with a CP indicator related RSC selection policy (eg, RSC selection priority order) at 310. Alternatively or additionally, the remote UE 110 may be provisioned with a re-authentication policy or the like.

[0154] At 311, the remote UE 110 may select a relay UE 121 for communication.

[0155] At 312, a path switch from relay UE 121 to, for example, relay UE 122 may be triggered.

[0156] At 313, the remote UE 110 may select an RSC and a corresponding relay based on the CP indicator associated with the RSC. If the priority order related to the CP security indicator is preconfigured in the remote UE, the UE should follow the order required by the HPLMN to select the RSC; otherwise, it may depend on the UE implementation.

[0157] Figure 4 An example 400 of RSC selection based on CP indicator is shown. Figure 4 As shown, after the path switch is triggered 401, the remote UE 110 may determine 402 whether there is a relay with the same RSC as the current relay (i.e., the source relay). If a relay with the same RSC is found, the remote UE 110 may select 403 the relay as the target relay for the path switch. If a relay with the same RSC is not found, the remote UE 110 may select 404 a candidate RSC.

[0158] Then, the remote UE 110 may obtain 405 the CP security indicator associated with the source RSC and the candidate RSC to determine whether the RSC supports a CP-based security procedure or a UP-based security procedure. For example, if the CP security indicator exists, it may indicate that the corresponding RSC supports a CP-based security procedure; otherwise, if the CP-based security procedure or the UP-based security procedure does not exist, it may indicate that the corresponding RSC supports a UP-based security procedure. It should be understood that the format of the CP security indicator is described only for ease of understanding without any limitation on the scope of the present disclosure, and the CP security indicator may be implemented in any suitable format.

[0159] The remote UE 110 may determine 406 whether there is an RSC that has a valid PRUK and supports the same security procedures as the source RSC. If an RSC that has a valid PRUK and supports the same security procedures is found, the remote UE 110 may select the RSC as the target RSC, use 408 the target RSC to select a target relay, and include the PRUK ID in the DCR. If an RSC that has a valid PRUK and supports the same security procedures is not found, the remote UE 110 may determine 407 whether there is an RSC that has a valid PRUK. If an RSC that has a valid PRUK is found, the remote UE 110 may select the RSC as the target RSC, use 408 the target RSC to select a target relay, and include the PRUK ID in the DCR.

[0160] If an RSC with a valid PRUK is not found, the remote UE 110 may determine 409 whether there is an RSC that supports the same security procedures as the source RSC. If an RSC that supports the same security procedures is found, the remote UE 110 may select the RSC as a target RSC, use 410 the target RSC to select a target relay and include a SUCI in the DCR. If an RSC that supports the same security procedures is not found, the remote UE 110 may randomly select an RSC from the candidate RSCs, or select an RSC based on the remote UE's implementation. The remote UE 110 may then select the randomly selected RSC as the target RSC, use 410 the target RSC to select a target relay and include a SUCI in the DCR.

[0161] It should be understood that the flowchart 400 is provided only for ease of understanding and does not represent any limitation, and the RSC selection strategy of the present disclosure may be implemented in any suitable order.

[0162] return Figure 3 At 314 (ie, 314a-d), the following may be followed: Figure 1B and Figure 1CFor the sake of brevity, the process is not repeated here.

[0163] According to the above embodiments, the present disclosure proposes a solution to optimize the relay selection process based on the CP security indicator associated with the RSC. Through the proposed solution, service continuity after path switching between ProSe L3 relays can be improved, and delay or interruption of services can be avoided.

[0164] According to other embodiments, the present disclosure also proposes solutions to optimize CP and UP security procedures to reduce re-authentication during path switching while still maintaining the freshness of PRUK during the mobility of the remote UE. For example, for both UP-based procedures and CP-based procedures, ProSe re-authentication / authorization and PRUK regeneration may be triggered in the following cases. In the case where the remote UE moves to a new PLMN, similar to the main authentication, ProSe re-authentication / authorization and PRUK regeneration may be triggered by the remote UE. In the case where the remote UE selects a relay in the new PLMN, ProSe re-authentication / authorization and PRUK regeneration may be triggered by the remote UE. In the case of PRUK expiration, subscription data change, etc., the HPLMN may trigger re-authentication. In some embodiments, when the remote UE switches to another RSC, re-authentication may not be triggered even for the CP-based procedure.

[0165] In some embodiments, the present disclosure proposes a re-authentication policy, and the same PRUK will be used for the remote UE regardless of the change of RSC.Re-authentication may be determined based on the re-authentication policy provisioned on the remote UE through the authorization and provisioning process, or depend on the UE implementation.

[0166] Figure 5 An example flow chart illustrating an example process 500 for optimizing a security process according to some embodiments of the present disclosure is illustrated. For ease of understanding, the process 500 may involve the following: Figure 1A-Figure 1C A remote UE 110 (which may also be referred to as a remote terminal equipment) is shown.

[0167] At block 510, the remote UE 110 obtains an authentication policy that will be used by the remote terminal device to determine whether to trigger a ProSe authentication procedure. At block 520, the remote UE 110 determines to trigger a ProSe authentication procedure based at least on the authentication policy.

[0168] In some embodiments, the authentication policy may be based on the mobility of the remote terminal device. In some embodiments, the remote UE 110 may determine to trigger the ProSe authentication process based on the remote terminal device moving to a new serving PLMN. In some embodiments, the remote UE 110 may determine to trigger the ProSe authentication process based on the remote terminal device selecting a relay terminal device in the new serving PLMN.

[0169] In some embodiments, the remote UE 110 may determine to trigger the ProSe authentication process based on the root key being invalid.The root key may be used to generate at least one security key for establishing a secure link for direct communication between the remote terminal device and the relay terminal device.

[0170] In some embodiments, the ProSe authentication process may include a CP security process.In addition, the remote UE 110 may determine to trigger the ProSe authentication process based on the authentication policy regardless of the change of the RSC, and the generation of the root key is independent of the RSC.

[0171] Figure 6 An example flow chart illustrating an example process 600 for optimizing a CP security process according to some embodiments of the present disclosure is illustrated. For ease of understanding, the process 600 may involve the following: Figure 1C AUSF 173 shown.

[0172] At block 610, the AUSF 173 generates a root key independently of the RSC. The root key is used to generate at least one ProSe key, which is used to establish a secure link for direct communication between a remote terminal device and a relay terminal device. At block 620, the AUSF 173 sends a ProSe key registration request without the RSC to the PAnF device 174.

[0173] In some embodiments, AUSF 173 may send a ProSe key acquisition request to the PAnF device to trigger a relay service authorization process for a remote terminal device based on RSC. In some embodiments, AUSF 173 may generate at least a ProSe security key based at least on RSC. At least the ProSe security key may be RSC specific. In some embodiments, the root key may include CP-PRUK.

[0174] Figure 7An example signaling diagram showing a UP security process 700 optimized according to some embodiments of the present disclosure is illustrated. The process 700 may involve a remote UE 110, a UE-to-network relay 121, a 5G DDNMF 151 of the remote UE 110, a PKMF 152 of the remote UE 110, a 5G DDNMF 153 of the relay 121, a PKMF 154 of the relay 121, and a UDM (or BSF or HSS) 155 of the remote UE 110.

[0175] like Figure 7 As shown, at 710a, the remote UE 110 may be provisioned with a re-authentication policy, etc. At 710b-710d, the remote UE 110 may follow the Figure 1B The process shown in FIG. 1 for PRUK request and then discovering and communicating with L3 U2N relays.

[0176] At 710e, the remote UE 110 may move to a new area. At 711, based on the availability of the UP PRUK and the reauthentication policy pre-configured in the remote UE, or based on UE implementation, the remote UE 110 may trigger reauthentication. For example, if the UE moves to a new serving PLMN, or the local PRUK is invalid (e.g., expired, damaged, etc.), the remote UE 110 may trigger reauthentication.

[0177] At 712a, if the remote UE 110 is in the coverage area, it may send a PRUK request to the HPLMN to obtain a new key, which may trigger re-authentication / authorization and PRUK generation. At 712b, if the remote UE 110 is not in the coverage area, it includes the SUCI in the next DCR request to the U2N relay, which may trigger re-authentication / authorization and PRUK generation.

[0178] The rest of the process for relay services can be similar to Figure 1B The process shown will not be repeated here.

[0179] Figure 8 An example signaling diagram illustrating a CP security process 800 optimized according to some embodiments of the present disclosure is illustrated. The process 800 may involve a remote UE 110, a UE-to-network relay 121, an AMF 171 of the remote UE 110, an AMF 172 of the relay 121, an AUSF 173 of the remote UE 110, a UDM 155 of the remote UE 110, and a PAnF 174 of the remote UE 110.

[0180] At 810, the 5G ProSe remote UE and the 5G ProSe UE-to-network relay may register with the network. The 5G ProSe UE-to-network relay may be authenticated and authorized by the network to provide UE-to-network relay services. The 5G ProSe remote UE may be authenticated and authorized by the network to receive UE-to-network relay services. During this authorization and information provisioning process, PC5 security policies are provisioned to the 5G ProSe remote UE and the 5G ProSe UE-to-network relay, respectively.

[0181] In addition, Figure 1C Unlike the process shown, a re-authentication strategy is provisioned to the 5G ProSe Remote UE.

[0182] At 811, based on the availability of CP-PRUK and the re-authentication policy pre-configured in the remote UE, or based on UE implementation, the remote UE may trigger ProSe authentication / re-authentication. For example, if the UE moves to a new serving PLMN, or the local PRUK is invalid (e.g., expired, damaged, etc.), the remote UE may trigger re-authentication.

[0183] At 812, after the discovery of the 5G ProSe UE to the network relay, the 5G ProSe remote UE may send a direct communication request to the 5G ProSe UE to the network relay for establishing a secure PC5 unicast link. The 5G ProSe remote UE may include its security capabilities and PC5 signaling security policy in the DCR message. The message may also include a relay service code, Nonce_1.

[0184] If the 5G ProSe remote UE does not have a valid 5G ProSe Remote User Key (CP-PRUK) and needs to be re-authenticated, the 5G ProSe remote UE may include a SUCI in the DCR to trigger a 5G ProSe remote UE specific authentication and establish a CP-PRUK.

[0185] If the 5G ProSe remote UE already has a valid CP-P for the relay service code and does not need to be re-authenticated, the 5G ProSe remote UE may include the associated CP-PRUK ID in the DCR to indicate that the 5G ProSe remote UE wants to use the CP-PRUK to acquire the relay connection.

[0186] Steps 813 and 814 are similar to Figure 1C Steps 183 and 184 shown are not repeated here.

[0187] At 815, the 5G ProSe UE to network relayed AMF may select an AUSF based on the SUCI or CP-PRUK ID and forward the parameters received in the relay key request to the AUSF in a Nausf_UEAuthentication_ProseAuthenticate request message. The Nausf_UEAuthentication_ProseAuthenticate request message may contain the SUCI or CP-PRUK ID of the 5G ProSe remote UE, the relay service code, and Nonce_1. If the CP-PRUK ID is received from the 5G ProSe UE to network relayed AMF, the 5G ProSe remote AUSF may temporarily store Nonce_1 and the UE skips steps 186-189. If the SUCI of the 5G ProSe remote UE is received from the 5G ProSe UE to network relayed AMF, the 5G ProSe remote UE AUSF temporarily stores Nonce_1 and the relay service code. Figure 1C Unlike step 185 shown, step 820 will not be skipped.

[0188] At 816, the AUSF may initiate 5G ProSe remote UE-specific authentication without using the received ProSe-specific parameters (i.e., RSC, etc.).

[0189] Steps 817a-818 are similar to Figure 1C Steps 187a-188 shown are not repeated here.

[0190] At 819a, the AUSF of the 5G ProSe remote UE may select a PAnF based on the CP-PRUK ID and send the SUPI, CP-PRUK and CP-PRUK ID to the PAnF in an Npanf_ProseKey_Register request message. Figure 1C Different from step 189a shown, the AUSF of the 5G ProSe remote UE may not send RSC to the PAnF in the Npanf_ProseKey_Register request message.

[0191] At 819b, the PAnF may store the Prose context information (ie, SUPI, CP-PRUK, CP-PRUK ID) for the 5G Prose remote UE and send an Npanf_ProseKey_Register response message to the AUSF. Figure 1C Unlike step 189b shown, the AUSF of the 5G ProSe remote UE can store the ProSe context information without RSC.

[0192] At 820a, the AUSF of the 5G ProSe remote UE may select a PAnF based on the CP-PRUK ID and send the received CP-PRUK ID and RSC in an Npanf_ProseKey_get request message.

[0193] At 820b, the PAnF may retrieve the CP-PRUK based on the CP-PRUK ID and check whether the 5G ProSe remote UE is authorized to use the UE-to-network relay service based on the received RSC. If the 5G ProSe remote UE is authorized and the retrieved CP-PRUK is valid, the PAnF may send an Npanf_ProseKey_get response message with the CP-PRUK to the AUSF.

[0194] At 821, the AUSF of the 5G ProSe remote UE may generate Nonce_2 and derive K using CP-PRUK, RSC, Nonce_1 and Nonce_2. NR_ProSe Key.

[0195] Steps 822-827 are similar to Figure 1C Steps 192-197 shown are not repeated here.

[0196] In some embodiments, a device capable of performing any of the methods 200 (e.g., remote UE 110) may include components for performing the corresponding steps of the method 200. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0197] In some embodiments, the apparatus includes: a component for obtaining, at a remote terminal device, a selection policy for selecting a relay selection code (RSC) from a plurality of RSCs, an RSC in the plurality of RSCs being associated with an indicator for indicating whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; a component for selecting a target RSC based on the selection policy based on determining that a path switch from a source relay terminal device having a source RSC is triggered, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; and a component for selecting a target relay terminal device for the path switch based on the target RSC.

[0198] In some embodiments, the component for selecting a target relay terminal device based on the target RSC includes a component for selecting a target relay terminal device having a target RSC identical to the source RSC. In some implementations, the apparatus further includes a component for: determining a plurality of RSCs; obtaining a plurality of indicators; and determining whether the source RSC and the plurality of RSCs support a CP security procedure or a UP security procedure based on the source RSC and the plurality of indicators.

[0199] In some embodiments, the component for selecting a target relay terminal device based on a target RSC includes a component for selecting the following RSC from among multiple RSCs as the target RSC, for which the remote terminal device has a valid root key. In some implementations, the component for selecting a target relay terminal device based on a target RSC includes a component for selecting the following RSC from among multiple RSCs as the target RSC based on determining that the source RSC supports the CP security process, for which the remote terminal device has a valid root key, and the RSC supports the CP security process.

[0200] In some embodiments, the component for selecting a target relay terminal device based on a target RSC includes a component for selecting the following RSC from multiple RSCs as the target RSC based on determining that the source RSC supports the UP security process, for which the remote terminal device has a valid root key and which supports the UP security process.

[0201] In some embodiments, the apparatus further comprises a component for generating a direct communication request (DCR) including an identification (ID) of a valid root key, the valid root key being used to generate at least one security key, the at least one security key being used to establish a secure link for direct communication between a remote terminal device and a target relay terminal device.

[0202] In some embodiments, the device also includes: a component for selecting a candidate RSC that supports the CP security process from at least one candidate RSC as a target RSC based on determining that the source RSC supports the CP security process; a component for selecting an RSC that supports the UP security process from multiple RSCs as the target RSC based on determining that the source RSC supports the UP security process; or a component for randomly selecting one of the multiple RSCs as the target RSC.

[0203] In some embodiments, the apparatus further comprises a component for generating a DCR, the DCR comprising a subscription concealed identifier (SUCI) used to trigger a proximity-based service (ProSe) authentication procedure of a remote terminal device. In some embodiments, the selection strategy comprises at least one of: a selection order of a CP security procedure or a UP security procedure supported by a source RSC and a target RSC; or an authentication strategy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication procedure. In some embodiments, the selection strategy is pre-configured by a home public land mobile network (HPLMN) of the remote terminal device, or is based on an implementation of the remote terminal device.

[0204] In some embodiments, the apparatus further comprises means for performing other steps of some embodiments of method 200. In some embodiments, the apparatus comprises at least one processor and at least one memory comprising computer program code, the at least one memory and the computer program code being configured to cause execution of the apparatus together with the at least one processor.

[0205] In some embodiments, a device capable of performing any of the methods 500 (e.g., remote UE 110) may include components for performing the corresponding steps of the method 500. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0206] In some embodiments, the apparatus includes: a component for obtaining an authentication policy at a remote terminal device, the authentication policy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication process; and a component for determining to trigger the ProSe authentication process based at least on the authentication policy.

[0207] In some embodiments, the authentication policy is based on mobility of the remote terminal device. In some embodiments, the means for determining to trigger the ProSe authentication procedure includes means for determining to trigger the ProSe authentication procedure based on the remote terminal device moving to a new serving public land mobile network (PLMN). In some embodiments, the means for determining to trigger the ProSe authentication procedure includes means for determining to trigger the ProSe authentication procedure based on the remote terminal device selecting a relay terminal device in the new serving PLMN.

[0208] In some embodiments, the component for determining to trigger the ProSe authentication process includes a component for determining to trigger the ProSe authentication process based on that a root key is invalid, wherein the root key is used to generate at least one security key, and the at least one security key is used to establish a secure link for direct communication between a remote terminal device and a relay terminal device.

[0209] In some embodiments, the ProSe authentication process includes a control plane (CP) security process. In addition, the component for determining to trigger the ProSe authentication process based on at least the authentication policy includes a component for determining to trigger the ProSe authentication process based on the authentication policy regardless of whether the RSC changes, and the generation of the root key is independent of the RSC.

[0210] In some embodiments, the apparatus further comprises means for performing other steps of some embodiments of method 500. In some embodiments, the apparatus comprises at least one processor and at least one memory comprising computer program code, the at least one memory and the computer program code being configured to cause execution of the apparatus together with the at least one processor.

[0211] In some embodiments, an apparatus capable of performing any of the methods 600 (e.g., AUSF device 173) may include components for performing the corresponding steps of the method 600. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module.

[0212] In some embodiments, the apparatus includes: a component for generating a root key at an authentication server function (AUSF) device independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the at least one ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; and a component for sending a ProSe key registration request without the RSC to a ProSe anchor function (PAnF) device.

[0213] In some embodiments, the apparatus further comprises a component for sending a ProSe key acquisition request to the PAnF device to trigger a relay service authorization process of the remote terminal device based on the RSC. In some implementations, the apparatus further comprises a component for generating at least a ProSe security key based at least on the RSC, at least the ProSe security key being RSC specific. In some embodiments, the root key comprises a control plane ProSe remote user key (CP-PRUK).

[0214] In some embodiments, the apparatus further comprises means for performing other steps of some embodiments of method 600. In some embodiments, the apparatus comprises at least one processor and at least one memory comprising computer program code, the at least one memory and the computer program code being configured to cause execution of the apparatus with the at least one processor.

[0215] Fig. 9900 is a simplified block diagram of a device 900 suitable for implementing an embodiment of the present disclosure. The device 900 may be provided to implement a communication device, such as a remote UE 110 and an AUSF device 173. As shown, the device 900 includes one or more processors 910, one or more memories 920 coupled to the processor 910, and one or more communication modules (TX / RX) 940 coupled to the processor 910.

[0216] The one or more communication modules 940 are used for two-way communication. The one or more communication modules 940 have at least one antenna to facilitate communication. The communication interface may represent any interface required for communication with other network elements.

[0217] Processor 910 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 900 may have multiple processors, such as application specific integrated circuit chips that are time slaved to a clock synchronized with a main processor.

[0218] The memory 920 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 924, electrically programmable read-only memory (EPROM), flash memory, hard disks, compact disks (CDs), digital video disks (DVDs), and other magnetic storage devices and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 922 and other volatile memories that do not persist during power outages.

[0219] The computer program 930 includes computer executable instructions executed by the associated processor 910. The program 930 may be stored in the ROM 920. The processor 910 may perform any suitable actions and processes by loading the program 930 into the RAM 920.

[0220] The embodiments of the present disclosure may be implemented by a program 930, so that the device 900 may execute the reference Figures 2 to 8 Any process of the present disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

[0221] In some embodiments, the program 930 may be tangibly contained in a computer-readable medium, which may be included in the device 900 (such as in the memory 920) or in other storage devices accessible to the device 900. The device 900 may load the program 930 from the computer-readable medium to the RAM 922 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. Fig.10 An example of a computer readable medium 1000 in the form of a CD or DVD is shown. The computer readable medium has a program 930 stored thereon.

[0222] Generally, various embodiments of the present disclosure may be implemented using hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented using hardware, while other aspects may be implemented using firmware or software that may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are illustrated and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that, as non-limiting examples, the blocks, devices, systems, techniques, or methods described herein may be implemented using hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0223] The present disclosure also provides at least one computer program product tangibly stored on a transient or non-transitory computer-readable storage medium. The computer program product includes computer executable instructions, such as instructions included in a program module, which are executed in a device on a target real or virtual processor to perform the above referenced Figure 2 , Figure 5 and Figure 6 Methods 200, 500 and 500 are described. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or split between program modules as needed. The machine executable instructions of program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in both local and remote storage media.

[0224] The program code for executing the method of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code is implemented when executed by the processor or controller. The program code can be executed completely on the machine, partially on the machine, as an independent software package, partially on the machine and partially on a remote machine, or completely on a remote machine or server.

[0225] In the context of the present disclosure, instructions or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer-readable media, etc.

[0226] Computer readable medium can be a computer readable signal medium or a computer readable storage medium. Computer readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. More specific examples of computer readable storage medium will include electrical connections with one or more wires, portable computer floppy disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. The term "non-transient" used herein is a restriction on the medium itself (i.e., tangible, rather than signal), rather than a restriction on data storage persistence (e.g., RAM and ROM).

[0227] In addition, although the operations are described in a particular order, this should not be understood as requiring such operations to be performed in the particular order shown or in order or performing all the operations shown to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be interpreted as limitations on the scope of the present disclosure, but rather descriptions of features that may be specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0228] Although the present disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the present disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Instead, the specific features or acts described above are disclosed as example forms of implementing the claims.

Claims

1. A remote terminal device, comprising: at least one processor; as well as at least one memory storing instructions which, when executed by the at least one processor, cause the remote terminal device to at least: Obtaining a selection strategy for selecting a relay selection code (RSC) from a plurality of RSCs, wherein an RSC in the plurality of RSCs is associated with an indicator, wherein the indicator is used to indicate whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; selecting a target RSC based on the selection policy based on determining that a path switch is triggered from a source relay terminal device having a source RSC, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; as well as A target relay terminal device is selected for the path switching based on the target RSC.

2. The remote terminal device according to claim 1, wherein the remote terminal device is caused to select a target relay terminal device based on the target RSC by: The target relay terminal device having the target RSC identical to the source RSC is selected.

3. The remote terminal device according to claim 1 or 2, wherein the remote terminal device is further configured to: determining the plurality of RSCs; obtaining the plurality of indicators; and Based on the source RSC and the plurality of indicators, it is determined whether the source RSC and the plurality of RSCs support the CP security procedure or the UP security procedure.

4. The remote terminal device according to any one of claims 1 to 3, wherein the remote terminal device is caused to select the target RSC based on the selection policy by: An RSC among the plurality of RSCs is selected as the target RSC for which the remote terminal device has a valid root key.

5. The remote terminal device according to claim 4, wherein the remote terminal device is further caused to select the target RSC based on the selection policy by: Based on determining that the source RSC supports the CP security procedure, the following RSC among the multiple RSCs is selected as the target RSC, for which the remote terminal device has the valid root key and the RSC supports the CP security procedure.

6. The remote terminal device according to claim 4, wherein the remote terminal device is further caused to select the target RSC based on the selection policy by: Based on determining that the source RSC supports the UP security process, the following RSC among the multiple RSCs is selected as the target RSC, for which the remote terminal device has the valid root key and the RSC supports the UP security process.

7. The remote terminal device according to any one of claims 1 to 6, wherein the remote terminal device is further configured to: A direct communication request (DCR) is generated including an identification (ID) of the effective root key, wherein the effective root key is used to generate at least one security key, and the at least one security key is used to establish a secure link for direct communication between the remote terminal device and the target relay terminal device.

8. The remote terminal device according to claim 3, wherein the remote terminal device is further configured to perform at least one of the following: Based on determining that the source RSC supports the CP security process, selecting a candidate RSC that supports the CP security process from among the at least one candidate RSC as the target RSC; Based on determining that the source RSC supports the UP security procedure, selecting an RSC among the multiple RSCs that supports the UP security procedure as the target RSC; or One of the plurality of RSCs is randomly selected as the target RSC.

9. The remote terminal device according to claim 8, wherein the remote terminal device is further configured to: A DCR is generated, the DCR including a Subscription Hidden Identifier (SUCI) used to trigger a Proximity Based Services (ProSe) authentication procedure of the remote terminal device.

10. The remote terminal device according to any one of claims 1 to 9, wherein the selection strategy comprises at least one of the following: Based on the selection order of the CP security procedure or the UP security procedure supported by the source RSC and the target RSC; or The authentication policy that will be used by the remote terminal device to determine whether to trigger the ProSe authentication process.

11. The remote terminal device according to any one of claims 1 to 10, wherein the selection strategy is preconfigured by a home public land mobile network (HPLMN) of the remote terminal device or is based on the implementation of the remote terminal device.

12. A remote terminal device, comprising: at least one processor; as well as at least one memory storing instructions which, when executed by the at least one processor, cause the remote terminal device to at least: obtaining an authentication policy, the authentication policy to be used by the remote terminal device to determine whether to trigger a proximity-based service (ProSe) authentication procedure; as well as Based at least on the authentication policy, determine to trigger the ProSe authentication process.

13. The remote terminal device according to claim 12, wherein the authentication policy is based on the mobility of the remote terminal device.

14. The remote terminal device according to claim 12 or 13, wherein the remote terminal device is configured to determine triggering the ProSe authentication process by: Based on the remote terminal equipment moving to a new serving public land mobile network (PLMN), it is determined to trigger the ProSe authentication process.

15. The remote terminal device according to any one of claims 12 to 14, wherein the remote terminal device is configured to determine triggering the ProSe authentication process by: Based on the remote terminal device selecting a relay terminal device in the new service PLMN, it is determined to trigger the ProSe authentication process.

16. The remote terminal device according to any one of claims 12 to 15, wherein the remote terminal device is further configured to determine triggering the ProSe authentication process by: The ProSe authentication process is triggered based on determining that a root key is invalid, wherein the root key is used to generate at least one security key, and the at least one security key is used to establish a secure link for direct communication between the remote terminal device and the relay terminal device.

17. The remote terminal device according to any one of claims 12 to 16, wherein the ProSe authentication procedure comprises a control plane (CP) security procedure, and the remote terminal device is caused to determine triggering the ProSe authentication procedure based at least on the authentication policy by: The ProSe authentication process is triggered based on the authentication policy regardless of the change of the RSC, and the generation of the root key is independent of the RSC.

18. An authentication server function (AUSF) device, comprising: at least one processor; as well as at least one memory storing instructions that, when executed by the at least one processor, cause the AUSF device to at least: generating a root key independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the at least one ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; as well as A ProSe key registration request without the RSC is sent to a ProSe anchor function (PAnF) device.

19. The AUSF device of claim 18, wherein the AUSF device is further caused to: A ProSe key acquisition request is sent to the PAnF device to trigger a relay service authorization process of the remote terminal device based on the RSC.

20. The AUSF device according to claim 18 or 19, wherein the AUSF device is further caused to: The at least ProSe security key is generated based at least on the RSC, the at least ProSe security key being RSC specific.

21. The AUSF device according to any one of claims 18 to 20, wherein the root key comprises a Control Plane ProSe Remote User Key (CP-PRUK).

22. A method comprising: obtaining, at a remote terminal device, a selection policy for selecting a relay selection code (RSC) from a plurality of RSCs, an RSC in the plurality of RSCs being associated with an indicator for indicating whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; selecting a target RSC based on the selection policy based on determining that a path switch is triggered from a source relay terminal device having a source RSC, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; as well as A target relay terminal device is selected for the path switching based on the target RSC.

23. A method comprising: obtaining, at a remote terminal device, an authentication policy to be used by the remote terminal device to determine whether to trigger a Proximity Based Services (ProSe) authentication procedure; as well as Based at least on the authentication policy, determine to trigger the ProSe authentication process.

24. A method comprising: generating, at an authentication server function (AUSF) device, a root key independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the at least one ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; as well as A ProSe key registration request without the RSC is sent to a ProSe anchor function (PAnF) device.

25. An apparatus comprising components for: Obtaining a selection strategy for selecting a relay selection code (RSC) from a plurality of RSCs, wherein an RSC in the plurality of RSCs is associated with an indicator, wherein the indicator is used to indicate whether the RSC supports a control plane (CP) security procedure or a user plane (UP) security procedure; selecting a target RSC based on the selection policy based on determining that a path switch is triggered from a source relay terminal device having a source RSC, a source indicator being associated with the source RSC, and a plurality of indicators being associated with the plurality of RSCs; and A target relay terminal device is selected for the path switching based on the target RSC.

26. An apparatus comprising components for: obtaining an authentication policy to be used by a remote terminal device to determine whether to trigger a Proximity Based Services (ProSe) authentication procedure; and Based at least on the authentication policy, determine to trigger the ProSe authentication process.

27. An apparatus comprising components for: generating a root key independently of a relay selection code (RSC), the root key being used to generate at least one proximity-based service (ProSe) key, the at least one ProSe key being used to establish a secure link for direct communication between a remote terminal device and a relay terminal device; and A ProSe key registration request without the RSC is sent to a ProSe anchor function (PAnF) device.

28. A computer-readable medium comprising program instructions which, when executed by an apparatus, cause the apparatus to perform at least one of the methods according to claims 22 to 24.

Images