A method and apparatus for security processing of relay communication

Abstract

The present disclosure provides a security processing method and device for relay communication, and relates to the technical field of communication. The method comprises: in the scenario of U2U relay communication, a first key related to RSC can be determined for a source UE, a relay UE and a target UE, and then U2U relay communication can be performed according to the first key. Thus, an effective security protection scheme is provided in U2U relay communication, and the security of U2U relay communication is improved.

Description

[0001] This application is a divisional application of Chinese patent application filed on February 9, 2023, with application number 2023800081839 and entitled "A Security Processing Method and Apparatus for Relay Communication". Technical Field

[0002] This disclosure relates to the field of communication technology, and in particular to a method and apparatus for secure relay communication. Background Technology

[0003] 5G Proximity-based Services (ProSe) enable peer-to-peer User Equipment (UE) to communicate with each other via relay UEs. This means that if a source UE cannot communicate directly with a target UE, the source UE will attempt to discover a relay UE to establish communication with the target UE; this is known as UE-to-UE (U2U) relay communication.

[0004] However, there is currently a lack of effective security protection measures in U2U relay communication, which in turn affects the security of U2U relay communication. Summary of the Invention

[0005] This disclosure proposes a security processing method and apparatus for relay communication, which can provide an effective security protection scheme in U2U relay communication and improve the security of U2U relay communication.

[0006] A first aspect of this disclosure provides a secure processing method for relay communication, applied to a UE, the method comprising: determining a first key associated with a Relay Service Code (RSC); and performing U2U relay communication based on the first key.

[0007] In some embodiments of this disclosure, the step of performing U2U relay communication based on the first key includes: generating a session key related to a service in the neighboring service based on the first key and service identification information in the neighboring service; and performing U2U relay communication of the neighboring service based on the session key.

[0008] In some embodiments of this disclosure, the service identification information is used to identify the service information used by the UE on the U2U relay communication link.

[0009] In some embodiments of this disclosure, generating a session key related to a service in a neighboring service based on the first key and service identifier information in the neighboring service includes: calculating the session key using a key derivation function based on the first key, the service identifier information, and random number information.

[0010] In some embodiments of this disclosure, the parameters of the key derivation function used to calculate the session key include at least one of the following: The first key; The business identification information; The length of the service identification information; First random number; The length of the first random number; Second random number; The length of the second random number.

[0011] In some embodiments of this disclosure, determining the first key associated with the RSC includes: generating the first key associated with the RSC based on a long-term credential.

[0012] In some embodiments of this disclosure, the method further includes: when a new RSC is provided in a Direct Communication Request (DCR) message, regenerating a second key associated with the new RSC based on the long-term credential, and performing U2U relay communication based on the regenerated second key.

[0013] In some embodiments of this disclosure, generating a first key associated with RSC based on a long-term credential includes: generating the first key based on the long-term credential by exchanging authentication signaling.

[0014] A second aspect of this disclosure provides a secure processing apparatus for relay communication applied to a UE, the apparatus comprising: a generation module configured to determine a first key associated with an RSC; and a communication module configured to perform U2U relay communication based on the first key.

[0015] A third aspect of this disclosure provides a communication device comprising: a transceiver; a memory; and a processor, respectively connected to the transceiver and the memory, configured to control the transmission and reception of wireless signals of the transceiver by executing computer-executable instructions on the memory, and capable of implementing the method as described in the first aspect of this disclosure.

[0016] A fourth aspect of this disclosure provides a computer storage medium storing computer-executable instructions; when executed by a processor, the computer-executable instructions can implement the method of the first aspect of this disclosure.

[0017] This disclosure provides a secure processing method and apparatus for relay communication. In a U2U relay communication scenario, a first key related to RSC can be determined for the source UE, relay UE, and target UE, and then U2U relay communication can be performed based on this first key. This provides an effective security protection scheme for U2U relay communication, improving its security.

[0018] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0019] The above and / or additional aspects and advantages of this disclosure will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which: Figure 1 This is a schematic diagram of an example architecture according to an embodiment of the present disclosure; Figure 2 This is a flowchart illustrating a secure relay communication method according to an embodiment of the present disclosure. Figure 3 This is a flowchart illustrating a secure relay communication method according to an embodiment of the present disclosure. Figure 4 This is a flowchart illustrating a secure relay communication method according to an embodiment of the present disclosure. Figure 5 This is a schematic diagram illustrating one example of an embodiment according to the present disclosure; Figure 6 This is a block diagram of a secure processing apparatus for relay communication according to an embodiment of the present disclosure; Figure 7 This is a schematic diagram of the structure of a communication device according to an embodiment of the present disclosure; Figure 8 This is a schematic diagram of the structure of a chip provided in an embodiment of the present disclosure. Detailed Implementation

[0020] The embodiments of this disclosure are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure. It should be noted that, unless otherwise specified, the embodiments of this disclosure and the features in the embodiments can be combined with each other.

[0021] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. The singular forms “a” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0022] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of embodiments of this disclosure, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0023] In 3GPP TR 33.740[1], 5G proximity service enables peer UEs to communicate with each other via relay UEs. Figure 1 As shown, if the source UE 11 cannot communicate directly with the target UE 12, the source UE 11 will attempt to discover the relay UE 13 to communicate with the target UE 12, i.e., U2U relay communication. The introduction of this new scenario poses new requirements to existing security mechanisms. However, currently, there is a lack of effective security protection measures in U2U relay communication, thus affecting its security.

[0024] Therefore, this embodiment proposes a secure processing method and apparatus for relay communication, which can provide an effective security protection scheme in U2U relay communication and improve the security of U2U relay communication.

[0025] The following description, in conjunction with the accompanying drawings, details the secure relay communication processing method and apparatus provided in this embodiment.

[0026] Figure 2 A flowchart illustrating a secure relay communication method according to an embodiment of this disclosure is shown. Figure 2 As shown, this method can be applied to execution on the UE side, such as... Figure 1 As shown, the UE can be any one of the source UE 11, target UE 12, and relay UE 13. The method in this embodiment may include the following steps.

[0027] Step 201: The UE determines the first key associated with the RSC.

[0028] In some examples, step 201 may specifically include: the UE generating a first key associated with the RSC based on long-term credentials. Long-term credentials may be provided to the UE and may constitute the security root credentials for the PC5 unicast link. These long-term credentials may include a symmetric key or a public-private key pair, depending on the specific use case requirements.

[0029] RSC stands for Relay Service Code, which can be used to identify the ProSe service (neighborhood service) provided by the 5G ProSe U2U relay. Each ProSe service has a corresponding RSC. In this embodiment, a first key associated with the RSC corresponding to the current ProSe service in 5G ProSe U2U relay communication can be generated from long-term credentials. This first key can be used for security protection in U2U relay communication, such as establishing security between the U2U relay and the ProSe terminal UE communicating via the New Radio (NR) PC5 unicast link.

[0030] Step 202: The UE performs U2U relay communication based on the first key.

[0031] By applying the secure processing method for relay communication provided in this embodiment, in a U2U relay communication scenario, a first key related to RSC can be determined for the source UE, relay UE, and target UE, and then U2U relay communication can be performed based on this first key. This provides an effective security protection scheme for U2U relay communication, improving its security.

[0032] Figure 3 A flowchart illustrating a secure relay communication processing method according to an embodiment of this disclosure is shown. Based on Figure 2 The illustrated embodiment, as Figure 3 As shown, this method can be applied to UEs (such as...) Figure 1 (Any of the source UE 11, target UE 12, and relay UE 13) may include the following steps.

[0033] Step 301: The UE generates a first key associated with the RSC based on the long-term certificate.

[0034] In some examples, step 301 may specifically include: the UE generating a first key associated with the RSC based on long-term credentials by exchanging authentication signaling.

[0035] For example, the first key K associated with RSC can be derived from long-term credentials by exchanging authentication signaling between UEs. NR_U2U_ProSe It should be noted that, for ease of description, this embodiment uses K. NR_U2U_ProSe The first key will be explained using an example, but no specific name for the first key is specified. This K... NR_U2U_ProSe It can be a key bound to the U2U Relay Service (RSC) and can be used to establish security between the U2U Relay and the ProSe terminal UE communicating via the NR PC5 unicast link.

[0036] Step 302: The UE generates a session key related to the service in the neighboring service based on the first key and the service identifier information in the neighboring service.

[0037] RSCs are used to identify the neighboring services provided by the relay UE. An RSC can be associated with one service or multiple services. When an RSC is associated with multiple services, traffic from different services is transmitted through the same PC5 U2U unicast link and uses the same shared session key to protect the traffic from different services. However, if this session key is leaked, the traffic from all these services can be decrypted, thus affecting the security of U2U relay communication. Therefore, this embodiment can generate a session key based on a first key and the service identification information in the neighboring services. This session key is used for security protection of that service in U2U relay communication, ensuring that different services have their own corresponding session keys. Even if one session key is leaked, the security of the traffic from other services will not be affected.

[0038] In some examples, the service identification information of the proximity service can be used to identify the service information used by the UE on the U2U relay communication link. For example, the service identification information of the proximity service may be the ProSe Code, the ProSe Identifier, the ProSe Application ID, the Application ID, etc., and this embodiment is not limited to these.

[0039] For example, based on the first key K NR_U2U_ProSe Based on the service identification information of neighboring services, a session key K is generated that is related to the service information (the service information identified by the service identification information). U2U-sess It should be noted that, for ease of description, this embodiment uses K. U2U-sess This example illustrates the session key, but does not impose any restrictions on the specific name of the session key. U2U-sess It can be from K by UE NR_U2U_ProSeThe exported key can specifically be a session key used to protect a particular U2U relay ProSe service between UEs. During an active unicast communication session between UEs, the key can be refreshed by running a key update procedure. U2U-sess .

[0040] Furthermore, in some examples, step 302 may specifically include: calculating a session key using a Key Derivation Function (KDF) based on the first key, the service identifier information of neighboring services, and random number information. This method can accurately generate a valid session key.

[0041] Specifically, in some examples, the parameters of the key derivation function used to calculate the session key may include at least one of the following: First key K NR_U2U_ProSe ; Business identification information of adjacent services (such as ProSe Code or Application ID); Length of the business identification information (such as the length of ProSe Code or Application ID); First random number (such as random number 1); Length of the first random number (such as the length of random number 1); Second random number (such as random number 2); Length of the second random number (such as the length of random number 2).

[0042] For example, the random number 1, the length of random number 1, random number 2, the length of random number 2, ProSe Code, and the length of ProSe Code, along with the first key K. NR_U2U_ProSe The inputs are combined and fed into the key derivation function for calculation, such as calculating the corresponding hash value or MD5 value, to obtain the session key K. U2U-sess .

[0043] Step 303: The UE performs U2U relay communication for neighborhood services based on the session key.

[0044] In some examples, step 303 may specifically include: generating key A and key B based on the session key, wherein key A (e.g., NRPEK) can be used for encryption of communication information, and key B (e.g., NRPIK) is used for the integrity transmission of communication information; then, key A and key B are used for U2U relay communication of proximity services. For example, key A and key B are used in the confidentiality and integrity algorithms of communication information, respectively, to protect the confidentiality and integrity of PC5-S signaling, PC5 Radio Resource Control (RRC) signaling, and PC5 user plane data. Key A and key B are derived from session key K. U2U-sess Each time K is changed U2U-sess The key A and key B will be automatically refreshed at any time.

[0045] Based on the above examples, such as Figure 4 The diagram illustrates a specific example architecture. For the source UE, target UE, and relay UE, the first key K related to RSC can be derived from long-term credentials through the exchange of authentication signaling. NR_U2U_ProSe Then according to K NR_U2U_ProSe Session key K is generated from the service identification information of neighboring services. U2U-sess Then according to K U2U-sess NRPEK and NRPIK are generated and used in the confidentiality and integrity algorithms of communication information, respectively, thereby ensuring the security of U2U relay communication.

[0046] By applying the secure processing method for relay communication provided in this embodiment, in a U2U relay communication scenario, a first key related to RSC can be generated based on long-term credentials for the source UE, relay UE, and target UE. This first key can then be used for U2U relay communication. Therefore, an effective security protection scheme is provided for U2U relay communication, improving its security.

[0047] Figure 5 A flowchart illustrating a secure relay communication processing method according to an embodiment of this disclosure is shown. Based on Figure 2 The illustrated embodiment, as Figure 5 As shown, this method can be applied to UEs (such as...) Figure 1 (Any of the source UE 11, target UE 12, and relay UE 13) may include the following steps.

[0048] Step 401: The UE generates a first key associated with the RSC based on the long-term certificate.

[0049] Step 402: The UE performs U2U relay communication based on the first key.

[0050] For details, please refer to [the relevant documentation]. Figures 1 to 4 The corresponding descriptions of the examples are not repeated here.

[0051] Step 403: When a new RSC is provided in the DCR message, the UE regenerates the second key associated with the new RSC based on the long-term credential, and performs U2U relay communication according to the regenerated second key.

[0052] The DCR message represents a direct communication request. The new RSC provided in the DCR message differs from the RSC (original) corresponding to the first key generated in step 401. This can be understood as a newly provided RSC in U2U relay communication, with each different RSC having its own corresponding proximity service. If a new RSC is provided in the DCR message, the UE will no longer use the first key corresponding to the original RSC. Instead, it will regenerate a second key associated with the new RSC based on long-term credentials and perform U2U relay communication according to the regenerated second key.

[0053] For example, in performing the authentication process to derive K NR_U2U_ProSe Previously, the RSC was provided in the DCR message. Based on the provided RSC, neighboring UEs and U2U relays could authenticate each other and derive the corresponding K. NR_U2U_ProSe If a new RSC is provided, then a new K needs to be generated. NR_U2U_ProSe The new K NR_U2U_ProSe Related to this new RSC, and then according to this new K NR_U2U_ProSe Perform U2U relay communication.

[0054] By applying the secure processing method for relay communication provided in this embodiment, an effective security protection scheme is provided in U2U relay communication, thereby improving the security of U2U relay communication.

[0055] The methods provided in the above embodiments of this disclosure are described from the perspective of a user equipment. To implement the functions of the methods provided in the above embodiments of this disclosure, the user equipment may include hardware structures and software modules, implementing the above functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. One of the above functions may be executed in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0056] Corresponding to the relay communication security processing methods provided in the above embodiments, this disclosure also provides a relay communication security processing device. Since the relay communication security processing device provided in this disclosure corresponds to the relay communication security processing methods provided in the above embodiments, the implementation methods of the relay communication security processing methods are also applicable to the relay communication security processing device provided in this embodiment, and will not be described in detail in this embodiment.

[0057] Figure 6 This is a schematic diagram of a secure processing device for relay communication provided in an embodiment of the present disclosure. This secure processing device for relay communication can be used by a UE (such as...). Figure 1 (Any of the following UEs: source UE 11, target UE 12, and relay UE 13).

[0058] like Figure 6 As shown, the device may include: a generation module 51 configured to determine a first key associated with RSC; and a communication module 52 configured to perform U2U relay communication based on the first key.

[0059] In some embodiments, the communication module 52 is specifically configured to generate a session key related to a service in the neighboring service based on the first key and service identification information in the neighboring service; and to perform U2U relay communication of the neighboring service based on the session key.

[0060] In some embodiments, the service identification information is used to identify the service information used by the UE on the U2U relay communication link.

[0061] In some embodiments, the communication module 52 is further configured to calculate the session key based on the first key, the service identification information, and the random number information using a key derivation function.

[0062] In some embodiments, the parameters of the key derivation function used to calculate the session key include at least one of the following: The first key; the service identification information; the length of the service identification information; the first random number; the length of the first random number; the second random number; the length of the second random number.

[0063] In some embodiments, generation module 51 is specifically configured to generate the first key associated with the RSC based on the long-term credential.

[0064] In some embodiments, the generation module 51 is further configured to regenerate a second key associated with the new RSC based on the long-term credential when a new RSC is provided in the DCR message; the communication module 52 is further configured to perform U2U relay communication based on the regenerated second key.

[0065] In some embodiments, the generation module 51 is specifically configured to generate the first key based on the long-term credential by exchanging authentication signaling.

[0066] By applying the technical solution disclosed herein, an effective security protection scheme is provided in U2U relay communication, thereby improving the security of U2U relay communication.

[0067] Please see Figure 7 , Figure 7This is a schematic diagram of the structure of a communication device 1300 provided in this embodiment. The communication device 1300 can be a network device, a user device, a chip, chip system, or processor that supports the network device in implementing the above methods, or a chip, chip system, or processor that supports the user device in implementing the above methods. This device can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0068] The communication device 1300 may include one or more processors 1301. The processor 1301 may be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the communication device (e.g., base station, baseband chip, terminal equipment, terminal equipment chip, DU or CU, etc.), execute computer programs, and process data from the computer programs.

[0069] Optionally, the communication device 1300 may further include one or more memories 1302, which may store a computer program 1304. The processor 1301 executes the computer program 1304 to cause the communication device 1300 to perform the methods described in the above method embodiments. Optionally, the memory 1302 may also store data. The communication device 1300 and the memory 1302 may be provided separately or integrated together.

[0070] Optionally, the communication device 1300 may also include a transceiver 1305 and an antenna 1306. The transceiver 1305 may be referred to as a transceiver unit, transceiver, or transceiver circuit, etc., and is used to implement the transmission and reception functions. The transceiver 1305 may include a receiver and a transmitter. The receiver may be referred to as a receiver or receiving circuit, etc., and is used to implement the receiving function; the transmitter may be referred to as a transmitter or transmitting circuit, etc., and is used to implement the transmitting function.

[0071] Optionally, the communication device 1300 may further include one or more interface circuits 1307. The interface circuit 1307 is used to receive code instructions and transmit them to the processor 1301. The processor 1301 executes the code instructions to cause the communication device 1300 to perform the methods described in the above method embodiments.

[0072] In one implementation, the processor 1301 may include a transceiver for implementing receive and transmit functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing receive and transmit functions may be separate or integrated. The aforementioned transceiver circuit, interface, or interface circuit can be used for reading and writing code / data, or it can be used for transmitting or relaying signals.

[0073] In one implementation, processor 1301 may store computer program 1303, which runs on processor 1301 and causes communication device 1300 to perform the methods described in the above method embodiments. Computer program 1303 may be embedded in processor 1301, in which case processor 1301 may be implemented in hardware.

[0074] In one implementation, the communication device 1300 may include circuitry capable of performing the functions of transmitting, receiving, or communicating as described in the aforementioned method embodiments. The processor and transceiver described in this disclosure can be implemented on integrated circuits (ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application-specific integrated circuits (ASICs), printed circuit boards (PCBs), electronic devices, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductors (CMOS), n-metal-oxide-semiconductor (NMOS), positive-channel metal oxide semiconductors (PMOS), bipolar junction transistors (BJTs), bipolar CMOS (BiCMOS), silicon-germanium (SiGe), gallium arsenide (GaAs), etc.

[0075] The communication device described in the above embodiments may be a network device or a user equipment, but the scope of the communication device described in this disclosure is not limited thereto, and the structure of the communication device may vary. Figure 7 The communication device can be a standalone device or part of a larger device. For example, the communication device could be: (1) Independent integrated circuit IC, or chip, or chip system or subsystem; (2) A collection of one or more ICs, optionally including storage components for storing data and computer programs; (3) ASIC, such as modem; (4) Modules that can be embedded in other devices; (5) Receivers, terminal equipment, smart terminal equipment, cellular phones, wireless equipment, handheld devices, mobile units, vehicle-mounted equipment, network equipment, cloud equipment, artificial intelligence equipment, etc. (6) Others, etc.

[0076] For cases where the communication device can be a chip or a chip system, please refer to [link / reference]. Figure 8 The diagram shows the structure of the chip. Figure 8 The chip shown includes a processor 1401 and an interface 1402. There can be one or more processors 1401, and multiple interfaces 1402.

[0077] Optionally, the chip also includes a memory 1403 for storing necessary computer programs and data.

[0078] Those skilled in the art will also understand that the various illustrative logical blocks and steps listed in the embodiments of this disclosure can be implemented by electronic hardware, computer software, or a combination of both. Whether such functionality is implemented in hardware or software depends on the specific application and the overall system design requirements. Those skilled in the art can implement the described functionality using various methods for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of this disclosure.

[0079] This disclosure also provides a readable storage medium having instructions stored thereon that, when executed by a computer, implement the functions of any of the above method embodiments.

[0080] This disclosure also provides a computer program product that, when executed by a computer, implements the functions of any of the above method embodiments.

[0081] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer programs. When a computer program is loaded and executed on a computer, it generates, in whole or in part, the processes or functions according to the embodiments of this disclosure. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, a computer program can be transferred from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0082] Those skilled in the art will understand that the various numerical designations such as "first," "second," etc., used in this disclosure are merely for the convenience of description and are not intended to limit the scope of the embodiments of this disclosure, nor do they indicate the order of events.

[0083] At least one of the features described in this disclosure can also be described as one or more, and multiple features can be two, three, four or more, and this disclosure does not impose any limitations. In the embodiments of this disclosure, for a technical feature, the technical features in that technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", etc., and there is no sequential order or size order among the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0084] As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0085] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0086] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0087] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0088] Furthermore, it should be understood that the various embodiments described in this disclosure can be implemented individually or in combination with other embodiments, where the scheme allows.

[0089] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments claimed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0090] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0091] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A secure processing method for relay communication, characterized in that, Applied to a user equipment (UE), the method includes: Determine the first key associated with the Relay Service Code (RSC); User equipment to user equipment U2U relay communication is performed based on the first key; The step of determining the first key associated with the RSC includes: generating the first key associated with the RSC based on long-term credentials by exchanging authentication signaling between UEs; When a new RSC is provided in the Direct Communication Request (DCR) message, a second key associated with the new RSC is regenerated based on the long-term credential, and U2U relay communication is performed based on the regenerated second key; The step of performing U2U relay communication based on the first key includes: generating a key for encrypting communication information and a key for transmitting communication information with integrity based on the session key; and performing U2U relay communication for proximity services based on the key for encrypting communication information and the key for transmitting communication information with integrity. The session key is generated according to at least one of the following: The first key; The service identification information in the adjacent service; The length of the service identification information; First random number; The length of the first random number; Second random number; The length of the second random number.

2. The method according to claim 1, characterized in that, The service identification information is used to identify the service information used by the UE on the U2U relay communication link.

3. A secure processing device for relay communication, characterized in that, The device is applied to a user equipment (UE) and includes: The generation module is configured to determine the first key associated with the Relay Service Code (RSC). The communication module is configured to perform user equipment-to-user equipment U2U relay communication based on the first key; Specifically, the generation module is configured to generate the first key associated with the RSC based on long-term credentials by exchanging authentication signaling between UEs; The generation module is further configured to regenerate a second key associated with the new RSC based on the long-term credential when a new RSC is provided in the Direct Communication Request (DCR) message; the communication module is further configured to perform U2U relay communication based on the regenerated second key. Specifically, the communication module is configured to generate a key for encrypting communication information and a key for transmitting communication information with integrity based on the session key; and to perform U2U relay communication for proximity services based on the key for encrypting communication information and the key for transmitting communication information with integrity. The session key is generated according to at least one of the following: The first key; The service identification information in the adjacent service; The length of the service identification information; First random number; The length of the first random number; Second random number; The length of the second random number.

4. A communication device, wherein, include: transceiver; Memory; The processor is connected to the transceiver and the memory respectively, and is configured to control the wireless signal transmission and reception of the transceiver by executing computer-executable instructions on the memory, and is capable of implementing the method of any one of claims 1 to 2.

5. A computer storage medium, wherein, The computer storage medium stores computer-executable instructions; when executed by a processor, the computer-executable instructions can implement the method of any one of claims 1 to 2.

Images