UE Relay Authorization for Secure ProSe Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Proximity services (ProSe) allow User Equipment (UE) to discover each other through a UE-to-UE relay, but this can lead to Man-In-the-middle-attacks (MITM) due to untrusted communication nodes acting as relays.
Innovation Solution
A method and apparatus that involve sending a request message with a Relay Service Code (RSC) to a network device for authorization and receiving a security parameter, enabling secure UE-to-UE relay discovery by authorized relays, and performing security checks on request messages to prevent MITM attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If UE-to-UE relay discovery is enabled to allow UEs to discover each other through relay nodes, then communication coverage and connectivity are improved, but security vulnerability increases due to untrusted relay nodes enabling MITM attacks
Solution Approach 1:
The network device performs preliminary authorization of relay nodes before they can participate in UE-to-UE relay discovery. The network device sends authorization information including security parameters to relay nodes in advance, enabling them to authenticate themselves when other UEs initiate discovery requests. This preliminary security setup prevents MITM attacks while maintaining relay discovery functionality.
Solution Approach 2:
The network device acts as an intermediary that distributes authorization information to relay nodes. This intermediary role ensures that relay nodes are properly authenticated and authorized by the network before they can facilitate UE-to-UE communication, thereby preventing unauthorized or malicious relay operations without blocking legitimate relay discovery.
2Reliability
If security authorization procedures are implemented for relay nodes, then security against MITM attacks is improved, but system complexity and signaling overhead increase
Solution Approach 1:
The security authorization functionality is extracted as a separate, standardized procedure performed by the network device before relay discovery. The authorization information including security parameters is extracted and distributed to relay nodes independently, simplifying the overall system by separating security management from the relay discovery process itself.
Solution Approach 2:
The patent uses parameter changes by distributing specific security parameters (such as authorization tokens or cryptographic keys) to relay nodes. These parameters enable automated authentication without requiring complex real-time security negotiations, thereby reducing system complexity while maintaining high security standards.
3Measurement precision
If relay nodes are authorized with security parameters, then authentication capability is improved, but signaling overhead and network device load increase
Solution Approach 1:
The network device performs preliminary authorization of relay nodes by sending security parameters in advance, before any UE-to-UE discovery occurs. This one-time preliminary signaling reduces the need for repeated authentication exchanges during actual relay operations, thereby improving authentication accuracy while minimizing ongoing signaling overhead and network device load.
Data Source
AI summary
An information processing method is performed by a relay user equipment (UE).The method includes: sending a first request message to a network device, wherein the first request message at least comprises a Relay Service Code (RSC) to identify a relay service; receiving a first response message returned by the network device based on the first request message, wherein a relay UE is authorized to provide the relay service indicated by the RSC, and the first response message includes a security parameter for UE-to-UE relay discovery; after receiving the first response message, performing monitoring of a second request message from a source UE; and in response to the relay UE supporting the relay service indicated by the RSC included in the second request message, broadcasting a third request message according to the second request message and relay information.