Security material obtaining method, and apparatus

Abstract

Disclosed in embodiments of the present disclosure are a security material obtaining method, and an apparatus. The method executed by a terminal device comprises: in a U2U relay discovery process, sending a first request message to a first network element, wherein the first request message is used for requesting to obtain a first discovery security material, and the first discovery security material is used for protecting a direct discovery set. Therefore, a terminal device can obtain a first discovery security material used for protecting a direct discovery set, so as to ensure the communication security of a U2U relay discovery process.

Description

Safety material acquisition method and device Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method and device for obtaining secure materials. Background Art

[0002] In the related art, two sets of discovery security materials are used for protecting device-to-device (UE to UE, U2U) relay discovery messages, including discovery security materials for protecting direct discovery sets and discovery security materials for protecting U2U relay discovery messages.

[0003] The discovery security material used to protect the direct discovery set cannot be directly obtained in the U2U relay discovery process using the same acquisition method as in the direct discovery process. Therefore, how to obtain the discovery security material used to protect the direct discovery set in U2U relay discovery is an urgent problem that needs to be solved.

[0004] Summary of the Invention

[0005] The embodiments of the present disclosure provide a method and apparatus for obtaining security materials, which can be applied to communication systems such as long term evolution (LTE) systems, fifth generation (5G) mobile communication systems, 5G new radio (NR) systems, or other future new mobile communication systems. The terminal device can obtain the first discovery security material for protecting the direct discovery set to ensure the communication security of the U2U relay discovery process.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for obtaining security materials, which is executed by a terminal device, including: during the U2U relay discovery process, the terminal device sends a first request message to a first network element, wherein the first request message is used to request the acquisition of first discovery security materials, and the first discovery security materials are used to protect the direct discovery set.

[0007] By implementing the disclosed embodiments, during the U2U relay discovery process, a terminal device sends a first request message to a first network element, requesting the acquisition of first discovery security material, which is used to protect a direct discovery set. Thus, the terminal device can obtain the first discovery security material used to protect the direct discovery set, thereby ensuring communication security during the U2U relay discovery process.

[0008] In a second aspect, an embodiment of the present disclosure provides another method for obtaining security materials, which is executed by a first network element and includes: receiving a first request message sent by a terminal device, wherein the first request message is used to request the acquisition of first discovery security materials, and the first discovery security materials are used to protect a direct discovery set.

[0009] In a third aspect, an embodiment of the present disclosure provides a communication device that implements some or all of the functions of the terminal device described in the method described in the first aspect above. For example, the functions of the communication device may include some or all of the functions in the embodiments of the present disclosure, or may include the functions of implementing any one of the embodiments of the present disclosure separately. The functions may be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0010] In one implementation, the communication device may include a transceiver module and a processing module, wherein the processing module is configured to support the communication device in performing the corresponding functions of the above-mentioned method. The transceiver module is used to support communication between the communication device and other devices. The communication device may also include a storage module, which is coupled to the transceiver module and the processing module and stores computer programs and data necessary for the communication device.

[0011] As an example, the processing module may be a processor, the transceiver module may be a transceiver or a communication interface, and the storage module may be a memory. In one implementation, the communication device includes: a transceiver module configured to send a first request message to a first network element, wherein the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0012] In a fourth aspect, an embodiment of the present disclosure provides another communication device, which has the function of implementing some or all of the functions of the first network element in the method example described in the second aspect above. For example, the functions of the communication device may have the functions of some or all of the embodiments of the present disclosure, or may have the function of implementing any one of the embodiments of the present disclosure separately. The functions may be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0013] In one implementation, the communication device may include a transceiver module and a processing module, the processing module being configured to support the communication device in performing the corresponding functions of the above-described method. The transceiver module is configured to support communication between the communication device and other devices. The communication device may also include a storage module, coupled to the transceiver module and the processing module, which stores computer programs and data necessary for the communication device.

[0014] As an example, the processing module may be a processor, the transceiver module may be a transceiver or a communication interface, and the storage module may be a memory. In one implementation, the communication apparatus includes a transceiver module configured to receive a first request message sent by a terminal device, wherein the first request message is used to request the acquisition of first discovery security material, which is used to protect a direct discovery set.

[0015] In a fifth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor. When the processor calls a computer program in a memory, the method described in the first aspect is executed.

[0016] In a sixth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor. When the processor calls a computer program in a memory, the method described in the second aspect is executed.

[0017] In the seventh aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the first aspect above.

[0018] In an eighth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the second aspect above.

[0019] In a ninth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the first aspect above.

[0020] In the tenth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the second aspect above.

[0021] In the eleventh aspect, an embodiment of the present disclosure provides a perception service processing system, which includes the communication device described in the third aspect and the communication device described in the fourth aspect, or the system includes the communication device described in the fifth aspect and the communication device described in the sixth aspect, or the system includes the communication device described in the seventh aspect and the communication device described in the eighth aspect, or the system includes the communication device described in the ninth aspect and the communication device described in the tenth aspect.

[0022] In a twelfth aspect, an embodiment of the present disclosure provides a computer-readable storage medium for storing instructions for the above-mentioned terminal device, and when the instructions are executed, the terminal device executes the method described in the above-mentioned first aspect.

[0023] In a thirteenth aspect, an embodiment of the present disclosure provides a readable storage medium for storing instructions for the above-mentioned first network element. When the instructions are executed, the first network element executes the method described in the above-mentioned second aspect.

[0024] In a fourteenth aspect, the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.

[0025] In a fifteenth aspect, the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect above.

[0026] In a sixteenth aspect, the present disclosure provides a chip system comprising at least one processor and an interface for supporting a terminal device in implementing the functions described in the first aspect, such as determining or processing at least one of the data and information described in the aforementioned method. In one possible design, the chip system further comprises a memory for storing computer programs and data necessary for the terminal device. The chip system may consist of a chip alone or may include a chip and other discrete components.

[0027] In a seventeenth aspect, the present disclosure provides a chip system, comprising at least one processor and an interface, configured to support a first network element in implementing the functions described in the second aspect, such as determining or processing at least one of the data and information described in the aforementioned method. In one possible design, the chip system further comprises a memory configured to store computer programs and data necessary for the first network element. The chip system may consist of a chip or may include a chip and other discrete components.

[0028] In an eighteenth aspect, the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.

[0029] In a nineteenth aspect, the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the background technology, the drawings required for use in the embodiments of the present disclosure or the background technology will be described below.

[0031] FIG1 is a schematic diagram of a network architecture of a U2U relay scenario provided by an embodiment of the present disclosure;

[0032] FIG2 is a schematic diagram of a network architecture provided by an embodiment of the present disclosure;

[0033] FIG3 is a flow chart of a method for obtaining security materials provided by an embodiment of the present disclosure;

[0034] FIG4 is a flow chart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0035] FIG5 is a flow chart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0036] FIG6 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0037] FIG7 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0038] FIG8 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0039] FIG9 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0040] FIG10 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0041] FIG11 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0042] FIG12 is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure;

[0043] FIG13 is a structural diagram of a communication device provided by an embodiment of the present disclosure;

[0044] FIG14 is a structural diagram of another communication device provided by an embodiment of the present disclosure;

[0045] FIG15 is a structural diagram of a chip provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] To facilitate understanding of the technical solutions of the present disclosure, some terms involved in the embodiments of the present disclosure are briefly introduced below.

[0047] 1. Proximity Service (ProSe)

[0048] Proximity services are provided by the 3rd Generation Partnership Project (3GPP) system for devices in close proximity. ProSe services can support a variety of application scenarios, including public safety, the Internet of Things (IoT), and the Internet of Vehicles (IoV). ProSe technology primarily encompasses two aspects: ProSe discovery and ProSe communication. ProSe discovery allows devices to discover each other and pair with each other, while ProSe communication establishes a secure communication channel between devices for secure data communication.

[0049] In the Prose scenario, the source terminal device and the target terminal device can discover each other, complete pairing, establish a secure communication channel, and conduct secure data communication.

[0050] In a Prose scenario, when the source terminal device and the target terminal device cannot communicate directly, they can communicate with the target terminal device through a terminal device with a relay function (UE-to-UE relay, U2U relay). For example, the source terminal device sends the source terminal device information identifier and / or the target terminal device information identifier to the relay terminal device. The relay terminal device can broadcast the source terminal device identifier and / or the target terminal device information identifier to find the target terminal device. If the target terminal device agrees to communicate, a response is sent to the source terminal device through the relay terminal device.

[0051] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, unless otherwise indicated, like numbers in different figures represent like or similar elements. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0052] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0053] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, for example, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0054] It should be noted that the information (including but not limited to user device information, user personal information, terminal device information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0055] Please refer to Figure 1, which is a schematic diagram of a network architecture of a U2U relay scenario provided by the present disclosure. As shown in Figure 1, the network architecture includes at least three terminal devices. It should be understood that the terminal devices in the embodiments of the present disclosure may also be referred to as: user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc. The network architecture includes at least one source end terminal device (source EndUE), a U2U relay terminal device (UE-to-UE relay UE) and a target end terminal device (Target End UE). Among them, source EndUE may also be referred to as a sending UE, and Target End UE may also be referred to as a receiving UE, which is not specifically limited in the present disclosure.

[0056] In U2U (UE-to-UE) relay communication, the source end UE communicates with the target end UE through one or more U2U relay UEs. The source end UE and the target end UE can exchange data and signaling through the U2U relay UE. This scenario can be used to enhance sidelink (SL) coverage (for example, when the source end UE and the target end UE have poor coverage or are out of coverage) or improve capacity (for example, when the U2U relay UE is a highly capable device). Among them, the source EndUE, U2U relay UE, and Target EndUE can be in the radio resource control (RRC) connection state, RRC idle state, RRC inactive state, and out of coverage (OOC) state. The source End UE and U2U relay UE, as well as the U2U relay UE and Target EndUE, are SL unicast communications. In the unicast communication mode, the two UEs need to establish a unicast connection first. After the unicast connection is established, the sending UE (Tx UE) can send unicast data to the receiving UE (Rx UE), and only the Rx UE can receive and parse the data. Figure 1 is just a simplified schematic diagram for example. The relay scenario can also include other network devices, which are not drawn in Figure 1.

[0057] In order to better understand a method for obtaining security materials disclosed in an embodiment of the present disclosure, the communication system to which the embodiment of the present disclosure is applicable is first described below.

[0058] Please refer to Figure 2, which is a schematic diagram of a network architecture used in an embodiment of the present disclosure, where the network architecture is, for example, a 5G network architecture. The 5G network includes (radio) access network (R)AN) equipment, UPF, AMF, SMF, authentication server function (AUSF), network slice selection function (NSSF), network exposure function (NEF), network exposure function repository (NRF), policy control function (PCF), unified data management (UDM), unified data repository (UDR), application function (AF) or charging function (CHF), etc.

[0059] It should be noted that Figure 2 only exemplifies some examples of network elements or entities in a 5G network. The 5G network may also include some network elements or entities not shown in Figure 2, such as a network data analytics function (NWDAF), and the names of the network elements or entities in the 5G network illustrated in Figure 2 may remain unchanged or change in future communication systems (such as 6G communication systems), and the embodiments of the present disclosure do not specifically limit this.

[0060] Among them, AMF is a control plane network element provided by the operator network, responsible for access control and mobility management of terminal devices accessing the operator network, such as mobile status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0061] The SMF is a control plane network element provided by the operator network, responsible for managing the protocol data unit (PDU) sessions of terminal devices. A PDU session is a channel for transmitting PDUs. Terminal devices need to transmit PDUs to and from the DN through PDU sessions. The SMF is responsible for establishing, maintaining, and deleting PDU sessions. The SMF includes session management (such as session establishment, modification, and release, including tunnel maintenance between the UPF and RAN), UPF selection and control, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0062] The UPF is a gateway provided by the operator, serving as the gateway for communication between the operator's network and the DN. The UPF includes user-plane-related functions such as packet routing and transmission, packet inspection, service usage reporting, Quality of Service (QoS) processing, lawful interception, uplink packet inspection, and downlink packet storage.

[0063] The PCF is a control plane function provided by the operator and is used to provide PDU session policies to the SMF. Policies may include charging-related policies, QoS-related policies, and authorization-related policies.

[0064] The UDM is a control plane network element provided by the operator, responsible for storing information such as the subscriber permanent identifier (SUPI), security context, and subscription data of subscribers in the operator's network.

[0065] AF is a functional network element that provides various business services. It can interact with the core network through other network elements and can interact with the policy management framework to perform policy management.

[0066] NEF is used to provide the framework, authentication, and interface related to network capability exposure, and to transmit information between 5G system network functions and other network functions.

[0067] UDR is mainly used to store user-related contract data, policy data, open structured data, and application data.

[0068] In this network architecture, the N1 interface is the interface between the terminal device and the AMF. The N2 interface is the interface between the RAN and the AMF, used for sending non-access stratum (NAS) messages, etc. The N3 interface is the interface between the (R)AN and the UPF, used for transmitting user plane data, etc. The N4 interface is the interface between the SMF and the UPF, used for transmitting information such as tunnel identification information of the N3 connection, data cache indication information, downlink data notification messages, etc. The N6 interface is the interface between the UPF and the DN, used for transmitting user plane data, etc. In addition, control plane functions such as the AUSF, AMF, SMF, NSSF, NEF, NRF, PCF, UDM, UDR, CHF or AF use service-based interfaces to interact. For example, the service-oriented interface provided by AUSF is Nausf; the service-oriented interface provided by AMF is Namf; the service-oriented interface provided by SMF is Nsmf; the service-oriented interface provided by NSSF is Nnssf; the service-oriented interface provided by NEF is Nnef; the service-oriented interface provided by NRF is Nnrf; the service-oriented interface provided by PCF is Npcf; the service-oriented interface provided by UDM is Nudm; the service-oriented interface provided by UDR is Nudr; the service-oriented interface provided by CHF is Nchf; and the service-oriented interface provided by AF is Naf. For the description of the relevant interfaces, please refer to the description in the relevant technology and will not be repeated here.

[0069] It should be noted that the terms introduced above may have different names in different fields or different standards, so the names shown above should not be understood as limiting the embodiments of the present disclosure. The functions involved in the embodiments of the present disclosure may also be referred to as network elements, functional devices or entities or functional entities. For example, the policy control function may also be referred to as a policy control function network element, a policy control function device or a policy control entity or a policy control function entity. The names are not limited in this disclosure, and those skilled in the art may replace the names of the above functional devices with other names and perform the same functions, which all fall within the scope of protection of this disclosure. The above functional devices may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0070] It can be understood that the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.

[0071] In addition, in order to facilitate understanding of the embodiments of the present disclosure, the following points are explained.

[0072] First, in the embodiments of the present disclosure, "used to indicate" may include being used to indicate directly or indirectly. When describing that a certain information is used to indicate A, it may include that the information directly indicates A or indirectly indicates A, but it does not necessarily mean that the information carries A.

[0073] The information indicated by the information is called the information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated. For example, but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, where there is an association between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can be achieved by using the arrangement order of each piece of information that is pre-agreed (for example, specified by the protocol), thereby reducing the indication overhead to a certain extent.

[0074] The information to be indicated can be sent as a whole or as multiple sub-information messages that are sent separately. The transmission periods and / or timings of these sub-information messages can be the same or different. The specific transmission method is not limited in this disclosure. The transmission periods and / or timings of these sub-information messages can be predefined, for example, according to a protocol.

[0075] Second, the embodiments of the present disclosure list multiple implementation methods to clearly illustrate the technical solutions of the embodiments of the present disclosure. Of course, those skilled in the art will understand that the multiple embodiments provided in the embodiments of the present disclosure can be implemented individually, combined with the methods of other embodiments of the embodiments of the present disclosure, or implemented individually or in combination with some methods in other related technologies; the embodiments of the present disclosure are not limited to this.

[0076] The following is a detailed description of the method and device for obtaining security materials provided by the present disclosure with reference to the accompanying drawings.

[0077] In related technologies, two sets of discovery security materials are used to protect U2U relay discovery messages: discovery security materials for protecting the direct discovery set and discovery security materials for protecting U2U relay discovery messages. The discovery security materials used to protect the direct discovery set cannot be directly acquired using the same acquisition method used during direct discovery.

[0078] Based on this, embodiments of the present disclosure provide a method and apparatus for obtaining security materials. During a U2U relay discovery process, a terminal device may send a first request message to a first network element, requesting the acquisition of first discovery security materials, which are used to protect a direct discovery set. Thus, during the U2U relay discovery process, the terminal device can obtain the first discovery security materials used to protect the direct discovery set, thereby ensuring communication security during the U2U relay discovery process.

[0079] Please refer to Figure 3, which is a flowchart of a method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 3, the method is applied to a device-to-device U2U relay discovery process and is executed by a terminal device. The method may include but is not limited to the following steps:

[0080] S31: Send a first request message to a first network element, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0081] In an embodiment of the present disclosure, during the U2U relay discovery process, the terminal device may send a first request message to the first network element, wherein the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect the direct discovery set.

[0082] In some embodiments, the first network element may be at least one of a direct discovery name management function (DDNMF), a key management function (PKMF), a PCF, and the like.

[0083] In the embodiment of the present disclosure, the first discovery security material is used to protect the direct discovery set, and the first discovery security material may also be referred to as direct discovery security material.

[0084] It can be understood that the 5G ProSe U2U relay discovery message contains two sets of identifiers, a direct discovery set and a U2U relay discovery set, wherein the direct discovery set in the identifier contains part of the content of the 5G ProSe direct discovery message, which may include information of the source terminal device (Source End UE) and / or information of the target terminal device (Target End UE).

[0085] In some embodiments, the first request message may be a Relay Discovery Key Request message, or may be other key request messages, etc., and the embodiments of the present disclosure do not impose specific limitations on this.

[0086] In some embodiments, the first request message includes ProSe identification information for determining the first discovery security material.

[0087] In an embodiment of the present disclosure, the first request message may include ProSe identification information for determining the first discovered security material, wherein the ProSe identification information may be a ProSe identifier, or may also be other information identifying a Prose application, etc., and the embodiment of the present disclosure does not impose any specific restrictions on this.

[0088] In some embodiments, the terminal device receives a first response message sent by the first network element, wherein the first response message includes a first discovered security material.

[0089] In the disclosed embodiments, during a U2U relay discovery process, a terminal device sends a first request message to a first network element. If the first request message is used to request the acquisition of first discovery security material, the terminal device may receive a first response message from the first network element, the first response message including the first discovery security material. Thus, the terminal device can obtain the first discovery security material used to protect the direct discovery set, thereby ensuring communication security during the U2U relay discovery process.

[0090] In some embodiments, the first response message may be a Relay Discovery Key Response message, or a Key Response message, etc., and the embodiments of the present disclosure do not impose specific limitations on this.

[0091] In an embodiment of the present disclosure, the terminal device can send a first request message including ProSe identification information for determining the first discovery security material to the first network element, requesting to obtain the first discovery security material, and then can receive a first response message including the first discovery security material sent by the first network element. Thus, the terminal device can obtain the first discovery security material for protecting the direct discovery set to ensure the communication security of the U2U relay discovery process.

[0092] In some embodiments, the first request message is further used to request acquisition of second discovery security material, and the first response message further includes the second discovery security material, where the second discovery security material is used to protect the U2U relay discovery message.

[0093] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, and the first request message is used to request to obtain the first discovery security material, and also to request to obtain the second discovery security material. As a result, the terminal device receives a first response message sent by the first network element, and the first response message includes the first discovery security material and may also include the second discovery security material.

[0094] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0095] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, requesting to obtain the first discovery security material and the second discovery security material, and then can receive a first response message sent by the first network element including the first discovery security material and the second discovery security material. Thus, the terminal device can simultaneously obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0096] In some embodiments, the first request message includes a relay service code (RSC).

[0097] In an embodiment of the present disclosure, the terminal device can send a first request message including ProSe identification information and RSC for determining the first discovery security material to the first network element, requesting to obtain the first discovery security material and the second discovery security material, and then can receive a first response message including the first discovery security material and the second discovery security material sent by the first network element. Thus, the terminal device can simultaneously obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0098] In some embodiments, the terminal device sends a second request message to the first network element, where the second request message is also used to request acquisition of second discovery security material; and receives a second response message sent by the first network element, where the second response message includes the second discovery security material.

[0099] In an embodiment of the present disclosure, the terminal device can send a second request message to the first network element, and the second request message is also used to request to obtain the second discovered security material. After that, the terminal device can receive a second response message sent by the first network element, and the second response message includes the second discovered security material.

[0100] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0101] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, requesting to obtain the first discovery security material, and can also send a second request message to the first network element, requesting to obtain the second discovery security material. Thereafter, the terminal device can receive a first response message including the first discovery security material and a second response message including the second discovery security material sent by the first network element. Thus, the terminal device can obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message, so as to ensure the communication security of the U2U relay discovery process.

[0102] In some embodiments, the second request message includes an RSC.

[0103] In an embodiment of the present disclosure, the terminal device can send a first request message including ProSe identification information for determining the first discovery security material to the first network element, requesting to obtain the first discovery security material, and can also send a second request message including RSC to the first network element, requesting to obtain the second discovery security material. Thereafter, the terminal device can receive a first response message including the first discovery security material and a second response message including the second discovery security material sent by the first network element. Thus, the terminal device can obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message, so as to ensure the communication security of the U2U relay discovery process.

[0104] In some embodiments, the first request message also includes a first security capability, and the terminal device receives the first security algorithm and / or the second security algorithm sent by the first network element.

[0105] In an embodiment of the present disclosure, the first request message sent by the terminal device to the first network element may also include the first security capability of the terminal device. In this case, the terminal device may receive the first security algorithm and / or second security algorithm sent by the first network element.

[0106] Among them, the first network element receives the first request message including the first security capability sent by the terminal device, and can determine the selected first security algorithm and / or second security algorithm based on the first security capability. Further, the first network element can send the determined first security algorithm and / or second security algorithm to the terminal device.

[0107] In some embodiments, when the first request message is used to request obtaining the first discovered security material, if the first request message includes the first security capability, the terminal device can receive the first security algorithm sent by the first network element, wherein the first security algorithm is related to the first discovered security material.

[0108] In some embodiments, when the first request message is used to request obtaining the second discovery security, if the first request message includes the first security capability, the terminal device can receive the second security algorithm sent by the first network element, wherein the second security algorithm is related to the second discovery security material.

[0109] In some embodiments, when the first request message is used to request the acquisition of the first discovery security material and the second discovery security material, if the first request message includes the first security capability, the terminal device can receive the first security algorithm and the second security algorithm sent by the first network element, wherein the first security algorithm is related to the first discovery security material and the second security algorithm is related to the second discovery security material.

[0110] In some embodiments, the terminal device receives the first security algorithm and / or the second security algorithm sent by the first network element, and can receive a first response message sent by the first network element, where the first response message includes the first security algorithm and / or the second security algorithm.

[0111] In some embodiments, the second request message also includes a second security capability, and the terminal device receives the second security algorithm sent by the first network element.

[0112] In the embodiment of the present disclosure, the second request message sent by the terminal device to the first network element may further include the second security capability of the terminal device. In this case, the terminal device may receive the second security algorithm sent by the first network element.

[0113] Among them, the first network element receives the second request message including the second security capability sent by the terminal device, and can determine the selected second security algorithm based on the second security capability. Further, the first network element can send the determined second security algorithm to the terminal device.

[0114] In some embodiments, when a terminal device sends a first request message to a first network element requesting to obtain first discovery security material, if the first request message includes a first security capability, the terminal device may receive a first security algorithm sent by the first network element, where the first security algorithm is related to the first discovery security material. In this case, if the terminal device sends a second request message to the first network element requesting to obtain second discovery security material, if the second request message includes a second security capability, the terminal device may receive a second security algorithm sent by the first network element, where the second security algorithm is related to the second discovery security material.

[0115] In some embodiments, the terminal device receives the second security algorithm sent by the first network element and may receive a second response message sent by the first network element, where the second response message includes the second security algorithm.

[0116] In some embodiments, the first security capability may be the same as or different from the second security capability.

[0117] In some embodiments, the first security algorithm may be the same as or different from the second security algorithm.

[0118] In some embodiments, the terminal device stores at least one of the following information:

[0119] First to discover safe materials;

[0120] ProSe identification information;

[0121] Second, safety materials were discovered;

[0122] RSC;

[0123] First security algorithm;

[0124] Second security algorithm.

[0125] In an embodiment of the present disclosure, when the terminal device obtains at least one of the first discovery security material, ProSe identification information, the second discovery security material, RSC, the first security algorithm, and the second security algorithm, it can store at least one of the obtained first discovery security material, ProSe identification information, the second discovery security material, RSC, the first security algorithm, and the second security algorithm.

[0126] Exemplarily, the terminal device sends a first request message including ProSe identification information for determining the first discovery security material to the first network element, and receives a first response message sent by the first network element. When the first response message includes the first discovery security material, the terminal device can store the ProSe identification information and the first discovery security material together.

[0127] Exemplarily, the terminal device sends a first request message including ProSe identification information and RSC for determining the first discovery security material to the first network element, and receives a first response message sent by the first network element. When the first response message includes the first discovery security material and the second discovery security material, the terminal device can store the ProSe identification information, RSC, the first discovery security material and the second discovery security material together.

[0128] Exemplarily, the terminal device sends a first request message including ProSe identification information, RSC and first security capability for determining a first discovery security material to the first network element, and receives a first response message sent by the first network element. When the first response message includes the first discovery security material, the second discovery security material and the first security algorithm, the terminal device can store the ProSe identification information, RSC, the first discovery security material, the second discovery security material and the first security algorithm together.

[0129] It should be noted that the above examples are for illustrative purposes only and are not intended to limit the embodiments of the present disclosure. The terminal device may also obtain the second security discovery material in other ways. Furthermore, the above examples are not exhaustive and are merely partial examples. The terminal device may also obtain the second security algorithm, as described above.

[0130] In some embodiments, the first request message further includes a public land mobile network (PLMN) list.

[0131] In the embodiment of the present disclosure, the first request message may further include a PLMN list, wherein the PLMN list may be used by the first network element to determine the third network element, so as to obtain the first discovery security material from the third network element.

[0132] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0133] By implementing the disclosed embodiments, during the U2U relay discovery process, a terminal device sends a first request message to a first network element, requesting the acquisition of first discovery security material, which is used to protect a direct discovery set. Thus, the terminal device can obtain the first discovery security material used to protect the direct discovery set, thereby ensuring communication security during the U2U relay discovery process.

[0134] Please refer to Figure 4, which is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 4, the method is applied to the device-to-device U2U relay discovery process and is executed by the terminal device. The method may include but is not limited to the following steps:

[0135] S41: Send a first request message to a first network element, wherein the first request message is used to request acquisition of first discovery security material, the first discovery security material is used to protect a direct discovery set, and the first request message is also used to request acquisition of second discovery security material.

[0136] S42: Receive a first response message sent by the first network element, wherein the first response message includes a first discovery security material and a second discovery security material, and the second discovery security material is used to protect the U2U relay discovery message.

[0137] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, and the first request message is used to request to obtain the first discovery security material, and also to request to obtain the second discovery security material. As a result, the terminal device receives a first response message sent by the first network element, and the first response message includes the first discovery security material and may also include the second discovery security material.

[0138] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0139] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, requesting to obtain the first discovery security material and the second discovery security material, and then can receive a first response message sent by the first network element including the first discovery security material and the second discovery security material. Thus, the terminal device can simultaneously obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0140] In some embodiments, the first request message includes ProSe identification information used to determine the first discovered security material.

[0141] In some embodiments, the first request message includes a relay service code (RSC).

[0142] In an embodiment of the present disclosure, the terminal device can send a first request message including ProSe identification information and RSC for determining the first discovery security material to the first network element, requesting to obtain the first discovery security material and the second discovery security material, and then can receive a first response message including the first discovery security material and the second discovery security material sent by the first network element. Thus, the terminal device can simultaneously obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0143] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference can be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0144] In some embodiments, after the terminal device receives the first response message sent by the first network element and obtains the first discovery security material and the second discovery security material, the first discovery security material, the second discovery security material, the RSC and the ProSe identification information can be stored together.

[0145] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0146] It should be noted that, in the embodiment of the present disclosure, S41 to S42 can be implemented separately, or can be implemented together with any other steps in the embodiment of the present disclosure, for example, combined with S31 in the embodiment of the present disclosure, and the embodiment of the present disclosure does not limit this.

[0147] By implementing the disclosed embodiments, during the U2U relay discovery process, a terminal device sends a first request message to a first network element, wherein the first request message is used to request the acquisition of first discovery security material and the first request message is also used to request the acquisition of second discovery security material; and receives a first response message sent by the first network element, wherein the first response message includes the first discovery security material and the first response message also includes the second discovery security material, the first discovery security material is used to protect the direct discovery set, and the second discovery security material is used to protect the U2U relay discovery message. Thus, the terminal device can simultaneously obtain the first discovery security material used to protect the direct discovery set and the second discovery security material used to protect the U2U relay discovery message, thereby ensuring communication security during the U2U relay discovery process.

[0148] Please refer to Figure 5, which is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 5, the method is applied to the U2U relay discovery process and is executed by a terminal device. The method may include but is not limited to the following steps:

[0149] S51: Send a first request message to a first network element, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0150] S52: Receive a first response message sent by the first network element, where the first response message includes a first discovered security material.

[0151] For the relevant description of S51 and S52, reference may be made to the relevant description in the above embodiment, which will not be repeated here.

[0152] S53: Send a second request message to the first network element, where the second request message is also used to request acquisition of second discovered security material.

[0153] S54: Receive a second response message sent by the first network element, where the second response message includes a second discovered security material.

[0154] In an embodiment of the present disclosure, the terminal device can send a second request message to the first network element, and the second request message is also used to request to obtain the second discovered security material. After that, the terminal device can receive a second response message sent by the first network element, and the second response message includes the second discovered security material.

[0155] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0156] In an embodiment of the present disclosure, the terminal device can send a first request message to the first network element, requesting to obtain the first discovery security material, and can also send a second request message to the first network element, requesting to obtain the second discovery security material. Thereafter, the terminal device can receive a first response message including the first discovery security material and a second response message including the second discovery security material sent by the first network element. Thus, the terminal device can obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message, so as to ensure the communication security of the U2U relay discovery process.

[0157] In some embodiments, the first request message includes ProSe identification information used to determine the first discovered security material.

[0158] In some embodiments, the second request message includes an RSC.

[0159] In an embodiment of the present disclosure, the terminal device can send a first request message including ProSe identification information for determining the first discovery security material to the first network element, requesting to obtain the first discovery security material, and can also send a second request message including RSC to the first network element, requesting to obtain the second discovery security material. Thereafter, the terminal device can receive a first response message including the first discovery security material and a second response message including the second discovery security material sent by the first network element. Thus, the terminal device can obtain the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message, so as to ensure the communication security of the U2U relay discovery process.

[0160] It should be noted that the execution order of S51 to S54 can also be S53 and S54 executed first, and S51 and S52 executed later, and the embodiment of the present disclosure does not impose any specific limitation on this.

[0161] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference may be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0162] In some embodiments, after the terminal device receives the first response message and the second response message sent by the first network element and obtains the first discovery security material and the second discovery security material, the first discovery security material, the second discovery security material, the RSC and the ProSe identification information can be stored together.

[0163] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0164] It should be noted that, in the embodiment of the present disclosure, S51 to S54 can be implemented separately or in combination with any other steps in the embodiment of the present disclosure, for example, in combination with S31 in the embodiment of the present disclosure, and the embodiment of the present disclosure does not limit this.

[0165] By implementing the embodiments of the present disclosure, during the U2U relay discovery process, the terminal device sends a first request message to the first network element, wherein the first request message is used to request the acquisition of first discovery security materials, which are used to protect the direct discovery set; receives a first response message sent by the first network element, wherein the first response message includes the first discovery security materials; sends a second request message to the first network element, wherein the second request message is also used to request the acquisition of second discovery security materials; and receives a second response message sent by the first network element, wherein the second response message includes the second discovery security materials. Thus, the terminal device can obtain the first discovery security materials used to protect the direct discovery set and the second discovery security materials used to protect the U2U relay discovery message, thereby ensuring the communication security of the U2U relay discovery process.

[0166] Please refer to Figure 6, which is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 6, the method is applied to the U2U relay discovery process and is executed by the first network element. The method may include but is not limited to the following steps:

[0167] S61: Receive a first request message sent by a terminal device, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0168] In an embodiment of the present disclosure, the first network element may receive a first request message sent by a terminal device, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0169] In some embodiments, the first network element may be at least one of a direct discovery name management function (DDNMF), a key management function (PKMF), a PCF, and the like.

[0170] In the embodiment of the present disclosure, the first discovery security material is used to protect the direct discovery set, and the first discovery security material may also be referred to as direct discovery security material.

[0171] It can be understood that the 5G ProSe U2U relay discovery message contains two sets of identifiers, a direct discovery set and a U2U relay discovery set, wherein the direct discovery set in the identifier contains part of the content of the 5G ProSe direct discovery message, which may include information of the source terminal device (Source End UE) and / or information of the target terminal device (Target End UE).

[0172] In some embodiments, the first request message may be a Relay Discovery Key Request message, or may be other key request messages, etc., and the embodiments of the present disclosure do not impose specific limitations on this.

[0173] In some embodiments, the first network element sends a first response message to the terminal device, wherein the first response message includes the first discovered security material.

[0174] In an embodiment of the present disclosure, a first network element may receive a first request message sent by a terminal device during a U2U relay discovery process. Furthermore, if the first request message is used to request first discovery security material, the first network element may send a first response message to the terminal device, where the first response message includes the first discovery security material. Thus, the terminal device may be configured with the first discovery security material for protecting the direct discovery set, thereby ensuring communication security during the U2U relay discovery process.

[0175] In some embodiments, the first response message may be a Relay Discovery Key Response message, or a Key Response message, etc., and the embodiments of the present disclosure do not impose specific limitations on this.

[0176] In an embodiment of the present disclosure, during the U2U relay discovery process, the first network element may receive a first request message sent by a terminal device including ProSe identification information for determining a first discovery security material. The first network element may then send a first response message including the first discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set may be configured for the terminal device to ensure the communication security of the U2U relay discovery process.

[0177] In some embodiments, the first network element sends a first response message to the terminal device, wherein the first network element determines that the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information.

[0178] In an embodiment of the present disclosure, the first network element may send a first response message to the terminal device when determining that the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information.

[0179] In some embodiments, when the first network element determines that the terminal device is not authorized to perform the U2U relay discovery process related to the ProSe identification information, it may send other response messages to the terminal device. The other response messages are used to indicate that the terminal device is not authorized to perform the U2U relay discovery process related to the ProSe identification information, or may also be used to indicate that the terminal device is denied the U2U relay discovery process related to the ProSe identification information, or may also indicate that the terminal device has failed to perform the U2U relay discovery process related to the ProSe identification information, and so on.

[0180] In some other embodiments, in some embodiments, the first network element may cancel sending the first response message to the terminal device if it determines that the terminal device is not authorized to perform the U2U relay discovery process related to the ProSe identification information.

[0181] In some embodiments, the first network element sends an authorization request message to the second network element, wherein the authorization request message is used to request to determine whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information; receives an authorization response message sent by the second network element, wherein the authorization response message is used to indicate that the terminal device is authorized to perform the U2U relay discovery process; and determines, based on the authorization response message, that the terminal device is authorized to perform the U2U relay discovery process.

[0182] In an embodiment of the present disclosure, the first network element may send an authorization request message to the second network element, where the authorization request message is used to request whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information. The terminal device may then receive an authorization response message sent by the second network element, where the authorization response message may be used to indicate whether the terminal device is authorized to perform a U2U relay discovery process.

[0183] In some embodiments, when the authorization response message is used to indicate that the terminal device is authorized to perform the U2U relay discovery process, the first network element may determine, based on the authorization response message, that the terminal device is authorized to perform the U2U relay discovery process.

[0184] In the embodiment of the present disclosure, the second network element may be a neighbor service application server, or may also be a UDM.

[0185] In some embodiments, the first request message includes ProSe identification information for determining the first discovery security material.

[0186] In an embodiment of the present disclosure, the first request message may include ProSe identification information for determining the first discovered security material, wherein the ProSe identification information may be a ProSe identifier, or may also be other information identifying a Prose application, etc., and the embodiment of the present disclosure does not impose any specific restrictions on this.

[0187] In some embodiments, the first request message is further used to request acquisition of second discovery security material, and the first response message further includes the second discovery security material, where the second discovery security material is used to protect the U2U relay discovery message.

[0188] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, where the first request message is used to request the acquisition of a first discovery security material and also to request the acquisition of a second discovery security material. Thus, the first network element sends a first response message to the terminal device, where the first response message includes the first discovery security material and may also include the second discovery security material.

[0189] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0190] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, requesting to obtain the first discovery security material and the second discovery security material. After that, the first network element can send a first response message including the first discovery security material and the second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device at the same time to ensure the communication security of the U2U relay discovery process.

[0191] In some embodiments, the first request message includes a relay service code (RSC).

[0192] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, including ProSe identification information for determining a first discovery security material and an RSC. The first network element can then send a first response message including the first discovery security material and the second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device at the same time to ensure the communication security of the U2U relay discovery process.

[0193] In some embodiments, the first network element receives a second request message sent by the terminal device, where the second request message is also used to request acquisition of second discovered security material; and sends a second response message to the terminal device, where the second response message includes the second discovered security material.

[0194] In an embodiment of the present disclosure, the first network element can receive a second request message sent by the terminal device, and the second request message is also used to request to obtain the second discovered security material. After that, the first network element can send a second response message to the terminal device, and the second response message includes the second discovered security material.

[0195] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0196] In an embodiment of the present disclosure, the first network element can receive a first request message sent by the terminal device, and can also receive a second request message sent by the terminal device. Thereafter, the first network element can send a first response message including a first discovery security material and a second response message including a second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device to ensure the communication security of the U2U relay discovery process.

[0197] In some embodiments, the second request message includes an RSC.

[0198] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device including ProSe identification information for determining a first discovery security material, and can also receive a second request message sent by the terminal device including an RSC. The first network element can then send a first response message including the first discovery security material and a second response message including the second discovery security material to the terminal device. Thus, the terminal device can be configured with the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0199] In some embodiments, the first network element sends a third request message to the second network element or the third network element, wherein the third request message is used to request to obtain the first discovered security material; and receives a third response message sent by the second network element or the third network element, wherein the third response message includes the first discovered security material.

[0200] In the disclosed embodiment, a first network element may send a third request message to a second network element, the third request message being used to request obtaining first discovery security material. The first network element may then receive a third response message from the second network element, the third response message including the first discovery security material. Thus, the first network element may obtain the first discovery security material from the second network element.

[0201] In the disclosed embodiment, a first network element may send a third request message to a third network element, the third request message being used to request obtaining the first discovery security material. The first network element may then receive a third response message from the third network element, the third response message including the first discovery security material. Thus, the first network element may obtain the first discovery security material from the third network element.

[0202] In the embodiment of the present disclosure, the second network element may be a neighbor service application server, or may also be a UDM.

[0203] In the embodiment of the present disclosure, the third network element may be at least one of a DDNMF of other terminal devices, a PKMF of other terminal devices, a PCF of other terminal devices, and the like.

[0204] In some embodiments, the third request message includes ProSe identification information used to determine the first discovered security material.

[0205] In the embodiment of the present disclosure, the third request message sent by the first network element to the second network element or the third network element may include ProSe identification information for determining the first discovery security material. Thus, the second network element or the third network element may determine the first discovery security material based on the ProSe identification information.

[0206] In some embodiments, the first request message also includes a first security capability, wherein the first network element determines the selected first security algorithm and / or second security algorithm based on the first security capability; and sends the determined first security algorithm and / or second security algorithm to the terminal device.

[0207] In an embodiment of the present disclosure, a first network element receives a first request message sent by a terminal device. When the first request message includes a first security capability, the first network element can determine the selected first security algorithm and / or second security algorithm based on the first security capability, and send the determined first security algorithm and / or second security algorithm to the terminal device.

[0208] In some embodiments, when the first request message is used to request obtaining the first discovered security material, if the first request message includes the first security capability, the first network element may send a first security algorithm to the terminal device, wherein the first security algorithm is related to the first discovered security material.

[0209] In some embodiments, when the first request message is used to request obtaining the second discovery security, if the first request message includes the first security capability, the first network element may send a second security algorithm to the terminal device, wherein the second security algorithm is related to the second discovery security material.

[0210] In some embodiments, when the first request message is used to request the acquisition of the first discovery security material and the second discovery security material, if the first request message includes the first security capability, the first network element can send the first security algorithm and the second security algorithm to the terminal device, wherein the first security algorithm is related to the first discovery security material and the second security algorithm is related to the second discovery security material.

[0211] In some embodiments, the first network element may send the first security algorithm and / or the second security algorithm to the terminal device, and may send a first response message to the terminal device, where the first response message includes the first security algorithm and / or the second security algorithm.

[0212] In some embodiments, the first network element determines the selected first security algorithm and / or second security algorithm based on the first security capability, including: sending a fourth request message to the second network element or the third network element, wherein the fourth request message is used to request to obtain the first security algorithm and / or the second security algorithm based on the first security capability; and receiving a fourth response message sent by the second network element or the third network element, wherein the fourth response message includes the determined first security algorithm and / or second security algorithm.

[0213] In an embodiment of the present disclosure, a first network element may send a fourth request message to a second network element or a third network element, requesting that the first security algorithm and / or the second security algorithm be obtained based on the first security capability. The first network element may then receive a fourth response message sent by the second network element or the third network element, the fourth response message including the first security algorithm and / or the second security algorithm. Thus, the first network element may determine the selected first security algorithm and / or second security algorithm.

[0214] In the embodiment of the present disclosure, the second network element may be a neighbor service application server, or may also be a UDM.

[0215] In the embodiment of the present disclosure, the third network element may be at least one of a DDNMF of other terminal devices, a PKMF of other terminal devices, a PCF of other terminal devices, and the like.

[0216] In some embodiments, the fourth request message includes the first security capability and ProSe identification information.

[0217] In the embodiment of the present disclosure, the fourth request message may include the first security capability and ProSe identification information.

[0218] In some embodiments, the second request message further includes a second security capability, and the first network element determines the selected second security algorithm based on the second security capability; and sends the determined second security algorithm to the terminal device.

[0219] In an embodiment of the present disclosure, a first network element receives a first request message sent by a terminal device. When the first request message includes a second security capability, the first network element may determine a selected second security algorithm based on the second security capability and send the determined second security algorithm to the terminal device.

[0220] In some embodiments, when a first network element receives a first request message sent by a terminal device requesting to obtain first discovery security material, if the first request message includes a first security capability, the first network element may send a first security algorithm to the terminal device, where the first security algorithm is related to the first discovery security material. In this case, if the first network element receives a second request message sent by the terminal device requesting to obtain second discovery security material, if the second request message includes a second security capability, the first network element may send a second security algorithm to the terminal device, where the second security algorithm is related to the second discovery security material.

[0221] In some embodiments, the first network element determines the third network element based on the PLMN list.

[0222] In the embodiment of the present disclosure, the first network element may determine the third network element according to the PLMN list.

[0223] The first network element may determine the PLMN list according to an agreement between operators, or may determine the PLMN list based on pre-configured information.

[0224] In some embodiments, the first request message also includes a PLMN list.

[0225] In the embodiment of the present disclosure, the first network element receives a first request message sent by the terminal device, where the first request message includes a PLMN. Thus, the first network element can obtain a PLMN list from the terminal device for determining the third network element.

[0226] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0227] By implementing the disclosed embodiments, a first network element receives a first request message sent by a terminal device, wherein the first request message is used to request the acquisition of first discovery security material, which is used to protect a direct discovery set. Thus, the first discovery security material used to protect the direct discovery set can be configured for the terminal device to ensure communication security during the U2U relay discovery process.

[0228] Please refer to Figure 7, which is a flow chart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 7, the method is applied to the U2U relay discovery process and is executed by the first network element. The method may include but is not limited to the following steps:

[0229] S71: Receive a first request message sent by a terminal device, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0230] For the relevant description of S71, please refer to the relevant description in some of the above embodiments, which will not be repeated here.

[0231] S72: Send an authorization request message to the second network element, where the authorization request message is used to request to determine whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information.

[0232] S73: Receive an authorization response message sent by the second network element, where the authorization response message is used to indicate that the terminal device is authorized to perform a U2U relay discovery process.

[0233] S74: When it is determined, based on the authorization response message, that the terminal device is authorized to perform the U2U relay discovery process, a first response message is sent to the terminal device, wherein the first response message includes a first discovery security material.

[0234] In an embodiment of the present disclosure, the first network element may send an authorization request message to the second network element, where the authorization request message is used to request whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information. The first network element may then receive an authorization response message sent by the second network element. When the authorization response message is used to indicate that the terminal device is authorized to perform a U2U relay discovery process, the first network element may determine, based on the authorization response message, that the terminal device is authorized to perform a U2U relay discovery process. Based on this, the first network element may determine to send a first response message to the terminal device, where the first response message includes a first discovery security material.

[0235] In the embodiment of the present disclosure, the second network element may be a neighbor service application server, or may also be a UDM.

[0236] In some embodiments, the first request message includes ProSe identification information for determining the first discovery security material.

[0237] In the embodiment of the present disclosure, the first request message may include ProSe identification information used to determine the first discovered security material, wherein the ProSe identification information may be a ProSe identifier.

[0238] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference can be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0239] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0240] It should be noted that, in the embodiment of the present disclosure, S71 to S74 can be implemented separately or in combination with any other steps in the embodiment of the present disclosure, for example, in combination with S61 in the embodiment of the present disclosure, and the embodiment of the present disclosure does not limit this.

[0241] By implementing the embodiment of the present disclosure, the first network element receives a first request message sent by the terminal device, wherein the first request message is used to request to obtain the first discovery security material, and the first discovery security material is used to protect the direct discovery set; sends an authorization request message to the second network element, wherein the authorization request message is used to request to determine whether the terminal device is authorized to perform the U2U relay discovery process related to the ProSe identification information; receives an authorization response message sent by the second network element, wherein the authorization response message is used to indicate that the terminal device is authorized to perform the U2U relay discovery process; and when it is determined that the terminal device is authorized to perform the U2U relay discovery process according to the authorization response message, sends a first response message to the terminal device, wherein the first response message includes the first discovery security material. Thus, the first discovery security material for protecting the direct discovery set can be configured for the terminal device to ensure the communication security of the U2U relay discovery process.

[0242] Please refer to Figure 8, which is a flow chart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 8, the method is applied to the U2U relay discovery process and is executed by the first network element. The method may include but is not limited to the following steps:

[0243] S81: Receive a first request message sent by a terminal device, wherein the first request message is used to request acquisition of first discovery security material, the first discovery security material is used to protect a direct discovery set, and the first request message is also used to request acquisition of second discovery security material.

[0244] S82: Send a first response message to the terminal device, wherein the first response message includes the first discovered security material and the first response message also includes the second discovered security material.

[0245] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, where the first request message is used to request the acquisition of a first discovery security material and also to request the acquisition of a second discovery security material. Thus, the first network element sends a first response message to the terminal device, where the first response message includes the first discovery security material and may also include the second discovery security material.

[0246] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0247] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, requesting to obtain the first discovery security material and the second discovery security material. After that, the first network element can send a first response message including the first discovery security material and the second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device at the same time to ensure the communication security of the U2U relay discovery process.

[0248] In some embodiments, the first request message includes ProSe identification information used to determine the first discovered security material.

[0249] In some embodiments, the first request message includes a relay service code (RSC).

[0250] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device, including ProSe identification information for determining a first discovery security material and an RSC. The first network element can then send a first response message including the first discovery security material and the second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device at the same time to ensure the communication security of the U2U relay discovery process.

[0251] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference can be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0252] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0253] It should be noted that in the embodiment of the present disclosure, S81 to S82 can be implemented separately or in combination with any other steps in the embodiment of the present disclosure, for example, in combination with S61 and / or S71 to S74 in the embodiment of the present disclosure, and the embodiment of the present disclosure is not limited to this.

[0254] By implementing the disclosed embodiments, a first network element receives a first request message sent by a terminal device, wherein the first request message is used to request the acquisition of first discovery security material, which is used to protect a direct discovery set, and the first request message is also used to request the acquisition of second discovery security material; and sends a first response message to the terminal device, wherein the first response message includes the first discovery security material and the first response message also includes the second discovery security material. Thus, the terminal device can be configured with both the first discovery security material for protecting the direct discovery set and the second discovery security material for protecting the U2U relay discovery message, thereby ensuring communication security during the U2U relay discovery process.

[0255] Please refer to Figure 9, which is a flowchart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 9, the method is applied to the U2U relay discovery process and is executed by the first network element. The method may include but is not limited to the following steps:

[0256] S91: Receive a first request message sent by a terminal device, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0257] S92: Send a first response message to the terminal device, where the first response message includes the first discovered security material.

[0258] For the relevant descriptions of S91 to S92, reference can be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0259] S93: Receive a second request message sent by the terminal device, where the second request message is also used to request acquisition of second discovered security material.

[0260] S94: Send a second response message to the terminal device, where the second response message includes the second discovered security material.

[0261] In an embodiment of the present disclosure, the first network element can receive a second request message sent by the terminal device, and the second request message is also used to request to obtain the second discovered security material. After that, the first network element can send a second response message to the terminal device, and the second response message includes the second discovered security material.

[0262] In the embodiment of the present disclosure, the second discovery security material is used to protect the U2U relay discovery message. The second discovery security material may also be referred to as the U2U relay discovery security material.

[0263] In an embodiment of the present disclosure, the first network element can receive a first request message sent by the terminal device, and can also receive a second request message sent by the terminal device. Thereafter, the first network element can send a first response message including a first discovery security material and a second response message including a second discovery security material to the terminal device. Thus, the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message can be configured for the terminal device to ensure the communication security of the U2U relay discovery process.

[0264] In some embodiments, the first request message includes ProSe identification information used to determine the first discovered security material.

[0265] In some embodiments, the second request message includes an RSC.

[0266] In an embodiment of the present disclosure, the first network element can receive a first request message sent by a terminal device including ProSe identification information for determining a first discovery security material, and can also receive a second request message sent by the terminal device including an RSC. The first network element can then send a first response message including the first discovery security material and a second response message including the second discovery security material to the terminal device. Thus, the terminal device can be configured with the first discovery security material for protecting the direct discovery set and the second security material for protecting the U2U relay discovery message to ensure the communication security of the U2U relay discovery process.

[0267] It should be noted that the execution order of S91 to S94 can also be S93 and S94 executed first, and S91 and S92 executed later. The embodiment of the present disclosure does not impose any specific limitation on this.

[0268] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference may be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0269] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0270] It should be noted that in the embodiment of the present disclosure, S91 to S94 can be implemented separately or in combination with any other steps in the embodiment of the present disclosure, for example, in combination with S61 and / or S71 to S74 in the embodiment of the present disclosure, and the embodiment of the present disclosure is not limited to this.

[0271] By implementing the embodiments of the present disclosure, a first network element receives a first request message sent by a terminal device, wherein the first request message is used to request the acquisition of first discovery security materials, and the first discovery security materials are used to protect the direct discovery set; sends a first response message to the terminal device, wherein the first response message includes the first discovery security materials; receives a second request message sent by the terminal device, wherein the second request message is also used to request the acquisition of second discovery security materials; and sends a second response message to the terminal device, wherein the second response message includes the second discovery security materials. Thus, the first discovery security materials for protecting the direct discovery set and the second discovery security materials for protecting the U2U relay discovery message can be configured for the terminal device to ensure the communication security of the U2U relay discovery process.

[0272] Please refer to Figure 10, which is a flow chart of another method for obtaining security materials provided by an embodiment of the present disclosure. As shown in Figure 10, the method is applied to the U2U relay discovery process and is executed by the first network element. The method may include but is not limited to the following steps:

[0273] S101: Send a third request message to a second network element or a third network element, where the third request message is used to request acquisition of first discovered security material.

[0274] S102: Receive a third response message sent by the second network element or the third network element, where the third response message includes the first discovered security material.

[0275] In the disclosed embodiment, a first network element may send a third request message to a second network element, the third request message being used to request obtaining first discovery security material. The first network element may then receive a third response message from the second network element, the third response message including the first discovery security material. Thus, the first network element may obtain the first discovery security material from the second network element.

[0276] In the disclosed embodiment, a first network element may send a third request message to a third network element, the third request message being used to request obtaining the first discovery security material. The first network element may then receive a third response message from the third network element, the third response message including the first discovery security material. Thus, the first network element may obtain the first discovery security material from the third network element.

[0277] In the embodiment of the present disclosure, the second network element may be a neighbor service application server, or may also be a UDM.

[0278] In the embodiment of the present disclosure, the third network element may be at least one of a DDNMF of other terminal devices, a PKMF of other terminal devices, a PCF of other terminal devices, and the like.

[0279] In some embodiments, the third request message includes ProSe identification information used to determine the first discovered security material.

[0280] In the embodiment of the present disclosure, the third request message sent by the first network element to the second network element or the third network element may include ProSe identification information for determining the first discovery security material. Thus, the second network element or the third network element may determine the first discovery security material based on the ProSe identification information.

[0281] S103: Receive a first request message sent by the terminal device, where the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect the direct discovery set.

[0282] S104: Send a first response message to the terminal device, where the first response message includes a first discovered security material.

[0283] For the relevant descriptions of S103 and S104 , reference may be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0284] In some embodiments, the first network element determines the third network element based on the PLMN list.

[0285] In the embodiment of the present disclosure, the first network element may determine the third network element according to the PLMN list.

[0286] The first network element may determine the PLMN list according to an agreement between operators, or may determine the PLMN list based on pre-configured information.

[0287] In some embodiments, the first request message also includes a PLMN list.

[0288] In the embodiment of the present disclosure, the first network element receives a first request message sent by the terminal device, where the first request message includes a PLMN. Thus, the first network element can obtain a PLMN list from the terminal device for determining the third network element.

[0289] It should be noted that the execution order of S101 to S104 can be adjusted arbitrarily. For example, S101 and S102 are executed after S103 and before S104. This embodiment of the present disclosure does not impose any specific limitation on this.

[0290] It should be noted that, for the relevant descriptions of the first network element, the first request message, the first discovered security material, and the first response message, reference may be made to the relevant descriptions in some of the above embodiments, which will not be repeated here.

[0291] In this embodiment or example, unless there is any contradiction, each step can be independent, arbitrarily combined or exchanged in order, and the optional methods or optional examples can be arbitrarily combined and can be arbitrarily combined with other embodiments or examples.

[0292] It should be noted that in the embodiments of the present disclosure, S101 to S104 can be implemented separately or in combination with any other steps in the embodiments of the present disclosure, for example, they can be implemented in combination with S61 and / or S71 to S74 and / or S81 to S82 and / or S91 to S94 in the embodiments of the present disclosure, and the embodiments of the present disclosure are not limited to this.

[0293] By implementing the embodiments of the present disclosure, a first network element sends a third request message to a second network element or a third network element, wherein the third request message is used to request the acquisition of the first discovery security material; a first network element receives a third response message sent by the second network element or the third network element, wherein the third response message includes the first discovery security material; a first request message is received from a terminal device, wherein the first request message is used to request the acquisition of the first discovery security material, and the first discovery security material is used to protect the direct discovery set; and a first response message is sent to the terminal device, wherein the first response message includes the first discovery security material. Thus, the first discovery security material for protecting the direct discovery set can be configured for the terminal device to ensure communication security during the U2U relay discovery process.

[0294] To facilitate understanding of the embodiments of the present disclosure, the following exemplary embodiments are provided.

[0295] In an exemplary embodiment, two sets of discovery security materials are used to protect U2U relay discovery messages, including direct discovery security materials and U2U relay discovery security materials. The direct discovery security materials are used to protect the direct discovery set, while the U2U relay discovery security materials are used to protect U2U relay discovery messages.

[0296] The distribution of security materials for direct discovery reuses the security material distribution mechanism for restricted 5G neighbor service direct discovery. However, because the DDNMF does not participate in U2U relay discovery to provide neighbor service restriction codes, neighbor service query codes, or neighbor service response codes, the security mechanisms for direct discovery cannot be directly reused in the U2U relay discovery mechanism.

[0297] Furthermore, the discovery security material for direct discovery is associated with a Prose restriction code, Prose query code, or Prose response code, whereas Prose restriction codes, Prose query codes, or Prose response codes are not used in the U2U relay discovery process. Therefore, how to identify the direct discovery security material in U2U relay discovery requires further study.

[0298] As shown in Figure 11, the terminal device is a neighbor service end UE, the first network element is the DDNMF / PKMF / PCF of the neighbor service end UE, the second network element is a UDM or a neighbor service application server (Prose Application server), and the third network element is the DDNMF / PKMF / PCF of the U2U relay terminal device.

[0299] Steps 1a to 1c refer to the U2U relay terminal device:

[0300] 1a. The U2U relay terminal device sends a Relay Discovery Key Request message containing the Relay Service Code (RSC) and security capabilities to the 5G DDNMF / PKMF / PCF in its HPLMN to obtain relevant U2U relay discovery security materials.

[0301] 1b.5G DDNMF / PKMF / PCF can query UDM whether the U2U relay terminal device is authorized to perform the U2U relay discovery process.

[0302] 1c. If the U2U Relay Endpoint Device is authorized to perform U2U Relay Discovery, the 5G DDNMF / PKMF / PCF of the U2U Relay Endpoint Device returns the corresponding U2U Relay Discovery Security Material, which provides the U2U Relay with the necessary information to protect the U2U Relay Discovery message. The 5G DDNMF / PKMF / PCF also determines the selected PC5 encryption algorithm based on the RSC and PC5 UE security capabilities received in step 1a. The U2U Relay stores the selected PC5 encryption algorithm along with the RSC.

[0303] Among them, steps 2a-3c refer to the neighboring service terminal device:

[0304] 2a. The neighboring server UE sends a Relay Discovery Key Request message containing the RSC and security capabilities to the 5G DDNMF / PKMF / PCF in its HPLMN to obtain the relevant U2U Relay Discovery security material. The neighboring server UE may also include a list of PLMNs in which the UE is authorized to use the 5G ProSe U2U discovery mechanism.

[0305] 2b.5G DDNMF / PKMF / PCF can check with the UDM or Prose Application server whether the neighboring server UE is authorized to announce / monitor the U2U relay discovery message under the RSC.

[0306] 2c. If the neighboring server UE is authorized and the corresponding U2U relay finds that the security information is not stored in the 5G DDNMF / PKMF / PCF, the 5G DDNMF / PKMF / PCF of the neighboring server UE may send a key request message to the 5G DDNMF / PKMF / PCF of the U2U relay and / or the 5G DDNMF / PKMF / PCF of other neighboring server UEs.

[0307] Note: The DDNMF / PKMF of the neighboring server UE can discover the DDNMF / PKMF of the potential U2U relay supporting the RSC based on the HPLMN contained in the potential U2U relay ID, or based on the HPLMN information pre-configured in the DDNMF / PKMF, or based on the HPLMN information provided by the neighboring server UE in the discovery key request.

[0308] 2d. The 5G DDNMF / PKMF / PCF of the neighboring server UE returns the corresponding U2U Relay Discovery security material and the selected security algorithm. The neighboring server UE stores the U2U Relay Discovery security material, the selected PC5 encryption algorithm, and the RSC.

[0309] 3a. The neighboring server UE sends a Relay Discovery Key Request message containing the ProSe identifier and security capabilities to the 5G DDNMF / PKMF / PCF in its HPLMN to obtain the relevant direct discovery security material. The neighboring server UE may also include a list of PLMNs in which the UE is authorized to use the 5G ProSe U2U discovery mechanism.

[0310] 3b.5G DDNMF / PKMF / PCF may query the Neighborhood Service Application Server whether the Neighborhood Service UE is authorized to announce / monitor U2U Relay Discovery messages based on the Neighborhood Service Identifier.

[0311] 3c. If the neighbor service UE is authorized, the 5G DDNMF / PKMF / PCF will return the corresponding direct discovery security material and the selected security algorithm. The neighbor service UE will store the direct discovery security material and the selected security algorithm together with the neighbor service identifier.

[0312] Optionally, direct discovery security material may be generated by the 5G DDNMF / PKMF / PCF. If the potential neighbor server UE list is provided by the neighbor server UE or pre-configured in the 5G DDNMF / PKMF, the 5G DDNMF / PKMF of the neighbor server UE may contact the 5G DDNMF / PKMF that supports the neighbor service identifier to obtain the relevant direct discovery security material and the selected security algorithm.

[0313] Optionally, the direct discovery security material may be provided by the proximity service application server. Based on the proximity service identifier and the UE security capabilities, the proximity service application server generates the corresponding direct discovery security material and determines the selected security algorithm.

[0314] It should be noted that the detailed description of the relevant steps in the exemplary embodiments can be found in the relevant descriptions of some of the above embodiments, and will not be repeated here.

[0315] In another exemplary embodiment, as shown in Figure 12, the terminal device is a neighboring service end UE, the first network element is the DDNMF / PKMF / PCF of the neighboring service end UE, the second network element is a UDM or a neighboring service application server (Prose Application server), and the third network element is the DDNMF / PKMF / PCF of the U2U relay terminal device.

[0316] The neighbor service end UE can obtain the direct discovery security material and the U2U relay discovery security material at one time by sending a relay discovery key request message containing the RSC and the neighbor service identifier.

[0317] Among them, steps 2a-3c refer to the neighboring service terminal device:

[0318] 2a. The neighbor service UE sends a Relay Discovery Key Request message containing the RSC, neighbor service identifier, and security capabilities to the 5G DDNMF / PKMF / PCF in its HPLMN to obtain the relevant direct discovery security material and U2U relay discovery security material. The neighbor service UE may also include a list of PLMNs in which the UE is authorized to perform the 5G Prose U2U relay discovery mechanism.

[0319] 2b.5G DDNMF / PKMF / PCF can check with the UDM or Prose Application server whether the neighbor service end UE is authorized to announce / monitor the U2U relay discovery message under the RSC and / or neighbor service identifier.

[0320] 2c. If the neighboring server UE is authorized and the corresponding U2U relay finds that the security information is not stored in the 5G DDNMF / PKMF / PCF, the 5G DDNMF / PKMF / PCF of the neighboring server UE may send a key request message to the 5G DDNMF / PKMF / PCF of the U2U relay and / or the 5G DDNMF / PKMF / PCF of other neighboring server UEs.

[0321] Note: The DDNMF / PKMF of the neighboring server UE can discover the DDNMF / PKMF of the potential U2U relay supporting the RSC based on the HPLMN contained in the potential U2U relay ID, or based on the HPLMN information pre-configured in the DDNMF / PKMF, or based on the HPLMN information provided by the neighboring server UE in the discovery key request.

[0322] 2d. The neighboring server UE's 5G DDNMF / PKMF / PCF returns the corresponding U2U relay discovery security material, direct discovery security material, and selected security algorithm. The neighboring server UE stores the U2U relay discovery security material, direct discovery security material, selected PC5 encryption algorithm, and RSC.

[0323] It should be noted that the detailed description of the relevant steps in the exemplary embodiments can be found in the relevant descriptions of some of the above embodiments, and will not be repeated here.

[0324] In the embodiments provided above, the methods provided in the embodiments of the present disclosure are described from the perspectives of a terminal device and a first network element, respectively. To implement the various functions in the methods provided in the embodiments of the present disclosure, the first network element and the terminal device may include hardware structures and software modules, and implement the aforementioned functions in the form of hardware structures, software modules, or a combination of hardware structures and software modules. Certain of the aforementioned functions may be implemented in the form of hardware structures, software modules, or a combination of hardware structures and software modules.

[0325] Please refer to Figure 13, which is a schematic diagram of the structure of a communication device 1 provided in an embodiment of the present disclosure. The communication device 1 shown in Figure 13 may include a transceiver module 11 and a processing module 12. The transceiver module may include a sending module and / or a receiving module. The sending module is used to implement a sending function, and the receiving module is used to implement a receiving function. The transceiver module can implement a sending function and / or a receiving function.

[0326] The communication device 1 is provided at the terminal device side and includes a transceiver module 11 .

[0327] The transceiver module 11 is configured to send a first request message to the first network element, wherein the first request message is used to request to obtain a first discovery security material, and the first discovery security material is used to protect the direct discovery set.

[0328] In some embodiments, the transceiver module 11 is further configured to receive a first response message sent by the first network element, wherein the first response message includes the first discovered security material.

[0329] In some embodiments, the first request message includes ProSe identification information of a proximity service for determining the first discovery security material.

[0330] In some embodiments, the first request message is further used to request acquisition of second discovery security material, and the first response message further includes the second discovery security material, where the second discovery security material is used to protect the U2U relay discovery message.

[0331] In some embodiments, the first request message includes a relay service code, RSC.

[0332] In some embodiments, the transceiver module 11 is further configured to send a second request message to the first network element, where the second request message is also used to request the acquisition of the second discovered security material; and receive a second response message sent by the first network element, where the second response message includes the second discovered security material.

[0333] In some embodiments, the second request message includes an RSC.

[0334] In some embodiments, the first request message further includes a first security capability, wherein the transceiver module 11 is further configured to receive a first security algorithm and / or a second security algorithm sent by the first network element.

[0335] In some embodiments, the second request message further includes a second security capability, wherein the transceiver module 11 is further configured to receive a second security algorithm sent by the first network element.

[0336] In some embodiments, as shown in FIG13 , the apparatus further includes a processing module 12 .

[0337] The processing module 12 is further configured to store at least one of the following information:

[0338] First to discover safe materials;

[0339] ProSe identification information;

[0340] Second, safety materials were discovered;

[0341] RSC;

[0342] First security algorithm;

[0343] Second security algorithm.

[0344] In some embodiments, the first request message further includes a Public Land Mobile Network (PLMN) list.

[0345] The communication device 1 is provided at the first network element side and includes a transceiver module 11 .

[0346] The transceiver module 11 is configured to receive a first request message sent by a terminal device, wherein the first request message is used to request to obtain a first discovery security material, and the first discovery security material is used to protect a direct discovery set.

[0347] In some embodiments, the transceiver module 11 is further configured to send a first response message to the terminal device, wherein the first response message includes the first discovered security material.

[0348] In some embodiments, the transceiver module 11 is further configured to send a first response message to the terminal device, wherein the first network element determines that the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information.

[0349] In some embodiments, the transceiver module 11 is further configured to send an authorization request message to the second network element, wherein the authorization request message is used to request to determine whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information; and receive an authorization response message sent by the second network element, wherein the authorization response message is used to indicate that the terminal device is authorized to perform a U2U relay discovery process.

[0350] In some embodiments, the apparatus further includes a processing module 12 .

[0351] The processing module 12 is configured to determine, according to the authorization response message, whether the terminal device is authorized to perform the U2U relay discovery process.

[0352] In some embodiments, the first request message includes ProSe identification information for determining the first discovery security material.

[0353] In some embodiments, the first request message is further used to request acquisition of second discovery security material, and the first response message further includes the second discovery security material.

[0354] In some embodiments, the first request message includes an RSC.

[0355] In some embodiments, the transceiver module 11 is further configured to receive a second request message sent by the terminal device, where the second request message is also used to request acquisition of second discovered security material; and send a second response message to the terminal device, where the second response message includes the second discovered security material.

[0356] In some embodiments, the second request message includes an RSC.

[0357] In some embodiments, the transceiver module 11 is also configured to send a third request message to the second network element or the third network element, wherein the third request message is used to request to obtain the first discovered security material; and receive a third response message sent by the second network element or the third network element, wherein the third response message includes the first discovered security material.

[0358] In some embodiments, the third request message includes ProSe identification information used to determine the first discovered security material.

[0359] In some embodiments, the first request message also includes a first security capability, the processing module 12 is further configured to determine the selected first security algorithm and / or second security algorithm based on the first security capability, and the transceiver module 11 is further configured to send the determined first security algorithm and / or second security algorithm to the terminal device.

[0360] In some embodiments, the transceiver module 11 is further configured to send a fourth request message to the second network element or the third network element, wherein the fourth request message is used to request to obtain the first security algorithm and / or the second security algorithm based on the first security capability; and receive a fourth response message sent by the second network element or the third network element, wherein the fourth response message includes the first security algorithm and / or the second security algorithm.

[0361] In some embodiments, the fourth request message includes the first security capability and ProSe identification information.

[0362] In some embodiments, the second request message also includes a second security capability. The processing module 12 is further configured to determine the selected second security algorithm based on the second security capability. The transceiver module 11 is further configured to send the determined second security algorithm to the terminal device.

[0363] In some embodiments, the processing module 12 is further configured to determine the third network element according to the PLMN list.

[0364] In some embodiments, the first request message also includes a PLMN list.

[0365] Regarding the communication device 1 in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated on here.

[0366] The communication device 1 provided in the above embodiments of the present disclosure achieves the same or similar beneficial effects as the security material acquisition method provided in some of the above embodiments, and will not be described in detail here.

[0367] Please refer to Figure 14, which is a structural diagram of another communication device 1000 provided in an embodiment of the present disclosure. Communication device 1000 can be a terminal device or a first network element. This device can be used to implement the method described in the above method embodiment. For details, please refer to the description of the above method embodiment.

[0368] The communication device 1000 may include one or more processors 1001. The processor 1001 may be a general-purpose processor or a dedicated processor. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the communication device (e.g., a base station, a baseband chip, a terminal device, a terminal device chip, a DU or CU, etc.), execute computer programs, and process computer program data.

[0369] Optionally, the communication device 1000 may further include one or more memories 1002, on which a computer program 1004 may be stored. The memory 1002 executes the computer program 1004 to enable the communication device 1000 to perform the method described in the above method embodiment. Optionally, the memory 1002 may also store data. The communication device 1000 and the memory 1002 may be provided separately or integrated together.

[0370] Optionally, the communication device 1000 may further include a transceiver 1005 and an antenna 1006. The transceiver 1005 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is configured to implement transceiver functions. The transceiver 1005 may include a receiver and a transmitter. The receiver may be referred to as a receiver or a receiving circuit, etc., and is configured to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., and is configured to implement a transmitting function.

[0371] Optionally, the communication device 1000 may further include one or more interface circuits 1007. The interface circuit 1007 is configured to receive code instructions and transmit the code instructions to the processor 1001. The processor 1001 executes the code instructions to enable the communication device 1000 to perform the method described in the above method embodiment.

[0372] The communication device 1000 is a terminal device: the transceiver 1005 is used to perform any step in Figures 1 to 5.

[0373] The communication device 1000 is a first network element, and the transceiver 1005 is used to perform any step in Figures 6 to 10.

[0374] In one implementation, processor 1001 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and transmitting functions may be separate or integrated. The transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or may be used for transmitting or delivering signals.

[0375] In one implementation, processor 1001 may store a computer program 1003. Computer program 1003, when executed on processor 1001, enables communication device 1000 to perform the method described in the above method embodiment. Computer program 1003 may be embedded in processor 1001, in which case processor 1001 may be implemented by hardware.

[0376] In one implementation, the communication device 1000 may include a circuit that can implement the functions of sending, receiving, or communicating in the aforementioned method embodiments. The processor and transceiver described in the present disclosure can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0377] The communication device described in the above embodiment may be a terminal device, a first network element, or a core network, but the scope of the communication device described in this disclosure is not limited thereto, and the structure of the communication device may not be limited to FIG14. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be:

[0378] (1) An independent integrated circuit (IC), or chip, or chip system or subsystem;

[0379] (2) a collection of one or more ICs, optionally including a storage component for storing data and computer programs;

[0380] (3) ASIC, such as modem;

[0381] (4) Modules that can be embedded in other devices;

[0382] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0383] (6)Others, etc.

[0384] For the case where the communication device may be a chip or a chip system, please refer to FIG15 , which is a structural diagram of a chip provided in an embodiment of the present disclosure.

[0385] As shown in Figure 13, the chip 1100 includes a processor 1101 and an interface 1103. There may be one or more processors 1101, and there may be more than one interface 1103.

[0386] For the case where the chip is used to implement the function of the first network element in the embodiment of the present disclosure:

[0387] The interface 1103 is used to receive code instructions and transmit them to the processor.

[0388] The processor 1101 is configured to execute code instructions to perform the security material acquisition method as described in some of the above embodiments.

[0389] For the case where the chip is used to implement the functions of the terminal device in the embodiments of the present disclosure:

[0390] The interface 1103 is used to receive code instructions and transmit them to the processor.

[0391] The processor 1101 is configured to execute code instructions to perform the security material acquisition method as described in some of the above embodiments.

[0392] Optionally, the chip 1100 further includes a memory 1102 , which is used to store necessary computer programs and data.

[0393] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present disclosure may be implemented by electronic hardware, computer software, or a combination of both. Whether such functionality is implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functionality for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present disclosure.

[0394] An embodiment of the present disclosure also provides a communication system, which includes the communication device serving as the first network element and the communication device of the terminal device in the embodiment of Figure 13 above, or the system includes the communication device serving as the first network element and the communication device of the terminal device in the embodiment of Figure 14 above.

[0395] An embodiment of the present disclosure also provides a communication system, which includes a terminal device and a first network element.

[0396] Among them, the terminal device is configured to execute the security material acquisition method described in some of the above embodiments; the first network element is configured to execute the security material acquisition method described in some of the above embodiments.

[0397] The present disclosure also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.

[0398] The present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0399] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0400] Unless the context requires otherwise, throughout the specification and claims, the term "comprise" and its other forms, such as the third person singular form "comprises" and the present participle form "comprising", are to be interpreted as open and inclusive, that is, "including, but not limited to". In the description of the specification, the terms "some embodiments", "exemplary embodiments", etc. are intended to indicate that the particular features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the particular features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner.

[0401] Those skilled in the art will understand that the various numerical numbers such as first and second involved in the present disclosure are only for the convenience of description and are not used to limit the scope of the embodiments of the present disclosure, and also indicate the order of precedence.

[0402] The at least one in the present disclosure can also be described as one or more, and the multiple can be two, three, four or more, which is not limited in the present disclosure. In the embodiments of the present disclosure, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0403] In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, the solution after removing some steps in a certain embodiment or example can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be arbitrarily combined; in addition, the various embodiments or examples can be arbitrarily combined. For example, some or all steps of different embodiments or examples can be arbitrarily combined, and a certain embodiment or example can be arbitrarily combined with the optional methods or optional examples of other embodiments or examples. In addition, each element, each row, or each column in the table involved in the present disclosure can be implemented as an independent embodiment, and the combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0404] Regarding the description methods of the present disclosure such as "A or B", "A and / or B", "at least one of A and B", "A in one case, B in another case", "in response to one case A, in response to another case B", etc., at least one of the following schemes may be included according to the situation: executing A independently of B, that is, A in some embodiments; executing B independently of A, that is, B in some embodiments; selectively executing A and B, that is, selecting to execute from A and B in some embodiments; executing both A and B, that is, A and B in some embodiments.

[0405] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0406] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0407] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A method for obtaining safe materials, It is characterized in that The method is applied to a device-to-device U2U relay discovery process, and the method is executed by a terminal device, including: A first request message is sent to a first network element, wherein the first request message is used to request to obtain first discovery security material, and the first discovery security material is used to protect a direct discovery set.

2. The method according to claim 1, It is characterized in that The method further comprises: A first response message sent by the first network element is received, wherein the first response message includes the first discovered security material.

3. The method according to claim 1 or 2, It is characterized in that The first request message includes ProSe identification information used to determine the first discovered security material.

4. The method according to claim 2, It is characterized in that The first request message is also used to request to obtain a second discovery security material, and the first response message also includes the second discovery security material, where the second discovery security material is used to protect the U2U relay discovery message.

5. The method according to claim 4, It is characterized in that The first request message includes a relay service code, RSC.

6. The method according to any one of claims 1 to 5, It is characterized in that The first request message also includes a first security capability, wherein the method further includes: Receive at least one of the following sent by the first network element: First security algorithm; Second security algorithm.

7. The method according to any one of claims 1 to 3, It is characterized in that The method further comprises: Sending a second request message to the first network element, where the second request message is also used to request obtaining a second discovered security material; A second response message sent by the first network element is received, wherein the second response message includes the second discovered security material.

8. The method according to claim 7, It is characterized in that The second request message includes the RSC.

9. The method according to claim 7 or 8, It is characterized in that The second request message also includes a second security capability, wherein the method further includes: Receive a second security algorithm sent by the first network element.

10. The method according to claim 9, It is characterized in that The first request message also includes a first security capability, wherein the method further includes: Receive a first security algorithm sent by the first network element.

11. The method according to any one of claims 1 to 10, It is characterized in that The method further comprises: Store at least one of the following information: First to discover safe materials; ProSe identification information; Second, find safe materials; RSC; First security algorithm; Second security algorithm.

12. The method according to any one of claims 1 to 11, It is characterized in that The first request message also includes a public land mobile network PLMN list.

13. A method for obtaining safe materials, It is characterized in that The method is applied to a U2U relay discovery process, and the method is executed by a first network element, including: A first request message sent by a terminal device is received, wherein the first request message is used to request acquisition of first discovery security material, and the first discovery security material is used to protect a direct discovery set.

14. The method according to claim 13, It is characterized in that The method further comprises: A first response message is sent to the terminal device, wherein the first response message includes the first discovered security material.

15. The method of claim 14, It is characterized in that The sending a first response message to the terminal device includes: In response to determining that the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information, the first response message is sent to the terminal device.

16. The method of claim 15, It is characterized in that The determining that the terminal device is authorized to perform a U2U relay discovery process related to the Prose identification information includes: Sending an authorization request message to the second network element, wherein the authorization request message is used to request to determine whether the terminal device is authorized to perform a U2U relay discovery process related to the ProSe identification information; Receiving an authorization response message sent by the second network element, wherein the authorization response message is used to indicate that the terminal device is authorized to perform a U2U relay discovery process; According to the authorization response message, it is determined that the terminal device is authorized to perform the U2U relay discovery process.

17. The method according to any one of claims 13 to 16, It is characterized in that The first request message includes ProSe identification information used to determine the first discovery security material.

18. The method according to any one of claims 13 to 17, It is characterized in that The first request message is also used to request to obtain a second discovered security material, and the first response message also includes the second discovered security material.

19. The method of claim 18, It is characterized in that The first request message includes an RSC.

20. The method according to any one of claims 13 to 17, It is characterized in that The method further comprises: receiving a second request message sent by the terminal device, where the second request message is also used to request obtaining a second discovered security material; A second response message is sent to the terminal device, wherein the second response message includes the second discovered security material.

21. The method of claim 20, It is characterized in that The second request message includes the RSC.

22. The method according to any one of claims 13 to 21, It is characterized in that The method further comprises: Sending a third request message to the second network element or the third network element, wherein the third request message is used to request to obtain the first discovered security material; A third response message sent by the second network element or the third network element is received, wherein the third response message includes the first discovered security material.

23. The method of claim 22, It is characterized in that The third request message includes ProSe identification information used to determine the first discovered security material.

24. The method according to any one of claims 13 to 19, It is characterized in that The first request message also includes a first security capability, wherein the method further includes: Determining a selected first security algorithm and / or second security algorithm according to the first security capability; The determined first security algorithm and / or second security algorithm is sent to the terminal device.

25. The method of claim 24, It is characterized in that The step of determining the selected first security algorithm and / or second security algorithm according to the first security capability includes: Sending a fourth request message to the second network element or the third network element, wherein the fourth request message is used to request to obtain the first security algorithm and / or the second security algorithm according to the first security capability; Receive a fourth response message sent by the second network element or the third network element, wherein the fourth response message includes the first security algorithm and / or the second security algorithm.

26. The method of claim 25, It is characterized in that The fourth request message includes the first security capability and ProSe identification information used to determine the first discovered security material.

27. The method of claim 20 or 21, It is characterized in that The second request message also includes a second security capability, wherein the method further includes: determining a selected second security algorithm according to the second security capability; The determined second security algorithm is sent to the terminal device.

28. The method of claim 27, It is characterized in that The first request message also includes a first security capability, wherein the method further includes: Determining a selected first security algorithm according to the first security capability; The determined first security algorithm is sent to the terminal device.

29. The method of claim 22 or 25, It is characterized in that The method further comprises: The third network element is determined according to the PLMN list.

30. The method of any one of claims 13 to 29, It is characterized in that The first request message also includes a PLMN list.

31. A communication device, It is characterized in that include: The transceiver module is configured to send a first request message to a first network element, wherein the first request message is used to request to obtain first discovery security material, and the first discovery security material is used to protect a direct discovery set.

32. A communication device, It is characterized in that include: The transceiver module is configured to receive a first request message sent by a terminal device, wherein the first request message is used to request to obtain a first discovery security material, and the first discovery security material is used to protect a direct discovery set.

33. A communication device, It is characterized in that The device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device performs the method as described in any one of claims 1 to 12, or the processor executes the computer program stored in the memory so that the device performs the method as described in any one of claims 13 to 30.

34. A communication device, It is characterized in that include: processor and interface circuits; The interface circuit is used to receive code instructions and transmit them to the processor; The processor is used to run the code instructions to execute the method according to any one of claims 1 to 12, or is used to run the code instructions to execute the method according to any one of claims 13 to 30.

35. A computer-readable storage medium storing instructions, which, when executed, enable the method according to any one of claims 1 to 12 to be implemented, or, when executed, enable the method according to any one of claims 13 to 30 to be implemented.

36. A communication system, It is characterized in that include: A terminal device, configured to execute the method according to any one of claims 1 to 12; The first network element is configured to execute the method according to any one of claims 13 to 30.

Images