Information transmission method and device, communication equipment, communication system and storage medium

Abstract

The embodiment of the invention relates to an information transmission method and device, communication equipment, a communication system and a storage medium, user equipment (UE) obtains a PC5 security policy, and the PC5 security policy is used for protecting PC5 communication between relay UE and remote UE.

Description

[0001] This application is a divisional application of the invention patent application with application number 202180003641.0 and invention name "Information transmission method, device, communication equipment and storage medium" submitted to the State Intellectual Property Office on October 29, 2021. Technical Field

[0002] The present application relates to the field of wireless communication technology but is not limited to the field of wireless communication technology, and in particular to information transmission methods, devices, communication equipment, communication systems and storage media. Background Art

[0003] For the fifth generation (5G, 5 th The Proximity Service (ProSe) of the cellular mobile communication of the New Generation includes: ProSe direct communication and ProSe indirect communication. In the ProSe indirect communication scenario, the remote user equipment (UE) communicates with the network through the UE-to-Network (U2N) relay UE. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide an information transmission method, apparatus, communication device and storage medium.

[0005] According to a first aspect of an embodiment of the present disclosure, there is provided an information transmission method, wherein the method is applied to a user equipment UE, and the method includes:

[0006] A PC5 security policy is obtained, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

[0007] In one embodiment, the PC5 security policy includes:

[0008] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0009] and / or,

[0010] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0011] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0012] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0013] In one embodiment, the method further comprises:

[0014] Based on the PC5 security policy, the PC5 communication is established.

[0015] In one embodiment, in response to the UE being a relay UE, the method further includes:

[0016] Based on the UP security policy provided by the network side, the protocol data unit PDU session corresponding to the ProSe relay service is protected.

[0017] In one embodiment, obtaining the PC5 security policy includes:

[0018] Receive PC5 security policy indication information sent by the core network.

[0019] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0020] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0021] According to a second aspect of an embodiment of the present disclosure, there is provided an information transmission method, wherein the method is applied to a core network, and the method includes:

[0022] A PC5 security policy is configured, wherein the PC5 security policy is used to protect PC5 communications between the relay UE and the remote UE.

[0023] In one embodiment, the PC5 security policy includes:

[0024] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0025] and / or,

[0026] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0027] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0028] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0029] In one embodiment, the method further comprises:

[0030] Send the indication information of the PC5 security policy to the UE.

[0031] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0032] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0033] According to a third aspect of an embodiment of the present disclosure, there is provided an information transmission device, which is applied to a user equipment UE, and the device includes:

[0034] The acquisition module is configured to acquire a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

[0035] In one embodiment, the PC5 security policy includes:

[0036] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0037] and / or,

[0038] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0039] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0040] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0041] In one embodiment, the apparatus further comprises:

[0042] An establishing module is configured to establish the PC5 communication based on the PC5 security policy.

[0043] In one embodiment, in response to the UE being a relay UE, the apparatus further includes:

[0044] The protection module is configured to protect the protocol data unit PDU session corresponding to the ProSe relay service based on the UP security policy provided by the network side.

[0045] In one embodiment, the acquisition module is specifically configured as follows:

[0046] Receive PC5 security policy indication information sent by the core network.

[0047] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0048] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0049] According to a fourth aspect of an embodiment of the present disclosure, there is provided an information transmission device, wherein the device is applied to a core network, and the device includes:

[0050] The setting module is configured to configure a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

[0051] In one embodiment, the PC5 security policy includes:

[0052] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0053] and / or,

[0054] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0055] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0056] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0057] In one embodiment, the apparatus further comprises:

[0058] The sending module is configured to send the indication information of the PC5 security policy to the UE.

[0059] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0060] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0061] According to a fifth aspect of an embodiment of the present disclosure, a communication device is provided, comprising a processor, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes the steps of the information transmission method described in the first aspect or the second aspect when running the executable program.

[0062] According to a sixth aspect of an embodiment of the present disclosure, a storage medium is provided, on which an executable program is stored, wherein when the executable program is executed by a processor, the steps of the information transmission method described in the first aspect or the second aspect are implemented.

[0063] According to the information transmission method, apparatus, communication device and storage medium provided by the embodiments of the present disclosure, the UE obtains a PC5 security policy, wherein the PC5 security policy is used to protect the PC5 communication between the relay UE and the remote UE. In this way, through the PC5 security policy, the remote UE and the relay UE protect the PC5 connection security in the ProSe indirect communication based on the security policy, realize the security protection of the PC5 communication in the ProSe relay service, meet the security requirements of the ProSe indirect communication, and improve the communication security.

[0064] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the description, serve to explain the principles of the embodiments of the present invention.

[0066] Figure 1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment;

[0067] Figure 2 is a flowchart of an information transmission method according to an exemplary embodiment;

[0068] Figure 3 is a flowchart of another information transmission method according to an exemplary embodiment;

[0069] Figure 4 is a schematic diagram of information interaction of an information transmission method according to an exemplary embodiment;

[0070] Figure 5is a block diagram of an information transmission device according to an exemplary embodiment;

[0071] Figure 6 is a block diagram of another information transmission device according to an exemplary embodiment;

[0072] Figure 7 It is a block diagram of a device for information transmission according to an exemplary embodiment. DETAILED DESCRIPTION

[0073] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the appended claims.

[0074] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0075] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0076] Please refer to Figure 1 , which shows a schematic diagram of the structure of a wireless communication system provided by an embodiment of the present disclosure. Figure 1 As shown, the wireless communication system is a communication system based on cellular mobile communication technology, and the wireless communication system may include: a plurality of terminals 11 and a plurality of base stations 12 .

[0077] Among them, the terminal 11 can be a device that provides voice and / or data connectivity to the user. The terminal 11 can communicate with one or more core networks via a radio access network (RAN). The terminal 11 can be an Internet of Things terminal, such as a sensor device, a mobile phone (or a "cellular" phone), and a computer with an Internet of Things terminal. For example, it can be a fixed, portable, pocket-sized, handheld, computer-built-in or vehicle-mounted device. For example, a station (STA), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal, an access terminal, a user terminal, a user agent, a user device, or a user equipment (UE). Alternatively, the terminal 11 can also be a device of an unmanned aerial vehicle. Alternatively, the terminal 11 can also be a vehicle-mounted device, for example, it can be a driving computer with wireless communication function, or a wireless communication device connected to an external driving computer. Alternatively, the terminal 11 may also be a roadside device, for example, a street lamp, a signal lamp or other roadside device with a wireless communication function.

[0078] The base station 12 may be a network-side device in a wireless communication system. The wireless communication system may be a fourth generation mobile communication technology (4G) system, also known as a long term evolution (LTE) system; or, the wireless communication system may be a 5G system, also known as a new radio (NR) system or a 5G NR system. Alternatively, the wireless communication system may be the next generation system of the 5G system. The access network in the 5G system may be referred to as NG-RAN (New Generation-Radio Access Network). Alternatively, an MTC system.

[0079] Among them, the base station 12 can be an evolved base station (eNB) adopted in the 4G system. Alternatively, the base station 12 can also be a base station (gNB) adopting a centralized distributed architecture in the 5G system. When the base station 12 adopts a centralized distributed architecture, it usually includes a centralized unit (CU) and at least two distributed units (DU). The centralized unit is provided with a protocol stack of a packet data convergence protocol (PDCP) layer, a radio link layer control protocol (RLC) layer, and a media access control (MAC) layer; the distributed unit is provided with a physical (Physical, PHY) layer protocol stack. The specific implementation method of the base station 12 is not limited in the embodiment of the present disclosure.

[0080] A wireless connection can be established between the base station 12 and the terminal 11 through a wireless air interface. In different implementations, the wireless air interface is a wireless air interface based on the fourth generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth generation mobile communication network technology (5G) standard, for example, the wireless air interface is a new air interface; or, the wireless air interface can also be a wireless air interface based on the next generation mobile communication network technology standard of 5G.

[0081] In some embodiments, E2E (End to End) connections may also be established between the terminals 11, such as V2V (vehicle to vehicle) communication, V2I (vehicle to Infrastructure) communication, and V2P (vehicle to pedestrian) communication in vehicle to everything (V2X) communication.

[0082] In some embodiments, the wireless communication system may further include a network management device 13 .

[0083] Several base stations 12 are respectively connected to a network management device 13. The network management device 13 may be a core network device in a wireless communication system. For example, the network management device 13 may be a mobility management entity (MME) in an evolved packet core (EPC). Alternatively, the network management device may be other core network devices, such as a serving gateway (SGW), a public data network gateway (PGW), a policy and charging rules function (PCRF), or a home subscriber server (HSS). The implementation form of the network management device 13 is not limited in the embodiments of the present disclosure.

[0084] The execution entities involved in the embodiments of the present disclosure include, but are not limited to: UE such as a mobile phone terminal supporting cellular mobile communications, a base station, and a core network.

[0085] In the ProSe indirect communication scenario, PC5 communication based on PC5 connection needs to be established between the remote UE and the U2N relay UE. The PC5 connection security of PC5 communication in ProSe indirect communication is mainly achieved by generating keys. How to configure the activation and deactivation of PC5 connection security to meet the communication security requirements of ProSe indirect communication is an urgent problem to be solved.

[0086] like Figure 2 As shown, this exemplary embodiment provides an information transmission method, which can be applied to a UE in a cellular mobile communication system, including:

[0087] Step 201: Obtain a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between a relay UE and a remote UE.

[0088] The method disclosed in this embodiment may be executed by a UE in cellular mobile communication, and the UE may include: a terminal such as a mobile phone that uses cellular mobile communication technology for wireless communication.

[0089] In ProSe indirect communication, the remote UE and the relay UE perform PC5 communication through an established PC5 connection; the relay UE and the network side of the cellular mobile communication can communicate through the air interface of the cellular mobile communication.

[0090] The PC5 security policy may be used to configure PC5 connection security (PC5 Connection Security) of PC5 communication performed through a PC5 connection in ProSe indirect communication. Here, PC5 connection security may be a security protection method used for the PC5 connection.

[0091] The PC5 security policy may indicate whether to use PC5 connection security to protect PC5 communications.

[0092] Exemplarily, the PC5 security policy may indicate: PC5 connection security must be adopted, PC5 connection security is preferred, PC5 connection security does not need to be used, etc.

[0093] PC5 connection security may include a variety of security protection methods. When the PC5 security policy indicates that PC5 connection security is used to protect PC5 communication, the PC5 security policy may also indicate a specific protection method of the PC5 connection security used.

[0094] The specific protection methods for PC5 connection security may include at least one of the following: encryption protection of PC5 communication signaling and / or data; integrity protection of PC5 communication signaling and / or data, etc. Encryption protection of PC5 communication signaling and / or data may be security protection of PC5 communication signaling and / or data by using key encryption and decryption, etc. Integrity protection may be integrity protection and verification of PC5 communication signaling and / or data by using key.

[0095] When the UE performs PC5 communication in ProSe non-direct communication, it can determine the PC5 connection security of the PC5 communication according to the PC5 security policy, thereby improving the data communication security in the PC5 communication.

[0096] In this way, through the PC5 security policy, the remote UE and the relay UE protect the PC5 connection security in the ProSe indirect communication based on the security policy, realize the security protection of the PC5 communication in the ProSe relay service, meet the security requirements of the ProSe indirect communication, and improve the communication security.

[0097] In one embodiment, the PC5 security policy is configured by the core network. The PC5 security policy can be configured by the PCF of the core network.

[0098] In one embodiment, obtaining the PC5 security policy includes:

[0099] Receive PC5 security policy indication information sent by the core network.

[0100] Here, the PC5 security policy may be configured by the PCF of the core network. The PCF of the core network may send indication information of the PC5 security policy to the UE. The core network may send indication information of the PC5 security policy to the UE via the air interface of the cellular mobile communication.

[0101] In one embodiment, the core network may send indication information of the PC5 security policy to the UE through NAS signaling during the process of service authorization and activation for the UE. Here, service authorization and activation may include: authorization and activation of ProSe relay service. The core network may send indication information of the PC5 security policy to the remote UE and the relay UE through NAS signaling during the process of service authorization and activation for the remote UE and the relay UE, respectively.

[0102] Exemplarily, the core network authorizes and activates services for the U2N relay UE; the PCF provides the relay UE with the PC5 security policy for ProSe indirect communication. The core network authorizes and activates services for the remote UE; the PCF provides the remote UE with the PC5 security policy for ProSe indirect communication.

[0103] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0104] In ProSe indirect communication, the PC5 security policies of different ProSe relay services can be the same or different. In the same ProSe relay service, the PC5 security policy can be the same or different for the PC5 connection security configured for the signaling plane and the data plane. For example, in the same ProSe relay service, the security configured for PC5 UP and PC5 CP by the PC5 security policy can be different. Here, the ProSe relay service can be the service carried by the remote UE when performing data communication with the network side through data relaying by the relay UE.

[0105] In this way, the indication information of the PC5 security policy is sent through the core network to implement security configuration of the PC5 communication corresponding to one or more ProSe relay services, meet the security requirements of the PC5 communication of each ProSe relay service, and improve communication security.

[0106] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0107] The Relay Service Code (RSC) can be provided by the PCF to the relay UE and the remote UE. An RSC can uniquely identify a ProSe relay service that the relay UE can provide to the remote UE. In addition, the RSC can also identify the authorized user to whom the relay UE can provide services, and can be used to select related security policies or information, etc. For example, the RSC is required for authentication and authorization between the remote UE and the relay UE.

[0108] In one embodiment, the PC5 security policy includes:

[0109] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0110] and / or,

[0111] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0112] The security requirements of CP and UP during data transmission can be the same or different. PC5 CP security policy can be used to configure PC5 communication security of CP between relay UE and remote UE, that is, PC5 CP security. PC5 UP security policy can be used to configure PC5 communication security of UP between relay UE and remote UE, that is, PC5 UP security.

[0113] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0114] For ProSe indirect communication implemented through relay UE, PC5 communication needs to be established to carry signaling and user data between remote UE and relay UE. When the remote UE requests ProSe indirect communication from the network side, the PC5 CP security policy needs to meet the security requirements of PC5 communication of the ProSe relay service running between the remote UE and the relay UE. The PC5 CP security policy also needs to meet the security requirements of NAS signaling and AS signaling on the network side.

[0115] Therefore, the PC5 CP security of ProSe indirect communication configured by the PC5 CP security policy needs to be consistent with the security requirements of NAS signaling and AS signaling.

[0116] For example, the PC5 CP security policy of ProSe non-direct communication can configure PC5 CP security to be consistent with the security requirements of NAS signaling and AS signaling defined in 3GPP TS33.501, that is, PC5 CP security of ProSe non-direct communication is required.

[0117] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0118] When the remote UE requests ProSe indirect communication from the network side, the PC5 UP security policy needs to satisfy the ProSe service data exchanged between the remote UE and the relay UE. The PC5 UP security policy also needs to satisfy the connection service provided by the relay UE requested by the remote UE; further, the connection service provided by the relay UE is used to support the relay service provided by the network side to the remote UE through the relay UE. Therefore, the PC5 UP security configured by the PC5 UP security policy needs to meet the UP security requirements of the relay service provided by the network.

[0119] For example, the PC5 UP security policy can configure the PC5 UP security to be consistent with the network side UP security. The encryption and integrity protection requirements in the network side UP security can have "REQUIRED" or "PREFERRED" or "NOT NEEDED" options.

[0120] In one embodiment, the method further comprises:

[0121] Based on the PC5 security policy, the PC5 communication is established.

[0122] When establishing ProSe indirect communication, the remote UE can discover the relay UE and determine the ProSe relay service that the relay UE can provide.

[0123] The remote UE selects the discovered relay UE and establishes a PC5 connection for ProSe indirect communication. The PC5 connection security of the PC5 communication between the remote UE and the relay UE is configured by the PC5 security policy. In one embodiment, the PC5 security policy can be sent by the PCF to the remote UE and the relay UE.

[0124] In one embodiment, in response to the UE being a relay UE, the method further includes:

[0125] Based on the UP security policy provided by the network side, the protocol data unit PDU session corresponding to the ProSe relay service is protected.

[0126] The relay UE may establish a PDU session for ProSe indirect communication. The UP security policy of the established PDU session may be provided by the network. Here, the PDU session may be established before the remote UE requests to establish PC5 communication for ProSe indirect communication.

[0127] The relay UE and the 5G radio access network (NG-RAN) can activate UP security for the PDU session based on the UP security policy.

[0128] The remote UE can request different ProSe relay services from the relay UE. The remote UE can make a request by sending the relay service code (RSC, Relay Service Code) of the ProSe relay service to the relay UE. If the relay UE currently has not established a PDU session associated with the RSC, or the relay UE actively needs to establish a new PDU session for relaying, the relay UE can complete the process of initiating a new PDU session establishment before establishing the PC5 connection. The UP security policy for the new PDU session can also be provided by the network side. Here, the network side can be a wireless access network and / or core network in a cellular mobile communication system, etc.

[0129] In one embodiment, after ProSe indirect communication is established, the PC5 connection security of PC5 communication between the remote UE and the relay UE can be determined based on the configuration of the PC5 security policy. The communication security between the relay UE and the network side can be determined based on the configuration of the security policy provided by the network side. Thereby, the PC5 communication security in ProSe indirect communication and the communication security between the relay UE and the network side are achieved.

[0130] like Figure 3 As shown, this exemplary embodiment provides an information transmission method, which can be applied to a core network of a cellular mobile communication system, including:

[0131] Step 301: Configure a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communications between a relay UE and a remote UE.

[0132] The method disclosed in this embodiment may be executed by a PCF in a core network, etc. The PC5 security policy may be configured by the PCF.

[0133] In ProSe indirect communication, the remote UE and the relay UE perform PC5 communication through an established PC5 connection; the relay UE and the network side of the cellular mobile communication can communicate through the air interface of the cellular mobile communication.

[0134] The PC5 security policy may be used to configure PC5 connection security (PC5 Connection Security) of PC5 communication performed through a PC5 connection in ProSe indirect communication. Here, PC5 connection security may be a security protection method used for the PC5 connection.

[0135] The PC5 security policy may indicate whether to use PC5 connection security to protect PC5 communications.

[0136] Exemplarily, the PC5 security policy may indicate: PC5 connection security must be adopted, PC5 connection security is preferred, PC5 connection security does not need to be used, etc.

[0137] PC5 connection security may include a variety of security protection methods. When the PC5 security policy indicates that PC5 connection security is used to protect PC5 communication, the PC5 security policy may also indicate a specific protection method of the PC5 connection security used.

[0138] The specific protection methods for PC5 connection security may include at least one of the following: encryption protection of PC5 communication signaling and / or data; integrity protection of PC5 communication signaling and / or data, etc. Encryption protection of PC5 communication signaling and / or data may be security protection of PC5 communication signaling and / or data by using key encryption and decryption, etc. Integrity protection may be integrity protection and verification of PC5 communication signaling and / or data by using key.

[0139] When the UE performs PC5 communication in ProSe non-direct communication, it can determine the PC5 connection security of the PC5 communication according to the PC5 security policy, thereby improving the data communication security in the PC5 communication.

[0140] In this way, through the PC5 security policy, the remote UE and the relay UE protect the PC5 connection security in the ProSe indirect communication based on the security policy, realize the security protection of the PC5 communication in the ProSe relay service, meet the security requirements of the ProSe indirect communication, and improve the communication security.

[0141] In one embodiment, the PC5 security policy includes:

[0142] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0143] and / or,

[0144] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0145] The security requirements of CP and UP during data transmission can be the same or different. PC5 CP security policy can be used to configure PC5 communication security of CP between relay UE and remote UE, that is, PC5 CP security. PC5 UP security policy can be used to configure PC5 communication security of UP between relay UE and remote UE, that is, PC5 UP security.

[0146] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0147] For ProSe indirect communication implemented through relay UE, PC5 communication needs to be established to carry signaling and user data between remote UE and relay UE. When the remote UE requests ProSe indirect communication from the network side, the PC5 CP security policy needs to meet the security requirements of PC5 communication of the ProSe relay service running between the remote UE and the relay UE. The PC5 CP security policy also needs to meet the security requirements of NAS signaling and AS signaling on the network side.

[0148] Therefore, the PC5 CP security of ProSe indirect communication configured by the PC5 CP security policy needs to be consistent with the security requirements of NAS signaling and AS signaling.

[0149] For example, the PC5 CP security policy of ProSe non-direct communication can configure PC5 CP security to be consistent with the security requirements of NAS signaling and AS signaling defined in 3GPP TS33.501, that is, PC5 CP security of ProSe non-direct communication is required (REQUIRED).

[0150] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0151] When the remote UE requests ProSe indirect communication from the network side, the PC5 UP security policy needs to satisfy the ProSe service data exchanged between the remote UE and the relay UE. The PC5 UP security policy also needs to satisfy the connection service provided by the relay UE requested by the remote UE; further, the connection service provided by the relay UE is used to support the relay service provided by the network side to the remote UE through the relay UE. Therefore, the PC5 UP security configured by the PC5 UP security policy needs to meet the UP security requirements of the relay service provided by the network.

[0152] For example, the PC5 UP security policy can configure the PC5 UP security to be consistent with the network side UP security. The encryption and integrity protection requirements in the network side UP security can have "REQUIRED" or "PREFERRED" or "NOT NEEDED" options.

[0153] In one embodiment, the method further comprises:

[0154] Send the indication information of the PC5 security policy to the UE.

[0155] Here, the PC5 security policy may be configured by the PCF of the core network. The PCF of the core network may send indication information of the PC5 security policy to the UE. The core network may send indication information of the PC5 security policy to the UE via the air interface of the cellular mobile communication.

[0156] In one embodiment, the core network may send indication information of the PC5 security policy to the UE through NAS signaling during the process of service authorization and activation for the UE. Here, service authorization and activation may include: authorization and activation of ProSe relay service. The core network may send indication information of the PC5 security policy to the remote UE and the relay UE through NAS signaling during the process of service authorization and activation for the remote UE and the relay UE, respectively.

[0157] Exemplarily, the core network authorizes and activates services for the U2N relay UE; the PCF provides the relay UE with the PC5 security policy for ProSe indirect communication. The core network authorizes and activates services for the remote UE; the PCF provides the remote UE with the PC5 security policy for ProSe indirect communication.

[0158] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0159] In ProSe indirect communication, the PC5 security policies of different ProSe relay services can be the same or different. In the same ProSe relay service, the PC5 security policy can be the same or different for the PC5 connection security configured for the signaling plane and the data plane. For example, in the same ProSe relay service, the security configured for PC5 UP and PC5 CP by the PC5 security policy can be different. Here, the ProSe relay service can be the service carried by the remote UE when performing data communication with the network side through data relaying by the relay UE.

[0160] In this way, the indication information of the PC5 security policy is sent through the core network to implement security configuration of the PC5 communication corresponding to one or more ProSe relay services, meet the security requirements of the PC5 communication of each ProSe relay service, and improve communication security.

[0161] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0162] The Relay Service Code (RSC) can be provided by the PCF to the relay UE and the remote UE. An RSC can uniquely identify a ProSe relay service that the relay UE can provide to the remote UE. In addition, the RSC can also identify the authorized user to whom the relay UE can provide services, and can be used to select related security policies or information, etc. For example, the RSC is required for authentication and authorization between the remote UE and the relay UE.

[0163] A specific example is provided below in combination with any of the above embodiments:

[0164] like Figure 4 As shown, the application steps of PC5 security policy in ProSe indirect communication process include:

[0165] Step 401a: The core network may provide the relay UE with the PC5 security policy during the process of authorizing and activating services for the relay UE.

[0166] Step 401b: The core network may provide the remote UE with the PC5 security policy during the process of authorizing and activating services for the remote UE.

[0167] Step 402: Optionally, the relay UE may establish a PDU session for ProSe indirect communication relay. The UP security policy of the established PDU session is provided by the network side.

[0168] Step 403: The remote UE initiates a discovery process. The remote UE may discover the relay UE and determine the ProSe relay service provided by the relay UE.

[0169] Step 404a: The remote UE selects the discovered relay UE and establishes a PC5 connection for ProSe indirect communication. The PC5 connection security of the PC5 communication between the remote UE and the relay UE is configured by the PC5 security policy.

[0170] Step 404b: Optionally, if the relay UE does not currently establish a PDU session associated with the RSC, or the relay UE actively needs to establish a new PDU session for relaying, the relay UE can complete the process of initiating a new PDU session establishment before the PC5 connection is established. The UP security policy of the new PDU session can also be provided by the network side.

[0171] Step 405: The relay UE sends a remote UE report (remote user ID, remote UE information) to the SMF. The remote UE report is sent for the PDU session.

[0172] Step 406a: The ProSe relay service traffic is transmitted via the PC5 connection with security protection.

[0173] Step 406b: The ProSe relay service traffic relays the connection transmission between the UE and the network side with security protection.

[0174] The embodiment of the present invention further provides an information transmission device, which is applied to a UE of a cellular mobile wireless communication, such as Figure 5 As shown, the device 100 includes:

[0175] The acquisition module 110 is configured to acquire a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

[0176] In one embodiment, the PC5 security policy includes:

[0177] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0178] and / or,

[0179] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0180] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0181] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0182] In one embodiment, the apparatus further comprises:

[0183] The establishing module 120 is configured to establish the PC5 communication based on the PC5 security policy.

[0184] In one embodiment, in response to the UE being a relay UE, the apparatus further includes:

[0185] The protection module 130 is configured to protect the protocol data unit PDU session corresponding to the ProSe relay service based on the UP security policy provided by the network side.

[0186] In one embodiment, the acquisition module 110 is specifically configured as follows:

[0187] Receive PC5 security policy indication information sent by the core network.

[0188] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0189] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0190] The embodiment of the present invention further provides an information transmission device, which is applied to a core network of cellular mobile wireless communication, such as Figure 6 As shown, the device 200 includes:

[0191] The setting module 210 is configured to configure a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

[0192] In one embodiment, the PC5 security policy includes:

[0193] PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE;

[0194] and / or,

[0195] PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

[0196] In one embodiment, the PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

[0197] In one embodiment, the PC5 UP security policy is determined according to the UP security requirement of the ProSe relay service.

[0198] In one embodiment, the apparatus further comprises:

[0199] The sending module 220 is configured to send the indication information of the PC5 security policy to the UE.

[0200] In one embodiment, the security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

[0201] In one embodiment, the ProSe relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

[0202] In an exemplary embodiment, the acquisition module 110, the establishment module 120, the protection module 130, the setting module 210 and the sending module 220 can be implemented by one or more central processing units (CPU), graphics processing units (GPU), baseband processors (BP), application specific integrated circuits (ASIC), DSPs, programmable logic devices (PLD), complex programmable logic devices (CPLD), field programmable gate arrays (FPGA), general processors, controllers, microcontrollers (MCU), microprocessors, or other electronic components to execute the aforementioned method.

[0203] Figure 7 3000 is a block diagram of an apparatus 3000 for information transmission according to an exemplary embodiment. For example, the apparatus 3000 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0204] Reference Figure 7 , the device 3000 may include one or more of the following components: a processing component 3002 , a memory 3004 , a power component 3006 , a multimedia component 3008 , an audio component 3010 , an input / output (I / O) interface 3012 , a sensor component 3014 , and a communication component 3016 .

[0205] The processing component 3002 generally controls the overall operation of the device 3000, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 3002 may include one or more processors 3020 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 3002 may include one or more modules to facilitate the interaction between the processing component 3002 and other components. For example, the processing component 3002 may include a multimedia module to facilitate the interaction between the multimedia component 3008 and the processing component 3002.

[0206] The memory 3004 is configured to store various types of data to support operations on the device 3000. Examples of such data include instructions for any application or method operating on the device 3000, contact data, phone book data, messages, pictures, videos, etc. The memory 3004 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0207] The power supply component 3006 provides power to the various components of the device 3000. The power supply component 3006 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 3000.

[0208] The multimedia component 3008 includes a screen that provides an output interface between the device 3000 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 3008 includes a front camera and / or a rear camera. When the device 3000 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0209] The audio component 3010 is configured to output and / or input audio signals. For example, the audio component 3010 includes a microphone (MIC), and when the device 3000 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 3004 or sent via the communication component 3016. In some embodiments, the audio component 3010 also includes a speaker for outputting audio signals.

[0210] I / O interface 3012 provides an interface between processing component 3002 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, start buttons, and lock buttons.

[0211] The sensor assembly 3014 includes one or more sensors for providing various aspects of status assessment for the device 3000. For example, the sensor assembly 3014 can detect the open / closed state of the device 3000, the relative positioning of components, such as the display and keypad of the device 3000, and the sensor assembly 3014 can also detect the position change of the device 3000 or a component of the device 3000, the presence or absence of user contact with the device 3000, the orientation or acceleration / deceleration of the device 3000, and the temperature change of the device 3000. The sensor assembly 3014 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 3014 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 3014 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0212] The communication component 3016 is configured to facilitate wired or wireless communication between the device 3000 and other devices. The device 3000 can access a wireless network based on a communication standard, such as Wi-Fi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 3016 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 3016 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0213] In an exemplary embodiment, the apparatus 3000 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0214] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 3004 including instructions, and the instructions can be executed by the processor 3020 of the device 3000 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0215] Those skilled in the art will readily appreciate other implementations of the embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the embodiments of the present invention that follow the general principles of the embodiments of the present invention and include common knowledge or customary technical means in the art that are not disclosed in the embodiments of the present disclosure. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the embodiments of the present invention are indicated by the following claims.

[0216] It should be understood that the embodiments of the present invention are not limited to the precise structures described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the embodiments of the present invention is limited only by the appended claims.

Claims

1. A method for transmitting information, wherein: The method comprises: The core network sends indication information of the PC5 security policy to the user equipment UE, wherein the PC5 security policy is used to protect the PC5 communication between the relay UE and the remote UE.

2. The method according to claim 1, wherein: The PC5 security policy includes: PC5 control plane CP security policy, used to protect PC5 communication on the CP plane between the relay UE and the remote UE; and / or, PC5 user plane UP security policy is used to protect PC5 communication on the UP plane between the relay UE and the remote UE.

3. The method according to claim 2, wherein: The PC5 CP security policy meets the signaling security requirements of the non-access layer NAS and the access layer AS.

4. The method according to claim 2, wherein: The PC5 UP security policy is determined according to the UP security requirements of the proximity communication service ProSe relay service.

5. The method according to claim 1, wherein: The method further comprises: The UE establishes the PC5 communication based on the PC5 security policy.

6. The method according to claim 1, wherein: The method further comprises: The core network configures the PC5 security policy.

7. The method according to claim 1, wherein: In response to the UE being a relay UE, the method further includes: Based on the UP security policy provided by the core network, the protocol data unit PDU session corresponding to the ProSe relay service is protected.

8. The method according to claim 1, wherein: The security policy indication information is used to indicate at least one ProSe relay service and the PC5 security policy corresponding to each of the ProSe relay services.

9. The method according to claim 7, wherein: The relay service is indicated by a ProSe relay service code, wherein the ProSe relay service codes of different ProSe relay services are different.

10. A method for transmitting information, wherein: Applied to user equipment UE, the method includes: A PC5 security policy is obtained, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

11. A method for transmitting information, wherein: Applied to a core network, the method comprises: A PC5 security policy is configured, wherein the PC5 security policy is used to protect PC5 communications between the relay UE and the remote UE.

12. A communication system, wherein: The communication system includes a core network and a user equipment UE; The core network sends indication information of the PC5 security policy to the UE, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

13. An information transmission device, wherein: Applied to user equipment UE, the device includes: The acquisition module is configured to acquire a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

14. An information transmission device, wherein: Applied to a core network, the device comprises: The setting module is configured to configure a PC5 security policy, wherein the PC5 security policy is used to protect PC5 communication between the relay UE and the remote UE.

15. A communication device comprising a processor, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein: When the processor runs the executable program, the steps of the information transmission method according to claim 10 or 11 are performed.

16. A storage medium having an executable program stored thereon, wherein: When the executable program is executed by a processor, the steps of the information transmission method according to claim 10 or 11 are implemented.

Images