Sidelink UE Relay Security Key Setup for Out-of-Coverage Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for UE-to-UE relay in 5G NR sidelink communication fail to address ambiguities and differences in PC5 link setups, leading to potential security issues and uncertainties in establishing secure links between UEs, especially when some UEs are out of network coverage.
Innovation Solution
Implement methods for UEs to identify target UEs through sidelink discovery, exchange relay service codes, and obtain security keys using identifiers like SUCI or PRUK ID, enabling secure link establishment based on network-based authentication and authorization, even when UEs are out of coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions for UE-to-UE relay are used, then PC5 link setup can be established, but ambiguities and differences in link setup lead to security issues and uncertainties
Solution Approach 1:
The patent applies preliminary action by establishing security context and keys before the actual relay communication begins. The relay UE performs authentication and key derivation with both source and target UEs in advance, ensuring that all security parameters are aligned before data transmission starts, thereby eliminating ambiguities during the link setup phase
Solution Approach 2:
The patent implements feedback mechanisms where UEs exchange capability information and security status during the discovery and setup phases. The relay UE receives feedback from source and target UEs about their security contexts and adjusts the key derivation accordingly, ensuring consistent security establishment across all links
2Reliability
If network-based authentication is implemented for out-of-coverage UEs, then secure communication can be established, but additional authentication steps are required
Solution Approach 1:
The patent applies preliminary action by pre-establishing security contexts and caching authentication keys in the relay UE before out-of-coverage communication occurs. When a UE goes out of coverage, the relay UE can immediately use pre-derived keys for authentication without requiring real-time network interaction, thus maintaining security while reducing authentication time
Solution Approach 2:
The relay UE acts as an intermediary that performs authentication on behalf of out-of-coverage UEs. It derives keys using network-provided parameters and distributes them to source and target UEs, enabling secure communication without requiring continuous network connection for each individual authentication step
3Productivity
If parallel PC5 link setup is used for source UE and target UE, then connection establishment is faster, but security ambiguities arise due to different setup conditions
Solution Approach 1:
The patent applies segmentation by dividing the security setup process into independent but coordinated phases: discovery phase where capabilities are exchanged, key derivation phase where security keys are computed, and confirmation phase where security contexts are validated. This allows parallel link establishment while maintaining security consistency through structured coordination
Solution Approach 2:
The patent implements feedback mechanisms where UEs exchange capability information and security status during the discovery and setup phases. The relay UE receives feedback from source and target UEs about their security contexts and adjusts the key derivation accordingly, ensuring consistent security establishment across all links
Data Source
AI summary
Embodiments include methods for a user equipment (UE) configured to operate as a relay UE for sidelink (SL) communication between a source UE and a target UE. Such methods include identifying the target UE based on a SL discovery procedure performed by the UE or by the target UE, and sending to the target UE a first message that includes a relay service code (RSC) indicating a UE-to-UE relay service provided by the UE. Such methods include obtaining one or more security keys based on a security identifier associated with the target UE. Such methods include establishing a secure link with the target UE based on the obtained one or more security keys. Other embodiments include complementary methods for the target UE, as well as UEs configured to perform such methods.