BR112017021953B1 - METHODS EXECUTED BY A PROXIMITY SERVICE SERVER, PROXIMITY SERVICE SERVER, AND COMPUTER READABLE MEMORY - Google Patents

Abstract

METHODS AND APPARATUS FOR ONE END DEVICE TO DISCOVER ANOTHER END DEVICE. The present invention relates to a method performed by a proximity service server. The method comprises generating a ProSe query code and a ProSe response code, sending at least one ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device such that the second end device can securely discover the first end device via an air interface.

Description

Field of Invention

[0001] The present invention relates to methods for allowing an end device to securely discover another end device. It also refers to servers and end devices to allow one end device to securely discover another end device.

Fundamentals of Invention

[0002] Proximity Services (ProSe) are services that can be provided by the 3GPP system, based on UEs in proximity. One of these services is ProSe Discovery. The ProSe service is described in 3GPP TS 22.278 and 3GPP TS 23.303 and allows the possibility of Device-to-Device (D2D) communication, without transmitting messages over the Radio Access Network.

[0003] ProSe Discovery identifies which ProSe-enabled UEs are in proximity using the Evolved UMTS Terrestrial Radio Access (E-UTRA), whether or not they are using the Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) or the Evolved Packet Core Network (EPC), when permission, authorization and proximity criteria are met. Proximity criteria can be configured by the operator.

[0004] The ProSe Discovery process involves a discovery message sent over an air interface by one device, and received by another. The other device then responds with a discovery message. Both discovery messages comprise a ProSe code to identify each of the devices. However, one device may reproduce the ProSe code received from the other device and thus intend to be said by the other device. Therefore, there is a need for devices that can securely discover another device when they are in close proximity.

Summary of the Invention

[0005] According to one aspect of the invention, there is provided a method executed by a proximity service server comprising generating a ProSe query code and a ProSe response code, sending at least one ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device so that the second end device can securely discover the first end device on an interface aerial.

[0006] In one embodiment, the method further comprises, as a preliminary step, generating the first discovery key and the second discovery key. The method may also include, as a preliminary step, receiving the first and second discovery keys from a key management server.

[0007] In one embodiment, the method comprises generating a discovery filter based on the ProSe query code and sending it to the first end device.

[0008] In another embodiment, the method comprises receiving a discovery request from the second end device indicating that said second end device wishes to discover the first end device over an air interface, the proximity service server then sending the first key discovery code and the ProSe query code for the second end device.

[0009] The method may further comprise sending the ProSe response code to a second proximity service server with which the second end device is in communication.

[0010] In one embodiment, the method comprises receiving from the second end device a match report request comprising the ProSe response code and an authentication signal ("token") based on the second discovery key.

[0011] In an alternative embodiment, the method comprises checking the authentication signal using the second discovery key.

[0012] If the authentication signal is verified, the method may further include sending a match report response to the second end device, indicating that the first end device is genuine.

[0013] In one embodiment, the method comprises sending the second discovery key to the second end device such that the second end device can verify that the first end device is genuine.

[0014] In one embodiment, the second end device comprises a plurality of second end devices such that the method may comprise sending the ProSe query code and the first discovery key to each second end device.

[0015] According to another aspect of the invention, there is provided a server comprising a generation unit for generating a ProSe query code and a ProSe response code, a transmission unit for sending at least one ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device such that said second end device can securely discover the first end device via an air interface.

[0016] According to another aspect of the invention, there is provided a server comprising a processor and a memory, the memory containing instructions executable by the processor, such that the network node is operable to execute a method in accordance with any of attached claims 1 to 11.

[0017] According to yet another aspect of the invention, there is provided a method executed by an end device, the method comprising receiving a first discovery key, a second discovery key and a ProSe response code from a service server proximity, receiving a direct discovery request comprising a ProSe query code and an authentication signal from a second end device that wishes to discover the end device, verifying that the authentication signal uses the first discovery key.

[0018] The method may further comprise the first end device receiving, from the proximity service server, a discovery filter based on a ProSe query code.

[0019] In one embodiment, the first end device receives the ProSe query code and the authentication signal via an air interface and the authentication signal is based on the first discovery key.

[0020] If the first end device verifies the authentication signal received from the second end device, the method may further comprise sending a discovery response to the second end device comprising a second authentication signal based on the second discovery key.

[0021] In one embodiment, the method comprises, as a preliminary step, the end device sending to its proximity service server a discovery request in such a way as to request that the second end device can discover said end device.

[0022] According to another aspect of the invention, there is provided an end device comprising a transmission unit for receiving a first discovery key, a second discovery key and a ProSe response code from a proximity service server, and to receive a direct discovery request comprising a ProSe query code and an authentication signal from a second end device that wishes to discover the end device, a verification unit for verifying the authentication signal using the first discovery key .

[0023] In accordance with yet another aspect of the invention, there is provided an end device comprising a processor and a memory, the memory containing instructions executable by the processor, such that the network node is operable to execute a method in accordance with any one of the attached claims 14 to 18.

[0024] According to another aspect of the invention, there is provided a method executed by a proximity service server, the method comprising receiving from a second proximity service server at least a first discovery key, a ProSe query and a ProSe response code, generate a discovery filter based on the ProSe response code, and send the discovery filter, the first discovery key and the ProSe query code to a first end device such that the said first end device can safely discover a second end device on an air interface.

[0025] In one embodiment, the method comprises receiving from the first end device a match report request comprising an authentication signal based on a second discovery key and forwarding the authentication signal to the second proximity server for verification.

[0026] If the second proximity server verifies the authentication signal, the method may further comprise receiving a response from the second proximity server indicating that the second end device is genuine.

[0027] In one embodiment, the method further comprises the proximity service server receiving a second discovery key from the second proximity service server and sending the second discovery key to the first end device.

[0028] In another embodiment, the method may further comprise, as a preliminary step, the proximity service server receiving a discovery request from the first end device, indicating that the first end device wishes to discover the second end device from the second proximity service server.

[0029] In one embodiment, the method may comprise sending a discovery request to the second proximity service server indicating that the first end device wishes to discover the second end device from the second proximity service server.

[0030] According to another aspect of the invention, there is provided a server comprising a transmission unit for receiving from a second proximity service server at least a first discovery key, a ProSe query code and a ProSe response, a generation unit for generating a discovery filter based on the ProSe response code and sending said discovery filter, the first discovery key and the ProSe query code to a first end device such that the said first end device can safely discover a second end device on an air interface.

[0031] In accordance with yet another aspect of the invention, there is provided a server comprising a processor and a memory, the memory containing instructions executable by the processor, such that the network node is operable to execute a method in accordance with any of attached claims 21 to 26.

[0032] According to another aspect of the invention, there is provided a method executed by an end device, the method comprising receiving a ProSe query code and a first discovery key from a proximity service server, sending to a second end device a direct discovery request comprising an authentication signal based on the first discovery key, and receiving from the second end device a discovery response comprising a ProSe response code and a second authentication signal.

[0033] In one embodiment, the method comprises receiving from the proximity service server a discovery filter based on the ProSe response code.

[0034] In another embodiment, the method comprises the end device identifying the ProSe response code received from the second end device using the discovery filter.

[0035] In one embodiment, the end device may forward the second authentication signal to the proximity service server for verification.

[0036] If the second authentication signal is verified, the method may further comprise receiving a message from the proximity service server indicating that the second end device is genuine.

[0037] In an alternative embodiment, the method may comprise the end device receiving a second discovery key from the proximity service server and the end device verifying the second authentication signal using the second discovery key, thereby authenticating the second end device.

[0038] In one embodiment, the method may comprise, as a preliminary step, sending to the proximity service server a discovery request indicating that the end device wishes to discover the second device.

[0039] In another embodiment, the end device may comprise a plurality of end devices, such that the method further comprises each end device receiving the same ProSe query code and first discovery key, and sending to the same second device final a direct discovery request and receiving from said same second end device a direct discovery response.

[0040] According to another aspect of the invention, there is provided an end device comprising a transmission unit for receiving a ProSe query code and a first discovery key from a proximity service server, and for sending to a second end device a direct discovery request comprising an authentication signal based on the first discovery key, and to receive from the second end device a discovery response comprising a ProSe response code and a second authentication signal.

[0041] In accordance with yet another aspect of the invention, there is provided an end device comprising a processor and a memory, the memory containing instructions executable by the processor, such that the network node is operable to execute a method in accordance with any one of the attached claims 29 to 36.

[0042] According to a further aspect, there is provided a computer program configured, when executed on a computer, to perform a method according to any one of the attached claims 1 to 11, 14 to 18, 21 to 26 or 29 to 35.

[0043] In accordance with yet another aspect of the invention, there is provided a computer program product comprising a computer readable medium and a computer program as described above stored on the computer readable medium.

Brief Description of the Drawings

[0044] Figure 1 illustrates a first network that operates according to an embodiment of the invention.

[0045] Figure 2 illustrates a second network that operates in accordance with an embodiment of the invention.

[0046] Figure 3 illustrates the shape of the network.

[0047] Figure 4 illustrates the ProSe functions and their interfaces with a UE.

[0048] Figure 5 illustrates the ProSe functions and their interfaces.

[0049] Figure 6 illustrates an embodiment of the present invention.

[0050] Figure 7 illustrates another embodiment according to the present invention.

[0051] Figure 8 is a flowchart illustrating steps of the method according to an embodiment of the present invention executed by a server.

[0052] Figure 9 is a flowchart illustrating steps of the method according to another embodiment of the invention executed by a server.

[0053] Figure 10 is a flowchart illustrating steps of the method according to yet another embodiment of the invention executed by a server.

[0054] Figure 11 is a flowchart illustrating steps of the method according to an embodiment of the invention performed by a final device.

[0055] Figure 12 is a flowchart illustrating steps of the method according to another embodiment of the invention performed by a final device.

[0056] Figure 13 is a flowchart illustrating steps of the method according to an embodiment of the invention executed by a server.

[0057] Figure 14 is a flowchart illustrating steps of the method according to another embodiment of the invention executed by a server.

[0058] Figure 15 is a flowchart illustrating steps of the method according to an embodiment of the invention performed by a final device.

[0059] Figure 16 is a flowchart illustrating steps of the method according to another embodiment of the invention performed by a final device.

[0060] Figure 17 is a block diagram illustrating a server.

[0061] Figure 18 is a block diagram illustrating a final device.

[0062] Figure 19 is a block diagram illustrating a server.

[0063] Figure 20 is a block diagram illustrating another example of a server.

[0064] Figure 21 is a block diagram illustrating an example of a final device.

[0065] Figure 22 is a block diagram illustrating another example of a final device.

[0066] Figure 23 is a block diagram illustrating an example of a server.

[0067] Figure 24 is a block diagram illustrating another example of a server.

[0068] Figure 25 is a block diagram illustrating an example of a final device.

[0069] Figure 26 is a block diagram illustrating another example of a final device.

Detailed Description of the Invention

[0070] Figure 1 illustrates a part of a cellular communication network, including a first base station 10, a serving cell 12, with a first wireless communication device (UE1) 14 and a second wireless communication device ( UE2) 16 within cell 12.

[0071] Figure 2 illustrates a portion of another cellular communication network, including a first base station 20, a first serving cell 22, with a first wireless communication device (UE1) 24 within the cell 22, and a second base station 26, a second serving cell 28, with a second wireless communication device (UE2) 30 within the cell 28.

[0072] In the examples described herein, devices participating in the methods are described as user equipment devices (UEs). It should be understood that this term is used to refer to portable communications devices operated by the user, such as smartphones, laptop computers or the like, to other portable devices such as tracking devices or the like, and to devices primarily intended to stay stationary devices in use, such as sensors, smart meters or similar. The term user equipment devices should also be understood as wireless communication devices, end devices and terminal devices, and is not limited to being a user-operated device.

[0073] In the examples shown in Figures 1 and 2, the networks are part of an Evolved UMTS Terrestrial Radio Access Network (E-UTRAN), as defined by the 3rd Generation Partnership Project (3GPP). The 3GPP system offers the possibility of Proximity Services (ProSe) that can be used by User Equipment (UE) devices that are in proximity. The ProSe system is described in 3GPP TS 22.278 and 3GPP TS 23.303. For example, the ProSe system allows the possibility of Device to Device (D2D) communication, without transmitting messages through the Radio Access Network.

[0074] One aspect of the ProSe system is the ProSe Discovery process. The ProSe Discovery process identifies that ProSe-enabled UEs are in proximity, using the Evolved UMTS Terrestrial Radio Access network (with or without the use of E-UTRAN) or the Evolved Packet Core (EPC) network, when permission, authorization and proximity criteria are met. Proximity criteria can be configured by the operator. A specific form of ProSe Discovery is Direct ProSe Discovery, which is a procedure employed by a ProSe-enabled UE to discover other ProSe-enabled UEs in its neighborhood using only the capabilities of the two E-UTRA-enabled UEs.

[0075] The term ProSe-enabled UE refers to a UE that supports ProSe requirements and associated procedures. A ProSe-enabled UE can be a non-public security UE and/or a public security UE.

[0076] Figures 1 and 2 show scenarios for D2D ProSe where UE1 and UE2 are located in the coverage of a cell, which may be the same cell 12, as shown in Figure 1, or may be different cells 22, 28 as shown in Figure 2. When UE1 has a transmitter role, UE1 sends a discovery message and UE2 receives it. The two devices UEs1 and UE2 can switch their roles as transmitter and receiver. The transmission from UE1 can be received by at least one other UE besides UE2.

[0077] The ProSe Discovery process can be used as a standalone process (i.e., not necessarily followed by ProSe Communication) or as a facilitator for other services.

[0078] Figure 3 is an illustration of the ProSe network architecture. In Figure 3, two user equipment devices, UE A and UE B, are assumed to subscribe to the same Public Land Mobile Network (PLMN).

[0079] The two user equipment devices, UE A and UE B, each have a respective connection via the LTE-Uu interface to the Evolved UMTS Terrestrial Radio Access Network (E-UTRAN). An S1 interface connects the E-UTRAN to an Evolved Packet Core (EPC) network, which includes a Mobility Management Entity (MME), Service Access Port (SGW), Packet Access Port (PGW), Home Subscriber Server (HSS), and Secure User Plane Location (SUPL) location platform (SLP), among other network nodes.

[0080] The network also includes at least one application server that uses the ProSe capability to build application functionality.

[0081] The core network also includes a ProSe function that provides functionalities such as: Authorization and configuration of the UE for discovery and direct communication (controlled by the ProSe function in the user's Home PLMN in the case of non-mobility and by the Home PLMN or ProSe Function of PLMN Visited in the case of mobility); enabling EPC-level ProSe discovery functionality; handling and storing new subscriber data relating to ProSe and ProSe identities; and security-related functionality.

[0082] The ProSe function has a PC3 reference point toward each UE, and has a PC4 reference point for the EPC.

[0083] The ProSe function also has a PC2 reference point for at least one ProSe application server, which uses the ProSe capability to create the application functionality.

[0084] Each UE includes a ProSe application, which has a PC1 reference point for the ProSe Application Server.

[0085] The UEs, UE A and UE B, use the PC5 reference point for control and user plane discovery and communication, for transmission, and for device-to-device communication (between UEs directly and between UEs via the LTE-Uu interface ). Reference point PC5 is also called here an air interface between two UEs (UE A and UE B).

[0086] Figure 4 illustrates the ProSe function in more detail. The ProSe function 410 of a home public land mobile network (HPLMN) comprises three subfunctions: DPF 411, direct discovery name management function 412, and EPC level discovery function 413. The Direct Discovery Name Management function is used to Open ProSe Direct Discovery to allocate and process the mapping of ProSe Application IDs and ProSe Application Codes used in Direct ProSe Discovery. It uses ProSe-related subscriber data stored on the Home Subscriber Server (HSS) for authorization for each discovery request. It also provides the UE 414 with the necessary security material to protect discovery messages transmitted over the PC5 air interface.

[0087] Figure 5 illustrates various ProSe functions of different public land mobile networks (PLMN) and their interfaces. A home PLMN (HPLMN) 510 has a reference point PC6 or PC7 towards a local PLMN 511. The HPLMN 510 may also have a PC7 reference point for a visited PLMN (VPLMN) 512.

[0088] In the Direct ProSe Discovery procedure, there are two models: model A (“I am here”) and model B (“who is there”/”you are there”). Model A defines two roles for ProSe-enabled UEs that are participating in Direct ProSe Discovery. A role is assumed by an advertising UE that announces certain information that could be used by other UEs in its proximity that are allowed to discover the advertising UE. The other function is taken by a monitoring UE that monitors certain information of interest in proximity to the advertising UE.

[0089] Model B defines two roles for ProSe-enabled UEs that participate in Direct ProSe Discovery. A first function is assumed by a Discoverer UE that transmits a request containing certain information about what is interesting to discover. The other role is assumed by a discovered UE that receives the request message and can respond with information related to the discovering UE's request. It should be understood that the two UEs can change roles.

[0090] The Direct ProSe Discovery procedure can be the “open” or “restricted” discovery procedure. Open Direct ProSe Discovery may be a standalone service enabler that, for example, may use information from a discovered/advertiser UE for certain applications in the discoverer/monitoring UE that are authorized to use that information. For example, the discovered/advertising UE may be a nearby taxi and the discovering/monitoring UE wants to find a nearby taxi. In other words, there are little or no restrictions on who can discover who.

[0091] In the Restricted Direct ProSe Discovery procedure, there is a restriction on who can discover who. A ProSe-enabled UE must be capable of being discovered (discovery/advertiser UE) only by other ProSe-enabled UEs (discoverer/monitoring UE) that are close to each other and which are explicitly permitted by the discoverable ProSe-enabled UE ( EU discovered/advertiser). ProSe Direct Restricted Discovery allows permission set at the application layer by the discovered/advertising UE to determine the ability of the discovering/monitoring UE to discover the discovered/advertising UE.

[0092] It should be understood that the Restricted Direct ProSe Discovery procedure can use model A or model B.

[0093] Referring now again to model B in more detail, when a discovering UE wishes to discover a discovered UE in its neighborhood or proximity, the discovering UE transmits a direct discovery request message over the air interface (PC5) that includes a ProSe query code. (A ProSe lookup code is a code that is generated or allocated by the ProSe function in the public land mobile network (HPLMN) and allows the discoverer to identify another discoverer.) The discovered UE listens to a discovery message and uses a discovery filter with based on the ProSe query code to identify the direct discovery request message sent from the discovering UE. When the discovery filter identifies a ProSe query code sent from a discovering UE, said discovered UE transmits a direct discovery response message over the air interface (PC5 interface), including a ProSe response code. The ProSe response code is allocated by the ProSe function to the discovered UE.

[0094] An embodiment of the invention will now be described with reference to Figure 6. In this embodiment, a discovered UE 651, a ProSe public land mobile network (HPLMN) ProSe function 652 of the discovered UE, a discoverer UE 653, and a ProSe HPLMN function 654 of the UE discoverer exchanges messages.

[0095] First, the discovered UE 651 initiates a discovery request procedure with its ProSe HPLMN function 652, sending a discovery request requesting that the predetermined discovery UEs in an application server (see Figure 3) can discover the discovered UE 651, step 601. The discovered UE sends the request through the PC3 interface.

[0096] The ProSe function HPLMN 652 of the discovered UE then generates or constructs a ProSe query code, ProSe response code, a discovery key A (first discovery key) and a discovery key B (second discovery key), step 602. However, in another embodiment not illustrated, the ProSe HPLMN function 652 does not generate discovery keys A and B, instead it receives these keys from a key management server.

[0097] The ProSe function 652 also generates or prepares a discovery filter based on the ProSe query code. A discovery filter is a container of a ProSe query code, zero or more ProSe application masks, and time to live values and its use will be explained in more detail below.

[0098] The ProSe function 652 then sends via the PC3 interface a discovery response comprising the ProSe response code, the discovery key A, the discovery key B and the discovery filter to the discovered UE 651, step 603.

[0099] Meanwhile, the discovering UE 653 initiates a discovery request procedure with its ProSe HPLMN function 654 by sending via the PC3 interface to its ProSe HPLMN function 654 a discovery request to discover the discovered UE 651, step 604. The function ProSe HPLMN 654 of the discovering UE then sends a discovery request via the PC6 interface to the ProSe HPLMN 652 function of the discovering UE, step 605. In response, the ProSe HPLMN 652 function of the discovering UE sends a discovery response via the PC6 interface to the discoverer UE ProSe function HPLMN 654, the discovery response comprises the ProSe query code, the discovery key A and the ProSe response code, step 606. The discoverer UE ProSe function HPLMN 654 can then store the query code ProSe, discovery key A, and ProSe response code, step 606a.

[0100] The ProSe HPLMN function 654 of the discovery UE 654 then configures or generates a discovery filter based on the ProSe response code, and then sends a discovery response to the discovery UE 653, the discovery response comprising the ProSe query code , the discovery key A, and the discovery filter based on the ProSe response code, step 607.

[0101] Then, the discoverer UE 653 calculates an authentication signal using discovery key A. The authentication signal may be a message integrity code (MIC). The MIC is calculated using the key derivation function (KDF) described in 3GPP TS 33.220 together with the discovery key A and a time value as input parameters, step 608a. This authentication signal is called MIC-A here. The ProSe query code can also be used as an additional input parameter. It should be understood that the authentication signal is not limited to a MIC, rather, in an alternative embodiment a message authentication code could be used.

[0102] When the discovering UE 653 wants to discover the discovered UE 651 in its neighborhood, the discovering UE 653 transmits a direct discovery request message via interface PC5, 608b. The direct discovery request includes the ProSe query code and MIC-A.

[0103] The discovered UE 651 then listens to the direct discovery request and using its discovery filter based on the ProSe query code, the discovered UE 651 identifies or matches the ProSe query code received from the discovering UE 653. When the Discovered UE 651 makes a match, it verifies the authentication signal by calculating the MIC-A using the same discovery key A and time value, step 608c. If the MIC-A matches the authentication signal received from the discovering UE 653, the discovered UE 651 knows that the discovering UE is genuine and thus can safely allow the discovering UE 653 to discover the discovered UE 65. In the next step, the Discovered UE 651 calculates another authentication signal comprising a MIC based on the discovery key B and a time value, step 609a. This authentication signal is called MIC-B here. However, it should be understood that an alternative authentication signal may be used as described above in conjunction with discovery key A.

[0104] The discovered UE 651 sends a discovery response via the PC5 interface to the discovering UE 653, step 609b. The discovery response comprises the ProSe response code and MIC-B (the other authentication signal based on discovery key B).

[0105] The discovery UE 653 then listens to the discovery response, and using its discovery filter based on the ProSe response code, identifies or matches the ProSe response code sent from the discovery UE 651. So that the discovery UE 653 653 discovers whether the discovered UE 651 is genuine, the discovering UE 653 initiates a match reporting procedure. It does this by sending a match report request to its ProSe HPLMN function 654 via the PC3 interface, step 610. The match report message comprises the MIC-B authentication signal. It can also understand the ProSe response code. The ProSe HPLMN 654 function of the discovering UE then forwards via the PC6 interface the match report request to the ProSe HPLMN 652 function of the discovered UE, step 611.

[0106] The ProSe HPLMN 652 function of the discovered UE then checks the authentication signal by calculating the MIC-B using the discovery key B and the time value. If the MIC-B matches the authentication signal received from the discovered UE 651 through the discoverer UE 653, and its ProSe function HPLMN 654, the ProSe function 652 of the discovered UE sends a match report response to the ProSe function HPLMN 654 of the discoverer UE through the PC6 interface, step 613, and the ProSe HPLMN function 654 of the discoverer UE forwards the match report response to the discoverer UE 653, step 614. Upon receiving the match report response, the discoverer UE 653 knows that the discovered UE 651 is genuine.

[0107] One of the advantages of this method is that, as the discovered UE 651 and the discovering UE 653 share a discovery key (A), the discovered UE 651 can verify the discovering UE 653 in such a way that said discovered UE 651 know that the discoverer UE 653 is genuine and not another imitation or fake discoverer UE that reproduces the ProSe query code.

[0108] Furthermore, the discovered UE 651 does not need to initiate a match reporting procedure with its ProSe HPLMN function upon hearing a discovery request message that satisfies its discovery filter, instead, the discovered UE 651 can check the signal authentication received in the discovery request message.

[0109] It is also advantageous that discovery key B never leaves the ProSe function 652 of the UE uncovered. This means that the discovering UE 653 cannot claim to be the discovered UE by repeating the ProSe response code to another discovering UE.

[0110] Advantageously, this method can be applied to both open direct discovery and restricted direct discovery procedures.

[0111] Yet another advantage is that the discovered UE 651 and the discovering UE 653 can directly exchange the ProSe query code and the ProSe response code without requiring signaling on the network between them.

[0112] Another embodiment will now be described with reference to Figure 7. This embodiment differs from that described with reference to Figure 6 in that the ProSe HPLMN function of the discovered UE forwards the discovery key B to the discovering UE, such that the discovering UE does not need to initiate a match reporting process, but can check the MIC-B received from the discovered UE.

[0113] In this embodiment, a discovered UE 751, a ProSe function (HPLMN) 752 of the discovered UE's domestic public land mobile network, a discovering UE 753, and a ProSe HPLMN function 754 of the discovering UE exchange messages.

[0114] First, the discovered UE 751 initiates a discovery request procedure with its ProSe HPLMN function 752, sending a discovery request that requests predetermined discovering UEs in an application server (see Figure 3) to enable discovery of said Discovered UE 751, step 701. Discovered UE 751 sends the request via the PC3 interface.

[0115] The ProSe function HPLMN 752 of the discovered UE then generates a ProSe query code, the ProSe response code, a discovery key A (first discovery key) and a discovery key B (second discovery key), step 702. However, in another embodiment, the ProSe HPLMN function does not generate the A and B discovery keys, instead it receives these keys from a key management server.

[0116] The ProSe function HPLMN 752 also generates a discovery filter based on the ProSe query code. As described previously, a discovery filter is a container of a ProSe query code, zero or more ProSe application masks, and live time values, and its use will be explained in more detail below.

[0117] The ProSe function 752 then sends via the PC3 interface a discovery response comprising the ProSe response code, the discovery key A, the discovery key B and the discovery filter to the discovered UE 751, step 703.

[0118] Meanwhile, the discovering UE 753 initiates a discovery request procedure with its ProSe HPLMN function 754 by sending via the PC3 interface to the ProSe HPLMN function 754, a discovery request to discover the discovered UE 751, step 704. ProSe HPLMN 754 function of the discovering UE then sends a discovery request via the PC6 interface to the ProSe HPLMN 752 function of the discovered UE, step 705. In response, the ProSe HPLMN 752 function of the discovering UE sends a discovery response via the PC6 interface for the discoverer UE's ProSe HPLMN 754 function, the discovery response comprises the ProSe query code, discovery key A, discovery key B, and the ProSe response code, step 706. The discoverer UE's ProSe HPLMN 754 function may then store the ProSe query code, discovery key A, discovery key B, and ProSe response code, step 706a.

[0119] The ProSe HPLMN function 754 of the discovery UE then configures a discovery filter based on the ProSe response code, and sends a discovery response to the discovery UE 753, the discovery response comprising the ProSe query code, the key discovery key A, discovery key B, and discovery filter based on ProSe response code, step 707.

[0120] Subsequently, the discoverer UE 753 calculates an authentication signal using discovery key A. The authentication signal may be a message integrity code (MIC). The MIC is calculated using the key derivation function (KDF) described in 3GPP TS 33.220 together with the discovery key A and a time value as input parameters, step 708a. This authentication signal is called MIC-A here. (The ProSe query code can also be used as an additional input parameter. It should be understood that the authentication signal is not limited to a MIC. In an alternative embodiment, a message authentication code could be used in instead).

[0121] When the discovering UE 753 wants to discover the discovered UE 751 in its neighborhood, the discovering UE 753 transmits a direct discovery request message via the PC5 interface, 708b. The direct discovery request comprises the ProSe query code and the MIC-A.

[0122] The discovered UE 751 then listens to the direct discovery request and using its discovery filter based on the ProSe query code, it identifies or matches the ProSe query code received from the discovering UE 753. When the discovered UE 751 makes a match, it verifies the authentication signal by calculating MIC-A using the same discovery key A and time value, step 708c. If the MIC-A matches the authentication signal received from the discovering UE 753, the discovered UE 751 knows that the discovering UE 753 is genuine and therefore can safely allow the discovering UE 753 to discover the discovered UE 751. This is done calculating another authentication signal comprising a MIC based on discovery key B and a time value, step 709a. This authentication signal is called MIC-B here. However, it should be understood that an alternative authentication signal may be used as described above in conjunction with discovery key A.

[0123] The discovering UE 751 then sends a discovery response via the PC5 interface to the discovering UE 753, step 709b. The discovery response comprises the ProSe response code and the MIC-B (the other authentication signal based on discovery key B).

[0124] The discovery UE 753 then listens to the discovery response, and using its discovery filter based on the ProSe response code, identifies or matches the ProSe response code sent from the discovery UE 751. So that the discovery UE 753 discover whether the discovered UE 651 is genuine, the discovering UE 753 checks the authentication signal by calculating the MIC-B using the discovery key B and the time value. If the MIC-B matches the authentication signal received from the discovered UE 751, the discovering UE 653 knows that the discovered UE 651 is genuine, that is, that the discovered UE is not reproducing a ProSe response code belonging to another UE. uncovered.

[0125] This embodiment shares similar advantages to the embodiment described with reference to Figure 6. For example, one of the advantages of this method is that because the discovered UE 751 and the discovering UE 753 share a discovery key (A), the discovered UE 751 can verify the discoverer UE 753, such that the discovered UE 751 knows that the discoverer UE 753 is genuine and not another imitation or fake discoverer UE that reproduces the ProSe query code.

[0126] Furthermore, the discovered UE 751 does not need to initiate a match reporting procedure with its ProSe HPLMN function upon hearing a discovery request message that satisfies its discovery filter, instead, the discovered UE 751 can check the signal authentication received in the discovery request message. Similarly, the discovery UE 753 does not need to initiate a match reporting procedure upon hearing a discovery response message that satisfies its discovery filter. Instead, the discovering UE 753 itself may verify the authentication signal received from the discovering UE 752.

[0127] Advantageously, this method can be applied to the open direct discovery and restricted direct discovery procedure.

[0128] Similar to the embodiment described with reference to Figure 6, another advantage is that the discovered UE 751 and the discovering UE 753 can directly exchange the ProSe query code and the ProSe response code without requesting signaling to the network between them.

[0129] In both embodiments described with reference to Figures 6 and 7, it should be understood that the discovery UEs 653, 753 may be a group of discovery UEs that receive the same ProSe query code, discovery filter based in a particular ProSe response code, and a first discovery key. This is so that any of the discovering UEs in the group can discover the discovered UE. Thus, the first discovery key and the ProSe query code are not specific to a particular discovering UE.

[0130] Alternatively, each discovering UE of the group may additionally receive the same second discovery key so that each UE, upon receiving a discovery response 607, 707 from the discovered UE 651, 751, can verify or authenticate the UE discovered 651, 751.

[0131] Embodiments will now be described implementing the methods described with reference to Figures 6 and 7.

[0132] One embodiment of a method of a server will now be described with reference to Figure 8. The server may be a proximity service server such as a ProSe function. The proximity service server is part of the same public land mobile network (PLMN) as a first end device (discovered UE) and can therefore be considered as the home ProSe PLMN function of the first end device. The first end device and the proximity service server are transmitting information through the PC3 interface. The proximity service server is also sending and receiving information to and from a second end device (discoverer UE) via another or second proximity service server or ProSe function of the same PLMN as the second end device. Thus, the second proximity service server can be considered a domestic ProSe PLMN function of the second end device (discoverer UE).

[0133] As mentioned, the method is performed by a server, such as a proximity service server. The method comprises generating a ProSe query code and a ProSe response code 801, or allocating a ProSe query code and a ProSe response code to the first end device. In the next step, the proximity service server sends at least the ProSe response code together with a first and a second discovery key to the first end device 802. Thereafter, the proximity service server sends at least the first discovery key discovery and ProSe query code to a second end device 803 to allow the second end device to securely discover the first end device via an air interface.

[0134] Another embodiment of this method will now be described with reference to Figure 9. In this embodiment, the proximity service server may generate a first discovery key and a second discovery key 901, or alternatively, may receive both keys from from a key management server 902. The proximity service server then generates a ProSe query code and a ProSe response code 903, or allocates these codes to a first end device. Thereafter, it sends at least the ProSe response code together with the first and second discovery key to the first end device 904. The proximity service server then receives a discovery request from a second end device indicating that the second end device wants to discover the first end device via an air interface 905. In the next step, the proximity service server sends at least the first discovery key and the ProSe query code to the second end device 906, and then generates a discovery filter based on the ProSe query code and sends it to the first end device 907. The discovery filter based on the ProSe query code may alternatively be sent to the first end device in conjunction with the ProSe response code, with the first and second discovery key as set forth in step 904. The proximity service server also sends the ProSe response code to a second proximity service server, with which the second end device is in communication 908. ( This is so that the second proximity service server can generate the discovery filter based on the ProSe response code, instead of the proximity service server.) In the next step, the proximity service server receives a request for matching report comprising an authentication signal based on the second discovery key as well as the ProSe response code from the first end device through the second end device 909. It then verifies the authentication signal using the second discovery key 910 and then responds by sending a match report response to the second end device, indicating that the first end device is genuine 911. In one embodiment, step 912, the second end device comprises a plurality of second end devices, such that the method further comprises sending the ProSe query code and the first discovery key to each second end device as set forth in step 906.

[0135] Another embodiment will now be described with reference to Figure 10. This embodiment 1000 differs from the embodiments described with reference to Figure 9 in that the proximity service server also sends the second discovery key to the second end device, from such that said second end device can verify or authenticate the first end device without sending a match report request.

[0136] The first steps 1001, 1002, 1003, 1004, 1005 and 1006 correspond to steps 901, 902, 903, 904, 905 and 906 in Figure 9 and therefore will not be described in detail. In step 1007, the proximity service server sends the second discovery key to the second end device. The proximity service server also generates a discovery filter based on the ProSe query code and sends it to the first end device 1008, similar to step 907 in Figure 9. It also sends the ProSe response code to a second proximity server 1008. proximity service with which the second end device is in communication 1009. (This is so that the second proximity service server can generate the discovery filter based on the ProSe response code, rather than the proximity service server. ) In yet another embodiment, step 1010, the second end device comprises a plurality of second end devices, such that the method further comprises sending the ProSe query code, the first discovery key, and the second discovery key to each device. final, as established in steps 1006 and 1007.

[0137] Another aspect of the invention will now be described with reference to Figure 11. Figure 11 illustrates a method 1100 performed by an end device (discovered UE). The end device communicates with your proximity service server or the ProSe HPLMN function via the PC3 interface. The end device also communicates with a second end device (discoverer UE) via the PC5 air interface.

[0138] In the method, the end device receives a first discovery key, a second discovery key, and a ProSe response code from a proximity service server, 1102. The end device also receives a direct discovery request that comprises a ProSe query code and an authentication signal from a second end device that wishes to discover the end device, 1103. The end device then verifies the authentication signal using the first discovery key, 1104.

[0139] Figure 12 illustrates another embodiment, where a method 1200 is executed by an end device. In this method, the end device sends to a proximity service server a discovery request to request that the second end device can discover the end device, 1201. The end device receives a first discovery key, a second discovery key, and a ProSe response code from its proximity service server, 1202. It also receives a discovery filter based on a ProSe query code from its proximity service server, 1203. Subsequently, the end device receives a request direct discovery method that includes a ProSe query code and an authentication signal from a second end device that wishes to discover the end device, 1204. The end device may receive the ProSe query code and the authentication signal through an interface aerial and the authentication signal is based on the first discovery key, 1205. Subsequently, the end device verifies the authentication signal using the first discovery key, 1206. If it is verified successfully, the end device sends it to the second end device a discovery response comprising a second authentication signal based on the second discovery key, 1207.

[0140] Another embodiment of the invention will now be described with reference to Figure 13. Figure 13 shows a method of a server, such as a proximity service server, which may be a ProSe function. The proximity service server is part of the same public land mobile network (PLMN) as a first end device (discoverer UE) and can therefore be considered as the domestic ProSe PLMN function of the first end device. The first end device and the proximity service server are transmitting information through the PC3 interface. The proximity service server is also sending and receiving information to and from a second proximity service server or ProSe function of the same PLMN of a second end device (discovered UE). Thus, the second proximity service server can be considered a domestic ProSe PLMN function of the second end device.

[0141] In this method 1300, the proximity service server receives from a second proximity service server at least a first discovery key, a ProSe query code, and a ProSe response code, 1301. It generates a filter discovery based on the ProSe response code, 1302, and subsequently sends the discovery filter, the first discovery key, and the ProSe query code to a first end device 1303.

[0142] Another embodiment will now be described with reference to Figure 14. This method 1400 is also performed by a server such as a proximity service server similar to that which performs method 1300. The proximity service server receives a discovery request from a first end device (discovering UE) indicating that the first end device wishes to discover a second end device (discovered UE) from a second proximity service server, 1401. The proximity service server sends or forwards a request for discovery for the second proximity service server indicating that the first end device wishes to discover the second end device of the second proximity service server, 1402. The proximity service server then receives from the second proximity service server at least a first discovery key, a ProSe query code, and a ProSe response code, 1403. In the next step 1404, the proximity service server generates a discovery filter based on the ProSe response code. Subsequently, the proximity service server sends the discovery filter, the first discovery key, and the ProSe query code to the first end device.

[0143] In an alternative, the proximity service server receives from the first end device a match report request comprising an authentication signal based on a second discovery key, and then forwards the authentication signal to the second proximity server for verification, 1406. If the second proximity service server verifies the authentication signal, the method further comprises receiving a response from the second proximity server that authenticates the second end device, i.e., the proximity server. proximity service informs the first end device that the second end device is genuine,1407.

[0144] In another alternative, the proximity service server does not receive and forward an authentication signal. Instead, it receives a second discovery key from the second proximity service server and sends or forwards that second discovery key to the first end device, 1408. In doing so, the first end device can verify or authenticate the second end device.

[0145] In Figure 15 a method 1500 that is shown is executed by an end device (discoverer). The end device communicates with the proximity service server or the ProSe HPLMN function via the PC3 interface. The end device also communicates with a second (discovered) end device via the PC5 air interface.

[0146] In method 1500, the end device receives a ProSe query code and a first discovery key from a proximity service server, 1501. It then sends to a second end device a direct discovery request that includes a authentication signal based on the first discovery key, 1502. In the next step 1503, the end device receives from the second end device a discovery response comprising a ProSe response code and a second authentication signal, 1503.

[0147] Another embodiment of method 1600 will now be described with reference to Figure 16. This method is executed by an end device (discoverer) similar to execution method 1500.

[0148] In this method 1600, the end device receives a ProSe query code and a first discovery key from a proximity service server, 1601. It also receives a discovery filter based on the ProSe response code, 1602 The end device sends to a second end device (discovered UE) a direct discovery request comprising an authentication signal based on the first discovery key, 1603. In response, it receives from the second end device a discovery response that comprises a ProSe response code and a second authentication signal, 1604. The end device then identifies the ProSe response code received from the second end device using the discovery filter, 1605.

[0149] There are then two alternatives to this modality. In a first alternative, the end device forwards the second authentication signal to the proximity service server for verification, 1606. If successfully verified, the end device receives a message from its proximity service server indicating that the second end device is genuine, 1607. Although not shown in the drawing, verification of the authentication signal occurs on another proximity service server, that is, on the second (discovered) end device.

[0150] In the second alternative, the end device does not send or receive a match report, instead it receives a second discovery key from the proximity service server, and the end device verifies the second authentication signal using the second discovery key, thereby authenticating or verifying that the second end device is genuine, 1608.

[0151] For various embodiments of method 1600, it should be understood that the end device executing method 1600 may be a plurality of end devices such that the method further comprises each end device receiving the same code ProSe query key and the first discovery key, and sending a direct discovery request to the same second end device and receiving a direct discovery response from said second end device, 1609.

[0152] Embodiments of methods 800, 900, 1000, 1100, 1200, 1300, 1400, 1500 and 1600 benefit from all the advantages of the respective modalities described with reference to Figures 6 and 7.

[0153] The methods described above may be conducted on a server such as a proximity service server of an end device that may be a UE, or the end device itself. The methods may be performed upon receipt of suitable computer-readable instructions, which may be incorporated within a computer program running on the proximity service server or end device. Figures 17 and 18 illustrate an example of a proximity service server 1701 and an end device 1801 that can perform the methods of the present invention, for example, by receiving suitable instructions from a computer program. Referring to Figures 17 and 18, each of the proximity service server and the end device comprises a processor and a memory. The memory containing instructions executable by the processor, such that the proximity service server is operable to execute any of the embodiments of methods 800, 900, 1000, 1300 and 1400 and/or that the end device is operable to execute any of of embodiments of methods 1100, 1200, 1500 and 1600.

[0154] In Figure 19 an embodiment of a server 1901 is shown. The server 1901 may be a proximity service server or a ProSe function of an end device that acts as a discovery. The server comprises a PC6 1904 interface, in which it communicates with other proximity service servers or ProSe functions of end devices that act as discoverers. The server additionally comprises a PC3 interface 1905, in which it communicates with its end device (discovery) belonging to the same PLMN. The server 1901 comprises a processor 1902 and a memory 1903. The memory, containing instructions executable by the processor, such that the proximity service device is configured to generate a ProSe query code and a ProSe response code, sends at least a ProSe response code together with a first and a second discovery key to a first end device, and sends at least the first discovery key and the ProSe query code to a second end device so that the second end device can securely discover the first end device on an air interface.

[0155] Server 1901 may also be configured to generate the first discovery key and the second discovery key, or receive the first and second discovery key from a key management server.

[0156] In one embodiment, the server is configured to generate a discovery filter based on the ProSe Query code and send it to the first end device.

[0157] In one embodiment, the server 1901 is configured to receive a discovery request from the second end device indicating that said second end device wishes to discover the first end device via an air interface, the proximity service server sends subsequently the first discovery key and the ProSe query code for the second end device.

[0158] Server 1901 may also be configured to send the ProSe response code to a second proximity service server with which the second end device is in communication.

[0159] In one embodiment, the server 1901 is configured to receive from the second end device a match report request comprising the ProSe response code and an authentication signal based on the second discovery key. The server can be additionally configured to check the authentication signal using the second discovery key. If the authentication signal is verified, the server can be configured to send a match report response to the second end device, indicating that the first end device is genuine.

[0160] In an alternative embodiment, the server 1901 may be configured to send the second discovery key to the second end device, such that said second end device can verify that the first end device is genuine.

[0161] It should be understood that the server can be configured such that it sends the same ProSe query code and the same first discovery key to multiple second end devices belonging to a group. Every second end device can later send a direct discovery request to the same first (discovered) end device. Thus, the ProSe query code and the first discovery key are not specific to a particular second end device.

[0162] Figure 20 illustrates functional units in another embodiment of a proximity service server 2001 or ProSe function of a first (discovered) end device that can perform any of the methods 800, 900, 1000 described herein, e.g. according to computer-readable instructions received from a computer program. It should be understood that the units illustrated in Figure 20 are software-implemented functional units and can be run on any appropriate combination of software modules.

[0163] Referring to Figure 20, the proximity service server 2001 comprises a generation unit 2002 for generating a ProSe query code and a ProSe response code, a transmission unit 2003 for sending at least one ProSe response code together with a first and a second discovery key to a first end device, and to send at least the first discovery key and the ProSe query code to a second end device, such that said second end device can discover with security the first end device over an air interface.

[0164] The proximity service server 2001 also comprises a processor for running the software or units and a memory for storing the different units.

[0165] The generation unit 2002 may also comprise device for generating the first discovery key and the second discovery key. Alternatively, the transmission unit 2003 receives the first and second discovery keys from a key management server.

[0166] The generation unit 2002 may further comprise device for generating a discovery filter based on the ProSe query code and sending it to the first end device.

[0167] The transmission unit 2003 may comprise device for receiving a discovery request from the second end device indicating that the second end device wishes to discover the first end device via an air interface. It may also be to send the ProSe response code to a second proximity service server with which the second end device is in communication. The transmission unit 2003 may also comprise a device for receiving from the second end device a match report request comprising the ProSe response code and an authentication signal based on the second discovery key.

[0168] The proximity service server may further comprise a verification unit 2004 for verifying the authentication signal using the second discovery key. This is shown in dashed lines in Figure 20 to indicate that this unit is optional.

[0169] In an alternative embodiment, the proximity service server 2001 does not comprise a verification unit 2004. In this embodiment, the transmission unit 2003 comprises a device that sends the second discovery key to the second end device, such that that the second discovery key can verify the first end device. In this embodiment, the transmission unit does not receive a match report request or send a match report response.

[0170] The transmission unit 2003 described above may be for sending and receiving information, as described above, to a group of second end devices, such that the transmission unit sends the same ProSe query code and the first key of discovery for various elements of the group. You can also send the second discovery key to multiple members of the group.

[0171] In some examples, the transmission unit 2003, the verification unit 2004, and the generation unit 2002 may be implemented with the aid of a computer program that, when executed on a processor, causes the transmission unit to , the verification unit and the generation unit cooperate to execute examples of the method 800, 900, 1000 described above.

[0172] Figure 21 illustrates an end device 2101 that can act as an overdraft. The end device comprises a PC3 2102 interface to communicate with your ProSe function or proximity service server. The end device also comprises a PC5 2103 interface, with which it communicates with a second end device (discoverer). The end device 2101 further comprises a processor 2104 and a memory 2105. The memory containing instructions executable by the processor, such that the end device is configured to receive a first discovery key, a second discovery key, and a ProSe response code. from a proximity service server, receive a direct discovery request that includes a ProSe query code and an authentication token from a second end device that wants to discover the end device, and verify the authentication token using the first discovery key.

[0173] The end device may be further configured to receive from the proximity service server a discovery filter based on a ProSe query code, the discovery filter being used to identify the ProSe query code received from the second end device. The first end device may also be configured so that it receives the ProSe query code and authentication signal on an air interface, and the authentication signal is based on the first discovery key.

[0174] In one embodiment, the end device is configured to verify the authentication signal received from the second end device, the method further comprises sending to the second end device a discovery response comprising a second authentication signal based on the second discovery key. The end device may also be configured in such a way that, as a preliminary step, it sends to its proximity service server a discovery request in such a way as to request that the second end device can discover said end device.

[0175] Figure 22 illustrates functional units in another embodiment of an end device 2201 (uncovered) that can perform any of the methods 1100 and 1200 described herein, for example, in accordance with computer-readable instructions received from a program computer. It should be understood that the units illustrated in Figure 22 are software-implemented functional units and can be run on any appropriate combination of software modules.

[0176] Referring to Figure 22, the end device 2201 comprises a transmission unit 2202 for receiving a first discovery key, a second discovery key, and a ProSe response code from a proximity service server, and receiving a direct discovery request comprising a ProSe query code and an authentication signal from a second end device (discovering UE) that wants to discover the end device. The end device 2201 further comprises a verification unit 2203 for verifying the authentication signal using the first discovery key.

[0177] The transmission unit 2202 may further comprise a device for receiving from the proximity service server a discovery filter based on a ProSe query code, the discovery filter being used to identify the received ProSe query code. from the second end device. The end device may comprise an identification module (not shown) for using the discovery filter to identify the ProSe query code.

[0178] The transmission unit may also comprise a device for receiving the ProSe query code and the authentication signal via an air interface, the authentication signal being based on the first discovery key.

[0179] If the verification unit 2203 verifies the authentication signal received from the second end device, the transmission unit 2204 may further comprise a device for sending to the second end device a discovery response comprising a second authentication signal. based on the second discovery key.

[0180] It should also be understood that the transmission unit 2202 may further comprise a device for sending to its proximity service server a discovery request, such as to request that the second end device may discover said end device.

[0181] In some examples, the transmission unit 2202 and the verification unit 2203 may be implemented with the aid of a computer program that, when executed on a processor, causes the transmission unit and the verification unit to cooperate to perform examples of method 1100 and 1200 described above.

[0182] In Figure 23, an embodiment of another server 2301 is described. The server 2301 may be a proximity service server or a ProSe function of an end device that acts as a discoverer. The server 2301 comprises a PC6 interface 2302, in which it communicates with other proximity service servers or ProSe functions of end devices that act as a discovery. The server additionally comprises a PC3 interface 2303, in which it communicates with its end device (discoverer) belonging to the same PLMN. The server 2301 comprises a processor 2304 and a memory 2305. The memory 2305 contains processor-executable instructions such that the proximity service device is configured to receive from a second proximity service server at least a first discovery key, a ProSe query code, and a ProSe response code, generate a discovery filter based on the ProSe response code, and send the discovery filter, the first discovery key, and the ProSe query code to a first device terminal, so that said first end device (discovering UE) can securely discover a second end device (discovered UE) via an air interface.

[0183] Server 2301 may be further configured to receive from the first end device a match report request comprising an authentication signal based on a second discovery key, and forward the authentication signal to the second proximity server. for verification. If the second proximity server verifies the authentication signal, the server 2301 is further configured to receive a response from the second proximity service server indicating that the second end device is genuine.

[0184] In an alternative embodiment, the server 2301 may be configured to receive a second discovery key from the second proximity service server and send the second discovery key to the first end device.

[0185] Server 2301 may be configured to receive a discovery request from the first end device indicating that the first end device wishes to discover the second end device from the second proximity service server.

[0186] In yet another embodiment, server 2301 may be configured to send a discovery request to the second proximity service server, indicating that the first end device wishes to discover the second end device from the second proximity service server.

[0187] Figure 24 illustrates functional units in another embodiment of a proximity service server 2401 or ProSe function of an end device that acts as a discoverer. The proximity service server 2401 may perform any of the methods 1300 and 1400 described herein, for example, in accordance with computer-readable instructions received from a computer program. It should be understood that the units illustrated in Figure 24 are software-implemented functional units and can be run on any appropriate combination of software modules.

[0188] Referring to Figure 24, the proximity service server 2401 comprises a transmission unit 2402 for receiving from a second proximity service server at least a first discovery key, a ProSe query code, and a ProSe response code, and a generation unit 2403 for generating a discovery filter based on the ProSe response code. The transmission unit 2402 further comprises a device for sending the discovery filter, the first discovery key and the ProSe query code to a first end device, such that said first end device can securely discover a second device. end via an air interface.

[0189] The transmission unit 2403 may further comprise a device for receiving a match report request comprising an authentication signal based on a second discovery key, and forwarding the authentication signal to the second proximity server for verification. .

[0190] If the authentication signal is verified, the transmission unit 2402 further comprises a device for receiving a response from the second proximity service server, indicating that the second end device is genuine.

[0191] In another embodiment, the transmission unit comprises a device for receiving a second discovery key from the second proximity service server and sending the second discovery key to the first end device.

[0192] The transmission unit 2402 may further comprise a device for receiving a discovery request from the first end device indicating that the first end device wishes to discover the second end device from the second proximity service server. The transmission unit 2402 may also comprise a device for sending a discovery request to the second proximity service server indicating that the first end device wants to discover the second end device from the second proximity service server.

[0193] In some examples, the generation unit 2403 and the transmission unit 2402 may be implemented with the help of a computer program that, when executed on a processor, causes the transmission unit, the verification unit and the generating unit cooperate to perform the method examples 1300 and 1400 described above.

[0194] Figure 25 illustrates an end device 2501 that can act as a discoverer. The end device comprises a PC2 2502 interface for communicating with the proximity service server or the ProSe function. The end device 2501 also comprises a PC5 interface 2503, with which it communicates with a second (discovered) end device. End device 2501 further comprises a processor 2504 and memory 2505. The memory contains processor-executable instructions such that the end device is configured to receive a ProSe query code and a first discovery key from a server. proximity service, send a direct discovery request to a second end device comprising an authentication signal based on the first discovery key, and receive from the second end device a discovery response comprising a ProSe response code and a second authentication sign.

[0195] The end device 2501 may be further configured to receive from the proximity service server a discovery filter based on the ProSe response code.

[0196] In one embodiment, the end device 2501 is configured to identify the ProSe response code received from the second end device using the discovery filter.

[0197] End device 2501 may be further configured to forward the second authentication signal to the proximity service server for verification. If the second authentication signal is verified, the end device can be configured to receive a message from the proximity service server indicating that the second end device is genuine.

[0198] In one embodiment, the end device 2501 is configured to receive a second discovery key from the proximity service server, and the end device verifies the second authentication signal using the second discovery key, thereby authenticating the second end device.

[0199] In one embodiment, the end device 2501 may be configured to send to the proximity service server a discovery request indicating that the end device wants to discover the second device.

[0200] In another embodiment, multiple end devices 2501 may be configured to receive the same ProSe query code and first discovery key, and send to the same second end device a direct discovery request and receive a direct discovery response to from said same second final device.

[0201] Figure 26 illustrates functional units in another embodiment of an end device 2601 (discoverer) that can perform any of the methods 1500 and 1600 described herein, for example, according to computer-readable instructions received from a software program. computer. It should be understood that the units illustrated in Figure 26 are software-implemented functional units and can be run on any appropriate combination of software modules.

[0202] Referring to Figure 26, end device 2601 comprises a transmission unit 2602 for receiving a ProSe query code and a first discovery key from a proximity service server, sending to a second end device a request direct discovery device comprising an authentication signal based on the first discovery key, and receiving from the second end device a discovery response comprising a ProSe response code and a second authentication signal.

[0203] The transmission unit 2602 may further comprise a device for receiving from the proximity service server a discovery filter based on the ProSe response code.

[0204] The end device may further comprise an identification unit 2603 for identifying the ProSe response code received from the second end device using the discovery filter. This optional feature is indicated by the dashed lines in Figure 26.

[0205] The transmission unit 2602 may further comprise a device for forwarding the second authentication signal to the proximity service server for verification. If the second authentication signal is verified, the transmission unit may further comprise a device for receiving from the proximity service server a message indicating that the second end device is genuine.

[0206] In one embodiment, the transmission unit 2602 further comprises a device for receiving a second discovery key from the proximity service server, and the end device further comprises a verification unit 2604 for verifying the second authentication signal using the second discovery key thus authenticating the second end device. The 2604 verification unit is optional as indicated by the dashed lines in Figure 26.

[0207] The transmission unit 2602 may further comprise a device for sending to the proximity service server a discovery request indicating that the end device wishes to discover the second device.

[0208] In one embodiment, there are a plurality of end devices 2601, and each end device comprises a transmission unit for receiving the same ProSe query code and the first discovery key, sending to the same second end device a discovery request. direct discovery response and receive a direct discovery response from the same second end device.

[0209] In some examples, the transmission unit 2602, the identification unit 2603 and the verification unit 2604 may be implemented with the aid of a computer program that, when executed on a processor, causes the transmission unit , the verification unit and the identification unit cooperate to perform the method examples 1500 and 1600 described above.

[0210] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without abandoning the scope of the appended claims. The word “comprising” does not exclude the presence of elements or steps other than those listed in a claim, “one” or “an” does not exclude a plurality, and a single feature or other unit may fulfill the functions of several units cited in the claims. Any sign of reference in the claims should not be construed as limiting their scope.

Claims (10)

1. Method executed by a proximity services server (752, 1901), on a Home Public Land Mobile Network, HPLMN, of a User Equipment, UE, Discovered (751), characterized by the fact that it comprises: generating (702 ) a ProSe query code and a ProSe response code; sending (703) at least the ProSe response code together with a first and a second discovery key to the Discovered UE (751); and sending (706) the first discovery key, the second discovery key and the ProSe query code to the Discoverer UE (753) via a second proximity service server (754) in an HPLMN of the Discoverer UE (753 ), so that the Discovering UE (753) can verify that the Discovered UE (751) is genuine. 2. Method according to claim 1, characterized by the fact that it further comprises, as a preliminary step, generating the first discovery key and the second discovery key. 3. The method of claim 1, further comprising, as a preliminary step, receiving the first and second discovery keys from a key management server. 4. Method according to any one of claims 1 to 3, characterized by the fact that it further comprises generating a discovery filter based on the ProSe query code and sending it to the Discovered UE (751). 5. Method according to any one of claims 1 to 4, characterized by the fact that it further comprises receiving a discovery request through the second proximity service server from the Discoverer UE (753) indicating that the Discoverer UE (753 ) wishes to discover the Discovered UE (751) via an air interface, the proximity service server (1901) subsequently performs said sending (706) of the first discovery key, the second discovery key and the ProSe query code to the Discoverer UE (753) through the second proximity service server. 6. Proximity service server (1901) characterized by the fact that it comprises a processor (1902) and a memory (1903), the memory (1903) containing instructions executable by the processor (1902), such that the service server proximity sensor (1901) is operable to perform a method as defined in any one of claims 1 to 5. 7. Method executed by a proximity service server (754, 2301), in an HPLMN of a Discoverer UE (753), the method characterized by the fact that it comprises: receiving, from a proximity service server (1901 ) in an HPLMN of a Discovered UE (751) a first discovery key, a second discovery key, a ProSe query code and a ProSe response code; generate a discovery filter based on the ProSe response code and send (707) the discovery filter, the first discovery key, the second discovery key and the ProSe query code to the Discoverer UE (753). 8. The method of claim 7, further comprising, as a preliminary step, the proximity service server (2301) in the HPLMN of the Discoverer UE (753) receiving a discovery request from the UE Discoverer (753) indicating that the Discoverer UE (753) wants to discover the Discovered UE (751); and sending a discovery request to the proximity service server (752, 1901) in the HPLMN of the Discovered UE (751) indicating that the Discoverer UE (753) wants to discover the Discovered UE (751). 9. Proximity service server (2301) characterized by the fact that it comprises a processor (2304) and a memory (2305), the memory (2305) containing instructions executable by the processor (2304), such that the service server proximity sensor (2301) is operable to perform a method as defined in claim 7 or 8. 10. Computer readable memory containing instructions that, when executed on a proximity service server, execute the method as defined in any one of claims 1 to 5 or the method as defined in claim 7 or 8.