ProSe Group Security Establishment for Trusted D2D Communication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

3GPP SA3 lacks a comprehensive security solution for authorization and privacy issues in Proximity-based Service (ProSe) communication, particularly in device-to-device direct communication and unlicensed spectrum scenarios.

Innovation Solution

A method and system for forming secure groups in ProSe communication involving a requesting device and a receiving device, which includes requesting a service from a ProSe server, performing verification, and establishing group security through token-based, network-assisted, or device-level authentication and key management to ensure secure discovery, authorization, and communication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If device-to-device direct communication is enabled in ProSe, then communication flexibility and coverage are improved, but security vulnerabilities and authorization issues arise

Engineering Contradiction:

Improvecommunication flexibilityVSAvoidsecurity reliability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The network acts as an intermediary by establishing security contexts and authorization rules before allowing direct device-to-device communication. The network verifies device identities and configures security parameters (keys, algorithms, protection modes) that devices must use during direct communication, thus enabling flexible communication while maintaining security through network-mediated security setup.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If network-assisted ProSe communication is implemented, then authorization control is improved, but system complexity increases

Engineering Contradiction:

Improveauthorization controlVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security management process is segmented into distinct phases: network-assisted security context establishment, device-level key derivation, and communication-phase security enforcement. This segmentation allows the network to handle complex authorization logic separately from device operations, improving authorization control while managing system complexity through clear separation of responsibilities.

Inventive Principle:

Principle #1Segmentation

3Reliability

If group security establishment is performed for ProSe groups, then privacy protection is improved, but communication overhead increases

Engineering Contradiction:

Improveprivacy protectionVSAvoidcommunication overhead

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Security contexts, authorization rules, and encryption keys are established in advance during group formation and member addition, before actual data communication occurs. This preliminary security setup includes network-verified device identities and pre-configured security parameters, which protects privacy during subsequent communications without requiring repeated verification overhead during data exchange.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12483893B2Secure group creation in proximity based service communication

Publication Date: 2025.11.25 NEC CORP

AI summary

A method of forming a secure group in ProSe communication includes requesting a service request to a ProSe server from a requesting device (21), the service request indicating a request to communicate with a receiving device (22) from the requesting device (21), performing verification on the requesting and receiving devices (21) and (22) by the ProSe server 24, sending a ProSe Service Result to the requesting and receiving devices (21) and (22) to inform to be allowed a group member, and starting a group security establishment of the group including the requesting and receiving devices (21) and (22).