Secure communication in ProSe U2N relays

Abstract

The embodiment of the invention relates to secure communication in a ProSe U2N relay. According to one aspect of the present disclosure, a remote UE and a relay UE receive a configuration including at least a set of indicators for a CP-based security procedure or a UP-based security procedure for a relay service set. Based on an indicator for the relay service in the set of indicators, the remote UE and the relay UE perform one of a CP-based security procedure or a UP-based security procedure for communication between the remote UE and the relay UE for the relay service. In this manner, the remote UE and the remote UE may correctly trigger a security procedure for U2N relay communications.

Description

Technical Field

[0001] Embodiments of the present disclosure relate generally to the field of telecommunications, and in particular to methods, devices, apparatuses, and computer-readable storage media for secure communications in a Proximity-based Service (ProSe) User Equipment (UE) to Network (U2N) relay. Background Art

[0002] For ProSe communication via U2N relay, a user plane (UP)-based security solution has been proposed in the long-term evolution (LTE) technology. In the fifth generation (5G) communication technology, since the U2N relay will be used for business cases in addition to public safety, a control plane (CP)-based security solution has been proposed to ensure more solid and committed security. Currently, both UP-based security solutions and CP-based security solutions will be supported for ProSe communication via U2N relay to authenticate remote UEs and protect PC5 communications. However, the workflow and functions required for the CP-based security solution are different from those required for the UP-based security solution. Therefore, effective management of the CP-based security solution and the UP-based security solution is expected. Summary of the invention

[0003] In general, example embodiments of the present disclosure provide a solution for secure communication in a ProSe U2N relay.

[0004] In a first aspect, a first device is provided. The first device includes: at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code are configured to, together with the at least one processor, enable the first device to: receive a first configuration from a third device, the first configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; perform a discovery process based on the first configuration to determine a second device for relaying communication between the first device and a network for relay service; and perform one of a control plane-based security process and a user plane-based security process based on the indicator set for the relay service for communication between the first device and the second device for the relay service.

[0005] In a second aspect, a second device is provided. The second device includes: at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code are configured to, together with the at least one processor, enable the second device to: receive a second configuration from a fourth device, the second configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; and in response to receiving a communication request for a relay service from a first device, perform one of a control plane-based security process or a user plane-based security process based on an indicator for the relay service in the indicator set, for communication between the first device and the second device for the relay service.

[0006] In a third aspect, a core network element is provided. The core network element includes: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured to, together with the at least one processor, enable the core network element to: obtain a configuration from another core network element, the configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; and send the configuration to the device.

[0007] In a fourth aspect, a method for communication is provided. The method includes: receiving a first configuration from a third device at a first device, the first configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; performing a discovery process based on the first configuration to determine a second device for relaying communication between the first device and a network for the relay service; and performing one of a control plane-based security process and a user plane-based security process for communication between the first device and the second device for the relay service based on an indicator for the relay service in the indicator set.

[0008] In a fifth aspect, a communication method is provided. The method includes: receiving, at a second device, a second configuration from a fourth device, the second configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; and in response to receiving a communication request for a relay service from a first device, performing, based on the indicator for the relay service in the indicator set, one of the control plane-based security process or the user plane-based security process for communication between the first device and the second device for the relay service.

[0009] In a sixth aspect, a communication method is provided. The method comprises: obtaining, at a core network element, a configuration from another core network element, the configuration comprising at least: an indicator set of a control plane-based security procedure or a user plane-based security procedure for a relay service set; and sending the configuration to the device.

[0010] In a seventh aspect, a device for communication is provided. The device includes: a component for receiving a first configuration from a third device at a first device, the first configuration including at least: a set of indicators for a control plane-based security process or a user plane-based security process for a relay service set; a component for performing a discovery process based on the first configuration to determine a second device for relaying communication between the first device and a network for the relay service; and a component for performing one of a control plane-based security process and a user plane-based security process for communication between the first device and the second device for the relay service based on an indicator for the relay service in the indicator set.

[0011] In an eighth aspect, a device for communication is provided. The device includes: a component for receiving a second configuration from a fourth device at a second device, the second configuration including at least: an indicator set of a control plane-based security process or a user plane-based security process for a relay service set; and a component for performing, in response to receiving a communication request for a relay service from a first device, one of a control plane-based security process or a user plane-based security process based on an indicator for the relay service in the indicator set, for communication between the first device and the second device for the relay service.

[0012] In a ninth aspect, an apparatus for communication is provided. The apparatus includes: a component for obtaining a configuration from another core network element at a core network element, the configuration including at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a relay service set; and a component for sending the configuration to the device.

[0013] In a tenth aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing an apparatus to execute a method according to the fourth aspect, the fifth aspect or the sixth aspect.

[0014] It should be understood that the invention summary is not intended to identify the key or essential features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0016] Figure 1 illustrates an example communication environment in which embodiments of the present disclosure may be implemented;

[0017] Figure 2 A diagram illustrating a ProSe communication process via a U2N relay in which embodiments of the present disclosure may be implemented is illustrated;

[0018] Figure 3 A diagram illustrating a process in which a UP-based security solution of an embodiment of the present disclosure may be implemented is illustrated;

[0019] Figure 4 illustrates a diagram illustrating a process in which a CP-based security solution of an embodiment of the present disclosure may be implemented;

[0020] Figure 5 illustrates a diagram illustrating a communication process according to some embodiments of the present disclosure;

[0021] Figure 6 illustrates a flow chart of an example method implemented at a first device as a remote UE according to some embodiments of the present disclosure;

[0022] Figure 7 A flowchart illustrating an example method implemented at a second device as a relay UE according to some embodiments of the present disclosure is illustrated;

[0023] Figure 8 illustrates a flow chart of an example method implemented at a core network element according to some embodiments of the present disclosure;

[0024] Fig. 9 illustrates a simplified block diagram of a device suitable for implementing embodiments of the present disclosure; and

[0025] Fig.10 A block diagram of an example computer-readable medium is illustrated in accordance with some embodiments of the present disclosure.

[0026] Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. DETAILED DESCRIPTION

[0027] The principle of the present disclosure will now be described with reference to some example embodiments. It should be understood that these embodiments are described only to illustrate and help those skilled in the art to understand and implement the present disclosure, and do not represent any limitation on the scope of the present disclosure. The disclosure described herein can be implemented in various other ways except the way described below.

[0028] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0029] In this disclosure, references to "one embodiment," "an embodiment," and "an example embodiment" indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment must include the particular feature, structure, or characteristic. In addition, such phrases do not necessarily refer to the same embodiment. In addition, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, those skilled in the art believe that it is within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0030] It should be understood that although the terms "first" and "second" etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the example embodiments, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0031] The terms used herein are only used to describe specific embodiments and are not intended to limit the example embodiments. The singular forms "a", "an", and "the" used herein also include the plural forms, unless the context clearly indicates otherwise. It is further understood that the terms "include", "comprising", "having", "having", "including", and / or "containing" when used herein specify the presence of the features, elements, and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0032] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0033] (a) a pure hardware circuit implementation (such as an implementation using only analog and / or digital circuitry), and

[0034] (b) a combination of hardware circuitry and software such as (where applicable):

[0035] (i) a combination of analog and / or digital hardware circuits and software / firmware, and

[0036] (ii) any portion of hardware processor(s) (including digital signal processor(s)) with software, software and memory(s) that work together to enable a device (such as a mobile phone or server) to perform various functions), and

[0037] (c) Hardware circuits and / or processor(s), such as microprocessor(s), or portions of microprocessor(s), that require software (e.g., firmware) to operate, but which may not be present when the software is not required for operation.

[0038] This definition of circuitry applies to all uses of the term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors), or a portion of a hardware circuit or processor and its (their) accompanying software and / or firmware. For example, and if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0039] As used herein, the term "communication network" refers to a network that follows any suitable communication standard, such as long term evolution (LTE), advanced LTE (LTE-A), wideband code division multiple access (WCDMA), high speed packet access (HSPA), narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal equipment and the network equipment in the communication network can be performed according to any suitable generation of communication protocols, including but not limited to the first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, fifth generation (5G), sixth generation (6G) communication protocols, and / or any other protocols currently known or to be developed in the future. The embodiments of the present disclosure can be applied to various communication systems. Considering the rapid development of communication, there will certainly be communication technologies and systems that can be used to embody future types of the present disclosure. It should not be regarded as limiting the scope of the present disclosure to the above-mentioned systems.

[0040] As used herein, the term "network device" or "network element" refers to a node in a communication network, via which a terminal device accesses the network and receives services from the network. The communication network may be a core network (CN). The network devices or elements in the CN (also referred to herein as core network elements) may refer to a policy control function (PCF), an access management function (AMF), a session management function (SMF), a user plane function (UPF), a unified data management (UDM), a unified database (UDR), an authentication server function (AUSF), a ProSe key management function (PKMF), a direct discovery name management function (DDNMF), a network exposure function (NEF), etc.

[0041] The communication network may be a radio access network (RAN). Network devices or elements in the RAN may refer to base stations (BS) or access points (APs), such as NodeB (NodeB or NB), evolved NodeB (eNodeB or eNB), NR next generation NodeB (also known as gNB), remote radio unit (RRU), radio head (RH), remote radio head (RRH), relay, low power node (such as femto, pico, etc.), depending on the terminology and technology applied. The radio access network (RAN) split architecture includes a gNB-CU (centralized unit, which hosts the radio resource control (RRC), service data adaptation protocol (SDAP), and packet data convergence protocol (PDCP) layers), which controls multiple gNB-DUs (distributed units, which host the radio link control (RLC), media access control (MAC), and physical (PHY) layers).

[0042] The term "terminal device" refers to any terminal device capable of wireless communication. As an example and not limitation, the terminal device may also be referred to as a communication device, a user equipment (UE), a subscriber station (SS), a portable subscriber station, a mobile station (MS) or an access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device (such as a digital camera), a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop embedded device (LEE), a laptop mounted device (LME), a USB dongle, a smart device, a wireless customer premises equipment (CPE), an Internet of Things (IoT) device, a watch or other wearable device, a head mounted display (HMD), a vehicle, a drone, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in industrial and / or automated processing chain environments), consumer electronic devices, equipment operating on commercial and / or industrial wireless networks, etc. In the following description, the terms "terminal device", "communication device", "terminal", "user equipment" and "UE" may be used interchangeably.

[0043] Although in various example embodiments, the functions described herein may be performed in fixed and / or wireless network nodes, in other example embodiments, the functions may be implemented in a user equipment device (such as a mobile phone or tablet or laptop or desktop computer or mobile IoT device or fixed IoT device). For example, the user equipment device may be equipped with corresponding functions related to (multiple) fixed and / or wireless network nodes as required. The user equipment device may be a user device and / or a control device (such as a chipset or processor) that is configured to control the user device when installed in the user device. Examples of such functions include boot server functions and / or home subscriber servers, which may be implemented in the user equipment device by providing software to the user equipment device that is configured to cause the user equipment device to perform from the perspective of these functions / nodes.

[0044] In the context of the present disclosure, the term “U2N relay” may be used interchangeably with “5G ProSe layer 3 UE to network relay” or “relay UE”. The term “remote UE” may be used interchangeably with “5G ProSe layer 3 remote UE”.

[0045] As is known, Proximity-based Services (ProSe) are services that can be provided by the 3rd Generation Partnership Project (3GPP) system based on the proximity of UEs to each other. This feature was introduced in LTE and evolved in the 5G System (5GS). 5GS enablers for ProSe include the following functions: 5G ProSe direct discovery; 5G ProSe direct communication; and 5G ProSe U2N relay.

[0046] PC5 is a reference point between ProSe-enabled UEs and is used for 5G ProSe direct discovery, 5G ProSe direct communication, and the control plane and user plane of 5G ProSe U2N relay. 5G ProSe direct discovery is defined as a process that detects and identifies another UE in the vicinity via the New Radio (NR) PC5 reference point. 5G ProSe direct discovery can be standalone or can be used for subsequent operations (e.g., initiating 5G ProSe direct communication).

[0047] 5G ProSe direct communication enables the establishment of a new communication path between two or more ProSe-enabled UEs within the communication range. 5G ProSe direct communication over the PC5 reference point is supported when the UE is "served by NG-RAN" or when the UE is "not served by NG-RAN". 5G ProSe direct communication supports both public safety and commercial services.

[0048] The 5G ProSe U2N relay feature enables a 5G ProSe remote UE to connect to a 5G network via a 5G ProSe U2N relay. A 5G ProSe layer 2 or layer 3 U2N relay entity provides relay functionality to support connections to the network for 5G ProSe remote UEs. It can be used for both public safety services and commercial services (e.g., interactive services).

[0049] When operating ProSe in both public safety and commercial scenarios, 5GS should be able to support regional or national regulatory requirements and ensure the confidentiality and integrity of both user data and network signaling on the ProSe communication path to a level comparable to that provided by existing 3GPP systems.

[0050] In particular, the following security requirements apply to 5G ProSe U2N relay:

[0051] - In the 5G ProSe U2N relay scenario, the 5GS shall support authentication and authorization of the UE as a 5G ProSe U2N relay and a 5G ProSe remote UE;

[0052] -5GS shall support security means to establish PC5 link between 5G ProSe remote UE and 5G ProSe U2N relay;

[0053] - 5GS shall support confidentiality protection, integrity protection and replay protection for secure communication between 5G ProSe remote UE and 3GPP network via 5G ProSe U2N relay.

[0054] Therefore, security solutions have been proposed to protect ProSe communications. For 5G ProSe communications via 5G ProSe U2N relays, there are UP-based security solutions in LTE. In 5G, since 5G ProSe U2N relays will be used for business cases in addition to public safety, the security risk surface will be expanded, and therefore a more solid and committed security solution is required. In this regard, a CP-based security solution is introduced to authenticate 5G ProSe remote UEs and generate keys to protect the PC5 link between 5G ProSe remote UEs and 5G ProSe U2N relays, which is based on the primary authentication mechanism for UE and 5G network authentication.

[0055] In this case, both UP-based security solutions and CP-based security solutions will be supported for 5G ProSe communication via 5G ProSe U2N relay in 5G. This means that the 5G ProSe remote UE can support UP-based security solutions, or CP-based security solutions, or both UP-based security solutions and CP-based security solutions. Similarly, the 5G ProSe U2N relay can support UP-based security solutions, or CP-based security solutions, or both UP-based security solutions and CP-based security solutions.

[0056] Since the workflows and functions required for CP-based security solutions are different from those required for UP-based security solutions, the 5GS should enable the 5G ProSe remote UE to discover and select an appropriate 5G ProSe U2N relay that matches the capabilities of the 5G ProSe remote UE and the security policy for the corresponding relay service.

[0057] The 5G ProSe Remote UE should have the knowledge to decide: during the discovery process, which 5G ProSe U2N relay can be selected to support the CP-based security solution for the relay service; during the direct communication link establishment process, whether the 5G ProSe Remote User Key (PRUK) derivation to support the CP-based security solution should be triggered; and what the trigger for the key derivation is. The 5G ProSe U2N Relay should have the knowledge to decide: during the discovery process, whether it can respond to the request message from the 5G ProSe Remote UE; and during the direct communication link establishment process, whether the CP-based security solution or the UP-based security solution should be triggered.

[0058] The required enabling factors and knowledge described above do not exist in existing solutions. Therefore, during discovery, the 5G ProSe remote UE cannot select the correct 5G ProSe U2N relay to support the CP-based security solution. Neither the remote UE nor the U2N relay can correctly trigger the CP-based security workflow.

[0059] In view of this, an embodiment of the present disclosure provides a solution for managing a CP-based security solution and a UP-based security solution. In the solution, an indicator of a CP-based security solution or a UP-based security solution for a relay service is configured for a remote UE and a relay UE. Based on the indicator, the remote UE can discover a relay UE that supports the same security solution for the same relay service, and trigger a corresponding security solution to protect the communication between the remote UE and the relay UE for the relay service. Based on the indicator, the relay UE can also trigger a corresponding security solution to protect the communication between the remote UE and the relay UE for the relay service.

[0060] In this way, the remote UE can select the correct relay UE during discovery to support the same security solution, and the remote UE and relay UE can correctly trigger the security solution workflow.

[0061] The principles and implementations of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0062] Example of communication environment

[0063] Figure 1 1 illustrates a schematic diagram of an example communication environment 100 in which embodiments of the present disclosure may be implemented. Figure 1 As shown in , a communication environment 100 may involve multiple devices 101 , 102 , 103 , and 104 , multiple radio access networks (RANs) 110 and 120 , multiple core networks (CNs) 130 and 140 , and a data network 150 .

[0064] In this example, devices 101, 102, 103, and 104 are illustrated as mobile phones. It should be noted that any of devices 101, 102, 103, and 104 may be any other suitable type of terminal device or network device. In addition, it should be understood that the number of devices is only for illustrative purposes and does not represent any limitation. Communication environment 100 may include any suitable number or type of devices adapted to implement embodiments of the present disclosure.

[0065] like Figure 1 As shown in FIG. 1 , CN 130 may include a plurality of CN elements, for example, PCF 131, AMF 132, SMF 133, UPF 134, AUSF 135, PKMF 136, DDNMF 137, and UDM 138. CN 140 may include a plurality of CN elements, for example, PCF 141, AMF 142, SMF 143, UPF 144, AUSF 145, PKMF 146, DDNMF 147, and UDM 148, as shown in FIG. Figure 1It should be understood that the CN elements in CN 130 and 140 are for illustration purposes only and do not represent any limitation. Communication environment 100 may include more or fewer CN elements adapted to implement the embodiments of the present disclosure.

[0066] The data network 150 may be the Internet or any other suitable data network. The data network 150 may include a ProSe application server 151. The RANs 110 and 120 may include any suitable network equipment (not shown) and may adopt any suitable RAN technology. It should be understood that the communication environment 100 may include any suitable number or type of RANs, CNs, and data networks adapted to implement the embodiments of the present disclosure.

[0067] In some embodiments, devices 101 and 102 may communicate with data network 150 via RAN 110 and CN 130. Devices 103 and 104 may communicate with data network 150 via RAN 120 and CN 140.

[0068] The communication in the communication environment 100 can be implemented according to any appropriate (multiple) communication protocols, including but not limited to cellular communication protocols such as the first generation (1G), the second generation (2G), the third generation (3G), the fourth generation (4G), the fifth generation (5G) or the future sixth generation (6G), wireless local area network communication protocols such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11, and / or any other protocol currently known or to be developed in the future. In addition, the communication can utilize any appropriate wireless communication technology, including but not limited to: code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplex (FDD), time division duplex (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiplexing (OFDM), discrete Fourier transform spread OFDM (DFT-s-OFDM) and / or any other technology currently known or to be developed in the future.

[0069] In some embodiments for U2N relay communication, device 101 may communicate with RAN 110 via another device in the same RAN, such as device 102. In this case, device 101 may communicate with data network 150 via device 102, RAN 110, and CN 130. In these embodiments, device 101 may act as a remote UE and device 102 may act as a relay UE.

[0070] In some embodiments for U2N relay communication, device 101 may communicate with another RAN (e.g., RAN 120) via another device in another RAN (e.g., device 103). In this case, device 101 may communicate with data network 150 via device 103, RAN 120, and CN 140. In these embodiments, device 101 may act as a remote UE, and device 103 may act as a relay UE.

[0071] The remote UE and the relay UE may communicate with each other via a sidelink interface (e.g., a PC5 link). For example, the remote UE and the relay UE may communicate with each other via a sidelink data channel such as a physical sidelink shared channel (PSSCH), a sidelink control channel such as a physical sidelink control channel (PSCCH) or a physical sidelink feedback channel (PSFCH), or any other existing or future sidelink channel.

[0072] Figure 2 A diagram illustrating a process 200 of ProSe communication via U2N relay in which embodiments of the present disclosure may be implemented is illustrated. It should be understood that the order of the steps in the process is for illustration only and is not intended to be limiting.

[0073] like Figure 2 As shown in , at step 210, service authorization and provisioning are performed for the U2N relay. At step 211, service authorization and provisioning are performed for the remote UE. At step 220, the U2N relay may establish a protocol data unit (PDU) session for the relay.

[0074] At step 230, the remote UE performs a discovery process to discover the U2N relay. As part of the discovery process, the remote UE learns about the connection services provided by the U2N relay.

[0075] At step 240, the remote UE selects a U2N relay based on the connection services that the U2N relay can provide and establishes a connection for unicast mode communication. The selected U2N relay may establish a new PDU session.

[0076] At step 250, in the layer 2 link modification process, the selected U2N relay can generate a packet filter for use on the Uu interface based on the received PC5 quality of service (QoS) information and (multiple) QoS rules, and can perform the UE requested PDU session modification to establish a new QoS flow or bind the service to an existing QoS flow. From this point on, uplink and downlink relaying can begin.

[0077] At step 260, the selected U2N relay may send a remote UE report message to the SMF for the PDU session associated with the relay. The remote UE report message may include a remote UE identification (ID) and remote UE information.

[0078] At step 270, the relayed traffic may be performed between the remote UE and the network via the selected U2N relay.

[0079] For ProSe communication via U2N relay, a UP-based security solution is proposed. Figure 3 A diagram illustrating a process 300 of a UP-based security solution in which embodiments of the present disclosure may be implemented is illustrated. It should be understood that the order and implementation of the steps in the process are for illustration only and are not intended to be limiting.

[0080] like Figure 3 As shown in FIG. 3 , at step 301, the remote UE may send a direct communication request (DCR) to the U2N relay, the DCR including a PRUK ID or a subscription concealed identifier (SUCI), a relay service code (RSC) of the relay service, and a K NRP Freshness parameter 1. At step 302, the U2N relay may send a key request message to the PKMF of the U2N relay, the key request message including PRUK ID / SUCI, RSC and K NRP Freshness parameter 1.

[0081] At step 303, upon receiving the key request message, the PKMF of the U2N relay may check whether the U2N relay is authorized to provide relay services to the remote UE based on the ID of the U2N relay associated with the key used to establish the secure PC5 connection. If the authorization information of the U2N relay is not available locally, the PKMF of the U2N relay may request authorization information from the UDM of the U2N relay. If the U2N relay is authorized to provide relay services based on the ProSe subscription data, the PKMF of the U2N relay may send a key request with a PRUK ID or a SUCI to the PKMF of the remote UE.

[0082] Upon receiving the key request message, the PKMF of the remote UE may check whether the remote UE is authorized to use the relay service at step 304. If the authorization information of the remote UE is not available locally, the PKMF of the remote UE may request the authorization information from the UDM of the remote UE.

[0083] At step 305, the PKMF of the remote UE may generate K NRP Freshness parameter 2, and uses PRUK, RSC, K identified by PRUK ID NRP Freshness parameters 1 and KNRP Freshness parameter 2 is used to derive K NRP The PKMF of the remote UE can then send a key response message to the PKMF of the U2N relay, which includes K NRP and K NRP Freshness parameter 2.

[0084] At step 306, the PKMF of the U2N relay may send a key response message to the U2N relay. At step 307, the U2N relay may receive a key response message from the K NRP Export the session key (K NRP-SESS ), and then derives the confidentiality key (NRPEK) and integrity key (NRPIK). The U2N relay can send a direct security mode command message to the remote UE.

[0085] At step 308, if the remote UE receives a message including a Generic Bootstrapping Architecture (GBA) Push Information (GPI), the remote UE derives the PRUK and obtains the PRUK ID from the GPI. The remote UE may obtain the PRUK ID from its PRUK, RSC, K NRP Freshness parameter 1 and the received K NRP Freshness parameter 2 derives K NRP It shall then derive the session key (K NRP-SESS ), and processes the Direct Security Mode Command. Successful verification of the Direct Security Mode Command assures the remote UE that the U2N Relay is authorized to provide relay services.

[0086] At step 309, the remote UE may respond to the U2N relay with a direct security mode complete message. At step 310, the U2N relay may verify the direct security mode complete message. At step 311, the U2N relay may respond to the remote UE with a direct communication accept message after successful verification to complete the PC5 connection establishment process. The remote UE and the U2N relay may then continue with the rest of the process for the relay service over a secure PC5 link.

[0087] For ProSe communication via U2N relay, a CP-based security solution is also proposed. Figure 4 A diagram illustrating a process 400 of a CP-based security solution in which embodiments of the present disclosure may be implemented is illustrated. It should be understood that the order and implementation of the steps in the process are for illustration only and are not intended to be limiting.

[0088] like Figure 4As shown in , after the discovery of the U2N relay, at step 401, the remote UE can send a direct communication request to the 5G ProSe UE to network relay to establish a secure PC5 unicast link. The remote UE can include its security capabilities and PC5 security signaling policy in the DCR message. The message can also include SUCI, relay service code, Nonce_1.

[0089] At step 402, upon receiving the DCR message, the U2N relay may send a relay key request to the AMF of the U2N relay, the request including some of the parameters received in the DCR message. The U2N relay may also include a transaction identifier in the message, which identifies the remote UE for subsequent messages on the U2N relay's NAS message and PC5 message.

[0090] At step 403, the AMF of the U2N relay may verify whether the U2N relay is authorized to provide U2N relay services.

[0091] At step 404, the AMF of the U2N relay may select the AUSF based on the SUCI and forward the parameters received in the relay key request to the AUSF in the Nausf_UEAuthentication_ProseAuthenticate request message. The Nausf_UEAuthentication_ProseAuthenticate request message may contain the SUCI, relay service code, Nonce_1 of the remote UE. The AUSF may initiate a 5G ProSe remote UE specific authentication using the received ProSe specific parameters (i.e., RSC, etc.). The protection of the security policy negotiation and messages may follow a one-to-one security establishment.

[0092] At step 405, the AUSF of the remote UE may retrieve the authentication vector from the UDM of the remote UE via a Nudm_UEAuthentication_GetProseAv request message and trigger the authentication of the 5G ProSe remote UE. The authentication is performed between the AUSF of the remote UE and the remote UE via the AMF of the U2N relay and the U2N relay. Based on the subscription permanent identifier (SUPI), the UDM of the remote UE may select the authentication method.

[0093] At step 410, upon successful authentication, the remote UE may use the newly derived K AUSF_P To generate 5GPRUK and 5GPRUK ID. At step 420, after successful authentication, the remote UE's AUSF can also use the newly derived K AUSF_P to generate 5GPRUK and 5GPRUK ID.

[0094] At step 430, the AUSF of the remote UE may generate a key K NR_ProSe At step 440, the AUSF of the remote UE may send the key K to the U2N relay via the AMF of the U2N relay. NR_ProSe At step 450, the U2N relay may send a direct security mode command message to the remote UE.

[0095] At step 460, the remote UE may generate a key K NR_ProSe At step 470, the remote UE may send a direct security complete message to the U2N relay. At step 480, the U2N relay may respond with a direct communication accept message to the remote UE. The remote UE and the U2N relay may then continue with the remainder of the process for the relay service over the secure PC5 link.

[0096] The embodiments of the present disclosure provide a solution for managing CP-based security processes and UP-based security processes. Figure 5 Describe in more detail.

[0097] Example implementation of management of UP-based security solutions and CP-based security solutions

[0098] Figure 5 FIG. 5 is a flow chart illustrating a communication process 500 according to some embodiments of the present disclosure. For the purpose of discussion, reference will be made to Figure 1 Describe process 500. It should be understood that the order and implementation of the steps in the process are for illustration only and are not intended to be limiting.

[0099] For illustration, assume that device 101 acts as a remote UE and device 103 acts as a relay UE. In addition, process 500 will be described by using PCF 131 as an example of a third device serving device 101 and PCF 141 as an example of a fourth device serving device 103.

[0100] In some embodiments, the third device may be a core network element. For example, the third device may be a PCF of a remote UE. In another example, the third device may be a PKMF of a remote UE. It should be understood that any other suitable core network element is also feasible. In some alternative embodiments, the third device may be a ProSe application server.

[0101] In some embodiments, the fourth device may be a core network element. For example, the fourth device may be a PCF of a relay UE. In another example, the fourth device may be a PKMF of a relay UE. It should be understood that any other suitable core network element is also feasible. In some alternative embodiments, the fourth device may be a ProSe application server.

[0102] like Figure 5 As shown in , at step 510, a third device (e.g., PCF 131) serving device 101 sends a configuration (also referred to herein as a first configuration for convenience) to device 101, the configuration including: a set of indicators of a CP-based security procedure or a UP-based security procedure for a relay service set.

[0103] In some embodiments, PCF 131 may obtain the configuration from another core network element. In some embodiments, the other core network element may be a UDM. In some embodiments, the other core network element may be a UDR. It should be understood that the other core network element may be any other suitable core network element, and the present application is not limited in this respect.

[0104] In some embodiments, the configuration may include an indicator of a CP-based security procedure or a UP-based security procedure for each relay service. For example, PCF 131 may add an indicator in the security-related content for 5G ProSe U2N relay discovery for each ProSe RSC based on the security policy of the relay service associated with the RSC.

[0105] For example, the indicator may include a first indicator indicating a CP-based security process (also referred to herein as a CP-based security indicator), and a second indicator indicating a UP-based security process (also referred to herein as a UP-based security indicator). In another example, the indicator may include only a first indicator indicating a CP-based security process. The absence of the first indicator may be used to indicate a UP-based security process. In yet another example, the indicator may include only a second indicator indicating a UP-based security process. The absence of the second indicator may be used to indicate a CP-based security process. In yet another example, the indicator may include a single indicator indicating both a CP-based security process and a UP-based security process. For example, the first value of the single indicator indicates a CP-based security process, and the second value of the single indicator indicates a UP-based security process. For example, the first value is 0 and the second value is 1. As another example, the first value is 1 and the second value is 0. It should be understood that the indicator may be implemented in any suitable manner, and the present disclosure is not limited in this regard.

[0106] In some embodiments, the first configuration may also include an indication indicating whether at least one of a CP-based security process and a UP-based security process is authorized for use with the device 101. For example, the PCF 131 may supply the indication to the device 101 based on the security capabilities of the device 101 and the security / authorization policy in the subscription data. In some embodiments for the security capabilities of the device 101, the device 101 may be pre-configured with both a CP-based security support capability and a UP-based security support capability. In some embodiments, the device 101 may be pre-configured with one of a CP-based security support capability and a UP-based security support capability. In some embodiments, the device 101 may be pre-configured to not have any of a CP-based security support capability and a UP-based security support capability.

[0107] It should be understood that the indication can be implemented by any suitable configuration parameter, and the present disclosure is not limited in this respect. It should also be understood that the first configuration can also include any other suitable information that is currently available or to be developed. Through step 510, authorization and provisioning for the remote UE are completed.

[0108] At step 520, a fourth device (e.g., PCF 141) serving the device 103 sends a configuration (also referred to herein as a second configuration for convenience) to the device 103, the configuration including: a set of indicators of a CP-based security procedure or a UP-based security procedure for a relay service set. For example, the PCF 141 may add an indicator to the security-related content for 5G ProSe U2N relay discovery for each ProSe RSC based on the security policy of the relay service associated with the RSC.

[0109] For example, the indicator may include: a first indicator indicating a CP-based security process (also referred to herein as a CP-based security indicator), and a second indicator indicating a UP-based security process (also referred to herein as a UP-based security indicator). In another example, the indicator may include only the first indicator indicating a CP-based security process. The absence of the first indicator may be used to indicate a UP-based security process. In yet another example, the indicator may include only the second indicator indicating a UP-based security process. The absence of the second indicator may be used to indicate a CP-based security process. In yet another example, the indicator may include a single indicator indicating both a CP-based security process and a UP-based security process. For example, the first value of the single indicator indicates a CP-based security process, and the second value of the single indicator indicates a UP-based security process. For example, the first value is 0 and the second value is 1. As another example, the first value is 1 and the second value is 0. It should be understood that the indicator may be implemented in any suitable manner, and the present disclosure is not limited in this regard.

[0110] In some embodiments, the second configuration may also include an indication indicating whether at least one of a CP-based security process and a UP-based security process is authorized for use with the device 103. For example, the PCF 141 may supply the indication to the device 103 based on the security capabilities of the device 103 and the security / authorization policy in the subscription data. In some embodiments for the security capabilities of the device 103, the device 103 may be pre-configured with both a CP-based security support capability and a UP-based security support capability. In some embodiments, the device 103 may be pre-configured with one of a CP-based security support capability and a UP-based security support capability. In some embodiments, the device 103 may be pre-configured to not have any of a CP-based security support capability and a UP-based security support capability.

[0111] It should be understood that the indication can be implemented by any suitable configuration parameter, and the present disclosure is not limited in this respect. It should also be understood that the second configuration can also include any other suitable information that is currently available or to be developed. Through step 520, the authorization and provisioning for the relay UE are completed.

[0112] At step 530, device 101 performs a discovery process for a relay service based on the first configuration. In some embodiments, device 101 may determine a relay device based at least on the indicator set and the authorized indication included in the first configuration to relay communications between device 101 and the network for relay services. It should be understood that this is merely an example, and any other suitable manner is also feasible. The present disclosure is not limited in this respect.

[0113] For example, RSC can be used in the discovery process to indicate the connection service provided by the relay UE to the device 101 (i.e., the remote UE). The RSC list can be configured on the relay UE and the device 101. Based on the security-related content associated with the RSC, the relay UE and the device 101 know whether the RSC supports CP-based security or UP-based security. The device 101 can monitor the notification or discovery response message with the RSC corresponding to the desired relay service. Then, the device 101 can select a relay UE based on the received information to relay the communication between the device 101 and the network (e.g., RAN 120, CN 140, or data network 150) for the relay service. For example, the device 103 is selected as the relay UE.

[0114] In some embodiments, a CP-based security indicator or a UP-based security indicator may be added as an additional parameter used in a relay discovery additional information message (for model A) for the U2N relay to announce during the discovery process. Then, after monitoring the announcement message, the device 101 (i.e., the remote UE) may select a U2N relay based on the RSC and the CP-based security indicator or the UP-based security indicator.

[0115] Then, the device 101 performs one of a CP-based security process and a UP-based security process based on the indicator for the relay service in the indicator set. In some embodiments, the device 101 may determine a CP-based security process or a UP-based security process based on the indicator. In other words, the device 101 may determine one of the CP-based security process and the UP-based security process, which corresponds to the RSC of the relay service. Then, the device 101 may trigger the determined security process for communication via the relay service of the device 103.

[0116] In some embodiments, the security-related content of the relay service associated with the RSC discovered during the discovery process may include a CP-based security indicator. In these embodiments, as shown in step 540, the device 101 may perform a CP-based security process based on the CP-based security indicator. For example, as shown in step 541, the device 101 (i.e., the remote UE) may decide to use a CP-based security solution. At step 542, the device 101 may trigger the export of the key (5GPRUK). At step 543, the device 101 may send a direct communication request (DCR) to the device 103 (i.e., the U2N relay with RSC discovered and selected). The DCR may include the RSC and 5GPRUK ID / SUCI of the relay service.

[0117] Upon receiving the DCR, at step 550, the device 103 may perform one of a CP-based security process or a UP-based security process based on the indicator included in the second configuration. In other words, the device 103 may determine one of the CP-based security process and the UP-based security process, which corresponds to the RSC of the relay service. Then, the device 103 may trigger the determined security process for communication via the relay service of the device 103.

[0118] For example, at step 551, the device 103 may decide to use a CP-based security procedure. At step 552, based on a CP-based security indicator in the security-related content of the relay service associated with the RSC, the device 103 may trigger the CP-based security procedure to the AUSF 135 of the device 101 via the AMF 142 of the device 103. For example, upon receiving the DCR, based on the CP-based security indicator of the RSC, the device 103 may send a relay key request to the AMF of the device 103. The AMF shall support Single Network Slice Selection Assistance Information (S-SNSSAI) associated with the RSC to support CP-based security. Other details of the CP-based security procedure may be combined with Figure 4 The description is similar and therefore omitted here for the sake of brevity. It should be understood that the CP-based security process may also be implemented in any other suitable manner, and the present disclosure is not limited in this respect.

[0119] In some alternative embodiments, the security-related content of the relay service associated with the RSC discovered during the discovery process may include a UP-based security indicator. In these embodiments, as shown in step 560, the device 101 may perform a UP-based security process based on the indicator. For example, at step 561, the device 101 (i.e., the remote UE) may decide to use a UP-based security solution. At step 562, the device 101 may send a DCR to the device 103 (i.e., the discovered and selected U2N relay with RSC). The DCR may include the PRUK ID / SUCI, the RSC of the relay service, and the K NRP Freshness parameter 1.

[0120] Upon receiving the DCR, at step 570, device 103 may perform a UP-based security procedure based on the indicator included in the second configuration. For example, at step 571, device 103 may decide to use a UP-based security procedure. At step 572, device 103 may trigger a UP-based security procedure to PKMF 146 of device 103. Other details of the UP-based security procedure may be combined with Figure 3 The description is similar and therefore omitted here for the sake of brevity. It should be understood that the UP-based security process can also be implemented in any other suitable manner, and the present disclosure is not limited in this regard.

[0121] Through process 500, the remote UE can select the correct relay UE to support the same security solution during discovery, and the remote UE and the relay UE can correctly trigger the security solution workflow. Therefore, ProSe U2N relay communication can be implemented in a more reliable and efficient manner.

[0122] According to an embodiment of the present disclosure, security requirements may be added to indicate the following:

[0123] -Configuration parameters indicating whether CP-based security and / or UP-based security are supported by 5G ProSe UE to network relay shall be supplied by the PCF.

[0124] -Configuration parameters indicating whether CP-based security and / or UP-based security is supported by the 5G ProSe remote UE shall be supplied by the PCF.

[0125] - The CP-based security indicator or UP-based security indicator in the security-related content shall be configured by the PCF for each 5G ProSe UE to network relay service based on the security policy of the specific relay service.

[0126] -5G ProSe remote UE shall be able to discover 5G ProSe relay to support CP-based security.

[0127] -5G ProSe remote UE shall be able to discover 5G ProSe relay to support UP-based security.

[0128] -5G ProSe remote UE and relay shall decide on control plane based security or user plane based security for 5G ProSe layer 3 UE to network relay depending on the security related content of the specific relay service.

[0129] -The logic of PCF, 5G ProSe Remote UE and 5G ProSe UE to Network Relay should be enhanced to support this feature.

[0130] - Due to the extension of RSC, AMF and AUSF may be implicitly affected.

[0131] - In addition, for 5G ProSe communication cases, for AF-based service parameter provisioning, UDR may be implicitly affected due to the extension of RSC, and UDM may be implicitly affected due to the extension of subscription data. The ProSe application server also needs to be enhanced.

[0132] Regarding policy or parameter provisioning for 5G ProSe U2N relay, the following may be specified:

[0133] - For ProSe L3 U2N relay / remote UE provisioning, add authorized CP-based security parameters and / or UP-based security parameters.

[0134] -Add CP-based security indicator or UP-based security indicator to the security-related content of the relay service.

[0135] Example implementation of method

[0136] Corresponding to the above process, the exemplary embodiments of the present disclosure also provide a communication method. Figure 6 A flowchart of an example method 600 implemented at a first device as a remote UE according to some embodiments of the present disclosure is illustrated. For discussion purposes, reference will be made to Figure 1 Method 600 is described. It is assumed that device 101 is a remote UE and device 103 is a relay UE.

[0137] At box 610, a first device (e.g., device 101) receives a first configuration from a third device (e.g., PCF 131 serving device 101), the first configuration including at least: a set of indicators of CP-based security procedures or UP-based security procedures for a relay service set.

[0138] In some embodiments, the first configuration may further include: an indication of whether at least one of a CP-based security procedure and a UP-based security procedure is authorized for use in the device 101 .

[0139] In some embodiments, the third device may be a core network element. In some embodiments, the third device may be a PCF for the device 101. In some embodiments, the third device may be a PKMF for the device 101. In some embodiments, the third device may be a ProSe application server.

[0140] At block 620, device 101 performs a discovery process based on the first configuration to determine a second device (i.e., a relay UE) for relaying communications between device 101 and the network for the relay service. In some embodiments, device 101 may determine the relay UE (e.g., device 103) based at least on the indicator set and the indication. For example, in addition to the indicator set and the indication, device 101 may also perform a discovery process using other capabilities of the remote UE and attributes of the target relay service identified by the RSC. The present disclosure is not limited in this respect.

[0141] At block 630 , the device 101 performs one of a CP-based security procedure and a UP-based security procedure based on the indicator for the relay service in the indicator set for communication between the device 101 and the device 103 for the relay service.

[0142] In some embodiments, the device 101 may determine one of a control plane-based security procedure and a user plane-based security procedure based on the indicator, and trigger one of the control plane-based security procedure and the user plane-based security procedure.

[0143] Through the method 600, an indicator of a CP-based security procedure or a UP-based security procedure for a relay service may be configured to a remote UE. Based on the indicator, the remote UE may correctly trigger a security procedure for U2N relay communication.

[0144] Figure 7 FIG. 7 is a flowchart of a method 700 implemented at a second device as a relay UE according to some embodiments of the present disclosure. For discussion purposes, reference will be made to Figure 1 Method 700 is described. It is assumed that device 101 is a remote UE and device 103 is a relay UE.

[0145] At box 710, the second device (e.g., device 103) receives a second configuration from a fourth device (e.g., PCF 141 serving device 103), the second configuration including at least: an indicator set of CP-based security procedures or UP-based security procedures for the relay service set.

[0146] In some embodiments, the second configuration may further include: an indication of whether at least one of the CP-based security procedure and the UP-based security procedure is authorized for the device 103 .

[0147] In some embodiments, the fourth device may be a core network element. In some embodiments, the fourth device may be a PCF for the device 103. In some embodiments, the fourth device may be a PKMF for the device 103. In some embodiments, the fourth device may be a ProSe application server.

[0148] At block 720 , device 103 determines whether a communication request for the relay service is received from a first device (eg, device 101 ). If a communication request is received, process 700 continues to block 730 .

[0149] At block 730 , the device 103 performs one of a CP-based security procedure and a UP-based security procedure based on the indicator for the relay service in the indicator set for communication between the device 101 and the device 103 for the relay service.

[0150] In some embodiments, the device 103 may determine one of a control plane-based security procedure and a user plane-based security procedure based on the indicator, and trigger one of the control plane-based security procedure and the user plane-based security procedure.

[0151] Through the method 700, an indicator of a CP-based security procedure or a UP-based security procedure for a relay service may be configured to the relay UE. Based on the indicator, the relay UE may correctly trigger a security procedure for U2N relay communication.

[0152] Figure 8 A flow chart of an example method 800 implemented at a core network element according to some embodiments of the present disclosure is illustrated. For discussion purposes, reference will be made to Figure 1 Method 800 is described. It is assumed that device 101 is a remote UE and device 103 is a relay UE. Method 800 may be implemented at a core network element serving device 101 or a core network element serving device 103.

[0153] At block 810, a core network element obtains a configuration from another core network element, the configuration including at least a set of indicators of a CP-based security procedure or a UP-based security procedure for a relay service set.

[0154] In some embodiments, the additional core network element may be a UDM. In some embodiments, the additional core network element may be a UDR. It should be understood that the additional core network element may be any other suitable core network element.

[0155] At block 820, the core network element sends the configuration to a device (e.g., device 101 or 103). In some embodiments where the device is a remote UE, the core network element may be a PCF or PKMF for the remote UE. In some embodiments where the device is a relay UE, the core network element may be a PCF or PKMF for the relay UE.

[0156] In some embodiments, the configuration may also include: an indication of whether at least one of a CP-based security process and a UP-based security process is authorized for use with the device.

[0157] Through the method 800, an indicator of a CP-based security procedure or a UP-based security procedure for relay service may be configured to the remote UE and the relay UE. Based on the indicator, the remote UE and the remote UE may correctly trigger the security procedure for U2N relay communication.

[0158] It should be noted that the operations of methods 600 , 700 , and 800 correspond to the operations of process 500 described above, and therefore, for the sake of brevity, further details are not repeated here.

[0159] Example implementations of apparatus and devices

[0160] The exemplary embodiments of the present disclosure also provide corresponding devices. In some embodiments, a device capable of performing method 600 (e.g., a first device as a remote UE) may include a component for performing the corresponding steps of method 600. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit system or a software module.

[0161] In some embodiments, the apparatus includes: a component for receiving a first configuration from a third device at a first device, the first configuration including at least: a set of indicators for a control plane-based security process or a user plane-based security process for a set of relay services; a component for performing a discovery process based on the first configuration to determine a second device for relaying communications between the first device and a network for the relay service; and a component for performing, based on an indicator for the relay service in the indicator set, one of a control plane-based security process and a user plane-based security process for communications between the first device and a second device for the relay service.

[0162] In some embodiments, the first configuration further includes: an indication indicating whether at least one of a control plane-based security procedure and a user plane-based security procedure is authorized for the first device.

[0163] In some embodiments, a component for performing one of a control plane-based security process or a user plane-based security process includes: a component for determining one of the control plane-based security process and the user plane-based security process based on the indicator; and a component for triggering one of the control plane-based security process and the user plane-based security process.

[0164] In some embodiments, the first device is a remote user equipment, the second device is a relay user equipment, and the third device is a core network element, or a proximity-based service application server. In some embodiments, the core network element is a policy control function for the remote user equipment, or a proximity-based service key management function.

[0165] In some embodiments, an apparatus capable of executing method 700 (e.g., a second device as a relay UE) may include a component for executing the corresponding steps of method 700. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit system or a software module.

[0166] In some embodiments, the apparatus includes: a component for receiving a second configuration from a fourth device at a second device, the second configuration including at least: a set of indicators of a control plane-based security process or a user plane-based security process for a set of relay services; and a component for performing, in response to receiving a communication request for a relay service from a first device, one of the control plane-based security process or the user plane-based security process based on the indicator for the relay service in the indicator set, for communication between the first device and the second device for the relay service.

[0167] In some embodiments, the second configuration further includes: an indication indicating whether at least one of a control plane-based security procedure and a user plane-based security procedure is authorized for the second device.

[0168] In some embodiments, a component for performing one of a control plane-based security process or a user plane-based security process includes: a component for determining one of the control plane-based security process and the user plane-based security process based on the indicator; and a component for triggering one of the control plane-based security process and the user plane-based security process.

[0169] In some embodiments, the first device is a remote user equipment, the second device is a relay user equipment, and the fourth device is a core network element, or a proximity-based service application server. In some embodiments, the core network element is a policy control function of the relay user equipment, or a proximity-based service key management function.

[0170] In some embodiments, a device capable of performing method 800 (e.g., a core network element) may include a component for performing the corresponding steps of method 800. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit system or a software module.

[0171] In some embodiments, the apparatus includes: a component for acquiring, at a core network element, a configuration from another core network element, the configuration including at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a set of relay services; and a component for sending the configuration to the device.

[0172] In some embodiments, the configuration further includes: an indication of whether at least one of a control plane-based security procedure and a user plane-based security procedure is authorized for the device.

[0173] In some embodiments, the additional core network element is a unified data management or unified data repository.

[0174] In some embodiments, the device is a remote user equipment and the core network element is a policy control function for the remote user equipment, or a proximity-based service key management function.

[0175] In some embodiments, the device is a relay user equipment and the core network element is a policy control function for the relay user equipment, or a proximity-based service key management function.

[0176] In some embodiments, the component includes: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause execution of the apparatus.

[0177] Fig. 9 is a simplified block diagram of a device 900 suitable for implementing embodiments of the present disclosure. The device 900 may be provided to implement a communication device, such as Figure 1 The devices 101 to 104 shown, a core network element or a ProSe application server 151. As shown, the device 900 includes one or more processors 910, one or more memories 920 coupled to the processor 910, and one or more communication modules 940 coupled to the processor 910.

[0178] The communication module 940 is used for two-way communication. The communication module 940 has at least one antenna to facilitate communication. The communication interface may represent any interface required for communication with other network elements.

[0179] Processor 910 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 900 may have multiple processors, such as application specific integrated circuit chips that are time slaved to a clock synchronized with a main processor.

[0180] The memory 920 may include one or more non-volatile memories, and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 924, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic storage devices and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 922, and other volatile memories that do not persist during power outages.

[0181] The computer program 930 includes computer executable instructions executed by the associated processor 910. The program 930 may be stored in the ROM 920. The processor 910 may perform any suitable actions and processes by loading the program 930 into the RAM 920.

[0182] The embodiments of the present disclosure may be implemented by a program 930, so that the device 900 may execute the reference Figures 1 to 8 The embodiments of the present disclosure may also be implemented by hardware, or by a combination of software and hardware.

[0183] In some embodiments, the program 930 may be tangibly contained in a computer-readable medium, which may be included in the device 900 (such as in the memory 920), or in other storage devices accessible to the device 900. The device 900 may load the program 930 from the computer-readable medium to the RAM 922 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. Fig.10 An example of a computer readable medium 1000 in the form of a CD or DVD is shown. The computer readable medium has a program 930 stored thereon.

[0184] Generally, various embodiments of the present disclosure may be implemented using hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented using hardware, while other aspects may be implemented using firmware or software that may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are illustrated and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that, as non-limiting examples, the boxes, devices, systems, techniques, or methods described herein may be implemented using hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof.

[0185] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer executable instructions, such as instructions included in a program module, which are executed in a device on a target real or virtual processor to perform the above reference Figures 6 to 8 Methods 600, 700 and 800 are described. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or split between program modules as needed. The machine executable instructions of program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in both local and remote storage media.

[0186] The program code for executing the disclosed method can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code is implemented when executed by a processor or controller in a flow chart and / or a block diagram. The program code can be executed completely on a machine, partially on a machine, as an independent software package, partially on a machine and partially on a remote machine, or completely on a remote machine or server.

[0187] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer readable media, etc.

[0188] The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. A more specific example of a computer readable storage medium will include an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0189] In addition, although the operations are described in a specific order, this should not be understood as requiring such operations to be performed in the specific order shown or in order or performing all the operations shown to obtain the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be interpreted as limitations on the scope of the present disclosure, but rather descriptions of features that may be specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0190] Although the disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features or acts described above are disclosed as example forms of implementing the claims.

Claims

1. A first device, comprising: at least one processor; as well as at least one memory including computer program code, The at least one memory and the computer program code are configured to, with the at least one processor, cause the first device to: receiving a first configuration from a third device, the first configuration comprising at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a relay service set; performing a discovery process based on the first configuration to determine a second device for relaying communications between the first device and a network for relaying services; and Based on the indicator for the relay service in the indicator set, one of the control plane-based security procedure and the user plane-based security procedure is performed for the communication between the first device and the second device for the relay service.

2. The first device according to claim 1, wherein the first configuration further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use in the first device.

3. The first device of claim 1 , wherein the first device is caused to perform one of the control plane-based security procedure or the user plane-based security procedure by: determining, based on the indicator, the one of the control plane based security procedure and the user plane based security procedure; and The one of the control plane based security procedure and the user plane based security procedure is triggered. 4 . The first device of claim 1 , wherein the first device is a remote user equipment, the second device is a relay user equipment, and the third device is a core network element or a proximity-based service application server. 5 . The first device according to claim 4 , wherein the core network element is a policy control function or a proximity-based service key management function for the remote user equipment.

6. A second device, comprising: at least one processor; as well as at least one memory including computer program code, The at least one memory and the computer program code are configured to, with the at least one processor, cause the second device to: receiving a second configuration from a fourth device, the second configuration comprising at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a relay service set; as well as In response to receiving a communication request for a relay service from a first device, based on an indicator for the relay service in the indicator set, one of the control plane-based security process or the user plane-based security process is performed for communication between the first device and the second device for the relay service.

7. The second device according to claim 6, wherein the second configuration further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use in the second device.

8. The second device according to claim 6, wherein the second device is caused to perform one of the control plane-based security process or the user plane-based security process, comprising: determining, based on the indicator, the one of the control plane based security procedure and the user plane based security procedure; as well as The one of the control plane based security procedure and the user plane based security procedure is triggered.

9. The second device of claim 6, wherein the first device is a remote user equipment, the second device is a relay user equipment, and the fourth device is a core network element or a proximity-based service application server.

10. The second device according to claim 6, wherein the core network element is a policy control function or a proximity-based service key management function for the relay user equipment.

11. A core network element, comprising: at least one processor; as well as at least one memory including computer program code, The at least one memory and the computer program code are configured to, together with the at least one processor, cause the core network element to: Acquire a configuration from another core network element, the configuration comprising at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a set of relay services; as well as The configuration is sent to the device.

12. The core network element according to claim 11, wherein the configuration further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use with the device.

13. The core network element according to claim 11, wherein the further core network element is a unified data management or unified data repository.

14. The core network element of claim 11, wherein the device is a remote user equipment and the core network element is a policy control function or a proximity-based service key management function for the remote user equipment.

15. The core network element of claim 11, wherein the device is a relay user equipment, and the core network element is a policy control function or a proximity-based service key management function for the relay user equipment.

16. A method of communication, comprising: At the first device, receiving a first configuration from a third device, the first configuration comprising at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a relay service set; performing a discovery process based on the first configuration to determine a second device for relaying communications between the first device and a network for relaying services; and Based on the indicator for the relay service in the indicator set, one of the control plane-based security procedure and the user plane-based security procedure is performed for the communication between the first device and the second device for the relay service.

17. The method of claim 16, wherein the first configuration further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use in the first device.

18. The method of claim 16, wherein performing said one of the control plane based security procedure or the user plane based security procedure comprises: determining, based on the indicator, the one of the control plane based security procedure and the user plane based security procedure; as well as The one of the control plane based security procedure and the user plane based security procedure is triggered.

19. The method of claim 16, wherein the first device is a remote user equipment, the second device is a relay user equipment, and the third device is a core network element or a proximity-based service application server.

20. The method of claim 19, wherein the core network element is a policy control function or a proximity-based service key management function for the remote user equipment.

21. A method of communication, comprising: At the second device, receiving a second configuration from a fourth device, the second configuration comprising at least: a set of indicators of a control plane-based security procedure or a user plane-based security procedure for a relay service set; and In response to receiving a communication request for a relay service from a first device, based on an indicator for the relay service in the indicator set, one of the control plane-based security process or the user plane-based security process is performed for communication between the first device and the second device for the relay service.

22. The method of claim 21, wherein the second configuration further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use in the second device.

23. The method of claim 21, wherein performing said one of the control plane based security procedure or the user plane based security procedure comprises: determining, based on the indicator, the one of the control plane based security procedure and the user plane based security procedure; as well as The one of the control plane based security procedure and the user plane based security procedure is triggered.

24. The method of claim 21, wherein the first device is a remote user equipment, the second device is a relay user equipment, and the fourth device is a core network element or a proximity-based service application server.

25. The method of claim 24, wherein the core network element is a policy control function or a proximity-based service key management function for the relay user equipment.

26. A method of communication, comprising: At a core network element, obtaining a configuration from another core network element, the configuration comprising at least: a set of indicators of a control plane based security procedure or a user plane based security procedure for a set of relay services; and The configuration is sent to the device.

27. The method of claim 26, wherein the configuring further comprises: An indication indicating whether at least one of the control plane-based security procedure and the user plane-based security procedure is authorized for use with the device.

28. The method of claim 26, wherein the additional core network element is a unified data management or unified data repository.

29. The method of claim 26, wherein the device is a remote user equipment and the core network element is a policy control function or a proximity-based service key management function for the remote user equipment.

30. The method of claim 26, wherein the device is a relay user equipment and the core network element is a policy control function or a proximity-based service key management function for the relay user equipment.

31. A communication device, comprising: means for receiving, at the first device, from the third device, a first configuration, the first configuration comprising at least: a set of indicators of a control plane based security procedure or a user plane based security procedure for a relay service set; means for performing a discovery process based on the first configuration to determine a second device for relaying communications between the first device and a network for relaying services; and means for performing, based on an indicator in the set of indicators for the relay service, one of the control plane based security procedure and the user plane based security procedure for the communication between the first device and the second device for the relay service.

32. A communication device, comprising: means for receiving, at the second device, from the fourth device, a second configuration, the second configuration comprising at least: a set of indicators of a control plane based security procedure or a user plane based security procedure for a relay service set; and A component for performing, in response to receiving a communication request for a relay service from a first device, one of the control plane-based security process or the user plane-based security process based on an indicator for the relay service in the indicator set, for communication between the first device and the second device for the relay service.

33. A communication device, comprising: means for acquiring, at a core network element, a configuration from another core network element, the configuration comprising at least: a set of indicators of a control plane based security procedure or a user plane based security procedure for a set of relay services; and Means for sending said configuration to said device.

34. A non-transitory computer readable medium comprising program instructions for causing an apparatus to perform a method according to any one of claims 16 to 20, or any one of claims 21 to 25, or any one of claims 26 to 30.

Images