Physical layer security of user equipment to user equipment relay

Abstract

Aspects of the present disclosure generally relate to wireless communications. In some aspects, a user equipment (UE) may relay sidelink data between a first remote UE and a second remote UE. The UE may facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE. Numerous other aspects are described.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This patent application claims priority to U.S. non-provisional patent application No. 17 / 811,225, entitled “PHYSICAL LAYER SECURITY FOR USER EQUIPMENT TO USER EQUIPMENT RELAYS,” filed on July 7, 2022, which is hereby expressly incorporated herein by reference. Technical Field

[0003] Aspects of the present disclosure relate generally to wireless communications, and to techniques and apparatus for physical layer security for user equipment to user equipment relaying. Background Art

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunication services, such as telephony, video, data, messaging, and broadcasting. Typical wireless communication systems may employ multiple access technologies that can support communication with multiple users by sharing available system resources (e.g., bandwidth, transmit power, etc.). Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, time division synchronous code division multiple access (TD-SCDMA) systems, and long term evolution (LTE). LTE / LTE-Advanced is a set of enhancements to the Universal Mobile Telecommunications System (UMTS) mobile standard promulgated by the Third Generation Partnership Project (3GPP).

[0005] A wireless network may include one or more network nodes that support communications for wireless communication devices, such as user equipment (UE) or multiple UEs. A UE may communicate with a network node via downlink communications and uplink communications. A "downlink" (or "DL") refers to a communication link from a network node to a UE, and an "uplink" (or "UL") refers to a communication link from a UE to a network node. Some wireless networks may support device-to-device communications, such as via a local link (e.g., a side link (SL), a wireless local area network (WLAN) link, and / or a wireless personal area network (WPAN) link, etc.).

[0006] The above-mentioned multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different UEs to communicate at a city, country, region and / or global level. New Radio (NR), which may be referred to as 5G, is a set of enhancements to the LTE mobile standard promulgated by 3GPP. NR is designed to better support mobile broadband Internet access by improving spectrum efficiency, reducing costs, improving services, utilizing new spectrum, and using orthogonal frequency division multiplexing (OFDM) with cyclic prefix (CP) (CP-OFDM) on the downlink, using CP-OFDM and / or single carrier frequency division multiplexing (SC-FDM) (also known as discrete Fourier transform spread OFDM (DFT-s-OFDM)) on the uplink to better integrate with other open standards, as well as supporting beamforming, multiple input multiple output (MIMO) antenna technology and carrier aggregation. As the demand for mobile broadband access continues to increase, further improvements in LTE, NR and other radio access technologies remain useful. Summary of the invention

[0007] Some aspects described herein relate to a user equipment (UE) for wireless communication. The UE may include a memory and one or more processors, the one or more processors coupled to the memory. The one or more processors may be configured to relay sidelink data between a first remote UE and a second remote UE. The one or more processors may be configured to facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

[0008] Some aspects described herein relate to a method of wireless communication performed by a UE. The method may include relaying sidelink data between a first remote UE and a second remote UE. The method may include facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

[0009] Some aspects described herein relate to a non-transitory computer-readable medium storing an instruction set for wireless communication by a UE. The instruction set, when executed by one or more processors of the UE, may cause the UE to relay sidelink data between a first remote UE and a second remote UE. The instruction set, when executed by one or more processors of the UE, may cause the UE to facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

[0010] Some aspects described herein relate to an apparatus for wireless communication. The apparatus may include means for relaying sidelink data between a first remote UE and a second remote UE. The apparatus may include means for facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the apparatus and a second link key associated with a second link between the apparatus and the second remote UE.

[0011] The various aspects generally include methods, apparatus, systems, computer program products, non-transitory computer-readable media, user equipment, base stations, network entities, network nodes, wireless communication devices and / or processing systems as fully described herein with reference to the drawings and description and as illustrated in the drawings and description.

[0012] The features and technical advantages of examples according to the present disclosure have been outlined quite broadly above so that the following specific embodiments may be better understood. Additional features and advantages will be described below. The disclosed concepts and specific examples may be easily used as a basis for modifying or designing other structures for achieving the same purpose of the present disclosure. Such equivalent constructions do not depart from the scope of the appended claims. The characteristics of the concepts disclosed herein, both in terms of their organization and method of operation, and the associated advantages will be better understood by considering the following description in conjunction with the accompanying drawings. Each of the figures in the accompanying drawings is provided for the purpose of illustration and description, and not as a definition of the limitations of the claims.

[0013] Although various aspects are described in the present disclosure by illustrating some examples, it will be understood by those skilled in the art that such aspects can be implemented in many different arrangements and scenarios. The technology described herein can be implemented using different platform types, devices, systems, shapes, sizes and / or packaging arrangements. For example, some aspects can be implemented via integrated chip implementations or other devices based on non-module components (e.g., end-user devices, vehicles, communication equipment, computing equipment, industrial equipment, retail / shopping equipment, medical equipment and / or artificial intelligence devices). Various aspects can be implemented in chip-level components, modular components, non-modular components, non-chip-level components, device-level components and / or system-level components. The equipment incorporating the various aspects and features described may include additional components and features for implementing and practicing the various aspects claimed and described. For example, the transmission and reception of wireless signals may include one or more components for analog and digital purposes (e.g., hardware components, including antennas, radio frequency (RF) chains, power amplifiers, modulators, buffers, processors, interleavers, adders and / or summers). The various aspects described herein are intended to be practiced in various devices, components, systems, distributed arrangements and / or end-user devices of various sizes, shapes and configurations. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to fully understand the above-mentioned features of the present disclosure, a more specific description of the invention briefly summarized above can be obtained by referring to various aspects (some of which are illustrated in the accompanying drawings). However, it should be noted that the accompanying drawings only illustrate certain typical aspects of the present disclosure and are therefore not to be considered as limiting the scope thereof, as the specification may admit other equally effective aspects. The same reference numerals in different drawings may identify the same or similar elements.

[0015] Figure 1 is a diagram illustrating an example of a wireless network according to the present disclosure.

[0016] Figure 2 is a diagram illustrating an example of communication between a network node and a user equipment (UE) in a wireless network according to the present disclosure.

[0017] Figure 3 is a diagram illustrating an example of side link communication according to the present disclosure.

[0018] Figure 4 is a diagram illustrating an example of side link communication and access link communication according to the present disclosure.

[0019] Figure 5 is a diagram illustrating an example of a UE-to-UE relay and an example of a protocol stack for the UE-to-UE relay according to the present disclosure.

[0020] Figures 6 to 9is a diagram illustrating an example associated with physical layer security of UE-to-UE relay according to the present disclosure.

[0021] Fig.10 is a diagram illustrating example procedures associated with physical layer security for UE-to-UE relaying according to the present disclosure.

[0022] Fig.11 is a diagram of an example apparatus for wireless communications according to the present disclosure. DETAILED DESCRIPTION

[0023] The various aspects of the present disclosure are described more fully below with reference to the accompanying drawings. However, the present disclosure can be embodied in many different forms, and should not be construed as being limited to any specific structure or function presented throughout the present disclosure. Instead, these aspects are provided so that the present disclosure will be thorough and complete, and the protection scope of the present disclosure will be fully conveyed to those skilled in the art. It will be appreciated by those skilled in the art that the scope of the present disclosure is intended to cover any aspect of the present disclosure disclosed herein, whether it is implemented independently or in combination with any other aspect of the present disclosure. For example, any number of aspects set forth herein may be used to implement a device or practice method. In addition, the scope of the present disclosure is intended to cover such devices or methods implemented using other structures, functionality, or structures and functionality in addition to or different from the various aspects of the disclosure set forth herein. It should be understood that any aspect of the disclosure disclosed herein may be embodied by one or more elements of the present invention.

[0024] Several aspects of telecommunication systems will now be presented with reference to various devices and techniques. These devices and techniques will be described in the following detailed description and illustrated in the accompanying drawings by various blocks, modules, components, circuits, steps, processes, algorithms, etc. (collectively referred to as "elements"). These elements can be implemented using hardware, software, or a combination thereof. Whether these elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0025] Although various aspects may be described herein using terms generally associated with 5G or new radio (NR) radio access technologies (RATs), various aspects of the present disclosure may be applicable to other RATs, such as 3G RATs, 4G RATs, and / or post-5G RATs (e.g., 6G).

[0026] Figure 11 is a diagram illustrating an example of a wireless network 100 according to the present disclosure. The wireless network 100 may be or may include elements of a 5G (e.g., NR) network and / or a 4G (e.g., Long Term Evolution (LTE)) network, etc. The wireless network 100 may include one or more network nodes 110 (shown as network node 110a, network node 110b, network node 110c, and network node 110d), a user equipment (UE) 120 or multiple UEs 120 (shown as UE 120a, UE 120b, UE 120c, UE 120d, and UE 120e), and / or other entities. The network node 110 is a network node that communicates with the UE 120. As shown in the figure, the network node 110 may include one or more network nodes. For example, the network node 110 may be a converged network node, which means that the converged network node is configured to utilize a radio protocol stack that is physically or logically integrated within a single radio access network (RAN) node (e.g., within a single device or unit). As another example, the network node 110 may be a disaggregated network node (sometimes referred to as a disaggregated base station), meaning that the network node 110 is configured to utilize a protocol stack that is physically or logically distributed between two or more nodes, such as one or more central units (CUs), one or more distributed units (DUs), or one or more radio units (RUs).

[0027] In some examples, the network node 110 is or includes a network node that communicates with the UE 120 via a radio access link, such as an RU. In some examples, the network node 110 is or includes a network node that communicates with other network nodes 110 via a fronthaul link or a midhaul link, such as a DU. In some examples, the network node 110 is or includes a network node that communicates with other network nodes 110 via a midhaul link or communicates with a core network via a backhaul link, such as a CU. In some examples, the network node 110 (such as an aggregated network node 110 or a decomposed network node 110) may include multiple network nodes, such as one or more RUs, one or more CUs, and / or one or more DUs. The network node 110 may include, for example, an NR base station, an LTE base station, a Node B, an eNB (e.g., in 4G), a gNB (e.g., in 5G), an access point, a transmit receive point (TRP), a DU, a RU, a CU, a mobility element of a network, a core network node, a network element, a network equipment, a RAN node, or a combination thereof. In some examples, network nodes 110 may be interconnected to each other or to one or more other network nodes 110 in wireless network 100 via various types of fronthaul, midhaul, and / or backhaul interfaces, such as direct physical connections, air interfaces, or virtual networks, using any suitable transport network.

[0028] In some examples, the network node 110 may provide communication coverage for a particular geographic area. In the Third Generation Partnership Project (3GPP), the term "cell" may refer to the coverage area of ​​the network node 110 and / or the network node subsystem serving the coverage area, depending on the context in which the term is used. The network node 110 may provide communication coverage for a macro cell, a pico cell, a femto cell, and / or another type of cell. A macro cell may cover a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access by a UE 120 with a service subscription. A pico cell may cover a relatively small geographic area and may allow unrestricted access by a UE 120 with a service subscription. A femto cell may cover a relatively small geographic area (e.g., a home) and may allow restricted access by a UE 120 associated with the femto cell (e.g., a UE 120 in a closed subscriber group (CSG)). A network node 110 for a macro cell may be referred to as a macro network node. A network node 110 for a pico cell may be referred to as a pico network node. The network node 110 for a femto cell may be referred to as a femto network node or a home network node. Figure 1 In the example shown in , network node 110a may be a macro network node for macro cell 102a, network node 110b may be a pico network node for pico cell 102b, and network node 110c may be a femto network node for femto cell 102c. A network node may support one or more (e.g., three) cells. In some examples, a cell may not necessarily be stationary, and the geographic area of ​​a cell may move depending on the location of a mobile network node 110 (e.g., a mobile network node).

[0029] In some aspects, the term "base station" or "network node" may refer to an aggregated base station, a decomposed base station, an integrated access and backhaul (IAB) node, a relay node, or one or more components thereof. For example, in some aspects, a "base station" or "network node" may refer to a CU, a DU, a RU, a near real-time (near RT) RAN intelligent controller (RIC), or a non-real-time (non-RT) RIC, or a combination thereof. In some aspects, the term "base station" or "network node" may refer to a device configured to perform one or more functions (such as those described herein in conjunction with the network node 110). In some aspects, the term "base station" or "network node" may refer to a plurality of devices configured to perform one or more functions. For example, in some distributed systems, each of a number of different devices (which may be located in the same geographic location or in different geographic locations) may be configured to perform at least a portion of a function, or to repeat the execution of at least a portion of the function, and the term "base station" or "network node" may refer to any one or more of these different devices. In some aspects, the term "base station" or "network node" may refer to one or more virtual base stations or one or more virtual base station functions. For example, in some aspects, two or more base station functions may be instantiated on a single device. In some aspects, the term "base station" or "network node" may refer to one of the base station functions but not the other. In this way, a single device may include more than one base station.

[0030] The wireless network 100 may include one or more relay stations. A relay station is a network node that can receive transmissions of data from an upstream node (e.g., a network node 110 or a UE 120) and transmit transmissions of data to a downstream node (e.g., a UE 120 or a network node 110). A relay station may be a UE 120 that is capable of relaying transmissions for other UEs 120. Figure 1 In the example shown in , a network node 110d (e.g., a relay network node) may communicate with a network node 110a (e.g., a macro network node) and a UE 120d to facilitate communication between the network node 110a and the UE 120d. A network node 110 that relays communications may be referred to as a relay station, a relay base station, a relay network node, a relay node, a relay, etc.

[0031] The wireless network 100 may be a heterogeneous network that includes different types of network nodes 110, such as macro network nodes, pico network nodes, femto network nodes, relay network nodes, etc. These different types of network nodes 110 may have different transmit power levels, different coverage areas, and / or different impacts on interference in the wireless network 100. For example, a macro network node may have a high transmit power level (e.g., 5 watts to 40 watts), while a pico network node, a femto network node, and a relay network node may have a lower transmit power level (e.g., 0.1 watt to 2 watts).

[0032] The network controller 130 may be coupled to or in communication with a set of network nodes 110 and may provide coordination and control for the network nodes 110. The network controller 130 may communicate with the network nodes 110 via a backhaul communication link or a midhaul communication link. The network nodes 110 may also communicate directly with each other or indirectly via a wireless backhaul communication link or a wired backhaul communication link. In some aspects, the network controller 130 may be or may include a CU or a core network device.

[0033] UE 120 may be dispersed throughout the wireless network 100, and each UE 120 may be fixed or mobile. UE 120 may include, for example, an access terminal, a terminal, a mobile station, and / or a subscriber unit. UE 120 may be a cellular phone (e.g., a smart phone), a personal digital assistant (PDA), a wireless modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a wireless local loop (WLL) station, a tablet computer, a camera, a gaming device, a netbook, a smartbook, an ultrabook, a medical device, a biometric device, a wearable device (e.g., a smart watch, smart clothing, smart glasses, a smart wristband, smart jewelry (e.g., a smart ring or a smart bracelet)), an entertainment device (e.g., a music device, a video device, and / or a satellite radio), a vehicle component or sensor, a smart meter / sensor, an industrial manufacturing equipment, a global positioning system device, a UE function of a network node, and / or any other suitable device configured to communicate via a wireless or wired medium.

[0034] Some UEs 120 may be considered as machine type communication (MTC) or evolved or enhanced machine type communication (eMTC) UEs. MTC UEs and / or eMTC UEs may include, for example, robots, drones, remote devices, sensors, meters, monitors, and / or location tags that may communicate with a network node, another device (e.g., a remote device), or some other entity. Some UEs 120 may be considered as Internet of Things (IoT) devices and / or may be implemented as NB-IoT (narrowband IoT) devices. Some UEs 120 may be considered as customer premises equipment. UE 120 may be included in a housing that houses components of UE 120, such as a processor component and / or a memory component. In some examples, the processor component and the memory component may be coupled together. For example, a processor component (e.g., one or more processors) and a memory component (e.g., a memory) may be operationally coupled, communicatively coupled, electronically coupled, and / or electrically coupled.

[0035] In general, any number of wireless networks 100 may be deployed in a given geographic area. Each wireless network 100 may support a specific RAT and may operate on one or more frequencies. RAT may be referred to as a radio technology, air interface, etc. Frequency may be referred to as a carrier, frequency channel, etc. Each frequency may support a single RAT in a given geographic area to avoid interference between wireless networks of different RATs. In some cases, NR or 5G RAT networks may be deployed.

[0036] In some examples, two or more UEs 120 (e.g., shown as UE 120a and UE 120e) may communicate directly (e.g., without using network node 110 as an intermediary to communicate with each other) using one or more side link channels. For example, UE 120 may communicate using peer-to-peer (P2P) communication, device-to-device (D2D) communication, vehicle-to-everything (V2X) protocols (e.g., which may include vehicle-to-vehicle (V2V) protocols, vehicle-to-infrastructure (V2I) protocols, or vehicle-to-pedestrian (V2P) protocols), and / or mesh networks. In such examples, UE 120 may perform scheduling operations, resource selection operations, and / or other operations described elsewhere herein as being performed by network node 110.

[0037] The devices of the wireless network 100 may communicate using an electromagnetic spectrum, which may be subdivided into various categories, bands, channels, etc., according to frequency or wavelength. For example, the devices of the wireless network 100 may communicate using one or more operating bands. In 5G NR, two initial operating bands have been identified as frequency ranges designated FR1 (410 MHz–7.125 GHz) and FR2 (24.25 GHz–52.6 GHz). It should be understood that, although a portion of FR1 is greater than 6 GHz, FR1 is often (interchangeably) referred to as a “below 6 GHz” band in various documents and articles. A similar naming problem sometimes occurs with respect to FR2, which is often (interchangeably) referred to as a “millimeter wave” band in documents and articles, although different from the extremely high frequency (EHF) band (30 GHz–300 GHz) identified as a “millimeter wave” band by the International Telecommunication Union (ITU).

[0038] Frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR research has identified the operating bands for these mid-band frequencies as frequency range designation FR3 (7.125 GHz–24.25 GHz). The bands falling within FR3 can inherit FR1 characteristics and / or FR2 characteristics, and thus the features of FR1 and / or FR2 can be effectively extended to mid-band frequencies. In addition, higher frequency bands are currently being explored to extend 5G NR operations to more than 52.6 GHz. For example, three higher operating bands have been identified as frequency range designations FR4a or FR4-1 (52.6 GHz–71 GHz), FR4 (52.6 GHz–114.25 GHz), and FR5 (114.25 GHz–300 GHz). Each of these higher frequency bands falls within the EHF band.

[0039] Considering the above examples, unless otherwise explicitly stated, it should be understood that if the term "below 6 GHz" or the like is used herein, the term may broadly refer to frequencies that may be lower than 6 GHz, may be within FR1, or may include mid-band frequencies. In addition, unless otherwise explicitly stated, it should be understood that if the term "millimeter wave" or the like is used herein, the term may broadly refer to frequencies that may include mid-band frequencies, may be within FR2, FR4, FR4-a or FR4-1, and / or FR5, or may be within the EHF band. It is contemplated that the frequencies included in these operating bands (e.g., FR1, FR2, FR3, FR4, FR4-a, FR4-1, and / or FR5) may be modified, and the techniques described herein are applicable to those modified frequency ranges.

[0040] In some aspects, UE 120 may include a communications manager 140. As described in more detail elsewhere herein, the communications manager 140 may relay sidelink data between a first remote UE and a second remote UE; and facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and UE 120 and a second link key associated with a second link between UE 120 and the second remote UE. Additionally or alternatively, the communications manager 140 may perform one or more other operations described herein.

[0041] As indicated above, Figure 1 are provided as examples. Other examples can be found in the Figure 1 Different from what is described.

[0042] Figure 22 is a diagram illustrating an example 200 of a network node 110 communicating with a UE 120 in a wireless network 100 according to the present disclosure. The network node 110 may be equipped with a set of antennas 234a to 234t, such as T antennas (T≥1). The UE 120 may be equipped with a set of antennas 252a to 252r, such as R antennas (R≥1). The network node 110 of example 200 includes one or more radio frequency components, such as an antenna 234 and a modem 254. In some examples, the network node 110 may include an interface, a communication component, or another component that facilitates communication with the UE 120 or another network node. Some network nodes 110 may not include a radio frequency component that facilitates direct communication with the UE 120, such as one or more CUs or one or more DUs.

[0043] At the network node 110, a transmit processor 220 may receive data intended for a UE 120 (or a set of UEs 120) from a data source 212. The transmit processor 220 may select one or more modulation and coding schemes (MCS) for the UE 120 based at least in part on one or more channel quality indicators (CQIs) received from the UE 120. The network node 110 may process (e.g., encode and modulate) the data for the UE 120 based at least in part on the MCS selected for the UE 120, and may provide data symbols for the UE 120. The transmit processor 220 may process system information (e.g., for semi-static resource partitioning information (SRPI)) and control information (e.g., CQI requests, grants, and / or upper layer signaling), and provide overhead symbols and control symbols. The transmit processor 220 may generate reference symbols for reference signals (e.g., cell-specific reference signals (CRS) or demodulation reference signals (DMRS)) and synchronization signals (e.g., primary synchronization signals (PSS) or secondary synchronization signals (SSS)). The transmit (TX) multiple-input multiple-output (MIMO) processor 230 may perform spatial processing (e.g., precoding) on ​​data symbols, control symbols, overhead symbols, and / or reference symbols, where applicable, and may provide a set of output symbol streams (e.g., T output symbol streams) to a corresponding set of modems 232 (e.g., T modulators) (shown as modems 232a to 232t). For example, each output symbol stream may be provided to a modulator component (shown as MOD) of the modem 232. Each modem 232 may process a corresponding output symbol stream (e.g., for OFDM) using a corresponding modulator component to obtain an output sample stream. Each modem 232 may further process (e.g., convert to analog, amplify, filter, and / or upconvert) the output sample stream using a corresponding modulator component to obtain a downlink signal. The modems 232a through 232t may transmit a set of downlink signals (eg, T downlink signals) via a corresponding set of antennas 234 (eg, T antennas) (shown as antennas 234a through 234t).

[0044] At the UE 120, a set of antennas 252 (shown as antennas 252a to 252r) may receive downlink signals from the network node 110 and / or other network nodes 110 and may provide a set of received signals (e.g., R received signals) to a set of modems 254 (e.g., R modems) (shown as modems 254a to 254r). For example, each received signal may be provided to a demodulator component (shown as DEMOD) of the modem 254. Each modem 254 may use a corresponding demodulator component to condition (e.g., filter, amplify, downconvert, and / or digitize) the received signal to obtain input samples. Each modem 254 may use a demodulator component to further process the input samples (e.g., for OFDM) to obtain received symbols. A MIMO detector 256 may obtain received symbols from the modem 254, may perform MIMO detection on the received symbols where applicable, and may provide detected symbols. The receive processor 258 may process (e.g., demodulate and decode) the detected symbols, may provide decoded data for the UE 120 to the data sink 260, and may provide decoded control information and system information to the controller / processor 280. The term "controller / processor" may refer to one or more controllers, one or more processors, or a combination thereof. The channel processor may determine a reference signal received power (RSRP) parameter, a received signal strength indicator (RSSI) parameter, a reference signal received quality (RSRQ) parameter, and / or a CQI parameter, among other things. In some examples, one or more components of the UE 120 may be included in the housing 284.

[0045] The network controller 130 may include a communication unit 294, a controller / processor 290, and a memory 292. The network controller 130 may include, for example, one or more devices in a core network. The network controller 130 may communicate with the network node 110 via the communication unit 294.

[0046] One or more antennas (e.g., antennas 234a to 234t and / or antennas 252a to 252r) may include or be included within one or more antenna panels, one or more antenna groups, one or more sets of antenna elements, and / or one or more antenna arrays, etc. Antenna panels, antenna groups, sets of antenna elements, and / or antenna arrays may include one or more antenna elements (in a single housing or multiple housings), sets of coplanar antenna elements, sets of non-coplanar antenna elements, and / or coupled to one or more transmit and / or receive components (such as, Figure 2 One or more antenna elements of one or more components in.

[0047] On the uplink, at the UE 120, the transmit processor 264 may receive and process data from the data source 262 and control information from the controller / processor 280 (e.g., for reports including RSRP, RSSI, RSRQ, and / or CQI). The transmit processor 264 may generate reference symbols for one or more reference signals. The symbols from the transmit processor 264 may be pre-decoded by the TX MIMO processor 266, where applicable, further processed by the modem 254 (e.g., for DFT-s-OFDM or CP-OFDM), and sent to the network node 110. In some examples, the modem 254 of the UE 120 may include a modulator and a demodulator. In some examples, the UE 120 includes a transceiver. The transceiver may include any combination of an antenna 252, a modem 254, a MIMO detector 256, a receive processor 258, a transmit processor 264, and / or a TX MIMO processor 266. The transceiver may be used by a processor (eg, controller / processor 280) and memory 282 to perform the functions described herein (eg, reference Figures 6 to 11 ) or any aspect of any of the methods described herein.

[0048] At the network node 110, uplink signals from the UE 120 and / or other UEs may be received by the antenna 234, processed by the modem 232 (e.g., a demodulator component (shown as DEMOD) of the modem 232), detected by the MIMO detector 236 (where applicable), and further processed by the receive processor 238 to obtain decoded data and control information transmitted by the UE 120. The receive processor 238 may provide the decoded data to the data sink 239 and the decoded control information to the controller / processor 240. The network node 110 may include a communication unit 244 and may communicate with the network controller 130 via the communication unit 244. The network node 110 may include a scheduler 246 to schedule one or more UEs 120 for downlink communication and / or uplink communication. In some examples, the modem 232 of the network node 110 may include a modulator and a demodulator. In some examples, the network node 110 includes a transceiver. The transceiver may include any combination of antenna 234, modem 232, MIMO detector 236, receive processor 238, transmit processor 220, and / or TX MIMO processor 230. The transceiver may be used by a processor (e.g., controller / processor 240) and memory 242 to perform the operations described herein (e.g., reference 2 Figures 6 to 11 ) or any aspect of any of the methods described herein.

[0049] The controller / processor 240 of the network node 110, the controller / processor 280 of the UE 120, and / or Figure 2 Any other components of the network node 110 may perform one or more techniques associated with physical layer security for UE-to-UE relaying, as described in more detail elsewhere herein. For example, the controller / processor 240 of the network node 110, the controller / processor 280 of the UE 120, and / or Figure 2 Any other component of the Fig.10 1000 and / or operations of other processes as described herein. Memory 242 and memory 282 may store data and program codes for network node 110 and UE 120, respectively. In some examples, memory 242 and / or memory 282 may include a non-transitory computer-readable medium that stores one or more instructions (e.g., code and / or program code) for wireless communication. For example, the one or more instructions, when executed by one or more processors of network node 110 and / or UE 120 (e.g., directly executed, or executed after compilation, conversion, and / or interpretation), may cause one or more processors, UE 120, and / or network node 110 to perform or direct, for example, Fig.10 The process 1000 and / or operations of other processes as described herein. In some examples, executing instructions may include running instructions, converting instructions, compiling instructions, and / or interpreting instructions, etc.

[0050] In some aspects, a UE (e.g., UE 120) includes a component for relaying sidelink data between a first remote UE and a second remote UE; and / or a component for facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE. The components for the UE to perform the operations described herein may include, for example, one or more of the following: a communication manager 140, an antenna 252, a modem 254, a MIMO detector 256, a receive processor 258, a transmit processor 264, a TX MIMO processor 266, a controller / processor 280, or a memory 282.

[0051] Although Figure 2 The blocks in the 200 and 210 are illustrated as distinct components, but the functionality described above for these blocks may be implemented in a single hardware, software, or combined component or in various combinations of components. For example, the functionality described for the transmit processor 264, the receive processor 258, and / or the TX MIMO processor 266 may be performed by or under the control of the controller / processor 280.

[0052] As indicated above, Figure 2 are provided as examples. Other examples can be found in the Figure 2 Different from what is described.

[0053] The deployment of a communication system (such as a 5G NR system) can be arranged in a variety of ways with various components or components. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a RAN node, a core network node, a network element, a base station or network equipment can be implemented in an aggregated or decomposed architecture. For example, a base station (such as a node B (NB), an evolved NB (eNB), an NR BS, a 5G NB, an access point (AP), a TRP or a cell, etc.) or one or more units (or one or more components) performing base station functionality can be implemented as an aggregated base station (also referred to as an independent base station or a monolithic base station) or a decomposed base station. "Network entity" or "network node" may refer to a decomposed base station or one or more units of a decomposed base station (such as one or more CUs, one or more DUs, one or more RUs, or a combination thereof).

[0054] An aggregated base station (e.g., an aggregated network node) may be configured to utilize a radio protocol stack that is physically or logically integrated within a single RAN node (e.g., within a single device or unit). A decomposed base station (e.g., a decomposed network node) may be configured to utilize a protocol stack that is physically or logically distributed between two or more units (such as one or more CUs, one or more DUs, or one or more RUs). In some examples, a CU may be implemented within a network node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed across one or more other network nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may also be implemented as a virtual unit, such as a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU), and the like.

[0055] Base station type operations or network designs may take into account the aggregated nature of base station functionality. For example, a decomposed base station may be utilized in an IAB network, an open radio access network (O-RAN (such as a network configuration initiated by the O-RAN Alliance)), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)) to facilitate the scaling of a communication system by separating base station functionality into one or more units that can be deployed separately. A decomposed base station may include functionality implemented across two or more units at various physical locations, as well as functionality implemented virtually for at least one unit, which may enable flexibility in network design. Individual units of a decomposed base station may be configured for wired or wireless communication with at least one other unit of the decomposed base station.

[0056] Figure 3 is a diagram illustrating an example 300 of sidelink communications according to the present disclosure.

[0057] like Figure 3 As shown in , the first UE 305-1 can communicate with the second UE 305-2 (and one or more other UEs 305) via one or more side link channels 310. UEs 305-1 and 305-2 can communicate using one or more side link channels 310 for P2P communication, D2D communication, V2X communication (e.g., which may include V2V communication, V2I communication and / or V2P communication) and / or mesh networks. In some aspects, UE 305 (e.g., UE 305-1 and / or UE 305-2) may correspond to one or more other UEs described elsewhere herein, such as UE 120. In some aspects, one or more side link channels 310 may use a PC5 interface and / or may operate in a high frequency band (e.g., a 5.9 GHz band). Additionally or alternatively, UE 305 may use global navigation satellite system (GNSS) timing to synchronize the timing of a transmit time interval (TTI) (e.g., a frame, subframe, time slot, or symbol).

[0058] like Figure 3 As further shown, the one or more sidelink channels 310 may include a physical sidelink control channel (PSCCH) 315, a physical sidelink shared channel (PSSCH) 320, and / or a physical sidelink feedback channel (PSFCH) 325. The PSCCH 315 may be used to communicate control information, similar to a physical downlink control channel (PDCCH) and / or a physical uplink control channel (PUCCH) used for cellular communication with the network node 110 via an access link or access channel. The PSSCH 320 may be used to communicate data, similar to a physical downlink shared channel (PDSCH) and / or a physical uplink shared channel (PUSCH) used for cellular communication with the network node 110 via an access link or access channel. For example, the PSCCH 315 may carry sidelink control information (SCI) 330, which may indicate various control information for sidelink communication, such as one or more resources (e.g., time resources, frequency resources, and / or space resources), wherein a transport block (TB) 335 may be carried on the PSSCH 320. TB 335 may include data. PSFCH 325 may be used to communicate sidelink feedback 340, such as hybrid automatic repeat request (HARQ) feedback (eg, acknowledgement or negative acknowledgement (ACK / NACK) information), transmit power control (TPC), and / or scheduling request (SR).

[0059] Although shown on PSCCH 315, in some aspects, SCI 330 may include multiple communications in different levels, such as a first level SCI (SCI-1) and a second level SCI (SCI-2). SCI-1 may be sent on PSCCH 315. SCI-2 may be sent on PSSCH 320. SCI-1 may include, for example, an indication of one or more resources (e.g., time resources, frequency resources, and / or space resources) on PSSCH 320, information for decoding sidelink communications on PSSCH, a quality of service (QoS) priority value, a resource reservation period, a PSSCH DMRS pattern, an SCI format for SCI-2, a beta offset for SCI-2, a number of PSSCH DMRS ports, and / or an MCS. SCI-2 may include information associated with data transmission on PSSCH 320, such as a HARQ process ID, a new data indicator (NDI), a source identifier, a destination identifier, and / or a channel state information (CSI) report trigger.

[0060] In some aspects, one or more sidelink channels 310 may use a resource pool. For example, a scheduling assignment (e.g., included in SCI 330) may be sent in a subchannel across time using specific resource blocks (RBs). In some aspects, data transmissions associated with a scheduling assignment (e.g., on PSSCH 320) may occupy adjacent RBs in the same subframe as the scheduling assignment (e.g., using frequency division multiplexing). In some aspects, the scheduling assignment and the associated data transmission are not sent on adjacent RBs.

[0061] In some aspects, UE 305 may operate using a sidelink resource allocation mode (e.g., Mode 1) where resource selection and / or scheduling is performed by network node 110. For example, UE 305 may receive a grant for sidelink channel access and / or scheduling from network node 110 (e.g., in downlink control information (DCI) or in a radio resource control (RRC) message, such as a grant for configuration). In some aspects, UE 305 may operate using a resource allocation mode (e.g., Mode 2) where resource selection and / or scheduling is performed by UE 305 (e.g., instead of network node 110). In some aspects, UE 305 may perform resource selection and / or scheduling by sensing channel availability for transmission. For example, UE 305 may measure RSSI parameters associated with various side link channels (e.g., sidelink-RSSI (S-RSSI) parameters), may measure RSRP parameters associated with various side link channels (e.g., PSSCH-RSRP parameters), and / or may measure RSRQ parameters associated with various side link channels (e.g., PSSCH-RSRQ parameters), and may select a channel for sending side link communications based at least in part on the measurement results.

[0062] Additionally or alternatively, the UE 305 may perform resource selection and / or scheduling using the SCI 330 received in the PSCCH 315, which may indicate occupied resources and / or channel parameters. Additionally or alternatively, the UE 305 may perform resource selection and / or scheduling by determining a channel busy rate (CBR) associated with each sidelink channel, which may be used for rate control (e.g., by indicating a maximum number of resource blocks that the UE 305 may use for a particular set of subframes).

[0063] In a resource allocation mode (e.g., Mode 2) in which resource selection and / or scheduling is performed by the UE 305, the UE 305 may generate a sidelink grant and may send the grant in the SCI 330. The sidelink grant may indicate, for example, one or more parameters (e.g., transmission parameters) to be used for an upcoming sidelink transmission, such as one or more resource blocks (e.g., for TB 335) to be used for an upcoming sidelink transmission on the PSSCH 320, one or more subframes to be used for an upcoming sidelink transmission, and / or an MCS to be used for an upcoming sidelink transmission. In some aspects, the UE 305 may generate a sidelink grant that indicates one or more parameters (such as the periodicity of the sidelink transmission) for semi-persistent scheduling (SPS). Additionally or alternatively, the UE 305 may generate a sidelink grant for event-driven scheduling (such as for an on-demand sidelink message).

[0064] As indicated above, Figure 3 are provided as examples. Other examples can be found in relation to Figure 3 Different from what is described.

[0065] Figure 4 is a diagram illustrating an example 400 of side link communications and access link communications according to the present disclosure.

[0066] like Figure 4 As shown, the transmitter (Tx) / receiver (Rx) UE 405 and the Rx / Tx UE 410 can communicate with each other via a side link, as described above in conjunction with Figure 3 As further shown in the figure, in some sidelink modes, the network node 110 can communicate with the Tx / Rx UE 405 via the first access link. Additionally or alternatively, in some sidelink modes, the network node 110 can communicate with the Rx / Tx UE 410 via the second access link. The Tx / Rx UE 405 and / or the Rx / Tx UE 410 can correspond to one or more UEs described elsewhere in this document, such as Figure 1120. Thus, a direct link between UEs 120 (e.g., via a PC5 interface) may be referred to as a side link, and a direct link between network node 110 and UE 120 (e.g., via a Uu interface) may be referred to as an access link. Side link communications may be sent via a side link, and access link communications may be sent via an access link. Access link communications may be downlink communications (from network node 110 to UE 120) or uplink communications (from UE 120 to network node 110).

[0067] As indicated above, Figure 4 are provided as examples. Other examples can be found in relation to Figure 4 Different from what is described.

[0068] Figure 5 5 is a diagram illustrating an example 500 of a UE-to-UE relay and an example 510 of a protocol stack for UE-to-UE relay according to the present disclosure. In UE-to-UE relay, a relay device may relay communications between two remote UEs. Figure 5 As shown in example 500, the relay UE may relay sidelink communications between a first remote UE and a second remote UE. The first remote UE and the relay UE may establish a connection, and a first link key K 1 A link between the first remote UE and the relay UE may be established. A second remote UE and the relay UE may also establish a connection, and a second link key K 2 The first link key K may be established for a link between a second remote UE and a relay UE. 1 and the second link key K 2 These may be higher layer keys (eg, Packet Data Convergence Protocol (PDCP) layer keys, which provide security at the PDCP layer), which may be established independently using a certificate exchange.

[0069] Figure 5Example 510 shows an example of a protocol stack for a one-hop UE-to-UE layer 2 (L2) relay architecture for relaying communications between a source UE and a destination UE. For example, the source UE may correspond to a first remote UE, the destination UE may correspond to a second remote UE, and the UE-to-UE relay may correspond to a relay UE. As shown in example 510, the protocol stack for the UE-to-UE relay architecture may include an Internet Protocol (IP) layer, a PC5 service data adaptation protocol (SDAP) layer, a PC5 PDCP layer, an adaptation (ADAPT) layer, a PC5 radio link control (RLC) layer, a PC5 medium access control (MAC) layer, and a PC5 physical (PHY) layer in the source UE and the target UE. Communications associated with the IP layer, the SDAP layer, and the PDCP layer may be between corresponding layers in the source UE and the destination UE. Communications associated with the PHY layer, the MAC layer, the RLC layer, and the ADAPT layer may be between corresponding layers in the source UE and the UE-to-UE relay (e.g., via an RLC channel) and between corresponding layers in the UE-to-UE relay and the destination UE (e.g., via an RLC channel).

[0070] In some examples, security may be provided at a higher layer such as the PDCP layer (e.g., per-link security). When the source UE and the destination UE establish a connection and are in L2 relay mode (e.g., after connection establishment), source-to-destination security (e.g., PDCP layer security) may be applied to PC5 communications between the source UE and the destination UE. When an end-to-end connection is established, the source-to-relay link and the relay-to-destination link may be independently protected (e.g., using a higher layer security key K 1 and K 2 ). However, during this phase, there is no concept of end-to-end security. In addition, since the relay does not support PDCP (as shown in example 510), per-link (e.g., source-relay and relay-destination) higher layer security may not be used for relay communications before and during the establishment of source-destination end-to-end security.

[0071] Some techniques and apparatus described herein enable a UE (e.g., a relay UE) to facilitate end-to-end PHY layer security for UE-to-UE relaying between a first remote UE and a second remote UE. The UE may relay sidelink data between the first remote UE and the second remote UE, and the UE may facilitate end-to-end PHY layer security for the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and a second link key associated with a second link between the UE and the second remote UE. Thus, end-to-end PHY layer security may protect sidelink communications relayed between the first remote UE and the second remote UE before and during establishment of an end-to-end connection between the first remote UE and the second remote UE. This may enable authentication of sidelink communications relayed by the UE between the first remote UE and the second remote UE, which may improve the security of UE-to-UE relaying.

[0072] As indicated above, Figure 5 are provided as examples. Other examples can be found in relation to Figure 5 Different from what is described.

[0073] Figure 6 is a diagram illustrating an example 600 associated with PHY layer security for UE-to-UE relaying according to the present disclosure. Figure 6 As shown, example 600 includes communications between a first remote UE 601, a second remote UE 602, and a relay UE 603. In some aspects, the first remote UE 601, the second remote UE 602, and the relay UE 603 ​​may correspond to one or more other UEs described elsewhere herein, such as UE 120. In some aspects, the first remote UE 601, the second remote UE 602, and the relay UE 603 ​​may communicate via sidelink communications (e.g., via a PC5 interface). As shown in example 600, in some aspects, the relay UE 603 ​​may use per-hop authentication of the transmitted sidelink communications to facilitate end-to-end PHY layer security of the sidelink data relayed between the first remote UE 601 and the second remote UE 602.

[0074] like Figure 6 As shown, and as indicated by reference numeral 605, the relay UE 603 ​​and the first remote UE 601 may be based at least in part on a first link key K associated with a first link between the first remote UE 601 and the relay UE 603. 1 To establish the first PHY layer key The first link key K 1It may be an established higher layer (e.g., PDCP layer) key for the first link between the first remote UE 601 and the relay UE 603. For example, when a side link connection is established between the first remote UE 601 and the relay UE 603, the first remote UE 601 and the relay UE 603 ​​may establish a higher layer key K 1 (e.g., by exchanging certificates). First PHY layer key It may be based at least in part on the first link key K 1 In some aspects, the first remote UE 601 and the relay UE 603 ​​may each determine a first link key K based at least in part on the first link key K. 1 and time slot number according to (K 1 , time slot number) to derive the first PHY layer key Where KDF is the key derivation function.

[0075] like Figure 6 As shown, and as indicated by reference numeral 610, the relay UE 603 ​​and the second remote UE 602 may be based at least in part on a second link key K associated with a second link between the second remote UE 602 and the relay UE 603. 2 To establish the second PHY layer key The second link key K 2 The higher layer key K may be an established higher layer (e.g., PDCP layer) key for the second link between the second remote UE 602 and the relay UE 603. For example, when a side link connection is established between the second remote UE 602 and the relay UE 603, the second remote UE 602 and the relay UE 603 ​​may establish a higher layer key K. 2 (e.g., by exchanging certificates). Second PHY layer key The second link key K may be based at least in part on 2 In some aspects, the second remote UE 602 and the relay UE 603 ​​may each determine a second link key K based at least in part on the second link key K. 2 and time slot number according to (K 2 , time slot number) to derive the second PHY layer key Where KDF is the key derivation function.

[0076] like Figure 6As shown, and as shown by reference numeral 615, the first remote UE 601 may determine a first message authentication code for authenticating sidelink data to be sent from the first remote UE 601 to the relay UE 603 ​​and relayed from the relay UE 603 ​​to the second remote UE 602. In some aspects, the first message authentication code determined by the first remote UE 601 may be based at least in part on the first link key K 1 For example, the first remote UE 601 may be based at least in part on the first PHY layer key and side link data D according to To determine a first message authentication code for the side link data D (eg, PHY layer data) to be sent Where f can be any standardized one-way mapping function. In this case, the first message authentication code May be a digital signature that can be used to authenticate the source of the side link data.

[0077] like Figure 6 As shown, and as shown by reference numeral 620, the first remote UE 601 may send a message including side link data D and a first message authentication code to the relay UE 603. For example, the first side link communication may be an extended side link message (eg, ), where the first message authentication code Included in the side link data D.

[0078] The relay UE 603 ​​may receive the first side link communication sent by the first remote UE 601. The relay UE 603 ​​may decode the first side link communication, and the relay UE 603 ​​may determine whether to relay the first side link communication to the second remote UE 602 according to a destination identifier (ID) indicated in the first side link communication (e.g., in the SCI).

[0079] like Figure 6 As shown, and as shown by reference numeral 625, the relay UE 603 ​​may be based at least in part on the first message authentication code For example, the relay UE 603 ​​may perform authentication of the first side link communication in conjunction with (e.g., based on the destination ID) determining that the first side link communication is to be relayed to the second remote UE 602. In some aspects, the relay UE 603 ​​may perform authentication of the first side link communication based on the data D received in the first side link communication and the first PHY layer key. To determine the derived first message authentication code The relay UE 603 ​​may pass the derived first message authentication code A first message authentication code included in the communication with the first side link Compare to verify the derived first message authentication code Whether the first message authentication code included in the first side link communication In some aspects, the relay UE 603 ​​may determine whether the first remote UE 601 is the source of the first side link communication. and There is a match to proceed Figure 6 The operations shown in and In case of a mismatch, the relay UE 603 ​​may discard the first sidelink communication and not relay the sidelink data to the second remote UE 602 .

[0080] like Figure 6 As shown, and as shown by reference numeral 630, the relay UE 603 ​​may determine a second message authentication code for the data D received in the first side link communication. For example, the relay UE 603 ​​may discard the first message authentication code And the relay UE 603 ​​may determine a new message authentication code (eg, a second message authentication code) for a second link between the relay UE 603 ​​and the second remote UE 602. ). In some aspects, the second message authentication code The second link key K may be based at least in part on 2 For example, the relay UE 603 ​​may determine based at least in part on the second PHY layer key and side link data D according to To determine the second message authentication code for the side link data D

[0081] like Figure 6 As shown, and as shown by reference numeral 635, the relay UE 603 ​​may send a message including side link data D (eg, side link data received by the relay UE 603 ​​in the first side link communication) and a second message authentication code to the second remote UE 602. For example, the second side link communication may be a side link message (e.g., ), where the second message authentication code Included in the sidelink data D. The second remote UE 602 may receive the second sidelink communication sent by the relay UE 603 ​​.

[0082] like Figure 6 As shown, and as shown by reference numeral 640, the second remote UE 602 may be based at least in part on In some aspects, the second remote UE 602 may authenticate the second side link communication based on the data D received in the second side link communication and the second PHY layer key. To determine the derived second message authentication code The second remote UE 602 can obtain the second message authentication code by A second message authentication code included in the communication with the second side link Compare to verify the derived second message authentication code Whether the second message authentication code included in the second side link communication The second remote UE 602 may determine that the sidelink data has been relayed from the first remote UE 601 based at least in part on the source ID indicated in the control channel (eg, SCI).

[0083] As indicated above, Figure 6 are provided as examples. Other examples can be found in relation to Figure 6 Different from what is described.

[0084] Figure 7 is a diagram illustrating an example 700 associated with PHY layer security for UE-to-UE relaying according to the present disclosure. Figure 7 As shown, example 700 includes communication between a first remote UE 701, a second remote UE 702, and a relay UE 703. In some aspects, the first remote UE 701, the second remote UE 702, and the relay UE 703 may correspond to one or more other UEs described elsewhere herein, such as UE 120. In some aspects, the first remote UE 701, the second remote UE 702, and the relay UE 703 may communicate via sidelink communication (e.g., via a PC5 interface). As shown in example 700, in some aspects, the relay UE 703 may facilitate end-to-end PHY layer security of sidelink data relayed between the first remote UE 701 and the second remote UE 702 by facilitating end-to-end remote key agreement between the first remote UE 701 and the second remote UE 702.

[0085] like Figure 7 As shown, and as indicated by reference numeral 705, the relay UE 703 and the first remote UE 701 may be based at least in part on a first link key K associated with a first link between the first remote UE 701 and the relay UE 703. 1 To establish the first PHY layer key The first link key K 1The key may be an established higher layer (eg, PDCP layer) key for the first link between the first remote UE 701 and the relay UE 703. In some aspects, the first remote UE 701 and the relay UE 703 may each establish a key based on (K 1 , time slot number) to derive the first PHY layer key As above combined Figure 6 described.

[0086] like Figure 7 As shown, and as indicated by reference numeral 710, the relay UE 703 and the second remote UE 702 may be based at least in part on a second link key K associated with a second link between the second remote UE 702 and the relay UE 703. Y To establish the second PHY layer key The second link key K 2 The key may be an established higher layer (eg, PDCP layer) key for a second link between the second remote UE 702 and the relay UE 703. In some aspects, the second remote UE 702 and the relay UE 703 may each establish a key based on (K 2 , time slot number) to derive the second PHY layer key As above combined Figure 6 described.

[0087] like Figure 7 As shown, and as shown by reference numeral 715, the relay UE 703 may send an indication of a combined PHY layer key to the first remote UE 701, the combined PHY layer key combining the first PHY layer key and the second PHY layer key As indicated by reference numeral 720, the relay UE 703 may send an indication of a combined PHY layer key to the second remote UE 702, the combined PHY layer key combining the first PHY layer key and the second PHY layer key In some aspects, the relay UE 703 may use an exclusive OR (XOR) operation (e.g., a bitwise XOR operation) to To combine the first PHY layer key and the second PHY layer key To generate a combined PHY layer key. By sending the combined PHY layer key to the first remote UE 701 and the second remote UE 702 The relay UE 703 may facilitate end-to-end remote key negotiation between the first remote UE 701 and the second remote UE 702. Since the first remote UE 701 has established the first PHY layer key Therefore, the first remote UE 701 can obtain the combined PHY layer key Derive / decode second PHY layer keys Similarly, since the second remote UE 702 has established a second PHY layer key Therefore, the second remote UE 702 can obtain the combined PHY layer key Derive / decode first PHY layer keys Therefore, the first remote UE 701 and the second remote UE 702 may each know and In addition, the combined PHY layer key is sent by the relay UE 703 The security of the first link or the second link will not be compromised because UEs other than the first remote UE 701 and the second remote UE 702 are not yet established. or It may not be possible to decode

[0088] like Figure 7 As further shown, and as indicated by reference numeral 725, the first remote UE 701 may be based at least in part on and To derive the end-to-end key K′ (eg, end-to-end PHY layer key). For example, the first remote UE 701 may derive the end-to-end key K′ (eg, end-to-end PHY layer key) according to To derive the end-to-end key K′, where f is a key derivation function. As shown in reference numeral 730, the second remote UE 702 may derive the end-to-end key K′. For example, the first remote UE 701 may derive the end-to-end key K′ according to In this case, the first remote UE 701 and the second remote UE 702 may be based at least in part on the information provided by the relay UE 703. and The shared knowledge of is used to derive the same key K′ to be used for end-to-end PHY layer security of the sidelink communication between the first remote UE 701 and the second remote UE 702 (via the relay UE 703).

[0089] like Figure 7 As shown, and as shown by reference numeral 735, the first remote UE 701 may determine a message authentication code s for sidelink data to be sent from the first remote UE 701 to the relay UE 703 and relayed from the relay UE 703 to the second remote UE 702. K′ In some aspects, the first remote UE 701 may determine the end-to-end key K′ and the sidelink data D based at least in part on the end-to-end key K′ and the sidelink data D. K′(D) = f(K′, D) to determine the message authentication code s for the sidelink data D (e.g., PHY layer data) to be transmitted K′ (D), where f can be any standardized one-way mapping function.

[0090] like Figure 7 As shown, and as shown by reference numeral 740, the first remote UE 701 may send a message including side link data D and a message authentication code s to the relay UE 703. K′ For example, the first side link communication may be a side link message (eg, d = [D, s K′ (D)]), where the message authentication code s K′ (D) is included in the sidelink data D. The relay UE 703 may receive the sidelink communication transmitted by the first remote UE 701 .

[0091] like Figure 7 As shown, and as shown by reference numeral 745, the relay UE 703 may include the side link data D and the message authentication code s K′ (D) is forwarded to the second remote UE 702. In some aspects, the relay UE 703 may decode only the control information (e.g., SCI) in the sidelink communication to determine whether the destination ID is associated with the remote UE (e.g., the second remote UE 702), and forward the sidelink communication to the remote UE (e.g., the second remote UE 702) if it is determined that the two are associated. In this case, the relay UE 703 may not incur overhead associated with decoding the sidelink data, performing authentication, determining a new message authentication code, and / or re-encoding the sidelink data.

[0092] The second remote UE 702 may receive the sidelink communication forwarded by the relay UE 703. Figure 7 As shown, and as shown by reference numeral 750, the second remote UE 702 may be based at least in part on the message authentication code s K′ (D) to authenticate the sidelink communication. In some aspects, the second remote UE 702 may use the end-to-end key K′ to determine the derived message authentication code based on the data D received in the sidelink communication and the end-to-end key K′. The second remote UE 702 can obtain the derived message authentication code by The message authentication code s included in the sidelink communication K′ Compare to verify the derived message authentication code Whether the message authentication code s included in the first side link communication K′ In some aspects, when the derived message authentication code With the received message authentication code sK′ When matched, the second remote UE 702 may determine that the sidelink communication is valid.

[0093] As indicated above, Figure 7 are provided as examples. Other examples can be found in relation to Figure 7 Different from what is described.

[0094] Figure 8 8 is a diagram illustrating an example 800 associated with PHY layer security for UE-to-UE relaying according to the present disclosure. Figure 8 As shown, example 800 includes communication between a first remote UE 801, a second remote UE 802, and a relay UE 803. In some aspects, the first remote UE 801, the second remote UE 802, and the relay UE 803 may correspond to one or more other UEs described elsewhere herein, such as UE 120. In some aspects, the first remote UE 801, the second remote UE 802, and the relay UE 803 may communicate via sidelink communication (e.g., via a PC5 interface). As shown in example 800, in some aspects, the relay UE 803 may facilitate end-to-end PHY layer security of sidelink data relayed between the first remote UE 801 and the second remote UE 802 by facilitating end-to-end remote key agreement between the first remote UE 801 and the second remote UE 802.

[0095] like Figure 8 As shown, and as indicated by reference numeral 805, the relay UE 803 and the first remote UE 801 may be based at least in part on a first link key K associated with a first link between the first remote UE 801 and the relay UE 803. 1 To establish the first PHY layer key The first link key K 1 The key may be an established higher layer (eg, PDCP layer) key for the first link between the first remote UE 801 and the relay UE 803. In some aspects, the first remote UE 801 and the relay UE 803 may each establish a key based on (K 1 , time slot number) to derive the first PHY layer key As above combined Figure 6 described.

[0096] like Figure 8 As shown, and as indicated by reference numeral 810, the relay UE 803 and the second remote UE 802 may be based at least in part on a second link key K associated with a second link between the second remote UE 802 and the relay UE 803. 2 To establish the second PHY layer key The second link key K 2 The key may be an established higher layer (eg, PDCP layer) key for a second link between the second remote UE 802 and the relay UE 803. In some aspects, the second remote UE 802 and the relay UE 803 may each establish a key based on (K 2 , time slot number) to derive the second PHY layer key As above combined Figure 6 described.

[0097] like Figure 8 As shown, and as shown by reference numeral 815, the relay UE 803 may send an indication of a first combined PHY layer key to the first remote UE 801, the first combined PHY layer key combining the first PHY layer key and an end-to-end key K. In some aspects, the relay UE 803 may determine or select an end-to-end key K (e.g., to be used to provide end-to-end PHY layer security between the first remote UE 801 and the second remote UE 802). For example, the key K may be determined by the relay UE 803 relative to the link key K 1 and K 2 In some aspects, the relay UE 803 may use an XOR operation (eg, a bitwise XOR operation) according to To combine the first PHY layer key and the end-to-end key K to generate a first combined PHY layer key.

[0098] like Figure 8 As shown, and as indicated by reference numeral 820, the relay UE 803 may send an indication of a second combined PHY layer key to the second remote UE 802, the second combined PHY layer key combining the second PHY layer key and the end-to-end key K. In some aspects, the relay UE 803 may use an XOR operation (eg, a bit-by-bit XOR operation) according to To combine the second PHY layer key and the end-to-end key K to generate a second combined PHY layer key. In some aspects, by sending to the first remote UE 801 The combined independent key K is sent to the second remote UE 802 The combined independent key K, the relay UE 803 may enable the first remote UE 801 and the second remote UE 802 to each decode the same independent key K, and may thus facilitate end-to-end remote key agreement between the first remote UE 801 and the second remote UE 802.

[0099] like Figure 8As shown, and as shown by reference numeral 825, the first remote UE 801 may be based at least in part on the first combined PHY layer key To derive the end-to-end key K′. For example, the first remote UE 801 may use the first combined PHY layer key As shown at 830, the second remote UE 802 may determine the end-to-end key K′=K based at least in part on the second combined PHY layer key To derive the end-to-end key K′. For example, the second remote UE 802 may use the second combined PHY layer key In this case, the first remote UE 801 and the second remote UE 802 may derive the same key K′=K to be used for end-to-end PHY layer security of side link communication between the first remote UE 801 and the second remote UE 802 (via the relay UE 803).

[0100] like Figure 8 As shown, and as shown by reference numeral 835, the first remote UE 801 may determine a message authentication code s for sidelink data to be sent from the first remote UE 801 to the relay UE 803 and relayed from the relay UE 803 to the second remote UE 802. K′ In some aspects, the first remote UE 801 may determine the end-to-end key K′ and the sidelink data D based at least in part on the end-to-end key K′ and the sidelink data D. K′ (D) = f(K′, D) to determine the message authentication code s for the sidelink data D (e.g., PHY layer data) to be transmitted K′ (D), where f can be any standardized one-way mapping function.

[0101] like Figure 8 As shown, and as shown by reference numeral 840, the first remote UE 801 may send a message including side link data D and a message authentication code s to the relay UE 803. K′ For example, the first side link communication may be a side link message (eg, d = [D, s K′ (D)]), where the message authentication code s K′ (D) is included in the sidelink data D. The relay UE 803 may receive the sidelink communication transmitted by the first remote UE 801 .

[0102] like Figure 8 As shown, and as shown by reference numeral 845, the relay UE 803 may include the side link data D and the message authentication code s K′(D) is forwarded to the second remote UE 802. In some aspects, the relay UE 803 may decode only the control information (e.g., SCI) in the sidelink communication to determine whether the destination ID is associated with the remote UE (e.g., the second remote UE 802), and forward the sidelink communication to the remote UE (e.g., the second remote UE 802) if it is determined that the two are associated. In this case, the relay UE 803 may not incur overhead associated with decoding the sidelink data, performing authentication, determining a new message authentication code, and / or re-encoding the sidelink data.

[0103] The second remote UE 802 may receive the sidelink communication forwarded by the relay UE 803. Figure 8 As shown, and as shown by reference numeral 850, the second remote UE 802 may be based at least in part on the message authentication code s K′ (D) to authenticate the sidelink communication. In some aspects, the second remote UE 802 may use the end-to-end key K′ to determine the derived message authentication code based on the data D received in the sidelink communication and the end-to-end key K′. The second remote UE 802 can obtain the derived message authentication code by The message authentication code s included in the sidelink communication K′ Compare to verify the derived message authentication code Whether the message authentication code s included in the first side link communication K′ In some aspects, when the derived message authentication code With the received message authentication code s K′ When there is a match, the second remote UE 802 may determine that the sidelink communication is valid.

[0104] As indicated above, Figure 8 are provided as examples. Other examples can be found in relation to Figure 8 Different from what is described.

[0105] Fig. 9 is a diagram illustrating an example 900 associated with PHY layer security for UE-to-UE relaying according to the present disclosure. Fig. 9 As shown, example 900 includes communications between a first remote UE 901, a second remote UE 902, and a relay UE 903. In some aspects, the first remote UE 901, the second remote UE 902, and the relay UE 903 may correspond to one or more other UEs described elsewhere herein, such as UE 120. In some aspects, the first remote UE 901, the second remote UE 902, and the relay UE 903 may communicate via sidelink communications (e.g., through a PC5 interface).

[0106] As shown in example 900, in some aspects, the relay UE 903 may use hybrid digital and analog security authentication to facilitate end-to-end PHY layer security of sidelink data relayed between a first remote UE 901 and a second remote UE 902. For example, a digital signature may be sent based at least in part on a key associated with a first hop (e.g., a first link between the first remote UE 901 and the relay UE 903) and PHY data (D) (e.g., by the first remote UE 901), and the digital signature may be sent by the relay UE 903 in a particular beam direction based at least in part on a key associated with a second hop (e.g., a second link between the relay UE 903 and the second remote UE 902). In this case, when forwarding the PHY data (D) and the digital signature in a certain beam direction, the relay UE 903 may act similarly to a repeater or a reconfigurable smart surface (RIS).

[0107] like Fig. 9 As shown, and as indicated by reference numeral 905, the relay UE 903 may establish a first link key K associated with the first remote UE 901 and the relay UE 903 based at least in part on the first established link key K associated with the first link between the first remote UE 901 and the relay UE 903. 1 and K 2 The relay UE 903 may send a key including K to the first remote UE 901 and the second remote UE 902. 1 and K 2 (or and Based at least in part on receiving the combined key, the first remote UE 901 may determine K 2 (or ), and the second remote UE 902 may determine K 1 (or In this way, both the first remote UE 901 and the second remote UE 902 may have a common key agreement K=[K 1 ,K 2 ].

[0108] like Fig. 9 As shown, and as shown by reference numeral 910, the first remote UE 901 may determine a message authentication code for sidelink data to be sent from the first remote UE 601 to the relay UE 603 ​​and relayed from the relay UE 603 ​​to the second remote UE 602. Message Authentication Code It can be a digital signature. In some aspects, the message authentication code determined by the first remote UE 601 The first link key K may be based at least in part on1 For example, the first remote UE 601 may be based at least in part on K 1 According to To determine a first message authentication code for the side link data D (eg, PHY layer data) to be sent In some aspects, the first remote UE 901 may be based at least on (which is based at least in part on K 1 to export) to determine As above combined Figure 6 described.

[0109] like Fig. 9 As shown, and as shown by reference numeral 915, the first remote UE 901 may send a message including side link data D and a first message authentication code to the relay UE 903. For example, the first side link communication may be a side link message The message authentication code (eg, a digital signature) is included in the sidelink data D. The relay UE 903 may receive the first sidelink communication sent by the first remote UE 901 .

[0110] like Fig. 9 As shown, and as indicated by reference numeral 920, the relay UE 903 may be based at least in part on a second link key K associated with a second link between the relay UE 903 and the second remote UE 902. 2 The side link communication includes the side link data D and the message authentication code For example, the relay UE 903 may determine based at least in part on the second link key K 2 to select a transmit beam for transmitting side link communications including side link data D and a message authentication code In some aspects, the relay UE 903 may only be dependent on the second link key K 2 Forwarding side link communication on a specific transmit beam In some aspects, when sending side link communications, the relay UE 903 may select a second link key K 2 The associated transmit beam is used as a transmit beam for transmitting sidelink communications to the second remote UE 902. For example, based at least in part on K 2 , at different times, the side link communication d may be transmitted by the relay UE 903 only on a specific transmit beam, and at different times, with K 2The associated specific transmit beam may vary between different transmit beams. In this case, the second remote UE 902 may use the corresponding receive beam (e.g., at a specific time with K 2 associated receive beam) to receive side link communications from relay UE 903.

[0111] like Fig. 9 As shown, and as shown by reference numeral 925, the second remote UE 902 may be based at least in part on a message authentication code Due to the common key negotiation between the first remote UE 901 and the second remote UE 902, the second remote UE 902 can know the first link key K 1 In some aspects, the second remote UE 902 may determine the link key K based on the data D received in the sidelink communication and the first link key K. 1 To determine the exported message authentication code The second remote UE 902 can obtain the derived message authentication code by Message authentication code included in sidelink communications Compare to verify the derived message authentication code Whether the message authentication code included in the first side link communication In some aspects, when the derived message authentication code The received message authentication code When matched, the second remote UE 902 may determine that the sidelink communication is valid.

[0112] As indicated above, Fig. 9 are provided as examples. Other examples can be found in relation to Fig. 9 Different from what is described.

[0113] Fig.10 1 is a diagram illustrating an example process 1000 performed, for example, by a UE according to the present disclosure. Example process 1000 is an example in which the UE (e.g., UE 120, relay UE 603, relay UE 703, relay UE 803, and / or relay UE 903) performs operations associated with PHY layer security for UE-to-UE relaying.

[0114] like Fig.10 As shown, in some aspects, process 1000 may include relaying sidelink data between a first remote UE and a second remote UE (block 1010). For example, the UE (e.g., using Fig.11 The communications manager 140, receiving component 1102, and / or sending component 1104 depicted in FIG. 1 may relay sidelink data between a first remote UE and a second remote UE, as described above.

[0115] like Fig.10 As further shown, in some aspects, process 1000 may include facilitating end-to-end physical layer security of sidelink data relayed between a first remote UE and a second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE (block 1020). For example, the UE (e.g., using Fig.11 The communications manager 140 and / or security component 1108 depicted in the drawings may facilitate end-to-end physical layer security of side link data relayed between a first remote UE and a second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE, as described above.

[0116] Process 1000 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0117] In a first aspect, relaying sidelink data between a first remote UE and a second remote UE includes: receiving a first sidelink communication including sidelink data and a first message authentication code from the first remote UE based at least in part on the sidelink data and a first link key; and sending a second sidelink communication including sidelink data and a second message authentication code to the second remote UE based at least in part on the sidelink data and the second link key.

[0118] In a second aspect, facilitating end-to-end physical layer security of sidelink data relayed between a first remote UE and a second remote UE includes: determining a derived first message authentication code based at least in part on the sidelink data and a first link key included in the first sidelink communication; verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication; and determining a second message authentication code based at least in part on the sidelink data and the second link key in combination with verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication.

[0119] In a third aspect, sending a second side link communication including side link data and a second message authentication code includes: combining verification that the first message authentication code derived matches the first message authentication code included in the first side link communication, and sending the second side link communication including the side link data and the second message authentication code to a second remote UE.

[0120] In a fourth aspect, a first message authentication code is based at least in part on side link data and a first physical layer key derived from the first link key, and a second message authentication code is based at least in part on the side link data and a second physical layer key derived from the second link key.

[0121] In a fifth aspect, the first link key is a first higher layer key associated with a first link between a first remote UE and the UE, and the second link key is a second higher layer key associated with a second link between the UE and a second remote UE.

[0122] In a sixth aspect, facilitating end-to-end physical layer security of sidelink data relayed between a first remote UE and a second remote UE includes facilitating end-to-end remote key agreement between the first remote UE and the second remote UE.

[0123] In a seventh aspect, facilitating end-to-end remote key negotiation between a first remote UE and a second remote UE includes: sending an indication of a combined physical layer key to the first remote UE, wherein the combined physical layer key combines a first physical layer key derived from a first link key and a second physical layer key derived from a second link key; and sending an indication of a combined physical layer key to the second remote UE, wherein the combined physical layer key combines a first physical layer key derived from the first link key and a second physical layer key derived from the second link key.

[0124] In an eighth aspect, relaying sidelink data between a first remote UE and a second remote UE includes: receiving sidelink communications including sidelink data and a message authentication code from the first remote UE based at least in part on the sidelink data and an end-to-end key derived from a first physical layer key and a second physical layer key; and forwarding the sidelink communications including the sidelink data and the message authentication code to the second remote UE.

[0125] In a ninth aspect, facilitating end-to-end remote key negotiation between a first remote UE and a second remote UE includes sending an indication of a first combination of physical layer keys to the first remote UE, the first combination of physical layer keys combining an end-to-end key and a first physical layer key derived from a first link key; and sending an indication of a second combination of physical layer keys to the second remote UE, the second combination of physical layer keys combining an end-to-end key and a second physical layer key derived from a second link key.

[0126] In a tenth aspect, relaying sidelink data between a first remote UE and a second remote UE includes: receiving sidelink communications including sidelink data and a message authentication code from the first remote UE based at least in part on the sidelink data and an end-to-end key; and forwarding the sidelink communications including the sidelink data and the message authentication code to the second remote UE.

[0127] In an eleventh aspect, relaying sidelink data between a first remote UE and a second remote UE includes: receiving sidelink communications including sidelink data and a digital signature from the first remote UE based at least in part on the sidelink data and a first link key; and sending sidelink communications including the sidelink data and the digital signature to the second remote UE on a transmit beam based at least in part on the second link key.

[0128] In a twelfth aspect, facilitating end-to-end physical layer security of sidelink data relayed between a first remote UE and a second remote UE further comprises selecting a transmit beam for transmitting sidelink communications including the sidelink data and a digital signature to the second remote UE based at least in part on a second link key.

[0129] In a thirteenth aspect, selecting a transmit beam for transmitting sidelink communications to a second remote UE includes: when transmitting the sidelink communications, selecting a transmit beam associated with a second link key as the transmit beam for transmitting the sidelink communications to the second remote UE.

[0130] although Fig.10 An example block diagram of process 1000 is shown, but in some aspects, process 1000 may include Fig.10 In some embodiments, the process 1000 may include additional blocks, fewer blocks, different blocks, or blocks arranged in a different manner than those depicted in the process 1000. Additionally or alternatively, two or more blocks of the blocks of process 1000 may be executed in parallel.

[0131] Fig.11 1 is a diagram of an example apparatus 1100 for wireless communication according to the present disclosure. Apparatus 1100 may be a UE, or a UE may include apparatus 1100. In some aspects, apparatus 1100 includes a receiving component 1102 and a transmitting component 1104 that may communicate with each other (e.g., via one or more buses and / or one or more other components). As shown, apparatus 1100 may communicate with another apparatus 1106 (such as a UE, a base station, or another wireless communication device) using receiving component 1102 and transmitting component 1104. As further shown, apparatus 1100 may include a communication manager 140. Communication manager 140 may include, among other things, a security component 1108.

[0132] In some aspects, the apparatus 1100 may be configured to perform Figures 6 to 9 Additionally or alternatively, the apparatus 1100 may be configured to perform one or more of the processes described herein (such as Fig.10 In some aspects, the apparatus 1100 and / or Fig.11 One or more of the components shown in the figure may include a combination of Figure 2 One or more components of the UE. Additionally or alternatively, Fig.11 One or more of the components shown in the figure may be combined with Figure 2 Additionally or alternatively, one or more components in the set of components may be implemented at least in part as software stored in a memory. For example, a component (or a portion of a component) may be implemented as instructions or codes that are stored in a non-transitory computer-readable medium and can be executed by a controller or processor to perform the function or operation of the component.

[0133] The receiving component 1102 may receive communications from the device 1106, such as reference signals, control information, data communications, or combinations thereof. The receiving component 1102 may provide the received communications to one or more other components of the device 1100. In some aspects, the receiving component 1102 may perform signal processing (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.) on the received communications and may provide the processed signals to one or more other components of the device 1100. In some aspects, the receiving component 1102 may include combining Figure 2 One or more antennas, modems, demodulators, MIMO detectors, receiving processors, controllers / processors, memories or combinations thereof of the UE.

[0134] The transmitting component 1104 may transmit communications, such as reference signals, control information, data communications, or combinations thereof, to the device 1106. In some aspects, one or more other components of the device 1100 may generate communications and may provide the generated communications to the transmitting component 1104 for transmission to the device 1106. In some aspects, the transmitting component 1104 may perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, or encoding, etc.) on the generated communications and may transmit the processed signals to the device 1106. In some aspects, the transmitting component 1104 may include combining Figure 2 One or more antennas, modems, modulators, transmit MIMO processors, transmit processors, controllers / processors, memories, or combinations thereof of the UE. In some aspects, the transmit component 1104 can be co-located with the receive component 1102 in a transceiver.

[0135] The receiving component 1102 and / or the sending component 1104 can relay the sidelink data between the first remote UE and the second remote UE. The security component 1108 can facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

[0136] Fig.11 The number and arrangement of components shown in the figure are provided as examples. In practice, there may be Fig.11 Additional components, fewer components, different components, or components arranged in a different manner than those shown in FIG. Fig.11 Two or more components shown in may be implemented in a single component, or Fig.11 The single component shown in may be implemented as multiple distributed components. Additionally or alternatively, Fig.11 The assembly of (one or more) components shown in the executable is described as being composed of Fig.11 Another collection of components shown in the figure performs one or more functions.

[0137] The following provides an overview of some aspects of the disclosure:

[0138] Aspect 1: A method of wireless communication performed by a user equipment (UE), the method comprising: relaying side link data between a first remote UE and a second remote UE; and facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

[0139] Aspect 2: A method according to Aspect 1, wherein relaying the sidelink data between the first remote UE and the second remote UE includes: receiving a first sidelink communication including the sidelink data and a first message authentication code from the first remote UE based at least in part on the sidelink data and the first link key; and sending a second sidelink communication including the sidelink data and a second message authentication code to the second remote UE based at least in part on the sidelink data and the second link key.

[0140] Aspect 3: A method according to Aspect 2, wherein facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE includes: determining a derived first message authentication code based at least in part on the side link data and the first link key included in the first side link communication; verifying that the derived first message authentication code matches the first message authentication code included in the first side link communication; and determining the second message authentication code based at least in part on the side link data and the second link key in combination with verifying that the derived first message authentication code matches the first message authentication code included in the first side link communication.

[0141] Aspect 4: A method according to Aspect 3, wherein sending the second side link communication including the side link data and the second message authentication code includes: sending the second side link communication including the side link data and the second message authentication code to the second remote UE in combination with verifying that the derived first message authentication code matches the first message authentication code included in the first side link communication.

[0142] Aspect 5: A method according to any one of Aspects 3 to 4, wherein the first message authentication code is based at least in part on the side link data and a first physical layer key derived from the first link key, and wherein the second message authentication code is based at least in part on the side link data and a second physical layer key derived from the second link key.

[0143] Aspect 6: A method according to Aspect 5, wherein the first link key is a first higher layer key associated with the first link between the first remote UE and the UE, and wherein the second link key is a second higher layer key associated with the second link between the UE and the second remote UE.

[0144] Aspect 7: A method according to Aspect 1, wherein facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE includes: facilitating end-to-end remote key agreement between the first remote UE and the second remote UE.

[0145] Aspect 8: A method according to Aspect 7, wherein facilitating the end-to-end remote key negotiation between the first remote UE and the second remote UE includes: sending an indication of a combined physical layer key to the first remote UE, the combined physical layer key combination being a first physical layer key derived from the first link key and a second physical layer key derived from the second link key; and sending an indication of the combined physical layer key to the second remote UE, the combined physical layer key combination being the first physical layer key derived from the first link key and the second physical layer key derived from the second link key.

[0146] Aspect 9: A method according to Aspect 8, wherein relaying the sidelink data between the first remote UE and the second remote UE includes: receiving a sidelink communication including the sidelink data and a message authentication code from the first remote UE based at least in part on the sidelink data and an end-to-end key derived from the first physical layer key and the second physical layer key; and forwarding the sidelink communication including the sidelink data and the message authentication code to the second remote UE.

[0147] Aspect 10: A method according to Aspect 7, wherein facilitating the end-to-end remote key negotiation between the first remote UE and the second remote UE includes: sending an indication of a first combination of physical layer keys to the first remote UE, the first combination of physical layer keys combining an end-to-end key and a first physical layer key derived from the first link key; and sending an indication of a second combination of physical layer keys to the second remote UE, the second combination of physical layer keys combining the end-to-end key and a second physical layer key derived from the second link key.

[0148] Aspect 11: A method according to Aspect 10, wherein relaying the sidelink data between the first remote UE and the second remote UE includes: receiving a sidelink communication including the sidelink data and a message authentication code from the first remote UE based at least in part on the sidelink data and the end-to-end key; and forwarding the sidelink communication including the sidelink data and the message authentication code to the second remote UE.

[0149] Aspect 12: A method according to Aspect 7, wherein relaying the sidelink data between the first remote UE and the second remote UE includes: receiving a sidelink communication including the sidelink data and the digital signature from the first remote UE based at least in part on the sidelink data and the first link key; and sending the sidelink communication including the sidelink data and the digital signature to the second remote UE on a transmit beam based at least in part on the second link key.

[0150] Aspect 13: A method according to Aspect 12, wherein facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE further includes: selecting the transmit beam for sending the sidelink communication including the sidelink data and the digital signature to the second remote UE based at least in part on the second link key.

[0151] Aspect 14: A method according to Aspect 13, wherein selecting the transmit beam for sending the sidelink communication to the second remote UE includes: when sending the sidelink communication, selecting the transmit beam associated with the second link key as the transmit beam for sending the sidelink communication to the second remote UE.

[0152] Aspect 15: An apparatus for performing wireless communications at a device, the apparatus comprising: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform one or more of the methods described in Aspects 1 to 14.

[0153] Aspect 16: A device for wireless communication, the device comprising: a memory; and one or more processors, the one or more processors coupled to the memory, the one or more processors configured to execute the method according to one or more of aspects 1 to 14.

[0154] Aspect 17: An apparatus for wireless communication, the apparatus comprising at least one means for performing the method according to one or more of aspects 1 to 14.

[0155] Aspect 18: A non-transitory computer-readable medium storing code for wireless communication, the code comprising instructions executable by a processor to perform the method according to one or more of aspects 1 to 14.

[0156] Aspect 19: A non-transitory computer-readable medium storing an instruction set for wireless communication, the instruction set comprising one or more instructions which, when executed by one or more processors of a device, cause the device to perform one or more of the methods described in aspects 1 to 14.

[0157] While the foregoing disclosure provides illustration and description, it is not intended to be exhaustive or to limit the aspects to the precise forms disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practice of these aspects.

[0158] As used herein, the term "component" is intended to be broadly interpreted as a combination of hardware and / or hardware and software. Whether referred to as software, firmware, middleware, microcode, hardware description language or other names, "software" should be broadly interpreted as meaning instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads, processes and / or functions implemented, etc. As used herein, a "processor" is implemented in a combination of hardware and / or hardware and software. It will be clear that the systems and / or methods described herein can be implemented by a combination of hardware and / or hardware and software in different forms. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit various aspects. Therefore, the operation and behavior of the system and / or method are not described herein with reference to specific software codes, because those skilled in the art will understand that software and hardware can be designed to implement the system and / or method based at least in part on the description herein.

[0159] As used herein, "satisfying a threshold" may refer to a value being greater than a threshold, greater than or equal to a threshold, less than a threshold, less than or equal to a threshold, equal to a threshold, not equal to a threshold, etc., depending on the context.

[0160] Although specific combinations of features are set forth in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of various aspects. Many of these features can be combined in a manner that is not specifically described in the claims and / or is not disclosed in the specification. The disclosure of various aspects includes each dependent claim combined with each other claim in the claim set. As used herein, the phrase "at least one of" the list of items refers to any combination of these items (which includes a single member). As an example, "at least one of a, b or c" is intended to cover a, b, c, a+b, a+c, b+c and a+b+c, and any combination with multiple identical elements (e.g., a+a, a+a+a, a+a+b, a+a+c, a+b+b, a+c+c, b+b, b+b+b, b+b+c, c+c and c+c+c, or any other ordering of a, b and c).

[0161] Any element, action or instruction used herein should not be interpreted as key or necessary, unless clearly stated so. In addition, as used herein, the articles "one" and "a kind of" are intended to include one or more items, and can be used interchangeably with "one or more". In addition, as used herein, the article "said" is intended to include one or more items connected with the article "said", and can be used interchangeably with "one or more". In addition, as used herein, the terms "set" and "group" are intended to include one or more items, and can be used interchangeably with "one or more". If only want to refer to a project, then use the phrase "only one" or similar terms. In addition, as used herein, the terms "have", "have", "have" etc. are intended to be open terms, which do not limit the elements they modify (for example, "having" A elements can also have B). In addition, the phrase "based on" is intended to represent "based at least in part", unless otherwise clearly stated. Furthermore, as used herein, the term "or" when used in a series is intended to be open-ended and may be used interchangeably with "and / or" unless expressly stated otherwise (eg, if used in conjunction with "either" or "only one of").

Claims

1. A user equipment (UE) for wireless communication, the user equipment (UE) comprising: Memory; and one or more processors coupled to the memory and configured to: relaying sidelink data between a first remote UE and a second remote UE; as well as Facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

2. The UE of claim 1 , wherein to relay the sidelink data between the first remote UE and the second remote UE, the one or more processors are configured to: receiving, from the first remote UE, a first sidelink communication including the sidelink data and a first message authentication code based at least in part on the sidelink data and the first link key; and A second sidelink communication including the sidelink data and a second message authentication code is sent to the second remote UE based at least in part on the sidelink data and the second link key.

3. The UE of claim 2, wherein to facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE, the one or more processors are configured to: determining a derived first message authentication code based at least in part on the sidelink data included in the first sidelink communication and the first link key; verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication; as well as The second message authentication code is determined based at least in part on the side link data and the second link key in conjunction with verifying that the derived first message authentication code matches the first message authentication code included in the first side link communication.

4. The UE of claim 3, wherein to send the second sidelink communication, the one or more processors are configured to send the sidelink data and the second message authentication code, comprising: In conjunction with verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication, sending the second sidelink communication including the sidelink data and the second message authentication code to the second remote UE.

5. A UE according to claim 3, wherein the first message authentication code is based at least in part on the side link data and a first physical layer key derived from the first link key, and wherein the second message authentication code is based at least in part on the side link data and a second physical layer key derived from the second link key.

6. The UE of claim 5, wherein the first link key is a first higher layer key associated with the first link between the first remote UE and the UE, and wherein the second link key is a second higher layer key associated with the second link between the UE and the second remote UE.

7. The UE of claim 1, wherein to facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE, the one or more processors are configured to: End-to-end remote key agreement is facilitated between the first remote UE and the second remote UE.

8. The UE of claim 7, wherein to facilitate the end-to-end remote key agreement between the first remote UE and the second remote UE, the one or more processors are configured to: sending an indication of a combined physical layer key to the first remote UE, the combined physical layer key combining a first physical layer key derived from the first link key and a second physical layer key derived from the second link key; and An indication of the combined physical layer key is sent to the second remote UE, the combined physical layer key combining the first physical layer key derived from the first link key and the second physical layer key derived from the second link key.

9. The UE of claim 8, wherein to relay the sidelink data between the first remote UE and the second remote UE, the one or more processors are configured to: receiving, from the first remote UE, a sidelink communication including the sidelink data and a message authentication code based at least in part on the sidelink data and an end-to-end key derived from the first physical layer key and the second physical layer key; and The sidelink communication including the sidelink data and the message authentication code is forwarded to the second remote UE.

10. The UE of claim 7, wherein to facilitate the end-to-end remote key agreement between the first remote UE and the second remote UE, the one or more processors are configured to: sending an indication of a first combined physical layer key to the first remote UE, the first combined physical layer key combining an end-to-end key and a first physical layer key derived from the first link key; and An indication of a second combined physical layer key is sent to the second remote UE, the second combined physical layer key combining the end-to-end key and a second physical layer key derived from the second link key.

11. The UE of claim 10, wherein to relay the sidelink data between the first remote UE and the second remote UE, the one or more processors are configured to: receiving, from the first remote UE, a sidelink communication including the sidelink data and a message authentication code based at least in part on the sidelink data and the end-to-end key; and The sidelink communication including the sidelink data and the message authentication code is forwarded to the second remote UE.

12. The UE of claim 7, wherein to relay the sidelink data between the first remote UE and the second remote UE, the one or more processors are configured to: receiving, from the first remote UE, a sidelink communication including the sidelink data and a digital signature based at least in part on the sidelink data and the first link key; and The sidelink communication including the sidelink data and the digital signature is transmitted to the second remote UE on a transmit beam based at least in part on the second link key.

13. The UE of claim 12, wherein to facilitate end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE, the one or more processors are configured to: The transmit beam for transmitting the sidelink communication including the sidelink data and the digital signature to the second remote UE is selected based at least in part on the second link key.

14. The UE of claim 13, wherein to select the transmit beam for transmitting the sidelink communication to the second remote UE, the one or more processors are configured to: When transmitting the sidelink communication, a transmit beam associated with the second link key is selected as the transmit beam for transmitting the sidelink communication to the second remote UE.

15. A method of wireless communication performed by a user equipment (UE), the method comprising: relaying sidelink data between a first remote UE and a second remote UE; as well as Facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

16. The method of claim 15, wherein relaying the sidelink data between the first remote UE and the second remote UE comprises: receiving, from the first remote UE, a first sidelink communication including the sidelink data and a first message authentication code based at least in part on the sidelink data and the first link key; as well as A second sidelink communication including the sidelink data and a second message authentication code is sent to the second remote UE based at least in part on the sidelink data and the second link key.

17. The method of claim 16, wherein facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE comprises: determining a derived first message authentication code based at least in part on the sidelink data included in the first sidelink communication and the first link key; verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication; as well as The second message authentication code is determined based at least in part on the side link data and the second link key in conjunction with verifying that the derived first message authentication code matches the first message authentication code included in the first side link communication.

18. The method of claim 17, wherein sending the second sidelink communication including the sidelink data and the second message authentication code comprises: In conjunction with verifying that the derived first message authentication code matches the first message authentication code included in the first sidelink communication, sending the second sidelink communication including the sidelink data and the second message authentication code to the second remote UE.

19. A method according to claim 17, wherein the first message authentication code is based at least in part on the side link data and a first physical layer key derived from the first link key, and wherein the second message authentication code is based at least in part on the side link data and a second physical layer key derived from the second link key.

20. The method of claim 19, wherein the first link key is a first higher layer key associated with the first link between the first remote UE and the UE, and wherein the second link key is a second higher layer key associated with the second link between the UE and the second remote UE.

21. The method of claim 15, wherein facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE comprises: End-to-end remote key agreement is facilitated between the first remote UE and the second remote UE.

22. The method of claim 21 , wherein facilitating the end-to-end remote key agreement between the first remote UE and the second remote UE comprises: sending an indication of a combined physical layer key to the first remote UE, the combined physical layer key combining a first physical layer key derived from the first link key and a second physical layer key derived from the second link key; as well as An indication of the combined physical layer key is sent to the second remote UE, the combined physical layer key combining the first physical layer key derived from the first link key and the second physical layer key derived from the second link key.

23. The method of claim 22, wherein relaying the sidelink data between the first remote UE and the second remote UE comprises: receiving, from the first remote UE, a sidelink communication including the sidelink data and a message authentication code based at least in part on the sidelink data and an end-to-end key derived from the first physical layer key and the second physical layer key; as well as The sidelink communication including the sidelink data and the message authentication code is forwarded to the second remote UE.

24. The method of claim 21 , wherein facilitating the end-to-end remote key agreement between the first remote UE and the second remote UE comprises: sending an indication of a first combined physical layer key to the first remote UE, the first combined physical layer key combining an end-to-end key and a first physical layer key derived from the first link key; as well as An indication of a second combined physical layer key is sent to the second remote UE, the second combined physical layer key combining the end-to-end key and a second physical layer key derived from the second link key.

25. The method of claim 24, wherein relaying the sidelink data between the first remote UE and the second remote UE comprises: receiving, from the first remote UE, a sidelink communication including the sidelink data and a message authentication code based at least in part on the sidelink data and the end-to-end key; as well as The sidelink communication including the sidelink data and the message authentication code is forwarded to the second remote UE.

26. The method of claim 21, wherein relaying the sidelink data between the first remote UE and the second remote UE comprises: receiving, from the first remote UE, a sidelink communication including the sidelink data and a digital signature based at least in part on the sidelink data and the first link key; as well as The sidelink communication including the sidelink data and the digital signature is transmitted to the second remote UE on a transmit beam based at least in part on the second link key.

27. The method of claim 26, wherein facilitating end-to-end physical layer security of the sidelink data relayed between the first remote UE and the second remote UE further comprises: The transmit beam for transmitting the sidelink communication including the sidelink data and the digital signature to the second remote UE is selected based at least in part on the second link key.

28. The method of claim 27, wherein selecting the transmit beam for transmitting the sidelink communication to the second remote UE comprises: When transmitting the sidelink communication, a transmit beam associated with the second link key is selected as the transmit beam for transmitting the sidelink communication to the second remote UE.

29. A non-transitory computer readable medium storing an instruction set for wireless communication, the instruction set comprising: One or more instructions that, when executed by one or more processors of a user equipment (UE), cause the UE to: relaying sidelink data between a first remote UE and a second remote UE; and Facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the UE and a second link key associated with a second link between the UE and the second remote UE.

30. An apparatus for wireless communication, the apparatus comprising: means for relaying sidelink data between a first remote user equipment (UE) and a second remote UE; and A component for facilitating end-to-end physical layer security of the side link data relayed between the first remote UE and the second remote UE based at least in part on a first link key associated with a first link between the first remote UE and the apparatus and a second link key associated with a second link between the apparatus and the second remote UE.

Images