DCR message protection processing by a u2n relay using a DCR security id

Abstract

Systems, methods, and / or apparatus are provided for a direct Connection Request (OCR) message protecting processing. A device, such as a UE-to-network (U2N) relay wireless transmit / receive unit (WTRU), may be configured to perform one or more processes. The U2N WTRU may send a discovery message during a U2N relay discovery procedure. The discovery message may include a Direct Connection Request security identification (ID) (DSID)The U2N WTRU may receive a DCR message, e.g., from a remote WTRU. The DCR message may be, or may include, the DSID, an encrypted U2N Relay Service Code (U2N_RSC), and an encrypted ProSe remote user key (PRUK) ID. The U2N WTRU may determine, e.g., from the DCR message, a discovery security key based on the DSID. The DSID may be associated with the discovery security key. The U2N WTRU may decrypt the encrypted U2N_RSC and PRUK ID based on the discovery security key.

Description

DCR MESSAGE PROTECTION PROCESSING BY A U2N RELAY USING A DCR SECURITY IDCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 542,720 filed October 5, 2023, the contents of which are incorporated by reference herein.BACKGROUND

[0002] Mobile communications using wireless communication continue to evolve. A fifth generation of mobile communication radio access technology (RAT) may be referred to as 5G new radio (NR). A previous (legacy) generation of mobile communication RAT may be, for example, fourth generation (4G) long-term evolution (LTE). Wireless communication devices may establish communications with other devices and data networks, e.g., via an access network, such as a radio access network (RAN).SUMMARY

[0003] Systems, methods, and apparatus are provided for a device, such as a UE-to-Network (U2N) relay wireless transmit / receive unit (WTRU). The U2N relay WTRU may be configured to perform one or more of the following.

[0004] The device, e.g., the U2N relay WTRU, may send a discovery message during a U2N relay discovery procedure. The discovery message may include a direct connection request security identification (ID) (DSID). In examples, the discovery message may be a relay discovery announcement message, such as a UE-to-UE (U2U) relay discovery announcement message. In examples, the discovery message is a relay discovery solicitation response message, such as a WTRU-to-WTRU relay discovery solicitation response message. In examples, the discovery message may be, or may include, at least one of a protected U2N relay discovery announcement message or a protected U2N relay discovery solicitation response message.

[0005] The U2N relay WTRU may receive a direct connection request (DCR) message. For example, the U2N relay WTRU may receive a DCR message from a remote WTRU. The DCR message may be, ormay include, the DSID, an encrypted U2N Relay Service Code (U2N_RSC), and / or an encrypted ProSe remote user key (PRUK) ID.

[0006] The U2N relay WTRU may determine, from the DCR message, a discovery security key based on the DSID. The DSID may be associated with the discovery security key. For example, the DSID may be associated with the discovery security key based on the U2N relay WTRU generating a mapping between the DSID and the discovery security key. The discovery security key may be, or may include, a U2N Relay Service Code (U2N_RSC) discovery security key.

[0007] The U2N relay WTRU may decrypt the encrypted U2N_RSC and PRUK ID based on the discovery security key.

[0008] The U2N relay WTRU may determine that the U2N relay WTRU is configured with the U2N_RSC and is associated with a U2N relay discovery security key.

[0009] The DSID described herein may be associated with and / or correspond to a specific remote WTRU. For example, the DSID may be unique for a remote WTRU. In examples, a first DSID may be associated with a first remote WTRU and a second DSID may be associated with a second remote WTRU.

[0010] Systems, methods, and apparatus are provided for a DCR message protecting processing. The first WTRU, which may be a U2N relay, may be provided. The first WTRU may include a processor. The processor may be programmed to perform one or more processes. An announcement message may be sent during a U2N relay discovery procedure. The announcement message may include a DSID. The DSID may be associated with a U2N_RSC and / or one or more discovery security keys. The first WTRU may receive a DCR message from a remote WTRU. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID. The discovery security keys may be determined using the DSID and a mapping, e.g., that is established during a discovery process. The encrypted U2N_RSC and / or the PRUK ID may be decrypted using the one or more discovery security keys.

[0011] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be a remote WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The remote WTRU may receive an announcement message. The announcement message may be, or may include, a DSID. The DSID may be associated with one or more discovery security keys. The DSID may be associated with a U2N_RSC and / or the one or more discovery security keys and U2N relay user information. The remote WTRU may send a DCR to a U2N relay. The DCR message (e.g., a portion of the DCR messages) may be protected using the one or more discovery security keys. For example, a portion of the DCR messages, such as the RSC and / or the PRUK lEs associated with the DCR messages, may be protected using the one or morediscovery security keys. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID.

[0012] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be a U2U relay, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The U2U relay may send an announcement message. The U2U relay may determine a DSID. The DSID may be associated with a U2U_RSC and / or one or more discovery security keys. The U2U relay may receive a DCR message from an end WTRU. The DCR message may be, or may include, one or more of the DSID and an encrypted U2U_RSC and / or an encrypted PRUK ID. The U2U relay may determine a discovery security key, e.g., using the received DSID and / or mapping established during a discovery process. The discovery security key may be, or may include, one or more U2N_RSC discovery security keys. The U2U relay may decrypt U2U_RSC and / or PRUK ID, e.g., using the discovery security key.

[0013] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be an end WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The end WTRU may receive a U2U relay discovery message, e.g., the protected U2U relay discovery message. The protected U2U relay discovery message may be, or may include, one or more of a DSID associated with a U2U_RSC and / or one or more discovery security keys. The DSID may be associated with the U2U relay user information. The end WTRU may send a DCR message a UE-to-UE (U2U) relay WTRU. The DCR message (e.g., a portion of the DCR message) may be protected, e.g., using the one or more discovery security keys. The DCR message may include one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID.BRIEF DESCRIPTION OF THE DRAWINGS

[0014] FIG. 1 A is a system diagram illustrating an example communications system in which one or more disclosed embodiments may be implemented.

[0015] FIG. 1 B is a system diagram illustrating an example wireless transmit / receive unit (WTRU) that may be used within the communications system illustrated in FIG. 1A according to an embodiment.

[0016] FIG. 1 C is a system diagram illustrating an example radio access network (RAN) and an example core network (CN) that may be used within the communications system illustrated in FIG. 1 A according to an embodiment.

[0017] FIG. 1 D is a system diagram illustrating a further example RAN and a further example CN that may be used within the communications system illustrated in FIG. 1A according to an embodiment.

[0018] FIG. 2 illustrates an example UE-to-UE (U2U) relay discovery with a Model B using a solicitation identification (ID).

[0019] FIG. 3 illustrates an example U2U relay discovery with a Model B for a UE-to-Network (U2N) relay using a solicitation ID.

[0020] FIG. 4 illustrates an example U2N relay communication procedure using a direct connection request (DCR) security ID (DSID).

[0021] FIG. 5 illustrates an example U2U relay communication procedure using a DSID, e.g., from a model B U2N relay discovery.

[0022] FIGs. 6A-B illustrates an example U2N relay communication procedure, e.g., a multi-hop U2N relay communication procedure, using a DSID from a Model B U2N relay multi-hop discovery.DETAILED DESCRIPTION

[0023] FIG. 1 A is a diagram illustrating an example communications system 100 in which one or more disclosed embodiments may be implemented. The communications system 100 may be a multiple access system that provides content, such as voice, data, video, messaging, broadcast, etc., to multiple wireless users. The communications system 100 may enable multiple wireless users to access such content through the sharing of system resources, including wireless bandwidth. For example, the communications systems 100 may employ one or more channel access methods, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single-carrier FDMA (SC-FDMA), zero-tail unique-word DFT-Spread OFDM (ZT UW DTS-s OFDM), unique word OFDM (UW-OFDM), resource block-filtered OFDM, filter bank multicarrier (FBMC), and the like.

[0024] As shown in FIG. 1A, the communications system 100 may include wireless transmit / receive units (WTRUs) 102a, 102b, 102c, 102d, a RAN 104 / 113, a ON 106 / 115, a public switched telephone network (PSTN) 108, the Internet 110, and other networks 112, though it will be appreciated that the disclosed embodiments contemplate any number of WTRUs, base stations, networks, and / or network elements. Each of the WTRUs 102a, 102b, 102c, 102d may be any type of device configured to operate and / or communicate in a wireless environment. By way of example, the WTRUs 102a, 102b, 102c, 102d, any of which may be referred to as a “station” and / or a “STA”, may be configured to transmit and / or receive wireless signals and may include a user equipment (UE), a mobile station, a fixed or mobile subscriber unit, a subscription-based unit, a pager, a cellular telephone, a personal digital assistant (PDA), a smartphone, a laptop, a netbook, a personal computer, a wireless sensor, a hotspot or Mi-Fi device, an Internet of Things(loT) device, a watch or other wearable, a head-mounted display (HMD), a vehicle, a drone, a medical device and applications (e.g., remote surgery), an industrial device and applications (e.g., a robot and / or other wireless devices operating in an industrial and / or an automated processing chain contexts), a consumer electronics device, a device operating on commercial and / or industrial wireless networks, and the like. Any of the WTRUs 102a, 102b, 102c and 102d may be interchangeably referred to as a UE.

[0025] The communications systems 100 may also include a base station 114a and / or a base station 114b. Each of the base stations 114a, 114b may be any type of device configured to wirelessly interface with at least one of the WTRUs 102a, 102b, 102c, 102d to facilitate access to one or more communication networks, such as the CN 106 / 115, the I nternet 110, and / or the other networks 112. By way of example, the base stations 114a, 114b may be a base transceiver station (BTS), a Node-B, an eNode B, a Home Node B, a Home eNode B, a gNB, a NR NodeB, a site controller, an access point (AP), a wireless router, and the like. While the base stations 114a, 114b are each depicted as a single element, it will be appreciated that the base stations 114a, 114b may include any number of interconnected base stations and / or network elements.

[0026] The base station 114a may be part of the RAN 104 / 113, which may also include other base stations and / or network elements (not shown), such as a base station controller (BSC), a radio network controller (RNC), relay nodes, etc. The base station 114a and / or the base station 114b may be configured to transmit and / or receive wireless signals on one or more carrier frequencies, which may be referred to as a cell (not shown). These frequencies may be in licensed spectrum, unlicensed spectrum, or a combination of licensed and unlicensed spectrum. A cell may provide coverage for a wireless service to a specific geographical area that may be relatively fixed or that may change over time. The cell may further be divided into cell sectors. For example, the cell associated with the base station 114a may be divided into three sectors. Thus, in one embodiment, the base station 114a may include three transceivers, i.e. , one for each sector of the cell. In an embodiment, the base station 114a may employ multiple-input multiple output (MIMO) technology and may utilize multiple transceivers for each sector of the cell. For example, beamforming may be used to transmit and / or receive signals in desired spatial directions.

[0027] The base stations 114a, 114b may communicate with one or more of the WTRUs 102a, 102b, 102c, 102d over an air interface 116, which may be any suitable wireless communication link (e.g., radio frequency (RF), microwave, centimeter wave, micrometer wave, infrared (IR), ultraviolet (UV), visible light, etc.). The air interface 116 may be established using any suitable radio access technology (RAT).

[0028] More specifically, as noted above, the communications system 100 may be a multiple access system and may employ one or more channel access schemes, such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, and the like. For example, the base station 114a in the RAN 104 / 113 and the WTRUs 102a,102b, 102c may implement a radio technology such as Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (UTRA), which may establish the air interface 116 using wideband CDMA (WCDMA). WCDMA may include communication protocols such as High-Speed Packet Access (HSPA) and / or Evolved HSPA (HSPA+). HSPA may include High-Speed Downlink (DL) Packet Access (HSDPA) and / or High-Speed UL Packet Access (HSUPA).

[0029] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as Evolved UMTS Terrestrial Radio Access (E-UTRA), which may establish the air interface 116 using Long Term Evolution (LTE) and / or LTE-Advanced (LTE-A) and / or LTE-Advanced Pro (LTE-A Pro).

[0030] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as NR Radio Access, which may establish the air interface 116 using New Radio (NR).

[0031] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement multiple radio access technologies. For example, the base station 114a and the WTRUs 102a, 102b, 102c may implement LTE radio access and NR radio access together, for instance using dual connectivity (DC) principles. Thus, the air interface utilized by WTRUs 102a, 102b, 102c may be characterized by multiple types of radio access technologies and / or transmissions sent to / from multiple types of base stations (e.g., an eNB and a gNB).

[0032] In other embodiments, the base station 114a and the WTRUs 102a, 102b, 102c may implement radio technologies such as IEEE 802.11 (i.e., Wireless Fidelity (WiFi), IEEE 802.16 (i.e., Worldwide Interoperability for Microwave Access (WiMAX)), CDMA2000, CDMA2000 1X, CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95 (IS-95), Interim Standard 856 (IS-856), Global System for Mobile communications (GSM), Enhanced Data rates for GSM Evolution (EDGE), GSM EDGE (GERAN), and the like.

[0033] The base station 114b in FIG. 1 A may be a wireless router, Home Node B, Home eNode B, or access point, for example, and may utilize any suitable RAT for facilitating wireless connectivity in a localized area, such as a place of business, a home, a vehicle, a campus, an industrial facility, an air corridor (e.g., for use by drones), a roadway, and the like. In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology such as IEEE 802.11 to establish a wireless local area network (WLAN). In an embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology such as IEEE 802.15 to establish a wireless personal area network (WPAN). In yet another embodiment, the base station 114b and the WTRUs 102c, 102d may utilize a cellular-based RAT (e.g., WCDMA, CDMA2000, GSM, LTE, LTE-A, LTE-A Pro, NR etc.) to establish a picocell orfemtocell. As shown in FIG. 1 A, the base station 114b may have a direct connection to the Internet 110. Thus, the base station 114b may not be required to access the Internet 110 via the CN 106 / 115.

[0034] The RAN 104 / 113 may be in communication with the CN 106 / 115, which may be any type of network configured to provide voice, data, applications, and / or voice over internet protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have varying quality of service (QoS) requirements, such as differing throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, and the like. The CN 106 / 115 may provide call control, billing services, mobile location-based services, pre-paid calling, Internet connectivity, video distribution, etc., and / or perform high-level security functions, such as user authentication. Although not shown in FIG. 1A, it will be appreciated that the RAN 104 / 113 and / or the CN 106 / 115 may be in direct or indirect communication with other RANs that employ the same RAT as the RAN 104 / 113 or a different RAT. For example, in addition to being connected to the RAN 104 / 113, which may be utilizing a NR radio technology, the CN 106 / 115 may also be in communication with another RAN (not shown) employing a GSM, UMTS, CDMA 2000, WiMAX, E-UTRA, or WiFi radio technology.

[0035] The CN 106 / 115 may also serve as a gateway for the WTRUs 102a, 102b, 102c, 102d to access the PSTN 108, the Internet 110, and / or the other networks 112. The PSTN 108 may include circuit- switched telephone networks that provide plain old telephone service (POTS). The Internet 110 may include a global system of interconnected computer networks and devices that use common communication protocols, such as the transmission control protocol (TCP), user datagram protocol (UDP) and / or the internet protocol (IP) in the TCP / IP internet protocol suite. The networks 112 may include wired and / or wireless communications networks owned and / or operated by other service providers. For example, the networks 112 may include another CN connected to one or more RANs, which may employ the same RAT as the RAN 104 / 113 or a different RAT.

[0036] Some or all of the WTRUs 102a, 102b, 102c, 102d in the communications system 100 may include multi-mode capabilities (e.g., the WTRUs 102a, 102b, 102c, 102d may include multiple transceivers for communicating with different wireless networks over different wireless links). For example, the WTRU 102c shown in FIG. 1A may be configured to communicate with the base station 114a, which may employ a cellular-based radio technology, and with the base station 114b, which may employ an IEEE 802 radio technology.

[0037] FIG. 1 B is a system diagram illustrating an example WTRU 102. As shown in FIG. 1 B, the WTRU 102 may include a processor 118, a transceiver 120, a transmit / receive element 122, a speaker / microphone 124, a keypad 126, a display / touchpad 128, non-removable memory 130, removable memory 132, a power source 134, a global positioning system (GPS) chipset 136, and / or other peripherals138, among others. It will be appreciated that the WTRU 102 may include any sub-combination of the foregoing elements while remaining consistent with an embodiment.

[0038] The processor 118 may be a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) circuits, any other type of integrated circuit (IC), a state machine, and the like. The processor 118 may perform signal coding, data processing, power control, input / output processing, and / or any other functionality that enables the WTRU 102 to operate in a wireless environment. The processor 118 may be coupled to the transceiver 120, which may be coupled to the transmit / receive element 122. While FIG. 1 B depicts the processor 118 and the transceiver 120 as separate components, it will be appreciated that the processor 118 and the transceiver 120 may be integrated together in an electronic package or chip.

[0039] The transmit / receive element 122 may be configured to transmit signals to, or receive signals from, a base station (e.g., the base station 114a) over the air interface 116. For example, in one embodiment, the transmit / receive element 122 may be an antenna configured to transmit and / or receive RF signals. In an embodiment, the transmit / receive element 122 may be an emitter / detector configured to transmit and / or receive IR, UV, or visible light signals, for example. In yet another embodiment, the transmit / receive element 122 may be configured to transmit and / or receive both RF and light signals. It will be appreciated that the transmit / receive element 122 may be configured to transmit and / or receive any combination of wireless signals.

[0040] Although the transmit / receive element 122 is depicted in FIG. 1 B as a single element, the WTRU 102 may include any number of transmit / receive elements 122. More specifically, the WTRU 102 may employ MIMO technology. Thus, in one embodiment, the WTRU 102 may include two or more transmit / receive elements 122 (e.g., multiple antennas) for transmitting and receiving wireless signals over the air interface 116.

[0041] The transceiver 120 may be configured to modulate the signals that are to be transmitted by the transmit / receive element 122 and to demodulate the signals that are received by the transmit / receive element 122. As noted above, the WTRU 102 may have multi-mode capabilities. Thus, the transceiver 120 may include multiple transceivers for enabling the WTRU 102 to communicate via multiple RATs, such as NR and I EEE 802.11 , for example.

[0042] The processor 118 of the WTRU 102 may be coupled to, and may receive user input data from, the speaker / microphone 124, the keypad 126, and / or the display / touchpad 128 (e.g., a liquid crystal display (LCD) display unit or organic light-emitting diode (OLED) display unit). The processor 118 may also outputuser data to the speaker / microphone 124, the keypad 126, and / or the display / touchpad 128. In addition, the processor 118 may access information from, and store data in, any type of suitable memory, such as the non-removable memory 130 and / or the removable memory 132. The non-removable memory 130 may include random-access memory (RAM), read-only memory (ROM), a hard disk, or any other type of memory storage device. The removable memory 132 may include a subscriber identity module (SIM) card, a memory stick, a secure digital (SD) memory card, and the like. In other embodiments, the processor 118 may access information from, and store data in, memory that is not physically located on the WTRU 102, such as on a server or a home computer (not shown).

[0043] The processor 118 may receive power from the power source 134 and may be configured to distribute and / or control the power to the other components in the WTRU 102. The power source 134 may be any suitable device for powering the WTRU 102. For example, the power source 134 may include one or more dry cell batteries (e.g., nickel-cadmium (NiCd), nickel-zinc (NiZn), nickel metal hydride (NiMH), lithium-ion (Li-ion), etc.), solar cells, fuel cells, and the like.

[0044] The processor 118 may also be coupled to the GPS chipset 136, which may be configured to provide location information (e.g., longitude and latitude) regarding the current location of the WTRU 102. In addition to, or in lieu of, the information from the GPS chipset 136, the WTRU 102 may receive location information over the air interface 116 from a base station (e.g., base stations 114a, 114b) and / or determine its location based on the timing of the signals being received from two or more nearby base stations. It will be appreciated that the WTRU 102 may acquire location information by way of any suitable locationdetermination method while remaining consistent with an embodiment.

[0045] The processor 118 may further be coupled to other peripherals 138, which may include one or more software and / or hardware modules that provide additional features, functionality and / or wired or wireless connectivity. For example, the peripherals 138 may include an accelerometer, an e-compass, a satellite transceiver, a digital camera (for photographs and / or video), a universal serial bus (USB) port, a vibration device, a television transceiver, a hands free headset, a Bluetooth® module, a frequency modulated (FM) radio unit, a digital music player, a media player, a video game player module, an Internet browser, a Virtual Reality and / or Augmented Reality (VR / AR) device, an activity tracker, and the like. The peripherals 138 may include one or more sensors, the sensors may be one or more of a gyroscope, an accelerometer, a hall effect sensor, a magnetometer, an orientation sensor, a proximity sensor, a temperature sensor, a time sensor; a geolocation sensor; an altimeter, a light sensor, a touch sensor, a magnetometer, a barometer, a gesture sensor, a biometric sensor, and / or a humidity sensor.

[0046] The WTRU 102 may include a full duplex radio for which transmission and reception of some or all of the signals (e.g., associated with particular subframes for both the UL (e.g., for transmission) anddownlink (e.g., for reception) may be concurrent and / or simultaneous. The full duplex radio may include an interference management unit to reduce and or substantially eliminate self-interference via either hardware (e.g., a choke) or signal processing via a processor (e.g., a separate processor (not shown) or via processor 118). In an embodiment, the WRTU 102 may include a half-duplex radio for which transmission and reception of some or all of the signals (e.g., associated with particular subframes for either the UL (e.g., for transmission) or the downlink (e.g., for reception)).

[0047] FIG. 1 C is a system diagram illustrating the RAN 104 and the CN 106 according to an embodiment. As noted above, the RAN 104 may employ an E-UTRA radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 104 may also be in communication with the CN 106.

[0048] The RAN 104 may include eNode-Bs 160a, 160b, 160c, though it will be appreciated that the RAN 104 may include any number of eNode-Bs while remaining consistent with an embodiment. The eNode-Bs 160a, 160b, 160c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the eNode-Bs 160a, 160b, 160c may implement MIMO technology. Thus, the eNode-B 160a, for example, may use multiple antennas to transmit wireless signals to, and / or receive wireless signals from, the WTRU 102a.

[0049] Each of the eNode-Bs 160a, 160b, 160c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in the UL and / or DL, and the like. As shown in FIG. 1 C, the eNode-Bs 160a, 160b, 160c may communicate with one another over an X2 interface.

[0050] The CN 106 shown in FIG. 1 C may include a mobility management entity (MME) 162, a serving gateway (SGW) 164, and a packet data network (PDN) gateway (or PGW) 166. While each of the foregoing elements are depicted as part of the CN 106, it will be appreciated that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0051] The MME 162 may be connected to each of the eNode-Bs 160a, 160b, 160c in the RAN 104 via an S1 interface and may serve as a control node. For example, the MME 162 may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, bearer activation / deactivation, selecting a particular serving gateway during an initial attach of the WTRUs 102a, 102b, 102c, and the like. The MME 162 may provide a control plane function for switching between the RAN 104 and other RANs (not shown) that employ other radio technologies, such as GSM and / or WCDMA.

[0052] The SGW 164 may be connected to each of the eNode Bs 160a, 160b, 160c in the RAN 104 via the S1 interface. The SGW 164 may generally route and forward user data packets to / from the WTRUs 102a, 102b, 102c. The SGW 164 may perform other functions, such as anchoring user planes during inter-eNode B handovers, triggering paging when DL data is available for the WTRUs 102a, 102b, 102c, managing and storing contexts of the WTRUs 102a, 102b, 102c, and the like.

[0053] The SGW 164 may be connected to the PGW 166, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices.

[0054] The CN 106 may facilitate communications with other networks. For example, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to circuit-switched networks, such as the PSTN 108, to facilitate communications between the WTRUs 102a, 102b, 102c and traditional land-line communications devices. For example, the CN 106 may include, or may communicate with, an IP gateway (e.g., an IP multimedia subsystem (IMS) server) that serves as an interface between the CN 106 and the PSTN 108. In addition, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to the other networks 112, which may include other wired and / or wireless networks that are owned and / or operated by other service providers.

[0055] Although the WTRU is described in FIGS. 1 A-1 D as a wireless terminal, it is contemplated that in certain representative embodiments that such a terminal may use (e.g., temporarily, or permanently) wired communication interfaces with the communication network.

[0056] In representative embodiments, the other network 112 may be a WLAN.

[0057] A WLAN in Infrastructure Basic Service Set (BSS) mode may have an Access Point (AP) for the BSS and one or more stations (STAs) associated with the AP. The AP may have an access or an interface to a Distribution System (DS) or another type of wired / wireless network that carries traffic in to and / or out of the BSS. Traffic to STAs that originates from outside the BSS may arrive through the AP and may be delivered to the STAs. Traffic originating from STAs to destinations outside the BSS may be sent to the AP to be delivered to respective destinations. Traffic between STAs within the BSS may be sent through the AP, for example, where the source STA may send traffic to the AP and the AP may deliver the traffic to the destination STA. The traffic between STAs within a BSS may be considered and / or referred to as peer-to- peer traffic. The peer-to-peer traffic may be sent between (e.g., directly between) the source and destination STAs with a direct link setup (DLS). In certain representative embodiments, the DLS may use an 802.11e DLS or an 802.11 z tunneled DLS (TDLS). A WLAN using an Independent BSS (I BSS) mode may not have an AP, and the STAs (e.g., all of the STAs) within or using the IBSS may communicate directly with each other. The IBSS mode of communication may sometimes be referred to herein as an “ad- hoc” mode of communication.

[0058] When using the 802.11 ac infrastructure mode of operation or a similar mode of operations, theAP may transmit a beacon on a fixed channel, such as a primary channel. The primary channel may be afixed width (e.g., 20 MHz wide bandwidth) or a dynamically set width via signaling. The primary channel may be the operating channel of the BSS and may be used by the STAs to establish a connection with the AP. In certain representative embodiments, Carrier Sense Multiple Access with Collision Avoidance (CSMA / CA) may be implemented, for example in 802.11 systems. For CSMA / CA, the STAs (e.g., every STA), including the AP, may sense the primary channel. If the primary channel is sensed / detected and / or determined to be busy by a particular STA, the particular STA may back off. One STA (e.g., only one station) may transmit at any given time in a given BSS.

[0059] High Throughput (HT) STAs may use a 40 MHz wide channel for communication, for example, via a combination of the primary 20 MHz channel with an adjacent or nonadjacent 20 MHz channel to form a 40 MHz wide channel.

[0060] Very High Throughput (VHT) STAs may support 20MHz, 40 MHz, 80 MHz, and / or 160 MHz wide channels. The 40 MHz, and / or 80 MHz, channels may be formed by combining contiguous 20 MHz channels. A 160 MHz channel may be formed by combining 8 contiguous 20 MHz channels, or by combining two non-contiguous 80 MHz channels, which may be referred to as an 80+80 configuration. For the 80+80 configuration, the data, after channel encoding, may be passed through a segment parser that may divide the data into two streams. Inverse Fast Fourier Transform (IFFT) processing, and time domain processing, may be done on each stream separately. The streams may be mapped on to the two 80 MHz channels, and the data may be transmitted by a transmitting STA. At the receiver of the receiving STA, the above-described operation for the 80+80 configuration may be reversed, and the combined data may be sent to the Medium Access Control (MAC).

[0061] Sub 1 GHz modes of operation are supported by 802.11af and 802.11 ah. The channel operating bandwidths, and carriers, are reduced in 802.11 af and 802.11 ah relative to those used in 802.11 n, and 802.11 ac. 802.11 af supports 5 MHz, 10 MHz and 20 MHz bandwidths in the TV White Space (TVWS) spectrum, and 802.11 ah supports 1 MHz, 2 MHz, 4 MHz, 8 MHz, and 16 MHz bandwidths using non- TVWS spectrum. According to a representative embodiment, 802.11 ah may support Meter Type Control / Machine-Type Communications, such as MTC devices in a macro coverage area. MTC devices may have certain capabilities, for example, limited capabilities including support for (e.g., only support for) certain and / or limited bandwidths. The MTC devices may include a battery with a battery life above a threshold (e.g., to maintain a very long battery life).

[0062] WLAN systems, which may support multiple channels, and channel bandwidths, such as 802.11 n, 802.11 ac, 802.11 af, and 802.11 ah, include a channel which may be designated as the primary channel. The primary channel may have a bandwidth equal to the largest common operating bandwidth supported by all STAs in the BSS. The bandwidth of the primary channel may be set and / or limited by aSTA, from among all STAs operating in a BSS, which supports the smallest bandwidth operating mode. In the example of 802.11 ah, the primary channel may be 1 MHz wide for STAs (e.g., MTC type devices) that support (e.g., only support) a 1 MHz mode, even if the AP, and other STAs in the BSS support 2 MHz, 4 MHz, 8 MHz, 16 MHz, and / or other channel bandwidth operating modes. Carrier sensing and / or Network Allocation Vector (NAV) settings may depend on the status of the primary channel. If the primary channel is busy, for example, due to a STA (which supports only a 1 MHz operating mode), transmitting to the AP, the entire available frequency bands may be considered busy even though a majority of the frequency bands remains idle and may be available.

[0063] In the United States, the available frequency bands, which may be used by 802.11 ah, are from 902 MHz to 928 MHz. In Korea, the available frequency bands are from 917.5 MHz to 923.5 MHz. In Japan, the available frequency bands are from 916.5 MHz to 927.5 MHz. The total bandwidth available for 802.11 ah is 6 MHz to 26 MHz depending on the country code.

[0064] FIG. 1 D is a system diagram illustrating the RAN 113 and the CN 115 according to an embodiment. As noted above, the RAN 113 may employ an NR radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 113 may also be in communication with the CN 115.

[0065] The RAN 113 may include gNBs 180a, 180b, 180c, though it will be appreciated that the RAN 113 may include any number of gNBs while remaining consistent with an embodiment. The gNBs 180a, 180b, 180c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the gNBs 180a, 180b, 180c may implement MIMO technology. For example, gNBs 180a, 108b may utilize beamforming to transmit signals to and / or receive signals from the gNBs 180a, 180b, 180c. Thus, the gNB 180a, for example, may use multiple antennas to transmit wireless signals to, and / or receive wireless signals from, the WTRU 102a. In an embodiment, the gNBs 180a, 180b, 180c may implement carrier aggregation technology. For example, the gNB 180a may transmit multiple component carriers to the WTRU 102a (not shown). A subset of these component carriers may be on unlicensed spectrum while the remaining component carriers may be on licensed spectrum. In an embodiment, the gNBs 180a, 180b, 180c may implement Coordinated Multi-Point (CoMP) technology. For example, WTRU 102a may receive coordinated transmissions from gNB 180a and gNB 180b (and / or gNB 180c).

[0066] The WTRUs 102a, 102b, 102c may communicate with gNBs 180a, 180b, 180c using transmissions associated with a scalable numerology. For example, the OFDM symbol spacing and / or OFDM subcarrier spacing may vary for different transmissions, different cells, and / or different portions of the wireless transmission spectrum. The WTRUs 102a, 102b, 102c may communicate with gNBs 180a,180b, 180c using subframe or transmission time intervals (TTIs) of various or scalable lengths (e.g., containing varying number of OFDM symbols and / or lasting varying lengths of absolute time).

[0067] The gNBs 180a, 180b, 180c may be configured to communicate with the WTRUs 102a, 102b, 102c in a standalone configuration and / or a non-standalone configuration. In the standalone configuration, WTRUs 102a, 102b, 102c may communicate with gNBs 180a, 180b, 180c without also accessing other RANs (e.g., such as eNode-Bs 160a, 160b, 160c). In the standalone configuration, WTRUs 102a, 102b, 102c may utilize one or more of gNBs 180a, 180b, 180c as a mobility anchor point. In the standalone configuration, WTRUs 102a, 102b, 102c may communicate with gNBs 180a, 180b, 180c using signals in an unlicensed band. In a non-standalone configuration WTRUs 102a, 102b, 102c may communicate with / connect to gNBs 180a, 180b, 180c while also communicating with / connecting to another RAN such as eNode-Bs 160a, 160b, 160c. For example, WTRUs 102a, 102b, 102c may implement DC principles to communicate with one or more gNBs 180a, 180b, 180c and one or more eNode-Bs 160a, 160b, 160c substantially simultaneously. In the non-standalone configuration, eNode-Bs 160a, 160b, 160c may serve as a mobility anchor for WTRUs 102a, 102b, 102c and gNBs 180a, 180b, 180c may provide additional coverage and / or throughput for servicing WTRUs 102a, 102b, 102c.

[0068] Each of the gNBs 180a, 180b, 180c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in the UL and / or DL, support of network slicing, dual connectivity, interworking between NR and E- UTRA, routing of user plane data towards User Plane Function (UPF) 184a, 184b, routing of control plane information towards Access and Mobility Management Function (AMF) 182a, 182b and the like. As shown in FIG. 1 D, the gNBs 180a, 180b, 180c may communicate with one another over an Xn interface.

[0069] The CN 115 shown in FIG. 1 D may include at least one AMF 182a, 182b, at least one UPF 184a, 184b, at least one Session Management Function (SMF) 183a, 183b, and possibly a Data Network (DN) 185a, 185b. While each of the foregoing elements are depicted as part of the CN 115, it will be appreciated that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0070] The AMF 182a, 182b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via an N2 interface and may serve as a control node. For example, the AMF 182a, 182b may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, support for network slicing (e.g., handling of different PDU sessions with different requirements), selecting a particular SMF 183a, 183b, management of the registration area, termination of NAS signaling, mobility management, and the like. Network slicing may be used by the AMF 182a, 182b in order to customize CN support for WTRUs 102a, 102b, 102c based on the types of services being utilized WTRUs 102a, 102b, 102c. For example, differentnetwork slices may be established for different use cases such as services relying on ultra-reliable low latency (URLLC) access, services relying on enhanced massive mobile broadband (eMBB) access, services for machine type communication (MTC) access, and / or the like. The AMF 162 may provide a control plane function for switching between the RAN 113 and other RANs (not shown) that employ other radio technologies, such as LTE, LTE-A, LTE-A Pro, and / or non-3GPP access technologies such as WiFi.

[0071] The SMF 183a, 183b may be connected to an AMF 182a, 182b in the CN 115 via an N11 interface. The SMF 183a, 183b may also be connected to a UPF 184a, 184b in the CN 115 via an N4 interface. The SMF 183a, 183b may select and control the UPF 184a, 184b and configure the routing of traffic through the UPF 184a, 184b. The SMF 183a, 183b may perform other functions, such as managing and allocating UE IP address, managing PDU sessions, controlling policy enforcement and QoS, providing downlink data notifications, and the like. A PDU session type may be IP-based, non-IP based, Ethernetbased, and the like.

[0072] The UPF 184a, 184b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via an N3 interface, which may provide the WTRUs 102a, 102b, 102c with access to packet- switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices. The UPF 184a, 184b may perform other functions, such as routing and forwarding packets, enforcing user plane policies, supporting multi-homed PDU sessions, handling user plane QoS, buffering downlink packets, providing mobility anchoring, and the like.

[0073] The CN 115 may facilitate communications with other networks. For example, the CN 115 may include, or may communicate with, an IP gateway (e.g., an IP multimedia subsystem (IMS) server) that serves as an interface between the CN 115 and the PSTN 108. In addition, the CN 115 may provide the WTRUs 102a, 102b, 102c with access to the other networks 112, which may include other wired and / or wireless networks that are owned and / or operated by other service providers. In one embodiment, the WTRUs 102a, 102b, 102c may be connected to a local Data Network (DN) 185a, 185b through the UPF 184a, 184b via the N3 interface to the UPF 184a, 184b and an N6 interface between the UPF 184a, 184b and the DN 185a, 185b.

[0074] In view of Figures 1 A-1 D, and the corresponding description of Figures 1 A-1 D, one or more, or all, of the functions described herein with regard to one or more of: WTRU 102a-d, Base Station 114a-b, eNode-B 160a-c, MME 162, SGW 164, PGW 166, gNB 180a-c, AMF 182a-b, UPF 184a-b, SMF 183a-b, DN 185a-b, and / or any other device(s) described herein, may be performed by one or more emulation devices (not shown). The emulation devices may be one or more devices configured to emulate one or more, or all, of the functions described herein. For example, the emulation devices may be used to test other devices and / or to simulate network and / or WTRU functions.

[0075] The emulation devices may be designed to implement one or more tests of other devices in a lab environment and / or in an operator network environment. For example, the one or more emulation devices may perform the one or more, or all, functions while being fully or partially implemented and / or deployed as part of a wired and / or wireless communication network in order to test other devices within the communication network. The one or more emulation devices may perform the one or more, or all, functions while being temporarily implemented / deployed as part of a wired and / or wireless communication network. The emulation device may be directly coupled to another device for purposes of testing and / or may perform testing using over-the-air wireless communications.

[0076] The one or more emulation devices may perform the one or more, including all, functions while not being implemented / deployed as part of a wired and / or wireless communication network. For example, the emulation devices may be utilized in a testing scenario in a testing laboratory and / or a non-deployed (e.g., testing) wired and / or wireless communication network in order to implement testing of one or more components. The one or more emulation devices may be testing equipment. Direct RF coupling and / or wireless communications via RF circuitry (e.g., which may include one or more antennas) may be used by the emulation devices to transmit and / or receive data.

[0077] Reference to a timer herein may refer to a time, a time period, a tracking of time, a tracking of a period of time, a combination thereof, and / or the like. Reference to a timer expiration herein may refer to determining that the time has occurred or that the period of time has expired.

[0078] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. A relay WTRU may be in direct proximity to a discoverer WTRU. The relay WTRU may include a processor. The processor may be configured to perform one or more of the following. The relay WTRU may receive a first protected discovery solicitation message from the discoverer WTRU. The first protected discovery solicitation message may include a first protected direct discovery set. The first protected direct discovery set may include encrypted discoverer user information and discoveree user information. The relay WTRU may allocate a direct discovery solicitation identification (ID) and may be associated the direct discovery solicitation ID with a discoverer source Layer 2 (L2) ID. The WTRU source L2 ID may be associated with the second WTRU. The relay WTRU may send a second protected discovery solicitation message to a relay WTRU. The second protected discovery solicitation message may include the first protected direct discovery set and the direct discovery solicitation ID.

[0079] A first protected discovery solicitation response message may be received from the relay WTRU. The first protected discovery solicitation response message may include a second protected direct discovery set and the direct discovery solicitation ID. The relay WTRU may determine the discoverer source L2 ID associated with the discoverer WTRU using the direct discovery solicitation ID. The relayWTRU may send a second protected discovery solicitation response message to the discoverer WTRU. The second protected discovery solicitation response message may include the second protected direct discovery set.

[0080] In an example, the source L2 ID may be a first source L2 ID. The allocation of the direct discovery solicitation ID by the processor may involve associating the direct discovery solicitation ID with a second source L2 ID.

[0081] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. The first WTRU may include a processor that is configured to perform one or more of the following. The first WTRU may receive a protected discovery solicitation message from the second WTRU. The protected discovery solicitation message may include relay user information, a direct discovery solicitation ID, and / or a first protected direct discovery set. The first protected direct discovery set may include encrypted discoverer user information and / or encrypted discoveree user information. The direct discovery solicitation ID may be associated with a relay source Layer 2 (L2) ID. The first WTRU may send a protected discovery solicitation response message to the second WTRU. The protected discovery solicitation response message may include a second protected direct discovery set and the discovery solicitation ID.

[0082] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. A first WTRU, which may be an intermediate relay WTRU, may be provided. The first WTRU may include a processor that is programmed to perform one or more processes. The first WTRU may receive a first protected discovery solicitation message from a second relay WTRU. The first protected discovery solicitation message may include one or more of a Relay Service Code indication, user information for the second relay WTRU, a first protected direct discovery set, and / or a direct discovery solicitation Identifier (ID). The direct discovery solicitation ID may be associated with the source Layer 2 (L2) ID of the second relay WTRU. Based on the relay indicator and / or an indicator for multi-hop support associated with the RSC, the first WTRU may send a second protected discovery solicitation message to a discoveree WTRU. The second protected discovery solicitation message may include the RSC, one or more of the user information for the first relay WTRU, the first protected direct discovery set, and / or the direct discovery solicitation ID. The first WTRU may receive a protected discovery solicitation response message from the discoveree WTRU. The protected discovery solicitation response message may include one or more of the RSC, a second protected direct discovery set, and / or the direct discovery solicitation ID. The first WTRU may determine the source L2 ID of the second relay WTRU using the direct discovery solicitation ID. The first WTRU may send a second protected discovery solicitation response message tothe second WTRU. The second protected discovery solicitation response message may include a second protected direct discovery set.

[0083] In an example, it may be determined that the second WTRU is provisioned with a Relay Service Code (RSC) with an associated indicator for multi-hop support.

[0084] In an example, the first protected direct discovery set may be, or may include, encrypted discoverer user information and / or encrypted discoveree user information.

[0085] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. A first WTRU, which may be a U2U relay, may be provided. The first WTRU may include a processor that is configured to perform one or more processes. The first WTRU may receive a first protected discovery solicitation message from the remote WTRU. The first protected discovery solicitation message may include encrypted remote WTRU user information and / or WTRU-to-Network (U2N) relay user information within a first protected U2N discovery set. The first WTRU may allocate the U2N relay discovery solicitation identification (ID) and associate the U2N relay discovery solicitation ID with a remote WTRU source Layer 2 (L2) ID that is associated with the remote WTRU. The first WTRU may send a second protected discovery solicitation message to a second relay WTRU. The second protected discovery solicitation message may include the first protected U2N discovery set and / or the U2N relay discovery solicitation ID. The first WTRU may receive a first protected discovery solicitation response message from the second relay WTRU. The first protected discovery solicitation response message may include a second protected U2N discovery set and / or the U2N relay discovery solicitation ID. The first WTRU may determine the remote WTRU source L2 ID associated with the remote WTRU using the U2N relay discovery solicitation ID. The first WTRU may send a second protected discovery solicitation response message to the remote WTRU. The second protected discovery solicitation response message may include the second protected U2N discovery set.

[0086] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. A first WTRU, which may be a U2N relay, may be provided. The first WTRU may include a processor that is configured to perform one or more processes. The first WTRU may receive a protected discovery solicitation message from a UE-to-UE (U2U) relay. The protected discovery solicitation message may include one or more of a U2U relay user information, a first protected U2N discovery set, and / or a U2N relay discovery solicitation identification (ID). The first WTRU may associate the U2N relay discovery solicitation ID with a U2U relay source Layer 2 (L2) ID. The first WTRU may send a protected discovery solicitation response message to the U2U relay. The protected discovery solicitation response message may include a second protected U2N discovery set and the U2N relay discovery solicitation ID.

[0087] In an example, the first protected U2N discovery set may include a U2N Relay Service Code (RSC), encrypted remote WTRU user information, and / or U2N relay user information.

[0088] Systems, methods, and apparatus are provided for relay discovery and / or communication security enhancements. A first WTRU, which may be a U2U relay, may be provided. The first WTRU may include a processor that is programmed to perform one or more processes. The first WTRU may receive a first protected discovery solicitation message from a second U2U relay WTRU. The first protected discovery solicitation message may include one or more of a U2U Relay Service Code (U2U_RSC), a relay indication, U2U relay user information associated with the second U2U relay WTRU, a first protected UE- to-Network (U2N) discovery set, and a U2N relay discovery solicitation identification (ID). The first WTRU may associate the U2N relay discovery solicitation ID with the second U2U relay source Layer 2 (L2) ID. Based on the relay indication and / or an indication for multi-hop support associated with the U2U_RSC, the first WTRU may send a second protected discovery solicitation message to a U2N relay WTRU. The second protected discovery solicitation message may include one or more of the U2U relay user information related to the first U2U relay WTRU, the first protected U2N discovery set, and / or the U2N relay discovery solicitation ID. The first WTRU may receive a protected discovery solicitation response message from the U2N relay WTRU. The protected discovery solicitation response message may include one or more of a second protected U2N discovery set and the U2N relay discovery solicitation ID. The first WTRU may determine the source L2 ID of the second U2U relay using the U2N relay discovery ID. The first WTRU may send a second protected discovery solicitation response message to the second U2U relay WTRU. The second protected discovery solicitation response message may include the second protected U2N discovery set.

[0089] In an example, it may be determined that the first U2U relay is provisioned with a U2U Relay Service Code (U2U_RSC) with an associated indication for multi-hop support.

[0090] In an example, the first protected UE-to-Network (U2N) discovery set may include one or more of U2N_RSC, encrypted remote WTRU user information, and / or U2N relay user information.

[0091] Systems, methods, and apparatus are provided for a device, such as a UE-to-Network (U2N) relay wireless transmit / receive unit (WTRU). The U2N relay WTRU may be configured to perform one or more of the following.

[0092] The device, e.g., the U2N relay WTRU, may send a discovery message during a U2N relay discovery procedure. The discovery message may include a direct connection request security identification (ID) (DSID). In examples, the discovery message may be a UE-to-UE (U2U) relay discovery announcement message. In examples, the discovery message is a WTRU-to-WTRU relay discovery solicitation response message. In examples, the discovery message may be, or may include, at least oneof a protected U2N relay discovery announcement message or a protected U2N relay discovery solicitation response message.

[0093] The U2N relay WTRU may receive a direct connection request (DCR) message. For example, the U2N relay WTRU may receive a DCR message from a remote WTRU. The DCR message may be, or may include, the DSID, an encrypted U2N Relay Service Code (U2N_RSC), and / or an encrypted ProSe remote user key (PRUK) ID.

[0094] The U2N relay WTRU may determine, from the DCR message, a discovery security key based on the DSID. The DSID may be associated with the discovery security key. For example, the DSID may be associated with the discovery security key based on the U2N relay WTRU generating a mapping between the DSID and the discovery security key. The discovery security key may be, or may include, a U2N Relay Service Code (U2N_RSC) discovery security key.

[0095] The U2N relay WTRU may decrypt the encrypted U2N_RSC and PRUK ID based on the discovery security key.

[0096] The U2N relay WTRU may determine that the U2N relay WTRU is configured with the U2N_RSC and is associated with a U2N relay discovery security key.

[0097] The DSID described herein may be associated with and / or correspond to a specific remote WTRU. For example, the DSID may be unique for a remote WTRU. In examples, a first DSID may be associated with a first remote WTRU and a second DSID may be associated with a second remote WTRU.

[0098] Systems, methods, and apparatus are provided for a DCR message protecting processing. A first WTRU, which may be a U2N relay, may be provided. The first WTRU may include a processor. The processor may be programmed to perform one or more processes. The first WTRU may send an announcement message during a U2N relay discovery procedure. The announcement message may include a DSID. The DSID may be associated with a U2N_RSC and / or one or more discovery security keys. The first WTRU may receive a DCR message from a remote WTRU. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID. The first WTRU may determine the discovery security keys using the DSID and a mapping, e.g., that is established during a discovery process. The first WTRU may decrypt the encrypted U2N_RSC and / or the PRUK ID using the one or more discovery security keys.

[0099] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be a remote WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The remote WTRU may receive an announcement message. The announcement message may be, or may include, a DSID. The DSID may be associated with one or more discovery security keys. The DSID may be associated with a U2N_RSCand / or the one or more discovery security keys and U2N relay user information. The remote WTRU may send a DCR to a U2N relay. The DCR message may be protected using the one or more discovery security keys. For example, a portion of the DCR messages, such as the RSC and / or the PRUK lEs associated with the DCR messages, may be protected using the one or more discovery security keys. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID.

[0100] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be a U2U relay, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The U2U relay may send an announcement message. The U2U relay may determine a DSID. The DSID may be associated with a U2U_RSC and / or one or more discovery security keys. The U2U relay may receive a DCR message from an end WTRU. The DCR message may be, or may include, one or more of the DSID and an encrypted U2U_RSC and / or an encrypted PRUK ID. The U2U relay may determine a discovery security key, e.g., using the received DSID and / or mapping established during a discovery process. The discovery security key may be, or may include, a U2N Relay Service Code (U2N_RSC) discovery security key. The U2U relay may decrypt U2U_RSC and / or PRUK ID, e.g., using the discovery security key.

[0101] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be an end WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The end WTRU may receive a U2U relay discovery message, e.g., the protected U2U relay discovery message. The protected U2U relay discovery message may be, or may include, one or more of a DSID associated with a U2U_RSC and / or one or more discovery security keys. The DSID may be associated with the U2U relay user information. The end WTRU may send a DCR message a UE-to-UE (U2U) relay WTRU. The DCR message (e.g., a portion of the DCR message) may be protected, e.g., using the one or more discovery security keys. The DCR message may include one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID.

[0102] Systems, methods, and apparatus are provided for a DCR message protecting processing. A first WTRU, which may be a U2N relay, may be provided. The first WTRU may include a processor. The processor may be programmed to perform one or more processes. The first WTRU may send an announcement message during a U2N relay discovery procedure. The announcement message may include a DSID. The DSID may be associated with a U2N_RSC and / or one or more discovery security keys. The first WTRU may receive a DCR message from a remote WTRU. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID. The first WTRU may determine the discovery security keys using the DSID and a mapping, e.g., that is establishedduring a discovery process. The first WTRU may decrypt the encrypted U2N_RSC and / or the PRUK ID using the one or more discovery security keys.

[0103] In an example, it may be determined that the U2N relay WTRU is configured with the U2N_RSC and may be associated with one or more U2N relay discovery security keys.

[0104] In an example, the one or more discovery security keys may be associated with a U2N Relay Service Code (U2N_RSC).

[0105] In an example, the announcement message may be a U2U relay discovery announcement message (e.g., Model A), and the U2U relay discovery announcement message may be, or may include, a U2U Relay discovery set.

[0106] In an example, the announcement message may be a U2U relay discovery solicitation response message (e.g., Model B).

[0107] In an example, the announcement message may be at least one of a protected U2N relay discovery announcement message (e.g., Model A) or a U2N relay discovery solicitation response message (e.g., Model B).

[0108] In an example, the DCR message may be received from a U2U relay.

[0109] Systems, methods, and apparatus are provided for a DCR message protecting processing. AWTRU, which may be a remote WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The WTRU may receive an announcement message. The announcement message may be, or may include, a DSID associated with a U2N_RSC and / or one or more discovery security keys. The DSID may be associated with the U2N relay user information. The WTRU may send a DCR message to a U2N relay using the one or more discovery security keys. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and an encrypted PRUK ID.

[0110] In an example, the WTRU may receive the announcement message during a discovery procedure.

[0111] In an example, the announcement message may be at least one of a protected U2N relay discovery announcement message (e.g., Model A) or a U2N relay discovery solicitation response message (e.g., Model B).

[0112] In an example, the one or more discovery security keys may be, or may include, at least a U2N_RSC discovery security key.

[0113] In an example, the announcement message may be a U2N relay discovery announcement message. The U2N relay discovery announcement message may include the DSID.

[0114] In an example, the DCR message may be a first DCR message, and the WTRU may send a second DCR message to a U2U relay.

[0115] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be a U2U relay, may be provided. The WTRU may be, or may include, a processor. The processor may be programmed to perform one or more processes. The WTRU may send an announcement message. The WTRU may determine a DSID. The DSID may be associated with a U2U_RSC and / or one or more discovery security keys. The WTRU may receive a DCR message from an end WTRU. The DCR message may be, or may include, one or more of the DSID, an encrypted U2U_RSC, and / or an encrypted PRUK ID. The WTRU may determine a discovery security key using the received DSID and / or the mapping established during a discovery process. The discovery security key may be, or may include, a U2N Relay Service Code (U2N_RSC) discovery security key. The WTRU may decrypt the U2U_RSC and / or PRUK ID using the discovery security key.

[0116] In an example, it may be determined that the U2U relay is configured with a U2U_RSC and is associated with one or more U2U relay discovery security keys.

[0117] In an example, the announcement message may be at least one of a protected U2U relay discovery announcement message (e.g., Model A) or a U2N relay discovery solicitation message (e.g., Model B).

[0118] In an example, the WTRU may receive a U2N discovery solicitation response message.

[0119] In an example, the WTRU may send the announcement message during a U2U relay discovery procedure.

[0120] In an example, the one or more security keys may be, or may include, at least one of a U2U_RSC discovery security key or a U2U relay discovery security key.

[0121] Systems, methods, and apparatus are provided for a DCR message protecting processing. A WTRU, which may be an end WTRU, may be provided. The WTRU may include a processor. The processor may be programmed to perform one or more processes. The WTRU may receive a protected U2U relay discovery message. The protected U2U relay discovery message may include one or more of a DSID associated with a U2U_RSC and / or one or more discovery security keys. The WTRU may associate the DSID with the U2U relay user information. The WTRU may send a DCR message to a U2U relay WTRU using the one or more discovery security keys. The DCR message may include one or more of the DSID, an encrypted U2N_RSC, and / or an encrypted PRUK ID.

[0122] In an example, the WTRU may receive the protected U2U relay discovery message during a discovery procedure.

[0123] In an example, it may be determined that the WTRU is configured with a U2U_RSC and is associated with one or more discovery security keys.

[0124] In an example, the announcement message may include at least one of a protected U2U relay discovery announcement message (e.g., Model A) or a U2U relay discovery solicitation message (e.g., Model B).

[0125] In an example, the WTRU may send a discovery solicitation response message (e.g., Model B).

[0126] In an example, the U2U relay WTRU (e.g., a WTRU-to-WTRU device or a UE-to-UE device) may allocate a discovery solicitation ID and associate the discovery solicitation ID with the source L2 ID of the discoverer (e.g., the End WTRU or the remote WTRU). The WTRU may send the discovery solicitation ID in the discovery solicitation message to the next node, which may be the discoveree WTRU (e.g., the end WTRU), U2N relay, and / or another U2U relay.

[0127] In an example, a U2U relay may receive a discovery solicitation ID in a discovery solicitation response message. The U2U relay may use the discovery solicitation ID to locate the discoverer (e.g., source L2 ID) in order to send the discovery solicitation response message to the discoverer.

[0128] During the discovery procedure, the U2N relay may establish a secure DSID with an authorized remote WTRU. The U2N relay may locate the one or more discovery security keys to decrypt the RSC and / or PRUK ID in the DCR, e.g., using the DSID included in the DCR.

[0129] The following abbreviations and acronyms are used herein: wireless transmit / receive unit (WTRU), Authentication Server Function (AUSF), Direct Connection Request / Accept (DCR / DCA), Direct Discovery Name Management Function (DDNMF), Discovery User Confidentiality Key (DUCK), Discovery User Integrity Key (DUIK), Discovery User Scrambling Key (DUSK), Key NR Prose (KNRP), Message Integrity Code (MIC), Policy Control Function (PCF), ProSe Key Management Function (PKMF), Prose remote User Key (PRUK), Relay Service Code (RSC), UE-to-Network Relay (U2N relay), RSC offered by U2N relay (U2N_RSC), UE-to-UE Relay (U2U relay), RSC offered by U2U relay (U2U_RSC), User Plane PRUK (UP-PRUK), and Universal Time Coordinated (UTC).

[0130] U2U relay Discovery Security Model B, using a random discovery solicitation ID (e.g., Single and Multi-Hop) may be provided. One or more U2U relays may employ a random solicitation ID associated with a discoverer WTRU upon receiving a discovery solicitation message. This may be done to determine which discoverer WTRU to send the discovery solicitation response message from a discoveree WTRU.

[0131] If a U2U relay is in proximity (e.g., direct proximity) to a discoverer WTRU (e.g., either single-hop or multi-hop), the U2U relay may perform one or more procedures. The U2U relay may receive a message, e.g., a protected discovery solicitation message, from the discoverer WTRU. The protected discovery solicitation message may include a protected direct discovery set (e.g., a first protected direct discoveryset). A discovery solicitation ID (e.g., a direct discovery solicitation ID) may be allocated and may be associated with the source L2 ID of the discoverer. A protected discovery solicitation message (e.g., a new protected discovery solicitation message) may be sent to a discoveree WTRU / U2U relay. The protected discovery solicitation message (e.g., the new protected discovery solicitation message) may include the first protected direct discovery set and / or the direct discovery solicitation ID. If a protected discovery solicitation response message from the discoveree WTRU / U2U relay is received, the source L2 ID of the discoverer WTRU may be located, e.g., using the direct discovery solicitation ID. The protected discovery solicitation response message may be, or may include, a second protected direct discovery set and / or the direct discovery solicitation ID. A protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) may be sent to the discoverer WTRU. The protected discovery solicitation response message (e.g., the new protected discovery solicitation response message) may include the second protected direct discovery set.

[0132] The discoveree WTRU may receive a protected discovery solicitation message from a U2U relay. The message may include one or more of U2U relay user information, a first protected direct discovery set, and / or a direct discovery solicitation ID. The discoveree WTRU may associate the direct discovery solicitation ID with the U2U relay source L2 ID and send a protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) to the U2U relay. The discovery solicitation response message may include a second protected direct discovery set and / or the discovery solicitation ID.

[0133] A U2U relay, which may be an intermediate U2U relay, may be configured for use in a multi-hop scenario. The U2U relay may be provisioned with an RSC with an associated indication for multi-hop support. The U2U relay may receive a protected discovery solicitation message from a second U2U relay. The message may include an RSC, a relay indication, a second U2U relay user information, a first protected direct discovery set, and / or a direct discovery solicitation ID. The U2U relay may associate the direct discovery solicitation ID with the second U2U relay source L2 ID. Based on the relay indication and / or the indication for multi-hop support associated with the RSC, the U2U relay may send a protected discovery solicitation message (e.g., a new protected discovery solicitation message) to a discoveree WTRU. The protected discovery solicitation message (e.g., the new protected discovery solicitation message) may include the RSC, one or more of its own U2U relay user information, the first protected direct discovery set, and / or the discovery solicitation ID (e.g., direct discovery solicitation ID). The U2U relay may receive a protected discovery solicitation response message from the discoveree WTRU. The protected discovery solicitation response message may include the RSC, one or more of a second protected direct discovery set, and / or the direct discovery solicitation ID. The U2U relay may locate thesource L2 ID of the U2U relay using the direct discovery solicitation ID. The U2U relay may transmit a protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) to the discoverer WTRU. The protected discovery solicitation response message (e.g., the new protected discovery solicitation response message) may include the second protected direct discovery set.

[0134] A U2N relay multi-hop Discovery Security Model B may be provided, for example, using a random discovery solicitation ID. If a U2U relay is in direct proximity to a remote WTRU, the U2U relay may perform one or more processes. The U2U relay may receive a protected discovery solicitation message from the remote WTRU. The protected discovery solicitation message may include a U2U_RSC and / or a first protected U2N discovery set. The U2U relay may allocate a U2N relay discovery solicitation ID and associate the U2N relay discovery solicitation ID with the remote source L2 ID. The U2U relay may send a protected discovery solicitation message (e.g., a new protected discovery solicitation message) to a U2N relay WTRU / U2U relay. The protected discovery solicitation message (e.g., the new protected discovery solicitation message) may include the first protected U2N discovery set and / or the U2N relay discovery solicitation ID. If a protected discovery solicitation response message is received from the U2N relay WTRU / U2U relay, the U2U relay may locate the source L2 ID of the remote WTRU using the U2N relay discovery solicitation ID. The U2U relay may send a protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) to the remote WTRU / The protected discovery solicitation response message (e.g., the new protected discovery solicitation response message) may include the second protected U2N discovery set.

[0135] A U2N relay WTRU may receive a protected discovery solicitation message from a U2U relay. The protected discovery solicitation message may include a U2U_RSC, one or more of U2U relay user information, a first protected U2N discovery set, and / or a U2N relay discovery solicitation ID. The U2N relay WTRU may associate the U2N relay discovery solicitation ID with the U2U relay source L2 ID and may send a protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) to the U2U relay. The response may include the U2U_RSC, a second protected U2N discovery set, and / or the U2N relay discovery solicitation ID.

[0136] An intermediate U2U relay WTRU may be provisioned with a U2U_RSC. For example, the intermediate U2U relay WTRU may be provisioned with a U2U_RSC with an associated indication for multihop support. The intermediate U2U relay may receive a protected discovery solicitation message from a second U2U relay. The protected discovery solicitation message may include a U2U_RSC, a relay indication, second U2U relay user information, a first protected U2N discovery set, and / or a U2N relay discovery solicitation ID. The intermediate U2U relay may associate the U2N relay discovery solicitation ID with the second U2U relay source L2 ID. Based on the relay indication and / or multi-hop support indicationassociated with U2LLRSC, the intermediate U2U relay may send a protected discovery solicitation message (e.g., a new protected discovery solicitation message) to a U2N relay WTRU. If a protected discovery solicitation response message is received from the U2N relay WTRU, the intermediate U2U relay may locate the source L2 ID of the second U2U relay using the U2N relay discovery ID. The intermediate U2U relay may send a protected discovery solicitation response message (e.g., a new protected discovery solicitation response message) to the remote WTRU. The protected discovery solicitation response message (e.g., the new protected discovery solicitation response message) may include the second protected U2N discovery set.

[0137] DCR message protection processing by a U2N relay (e.g., a U2N relay WTRU) may be provided using a DCR Security ID (DSID). A U2N relay, in a single-hop scenario and / or a multi-hop scenario, may be configured with U2N_RSC and / or one or more associated U2N relay discovery security keys. During the discovery procedure, the U2N relay may send a discovery message. For example, the discovery message may be a protected U2N relay discovery message. In examples, the discovery message may be a UE-to- UE (U2U) relay discovery announcement message. In examples, the discovery message may be a WTRU- to-WTRU relay discovery solicitation response message. For example, the discovery message may be at least one of a protected U2N relay discovery announcement message or a protected U2N relay discovery solicitation response message.

[0138] The discovery message may be, or may include, a DSID. As described herein, the DSID may be associated with (e.g., mapped to) one or more U2N_RSC / U2N relay discovery security keys. For example, the U2N relay may generate a mapping between the DSID and the discovery security key. In examples, the U2N relay may determine that the U2N relay is configured with the U2N_RNC and / or is associated with a U2N relay discovery security key. The discovery security key may be, or may include, a U2N_RSC discovery security key.

[0139] In a multi-hop example, the U2N relay may send the message (e.g., the discovery message) during the U2U relay discovery procedure, and the message may include a U2N relay discovery set within a U2U relay discovery message. The U2N relay may receive a DCR message from the remote WTRU and / or the U2U relay. The DCR message may include one or more of the DSID, an encrypted U2N_RSC, and / or PRUK ID. The U2N may determine, e.g., from the DCR message, a discovery security key based on (e.g., using) the received DSID. For example, the U2N relay may locate the one or more discovery security keys based on the mapping established during the discovery process. The U2N relay may decrypt the encrypted U2N_RSC and / or the PRUK ID based on (e.g., using) the one or more U2N relay discovery security keys.

[0140] As described herein, the DSID may correspond to (e.g., uniquely correspond to) a remote WTRU. For example, a first DSID may correspond to a first remote WTRU, and a second DSID may correspond to a second remote WTRU.

[0141] A remote WTRU may be configured with U2N_RSC and / or one or more associated discovery security keys. The remote WTRU may receive a protected U2N relay discovery message during the discovery procedure. The message may include a DSID associated with the U2N_RSC / U2N relay discovery security keys. In a multi-hop example, the remote WTRU may receive a U2N relay discovery set within a U2U relay discovery message. The remote WTRU may associate the received DSID with the one or more U2N_RSC / U2N relay discovery security keys and / or U2N relay user information. The remote WTRU may send a DCR message to the U2N relay. The DCR message may be, or may include, one or more of the DSID, an encrypted U2N_RSC, and / or PRUK ID, e.g., using the one or more U2N relay discovery security keys. In a multi-hop example, the remote WTRU may send the DCR message to the U2U relay.

[0142] DCR message protection processing by U2U relay may be provided using a DCR Security ID (DSID). A U2U relay (e.g., a U2N relay WTRU) may be configured with U2U_RSC and / or one or more associated U2U relay discovery security keys. During the U2U relay discovery procedure, the U2U relay may send a protected U2U relay discovery message. The protected U2U relay discovery message may include a DSID associated with the one or more U2U_RSC / U2U relay discovery security keys. The U2U relay may receive a DCR message from a WTRU (e.g., an end WTRU). The DCR message may include the DSID, an encrypted U2U_RSC, and / or a PRUK ID. The U2U relay may locate the U2U relay discovery security keys using the received DSID. For example, the U2U relay may locate the U2U relay discovery security keys using the received DSID based on the mapping established during the discovery process. The U2U relay may decrypt the U2U_RSC and / or PRUK ID using the one or more U2U relay discovery security keys.

[0143] The WTRU (e.g., an end UE, which may be referred to as an end WTRU) may be configured with U2U_RSC and / or one or more associated U2U relay discovery security keys. The WTRU may receive a protected U2U relay discovery message during a discovery procedure. The message may include a DSID associated with the one or more U2U_RSC / discovery security keys. The received discovery message may be an announcement message (e.g., Model A) or a discovery solicitation response message if the WTRU (e.g., the end WTRU) is the discoverer WTRU (e.g., the end WTRU). The received discovery message may be a discovery solicitation message if the WTRU (e.g., the end WTRU) is the discoveree WTRU (e.g., Model B). The WTRU (e.g., the end WTRU) may associate the DSID with the one or more U2U_RSC / discovery security keys and U2U relay user information. The WTRU (e.g., the end WTRU) maysend a DCR message to the U2U relay. The DCR message may include the DSID, an encrypted U2U_RSC, and / or a PRUK ID. The encryption may be configured (e.g., performed) using the one or more discovery security keys.

[0144] U2N procedures for discovery and communication may be provided and may include security and privacy. A U2N relay direct discovery using Model A or B may be supported. In Model A, the U2N relay may send one or more announcement discovery messages to be discovered by a remote WTRU in proximity. In Model B, the remote WTUR may act as a discoverer and may send a solicitation discovery message to which the U2N relay (e.g., discoveree) may reply with a corresponding response message.

[0145] One or more discovery security parameters (e.g., DUCK, DUIK, DUSK Keys, timing information, and / or the like) may be associated with the U2N relay Service Code (RSC). The one or more discovery security parameters may be provisioned in the remote WTRU and / or U2N relay. The one or more discovery security parameters may be used to protect one or more discovery messages and / or some sensitive parameters in a DCR message (e.g., RSC). The remote WTRU / relay may be provided with one or more security parameters, e.g., by a Direct Discovery Name Management Function (DDNMF), a Policy Control Function (PCF), and / or a ProSe Key Management Function (PKMF).

[0146] U2N relay direct communication may support one or more User Plane (UP) and / or Control Plane (CP) based security mechanisms. A root credential may be provisioned and / or generated. The root credential may be called a ProSe remote User Key (PRUK).

[0147] In an example, which may be control plane (CP) based, a remote WTRU (e.g., a remote UE) may establish a root credential (e.g., CP-PRUK) with a remote WTRU home public land mobile network (HPLMN) (e.g., authentication server function (AUSF) / unified data management (UDM) / prose anchor function (PAnF) / and / or the like). For example, a remote WTRU may establish a root credential during an authentication procedure (e.g., ProSe authentication procedure) as part of protocol establishment (e.g., PC5 link establishment) with the U2N relay. The authentication may request that one or more credentials are stored in the remote WTRU universal integrated circuit card (UICC).

[0148] In an example, which may be user plane (UP) based, a remote WTRU may be configured by its PKMF with a root credential (e.g., UP-PRUK). UP-PRUK may also be generated as part of a link establishment (e.g., PC5 link establishment) with the U2N relay using a mechanism, such as a GBA-PUSH mechanism, using one or more credentials, e.g., which may be stored in the remote WTRU UICC.

[0149] The PRUK may be used to establish a link root key (e.g., a PC5 link root key) KNRP shared between the remote WTRU and the U2N relay. The PRUK may be used to derive one or more sessions and / or security keys. The remote WTRU may derive KNRP from the PRUK, e.g., while the U2N relay receives KNRP from the network (e.g., PKMF or AMF).

[0150] The RSC and PRUK ID may be sent protected in the DCR for confidentiality and / or integrity as described herein. The relay device (e.g., the relay WTRU) may decrypt and check integrity of the RSC and / or the PRUK ID using the one or more discovery keys associated with the RSC. A privacy protection mechanism may be used for a U2U relay if receiving a DCR from an end WTRU.

[0151] U2U relay discovery security may be provided. U2U procedures for discovery and communication, which may include security and privacy, may be provided.

[0152] Model A and B of discovery may be supported. In Model A, the UE-to-UE relay may send one or more U2U relay Announcement messages. The one or more U2U relay announcement messages may include information about one or more end WTRUs (e.g., one or more end UEs, which may be known as direct discovery set and may include user information and / or ProSe service code) that were previously discovered or connected to the relay. In Model B, the UE-to-UE relay may retransmit the direct discovery set included in one or more U2U relay discovery solicitation and / or response messages.

[0153] One or more discovery messages may be protected using one or more key sets, such as two separate key sets. A first key set may be associated with the RSC offered by the U2U relay and used to protect the U2U relay discovery message (e.g., Announcement, Solicitation, and / or the like). A second key set may be associated with the ProSe service used by the one or more end WTRUs (e.g., the one or more end UEs). One or more discovery messages and / or direct discovery sets may be protected for confidentiality, integrity, and / or against replay. Replay protection may be done based on a UTC time-based counter.

[0154] Multi-hop for U2N and U2U relay may be provided. Multi-hop for U2N relay may enable a remote WTRU to discover and communicate with a U2N relay via one or more U2U relays. Multi-hop U2U relay may enable one or more WTRUs (e.g., one or more end UEs) to discover and communicate with each other via more than one U2U relay.

[0155] The multi-hop capability may be useful for one or more mission-critical communications (e.g., first responders) and may enhance coverage (e.g., indoor).

[0156] During U2U relay discovery, the user information ID of the discoverer end WTRU and discoveree end WTRU may be encrypted end-to-end, e.g., using a key set associated with a service (e.g., a ProSe service) inside a protected direct discovery set included on the one or more U2U relay discovery (e.g., solicitation and / or response) messages.

[0157] The U2U relay may not be provisioned with the key set associated with the ProSe service and may not be able to decrypt the user information IDs inside the direct discovery set within the relay discovery message. The U2U relay may (e.g., only) forward transparently the protected direct discovery set (e.g., with encrypted discoverer and / or discoveree User information) received in the discovery message.

[0158] The discoverer user information received relay discovery solicitation response message may be encrypted. The Relay may be unable to determine to which discoverer WTRU to send the discovery solicitation response message. This may be addressed for Multi-hop U2U relay with model B discovery (e.g., 2 end UEs using 2 or more U2U relay for discovering each other).

[0159] When considering multi-hop U2N relay, the remote WTRU may play the role of a discoverer. The U2N relay may play the role of a discoveree. The U2N relay service (e.g., with its RSC) may be used instead of and / or in addition to a ProSe service.

[0160] Embodiments disclosed herein may provide for the U2U relay to be able to determine to which discoverer end WTRU to send a discovery solicitation response message upon receiving a discovery solicitation response message from a discoveree end WTRU.

[0161] Embodiments disclosed herein may secure and preserve the privacy of the discoverer / discoveree against unauthorized parties as per existing security requirements (e.g., maintain an end-to-end (E2E) direct discovery set confidentiality protection).

[0162] Embodiments disclosed herein allow the support of multi-hop relaying scenarios (e.g., multi-hop between end-to-end WTRUs or between a remote WTRU and U2N relay).

[0163] DCR security processing at the U2N relay with encrypted RSC may be provided. As described herein, the RSC and PRUK ID may be sent to the U2N relay encrypted, e.g., to preserve their privacy. The U2N relay may use the one or more discovery keys associated with the RSC to decrypt them.

[0164] The U2N relay may be unable to locate the one or more proper discovery keys associated with the RSC to perform decryption of the RSC (e.g., and / or the PRUK ID) if the RSC may be encrypted. This may be applicable to U2U relay and / or multi-hop U2N relay.

[0165] In an example, the source L2 ID of the U2N relay (e.g., found by the remote WTRU during discovery) may be used. One or more embodiments described herein may address the privacy issue around RSC. For example, embodiments may prevent an attacker from linking the RSC and the source L2 ID (e.g., both being sent in the clear in the discovery message) and may prevent the attacker from inferring the RSC by eavesdropping on a DCR that includes the encrypted RSC and sent to that U2N relay source L2 ID.

[0166] In an example, a key identifier provisioned may be used. The key identifier may be provisioned in the remote WTRU and / or the U2N relay associated with the discovery security material associated with the RSC. One or more embodiments described herein may address the privacy issue around RSC. For example, the RSC may be replaced by another equivalent identifier (e.g., a static identifier) that may be used (e.g., in addition to and / or instead of RSC) by an attacker to track the remote WTRU during communication with the Relay.

[0167] In an example, a U2N relay may try multiple discovery key materials for the supported RSC. One or more embodiments described herein may address the privacy issue around RSC. For example, the one or more embodiments may prevent exposing a U2N relay to potential denial of service (DoS) attacks, whereby an attacker may send a DCR with random content (e.g., instead of the encrypted RSC and / or PRUK ID) triggering the U2N relay to try multiple discovery key material for one or more (e.g., all) the RSC that the U2N Relay supports.

[0168] A U2N relay may be able to identify the one or more correct discovery keys to decrypt the RSC and / or the PRUK ID. In an example, one or more procedures may be provided that may be secure and preserve the privacy of the RSC and / or the PRUK ID against unauthorized parties as per existing security requirements. In an example, one or more procedures may be provided to allow the support of multi-hop U2N relaying scenarios (e.g., multi-hop between a remote WTRU and a U2N relay). In an example, one or more procedures may be provided to prevent negatively impacting the performance of the U2N relay and / or exposing it to security threats.

[0169] In examples, a U2U relay may use a discovery solicitation ID to forward the discovery solicitation response to an appropriate discoverer in a U2U relay discovery Model B procedure. A principle of E2E security and confidentiality of the direct discovery set within the discovery message may be preserved.

[0170] In examples, a U2N relay may establish a secure DCR Security ID (DSID) with an authorized remote WTRU during the discovery procedure. The U2N relay may locate one or more discovery security keys to decrypt the RSC and / or the PRUK ID in the DCR using the DSID included in the DCR. The privacy of the RSC and / or the PRUK ID may be preserved and have negligible processing overhead on both the relay and the remote WTRU.

[0171] One or more embodiments described herein may be compatible with single-hop scenarios and / or multi-hop scenarios.

[0172] U2U relay Discovery Security Model B, using a random discovery solicitation ID (e.g., single and / or multi-Hop) may be provided.

[0173] FIG. 2 illustrates an example U2U relay discovery with Model B using a solicitation ID. One or more processes illustrated in FIG. 2 may or may not be performed (e.g., skipped). In an example of Model B based U2U relay discovery between two end WTRUs (e.g., two end UEs) and a U2U relay, a solicitation ID may be assigned to a discoverer upon receiving a protected discovery solicitation message. The solicitation ID may be used to determine to which discoverer to send a protected discovery solicitation response message upon receiving such a message from a discoveree. FIG. 2 may show a U2U relay discovery procedure in a single hop scenario.

[0174] At 0, the end WTRUs and U2U relay may be provisioned with one or more U2U relay discovery parameters, e.g., including the security material associated with the Relay Service Code (RSC). The end WTRU (e.g., the UEs) may be provisioned with the one or more discovery parameters, e.g., including the security material associated with the ProSe Service.

[0175] At 1 , the discoverer may generate a discovery solicitation message. The discovery solicitation message may include a protected direct discovery set (e.g., including the discoverer and / or the target discoveree user information). The discoverer may protect the discovery solicitation message with the security material associated with RSC. The discoverer may send the message to the U2U relay, e.g., using a self-assigned source L2 ID.

[0176] At 2, if the discovery solicitation message is received, the U2U relay may verify the security of the message using the security material associated with RSC. If the check is successful (e.g., the security of the message has not been compromised), the U2U relay may allocate a direct discovery solicitation ID and may associate the direct discovery solicitation ID with the discoverer source L2 ID. The U2U relay may ensure that the direct discovery solicitation ID may be unique (e.g., locally unique and / or different from other ongoing solicitation discovery) to identify unambiguously the discoverer at the U2U relay. For example, the U2U relay may be used for the solicitation ID any of a random number, the source L2 ID of the discoverer, the Query Code (e.g., inside the direct discovery set) from discoverer, and / or a transformation function thereof (e.g., using a hash function).

[0177] At 3, the U2U relay may generate a discovery solicitation message (e.g., a new discovery solicitation message). The discovery solicitation message may include the protected direct discovery set received from the discoverer and the direct discovery solicitation ID. The U2U relay may protect the discovery solicitation message with the security material associated with RSC and send the message to the discoveree. The U2U relay may associate the direct discovery solicitation ID with the U2U relay's source L2 ID used to send the discovery solicitation message over the next hop. In an example, the U2U relay's source L2 ID used to send the discovery solicitation message may be derived using the direct discovery solicitation ID.

[0178] At 4, if the discovery solicitation message is received, the discoveree may verify the security of the message using the security material associated with RSC. If the check is successful (e.g., the security of the message has not been compromised), the discoveree may verify the security of the included direct discovery set and may decrypt its content (e.g., the user information of the discoverer and discoveree). If the check is successful, the discoveree may check that the received discoverer user information matches its own configured user information. If there is a match, the discoveree may generate a discovery solicitation response message that includes a protected direct discovery set (e.g., the discoverer and / or thetarget discoveree user information) and the direct discovery solicitation ID. The discoveree may protect the discovery solicitation response message with the security material associated with RSC and send the message to the U2U relay.

[0179] At 5, if the discovery solicitation response message is received, the U2U relay may verify the security of the message using the security material associated with RSC. If the check is successful, the U2U relay may locate the discoverer source L2 ID based on the received direct discovery solicitation ID (e.g., based on the mapping established at 3 or 4 illustrated in FIG. 2 and / or as described herein). The U2U relay may generate a discovery solicitation response message (e.g., a new discovery solicitation response message) that includes the protected direct discovery set received from the discoveree. The U2U relay may protect the discovery solicitation response message with the security material associated with RSC and may send the message to the discoverer.

[0180] In a multi-hop example, the behavior of the first U2U relay (e.g., the direct U2U relay) in direct proximity to the discoverer may perform as described herein. The behavior of an intermediate U2U relay (e.g., in the discovery path between the direct U2U relay and the discoveree) may be described below with respect to FIG. 2.

[0181] At 0, the U2U relays and the end WTRUs (e.g., the end UEs) may be provisioned with an RSC with an associated indication for multi-hop support.

[0182] At 1 , the discoverer may include a relay indication in a discovery solicitation message to indicate that the discoverer wishes to perform U2U relay discovery across more than one U2U relay. An indication of the maximum number of hops allowed for the discovery may be included in the discovery message (e.g., the discovery solicitation message). For example, an indication may be configured as part of the authorization policy provisioned in the WTRUs and Relay (e.g., an indicator associated with the RSC). An indication of the number of hops (e.g., current number of hops) may be included in the discovery solicitation message and used by the relay to verify whether to include a relay indication in the discovery solicitation message (e.g., to prevent further relaying).

[0183] In examples, before 3, the direct U2U relay may send the discovery message to the intermediate U2U relay. The intermediate U2U relay (e.g., in addition to and / or instead of the discoveree) may receive and process the discovery message similarly to how it may be described herein for the direct U2U relay. Based on the relay indication and / or configured indication for multi-hop support for the RSC, the U2U may decide to proceed with the multi-hop U2U relay discovery and associate the direct discovery solicitation ID with the direct U2U relay source L2 ID.

[0184] At 3, the discoveree WTRU may receive from the intermediate U2U relay (e.g., in addition to and / or instead of a direct Relay) the protected discovery solicitation message (e.g., the new protecteddiscovery solicitation message), including intermediate U2U relay user information, the protected direct discovery set, and / or the direct discovery solicitation ID from the direct U2U relay. In an example, the intermediate U2U relay may include a second direct discovery solicitation ID in the message. The intermediate U2U may allocate the second direct discovery solicitation ID (e.g., to be locally unique) and associate the second direct discovery solicitation ID with one or more of the sources’ L2 ID and direct discovery solicitation ID of the direct U2U relay.

[0185] In examples, before 4, the intermediate U2U relay may receive a protected discovery solicitation response message from the discoveree WTRU. The protected discovery solicitation response message may include a second protected direct discovery set, and / or the direct discovery solicitation ID. The intermediate U2U relay may check the discovery solicitation response message security. If the security check is successful, the intermediate U2U relay may locate the source L2 ID of the direct U2U relay using direct discovery solicitation ID.

[0186] At 4, the direct U2U relay may receive a protected discovery solicitation response message from the intermediate U2U relay (e.g., in addition to and / or instead of the discoveree WTRU)

[0187] U2N relay multi-hop Discovery Security Model B, using a random discovery solicitation ID may be provided. FIG. 3 shows an example U2U relay discovery with Model B for U2N relay using solicitation ID. One or more processes illustrated in FIG. 3 may or may not be performed (e.g., skipped). FIG. 3 may show an example of Model B based U2U relay discovery between a remote WTRU and a U2N relay. The U2U relay may assign a solicitation ID to the remote WTRU (e.g., discoverer) upon receiving a protected discovery solicitation message. The assigned solicitation ID may be used to determine to which remote WTRU to send a protected discovery solicitation response message upon receiving such a message from a U2N relay (e.g., discoveree). The call flow may show a multi-hop discovery for U2N relay using a U2U relay. The procedure may be extended to support more than one U2U relay in the discovery path.

[0188] At 0, the remote WTRU, the U2N relay, and / or the U2U relay may be provisioned with one or more U2U relay discovery parameters, which may include the security material associated with the relay service (e.g., U2U_RSC). The remote WTRU and / or the U2N relay may be provisioned with the one or more discovery parameters. The one or more parameters may include the security material associated with the U2N relay Service (e.g., U2N_RSC). The U2U_RSC and / or the U2N_RSC may be configured with an associated indication for multi-hop support.

[0189] At 1 , the remote WTRU may generate a discovery solicitation message that includes a protected U2N discovery set (e.g., including U2N_RSC, the remote WTRU, and / or the U2N relay user information). The remote WTRU may protect the discovery solicitation message with the security material associatedwith U2U_RSC. The remote WTRU may send the message to the U2U relay using a self-assigned source L2 ID.

[0190] At 2, if the discovery solicitation message is received, the U2U relay may verify the security of the message using the security material associated with U2LLRSC. If the check is successful, the U2U relay may allocate a U2N relay discovery solicitation ID and associate the message with the remote WTRU source L2 ID. The U2U relay may ensure that the U2N relay discovery solicitation ID may be unique (e.g., locally unique and / or different from other ongoing solicitation discovery ID) to be able to identify unambiguously the remote WTRU at the U2U relay.

[0191] At 3, the U2U relay may generate a discovery solicitation message (e.g., a new discovery solicitation message) that includes the protected U2N discovery set received from the remote WTRU and / or the U2N relay discovery solicitation ID. The relay may protect the discovery solicitation message with the security material associated with U2U_RSC and may send the message to the U2N relay.

[0192] At 4, if the discovery solicitation message is received, the U2N relay may verify the security of the message using the security material associated with U2U_RSC. If the check is successful, the U2N relay may verify the security of the included U2N relay discovery set and decrypt its content (e.g., remote UE and / or U2N relay user information, using discovery keys associated with U2N_RSC). If the check is successful, the U2N relay may check that the received U2N relay user information and / or U2N_RSC matches its own configured user info / U2N_RSC. If there is a match, the U2N relay may generate a discovery solicitation response message that includes a protected U2N discovery set (e.g., the remote WTRU, the target U2N relay user information, U2N_RSC, and / or the like) protected using security material associated with U2N_RSC and the U2N relay discovery solicitation ID. The U2N relay may protect the discovery solicitation response message with the security material associated with U2U_RSC and send the message to the U2U relay.

[0193] At 5, if the discovery solicitation response message is received, the U2U relay may verify the security of the message security using the security material associated with U2U_RSC. If the check is successful, the U2U relay may locate the remote WTRU source L2 ID based on the received U2N relay discovery solicitation ID. The U2U relay may generate a discovery solicitation response message (e.g., a new discovery solicitation response message) that may include the protected U2N discovery set received from the U2N relay. The U2U relay may protect the discovery solicitation response message with the security material associated with U2U_RSC and send the message to the remote WTRU.

[0194] In an example, there may be more than one U2U relay in the discovery path, and the behavior of the first U2U relay (e.g., the direct U2U relay) may be in proximity (e.g., direct proximity) to the remoteWTRU as described herein. The behavior of an intermediate U2U relay (e.g., in the discovery path between the direct U2U relay and the U2N relay) may be described by highlighting changes relative to FIG. 3.

[0195] In examples, before 3, the direct U2U relay may send the discovery message to the intermediate U2U relay. The intermediate U2U relay (e.g., in addition to and / or instead of the U2N relay) may receive and process the discovery message as described herein with respect to the direct relay. The intermediate U2U relay may associate the U2N relay discovery solicitation ID with the direct U2U relay source L2 ID.

[0196] At 3, the U2N relay WTRU may receive from the intermediate U2U relay (e.g., in addition to and / or instead of the direct U2U relay) the protected discovery solicitation message (e.g., the new protected discovery solicitation message) that includes intermediate U2U relay user information, the protected U2N discovery set, and / or the U2N relay discovery solicitation ID from the direct relay.

[0197] At 1-4 illustrated in FIG. 3, the intermediate U2U relay may receive a protected discovery solicitation response message from the U2N relay WTRU. The protected discovery solicitation response message may include a second protected U2N discovery set and / or the U2N relay discovery solicitation ID. The intermediate U2U relay may check the discovery solicitation response message security. If the security check is successful, the intermediate U2U relay may locate the source L2 ID of the direct U2U relay using the U2N relay discovery solicitation ID.

[0198] At 4, the direct U2U relay may receive a protected discovery solicitation response message from the intermediate U2U relay (e.g., in addition to and / or instead of U2N relay WTRU).

[0199] DCR protection using a DCR Security ID at a U2N relay (e.g., single-hop scenario) may be provided. FIG. 4 shows an example U2N relay Communication procedure. One or more processes illustrated in FIG. 4 may or may not be performed (e.g., skipped). The U2N relay may establish a secure DCR Security ID (DSID) with an authorized remote WTRU during a U2N relay discovery procedure (e.g., Model A or B). The DSID may be associated by the U2N relay and a remote WTRU with an RSC (e.g., named U2N_RSC below) and one or more corresponding U2N relay discovery security keys. The U2N relay may use the DSID received in a DCR message to locate the one or more corresponding discovery security keys to decrypt the U2N_RSC / PRUK ID in the DCR message. If the U2N_RSC and / or the PRUK ID are successfully decrypted, the U2N relay may proceed with the secure link establishment with the remote WTRU identified by the PRUK ID for the given relay service identified with U2N RSC, as described herein.

[0200] At 0, the remote WTRU and the U2N relay are provisioned (e.g., by a PKMF) with one or more discovery parameters. The one or more discovery parameters may include the security material associated with the U2N relay Service (e.g., U2N_RSC). The security material may include discovery confidentiality and / or one or more integrity keys, as described.

[0201] At 1 , the U2N relay may wish to be discovered for the U2N_RSC that it provides. The U2N relay may allocate a DCR Security ID (DSID) and associate the DSID with the one or more U2N_RSC / U2N relay discovery security keys (e.g., generate a mapping between the DSID and the U2N_RSC). For privacy reasons, the U2N relay may decide to allocate a fresh DSID periodically (e.g., before each new Announcement or Solicitation response message as described below and / or after a given duration). The U2N relay may ensure that the DSID may be unique for a given U2N_RSC. The DSID may be derived from the U2N_RSC (e.g., using a secure hash function). One or more other parameters may be used as an input for DSID generation, such as a freshness parameter (e.g., current UTC based time, nonce, and / or the like) and / or remote UE related information (e.g., remote UE source L2 ID). In an example, the U2N relay may request the DSID from a server (e.g., PKMF, DDNMF, and / or the like) providing the U2N_RSC and remote WTRU information.

[0202] In an example, if Model A is used, the U2N relay may send a protected discovery announcement message that includes the U2N_RSC, U2N relay user information, and / or the DSID.

[0203] In an example, if Model B is used, the U2N relay may receive a protected discovery solicitation message that includes the U2N_RSC. At 1 , the U2N relay may decide to allocate the DSID at this stage. For example, the U2N relay may assign a different DSID for a remote WTRU (e.g., each remote WTRU) and / or may allocate a DSID in response to a discovery solicitation message. The U2N may decide on such DSID allocation strategy to prevent potential linkage (e.g., linkability attack) among one or more remote UEs using the same DSID (e.g., and therefore same U2N_RSC). The DSID allocation strategy (e.g., for Model A or B) selected by the U2N relay may be based on a policy provided by a network function (e.g., PCF, PKMF, and / or the like) as part of the U2N relay authorization provisioning procedure. The U2N relay may maintain a list of valid DSIDs (e.g., with an associated validity time) associated with the U2N_RSC. The U2N relay may send a protected discovery solicitation response message that includes the U2N_RSC, U2N relay user information, and / or the DSID.

[0204] The discovery message (e.g., the Announcement message and / or the Solicitation response) may be protected for confidentiality, integrity, and / or against replay using the security material associated with U2N_RSC provisioned at 0.

[0205] The U2N relay may protect (e.g., confidentiality, integrity, and / or against replay) the DSID within the discovery message with the security material associated with U2N_RSC. An authorized remote WTRU (e.g., only an authorized remote WTRU) may decrypt the DSID while preventing unauthorized parties to link the U2N_RSC with the DSID. The DSID may be protected as described herein as part of the message protection to prevent eavesdroppers from linking the DSID with the U2N_RSC, which may be sent in the clear in the DCR and / or to mitigate DSID based replay or tampering attacks.

[0206] The U2N relay may provide a validity time associated with the DSID. The validity time may be used by the remote WTRU as described herein. The U2N relay may delete the DSID if the validity time expiration has been detected.

[0207] At 3, if the discovery message is received, the remote WTRU may verify the security and decrypt the message (e.g., DSID, U2N relay user information, and / or the like) using the security material associated with U2N_RSC. The Remote WTRU may store the received DSID, e.g., along with the associated validity time. The remote WTRU may associate the stored DSID with the U2N_RSC / U2N relay user information and / or U2N relay source L2 ID.

[0208] At 4, the remote WTRU may wish to connect with the discovered U2N relay. The remote WTRU may send a DCR message and include the DSID or concealed DSID, U2N relay user information (e.g., application layer ID of the Relay), and / or encrypted U2N_RSC, PRUK ID to the U2N relay. If the DSID has an expired validity time, the remote WTRU may re-run a discovery procedure (e.g., receive a new Announcement or send a new Solicitation message) to obtain a valid DSID. The concealed DSID may be obtained, e.g., using a secure hash function with DSID as an input and / or with other possible input parameter(s) (e.g., UTC-based counter least significant bits (LSBs), which may be sent in the DCR, source L2 ID of the remote WTRU). As the DSID may be sent in a cleartext in the DCR, the concealment of the DSID may enable the reuse of the DSID by the U2N relay (e.g., assigned per U2N_RSC) among one or more remote WTRUs, and / or by the remote WTRU (e.g., in a reconnection) while mitigating potential linkage (e.g., linkability attack) or tracking attack of WTRUs using the DSID in the DCR.

[0209] At 5, upon receiving the DCR message, the U2N relay may locate the U2N_RSC and / or the one or more discovery security keys associated using the received DSID and / or based on the mapping established (e.g., as illustrated in 1 and / or as described herein). For example, the U2N relay may apply the secure hash function against the stored DSID(s) to find a match with a received concealed DSID. The U2N relay may verify the validity of the DSID in the process (e.g., the validity time may not be expired). The U2N relay may verify the security of the message and decrypt the U2N_RSC and / or PRUK ID in the message, e.g., using the security material associated with U2N_RSC.

[0210] At 6, the U2N relay and the remote WTRU may perform a direct link establishment procedure (e.g., direct link security establishment and / or QoS). The U2N relay may request a root key (e.g., a PC5 link root key) from the network and may use the root key during a Direct Security Mode Command procedure with the remote WTRU to establish one or more security keys (e.g., one or more PC5 link security keys, as described herein).

[0211] At 7, the U2N relay may send a DCA to the remote WTRU, upon completion of the link establishment procedure.

[0212] For the support of multi-hop U2N relay, a number of procedures may be modified and / or performed. During the U2U relay discovery procedure (e.g., at 2 illustrated in FIG. 4), the U2N relay may include the DSID in the protected U2N relay discovery set (e.g., DSID, U2N_RSC, U2N relay user information, and / or remote WTRU user information) included in a secure U2U relay discovery message. The DCR, which may include the DSID, may be received by the U2N relay from a U2U relay.

[0213] DCR protection using a DCR Security ID at a U2U relay (e.g., a single-hop scenario) may be provided. FIG. 5 shows an example U2U relay communication procedure. One or more processes illustrated in FIG. 5 may or may not be performed (e.g., skipped). For example, FIG. 5 may show a U2U relay communication procedure, e.g., after the U2U relay may have established a secure DCR Security ID (DSID) or a DSID pair with one or more authorized end UEs during a U2U relay discovery procedure using Model B. The DSID may be associated by the U2U relay and the end WTRU with an RSC (e.g., a U2U_RSC) and / or one or more corresponding U2U relay discovery security keys. The discoverer end WTRU may discover the U2U relay and / or a discoveree end WTRU during a U2U relay discovery procedure. The discoveree end WTRU may receive a first DSID from the U2U relay in a solicitation message. The discoverer may receive a second DSID from the U2U relay in a solicitation response message. The discoverer / discoveree may send the received DSID in a DCR message to connect with the U2U relay.

[0214] At 0, one or more end WTRUs (e.g., one or more end UEs) and U2U relay may be provisioned (e.g., by a PKMF) with one or more discovery parameters. The one or more discovery parameters may include the security material (e.g., confidentiality and / or integrity keys as described herein) associated with the U2U relay Service (e.g., U2U_RSC). The discoverer end WTRU and discoveree end WTRU may be provisioned with the one or more discovery parameters, including the security material associated with the service (e.g., ProSe service) to protect the direct discovery set (e.g., end-to-end).

[0215] At 1 , the discoverer end WTRU may generate a discovery solicitation message that includes a protected direct discovery set (e.g., including the discoverer end WTRU and the discoveree end WTRU user information). The discoverer end WTRU may protect the discovery solicitation message with the security material associated with U2U_RSC and may send the message to the U2U relay.

[0216] At 2, if the discovery solicitation message is received, the U2U relay may verify the security of the message using the security material associated with U2U_RSC. If the check is successful, the U2U relay may allocate a DCR Security ID (DSID) or a DSID pair (e.g., DSID#1 and DISD#2) and may associate the DSID or the DSID pair with the one or more U2U_RSC / U2U relay discovery security keys (e.g., generate a mapping between the DSID and U2U_RSC or the DSID pair and U2U_RSC). The U2U relay may ensure that the DSID may be unique for a given U2U_RSC. The DSID may be derived from the U2U_RSC (e.g.,using a secure hash function). The U2U relay may generate a DSID per end WTRU (e.g., the DSID#1 for discoveree and the DSID#2 for discoverer) or reuse the DSID for a pair of discoverer / discoveree end UEs (e.g., DSID#1 =DSID#2). The U2U relay may reuse the DSID across multiple discovery transactions (e.g., multiple pairs of discoverer / discoveree end UEs). The DSID allocation strategy (e.g., how often to refresh DSID or reused DSID) selected by the U2U relay may be based on a policy provided by a network function (e.g., PCF, PKMF, and / or the like) as part of the U2U relay authorization provisioning procedure. The U2U relay may request the DSID from a server (e.g., PKMF, DDNMF, and / or the like) providing the U2U_RSC and remote WTRU information.

[0217] At 3, the U2U relay may send a discovery solicitation message that may include the protected direct discovery set received from the discoverer end WTRU and the DSID (e.g., DSI D#1 ). The relay may protect the discovery solicitation message with the security material associated with U2U_RSC and send the message to the discoveree end WTRU.

[0218] The discovery message (e.g., the Announcement response and / or the Solicitation response) may be protected for confidentiality, integrity, and / or against replay using the security material associated with U2U_RSC provisioned at 0. The U2U relay may protect (e.g., confidentiality, integrity, and / or against replay) the DSID within the discovery message with the security material associated with U2U_RSC, such as an (e.g., only) authorized end UE(s) (e.g., only authorized end UE(s) may decrypt the DSID while preventing an unauthorized party to link the U2U_RSC with the DSID). The DSID may be protected as part of the message protection to prevent an eavesdropper linking the DSID with the U2U_RSC, which may be sent in the clear in the DCR and / or to mitigate DSID based replay or tampering attacks.

[0219] The U2U relay may provide a validity time associated with the DSID. The validity time may be used by the end WTRU as described herein. The U2U relay may delete the DSID if the validity time has expired.

[0220] At 4, if the discovery message is received, the discoveree end WTRU may verify the security and decrypt the message (e.g., the DSID and / or the U2U relay user information) using the security material associated with U2U_RSC. If the check is successful, the discoveree end WTRU may verify the security of the included direct discovery set and decrypt its content (e.g., discoverer end WTRU and discoveree end WTRU user information). If the check is successful, the discoveree end WTRU may store the received DSID, along with the associated validity time. The discoveree end WTRU may associate the DSID with the U2U_RSC, U2U relay User Information, and / or U2U relay source L2 ID.

[0221] At 5, the discoveree end WTRU may send a discovery solicitation response message that includes a protected Direct discovery set.

[0222] At 6, if the discovery solicitation response message is received, the U2U relay may verify the security of the message, e.g., using the security material associated with U2LLRSC. If the check is successful, the U2U relay may retrieve the DSID allocated (e.g., at 2 illustrated in FIG. 5) and may send a protected discovery solicitation response message that includes the protected Direct discovery set received from the discoveree end WTRU and the DSID (e.g., DSID#2).

[0223] At 7, if the discovery message is received, the discoverer end WTRU may verify the security and decrypt the message (e.g., DSID and / or U2U relay user information) using the security material associated with U2U_RSC. If the check is successful, the discoverer end WTRU may verify the security of the included direct discovery set and decrypt its content. If the check is successful, the discoverer end WTRU may store the received DSID, along with the associated validity time. The discoverer end WTRU may associate the DSID with the U2U_RSC / U2U relay User I nfo / U2U relay source L2 ID.

[0224] At 8, the end WTRU may wish to connect with the discovered U2U relay. An end WTRU (e.g., each end WTRU) may send a DCR message and include DSID (e.g., concealed DSID), U2U relay user information (e.g., application layer ID of the Relay), encrypted RSC, and / or PRUK ID to the U2U relay. The link establishment (e.g., the PC5 link establishment) with the U2U may be similar to that with U2N relay as described herein (e.g., as illustrated in FIG. 4).

[0225] In an example, a discovery Model A may be used. The U2U relay may establish a secure DCR Security ID (DSID) with one or more authorized end UEs during a U2U relay discovery procedure similar to the procedure shown in FIG. 4. The end WTRU may play the role of the remote WTRU, while the U2U relay may play the role of the U2N relay. The DSID may be associated by the U2U relay and end WTRU with a U2U_RSC and one or more corresponding U2U relay discovery security keys. The end WTRU may discover the U2U relay during a U2U relay discovery procedure and receive a DSID from the U2U relay in an announcement message. The end WTRU may send the DSID (e.g., concealed DSID) in a DCR message to connect with the U2U relay.

[0226] DCR protection may be provided using a DCR Security ID in a multi-hop U2N scenario.

[0227] FIGs. 6A-6B show an example U2N relay Communication procedure. One or more processes illustrated in FIGs. 6A-6B may or may not be performed (e.g., skipped). FIGs. 6A-6B may show an example U2N relay Communication procedure after a secure DCR Security ID (DSID) has been established between a remote WTRU, U2U, and / or one or more U2N relays and between the U2U and the U2N relay during a multi-hop U2N relay discovery procedure. A U2U_DSID may be associated with the U2U relay and the remote WTRU with a U2U_RSC and the one or more corresponding U2U relay discovery security keys. A U2N_DSID may be associated with the U2N relay and the remote WTRU and with a U2N_RSC and the one or more corresponding U2N relay discovery security keys. The remote WTRU may receive theU2U_DSID and U2N_DSID from the U2U relay, e.g., in a solicitation or announcement message. The remote WTRU may send the received DSIDs in a DCR message to the U2U relay to connect with the U2N relay via the U2U relay.

[0228] At 0, the remote WTRU, the U2U, and / or the U2N relay may be provisioned (e.g., by a PKMF) with one or more discovery parameters, e.g., including the security material (e.g., confidentiality and / or integrity keys as described herein) associated with the U2U relay Service (e.g., U2U_RSC). The remote WTRU and the U2N relay may be provisioned with the one or more discovery parameters, including the security material associated with the U2N relay Service (e.g., U2N_RSC), e.g., to protect end-to-end the U2N discovery set (e.g., within the U2U Discovery message) and / or the U2N communication set within the DCR sent to U2U relay.

[0229] At 1 , the remote WTRU may generate a discovery solicitation message that includes a protected U2N discovery set (e.g., including the U2N_RSC, remote WTRU, and / or U2N user information) protected with the security material associated with U2N_RSC. The remote WTRU end WTRU may protect the discovery solicitation message with the security material associated with U2U_RSC and send the message to the U2U relay.

[0230] At 2, if the discovery solicitation message is received, the U2U relay may verify the security of the message using the security material associated with U2U_RSC. If the check is successful, the U2U relay may allocate a U2U_DSID and associate the U2U_DSID with the one or more U2U_RSC / U2U relay discovery security keys (e.g., generate a mapping between DSID and U2U_RSC). The U2U relay may ensure that the U2UJDSID may be unique for a given U2U_RSC. The U2UJDSID may be derived from the U2U_RSC, remote WTRU source L2 ID, current time, etc. The U2U relay may generate a U2U_DSID per U2U_RSC and / or per remote WTRU / U2N relay. The U2U relay may request the U2U_DSID from a server (e.g., PKMF, DDNMF, and / or the like) providing the U2U_RSC and remote WTRU information.

[0231] At 3, the U2U relay may send a discovery solicitation message that includes the protected U2N discovery set received from the remote WTRU and the U2U_DSID. The U2U relay may protect the discovery solicitation message with the security material associated with U2U_RSC and may send the message to the U2N relay.

[0232] The discovery message may be protected for confidentiality, integrity, and / or against replay using the security material associated with U2U_RSC provisioned at 0. The U2U relay may protect (e.g., confidentiality, integrity, and / or against replay) the U2UJDSID within the discovery message with the security material associated with U2U_RSC, such as an (e.g., only) authorized remote WTRU / U2N relay, may decrypt the U2U_DSID, e.g., while preventing an unauthorized party to link the U2U_RSC with the U2UJDSID. The U2U_DSID may be protected as part of the message protection to prevent aneavesdropper from linking the U2U_DSID with the U2U_RSC, which may be sent in the clear in the DCR and / or to mitigate the DSID based replay or tampering attacks.

[0233] The U2U relay may provide a validity time associated with the U2U_DSID. The validity time may be used by the end WTRU as described herein. The U2U relay may delete the U2U_DSID if the validity time has expired.

[0234] At 4, if the discovery message is received, the U2N relay may verify the security and may decrypt the message (e.g., DSID and / or U2U relay user information) using the security material associated with U2U_RSC. If the check is successful, the U2N relay may verify the security of the included direct discovery set and may decrypt its content (e.g., remote WTRU and / or U2N relay user information). If the check is successful, the U2N relay may store the received U2U_DSID, along with the associated validity time. The U2N relay may associate the U2U_DSID with the U2U_RSC, U2U relay User Information, and / or U2U relay source L2 ID. The U2N relay may allocate a U2N_DSID and may associate the U2N_DSID with the one or more U2N_RSC / U2N relay discovery security keys (e.g., generating a mapping between the U2N_DSID and the U2N_RSC).

[0235] At 5, the U2N relay may send a discovery solicitation response message that includes a protected U2N discovery set. The U2N relay may include the U2N_DSID (e.g., confidentiality, integrity, and / or against replay) protected inside the U2N discovery set. The U2N_DSID may remain protected end- to-end between the U2N relay and the remote WTRU (e.g., transparent to U2U relay or other WTRU possessing U2U_RSC key material).

[0236] At 6, if the discovery solicitation response message is received, the U2U relay may verify the security of the message security using the security material associated with U2U_RSC. If the check is successful, the U2U relay may retrieve the U2U_DSID allocated (e.g., as illustrated at 2 of FIG. 6A) and may send a protected discovery solicitation response message that includes the protected U2N discovery set received from the U2U relay and the U2U_DSID.

[0237] At 7, if the discovery message is received, the remote WTRU may verify the security and decrypt the message (e.g., U2U_DSID and / or U2U relay user information) using the security material associated with U2U_RSC. If the check is successful, the remote WTRU may verify the security of the included U2N discovery set and may decrypt its content, including the U2N_DSID. If the check is successful, the remote WTRU may store the received U2U_DSID and U2N_DSID, along with the associated validity time, and associate the U2U_DSID and U2N_DSID, respectively, with the U2U_RSC and U2N_RSC. As described herein, the remote WTRU may be connected via a L3 U2U relay.

[0238] At 8a and / or 8b, the remote WTRU may wish to connect with the discovered U2N relay via the U2U relay. The remote WTRU may send a DCR message and may include the U2UJDSID (e.g., theconcealed U2UJDSID), U2U relay user information (e.g., application layer ID of the Relay), encrypted U2U_RSC, and / or U2U_PRUK ID to the U2U relay along with a protected U2N communication set. The U2N communication set may include the U2N_DSID (e.g., concealed U2N_DSID), encrypted U2N_RSC, and / or U2N_PRUK ID.

[0239] If the DCR message is received, the U2U relay may locate the U2U_RSC and the one or more discovery security keys associated using the received U2U_DSID and based on the mapping established (e.g., as illustrated at 2 of FIG. 6A). The U2U relay may verify the security of the message and decrypt the U2U_RSC and / or U2U_PRUK ID in the message using the discovery security material associated with U2LLRSC.

[0240] The U2U may perform a direct security establishment procedure with the remote WTRU. For example, the U2N relay may request a root key (e.g., a PC5 link root key) from the network (e.g., providing U2U_PRUK ID) and use the root key during a Direct Security Mode Command procedure with the remote WTRU to establish one or more security keys (e.g., one or more PC5 link security keys as described herein). For example, the U2U may establish a PC5 link root key based on a Long-Term Credentials (e.g., using a certificate, while out of coverage).

[0241] At 9, if security establishment with the remote WTRU is successful, the U2U relay may send a DCR message to the U2N relay and include the U2N communication set received from the remote WTRU.

[0242] If the DCR message is received, the U2N relay may locate the U2N_RSC. The one or more discovery security keys may be associated using the received U2N_DSID and / or based on the mapping established (e.g., as illustrated at 4 in FIG. 6A). The U2N relay may verify the security of the message and decrypt the U2N_RSC and / or U2N_PRUK ID in the message, e.g., using the discovery security material associated with U2N_RSC.

[0243] The U2N may perform a Direct security establishment procedure with the remote WTRU. For example, the U2N relay may request a PC5 link root key from the network (e.g., providing U2N_PRUK ID) and use the root key during a Direct Security Mode Command procedure with the remote WTRU to establish the PC5 link security keys (as described herein).

[0244] At 10, the U2N relay may send a DCA to the U2U relay and the U2U relay to the remote WTRU upon successful completion of the respective link establishment procedures.

[0245] Using discovery Model A, there may be some difference from 1-6. For example, the remote WTRU may receive the U2UJDSID and U2NJDSID in an Announcement message from the U2U relay. The U2NJDSID may be included in a protected U2N discovery set within the Announcement message. The U2U relay may receive the U2N relay discovery set from the U2N relay during a prior U2U relay discovery or communication procedure.

[0246] Using an L2 U2U relay, the link establishment may be modified. The remote WTRU may establish the first hop L2 link with the U2U relay providing the U2U_DSID, encrypted U2U_RSC, and / or U2U_PRUK ID but may not include the U2N Communication set. The U2U relay may establish the second hop L2 link with the U2N relay. The U2U relay may include a U2UJDSID and / or encrypted U2U_RSC in the DCR message sent to the U2N relay. A second hop L2 link may be established (e.g., the remote UE may receive the DCA for the first hop link), and the remote WTRU may send an end-to-end DCR message to the U2N relay via the U2U relay. The DCR may include the U2N_DSID, encrypted U2N_RSC, and / or U2N_PRUK ID. The E2E PC5 link between the remote WTRU and U2N may be established based on U2N_RSC and / or U2N_PRUK ID as described herein.

[0247] Although features and elements described above are described in particular combinations, each feature or element may be used alone without the other features and elements of the preferred embodiments, or in various combinations with or without other features and elements.

[0248] Although the implementations described herein may consider 3GPP specific protocols, it is understood that the implementations described herein are not restricted to this scenario and may be applicable to other wireless systems. For example, although the solutions described herein consider LTE, LTE-A, New Radio (NR) or 5G specific protocols, it is understood that the solutions described herein are not restricted to this scenario and are applicable to other wireless systems as well.

[0249] The processes described above may be implemented in a computer program, software, and / or firmware incorporated in a computer-readable medium for execution by a computer and / or processor. Examples of computer-readable media include, but are not limited to, electronic signals (transmitted over wired and / or wireless connections) and / or computer-readable storage media. Examples of computer- readable storage media include, but are not limited to, a read only memory (ROM), a random access memory (RAM), a register, cache memory, semiconductor memory devices, magnetic media such as, but not limited to, internal hard disks and removable disks, magneto-optical media, and / or optical media such as compact disc (CD)-ROM disks, and / or digital versatile disks (DVDs). A processor in association with software may be used to implement a radio frequency transceiver for use in a WTRU, terminal, base station, RNC, and / or any host computer.

Claims

CLAIMSWhat is Claimed:1 . A UE-to-Network (U2N) relay wireless transmit / receive unit (WTRU), the U2N relay WTRU comprising: a processor that is further configured to: send a discovery message during a U2N relay discovery procedure, wherein the discovery message comprises a direct connection request security identification (ID) (DSID); receive a direct connection request (DCR) message from a remote WTRU, wherein the DCR message comprises the DSID, an encrypted U2N Relay Service Code (U2N_RSC), and an encrypted ProSe remote user key (PRUK) ID; determine, from the DCR message, a discovery security key based on the DSID, wherein the DSID is associated with the discovery security key; and decrypt the encrypted U2N_RSC and PRUK ID based on the discovery security key.

2. The U2N relay WTRU of claim 1 , wherein the processor is further configured to determine that the U2N relay WTRU is configured with the U2N_RSC and is associated with a U2N relay discovery security key.

3. The U2N relay WTRU of claim 1 , wherein the discovery security key comprises a U2N Relay Service Code (U2N_RSC) discovery security key.

4. The U2N relay WTRU of claim 1, wherein the discovery message is a relay discovery announcement message.

5. The U2N relay WTRU of claim 1, wherein the discovery message is a relay discovery solicitation response message.

6. The U2N relay WTRU of claim 1 , wherein the discovery message is at least one of a protected U2N relay discovery announcement message or a protected U2N relay discovery solicitation response message.

7. The U2N relay WTRU of claim 1, wherein the DSID being associated with the discovery security key comprises the processor being configured to:generate a mapping between the DSID and the discovery security key.

8. The U2N relay WTRU of claim 1, wherein the DSID is a first DSID, wherein the remote WTRU is a first remote WTRU, and wherein the processor is configured to: assign the first DSID to the first remote WTRU; and assign a second DSID to a second remote WTRU.

9. A method for a UE-to-Network (U2N) relay wireless transmit / receive unit (WTRU) comprising: sending a discovery message during a U2N relay discovery procedure, wherein the discovery message comprises a direct connection request security identification (ID) (DSID); receiving a direct connection request (DCR) message from a remote WTRU, wherein the DCR message comprises the DSID, an encrypted U2N Relay Service Code (U2N_RSC), and an encrypted ProSe remote user key (PRUK) ID; determining, from the DCR message, a discovery security key based on the DSID, wherein the DSID is associated with the discovery security key; and decrypting the encrypted U2N_RSC and PRUK ID based on the discovery security key.

10. The method of claim 9, wherein the method further comprises: determining that the U2N relay WTRU is configured with the U2N_RSC and is associated with a U2N relay discovery security key.11 . The method of claim 9, wherein the discovery security key comprises a U2N Relay Service Code (U2N_RSC) discovery security key.

12. The method of claim 9, wherein the discovery message is a relay discovery announcement message.

13. The method of claim 9, wherein the discovery message is a relay discovery solicitation response message.

14. The method of claim 9, wherein the discovery message is at least one of a protected U2N relay discovery announcement message or a protected U2N relay discovery solicitation response message.

15. The method of claim 9, wherein the DSID being associated with the discovery security key comprises: generating a mapping between the DSID and the discovery security key.

16. The method of claim 9, wherein the DSID is a first DSID, wherein the remote WTRU is a first remote WTRU, and wherein the method comprises: assigning the first DSID to the first remote WTRU; and assigning a second DSID to a second remote WTRU.

Images