Obtaining security information for relay detection

Abstract

An exemplary embodiment of the present disclosure relates to obtaining security information for relay discovery. A first network device receives a first request for security information for relay discovery from a terminal device served by the first network device. The first request includes at least a relay service code (RSC). The first network device obtains at least one identity based on the first request. Each of the at least one identity is for one of at least one target relay terminal device group that supports the RSC. The first network device obtains at least one set of security information based on the at least one identity and the RSC. Each of the at least one set of security information is associated with one of the at least one target relay terminal device group. The first network device transmits the at least one set of security information to the terminal device.

Description

Technical Field

[0001] Various exemplary embodiments of the present disclosure relate generally to the field of telecommunications, and in particular, to a device, method, apparatus, and computer-readable storage medium for obtaining security information for relay discovery. Background Art

[0002] Fifth generation (5G) systems support proximity-based service (ProSe) capabilities. 5G ProSe capabilities may include 5G ProSe direct discovery, 5G ProSe direct communication, and 5G ProSe UE-to-Network (U2N) relay. In the 5G ProSe UE-to-Network relay capability, a remote user equipment (UE) may connect to a UE-to-Network relay via the PC5 interface in 5G ProSe direct communication, and communicate with a data network via the UE-to-Network relay and the 5G network. To perform 5G ProSe direct communication between the remote UE and the U2N relay, the remote UE and the U2N relay may perform a 5G ProSe direct discovery procedure using security information for relay discovery. Summary of the Invention

[0003] In general, exemplary embodiments of the present disclosure provide a solution for obtaining security information for relay discovery.

[0004] In a first embodiment, a first network device is provided within a first home public land mobile network (HPLMN). The first network device comprises at least one processor and at least one memory for storing instructions. When an instruction is executed by at least one processor, the instruction causes the first network device to perform at least: receive a first request from a terminal device served by the first network device requesting security information for relay discovery, the first request comprising at least a relay service code (RSC); obtain, based on the first request, at least one identity, each of the at least one identity relating to one of at least one target relay terminal device groups supporting an RSC; obtain, based on the at least one identity and the RSC, at least one set of security information, each of the at least one set of security information associated with one of at least one target relay terminal device groups; and transmit the at least one set of security information to the terminal device.

[0005] In a second embodiment, a terminal device is provided, comprising at least one processor and at least one memory for storing instructions. When an instruction is executed by at least one processor, the instruction causes the terminal device to transmit a request for security information for relay discovery to at least one network device in a Home Public Land Mobile Network (HPLMN), the request comprising at least a relay service code (RSC); receive at least one set of security information from the network device, each of which is associated with one of at least one target relay terminal device groups that support the RSC; and perform relay discovery based on the set of security information.

[0006] In a third aspect, a first policy control function (PCF) device is provided in a first home public land mobile network (HPLMN). The first PCF device comprises at least one processor and at least one memory for storing instructions. When an instruction is executed by at least one processor, the instruction includes receiving a second request from at least one network device in the first HPLMN for at least one identity, each of the at least one identity for one of at least one target relay terminal device groups supporting relay service codes (RSCs), and the second request including at least an RSC; obtaining at least one identity based on the second request; and sending a second response to the first network device for the second request, the second response including at least one identity.

[0007] In a fourth aspect, a second network device is provided in a second home public land mobile network (HPLMN). The second network device comprises at least one processor and at least one memory for storing instructions. When an instruction is executed by at least one processor, the instruction causes the second network device to perform at least three actions: receive a third request from a first network device in the first HPLM for at least one second set of security information for relay service codes (RSCs), the request including at least RSCs, and the second HPLMN is different from the first HPLMN; obtain at least one second set of security information based on the third request; and transmit a third response to the first network device, the third response including at least one second set of security information.

[0008] In a fifth aspect, a second policy control function (PCF) device is provided within a second home public land mobile network (HPLMN). The second PCF device comprises at least one processor and at least one memory for storing instructions. When an instruction is executed by at least one processor, the instruction causes the second PCF device to at least receive a request for at least one identity, each of which is for a target relay terminal device that supports a relay service code (RSC), and the request includes at least an RSC; obtain at least one identity based on the request; and transmit a response to the request, the response including at least one identity.

[0009] In a sixth aspect, an apparatus is provided. The apparatus is located in a first network device within a first home public land mobile network (HPLMN) and comprises means for receiving a first request for security information for relay discovery from a terminal device serviced by the first network device, wherein the first request includes at least a relay service code (RSC); means for obtaining at least one identity based on the first request, wherein each of the at least one identity is for one of at least one target relay terminal device groups that support an RSC; means for obtaining at least one set of security information based on at least one identity and the RSC, wherein each of the at least one set of security information is associated with one of at least one target relay terminal device groups; and means for transmitting the at least one set of security information to the terminal device.

[0010] In a seventh aspect, an apparatus is provided. The apparatus comprises means for transmitting a request for security information for relay discovery from a terminal device to a network device in a Home Public Land Mobile Network (HPLMN), wherein the request includes at least a relay service code (RSC); means for receiving at least one set of security information from the network device, wherein each of the at least one set of security information is associated with one of at least one target relay terminal device groups that supports an RSC; and means for performing relay discovery based on the at least one set of security information.

[0011] In the eighth aspect, an apparatus is provided. The apparatus is a first policy control function (PCF) apparatus in a first home public land mobile network (HPLMN), comprising means for receiving a second request for at least one identity from a first network apparatus in the first HPLMN, each of the at least one identity being for one of at least one target relay terminal apparatus groups supporting relay service codes (RSCs), the second request including at least an RSC, means for receiving, means for obtaining at least one identity based on the second request, and means for transmitting a second response to the second request to the first network apparatus, the second response including at least one identity.

[0012] In the ninth phase, an apparatus is provided. The apparatus comprises means for receiving a third request from a first network device in a first HPLM for at least one set of security information for relay service codes (RSCs), wherein the request includes at least RSCs, and the second HPLMN is different from the first HPLMN; means for obtaining at least one second set of security information based on the third request; and means for transmitting a third response to the first network device, wherein the third response includes at least one second set of security information.

[0013] In a tenth aspect, an apparatus is provided. The apparatus is located in a second PCF device within a second home public land mobile network (HPLMN) and comprises means for receiving a request for at least one identity, each of which is for a target relay terminal device that supports a relay service code (RSC), and the request includes at least an RSC; means for obtaining at least one identity based on the request; and means for transmitting a response to the request, the response includes at least one identity.

[0014] In an eleventh aspect, a method is provided. The method includes receiving a first request for security information for relay discovery from a terminal device served by the first network device, in a first network device within a first home public land mobile network (HPLMN), the first request comprising at least a relay service code (RSC); obtaining at least one identity based on the first request, each of the at least one identity relating to one of at least one target relay terminal device groups supporting an RSC; obtaining at least one set of security information based on the at least one identity and the RSC, each of the at least one set of security information associated with one of at least one target relay terminal device groups; and transmitting the at least one set of security information to the terminal device.

[0015] A twelfth aspect provides a method, which includes transmitting a request for security information for relay discovery from a terminal device to a network device in a Home Public Land Mobile Network (HPLMN), the request comprising at least a relay service code (RSC); receiving at least one set of security information from the network device, each of which is associated with one of at least one target relay terminal device groups that supports an RSC; and performing relay discovery based on the set of security information.

[0016] A thirteenth aspect provides a method, the method comprising: receiving a first policy control function (PCF) device in a first home public land mobile network (HPLMN) from a first network device in the first HPLMN for at least one identity, each of the at least one identity for one of at least one target relay terminal device groups supporting relay service codes (RSCs), the second request including at least an RSC; obtaining at least one identity based on the second request; and transmitting a second response to the first network device for the second request, the second response including at least one identity.

[0017] In a fourteenth aspect, a method is provided. The method includes, in a second network device in a second home public land mobile network (HPLMN), receiving a third request from a first network device in a first HPLMN for at least one second set of security information for relay service codes (RSCs), the request comprising at least RSCs, and the second HPLMN being different from the first HPLMN; obtaining at least one second set of security information based on the third request; and transmitting a third response to the first network device, the third response comprising at least one second set of security information.

[0018] In a 15th aspect, a method is provided. The method includes receiving a request for at least one identity in a second PCF device within a second home public land mobile network (HPLMN), each of the at least one identity being for a target relay terminal device supporting a relay service code (RSC), the request including at least an RSC, obtaining at least one identity based on the request, and transmitting a response to the request, the response including at least one identity.

[0019] In the sixteenth aspect, a computer-readable medium is provided. The computer-readable medium includes program instructions that, when executed by at least one processor, cause at least the device to perform a method according to any of the eleventh to fifteenth aspects.

[0020] It should be understood that the summary is not intended to identify any key or essential features of the exemplary embodiments of the Disclosure, nor is it intended to be used to limit the scope of the Disclosure. Other features of the Disclosure will be readily apparent through the following description. [Brief explanation of the drawing]

[0021] Next, several exemplary embodiments will be described with reference to the attached drawings. [Figure 1] Figure 1 shows an exemplary communications network in which exemplary embodiments of the present disclosure may be implemented. [Figure 2] Figure 2 is a signaling chart illustrating the security procedures for the restricted 5G ProSe direct discovery model A. [Figure 3] Figure 3 is a signaling chart illustrating the PC5 security establishment procedure for 5G ProSe UE-network relay communication via the user plane. [Figure 4] Figure 4 is a signaling chart illustrating the process for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. [Figure 5] Figure 5 is a signaling chart illustrating the process for obtaining security information for relay discovery in some other exemplary embodiments of the present disclosure. [Figure 6] Figure 6 is a signaling chart illustrating the process for obtaining security information for relay discovery in some other exemplary embodiments of the present disclosure. [Figure 7]Figure 7 shows a signaling chart illustrating an exemplary implementation of a process for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. [Figure 8] Figure 8 is a signaling chart illustrating an example of a process for obtaining security information for relay discovery in some other exemplary embodiments of the present disclosure. [Figure 9] Figure 9 is a signaling chart illustrating an example of a process for obtaining security information for relay discovery in some other exemplary embodiments of the present disclosure. [Figure 10] Figure 10 is a signaling chart illustrating an example of a process for obtaining security information for relay discovery in still other exemplary embodiments of the present disclosure. [Figure 11] Figure 11 is a signaling chart illustrating an example of a process for obtaining security information for relay discovery in still other exemplary embodiments of the present disclosure. [Figure 12] Figure 12 shows a flowchart of a method implemented in a first network device in some exemplary embodiments of the present disclosure. [Figure 13] Figure 13 shows a flowchart of a method implemented in a terminal device in some exemplary embodiments of the present disclosure. [Figure 14] Figure 14 shows a flowchart of a method implemented in a first Policy Control Function (PCF) device in some exemplary embodiments of the present disclosure. [Figure 15] Figure 15 shows a flowchart of a method implemented in a second network device in some exemplary embodiments of the present disclosure. [Figure 16] Figure 16 shows a flowchart of a method implemented in a second PCF device in some exemplary embodiments of the present disclosure. [Figure 17] Figure 17 shows a simplified block diagram of an apparatus suitable for implementing the exemplary embodiments of the present disclosure. [Figure 18] Figure 18 shows a block diagram of an exemplary computer-readable medium in an exemplary embodiment of the present disclosure. Throughout the drawings, the same or similar reference figures represent the same or similar elements. [Modes for carrying out the invention]

[0022] Next, the principles of this disclosure will be described with reference to several exemplary embodiments. These exemplary embodiments are provided for illustrative purposes only and are intended to help those skilled in the art understand and implement this disclosure, and should not be considered to imply any limitation on the scope of this disclosure. The disclosures described herein may be implemented in various other ways than those described below.

[0023] In the following description and claims, unless otherwise defined, all technical and scientific terms used herein have the same meanings as those generally understood by those skilled in the art to which this disclosure belongs.

[0024] References in this disclosure to “one embodiment,” “embodiment,” “exemplary embodiment,” etc., indicate that the embodiments described may include certain features, structures, or characteristics, but not all embodiments are required to include such features, structures, or characteristics. Furthermore, such expressions do not necessarily refer to the same embodiment. In addition, if certain features, structures, or characteristics are described in relation to an exemplary embodiment, it is assumed that any influence on such features, structures, or characteristics in relation to other exemplary embodiments, whether explicitly stated or not, is within the knowledge of those skilled in the art.

[0025] In this specification, terms such as “first” and “second” may be used to describe various elements, but it should be understood that these elements should not be limited by these terms. These terms are used merely to distinguish one element from another. For example, without departing from the scope of the exemplary embodiments, the first element may be referred to as the second element, and similarly, the second element may be referred to as the first element. As used herein, the terms “and / or” include any one or more of the listed terms and all combinations thereof.

[0026] The terms used herein are for illustrative purposes only and are not intended to limit any exemplary embodiment. Where used herein, the singular forms “a,” “an,” and “the” are intended to include the plural form unless the context clearly indicates otherwise. Where used herein, the terms “comprises,” “comprising,” “has,” “having,” “includes,” and / or “including” identify the presence of the described features, elements, and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0027] When used in this application, the term "circuit" means (a) Hardware-only circuit implementation (such as implementation of analog and / or digital circuits only), (b) A combination of hardware circuitry and software, for example (where applicable), (i) combination of analog and / or digital hardware circuits and software / firmware, (ii) A part that works in cooperation with software (including digital signal processors), software and memory(s), and hardware processor(s)(s) to enable devices such as mobile phones and servers to perform various functions), (c) Hardware circuits (multiple) and processors (multiple), such as microprocessors (multiple) or parts of microprocessors (multiple), that require software (e.g., firmware) for operation, but may not be present when not required for operation. It may refer to one, more, or all of these.

[0028] This definition of circuit applies to all uses of the term in this application, including in the claims. As a further example, in the use of this embodiment, the term circuit also includes not only a hardware circuit or processor (or more processors) or a part of a hardware circuit or processor and the software and / or firmware implementation associated therewith. The term circuit also includes, for example, a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device, where applicable to the elements of a particular claim.

[0029] As used herein, the term “communication network” refers to a network conforming to any appropriate communication standard, such as fifth-generation (5G) systems, Long-Term Evolution (LTE), LTE-Advanced (LTE-A), Broadband Code Division Multiple Access (WCDMA®), High-Speed ​​Packet Access (HSPA), and Narrowband Internet of Things (NB-IoT). Furthermore, communication between terminal devices and network devices in a communication network may be carried out in accordance with any appropriate generation of communication protocol, including but not limited to first-generation (1G), second-generation (2G), 2.5G, 2.75G, third-generation (3G), fourth-generation (4G), 4.5G, fifth-generation (5G) New Radio (NR) communication protocols, and / or any other protocols currently known or to be developed in the future. Exemplary embodiments of this disclosure can be applied to a variety of communication systems. Given the rapid development of communications, there will, of course, be future communication technologies and systems to which this disclosure can be embodied. This disclosure should not be considered to be limited to the aforementioned systems only.

[0030] As used herein, the term “Network device” refers to a node in a communications network from which terminal devices access the network and receive services. Depending on the terminology and technology applied, a network device may refer to a base station (BS) or access point (AP), such as a node B (NodeB, or NB), an evolved node B (eNodeB, or eNB), an NR next-generation node B (gNB), a remote radio unit (RRU), a radio header (RH), a remote radio head (RRH), or low-power nodes such as relays, femto, or pico. A RAN split architecture includes a gNB-CU (centralized unit, hosting RRC, SDAP, PDCP) that controls multiple gNB-DUs (distributed units, hosting RLC, MAC, and PHY).

[0031] The term "terminal device" refers to any end device capable of wireless communication. Examples, though not limited to, include communication equipment, user equipment (UE), subscriber station (SS), mobile subscriber station, mobile station (MS), or access terminal (AT). Terminal devices include, but are not limited to, mobile phones, cellular phones, smartphones, voice over IP (VoIP) phones, wireless local loop phones, tablets, wearable devices, personal digital assistants (PDAs), portable computers, desktop computers, image capture devices such as digital cameras, game terminals, music storage and playback appliances, in-vehicle wireless terminal devices, wireless endpoints, mobile stations, laptop embedded devices (LEEs), laptop mounted devices (LMEs), USB dongles, smart devices, wireless customer premises equipment (CPEs), Internet of Things (IoT) devices, wearables such as watches, head-mounted displays (HMDs), vehicles, drones, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in the context of industrial and / or automated processing chains), consumer electronics, and devices operating on commercial and / or industrial wireless networks. In the following description, the terms “terminal device,” “communication equipment,” “terminal,” “user equipment,” and “UE” may be used interchangeably.

[0032] The functions described in this embodiment may be performed in fixed network nodes and / or wireless network nodes in various exemplary embodiments, but in other exemplary embodiments, the functions may be implemented in user equipment (such as a mobile phone or tablet computer or laptop computer or desktop computer or mobile IoT device or fixed IoT device). The user equipment in this embodiment may appropriately include, for example, the corresponding functions described in relation to fixed network nodes and / or wireless network nodes. The user equipment may be a user device and / or a control device such as a chipset or processor configured to control the user device when installed therein. Examples of such functions include bootstrap server functions and / or home subscriber servers, which can be implemented in user equipment by providing the user equipment with software configured to run on the user equipment in terms of these functions / nodes.

[0033] Figure 1 shows an exemplary communication environment 100 in which exemplary embodiments of the present disclosure may be implemented. The environment 100 may include a first home public land mobile network (HPLMN) 110 and a second HPLMN 120.

[0034] The first terminal device 112 can use the subscription to the first HPLMN 110. The first terminal device 112 can communicate with the first network device 114 and the first PCF 116 within the first HPLMN 110.

[0035] In some exemplary embodiments, the first network device 114 may include a 5G Direct Discovery Name Management (DDNMF) device or a ProSe Key Management (PKMF) device.

[0036] The second terminal device 122 can use the subscription of the second HPLMN 120. The second terminal device 122 can communicate with the second network device 124 and the second PCF 126 of the second HPLMN 120.

[0037] In some exemplary embodiments, the second network device 124 may include a 5G Direct Discovery Name Management (DDNMF) device or a ProSe Key Management (PKMF) device.

[0038] It should be understood that the number of devices is merely for the purpose of facilitating understanding and does not imply any limitations. The communication environment 100 may include any suitable number or type of devices adapted to implement embodiments of the present disclosure.

[0039] Communication in communication environment 100 may be carried out according to any suitable communication protocol(s), including but not limited to first-generation (1G), second-generation (2G), third-generation (3G), fourth-generation (4G), fifth-generation (5G), or future sixth-generation (6G) cellular communication protocols, such as wireless local network communication protocols like IEEE 802.11, and / or other protocols currently known or to be developed in the future. Furthermore, communication may utilize suitable wireless communication technologies, including but not limited to code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplexing (FDD), time division duplexing (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiple access (OFDM), discrete Fourier transform spread OFDM (DFT-s-OFDM), and / or any other technologies currently known or to be developed in the future.

[0040] In some exemplary embodiments, the communication environment 100 may support proximity-based service (ProSe) functions such as 5G ProSe and 4G ProSe. The following describes exemplary embodiments of the disclosure, using 5G ProSe as an example. However, the disclosure may also be applicable to 4G ProSe or any future ProSe.

[0041] 5G ProSe functionality may include 5G ProSe direct discovery, 5G ProSe direct communication, and 5G ProSe UE-to-UE (U2N) relay.

[0042] In the 5G ProSe UE-to-network relay function, the first terminal device 112 connects to the second terminal device 122 via the PC5 interface using 5G ProSe direct communication, and can communicate with the data network via the second terminal device 122 and the 5G network. In this regard, the first terminal device 112 may be referred to as a remote terminal device or remote user equipment (UE), and the second terminal device 122 may be referred to as an inter-UE (U2N) relay.

[0043] To perform 5G ProSe direct communication between the first terminal device 112 and the second terminal device 122, the first terminal device 112 and the second terminal device 122 can perform a 5G ProSe direct discovery procedure using security information for relay discovery. Thus, it is necessary to obtain security information for relay discovery.

[0044] Figure 2 is a signaling chart showing security procedure 200 for the restricted 5G ProSe direct discovery model A.

[0045] In procedure 200, steps 211-214 relate to the Announcing UE202.

[0046] In step 211, in order to obtain the ProSe code for notification and the associated security material, notification UE202 sends a discovery request message containing the Restricted ProSe Application User ID (RPAUID) to 5G DDNMF205 within its HPLMN. Furthermore, notification UE202 must include the PC5 UE security features, including a list of encryption algorithms supported by the UE, in the discovery request message.

[0047] In the case of 5G ProSe UE-to-Network Relay discovery, the 5G ProSe UE-to-Network Relay acts as an Notice UE202 and sends a Relay Discovery Key Request instead of a Discovery Request. The Relay Discovery Key Request message includes the Relay Service Code (RSC) and the 5G ProSe UE-to-Network Relay's PC5 security function.

[0048] In step 212, the 5G DDNMF205 can check for notification approval with the ProSe application server. If 5G ProSe UE-network relay discovery is successful, this step is skipped.

[0049] In 213, if notification UE202 is roaming, the HPLMN and 5G DDNMF205 within VPLMN204 of notification UE202 exchange notification authentication.

[0050] In step 214, the 5G DDNMF205 in the HPLMN of notification UE202 returns the ProSe restriction code and the corresponding Code-Sending Security Parameters, along with the CURRENT_TIME and MAX_OFFSET parameters. The Code-Sending Security Parameters provide the information necessary for notification UE202 to protect the transmission of the ProSe restriction code and are stored together with the ProSe restriction code. Notification UE202 performs the same operation using CURRENT_TIME and MAX_OFFSET. The 5G DDNMF205 in the HPLMN of notification UE202 must include the selected PC5 encryption algorithm in the Discovery Response message. In step 211, the 5G DDNMF205 determines the selected PC5 encryption algorithm based on the ProSe restriction code and the received PC5 UE security capability. The UE stores the selected PC5 encryption algorithm together with the ProSe restriction code.

[0051] Furthermore, the 5G DDNMF205 within the HPLMN of notification UE202 can associate the ProSe restriction code with the PC5 security policy and include the PC5 security policy in the discovery response message.

[0052] In the case of 5G ProSe UE-network relay discovery, a relay discovery key response is used instead of a discovery response, and an RSC is used instead of a ProSe restriction code. The response message contains the discovery security material.

[0053] Please note that 5G DDNMF can obtain PC5 security policies in different ways (e.g., from PCF, from the ProSe application server, or based on the local configuration).

[0054] Steps 215-220 relate to the monitoring UE201.

[0055] In step 215, the monitoring UE201 sends a discovery request message containing the RPAUID and its PC5 UE security capabilities to the 5G DDNMF203 within its HPLMN in order to be authenticated to monitor one or more restricted ProSe application user IDs.

[0056] For 5G ProSe UE-to-network relay discovery, the 5G ProSe remote UE acts as a monitoring UE201 and sends a relay discovery key request instead of a discovery request. The relay discovery key request message includes RSC and the PC5 security function of the 5G ProSe remote UE.

[0057] In step 216, the 5G DDNMF203 within the HPLMN of the monitoring UE201 sends an authentication request to the ProSe application server. Based on the authentication settings, if the RPAUID is authenticated to discover at least one of the target RPAUIDs contained in the application-level container, the ProSe application server returns an authentication response.

[0058] If 5G ProSe UE-network relay discovery occurs, this step is skipped.

[0059] In step 217, if the discovery request is authorized and the PLMN ID in the target RPAUID indicates a different PLMN, the 5G DDNMF 203 in the HPLMN of the monitoring UE 201 contacts the 5G DDNMF of the indicated PLMN (i.e., the 5G DDNMF in the HPLMN of the notification UE 202) by sending a discovery key request message containing the PC5 UE security capability received in step 215.

[0060] For 5G ProSe UE-network-to-network relay discovery, the relay discovery key request and RSC are used instead of the discovery request and RPAUID.

[0061] In 218, the 5G DDNMF205 within the HPLMN of notification UE202 can exchange authorization messages with the ProSe application server 206.

[0062] If 5G ProSe UE-network relay discovery occurs, this step is skipped.

[0063] In step 219, if the PC5 UE security capability in step 5 includes the selected PC5 encryption algorithm, the 5G DDNMF205 in the HPLMN of the notification UE202 responds to the 5G DDNMF203 in the HPLMN of the monitoring UE201 with a discover key response message containing the ProSe restriction code, the corresponding code-receiving security parameters, an optional discover user integrity key (DUIK), and the selected PC5 encryption algorithm (based on the information / key stored in step 214). The Code-Receiving Security Parameters provide the information necessary for the monitoring UE201 to remove the protection applied by the notification UE202. The DUIK must be included as another parameter if the Code-Receiving Security Parameters indicate that the monitoring UE201 will use matching reports for MIC checks. The 5G DDNMF203 in the HPLMN of the monitoring UE201 stores the ProSe restriction code and the discover user integrity key (if received other than the Code-Receiving Security Parameters).

[0064] In 5G ProSe UE-network relay discovery, a relay discovery key response is used instead of a discovery response, and an RSC is used instead of a ProSe restriction code. The response message contains the discovery security material.

[0065] Notification UE202's HPLMN's 5G DDNMF205 can send the PC5 security policy associated with the ProSe restriction code to monitoring UE201's HPLMN's 5G DDNMF203.

[0066] It should be noted that there are two possible configurations for integrity checks: one where the MIC is checked by the 5G DDNMF203 on the monitoring UE201, and another where the MIC is checked on the monitoring UE201 side. The 5G DDNMF determines which configuration to use, assigns the ProSe restriction code to be monitored, and signals the monitoring UE201 with Code-Receiving Security Parameters.

[0067] Please note that the selected PC5 encryption algorithm will be associated with the ProSe restricted code.

[0068] In 220, the 5G DDNMF203 within the HPLMN of the monitoring UE201 returns the discovery filter and code reception security parameters along with the CURRENT_TIME and MAX_OFFSET parameters, as well as the selected PC5 encryption algorithm. The monitoring UE201 performs the same operation for CURRENT_TIME and MAX_OFFSET. The UE stores the discovery filter, code reception security parameters, and selected PC5 encryption algorithm along with the ProSe restriction code.

[0069] If the 5G DDNMF203 in the HPLMN of the monitoring UE201 receives a PC5 security policy associated with the ProSe restriction code in step 219, the 5G DDNMF of the monitoring UE201 forwards the PC5 security policy to the monitoring UE201.

[0070] Steps 11 and 12 are performed on PC5.

[0071] In step 221, the UE initiates an announcement if the UTC-based counter provided by the system associated with the discovery slot is within the MAX_OFFSET of the ProSe clock of notification UE202 and the validity timer has not expired. The UE forms and protects the discovery message. The four least significant bits of the UTC-based counter are sent along with the protected discovery message.

[0072] In step 222, the monitoring UE201 listens for discovery messages that satisfy its discovery filter if the UTC-based counter associated with its discovery slot is within the MAX_OFFSET of the monitoring UE's ProSe clock. It processes the messages to find such matching messages. If the monitoring UE201 is not requested to send a matching report for MIC checking, it stops at this step for security reasons. Otherwise, it proceeds to step 223.

[0073] Note that even if the UE independently checks the integrity of discovery messages, this does not prevent the UE from submitting matching reports, as required by TS 23.304. Security features are irrelevant when such matching reports are submitted.

[0074] Steps 13-16 concern the matched monitoring UE201.

[0075] In step 223, if the UE has not previously instructed the 5G DDNMF to check the MIC for any ProSe restricted codes it has discovered, or if the 5G DDNMF has checked the MIC for any ProSe restricted codes and the associated matching report refresh timer (see step 225 for details on this timer) has expired, or if requested in accordance with the procedure specified in TS 23.304, the monitoring UE201 sends a matching report message to the 5G DDNMF203 in the monitoring UE201's HPLMN. The matching report includes the UTC-based counter value with the four least significant bits closest to the monitoring UE201's UTC-based counter associated with the discovered slot, as well as other discovered message parameters, including the ProSe restricted code and MIC. The 5G DDNMF checks the MIC.

[0076] In 224, the 5G DDNMF203 within the HPLMN of the monitoring UE201 can exchange authentication requests (Auth Req) / authentication responses (Auth Resp) with the ProSe application server 206 to verify that the monitoring UE201 is authenticated to discover the notification UE202.

[0077] If 5G ProSe UE-network relay discovery occurs, this step is skipped.

[0078] In step 225, the 5G DDNMF203 within the HPLMN of the monitoring UE201 returns confirmation to the monitoring UE201 that the integrity check has passed. It also provides the CURRENT_TIME parameter for the UE to (re)set the ProSe clock. The 5G DDNMF203 within the HPLMN of the monitoring UE201 includes a matching report refresh timer in its message to the monitoring UE201. The matching report refresh timer indicates the waiting time before the UE sends a new matching report of the ProSe limit code.

[0079] In 226, the 5G DDNMF203 within the HPLMN of the monitoring UE201 can send a matching report information message to the 5G DDNMF205 within the HPLMN of the notification UE202.

[0080] Figure 3 is a signaling chart showing the PC5 security establishment procedure 300 for 5G ProSe UE-network relay communication via the user plane.

[0081] When a 5G ProSe remote UE301 is within coverage, it is provisioned with discovery security material and a ProSe remote user key (UP-PRUK). This security material has an expiration date and becomes invalid after it expires. If the UE does not have valid discovery security material, the 5G ProSe remote UE must connect to the 5G PKMF and obtain new material to use the 5G ProSe UE-to-network relay service.

[0082] Please note that this procedure describes a scenario where the 5G PKMF for the 5G ProSe remote UE differs from the 5G PKMF for the 5G ProSe UE-to-network relay. When both the 5G ProSe remote UE and the 5G ProSe UE-to-network relay are serviced by a single 5G PKMF, the 5G PKMF serves both the 5G PKMF for the 5G ProSe remote UE and the 5G PKMF for the 5G ProSe UE-to-network relay, and no message exchange between the 5G PKMFs is required.

[0083] Steps 310a, 310b, 311a, and 311b are performed when the 5G ProSe remote UE301 is within coverage.

[0084] In 310a, the 5G ProSe remote UE301 obtains a 5G PKMF address from its HPLMN's 5G DDNMF303. Alternatively, the 5G ProSe remote UE301 may be provisioned with a 5G PKMF address by the PCF. If the 5G ProSe remote UE301 is provisioned with a 5G PKMF address, it can access the 5G PKMF directly without requesting it from the 5G DDNMF. If the 5G ProSe remote UE310 cannot access the 5G PKMF using its provisioned 5G PKMF address, the 5G ProSe remote UE301 can request a 5G PKMF address from the 5G DDNMF.

[0085] In 310b, the 5G ProSe remote UE301 securely establishes a connection with the 5G PKMF304 via the PC8 reference point. The security of the PC8 interface depends on Ua security if GBA as defined in TS33.220 is used (see Section 5.2.3.4), and on Ua* security if AKMA as defined in TS33.535 is used (see Section 5.2.5.4). The 5G PKMF304 of the 5G ProSe remote UE301 checks whether the 5G ProSe remote UE301 is authenticated to receive inter-UE relay services, and if the UE is authenticated, the 5G PKMF304 of the 5G ProSe remote UE301 provides discovery security material to the 5G ProSe remote UE301. If the 5G ProSe remote UE301 provides a list of visited networks, the 5G PKMF304 of the 5G ProSe remote UE301 requests discovery security material from the 5G PKMF of the potential 5G ProSe UE-to-network relay for which the 5G ProSe remote UE301 will obtain relay services. The 5G PKMF of the 5G ProSe UE-to-network relay can then include a PC5 security policy in the 5G ProSe remote UE301.

[0086] It should be noted that 5G PKMF can configure the UE's authorization information locally. Otherwise, 5G PKMF will interact with the UE's UDM to obtain the UE's authentication information.

[0087] Please note that the 5G ProSe remote UE301 will be provisioned by the PCF in a list of networks that may be visited for the 5G ProSe UE-to-network relay service (identified by the RSC).

[0088] In step 310c, the 5G ProSe UE-network relay 302 obtains the 5G PKMF address from the HPLMN in the same manner as described in step 310a.

[0089] In step 310d, the 5G ProSe UE-to-network relay 302 securely establishes a connection with the 5G PKMF via the PC8 reference point, similar to step 310b. The 5G PKMF 306 of the 5G ProSe UE-to-network relay 302 checks whether the 5G ProSe UE-to-network relay 302 is authorized to provide the 5G ProSe UE-to-network relay service. If the UE is authorized, the 5G PKMF 306 of the 5G ProSe UE-to-network relay 302 provides the discovered security material to the 5G ProSe UE-to-network relay 302. The 5G PKMF 306 of the 5G ProSe UE-to-network relay 302 may include the PC5 security policy in the 5G ProSe UE-to-network relay 302.

[0090] In 311a, the 5G ProSe remote UE301 sends a PRUK request message to its 5G PKMF. This message indicates that the 5G ProSe remote UE301 is requesting an UP-PRUK from the 5G PKMF. If the 5G ProSe remote UE301 already has an UP-PRUK from this 5G PKMF, the message shall also include the UP-PRUK ID of the UP-PRUK.

[0091] The UP-PRUK ID can take either NAI format or a 64-bit string format. If the UP-PRUK ID is in NAI format, i.e., username@realm, the realm portion must contain the home network identifier (i.e., HPLMN ID). The username portion must contain a 64-bit string.

[0092] In step 311b, the 5G PKMF 304 checks whether the 5G ProSe remote UE 301 is authenticated to receive the inter-UE relay service. This is done by using the ID of the 5G ProSe remote UE 301 associated with the key used to establish a secure connection between the 5G ProSe remote UE 301 and the 5G PKMF in step 310b. If the 5G ProSe remote UE 301 is authenticated to receive the service, the 5G PKMF sends the UP-PRUK and UP-PRUK ID to the 5G ProSe remote UE 301. If the UP-PRUK and UP-PRUK ID are included, the 5G ProSe remote UE 301 stores them and deletes any previously stored for this 5G PKMF.

[0093] In step 312, a discovery procedure is performed between the 5G ProSe remote UE 301 and the 5G ProSe UE-network relay 302 using discovery parameters and discovery security material.

[0094] Steps 313-315 establish secure direct communication between the 5G ProSe remote UE301 and the U2N relay.

[0095] The following describes the authorization and provisioning of ProSe services.

[0096] Generally, in 5GS, the parameters for 5G ProSe direct discovery, 5G ProSe direct communication, and 5G ProSe UE-to-network relay services are: Provisioned by ME It must be composed of UICC. It must be provisioned with ME and configured with UICC. To be provided or updated by the ProSe application server via PCF and / or PC1 reference points. To be provided or updated from PCF to UE, This may be provided to the UE.

[0097] If the same parameters described in sections 5.1.2.1, 5.1.3.1, and 5.1.4.1 are provided from different sources, the UE will... Parameters provided or updated by PCF (including parameters determined by PCF itself and parameters provided to PCF from the ProSe application server), To be provided or updated by the ProSe application server via the PC1 reference point. It must be composed within the drugCC. Provisioned by ME This must be considered in order of priority.

[0098] Parameters provided or updated by the ProSe application server via the PC1 reference point may need to be supplemented with configuration data from the other sources mentioned above.

[0099] Note that the ProSe application server can provision the same ProSe parameters via 5GC or directly to the UE via the PC1 reference point, and that to enable provisioning via the PC1 reference point, the ProSe parameters can be revoked (e.g., deleted) via 5GC.

[0100] The basic principles for service authorization and provisioning of 5G ProSe direct discovery, 5G ProSe direct communication, and 5G ProSe UE-to-network relay services are as follows:

[0101] The PCF for HPLMN can constitute a list of PLMNs that the UE is certified to use 5G ProSe direct discovery for.

[0102] The PCF of HPLMN allows the UE to configure a list of PLMNs that are certified to use 5G ProSe direct communication. The PCF for HPLMN can constitute a list of PLMNs that the UE is certified to operate as a 5G ProSe UE-to-network relay. Certification for 5G ProSe Layer 2 UE-to-network relay and 5G ProSe Layer 3 UE-to-network relay are independent of each other. The HPLMN's PCF can configure a list of PLMNs that are authorized to allow a UE to access 5GC via the 5G ProSe UE-to-network relay (i.e., to operate as a 5G ProSe remote UE). Authorization for access via the 5G ProSe Layer 2 UE-to-network relay and the 5G ProSe Layer 3 UE-to-network relay are independent of each other. HPLMN's PCF merges authorization information from home and other PLMNs and provides the final authorization information to the UE. The PCF of the visited Public Land Mobile Network (VPLMN) or HPLMN can revoke authorization at any time (via H-PCF during roaming) by using the UE Configuration Update procedure for transparent UE policy distribution procedures as defined in Section 4.2.4.3 of TS23.502. The provisioning of ProSe policies / parameters to the UE is controlled by the PCF and can also be triggered by the UE. The PCF provisions one or more of the following ProSe policies / parameters: ProSe policies / parameters for 5G ProSe direct discovery as defined in Section 5.1.2.1, ProSe policies / parameters for 5G ProSe direct communication as defined in Section 5.1.3.1, The ProSe policies / parameters for 5G ProSe Layer 2 and / or Layer 3UE relay as defined in Section 5.1.4.1, The ProSe policies / parameters for 5G ProSe Layer 2 and / or Layer 3 remote UEs as defined in Section 5.1.4.1, The PCF includes 5G ProSe policies / parameters in a policy section identified by a Policy Section Identifier (PSI) as defined in Section 6.1.2.2.2 of TS23.503[9].

[0103] In addition to the above, rules regarding ProSe usage reporting settings and charges can be configured (in advance) within the UE, or they can be provided by the PCF.

[0104] In addition to the above, route selection policies can be configured (in advance) within the UE, as defined in Section 5.11, or provided by the PCF. Route preferences for ProSe services can be provided to the UDR from the ProSe application server, and the PCF can be used to generate and update route selection policies.

[0105] If a 5G ProSe Layer 3 remote UE is using 5G ProSe Layer 3 UE-to-network relay without using Non-3GPP® access InterWorking Function (N3IWF), provisioning and updating of PCF-based 5G ProSe policies / parameters for the 5G ProSe Layer 3 remote UE is not supported.

[0106] Based on the background information, there are two problems with the restricted 5G ProSe direct discovery security procedure, particularly with 5G ProSe UE-to-network relay discovery.

[0107] On the other hand, if the remote UE and the relay candidate belong to different HPLMNs, the remote UE's DDNMF / PKMF cannot know or find the location of the relay candidate's DDNMF / PKMF for the reasons explained below.

[0108] According to 5G DDNMF Discovery in section 4.3.2.2 of TS 23.304, the 5G DDNMF of an HPLMN uses the Network Repository Function (NRF) to discover other 5G DDNMFs of other PLMNs. Based on section 6.3.1 of TS 23.501, the NRF of a source PLMN reaches the NRF of a remote PLMN using the target PLMN ID. However, the 5G DDNMF of a remote UE does not have information on the ID of at least one target or relay candidate HPLMN.

[0109] From the description of "Authorization and Provisioning of ProSe Services," it appears that only the VPLMN or Serving PLMN of a remote UE is provisioned to the remote UE, and the remote UE can report these PLMNs to its DDNMF in a discovery key request, as shown in 310b of Figure 3. However, these PLMNs may be the VPLMN or Serving PLMN of a remote UE and may certainly be different from the HPLMN of a relay. Therefore, there is a clear gap in the current specification when the remote UE and relay UE belong to different HPLMNs, especially when the remote UE or relay UE is roaming.

[0110] Specifically, in Figure 2, at point 217, the remote UE's DDNMF does not know the HPLMN IDs of all relay candidates, and therefore cannot know or find the location of at least one relay candidate's DDNMF.

[0111] On the other hand, if the RSC associated with the discovery is securely supported / authenticated to multiple U2N relay candidates of at least different HPLMNs, the security discovery procedure will not work in the case of U2N relays.

[0112] Based on the current discovery procedure, particularly points 219 and 220 in Figure 2, security parameters and cryptographic algorithms are associated with RSC. If multiple potential U2N relays support RSC, it is impossible to distinguish between security parameters and cryptographic algorithms unless all relays share the same security parameters and algorithms. Since security parameters and cryptographic algorithms are used to protect discovery messages exchanged over the PC5 link, sharing them among all relay candidates, or at least between relays belonging to different HPLMNs, is not secure, or even impossible.

[0113] This disclosure provides a solution for obtaining security information for relay discovery. According to this solution, a first network device of a first HPLMN receives a first request for security information for relay discovery from a terminal device served by the first network device. The first request includes at least a relay service code (RSC). The first network device obtains at least one identity based on the first request. Each of the at least one identity is for one of at least one target relay terminal device groups that support an RSC. In turn, the first network device obtains at least one set of security information based on the at least one identity information. Each of the at least one set of security information is associated with one of at least one target relay terminal device groups. The first network device transmits the at least one set of security information to the terminal device. In this way, the first network device can discover a target DDNMF and distinguish the security information of different groups of target relay terminal devices.

[0114] The principles of this disclosure will be explained below with reference to Figures 4 to 18.

[0115] Figure 4 is a signaling chart showing a process 400 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 400 will be described with reference to Figure 1. Process 400 may include a first terminal device 112 and a first network device 114 in Figure 1. Alternatively, process 400 may include a second terminal device 122 and a second terminal device 124 in Figure 1. Hereinafter, process 400 will be described using the first terminal device 112 and the first network device 114 as an example.

[0116] As shown in Figure 4, the first terminal device 112 transmits a first request for security information for relay discovery to the first network device 114 (410). The first request includes at least the relay service code (RSC).

[0117] Therefore, the first network device 114 receives a first request from the first terminal device 112 for security information for relay discovery.

[0118] The first network device 114 obtains at least one identity based on the first request (420). Each of the at least one identity is for one of the at least one target relay terminal device groups that support RSC. Hereinafter, a target relay terminal device will also be referred to as a target relay UE, target relay, relay candidate terminal device, relay candidate UE, or relay candidate.

[0119] Next, the first network device 114 obtains at least one set of security information based on at least one identity information (430). Each of the at least one set of security information is associated with one of the at least one target relay terminal device groups.

[0120] The first network device 114 transmits at least one set of security information to the first terminal device 112 (450).

[0121] Therefore, the first terminal device 112 receives at least one set of security information from the first network device 114.

[0122] Sequentially, the first terminal device 112 performs relay discovery based on at least one set of security information (460).

[0123] Process 400 allows the first network device 114 to discover the target DDNMF and distinguish between different groups of security information of the target relay terminal devices.

[0124] In some exemplary embodiments, the first network device 114 can obtain a set of security information associated with a relay restriction identity (ID). The relay restriction ID may be generated based on the identity of the RSC and the group of target relay terminal devices. The first network device 114 can transmit the set of security information associated with the relay restriction ID.

[0125] In some exemplary embodiments, the first network device 114 may optionally construct a list of security information for relay discovery before transmitting at least one set of security information (440). Each element in the list may be associated with one of the sets of at least one set of security information.

[0126] In some exemplary embodiments, each element in the list may be associated with a set of security information and a relay restriction ID associated with that set of security information. Table 1 shows an example of a list. [Table 1]

[0127] In Table 1, each row may represent an element of the list of security information for relay discovery. Each element is associated with a set of security information for a group of target relay terminal devices and a relay restriction ID. For example, security information set #1 is associated with relay restriction ID #1.

[0128] Please note that the number of security information sets and relay restriction IDs associated with those sets are illustrative. More or fewer security information sets and relay restriction IDs may apply to this disclosure.

[0129] In some exemplary embodiments, each of the at least one set of security information may include at least one of the following: security parameters for relay discovery, or a PC5 encryption algorithm, or a discovery user integrity key (DUIK) for relay discovery.

[0130] In some exemplary embodiments, the first PCF device 116 may be configured to have the identity of at least one target relay terminal device belonging to the first HPLMN 110 and supporting RSC. Similarly, the second PCF device 126 may consist of the ID of at least one target relay terminal device belonging to the second HPLMN 120 and supporting RSC. In such exemplary embodiments, the first network device 114 can obtain at least one identity from the first PCF device 116 within the first HPLMN 110. This will be illustrated with reference to Figure 5.

[0131] Figure 5 is a signaling chart showing a process 500 for obtaining security information for relay discovery in some exemplary embodiments of this disclosure. For illustrative purposes, process 500 will be described with reference to Figure 1. Process 500 may include the first network device 114 and the first PCF device 116 in Figure 1.

[0132] As shown in Figure 5, the first network device 114 sends a second request for at least one identity to the first PCF device 116 (510). Each of the at least one identity is for one of at least one target relay terminal device groups that support RSC. The second request includes at least RSC.

[0133] Therefore, the first PCF device 116 receives a second request from the first network device 114 for at least one identity.

[0134] The first PCF device 116 obtains at least one identity based on the second request.

[0135] Next, the first PCF device 116 sends a second response to the second request to the first network device 114 (530). The second response includes at least one identity.

[0136] Therefore, the first network device 114 receives a second response that includes at least one identity.

[0137] In some exemplary embodiments, the first network device 114 may consist of the identity of at least one target relay terminal device belonging to the first HPLMN 110 and supporting RSC. Similarly, the second network device 124 may consist of the identity of at least one target relay terminal device belonging to the second HPLMN 120 and supporting RSC.

[0138] In such exemplary embodiments, if a first group of target relay terminal devices from at least one group belongs to the first HPLMN 110, the first network device 114 can locally obtain a first identity for the first group of target relay terminal devices. The first network device 114 can then locally obtain a first set of security information associated with the first group of target relay terminal devices.

[0139] In an exemplary embodiment, if a second group of target relay terminal devices from at least one group belongs to the second HPLMN 120, the first network device 114 may obtain a second set of security information associated with the second group of target relay terminal devices from the second network device 124. This will be illustrated with reference to Figure 6.

[0140] Figure 6 is a signaling chart showing a process 600 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 600 will be described with reference to Figure 1. Process 600 may include the first network device 114 and SSNND 124 in Figure 1.

[0141] As shown in Figure 6, the first network device 114 sends a third request to the second network device 124 for a second set of at least one piece of security information for the RSC (610). The third request includes at least the RSC.

[0142] Therefore, the second network device 124 receives a third request from the first network device 114 for a second set of at least one security information for the RSC.

[0143] The second network device 124 obtains a second set of at least one security information based on the third request (620). Each of the second sets of security information is associated with a second group of target relay terminal devices belonging to the second HPLMN 120.

[0144] Next, the second network device 124 sends a third response 630 to the first network device 114 for the third request. The third response includes at least one second set of security information.

[0145] Several embodiments of processes 400, 500, and 600 will be described below with reference to Figures 7 to 11.

[0146] In the embodiments shown in Figures 7 to 11, remote UE and U2N relay are used as examples of the first terminal device 112 and the second terminal device 122, respectively. DDNMF or PKMF are used as examples of the first network device 114 and the second network device 124, respectively. Furthermore, the first HPLMN 110 is configured with PLMN ID #1, and the second HPLMN 120 is configured with PLMN ID #2.

[0147] Figure 7 is a signaling chart showing a process 700 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, the process 700 will be described with reference to Figure 1. The process 700 may involve a first terminal device 112 (e.g., remote UE 112), a second terminal device 122 (e.g., U2N relay 122), a first network device 114 (e.g., DDNMF 114), a first PCF device 116, a second network device 124 (e.g., DDNMF 124), and a second PCF device 126, as shown in Figure 1.

[0148] In process 700, the first PCF device 116 belongs to the first HPLMN 110 and consists of the identity of at least one target relay terminal device that supports RSC. Similarly, the second PCF device 126 belongs to the second HPLMN 120 and consists of the identity of at least one target relay terminal device that supports RSC.

[0149] Furthermore, in process 700, each of at least one target relay terminal device group includes a single target relay terminal device, and the identity for the group of target relay terminal devices includes a relay identity for discovery.

[0150] As shown in Figure 7, at 701, the U2N relay 122 sends a discovery key request to its DDNMF 124 to obtain security information for relay discovery to protect the PC5 discovery message. The request may include the RSC and security capabilities of the U2N relay 122.

[0151] The operation at 701 can be considered an embodiment of the operation at 410 in Figure 4.

[0152] In 702, the DDNMF124 of the U2N relay 122 generates a relay limit ID for the U2N relay 122 with an active timer. The relay limit ID is associated with the RSC and the discoverable relay identity of the U2N relay 122. Hereafter, the discoverable relay identity will also be referred to as the "relay ID" for simplicity. For example, the relay ID may include the HPLMN ID of the U2N relay 122 (e.g., PLMN ID#2). Next, the DDNMF124 retrieves the security information associated with the relay limit ID. For example, the DDNMF124 can generate security parameters and select a PC5 encryption algorithm.

[0153] Next, DDNMF124 sends a discovery key response to U2N relay 122. The response includes the RSC, ProSe restriction code and enable timer, code-specific security parameters and selected PC5 encryption algorithm, CURRENT_TIME, MAX_OFFSET, and an optional PC5 security policy.

[0154] The operation at 702 can be considered an implementation example of the operation at 420, 430, 440, and 450 in Figure 4.

[0155] In step 703, the remote UE112 sends a discovery key request to its DDNMF114 to obtain relay discovery security information to protect the PC5 discovery message. This request may include the remote UE112's UE identity, RSC, and security features.

[0156] The operation at 703 can be considered another embodiment of the operation at 410 in Figure 4.

[0157] In 704, the DDNMF114 of the remote UE112 sends a request to its PCF device 116 to obtain the identity of a relay candidate that supports the remote UE112's RSC. This request may include the UE identity and RSC of the remote UE112.

[0158] The operation at 704 can be considered an implementation example of the operation at 510 in Figure 5.

[0159] In step 705, the PCF device 116 of the remote UE 112 locally obtains the HPLMN ID of the relay candidate based on the RSC and local configuration.

[0160] In 706a, the PCF device 116 of the remote UE 112 locally obtains the relay candidate IDs for relay candidates belonging to the same HPLMN of the remote UE 112 based on the RSC and local configuration.

[0161] In 706b, for relay candidates belonging to different HPLMNs of the remote UE112, the PCF device 116 of the remote UE112 obtains the identity of the relay candidates from the PCF device of the other PLMN. For example, for relay candidates belonging to the second HPLMN120, the PCF device 116 of the remote UE112 obtains the identity of the relay candidates from the PCF device 126.

[0162] In 706b.1, the PCF device 116 of the remote UE 112 sends a request to the PCF device 126 of the U2N relay 112 for the identity of the relay candidate belonging to the second HPLMN 120. This request is also referred to as "get relay candidate request". This request may include the PLMN ID#1 of the first HPLMN 110 of the remote UE 112 and RSC.

[0163] In 706b.2, the PCF device 116 of the remote UE 112 receives a response to “Receive relay candidate request.” This response is also referred to as “Receive relay candidate response.” “Receive relay candidate response” may include a list of PLMN ID #2, RSC, and relay IDs of the second HPLMN 120.

[0164] The operations in 705, 706a, 706b.1, and 706b.2 can be considered exemplary implementations of the operation in 520 of Figure 5.

[0165] In some implementations, the operation in 706a, 706b.1, and 706b.2 may be repeated for each HPLMN of the relay candidate.

[0166] In 707, the PCF device 116 of the remote UE 112 sends a response to the DDNMF 114 of the remote UE 112. This response is also referred to as "relay candidate response received". This response may include the UE identity of the remote UE 112, the RSC, and a list of relay IDs for the relay candidates.

[0167] The operation at 707 can be considered an implementation example of the operation at 530 in Figure 5.

[0168] In 708a, if relay candidates belong to the same HPLMN of the remote UE112, DDNMF114 generates a relay restriction ID for relay candidates with a valid timer. The relay restriction ID is associated with the RSC and the relay ID of the relay candidate. Next, DDNMF114 retrieves the security information associated with the relay restriction ID. For example, DDNMF114 can generate security parameters associated with the relay restriction ID, such as DUIK, and select a PC5 encryption algorithm.

[0169] In 708b.1, if a relay candidate belongs to a different HPLMN, the DDNMF114 of the remote UE112 sends a Discovery Key Request to the DDNMF of the relay candidate's HPLMN to obtain security information associated with the RSC. For example, the DDNMF114 of the remote UE112 sends a Discovery Key Request to the DDNMF124 of the second HPLMN120. The DDNMF114 of the remote UE112 can discover the relay candidate's DDNMF based on the PLMN ID of the relay candidate's HPLMN, which may be part of the relay candidate's relay ID. The request may include security features of the remote UE112, the RSC, and the relay candidate's relay ID.

[0170] The operation in 708b.1 can be considered as an embodiment of the operation in 610 of Figure 6.

[0171] In 708b.2, the DDNMF114 of the remote UE112 receives a discovery key response from the DDNMF124 of the U2N relay 122. This response may include a valid timer, security parameters, DUIK, and a relay restriction ID for a relay candidate having a selected PC5 encryption algorithm associated with the relay restriction ID. The relay restriction ID is associated with the RSC and relay ID.

[0172] The operation in 708b.2 can be considered an implementation example of the operation in 630 of Figure 6.

[0173] The operation in 708a, 708b.1, and 708b.2 in some embodiments may be repeated for relay candidates.

[0174] In 709, the DDNMF114 of the remote UE112 constructs a list of relay restriction IDs with corresponding validity timers, code security parameters, DUIK, and PC5 encryption algorithms.

[0175] The operation at 709 can be considered an implementation example of the operation at 440 in Figure 4.

[0176] In 710, the DDNMF of the remote UE112 sends a discovery key response to the remote UE112. The response may include the RSC, an optional PC5 security policy, CURRENT_TIME, MAX_OFFSET, and a list of (relay limit ID, valid timer, Code-Rcv-SecParams (i.e., security parameters), and the selected (Chosen) PC5 encryption algorithm).

[0177] CURRENT_TIME contains the current UTC-based time in 5G DDNMF. The UE can obtain UTC time from available sources (depending on the available source), such as RAN via SIB9, NITZ, NTP, GPS, and the Ub interface (within the GBA).

[0178] The MAX_OFFSET parameter is used to limit the attacker's ability to successfully replay discovery messages or to acquire correctly MIC'd discovery messages for later use. This is achieved by using MAX_OFFSET as the maximum difference between a UTC-based counter associated with the discovery slot and the ProSe clock held by the UE.

[0179] The operation at 710 can be considered an implementation example of the operation at 450 in Figure 4.

[0180] In 711, the remote UE112 and U2N relay 122 perform relay discovery via PC5. The discovery message is protected by at least one set of security information. Each of the at least one set of security information is associated with a relay restriction ID (which is per relay per RSC).

[0181] The operation at 711 can be considered an embodiment of the operation at 460 in Figure 4.

[0182] Process 700 can be aligned with legacy Advanced Packet System (EPS) / 5G direct discovery procedures, which have been extended to support discovery key requests for relay discovery. Furthermore, Process 700 can reduce the signaling load from the remote UE112 to its HPLMN110.

[0183] Figure 8 shows a signaling chart illustrating a process 800 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 800 will be described with reference to Figure 1. Process 800 may include a first terminal device 112 (e.g., remote UE 112), a second terminal device 122 (e.g., U2N relay 122), a first network device 114 (e.g., DDNMF 114), a first PCF device 116, a second network device 124 (e.g., DDNMF 124), and a second PCF device 126.

[0184] Process 800 is similar to process 700 in that the first PCF device 116 is configured to have the ID of at least one target relay terminal device that belongs to the first HPLMN 110 and supports RSC. Similarly, the second PCF device 126 is configured to have the identity of at least one target relay terminal device that belongs to the second HPLMN 120 and supports RSC.

[0185] Furthermore, process 800 is similar to process 700 in that each of at least one group of target relay terminal devices comprises a single target relay terminal device, and the ID for the group of target relay terminal devices includes a relay ID for discovery.

[0186] The difference between process 800 and process 700 is that interaction between PCF devices of different HPLMNs is avoided, and messages between DDNMFs of two HPLMNs can be reduced.

[0187] Specifically, the operation of 801, 802, 803, 805, 808a, 809, 810, and 811 in process 800 is similar to the operation of 701, 702, 703, 705, 708a, 709, 710, and 711 in process 700. Therefore, the details of these operations are omitted for simplicity.

[0188] The behavior of processes 804, 806, 807, 808b.1, 808b.2, and 808b.3 in process 800 differs from the behavior in process 700.

[0189] In 804, the DDNMF114 of the remote UE112 sends a request to its PCF device 116 to obtain the ID of the HPLMN that supports the remote UE112's RSC. This request may include the UE identity and RSC of the remote UE112. This request is also referred to as the "request to obtain the HPLMN of the relay candidate".

[0190] The operation at 804 can be considered another embodiment of the operation at 510 in Figure 5.

[0191] In 805, the PCF device 116 of the remote UE 112 locally obtains the ID of the relay candidate HPLMN based on the RSC and local configuration.

[0192] The operation at 805 can be considered another embodiment of the operation at 530 in Figure 5.

[0193] In 806, the PCF device 116 of the remote UE 112 sends a response to the DDNMF 114. This response is also referred to as the "response for obtaining the relay candidate HPLMN". The response may include the UE identity, RSC, and a list of PLMN IDs of the remote UE 112. For example, the list of PLMN IDs may include at least one of the IDs of the first HPLMN 110 (e.g., PLMN ID#1) or the ID of the second HPLMN 120 (e.g., PLMN ID#2).

[0194] The operation at 806 can be considered another embodiment of the operation at 530 in Figure 5.

[0195] In 807, if the list of PLMN IDs may include the ID of the first HPLMN110 (e.g., PLMN ID#1), the DDNMF114 of the remote UE112 obtains the relay candidate ID from the PCF device 116 of the remote UE112 based on the RSC.

[0196] The operation at 807 can be considered another embodiment of the operation at 510, 520, and 530 in Figure 5.

[0197] In 808b.1, if the list of PLMN IDs may include the ID of the second HPLMN120 (e.g., PLMN ID#2), the DDNMF114 of the remote UE112 sends a discovery key request to the DDNMF124 of the HPLMN120 to retrieve security information associated with the RSC. This request may include security information for the remote UE112 and the RSC. Note that the request may or may not include the ID of the second HPLMN120 (e.g., PLMN ID#2). This means that security information associated with each relay candidate of the second HPLMN120 must be retrieved.

[0198] The operation in 808b.1 can be considered another embodiment of the operation in 610 of Figure 6.

[0199] In 808b.2, the DDNMF124 of the U2N relay 122 obtains the relay IDs of the relay candidates in the second HPLMN120 from the PCF device 126 based on the RSC. Next, the DDNMF124 generates a relay restriction ID for each relay candidate that has a valid timer. The relay restriction ID is associated with the RSC and the relay ID of the relay candidate. Next, the DDNMF124 obtains the security information associated with the relay restriction ID. For example, the DDNMF124 can generate security parameters and select a PC5 encryption algorithm associated with the relay restriction ID. In turn, the DDNMF124 constructs a list of relay restriction IDs with the corresponding valid timers, code security parameters, and PC5 encryption algorithms.

[0200] In some exemplary embodiments, each element of the list may be associated with a second set of security information and a relay restriction ID associated with the second set of security information. Table 2 shows an example of a list. [Table 2]

[0201] In Table 2, each row may represent an element of a list of security information for relay discovery. Each element may be associated with a second set of security information for the target relay terminal device and relay restriction ID. For example, the second set of security information #3 is associated with the first target relay terminal device and relay restriction ID #3. Relay restriction ID #3 may be generated based on the RSC and the relay ID of the first target relay terminal device.

[0202] Please note that the number of security information sets and the relay restriction IDs associated with those sets are illustrative examples. More or fewer security information sets and relay restriction IDs may apply to this disclosure.

[0203] In 808b.3, the DDNMF114 of the remote UE112 receives a discovery key response from the DDNMF124 of the U2N relay 122. The response may include a list of relay restriction IDs with corresponding validity timers, code security parameters, and PC5 encryption algorithms.

[0204] The operation in 808b.3 can be considered another embodiment of the operation in 630 of Figure 6.

[0205] Figure 9 is a signaling chart showing a process 900 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 900 will be described with reference to Figure 1. Process 900 may include a first terminal device 112 (e.g., remote UE 112), a second terminal device 122 (e.g., U2N relay 122), a first network device 114 (e.g., DDNMF 114), a first PCF device 116, and a second network device 124 (e.g., DDNMF 124) in Figure 1.

[0206] Process 900 is similar to process 800 in that the first PCF device 116 is configured to belong to the first HPLMN 110 and have the identity of at least one target relay terminal device that supports RSC. Similarly, the second PCF device 126 is configured to belong to the second HPLMN 120 and have the identity of at least one target relay terminal device that supports RSC.

[0207] Furthermore, process 900 differs from process 800 in that each of at least one target relay terminal device groups includes multiple target relay terminal devices in either the first HPLMN110 or the second HPLMN120. The identity of the target relay terminal device group includes one of the PLMN identity (ID) of the first HPLMN110 or the second HPLMN120 to which the multiple target relay terminal devices belong, or the group ID of the multiple target relay terminal devices. For example, the group ID may include the PLMN ID of the first HPLMN110 or the second HPLMN120.

[0208] Specifically, the behavior of processes 901, 902, 903, 904, 905, 906, 908b.1, 909, 910, and 911 in process 900 is similar to the behavior of processes 801, 802, 803, 804, 805, 806, 808b.1, 809, 810, and 811 in process 800. Therefore, for the sake of brevity, the details of these behaviors are omitted.

[0209] The operation of 908a and 908b.2 in process 900 differs from the operation in process 800.

[0210] In 908a, if the list of PLMN IDs may include the ID of the first HPLMN110 (e.g., PLMN ID#1), the DDNMF114 on the remote UE112 generates relay restriction IDs for all relay candidates that support the RSC within the first HPLMN110. The relay restriction IDs are associated with the RSC and PLMN ID#1. Next, the DDNMF114 retrieves security information associated with the relay restriction IDs. For example, the DDNMF114 can generate security parameters and select a PC5 encryption algorithm associated with the relay restriction IDs. Furthermore, the DDNMF114 on the remote UE112 can generate a valid timer for the relay restriction IDs.

[0211] In 908b.1, if the list of PLMN IDs may include the ID of the second HPLMN120 (e.g., PLMN ID#2), the DDNMF114 of the remote UE112 sends a discovery key request to the DDNMF124 of the HPLMN120 to retrieve security information associated with the RSC. This request may include security features of the remote UE112 and the RSC. Note that the request may or may not include the ID of the second HPLMN120 (e.g., PLMN ID#2). This means that security information related to all relay candidates of the second HPLMN120 must be retrieved.

[0212] The operation in 908b.1 can be considered another embodiment of the operation in 610 of Figure 6.

[0213] In 908b.2, the DDNMF114 of the remote UE112 receives a discovery key response from the DDNMF124 of the U2N relay 122. This response may include a relay restriction ID with a corresponding valid timer, code security parameters, and PC5 encryption algorithm.

[0214] The operation in 908b.2 can be considered another embodiment of the operation in 630 of Figure 6.

[0215] In some implementations, the operations in 908b.1 and 908b.2 may be repeated for each HPLMN of the relay candidate associated with the RSC.

[0216] Figure 10 is a signaling chart showing a process 1000 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 1000 will be described with reference to Figure 1. Process 1000 may include a first terminal device 112 (e.g., remote UE 112), a second terminal device 122 (e.g., U2N relay 122), a first network device 114 (e.g., DDNMF 114), and a second network device 124 (e.g., DDNMF 124) as shown in Figure 1.

[0217] Process 1000 is similar to process 800 in that each of at least one group of target relay terminal devices comprises a single target relay terminal device, and the ID for the group of target relay terminal devices constitutes the relay ID for discovery.

[0218] Process 1000 differs from Process 800 in that the first network device 114 belongs to the first HPLMN 110 and consists of the ID of at least one target relay terminal device that supports RSC. Similarly, the second network device 124 belongs to the second HPLMN 120 and consists of the identity of at least one target relay terminal device that supports RSC.

[0219] Specifically, the behavior of steps 1001, 1002, 1003, 1008a, 1008b.1, 1008b.4, 1009, 1010, and 1011 in process 1000 is similar to the behavior of steps 801, 802, 803, 808a, 808b.1, 808b.3, 809, 810, and 811 in process 800. Therefore, the details of these behaviors are omitted for brevity.

[0220] The behavior in processes 900 for 1005, 1006, 1008b.2, and 1008b.3 differs from the behavior in process 800.

[0221] In step 1005, the DDNMF114 of the remote UE112 locally obtains the ID of the relay candidate HPLMN based on the RSC and local configuration.

[0222] In 1006, the DDNMF114 of the remote UE112 obtains the relay candidate ID locally based on the RSC and local configuration for relay candidates belonging to the same HPLMN of the remote UE112.

[0223] In 1008b.2, the DDNMF114 of the remote UE112 obtains the relay ID of the relay candidate in the second HPLMN120 based on the RSC and local configuration.

[0224] In 1008b.3, DDNMF124 generates a relay restriction ID for each relay candidate with a valid timer. The relay restriction ID is associated with the RSC and the relay ID of the relay candidate. DDNMF124 also retrieves security information associated with the relay restriction ID. For example, DDNMF124 can generate security parameters and select a PC5 encryption algorithm associated with the relay restriction ID. DDNMF124 then constructs a list of relay restriction IDs with the corresponding valid timers, code security parameters, and PC5 encryption algorithms. An example list is shown in Table 2.

[0225] In some exemplary embodiments, the operations described in 1008b.1 to 1008b.4 may be repeated for each PLMN of relay candidates associated with the RSC.

[0226] Figure 11 is a signaling chart showing a process 1100 for obtaining security information for relay discovery in some exemplary embodiments of the present disclosure. For illustrative purposes, process 1100 will be described with reference to Figure 1. Process 1100 may include a first terminal device 112 (e.g., remote UE 112), a second terminal device 122 (e.g., U2N relay 122), a first network device 114 (e.g., DDNMF 114), and a second network device 124 (e.g., DDNMF 124) as shown in Figure 1.

[0227] Process 1100 is similar to process 900 in that each of at least one target relay terminal device groups includes multiple target relay terminal devices in either the first HPLMN110 or the second HPLMN120. The group ID of the target relay terminal devices includes one of the PLMN identity (ID) of the first HPLMN110 or the second HPLMN120 to which the multiple target relay terminal devices belong, or the group ID of the multiple target relay terminal devices. For example, the group ID may include the PLMN ID of the first HPLMN110 or the second HPLMN120.

[0228] Process 1100 differs from process 900 in that the first network device 114 consists of the ID of at least one target relay terminal device belonging to the first HPLMN 110 and supporting RSC. Similarly, the second network device 124 consists of the identity of at least one target relay terminal device belonging to the second HPLMN 120 and supporting RSC.

[0229] Specifically, the behavior in processes 1100, 1101, 1102, 1103, 1108a, 1108b.1, 1108b.2, 1109, 1110, and 1111 is similar to the behavior in processes 900, 901, 902, 903, 908a, 908b.1, 908b.2, 909, 910, and 911. Therefore, the details of these behaviors are omitted for brevity.

[0230] The behavior in process 1100 at 1105 is different from the behavior in process 900.

[0231] In 1105, the DDNMF114 of the remote UE112 locally obtains the ID of the relay candidate HPLMN based on the RSC and local configuration.

[0232] In some exemplary embodiments, the operations in 1108b.1 and 1108b.2 may be repeated for each PLMN of relay candidates associated with the RSC.

[0233] Figure 12 shows a flowchart of an exemplary method 1200 implemented in a first network device in some exemplary embodiments of the present disclosure. For illustrative purposes, method 1200 is described in view of the first network device 114 with respect to Figure 1.

[0234] In block 1210, the first network device 114 receives a first request for security information for relay discovery from a terminal device served by the first network device. The first request includes at least a relay service code (RSC).

[0235] In block 1220, the first network device 114 obtains at least one identity based on the first request. Each of these at least one identities belongs to one of the at least one target relay terminal device groups that support RSC.

[0236] In block 1230, the first network device 114 obtains at least one set of security information based on at least one identity and RSC. Each of the at least one set of security information is associated with one of at least one target relay terminal device groups.

[0237] In block 1240, the first network device 114 transmits at least one set of security information to the terminal device.

[0238] In some exemplary embodiments, obtaining at least one identity may include obtaining at least one identity from a first policy control function (PCF) device within a first HPLMN.

[0239] In some exemplary embodiments, obtaining at least one identity from a first PCF device may include transmitting a second request to the first PCF device for at least one identity, the second request including at least an RSC, and receiving a second response from the first PCF device for the second request, the second response including at least one identity.

[0240] In some exemplary embodiments, obtaining at least one set of security information may include obtaining a set of security information associated with a relay restriction ID, where the relay restriction ID is generated based on the RSC and an ID for one of at least one target relay terminal device groups. In some exemplary embodiments, transmitting at least one set of security information may include transmitting a set of security information associated with a relay restriction ID.

[0241] In some exemplary embodiments, obtaining at least one set of security information may include generating a first relay restriction ID based on the RSC and a first identity for the first group of target relay terminal devices, on the basis of determining that the first group of target relay terminal devices among at least one group belongs to a first HPLMN, and obtaining a first set of security information associated with the first relay restriction ID.

[0242] In some exemplary embodiments, obtaining at least one set of security information may include sending a third request to a second network device in the second HPLMN for a second set of security information for the RSC, based on the determination that a second group of target relay terminal devices from at least one group belongs to a second HPLMN distinct from the first HPLMN, and receiving a third response from the second network device to the third request, the third response comprising the second set of security information and a second relay restriction ID, the second relay restriction ID being associated with the RSC and a second identity for the second group.

[0243] In an exemplary embodiment, the third request includes a second identity.

[0244] In some exemplary embodiments, obtaining at least one identity may include obtaining at least one identity locally.

[0245] In some exemplary embodiments, each of at least one target relay terminal device groups belongs to either a first HPLMN or a second HPLMN, where the second HPLMN is different from the first HPLMN.

[0246] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a single target relay terminal device, and each of at least one identity includes a discovery relay ID.

[0247] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a plurality of target relay terminal devices, and each of at least one identity includes one of the PLMN identity of a first HPLMN or second HPLMN to which the plurality of target relay terminal devices belong, or a group identity of the plurality of target relay terminal devices.

[0248] Figure 13 shows a flowchart of an exemplary method 1300 implemented in a terminal device in some exemplary embodiments of the present disclosure. For illustrative purposes, method 1300 is described in reference to a first terminal device 112 with respect to Figure 1. Alternatively, method 1300 may be implemented in a second terminal device 122.

[0249] In block 1310, the first terminal device 112 transmits a request for security information for relay discovery to the network device of the Home Public Land Mobile Network (HPLMN). The request includes at least a relay service code (RSC).

[0250] In block 1320, the first terminal device 112 receives at least one set of security information from the network device. Each of the at least one set of security information is associated with one of the at least one target relay terminal device groups that support RSC.

[0251] In block 1330, the first terminal device 112 performs relay discovery based on at least one set of security information.

[0252] In some exemplary embodiments, receiving at least one set of security information may include receiving a set of security information related to a relay restriction ID, wherein the relay restriction ID is associated with an ID for one of the RSC and at least one target relay terminal device group.

[0253] In an exemplary embodiment, each of at least one target relay terminal device groups belongs to either a first HPLMN or a second HPLMN, where the second HPLMN is different from the first HPLMN.

[0254] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a single target relay terminal device, and each of at least one identity includes a discovery relay ID.

[0255] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a plurality of target relay terminal devices, and each of at least one identity includes one of the PLMN identity of a first or second HPLMN to which the plurality of target relay terminal devices belong, or the group identity of the plurality of target relay terminal devices.

[0256] Figure 14 shows a flowchart of an exemplary method 1400 implemented in a first PCF apparatus in some exemplary embodiments of the present disclosure. For illustrative purposes, method 1400 is described in terms of the first PCF apparatus 116 with respect to Figure 1.

[0257] In block 1410, the first PCF device 116 receives a second request from the first network device in the first HPLMN for at least one identity. Each of the at least one identity is for one of at least one target relay terminal device groups that support relay service codes (RSCs), and the second request includes at least an RSC.

[0258] In block 1420, the first PCF device 116 obtains at least one identity based on the second request.

[0259] In block 1430, the first PCF device 116 transmits a second response to the second request to the first network device. The second response includes at least one identity.

[0260] In some exemplary embodiments, each of at least one target relay terminal device groups belongs to either a first HPLMN or a second HPLMN, where the second HPLMN is different from the first HPLMN.

[0261] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a single target relay terminal device, and each of at least one identity includes a relay ID for discovery.

[0262] In some exemplary embodiments, obtaining at least one identity may include, based on a second request, locally obtaining a first identity of the first HPLMN, and for each of the at least one target relay terminal device group, locally obtaining a relay ID for discovery.

[0263] In some exemplary embodiments, obtaining at least one identity may include sending a fourth request for discovery of at least one relay ID for at least one target relay terminal device group to a second PCF device in the second HPLMN, based on the determination that at least one target relay terminal device group belongs to the second HPLMN, and receiving a fourth response from the second PCF device to the fourth request, the fourth response including at least one relay ID.

[0264] In some exemplary embodiments, each of at least one target relay terminal device group comprises a plurality of target relay terminal devices, and at least one identity includes one of the PLMN IDs of a first or second HPLMN to which the plurality of target relay terminal devices belong, or the group ID of the plurality of target relay terminal devices.

[0265] In some exemplary embodiments, obtaining at least one identity may include obtaining a PLMN identity or a group identity based on a second request.

[0266] Figure 15 shows a flowchart of an exemplary method 1500 implemented in a second network device in some exemplary embodiments of the present disclosure. For illustrative purposes, method 1500 is described in view of the second network device 124 with respect to Figure 1.

[0267] In block 1510, the second network device 124 receives a third request from the first network device in the first HPLM for a second set of security information for at least one relay service code (RSC). The request includes at least an RSC, and the second HPLMN is different from the first HPLMN.

[0268] In block 1520, the second network device 124 obtains a second set of at least one piece of security information based on the third request.

[0269] In block 1530, the second network device 124 sends a third response to the first network device. The third response includes at least one second set of security information.

[0270] In some exemplary embodiments, each of at least one second set of security information is associated with a second group of target relay terminal devices belonging to the second HPLMN.

[0271] In some exemplary embodiments, a second group of target relay terminal devices comprises a single target relay terminal device, and the second identity of the second group includes a relay ID for discovery.

[0272] In some exemplary embodiments, the second group of target relay terminal apparatuses comprises a plurality of target relay terminal apparatuses, and the second identity for the second group includes one of a PLMN identity for a second HPLMN to which the plurality of target relay terminal apparatuses belong, or a group identity for the plurality of target relay terminal apparatuses.

[0273] In some exemplary embodiments, obtaining the second set of at least one security information may include generating a second relay restriction ID based on the RSC and the second identity for the second group, and obtaining one of the second set of at least one security information associated with the second relay restriction ID.

[0274] In some exemplary embodiments, transmitting the second set of at least one security information may include transmitting one of the second set of at least one security information associated with the second relay restriction identity.

[0275] In an exemplary embodiment, the third request includes the second identity for the second group of target relay terminal apparatuses.

[0276] Figure 16 shows a flowchart of an exemplary method 1600 implemented in a second PCF apparatus, in some exemplary embodiments of the present disclosure. For illustrative purposes, the method 1600 is described from the perspective of the second PCF apparatus 126 with reference to Figure 1.

[0277] At block 1610, the second PCF apparatus 126 receives a request for at least one identity, each of the at least one identity is for a target relay terminal apparatus that supports a relay service code (RSC), and the request includes at least the RSC.

[0278] In block 1620, the second PCF device 126 obtains at least one identity based on the request.

[0279] In block 1630, the second PCF device 126 sends a response to the request, the response containing at least one identity.

[0280] In some exemplary embodiments, receiving a request for at least one identity includes receiving a request from one of the following: a first network device in a first HPLMN different from the second HPLMN, or a second network device in the second HPLMN.

[0281] In some exemplary embodiments, an apparatus capable of performing any of the methods 1200 (e.g., the first network device 114) may comprise means for performing each operation of the methods 1200. The means may be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module. The apparatus may be implemented as the first network device 114, or may be included in the first network device 114. In some exemplary embodiments, the means may comprise a processor and memory.

[0282] In some exemplary embodiments, the device is a first network device of a first home public land mobile network (HPLMN) and includes means for receiving a first request for security information for relay discovery from a terminal device served by the first network device, wherein the first request includes at least a relay service code (RSC); means for obtaining at least one identity based on the first request, wherein each of the at least one identity is for one of at least one target relay terminal device groups that support an RSC; means for obtaining at least one set of security information based on at least one identity and the RSC, wherein each of the at least one set of security information is associated with one of at least one target relay terminal device groups; and means for transmitting at least one set of security information to a terminal device.

[0283] In some exemplary embodiments, means for obtaining at least one identity may include means for obtaining at least one identity from a first policy control function (PCF) device in a first HPLMN.

[0284] In some exemplary embodiments, means for obtaining at least one identity from a first PCF device may include means for transmitting a second request for at least one identity to the first PCF device, wherein the second request includes at least an RSC, and means for receiving a second response to the second request from the first PCF device, wherein the second response includes at least one identity.

[0285] In some exemplary embodiments, means for obtaining at least one set of security information may include means for obtaining a set of security information associated with a relay restriction ID, wherein the relay restriction ID is generated based on an ID for the RSC and one of at least one target relay terminal device groups. In some exemplary embodiments, means for transmitting at least one set of security information may include means for transmitting a set of security information associated with a relay restriction ID.

[0286] In some exemplary embodiments, means for obtaining at least one set of security information may include means for generating a first relay restriction ID based on an RSC and a first identity for the first group of target relay terminal devices, based on determining that the first group of target relay terminal devices from at least one group belongs to a first HPLMN, and means for obtaining a first set of security information associated with the first relay restriction ID.

[0287] In some exemplary embodiments, means for obtaining at least one set of security information includes means for sending a third request to a second network device in a second HPLMN for a second set of security information for an RSC, based on determining that a second group of target relay terminal devices from at least one group belongs to a second HPLMN different from a first HPLMN; and means for receiving a third response from the second network device for the third request, the third response comprising a second set of security information and a second relay restriction ID, the second relay restriction ID being associated with a second identity for an RSC and a second group.

[0288] In an exemplary embodiment, the third request includes a second identity.

[0289] In some exemplary embodiments, means for obtaining at least one identity may include means for obtaining at least one identity locally.

[0290] In some exemplary embodiments, each of at least one target relay terminal device groups belongs to either a first HPLMN or a second HPLMN, where the second HPLMN is different from the first HPLMN.

[0291] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a single target relay terminal device, and each of at least one identity includes a discovery relay ID.

[0292] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a plurality of target relay terminal devices, and each of at least one identity includes one of the PLMN identity of a first HPLMN or second HPLMN to which the plurality of target relay terminal devices belong, or a group identity of the plurality of target relay terminal devices.

[0293] In some exemplary embodiments, an apparatus (e.g., a first terminal apparatus 112) capable of performing any of the methods 1300 may comprise means for performing each operation of the methods 1300. The means can be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module. The apparatus may be implemented as the first terminal apparatus 112 or may be included in the first terminal apparatus 112. In some exemplary embodiments, the means may comprise a processor and memory.

[0294] In some exemplary embodiments, the apparatus is a means for transmitting a request for security information for relay discovery from a terminal apparatus to a network apparatus in a Home Public Land Mobile Network (HPLMN), wherein the request includes at least a Relay Service Code (RSC); a means for receiving at least one set of security information from the network apparatus, wherein each of the at least one set of security information is associated with one of at least one target relay terminal apparatus group that supports the RSC; and a means for performing relay discovery based on the at least one set of security information.

[0295] In some exemplary embodiments, receiving the at least one set of security information may include receiving the set of security information in association with a relay restriction ID, wherein the relay restriction ID is associated with the RSC and an ID for one of the at least one target relay terminal apparatus group.

[0296] In an exemplary embodiment, each of the at least one target relay terminal apparatus group belongs to a first HPLMN or a second HPLMN, and the second HPLMN is different from the first HPLMN.

[0297] In some exemplary embodiments, each of the at least one target relay terminal apparatus group comprises a single target relay terminal apparatus, and each of the at least one identity comprises a relay ID for discovery.

[0298] In some exemplary embodiments, each of the at least one target relay terminal apparatus group comprises a plurality of target relay terminal apparatuses, and each of the at least one identity includes one of the PLMN identity of the first or second HPLMN to which the plurality of target relay terminal apparatuses belong, or the group identity of the plurality of target relay terminal apparatuses.

[0299] In some exemplary embodiments, an apparatus (e.g., a first PCF apparatus 116) capable of performing any of the methods 1400 may comprise means for performing each operation of the methods 1400. The means may be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module. The apparatus may be implemented as the first PCF apparatus 116 or may be included in the first PCF apparatus 116. In some exemplary embodiments, the means may comprise a processor and memory.

[0300] In some exemplary embodiments, the device is a first policy control function (PCF) device in a first home public land mobile network (HPLMN), comprising means for receiving a second request for at least one identity from a first network device in the first HPLMN, each of the at least one identity being for one of at least one target relay terminal device groups supporting relay service codes (RSCs), the second request including at least an RSC, means for obtaining at least one identity based on the second request, and means for transmitting a second response to the second request to the first network device, the second response including at least one identity.

[0301] In some exemplary embodiments, each of at least one target relay terminal device groups belongs to either a first HPLMN or a second HPLMN. The second HPLMN is different from the first HPLMN.

[0302] In some exemplary embodiments, each of at least one target relay terminal device groups comprises a single target relay terminal device, and each of at least one identity includes a discovery relay ID.

[0303] In some exemplary embodiments, means for obtaining at least one identity may include means for locally obtaining a first identity of a first HPLMN based on a second request, based on determining that at least one target relay terminal device group belongs to a first HPLMN, and means for locally obtaining a relay ID for discovery for each of the at least one target relay terminal device group.

[0304] In some exemplary embodiments, means for obtaining at least one identity may include means for sending a fourth request for discovery of at least one relay ID for at least one target relay terminal device group to a second PCF device of the second HPLMN, based on the determination that at least one target relay terminal device group belongs to the second HPLMN, and means for receiving a fourth response to the fourth request from the second PCF device, wherein the fourth response includes at least one relay ID.

[0305] In some exemplary embodiments, each of at least one target relay terminal device group comprises a plurality of target relay terminal devices, and at least one identity includes one of the PLMN IDs of a first or second HPLMN to which the plurality of target relay terminal devices belong, or the group ID of the plurality of target relay terminal devices.

[0306] In some exemplary embodiments, means for obtaining at least one identity may include means for obtaining a PLMN identity or a group identity based on a second requirement.

[0307] In some exemplary embodiments, an apparatus capable of performing any of Method 1500 (e.g., a second network apparatus 124) may include means for performing each operation of Method 1500. The means can be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module. The apparatus may be implemented as the second network apparatus 124, or may be included in the second network apparatus 124. In some exemplary embodiments, the means may include a processor and memory.

[0308] In some exemplary embodiments, the apparatus in a second network device within a second home public land mobile network (HPLMN) includes means for receiving a third request from a first network device of a first HPLM for a second set of at least one security information for relay service codes (RSCs), wherein the request includes at least RSCs and the second HPLMN is different from the first HPLMN; means for obtaining the second set of at least one security information based on the third request; and means for transmitting a third response to the first network device, wherein the third response includes at least the second set of at least one security information.

[0309] In some exemplary embodiments, each set of at least one second set of security information is associated with a second group of target relay terminal devices belonging to the second HPLMN.

[0310] In some exemplary embodiments, a second group of target relay terminal devices comprises a single target relay terminal device, and the second identity of the second group includes a relay ID for discovery.

[0311] In some exemplary embodiments, a second group of target relay terminal devices comprises a plurality of target relay terminal devices, and the second identity for the second group includes one of the following: a PLMN identity for the second HPLMN to which the plurality of target relay terminal devices belong, or a group identity for the plurality of target relay terminal devices.

[0312] In some exemplary embodiments, means for obtaining at least one second set of security information may include means for generating a second relay restriction ID based on the RSC and a second identity for the second group, and means for obtaining one of the at least one second set of security information associated with the second relay restriction ID.

[0313] In some exemplary embodiments, means for transmitting at least one second set of security information may include means for transmitting one of the at least one second set of security information associated with a second relay-restricted identity.

[0314] In some exemplary embodiments, the third requirement includes a second identity for a second group of target relay terminal devices.

[0315] In some exemplary embodiments, an apparatus capable of performing any of Method 1600 (e.g., a second PCF apparatus 126) may comprise means for performing each operation of Method 1600. The means can be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module. The apparatus may be implemented as a second PCF apparatus 126, or may be included within a second PCF apparatus 126. In some exemplary embodiments, the means may comprise a processor and memory.

[0316] In some exemplary embodiments, the apparatus, in a second PCF device within a second home public land mobile network (HPLMN), comprises means for receiving a request for at least one identity, each of which is for a target relay terminal device supporting a relay service code (RSC), and the request includes at least an RSC; means for obtaining at least one identity based on the request; and means for transmitting a response to the request, the response including at least one identity.

[0317] In some exemplary embodiments, means for receiving requests for at least one identity include means for receiving requests from either a first network device in a first HPLMN different from the second HPLMN, or an SSNND in the second HPLMN.

[0318] Please understand that the details of the exemplary embodiments of this disclosure, as described with reference to Figures 7 to 11, also apply to Methods 1200 to 1600.

[0319] Figure 17 is a simplified block diagram of an apparatus 1700 suitable for carrying out embodiments of the present disclosure. The apparatus 1700 may be provided for implementing communication devices such as a first terminal device 112, a first network device 114, a first PCF device 116, a second terminal device 122, a second network device 124, or a second PCF device 126, as shown in Figure 1. As shown, the apparatus 1700 includes one or more processors 1710, one or more memories 1720 connected to the processors 1710, and one or more communication modules 1740 connected to the processors 1710.

[0320] The communication module 1740 is for bidirectional communication. The communication module 1740 has at least one antenna to facilitate communication. The communication interface can represent any interface necessary for communication with other network elements.

[0321] The processor 1710 may be of any type suitable for a local technology network and, in non-limiting examples, may include one or more of the following: a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. The device 1700 may have multiple processors, such as special-purpose integrated circuit chips that are temporally slaved to a clock that synchronizes the main processor.

[0322] Memory 1720 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 1724, electronically programmable read-only memory (EPROM), flash® memory, hard disks, compact discs (CDs), digital video discs (DVDs), and other magnetic and / or optical storage devices. Examples of volatile memories include, but are not limited to, random-access memory (RAM) 1722, and other volatile memories that do not persist for the power-down duration.

[0323] The computer program 1730 includes computer executable instructions that are executed by the associated processor 1710. The program 1730 may be stored in the ROM 1724. The processor 1710 can perform any appropriate operations and processes by loading the program 1730 into the RAM 1722.

[0324] Embodiments of the present disclosure may be implemented by program 1730 so that the apparatus 1700 can perform any of the processes of the present disclosure, as described with reference to Figures 1 to 16. Embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

[0325] In some exemplary embodiments, program 1730 may be tangibly contained in a computer-readable medium that may be contained in the device 1700 (such as in memory 1720) or in other storage devices accessible by the device 1700. The device 1700 can load program 1730 from the computer-readable medium into RAM 1722 and execute it. The computer-readable medium may include any type of tangible non-volatile storage, such as ROM, EPROM, flash® memory, hard disk, CD, or DVD. Figure 18 shows an example of computer-readable medium 1800 in the form of a CD or DVD. Program 1730 is stored on this computer-readable medium.

[0326] In general, various embodiments of this disclosure may be implemented in hardware or special-purpose circuits, software, logic, or any combination thereof. Some embodiments may be implemented in hardware, while others may be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. Various embodiments of this disclosure are illustrated and described using block diagrams, flowcharts, or any other pictorial representation, but it should be understood that any blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, special-purpose circuits or logic, general-purpose hardware or controllers, or other computing devices, or any combination thereof, in non-limiting illustrative examples.

[0327] This disclosure also provides at least one computer program product stored in contact with a non-transient computer-readable storage medium. The computer program product includes computer-executable instructions, such as those contained in a program module, which are executed on a device on a target real or virtual processor to perform methods 1200 to 1600 as described above with reference to Figures 12 to 16. Generally, a program module includes routines, programs, libraries, objects, classes, components, data structures, etc., that perform a specific task or implement a specific abstract data type. The functions of a program module can be combined or divided among program modules as desired in various embodiments. The machine-executable instructions of a program module can be executed locally or in a distributed device. In a distributed device, the program module can be located on both local and remote storage media.

[0328] Program code for performing the methods of this disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flowchart and / or block diagrams are performed. The program code may run entirely on the machine, partially on the machine, as a standalone software package, partially on the machine, partially on a remote machine, or entirely on a remote machine or server.

[0329] In the context of this disclosure, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like.

[0330] Computer-readable media may be computer-readable signal media or computer-readable storage media. Computer-readable media include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, and semiconductor systems, apparatus, devices, or any suitable combination thereof. More specific examples of computer-readable storage media include electrical connections having one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash® memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0331] Furthermore, although the operations are described in a specific order, this should not be understood as requiring that such operations be performed in a specific order shown, or sequentially, or that all illustrated operations be performed in order to achieve a desired result. In certain circumstances, multitasking and parallel processing may be preferable. Similarly, although some specific implementation details are included in the above description, these should not be interpreted as limiting the scope of this disclosure, but rather as descriptions of features that may be specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented separately or in any preferred subcombination in multiple embodiments.

[0332] While this disclosure has been described in language specific to structural features and / or methodological actions, it should be understood that the disclosure as defined in the attached claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as exemplary forms for carrying out the claims.

Claims

1. The first network device, At least one processor, When executed by the at least one processor, the first network device in the first home public land mobile network (HPLMN) will have at least the following capabilities: Receiving a first request for security information for relay discovery from a terminal device serviced by the first network device, wherein the first request includes at least a relay service code (RSC), Acquire at least one identity based on the first requirement, each of which is for one of at least one group of target relay terminal devices supporting the RSC, Obtaining at least one set of security information based on the at least one identity and the RSC, wherein each of the at least one set of security information is associated with one of the at least one groups of the target relay terminal devices, Transmitting the aforementioned set of at least one piece of security information to the terminal device, Obtaining a set of security information associated with a relay restriction identity, wherein the relay restriction identity is generated based on one identity of at least one group of the RSC and the target relay terminal device, by obtaining the set of at least one security information, Transmitting the set of security information in association with the relay restriction identity, thereby transmitting at least one set of security information, At least one memory that stores instructions to execute, A first network device comprising the following:

2. The first network device is Obtaining the at least one identity from the first policy control function (PCF) device within the first HPLMN, This is used to obtain at least one identity. The first network device according to claim 1.

3. The first network device is Transmitting a second request for at least one identity to the first PCF device, wherein the second request includes at least the RSC, Receiving a second response to the second request from the first PCF device, wherein the second response includes at least one identity, Therefore, the first PCF device is configured to obtain at least one identity. The first network device according to claim 2.

4. The first network device is Based on the determination that the first group of target relay terminal devices among the at least one group belongs to the first HPLMN, Based on the first identity of the first group of the RSC and target relay terminal device, a first relay restriction identity is generated. Obtaining a first set of security information associated with the first relay restriction identity, The first network device according to claim 1, wherein the device is configured to obtain the set of at least one piece of security information.

5. The first network device is Based on the determination that the second group of target relay terminal devices among the at least one group belongs to a second HPLMN that is different from the first HPLMN, To transmit a third request for a second set of security information for the RSC to the second network device within the second HPLMN, Receiving a third response to the third request from the second network device, wherein the third response includes the second set of security information and a second relay restriction identity, the second relay restriction identity being associated with the RSC and the second identity for the second group, The first network device according to claim 1, which causes the device to obtain the set of at least one piece of security information.

6. The first network device according to claim 5, wherein the third requirement includes the second identity.

7. The first network device is Obtaining at least one of the aforementioned identities locally, The first network device according to claim 1, wherein the device is configured to acquire at least one identity.

8. The first network device according to claim 1, wherein each of the at least one group of target relay terminal devices belongs to the first HPLMN or the second HPLMN, and the second HPLMN is different from the first HPLMN.

9. The first network device according to claim 8, wherein each of the at least one group of target relay terminal devices includes a single target relay terminal device, and each of the at least one identity includes a relay identity for discovery.

10. Each of the at least one group of target relay terminal devices comprises a plurality of target relay terminal devices, and each of the at least one identity is The PLMN identity of the first HPLMN or the second HPLMN to which the plurality of target relay terminal devices belong, or The group identity of the aforementioned multiple target relay terminal devices, The first network device according to claim 8, comprising one of the above.

11. A terminal device, At least one processor, When executed by the at least one processor, the terminal device will have at least: To transmit a request for security information for relay discovery to a network device within the Home Public Land Mobile Network (HPLMN), wherein the request includes at least a relay service code (RSC). Receiving at least one set of security information from the network device, wherein each of the at least one set of security information is associated with one of at least one group of target relay terminal devices supporting the RSC, Performing relay discovery based on the aforementioned set of at least one piece of security information, Receiving a set of security information associated with a relay restriction identity, wherein the relay restriction identity is associated with one identity from at least one group of the RSC and the target relay terminal device, by receiving, At least one memory that stores instructions to execute, A terminal device equipped with the following features.

12. The terminal device according to claim 11, wherein each of at least one group of target relay terminal devices belongs to a first HPLMN or a second HPLMN, and the second HPLMN is different from the first HPLMN.

13. The terminal device according to claim 12, wherein each of the at least one group of target relay terminal devices includes a single target relay terminal device, and each of the at least one identity includes a relay identity for discovery.

14. Each of the at least one group of target relay terminal devices comprises a plurality of target relay terminal devices, and each of the at least one identity is The PLMN identity of the first or second HPLMN to which the plurality of target relay terminal devices belong, The group identity of the aforementioned multiple target relay terminal devices, The terminal device according to claim 12, which includes one of the following.

15. It is a device, In a first network device within a first home public land mobile network (HPLMN), means for receiving a first request for security information for relay discovery from a terminal device serviced by the first network device, wherein the first request includes at least a relay service code (RSC), Means for obtaining at least one identity based on the first requirement, wherein each of the at least one identity is for one of at least one groups of target relay terminal devices supporting the RSC, Means for obtaining at least one set of security information based on the at least one identity and the RSC, wherein each of the at least one set of security information is associated with one of the at least one groups of the target relay terminal devices, Means for transmitting the set of at least one security information to the terminal device, Means for obtaining the set of security information associated with a relay restriction identity, wherein the relay restriction identity is generated based on one identity of at least one group of the RSC and the target relay terminal device, A means for transmitting the set of security information in association with the relay restriction identity, A device equipped with the following features.

16. It is a device, A means for transmitting a request for security information for relay discovery from a terminal device to a network device within the Home Public Land Mobile Network (HPLMN), wherein the request includes at least a relay service code (RSC), and a means for transmitting such a request. Means for receiving at least one set of security information from the network device, wherein each of the at least one set of security information is associated with one of at least one groups of target relay terminal devices supporting the RSC, Means for performing relay discovery based on the set of at least one security information, A means for receiving, by receiving, a set of security information associated with a relay restriction identity, wherein the relay restriction identity is associated with one identity from at least one group of the RSC and the target relay terminal device, A device equipped with the following features.

17. In a first network device within a first home public land mobile network (HPLMN), the first network device receives a first request for security information for relay discovery from a terminal device serviced by the first network device, wherein the first request includes at least a relay service code (RSC). Obtaining at least one identity based on the first requirement, each of which at least one identity belongs to one of at least one groups of target relay terminal devices supporting the RSC, Obtaining at least one set of security information based on the at least one identity and the RSC, wherein each of the at least one set of security information is associated with one of the at least one group of the target relay terminal devices, Transmitting the aforementioned set of at least one piece of security information to the terminal device, Obtaining a set of security information associated with a relay restriction identity, wherein the relay restriction identity is generated based on one identity of at least one group of the RSC and the target relay terminal device, by obtaining the set of at least one security information, Transmitting the set of security information in association with the relay restriction identity, thereby transmitting at least one set of security information, Methods that include...

18. The terminal device transmits a request for security information for relay discovery to a network device within the Home Public Land Mobile Network (HPLMN), wherein the request includes at least a relay service code (RSC). Receiving at least one set of security information from the network device, wherein each of the at least one set of security information is associated with one of at least one group of target relay terminal devices supporting the RSC, Performing relay discovery based on the aforementioned set of at least one piece of security information, Receiving a set of security information associated with a relay restriction identity, wherein the relay restriction identity is associated with one identity from at least one group of the RSC and the target relay terminal device, by receiving, Methods that include...

19. A computer-readable medium containing program instructions for causing a device to perform at least the method according to claim 17 or 18.

Images