WO2015105401A1 - Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile - Google Patents

Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile Download PDF

Info

Publication number
WO2015105401A1
WO2015105401A1 PCT/KR2015/000354 KR2015000354W WO2015105401A1 WO 2015105401 A1 WO2015105401 A1 WO 2015105401A1 KR 2015000354 W KR2015000354 W KR 2015000354W WO 2015105401 A1 WO2015105401 A1 WO 2015105401A1
Authority
WO
WIPO (PCT)
Prior art keywords
prose
terminal
group
key
communication
Prior art date
Application number
PCT/KR2015/000354
Other languages
English (en)
Korean (ko)
Inventor
서경주
Original Assignee
삼성전자 주식회사
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from KR1020140055885A external-priority patent/KR102088848B1/ko
Application filed by 삼성전자 주식회사 filed Critical 삼성전자 주식회사
Priority to US15/111,471 priority Critical patent/US10382955B2/en
Priority to EP15735197.4A priority patent/EP3096544B1/fr
Publication of WO2015105401A1 publication Critical patent/WO2015105401A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Definitions

  • the present invention relates to a system that enables a communication function to be performed on a device. Specifically, proximity based services (Prose), Prose discovery, Prose communication, Device to Device (D2D), especially public safety (P2) in a mobile communication network. It relates to communication for.
  • the present invention relates to an inter-device communication for public safety, or a device-to-device discovery for a group communication between devices, and a related security method for group communication between devices.
  • Proximity based services are particularly useful in situations where disaster relief by existing infrastructure communications is difficult, especially in disaster situations such as earthquakes, tsunamis and tornadoes. Proximity services are expected to play the role of public safety to communicate disasters through group communication between devices.
  • the present invention provides a method for enabling group communication between devices in an evolved mobile communication system including a 3rd Generation Partnership Project (3GPP) Evolved Packet System (EPS) and a method for setting and managing security in group communication between devices. .
  • 3GPP 3rd Generation Partnership Project
  • EPS Evolved Packet System
  • a device for performing group communication between devices acquires information for performing group communication between devices, obtains a security key for performing group communication between devices, and performs group communication between devices. It aims to set up security for secure communication.
  • an object of providing a proximity based service that is, prose discovery, prose communication (prose communication) do.
  • an object of the UE UE is to provide a method for obtaining the relevant information to enable group communication, and the security configuration is possible.
  • Another object of the present invention is to provide a method and system for enabling group communication, public safety communication, and the like to be performed safely and securely.
  • an object of the present invention is to enable secure communication.
  • a communication method of a terminal may include at least one of a public safety indication and a group communication indication to a mobility management entity (MME). Transmitting an attach request message including one; A prose identifier, a prose group identifier, a prose group key, a prose-related capability of the terminal and a proxy-related security key for a proximity based service (Prose) from the MME. Receiving an attach accept message including at least one of information; transmitting a prose registration request message to a prose function server; And receiving a prose registration response message according to authentication of the terminal from the prose function server.
  • MME mobility management entity
  • the method may further include: transmitting a paging message including at least one of a public safety indication and a group communication indication to the second terminal; Transmitting a prose group communication request message including prose group related information to a second terminal; Receiving a prose group communication response message from the second terminal when the second terminal verifies that the terminal belongs to the prose group by using the prose group related information; Verifying whether the second terminal belongs to the prose group; And performing prose group communication with the second terminal.
  • the prose group communication with the second terminal may include: transmitting a prose group session key request message to the prose function server; Receiving a prose session key encrypted with the prose group key from the prose function server; Transmitting a prose group encryption key or integrity key request message to the prose function server; And receiving a prose group encryption key or an integrity key encrypted with the prose session key from the prose function server.
  • the transmitting of the attach request message may include transmitting a attach request message further including a secret value for verifying whether the terminal is an appropriate terminal for group communication. It may include;
  • verifying whether the second terminal belongs to the prose group comprises: transmitting a verification request message regarding whether the second terminal belongs to the prose group to the prose function server; ; And receiving a verification response message indicating whether the second terminal belongs to the prose group from the prose function server.
  • the method may further include transmitting a prose registration complete message including the prose group key to the prose function server.
  • verifying whether the second terminal belongs to the prose group further comprises: transmitting a message indicating that the verification that the second terminal belongs to the prose group is successful to the second terminal; can do.
  • the terminal for communicating with the entity; And send an attach request message including at least one of a public safety indication and a group communication indication to a Mobility Management Entity (MME) and proxy from the MME.
  • MME Mobility Management Entity
  • At least one of a prose identifier, a prose group identifier, a prose group key, a prose-related capability of the terminal and a proxy-related security key for a proximity based service Receive an attach accept message including the information of the information, transmit a prose registration request message to the prose function server (prose function server), the prose according to the authentication of the terminal from the prose function server It may include a control unit for controlling to receive a registration registration (prose registration response) message.
  • the communication method of the proximity based service (prose) function server (prose function server) according to an embodiment of the present invention to achieve the above object, the prose registration procedure for prose group communication with the terminal; Performing; Receiving a prose group session key request message from the terminal; Generating the prose group session key; transmitting a prose session key encrypted with a prose group key to the terminal; Receiving a prose group encryption key or integrity key request message from the terminal; Generating the prose group encryption key or integrity key; And transmitting the prose group encryption key or the integrity key encrypted with the prose group body key to the terminal.
  • the prose registration procedure for prose group communication with the terminal Performing; Receiving a prose group session key request message from the terminal; Generating the prose group session key; transmitting a prose session key encrypted with a prose group key to the terminal; Receiving a prose group encryption key or integrity key request message from the terminal; Generating the prose group encryption key or integrity key; And transmitting the pros
  • the method may further include receiving a verification request message indicating whether a second terminal belongs to a prose group from the terminal; Verifying a prose group communication list associated with the terminal whether the second terminal belongs to the prose group; And transmitting a verification response message including the response information about the verification to the terminal.
  • the verifying may include generating a prose group key and storing the prose group key.
  • a proximity based service (Prose) function server for communicating with the entities; Perform a prose registration procedure for prose group communication with the terminal, receive a prose group session key request message from the terminal, generate the prose group session key, and generate a prose session key encrypted with the prose group key; A prose transmitted to the terminal, receiving a prose group encryption key or integrity key request message from the terminal, generating the prose group encryption key or integrity key, and encrypting the prose group body key And a control unit controlling to transmit a group encryption key or an integrity key to the terminal.
  • Prose proximity based service
  • a device performing communication performs a communication security method for public safety using prose discovery, prose communication group communication, and prose communication. can do.
  • devices are connected to each other in a group under an environment such as Evolved Universal Terrestrial Radio Access Network (EUTRAN) or Universal Terrestrial Radio Access Network (UTRAN) / GSM / EDGE Radio Access Network (GERAN).
  • EUTRAN Evolved Universal Terrestrial Radio Access Network
  • UTRAN Universal Terrestrial Radio Access Network
  • GERAN EDGE Radio Access Network
  • Information may be provided or provided.
  • the device may receive security key related information for prose discovery and prose communication, or perform a security procedure using the security key, thereby enhancing efficiency and security of communication.
  • the UE when the UE (UE) discovers another terminal and performs group communication, when the terminal cannot query the group related information, the group related information and the group security information are generated. By verifying this, and receiving and verifying security related information between groups, secure communication can be performed.
  • FIG. 1 is a block diagram of a mobile communication system according to an embodiment of the present invention.
  • FIG. 2 is an example of a flowchart illustrating a communication and security procedure for securing prose communication group communication according to an embodiment of the present invention.
  • FIG. 3 is another example of a flowchart illustrating a communication and security procedure for securing prose communication group communication according to an embodiment of the present invention.
  • FIG. 4 is a block diagram of a terminal according to an embodiment of the present invention.
  • FIG. 5 is a block diagram of a prose function server according to an embodiment of the present invention.
  • FIG. 6 is a block diagram of an HSS according to an embodiment of the present invention.
  • FIG. 7 is a block diagram of an MME according to an embodiment of the present invention.
  • the present invention to be described later, in the process of enabling various devices described above to operate as a terminal (UE) in a mobile communication system environment to enable communication, discovering each other between the devices (discovery), and group communication with each other In order to perform communication, it is to provide a method of transmitting related information, performing security procedures, and enabling secure communication.
  • EPS Evolved Packet System
  • 3GPP 3rd Generation Partnership Project
  • UTRAN Universal Terrestrial Radio Access Network
  • GERAN GSM / EDGE Radio Access Network
  • the present invention may be used in other mobile systems.
  • the terminal receives the related information, and receives the security related information, and performs the security procedure, of course, various modifications are possible without departing from the scope of the present invention.
  • an embodiment of the present invention transmits related information when various devices including a communication terminal, which is a basic object of the present invention, attempt to perform group communication between devices in an EUTRAN or 3GPP environment, and a security procedure. And management methods to enable secure communication.
  • a communication terminal which is a basic object of the present invention
  • management methods to enable secure communication.
  • Such a method may be used within the scope of the present invention without departing from the scope of the present invention even in a similar technical background and channel form, network architecture or similar protocol, or other mobile communication systems having different but similar protocols. It is applicable to the modification of the, which will be possible in the judgment of a person skilled in the art of the present invention.
  • FIG. 1 is a block diagram of a mobile communication system according to an embodiment of the present invention.
  • devices 111 and 131 may include various devices such as a user equipment (UE), a device performing machine type communication (UE), and a consumer device. May be included.
  • UE user equipment
  • UE device performing machine type communication
  • consumer device a consumer device. May be included.
  • FIG. 1 illustrates an example of an environment in which the first terminal 111 and the second terminal 131 are applicable to prose discovery and prose group communication.
  • the first terminal 111 may perform general EUTRAN communication through an evolved Node B (eNB) 114, a Mobility Management Entity (MME) 116, or the like.
  • the first terminal 111 may perform data communication through a serving gateway (S-GW), a packet data network gateway (PDN-GW) 119, or the like. Can be.
  • eNB evolved Node B
  • MME Mobility Management Entity
  • S-GW serving gateway
  • PDN-GW packet data network gateway
  • the mobile communication system further includes a prose function server (prose function server) 127 performing a prose related function in order to perform a Proximity based service (Prose) function.
  • the prose function server 127 verifies prose related registration, delivery of related information, and prose related capability of the terminal, and performs prose related functions.
  • the application server function of Prose is performed through the prose application server 125.
  • the prose application server 125 interoperates with a policy and charging rules function (PCRF) 123-1 in order to perform such a prose application function. Will perform.
  • PCRF policy and charging rules function
  • the device or terminal 111, 131
  • eNB 114 eNB 114
  • MME 116 prose function server 127
  • HSS 121 HSS 121
  • application server ( 125) authentication security and communication setup processes and operations that enable proximity based services (prose), prose discovery, prose communication, group communication, and the like. Let's take a look at how to help.
  • FIG. 2 is an example of a flowchart illustrating a communication and security procedure for securing prose communication group communication according to an embodiment of the present invention.
  • the embodiment shown in FIG. 2 shows a case of performing group prose discovery and prose communication.
  • the first terminal 111 may transmit an attach request message to the eNB 114 to perform a registration procedure.
  • the eNB 114 may transmit an attach request message transmitted by the first terminal 111 to the MME 116.
  • a public safety indication indicating communication for public safety may be included in the attach request message.
  • a group communication indication indicating a group communication may be included in the attach request message and transmitted.
  • the attach request message if the first terminal 111 is connected to the network for the first time for public safety or group communication, it is verified that the first terminal 111 is a terminal suitable for public safety or group communication. You must connect with a secure value for. This secret value should be a value that can be verified on the network for group communication or public safety communication.
  • the MME 116 may transmit an authentication data request message to the HSS 121.
  • the HSS 121 may transmit a response message including security related information including an authentication vector to the MME 116.
  • the MME 116 transmits a user authentication request message including an authentication token (AUTN) to the first terminal 111, and the first terminal 111 sends a user authentication response to the MME 116.
  • a RES response security value
  • a (User authentication response) message can be sent along with a (User authentication response) message.
  • the MME 116 may transmit an update location request message to the HSS 121.
  • the MME 116 may include a public safety indication in an update location request message and transmit it to the HSS 121.
  • the MME 116 may include a group communication indication in an update location request message and transmit it to the HSS 121.
  • the first terminal 111 accesses the network for the first time, the first terminal 111 should be verified in the network that the terminal is suitable for public safety or group communication. You must connect with).
  • This secret value should be a value that can be verified on the network for group communication or public safety communication.
  • the HSS 121 inquires information such as identifier information (ID), group key (group key) for group communication with respect to the first terminal 111.
  • ID identifier information
  • group key group key
  • the HSS 121 is a secret value sent by the first terminal 111 in step 311, and the first terminal 111 is suitable for group communication or public safety communication. It is verified whether the terminal.
  • a group identifier is assigned to the first terminal 111, and a group key is generated or assigned.
  • the group identifier includes any one of country information, area information, and communication network (network information in the carrier network and the provider network).
  • the group identifier may be used for public safety if it is for public safety. For example, it may include information such as firefighting, security, earthquake, typhoon, tsunami and tornado.
  • the HSS 121 transmits subscription data to the MME 116.
  • the HSS 121 is a prose identifier for providing a prose service to the MME 116, a Prose group identity, a Prose group key, a prose related capability of the terminal, If there is a registered prose identifier and security key, information such as a proxy key related to proximity and a prose Public Land Mobile Network (PLMN) list can be delivered together.
  • Proximity related security key is a security key for proximity discovery or proximity communication. If there is already registered information, the registered information is searched for and informed. Do it.
  • the MME 116 may transmit an attach accept message to the eNB 114.
  • the attach accept message is transmitted from the eNB 114 to the first terminal 111.
  • the MME 116 in step 317, the prose identifier for the prose service delivered from the HSS 121, the prose-related capacity of the terminal, the security-related security key, and the prose group.
  • Information such as a key group, a prose group identity, and a prose PLMN list may also be transmitted to the first terminal 111 along with an attach accept message.
  • the MME 116 in relation to steps 301, 303, 305, 307, 309, 311, 313, 317, and 319, the MME 116 is an intermediate entity, and the ProSe public indication, secrete value. And the like, and appeared as an intermediate node to verify in the HSS 121.
  • the intermediate node may be involved in the intermediate process, not the MME 116, but in the intermediate function, passing the parameters and verifying the HSS 121. That is, in step 301, 303, 305, 307, 309, 311, 313, 317, and 319, an entity that is involved in passing such a parameter may be a prose function 127.
  • At least one parameter such as a secret value for public safety and a public safety indication may be delivered from the UE through the Prose function 127. Then, the HSS 121 is verified using the transferred parameters through the steps 309, 311, and 313. On the other hand, if the prose function 127 becomes an entity of the intermediate process, according to the embodiment, the Prose Group ID, Prose Group Key, Prose key, Prose ID, etc. are passed from the HHS 121 to the Prose function 127 in steps 317 and 319. It may be delivered to the UE.
  • the first terminal 111 may transmit a prose registration request message to the prose function 127.
  • the second terminal 131 may perform a prose registration request process like the first terminal 111. Since the process is described with the first terminal 111, it is assumed that the second terminal 131 is basically subjected to the same registration process as the first terminal 111.
  • the prose function 127 may transmit a prose registration request message to the HSS 121 in step 325, and then the HSS 121 may transmit a prose authentication vector to the prose function 127.
  • the prose authentication vector includes a cipher key (CK) and an integrity key (IK) and transmitted to the prose function 127.
  • step 327 the prose authentication token is transmitted from the prose function 127 to the first terminal 111 through a pse authentication request message.
  • the prose function ID may be delivered to the HSS 121 in the prose function 127 in step 325.
  • the HSS 121 may transmit at least one parameter such as a prose group key, a prose key, and a prose authentication token while delivering a prose authentication vector and an authentication token to the Prose function 127.
  • At least one parameter of the received prose group key, prose key, prose authentication token, etc. may be delivered to the UE in the Prose function 127 in step 327.
  • a prose authentication response message including a response value for the authentication token transmitted from the prose function 127 to the first terminal 111 is registered by the first terminal 111. 127).
  • the prose function 127 may verify the result by comparing RES and XRES information.
  • the prose function 127 may transmit a prose registration response message to the first terminal 111.
  • the subsequent process will be described with respect to a process in which the terminal performs prose group communication using a prose key or a prose identifier, a prose group key, and a prose group ID.
  • the first terminal 111 when the first terminal 111 wants to verify the request message sent for the prose group communication through the group key, the first terminal 111 performs the prose function 127 as in step 343. ) May be transmitted including the prose group key of the first terminal 111 in a prose registration complete message. In response, the prose function 127 may register the group key of the first terminal 111 using the received information.
  • the prose function 127 may include a prose key to the application server 125 and information related to the registration of the prose service in the process of registering the terminal to the prose function 127 and the prose group key. At least one may be delivered. Thereafter, in operation 343-5, the application server 125 may store at least one of information such as a prose key and a prose group key. Thereafter, in step 343-7, the first terminal 111 and the application server 125 communicate using a prose key, a prose identifier, a Prose Group ID, a Prose Group key, and the like.
  • the first terminal 111 may send a paging message to the second terminal 131.
  • the paging message may include a group communication indicator for prose group communication in the terminal, or a public safety communication indication for instructing communication for public safety.
  • the first terminal 111 notifies the second terminal 131 that it wants to communicate with the prose group, and may request for prose communication.
  • the request method may be performed through a method of using broadcast, broadcast IP, multicast, multicast IP, and the like.
  • the prose group ID can be used to inform the destination.
  • step 349 the group related information of the first terminal 111 is transmitted together with a case 1) time stamp or case 2) nonce, or case 3) time stamp or nonce, in order to prevent a replay attack. Can also be concatenated and sent.
  • case 4) time stamp may also be time information of an application layer, and case 5) time information value used in a physical layer, that is, physical information used in a physical layer. Counter information, or time information used in system information block (SIB) 16 used in case 6) layer 2 may be used.
  • SIB system information block
  • the time information value obtained from the physical layer may be transmitted through SIB of layer 2 as in case 6), and the information of case 5) and case 6) may be physically delayed. There may be a small advantage.
  • case 7) such information may be transmitted through a one time hash function.
  • Case 8) A message authentication code (MAC) may be obtained using a group key, which is a key shared between the sender and the receiver. It can generate and authenticate whether it is from the right sender.
  • MAC message authentication code
  • step 351 the second terminal 131 verifies whether the first terminal 111 belongs to the Prose Group by decrypting (decrypting) the group related information, time stamp, and nonce transmitted in step 349 with the prose group key. Can be performed.
  • the second terminal 131 may transmit a group communication response message to the first terminal 111.
  • a group communication response message may be performed including a process of group join.
  • this step may not be performed if step 349 is made by a broadcast method.
  • the terminal 111 may perform case 1) verifying whether the second terminal 131 also belongs to the group in the first terminal 111.
  • case 2) the first terminal 111 may request the network to verify whether the second terminal 131 belongs to a group, and may perform a process of receiving a verification result.
  • the embodiment shown in FIG. 2 relates to an embodiment for verifying whether the second terminal 131 belongs to a group in the first terminal 111 according to case 1).
  • case 1) for verifying at the terminal level for group communication in operation 355, the first terminal 111 may perform verification whether the second terminal 131 belongs to a Prose group. In operation 357, the first terminal 111 may send a message including information indicating that the second terminal 131 joins the group to the second terminal 131. Alternatively, in another embodiment, the second terminal 131 verifies that the second terminal 131 belongs to the prose group in the first terminal 111, and thus the second terminal 131 sends a message indicating that the verification was successful. Can be sent to.
  • the purpose is to inform that the terminal is successful in joining the multicast (multicast group) This may be an optional process that is not performed.
  • the second terminal 131 may send a prose group communication request complete message to the first terminal 111.
  • the first terminal 111 transmits a session group request session message for the Prose group communication to the Prose function 127.
  • step 383 the Prose function 127 generates a prose group communication session key.
  • the prose function 127 may encrypt the prose group session key with the prose group key and transmit the encrypted message to the first terminal 111.
  • the first terminal 111 decrypts the prose group session key.
  • the first terminal 111 transmits a message requesting a security key to the prose function 127, for example, a prose group encryption and an integrity key request message.
  • a message requesting a security key to the prose function 127, for example, a prose group encryption and an integrity key request message.
  • the prose function 127 generates a prose group communication integrity key and a prose group communication encryption key.
  • the prose function 127 may encrypt the prose group communication encryption key or the prose group communication integrity key with the prose group session key and transmit the encrypted message to the first terminal 111.
  • the first terminal 111 decodes the prose group communication encryption key or the prose group communication integrity key into the prose group session key.
  • terminals belonging to the Prose Group such as the first terminal 111 and the second terminal 131 may safely perform the Prose Group communication.
  • 3 is another example of a flowchart illustrating a communication and security procedure for securing prose communication group communication according to an embodiment of the present invention. 3 illustrates a case of performing group prose discovery and prose communication.
  • the first terminal 111 may transmit an attach request message to the eNB 114 to perform a registration procedure.
  • the eNB 114 may transmit an attach request message transmitted by the first terminal 111 to the MME 116.
  • a public safety indication indicating communication for public safety may be included in the attach request message.
  • a group communication indication indicating a group communication may be included in the attach request message and transmitted.
  • the attach request message if the first terminal 111 is connected to the network for the first time for public safety or group communication, it is verified that the first terminal 111 is a terminal suitable for public safety or group communication. You must connect with a secure value for. This secret value should be a value that can be verified on the network for group communication or public safety communication.
  • the MME 116 may transmit an authentication data request message to the HSS 121.
  • the HSS 121 may transmit a response message including security related information including an authentication vector to the MME 116.
  • the MME 116 transmits a user authentication request message including an authentication token (AUTN) to the first terminal 111, and the first terminal 111 sends a user authentication response to the MME 116.
  • a RES response security value
  • RES Response security value
  • the MME 116 may transmit an update location request message to the HSS 121.
  • the MME 116 may include a public safety indication in an update location request message and send it to the HSS 121.
  • the MME 116 may include a group communication indication in an update location request message to the HSS 121.
  • the first terminal 111 accesses the network for the first time, the first terminal 111 should be verified in the network that the terminal is suitable for public safety or group communication. You must connect with).
  • This secret value should be a value that can be verified on the network for group communication or public safety communication.
  • the HSS 121 inquires information such as identifier information (ID) and group key for group communication with respect to the corresponding first terminal 111.
  • ID identifier information
  • group key for group communication with respect to the corresponding first terminal 111.
  • the HSS 121 is a secret value sent by the first terminal 111 in step 411 and the first terminal 111 is suitable for group communication or public safety communication. It is verified whether the terminal.
  • a group identifier is assigned to the first terminal 111 and a group key is generated or assigned.
  • the group identifier includes any one of country information, area information, and communication network (network information in the carrier network and the provider network).
  • the group identifier may be used for public safety if it is for public safety. For example, it may include information such as firefighting, security, earthquake, typhoon, tsunami and tornado.
  • the HSS 121 transmits subscription data to the MME 116.
  • the HSS 121 is a prose identifier for providing a prose service to the MME 116, a Prose group identity, a Prose group key, a prose related capability of the terminal, If there is a registered prose identifier and security key, information such as a proxy key related to proximity and a prose Public Land Mobile Network (PLMN) list can be delivered together.
  • Proximity related security key is a security key for proximity discovery or proximity communication. If there is already registered information, the registered information is searched for and informed. Do it.
  • the MME 116 may transmit an attach accept message to the eNB 114.
  • the attach accept message is transmitted from the eNB 114 to the first terminal 111.
  • the MME 116 transmits a prose identifier for providing a prose service delivered from the HSS 121 in step 417, a prose-related capability of the terminal, a security key related to a proximity, and a prose group.
  • Information such as a key group, a prose group identity, and a prose PLMN list may also be transmitted to the first terminal 111 along with an attach accept message.
  • the MME 116 in connection with steps 401, 403, 405, 407, 409, 411, 413, 417, and 419, delivers ProSe public indication, secrete value, etc. with respect to ProSe as an intermediate entity. , Which appeared as an intermediate node to verify in the HSS 121.
  • the intermediate node is not MME 116, but the Prose function 127 may be involved in the intermediate process, passing these parameters and involved in verifying in the HSS 121. That is, in step 401, 403, 405, 407, 409, 411, 413, 417, 419, the entity involved in passing these parameters may be the prose function 127.
  • At least one parameter such as a secret value or public safety indication for public safety may be delivered from the UE through the Prose function 127. Then, the HSS 121 is verified using the transferred parameters through 409, 411, and 413 steps. On the other hand, if the prose function 127 becomes an entity in the middle process, according to the embodiment, the Prose Group ID, Prose Group Key, Prose key, Prose ID, etc. are passed from the HHS 121 to the Prose function 127 in steps 417 and 419. It may be delivered to the UE.
  • the first terminal 111 may transmit a prose registration request message to the prose function 127.
  • the second terminal 131 may also perform a prose registration request process like the first terminal 111. Since the process is described with the first terminal 111, it is assumed that the second terminal 131 is basically subjected to the same registration process as the first terminal 111.
  • the prose function 127 may transmit a prose registration request message to the HSS 121, and then the HSS 121 may transmit a prose authentication vector to the prose function 127.
  • the prose authentication vector includes a cipher key (CK) and an integrity key (IK) and transmitted to the prose function 127.
  • the prose function 127 may transmit the prose authentication token to the first terminal 111 in a prose authentication request message.
  • the prose function ID may be delivered to the HSS 121 in the prose function 127 in step 425.
  • the HSS 121 may transmit at least one parameter such as a prose group key, a prose key, and a prose authentication token while delivering a prose authentication vector and an authentication token to the Prose function 127.
  • At least one of the parameters such as the prose group key, the prose key, and the prose authentication token may be delivered to the UE in the Prose function 127 in step 427.
  • step 429 a prose authentication response message including a response value for the authentication token transmitted from the prose function 127 to the first terminal 111 is registered in the prose function 127. 127).
  • the prose function 127 may verify the result by comparing the RES with the XRES information.
  • the prose function 127 may transmit a prose registration response message to the first terminal 111.
  • the subsequent process will be described with respect to a process in which the terminal performs prose group communication using a prose key or a prose identifier, a prose group key, and a prose group ID.
  • the first terminal 111 when the first terminal 111 wants to verify the request message sent for the prose group communication through the group key, the first terminal 111 performs the prose function 127 as in step 443. ) May be transmitted including the prose group key of the first terminal 111 in a prose registration complete message. In response, the prose function 127 may register the group key of the first terminal 111 using the received information.
  • the prose function 127 registers at least one of a prose key and a prose group key to the application server 125, and the prose function 127 registers for the prose service in the process of registering the terminal in the prose function 127.
  • the application server 125 may store at least one of information such as a prose key and a prose group key.
  • the first terminal 111 and the application server 125 communicate using at least one of a prose key, a prose identifier, a prose group ID, and a prose group key.
  • the first terminal 111 may send a paging message to the second terminal 131.
  • the paging message may include a group communication indicator for prose group communication in the terminal, or a public safety communication indication for instructing communication for public safety.
  • the first terminal 111 notifies the second terminal 131 that it wants to communicate with the prose group, and may request for prose communication.
  • a request method may be performed through a method using broadcast, broadcast IP, multicast, multicast IP, and the like.
  • the prose group ID can be used to inform the destination.
  • step 449 the group related information of the first terminal 111 is transmitted together with a case 1) time stamp or case 2) nonce, or case 3) time stamp or nonce, in order to prevent a replay attack.
  • case 4) time stamp may also be time information of an application layer
  • case 5) time information value used in a physical layer that is, physical information used in a physical layer.
  • Counter information, or time information used in system information block (SIB) 16 used in case 6) layer 2 may be used.
  • SIB system information block
  • the time information value obtained from the physical layer may be transmitted through SIB of layer 2 as in case 6), and the information of case 5) and case 6) may be physically delayed. There may be a small advantage.
  • case 7) such information may be transmitted through a one time hash function
  • case 8) a message authentication code (MAC) may be obtained using a group key, which is a key shared between the sender and the receiver. It can generate and authenticate whether it is from the right sender.
  • MAC message authentication code
  • step 451 the second terminal 131 verifies whether the first terminal 111 belongs to the Prose Group by decrypting (decrypting) the group related information, time stamp, nonce, etc. transmitted in step 449 with the prose group key. Can be performed.
  • the second terminal 131 may transmit a group communication response message to the first terminal 111.
  • a group communication response message may be performed including a process of group join.
  • this step may not be performed if step 449 is made by a broadcast method.
  • the first terminal 111 may perform case 1) verifying whether the second terminal 131 also belongs to the group in the first terminal 111.
  • case 2) the first terminal 111 may request the network to verify whether the second terminal 131 belongs to a group, and perform a process of receiving a verification result.
  • the second terminal in steps 459 to 467 may be used. Verification is made as to whether 131 belongs to the group.
  • the first terminal 111 may transmit a verification request message including information for requesting verification whether the second terminal 131 belongs to the group to the prose function 127.
  • the case 2-1) prose function 127 may determine whether the second terminal 131 belongs to a prose group or a prose group communication list related to the first terminal 111. ) Can be verified.
  • the prose group communication list is a list of terminals in the prose group capable of prose communication with the first terminal 111.
  • Prose function 127 may generate a prose group key and store the prose group key.
  • the prose function 127 may send a verification response message including the response information about the verification to the first terminal 111.
  • the prose function 127 may simply send the first terminal 111 only whether verification is successful.
  • the first terminal 111 transmits a verification response message or a group join response message to the second terminal 131 based on a result of verifying the prose group communication request response of the second terminal 131.
  • This message may be a verification response to whether the second terminal 131 belongs to a prose group or a response message to a prose group join.
  • the second terminal 131 may send a prose group communication request complete message to the first terminal 111.
  • step 481 the first terminal 111 transmits a session group request session message for the Prose group communication to the Prose function 127.
  • step 483 the Prose function 127 generates a prose group communication session key.
  • the prose function 127 may encrypt the prose group session key with the prose group key and transmit the encrypted message to the first terminal 111.
  • the first terminal 111 decrypts the prose group session key.
  • the first terminal 111 transmits a message requesting a security key to the prose function 127, for example, a prose group encryption key and an integrity key request message. Can be.
  • the prose function 127 generates a prose group communication integrity key and a prose group communication encryption key.
  • the prose function 127 may encrypt the prose group communication encryption key or the prose group communication integrity key with the prose group session key and transmit the encrypted message to the first terminal 111.
  • the first terminal 111 decodes the prose group communication encryption key or the prose group communication integrity key into the prose group session key.
  • terminals belonging to the Prose Group such as the first terminal 111 and the second terminal 131 may safely perform the Prose Group communication.
  • FIG. 4 is a block diagram of a terminal according to an embodiment of the present invention.
  • the terminal 500 may include a communication unit 510 and a control unit 520.
  • the controller 520 of the terminal 500 controls the terminal to perform any one of the above-described embodiments.
  • the controller 520 transmits an attach request message including at least one of a public safety indication and a group communication indication to the MME, and sends a proxy from the MME.
  • Prose identifier, prose group identifier, prose group key, prose-related capability of the terminal 500, and proxy-related security key (prose key) for proximity based service Receives an attach accept message including at least one of the information, transmits a prose registration request message to a prose function server, and transmits the prose registration request message to the prose function server from the terminal 500. Control to receive a prose registration response message according to the authentication of. In addition, the controller 520 transmits a paging message including at least one of a public safety indication and a group communication indication to the second terminal, and prose to the second terminal.
  • the prose group communication response A group communication response message may be received from the second terminal, the second terminal may verify whether the second terminal belongs to the prose group, and control to perform prose group communication with the second terminal.
  • the communication unit 510 of the terminal transmits and receives a signal in accordance with any one of the above-described embodiments.
  • the communication unit 510 may communicate with other entities. That is, an attach request message including at least one of a public safety indication and a group communication indication is transmitted to the MME, or a prose registration request is requested to a prose function server. You can communicate with other entities, such as sending a message (prose registration request).
  • FIG. 5 is a block diagram of a prose function server according to an embodiment of the present invention.
  • the prose function server 600 may include a communication unit 610 and a controller 620 for controlling overall operations of the prose function server 600.
  • the controller 620 may further include a prose controller 621.
  • the prose controller 621 of the prose function server 600 controls the prose function server 600 to perform an operation of any of the above-described embodiments.
  • the prose controller 621 performs a prose registration procedure for prose group communication with a terminal, receives a prose group session key request message from the terminal, generates the prose group session key, and and transmitting a prose session key encrypted with a prose group key to the terminal, receiving a prose group encryption key or integrity key request message from the terminal, and receiving the prose group encryption key or integrity key. And generate and transmit the prose group encryption key or the integrity key encrypted with the prose group body key to the terminal.
  • the communication unit 610 of the prose function server transmits and receives signals in accordance with any one of the above-described embodiments.
  • the communication unit 610 may communicate with other entities. That is, the mobile station may communicate with other entities such as receiving a prose group session key request message from the terminal or transmitting a prose session key encrypted with the prose group key to the terminal.
  • FIG. 6 is a block diagram of an HSS according to an embodiment of the present invention.
  • a home subscriber server (HSS) 700 may include a communication unit 710 and a controller 720 for controlling the overall operation of the HSS 700.
  • the controller 720 may further include a subscriber information controller 721.
  • the subscriber information controller 721 of the HSS 700 controls the HSS 700 to perform the operation of any of the above-described embodiments.
  • the subscriber information control unit 721 controls to receive an authentication data request message from the MME, and based on the received information, the subscriber information control unit 721 includes an authentication vector as an MME. It can be controlled to transmit information.
  • the communication unit 710 of the HSS 700 transmits and receives signals in accordance with any one of the above-described embodiments.
  • the communication unit 710 may communicate with other entities. That is, it may communicate with other entities such as receiving an authentication data request message from the MME, or transmitting security related information including an authentication vector to the MME.
  • FIG. 7 is a block diagram of an MME according to an embodiment of the present invention.
  • the MME 800 may include a communication unit 810 and a controller 820 for controlling overall operations of the MME 800.
  • the controller 820 may further include a mobility management controller 821.
  • the mobility management controller 821 of the MME 800 controls the MME 800 to perform an operation of any of the above-described embodiments.
  • the control unit receives the attach request request message transmitted by the terminal from the base station and transmits an authentication data request message to the HSS based on the received attach request message. can do.
  • the mobility management control unit 821 receives security-related information including an authentication vector from the HSS, and a user authentication request message including an authentication token (AUTN) to the terminal. Can be controlled to transmit.
  • AUTN authentication token
  • the communication unit 810 of the MME 800 transmits and receives a signal in accordance with any one of the above-described embodiments.
  • the communication unit 810 may communicate with other entities. That is, the base station may communicate with other entities such as receiving an attach request request message transmitted by the terminal from the base station or transmitting an authentication data request message to the HSS.
  • network entities such as an eNB and an application server according to an embodiment of the present invention may also include a communication unit and a control unit, respectively.
  • Each communication unit may transmit and receive a signal such that the entity communicates with other entities.
  • Each controller may control the corresponding entity to perform the operation of any one of the above-described embodiments.
  • all steps and messages may optionally be subject to execution or subject to omission.
  • the steps need not necessarily occur in order and may be reversed.
  • Message delivery doesn't necessarily have to happen in order, but can be reversed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un système pour permettre une fonction de communication d'un dispositif, et un procédé pour communiquer par un terminal, selon un mode de réalisation de la présente invention, comprend les étapes : de transmission, à un MME, d'un message de demande d'attachement comprenant une indication de sécurité publique et/ou une indication de communication de groupe ; de réception, du MME, d'un message d'acceptation d'attachement comprenant au moins un type d'informations parmi un identifiant ProSe, un identifiant de groupe ProSe et un groupe ProSe pour effectuer des fonctions ProSe, associées à ProSe du terminal, et une clé de sécurité associée à la proximité (clé ProSe) ; de transmission d'une demande d'enregistrement ProSe à un serveur de fonction ProSe ; et de réception, du serveur de fonction ProSe, un message de réponse d'enregistrement ProSe attendant l'authentification du terminal. Selon un mode de réalisation de la présente invention, des dispositifs peuvent mutuellement fournir ou recevoir des informations dans un groupe dans un environnement tel qu'un EUTRAN ou un UTRAN/GERAN.
PCT/KR2015/000354 2014-01-13 2015-01-13 Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile WO2015105401A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/111,471 US10382955B2 (en) 2014-01-13 2015-01-13 Security method and system for supporting prose group communication or public safety in mobile communication
EP15735197.4A EP3096544B1 (fr) 2014-01-13 2015-01-13 Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
KR20140004069 2014-01-13
KR10-2014-0004069 2014-01-13
KR10-2014-0055885 2014-05-09
KR1020140055885A KR102088848B1 (ko) 2014-01-13 2014-05-09 이동 통신에서 ProSe그룹 통신 또는 공공 안전을 지원하기 위한 보안 방안 및 시스템

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/111,471 Division US10382955B2 (en) 2014-01-13 2015-01-13 Security method and system for supporting prose group communication or public safety in mobile communication

Publications (1)

Publication Number Publication Date
WO2015105401A1 true WO2015105401A1 (fr) 2015-07-16

Family

ID=53524160

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2015/000354 WO2015105401A1 (fr) 2014-01-13 2015-01-13 Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile

Country Status (1)

Country Link
WO (1) WO2015105401A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017027056A1 (fr) * 2015-08-11 2017-02-16 Intel IP Corporation Découverte directe sécurisée entre des équipements d'utilisateur
WO2017034103A1 (fr) * 2015-08-26 2017-03-02 엘지전자(주) Procédé et dispositif au moyen desquels un terminal transmet/reçoit des données dans un système de communication sans fil
WO2017126721A1 (fr) * 2016-01-21 2017-07-27 엘지전자(주) Procédé et appareil d'envoi et de réception de données de terminal dans un système de communication sans fil

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013089452A1 (fr) * 2011-12-13 2013-06-20 엘지전자 주식회사 Procédé et dispositif pour fournir un service de proximité dans un système de communication sans fil
WO2013095001A1 (fr) * 2011-12-20 2013-06-27 엘지전자 주식회사 Procédé et appareil de commande lancée par un équipement utilisateur destinés à fournir un service de proximité
WO2013109040A1 (fr) * 2012-01-16 2013-07-25 엘지전자 주식회사 Procédé et appareil destinés à fournir un service de proximité dans un système de communication sans fil
US20130294433A1 (en) * 2012-05-04 2013-11-07 Institute For Information Industry Direct mode communication system and communication attaching method thereof

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013089452A1 (fr) * 2011-12-13 2013-06-20 엘지전자 주식회사 Procédé et dispositif pour fournir un service de proximité dans un système de communication sans fil
WO2013095001A1 (fr) * 2011-12-20 2013-06-27 엘지전자 주식회사 Procédé et appareil de commande lancée par un équipement utilisateur destinés à fournir un service de proximité
WO2013109040A1 (fr) * 2012-01-16 2013-07-25 엘지전자 주식회사 Procédé et appareil destinés à fournir un service de proximité dans un système de communication sans fil
US20130294433A1 (en) * 2012-05-04 2013-11-07 Institute For Information Industry Direct mode communication system and communication attaching method thereof

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017027056A1 (fr) * 2015-08-11 2017-02-16 Intel IP Corporation Découverte directe sécurisée entre des équipements d'utilisateur
US10499236B2 (en) 2015-08-11 2019-12-03 Intel IP Corporation Secure direct discovery among user equipment
WO2017034103A1 (fr) * 2015-08-26 2017-03-02 엘지전자(주) Procédé et dispositif au moyen desquels un terminal transmet/reçoit des données dans un système de communication sans fil
WO2017126721A1 (fr) * 2016-01-21 2017-07-27 엘지전자(주) Procédé et appareil d'envoi et de réception de données de terminal dans un système de communication sans fil

Similar Documents

Publication Publication Date Title
WO2015065063A1 (fr) Procédé et appareil de confirmation d'identité à l'aide de clés asymétriques dans un réseau de communications directes sans fil
WO2015105402A1 (fr) Procédé et système de prise en charge de sécurité pour découverte de service et communication de groupe dans un système de communication mobile
WO2010019020A2 (fr) Procédé de support de fonctionnement de protocole nas protégé par la sécurité dans un système de télécommunications mobiles
WO2018128499A1 (fr) Procédé et appareil pour sélectionner une fonction de gestion d'accès et de mobilité dans un système de communication mobile
WO2014171707A1 (fr) Procédé et système de sécurité destinés à prendre en charge des communications mobiles d'une politique de restriction en matière de renouvellement d'abonnement ou d'abonnement supplémentaire
WO2015065165A1 (fr) Procédé de sécurité et système pour assister la découverte et la communication entre des terminaux de service basés sur la proximité dans un environnement de système de communication mobile
JP2022536924A (ja) クローズドアクセスグループ関連の手順をハンドリングするための方法及びシステム
WO2012077999A2 (fr) Gestion de clé de chiffrement de trafic pour un groupe de multidiffusion de machine à machine
WO2016114604A1 (fr) Procédé et système pour établir une communication sécurisée entre un équipement utilisateur (ue) distant et un ue de relais dans un réseau de communication de dispositif à dispositif
WO2016085292A1 (fr) Procédé et appareil de prestation d'un service de parrainage entre des équipements utilisateur
WO2021045573A1 (fr) Appareil et procédé de fourniture de données d'abonnement à un terminal enregistré non abonné dans un système de communication sans fil
WO2013008990A1 (fr) Gestion de clé de chiffrement de trafic pour un groupe de multidiffusion de machine à machine
WO2013009059A2 (fr) Procédé de paramétrage d'un terminal dans un système de communication mobile
WO2014109597A1 (fr) Procédé de changement de passerelle dans un système machine à machine (m2m) et dispositif correspondant
WO2011081311A2 (fr) Procédé et système d'assistance à la sécurité dans un système de communications mobiles
WO2013005947A2 (fr) Appareil, procédé et système pour créer et mettre à jour une clé de chiffrement de données de multidiffusion dans un système de communication machine-machine
WO2017078459A1 (fr) Procédé, équipement d'utilisateur et nœud de réseau pour la protection de la confidentialité de l'utilisateur dans des réseaux
KR102088848B1 (ko) 이동 통신에서 ProSe그룹 통신 또는 공공 안전을 지원하기 위한 보안 방안 및 시스템
WO2012044072A2 (fr) Procédé d'attribution de clé utilisateur dans un réseau convergent
WO2014069925A1 (fr) Procédé et appareil pour gérer une connexion d'un réseau à commutation de paquets sur la base d'une zone locale dans un système de communication sans fil
WO2018000674A1 (fr) Procédé de connexion réseau, dispositif de connexion réseau et terminal
US20110002272A1 (en) Communication apparatus and communication method
WO2015105401A1 (fr) Procédé de sécurité et système de prise en charge de communication de groupe prose ou de sécurité publique dans une communication mobile
WO2015053602A1 (fr) Procédé et système pour prendre en charge des informations associées à la sécurité pour un service basé sur la proximité dans un environnement de système de communication mobile
CN106797560B (zh) 用于配置安全参数的方法、服务器、基站和通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15735197

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015735197

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015735197

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 15111471

Country of ref document: US