WO2016062000A1

WO2016062000A1 - Method, device and system for broadcasting and monitoring device-to-device limiting discovery service

Info

Publication number: WO2016062000A1
Application number: PCT/CN2015/074909
Authority: WO
Inventors: 游世林; 蔡继燕; 彭锦; 李阳; 林兆骥
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-10-20
Filing date: 2015-03-23
Publication date: 2016-04-28
Also published as: CN105592433B; CN105592433A

Abstract

The present invention provides a method, device and system for broadcasting and monitoring a device-to-device (D2D) limiting discovery service. The broadcasting method comprises: a broadcasting terminal (A-UE) sends a service request message to a distance-based service (ProSe) server (S402); the A-UE receives a discovery service code that is acquired after the ProSe server successfully authenticates the service request message (S404); and the A-UE broadcasts the discovery service code (S406). The present invention solves the problem in the prior art of a complex process of implementing a D2D discovery service due to the fact that a limiting discovery service must require service permission of a ProSe server, so that an A-UE can directly acquire broadcast or authentication permission from the ProSe server instead of using a ProSe functional entity, thereby simplifying the process steps of the discovery service.

Description

Device-to-device restriction discovery service broadcast, monitoring method, device and system

Technical field

The present invention relates to the field of communications, and in particular to a device-to-device restriction discovery service broadcast, monitoring method, apparatus, and system.

Background technique

In order to maintain the competitiveness of the third generation mobile communication system in the field of communication, and to provide users with faster, less delayed, more personalized mobile communication services, and at the same time, in order to reduce the operator's operating costs, the third generation of cooperation The Standards Working Group of the 3GPP (3rd Generation Partnership Project) is working on the Evolved Packet System (EPS). The entire EPS includes an E-UTRAN (Evolved Universal Terrestrial Radio Access Network) and an Evolved Packet Core Networking (EPC), where the EPC includes a Home Subscriber Server (HSS), mobility. Management entity (MME, Mobility Management Entity), Serving GPRS Support Node (SGSN), Policy and Charging Rule Function (PCRF), Serving Gateway (S-GW), grouping Data Gateway (P-GW, PDN Gateway) and Packet Data Network (PDN).

When two user equipments (UE, User Equipment) communicate through the EPS, the two UEs need to establish bearers with the EPS respectively. However, considering the rapid development of the UE and various mobile Internet services, many services want to be able to discover neighboring UEs and communicate, thus spawning a device-to-device (D2D) service. The D2D service is also called distance-based. Business (ProSe, Proximity-based Services). In the D2D service, when the two UEs are relatively close, they can communicate directly, and the connected data path can be bypassed to the core network. Thus, on the one hand, data routing can be reduced, and on the other hand, the network can be reduced. Data load. Therefore, D2D services have received the attention of many operators.

At present, the commonly used D2D service has a D2D discovery service. FIG. 1 is a structural block diagram of a communication architecture of the D2D discovery service in the prior art. As shown in FIG. 1 , two UEs accessed by the D2D can only access the EPC through the E-UTRAN. The two UEs may belong to one Public Land Mobile Network (PLMN) or belong to two PLMNs; for one UE, the PLMN may be divided into a Home PLMN (HPLMN, Home PLMN) and when the UE is from other The visited PLMN (VPLMN, Visited PLMN) when the PLMN is accessed may be collectively referred to as a local public land mobile network (LPLMN, Local PLMN) for the PLMN in which the UE is currently located, regardless of whether the local PLMN is HPLMN or VPLMN. In order to realize the D2D discovery service, On the carrier side, not only the EPS but also the ProSe Application Server that deploys the D2D discovery service can be provided. The ProSe application server can be provided by the service provider that operates the D2D service, or can be provided by the network operator that operates the EPS. ProSe Function is also deployed in different PLMNs. For the two UEs of the ProSe service, one of the UEs obtains the service identifier from the ProSe function entity, and then obtains the broadcastable service code from the ProSe function entity. This UE is called an Announcing UE (A-UE). The other UE accepts the broadcast of the A-UE and then matches the ProSe functional entity of the UE. If the matching is successful, the ProSe service is performed with the A-UE. Then, the non-broadcast UE is called a monitoring UE (M-UE).

In the D2D discovery service communication architecture, since the UE provides a related ProSe application (APP, Application), the interface with the ProSe application server is a PC1 interface, and provides related authentication functions. The interface between the UE and the UE is the PC5, which is used for direct mutual discovery and communication between the UEs, and the interface between the UE and the ProSe functional entity is the PC3, which is used for discovery and authentication through the network. The interface between the ProSe functional entity and the existing EPC is PC4, which includes a user plane interface with the P-GW and a control plane interface with the HSS for D2D discovery service discovery authentication. The interface between the ProSe functional entity and the ProSe application server is PC2, which is used for application implementation of the D2D discovery service. The ProSe function entity and the ProSe function entity have PC6 and PC7 interfaces respectively, which are used for the UE in both roaming and non-roaming situations. When the UE roams, it is the PC7 interface, and when the UE is not roaming, it is the PC6 interface. When the UE performs the D2D discovery service, the information interaction between the two ProSe functional entities is performed.

In addition, in mobile networks, terminals typically need to establish secure connections with service points in the network. The General Bootstrapping Architecture (GBA) is an authentication mechanism that guarantees the establishment of a secure connection between the terminal and the network service node. Figure 2 is a block diagram of the general authentication mechanism in the prior art. As shown in Figure 2, the bootstrap service function (Bootstrappingserver) The function, abbreviated as BSF, is in the user's home network. The BSF can obtain the user security vector of the GBA from the HSS; and the UE performs mutual authentication by using the Authentication and Key Agreement (AKA) protocol, and establishes a session key, which will be applied to the UE and the network application function. (Network application function, referred to as NAF); BSF can pass the key and user security settings to NAF. After the bootstrap is completed, the UE and the NAF can run some application-related protocols. In these protocols, the authentication of the messages is based on the session key generated in the mutual authentication process between the UE and the BSF. There was no previous security association between the UE and the NAF before the bootstrap process. The NAF obtains the shared key between the UE and the BSF from the BSF, and the NAF should be able to locate and be able to communicate securely with the BSF of the user's home network. Moreover, the NAF can set the local validity of the shared key according to the local policy, detect the lifetime of the shared key, and take measures with the UE to ensure the refresh of the key in the GBA. The HSS saves the user's security variables. The Subscriber Locator Function (SLF) is used to query the user's HSS. It is not a mandatory functional unit. The UE must support the GBA authentication function.

FIG. 3 is a schematic flowchart of a method for limiting discovery service in the prior art. As shown in FIG. 3, the method includes:

Step S300: The A-UE obtains the configuration parameter from the ProSe server, and obtains the restriction discovery service permission, where the configuration parameter includes the restriction service ProSe application identifier.

Step S301: After the A-UE and the ProSe functional entity under the HPLMN establish a secure connection, the A-UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the restricted service ProSe application identifier, the discovery service type, and the user identifier. , found that the business type is broadcast service Announce;

Step S302: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE. If the request is found to be authenticated, the ProSe functional entity sends a broadcast authentication request to the ProSe functional entity of the VPLMN, the message carries the restricted service ProSe application identifier, the user identifier, and the ProSe functional entity under the HPLMN of the A-UE allocates the discovery service code, the ProSe service code. Broadcast code for A-UE;

Step S303: After the ProSe functional entity of the A-UE of the A-UE authenticates the broadcast request, the device sends a broadcast authentication request response message to the ProSe functional entity in the HPLMN of the A-UE.

Step S304: The ProSe functional entity of the HPLMN sends a discovery service request response message to the A-UE. The message carries the discovery service code, the discovery key, the current time, and the maximum duration.

The ProSe service code is a broadcast service code allocated by the ProSe functional entity of the HPLMN of the A-UE to the A-UE, and the key is found to be 128 bits in total. The current time is the Greenwich Mean Time, that is, the world unified clock, A- The UE sets the ProSe time of the A-UE according to the current time, that is, the time of the synchronization and the network, and the maximum duration and the current time constitute the discovery time slot of the current discovery, that is, the life cycle of the service code is found, and the maximum duration is invalid;

Step S305: The A-UE broadcasts to the air through a broadcast channel, and the broadcast message carries the discovery service code.

Step S306: The M-UE obtains configuration parameters from the ProSe server, and obtains a restriction discovery service permission, where the configuration parameter includes a list of restricted service ProSe application identifiers.

Step S307: After the M-UE is interested in monitoring at least one restricted service ProSe application identifier, and establishing a secure connection with the ProSe functional entity under the HPLMN of the M-UE, the M-UE sends a discovery service request message to the ProSe functional entity under the HPLMN. The message includes a list of restricted ProSe application identifiers, and the service type is a monitor service monitor and a user identifier.

Step S308: If the ProSe functional entity under the HPLMN of the M-UE has no associated UE context, the ProSe functional entity performs authentication service authentication with the HSS, and establishes a new UE context, in the UE context. Contains the subscription parameters of the UE. If the request is found to be authenticated, the ProSe functional entity under the HPLMN of the M-UE sends a snooping authentication request to the ProSe functional entity of the other PLMN, and the message carrying the restricted service ProSe application identifier list and the user identifier;

The ProSe functional entity of the other PLMN also includes the ProSe functional entity under the HPLMN corresponding to the A-UE. Therefore, the restricted service ProSe application identifier list further includes at least one A-UE restricted service ProSe application identifier.

Step S309: the ProSe functional entity of the other PLMN obtains the authentication permission from the ProSe server;

Step S310: If the ProSe function entity of the other PLMN saves the discovery service code corresponding to the restricted service ProSe application identifier, the authentication and listening authentication request message is sent back to the ProSe functional entity of the M-UE of the M-UE to send a monitoring authentication request response message, and the message carries the discovery message. The mask corresponding to the service code and the life cycle corresponding to the discovery service code, that is, the current time and the maximum duration of the ProSe functional entities of other PLMNs;

Step S311: The ProSe functional entity of the HPLMN of the M-UE parses the ProSe service code composition discovery template according to the mask in the interception authentication request response message, and sends a discovery service request response message to the M-UE. The message carries the discovery template, the current time, and the maximum duration;

The current time is the current time of the ProSe functional entity of the HPLMN of the M-UE if the ProSe functional entity time of the HPLMN of the M-UE has been time synchronized with the ProSe functional entity of the other PLMN, otherwise it is carried by the monitoring authentication response request. The current time, the maximum duration is the maximum duration of the listening authentication response request. The M-UE sets the ProSe clock according to the current time;

Step S312: The M-UE receives the broadcast information of the A-UE, where the broadcast information includes the discovery service code.

Step S313: If the M-UE finds that the discovery service code broadcast by the A-UE exists in the discovery template, and the discovery service code is within the lifecycle of the discovery template, sends a matching report message to the ProSe functional entity of the HPLMN of the M-UE, The message carries the discovery service code, and the message also carries the ProSe time corresponding to the UE;

Step S314: The ProSe functional entity of the HPLMN of the M-UE forwards the matching report message to the ProSe functional entity of the HPLMN of the A-UE.

Step S315: The ProSe functional entity of the HPLMN of the A-UE carries the parameter according to the matching report, the ProSe time and the received discovery service code, and checks whether the service code is integrity passed, otherwise it fails, that is, the M-UE discovery service code does not. Complete

Step S316: After the ProSe functional entity integrity check of the HPLMN of the A-UE is successful, the matching report response message is sent back to the ProSe functional entity of the HPLMN of the M-UE;

Step S317: The ProSe function entity of the HPLMN of the M-UE sends a matching report response message to the M-UE, where the message carries the current time of the ProSe functional entity of the HPLMN of the M-UE, and the M-UE sets the ProSe time. After the matching is successful, the M-UE discovers the A-UE.

In the prior art, the restriction discovery service must require the service permission of the ProSe server. Therefore, regardless of the M-UE listening process or the A-UE broadcast process, the UE needs to obtain configuration information and permission from the ProSe server in advance, and also listens to the M-UE. The license to the ProSe server is again in the business, which leads to the cumbersome problem of the D2D discovery service implementation process.

In the prior art, the problem that the discovery service must require the service license of the ProSe server and the implementation process of the D2D discovery service is cumbersome has not yet been proposed.

Summary of the invention

The main purpose of the present invention is to provide a device-to-device restriction discovery service broadcast, monitoring method, device, and system, so as to solve the problem that the D2D discovery service implementation process is complicated in the prior art. problem.

In order to achieve the above object, the present invention provides a device-to-device D2D limiting discovery service broadcast method, including: a broadcast terminal A-UE transmitting a service request message to a distance-based service ProSe server; and the A-UE receiving the ProSe After the server authenticates the service request message, the server obtains a discovery service code, and the A-UE broadcasts the discovery service code.

According to another embodiment of the present invention, a device-to-device D2D method for monitoring a discovery service is provided, including: a listening terminal M-UE transmitting a service request message to a distance-based service ProSe server; the M-UE receiving station After the ProSe server authenticates the service request message, the discovery template of the mask corresponding to the discovery service code is obtained; the M-UE monitors according to the mask corresponding to the discovery service code in the discovery template. Broadcast channel.

According to another embodiment of the present invention, there is further provided a device to device D2D limiting discovery service broadcast device, the broadcast device being located in a broadcast terminal, comprising: a first sending module, configured to be a distance-based service ProSe server Sending a service request message; the first receiving module is configured to receive a discovery service code that is obtained after the ProSe server authenticates the service request message, and the broadcast module is configured to broadcast the discovery service code.

According to another embodiment of the present invention, there is also provided a device-to-device D2D monitoring device for limiting discovery service, the device being located in the monitoring terminal, comprising: a second sending module, configured to send to the distance-based service ProSe server a service request message, the second receiving module is configured to: after receiving the authentication of the service request message, the ProSe server acquires a discovery template consisting of a mask corresponding to the discovery service code; and the monitoring module is configured to be based on the discovery The mask corresponding to the discovery service code in the template listens to the broadcast channel.

According to another embodiment of the present invention, there is also provided a processing system for device-to-device D2D restriction discovery service, the system comprising a broadcast terminal located at a broadcast terminal side, a listening terminal located at a listening terminal side, and a distance-based service ProSe server The broadcast terminal includes: a first sending module, configured to send a service request message to the ProSe server; the first receiving module is configured to receive the discovery service code after the ProSe server authenticates the service request message a broadcast module configured to broadcast the discovery service code;

The monitoring device includes: a second sending module, configured to send a service request message to the ProSe server; and a second receiving module, configured to receive, after the ProSe server authenticates the service request message, obtain a service code corresponding to the discovery service code And the monitoring module is configured to listen to the broadcast channel according to the mask corresponding to the discovery service code in the discovery template; wherein the service request message is encrypted.

With the present invention, the broadcast terminal A-UE is used to send a service request message to the distance-based service ProSe server; the A-UE receives the ProSe server to obtain the discovery service code after authenticating the service request message; A-UE broadcast discovery The service code solves the problem that the limitation of the discovery service must require the service license of the ProSe server in the prior art, and the D2D discovery service implementation process is cumbersome, so that the A-UE can directly obtain the broadcast or authentication license to the ProSe server without passing the The ProSe functional entity simplifies the process steps for discovering a business.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a structural block diagram of a communication architecture of a D2D discovery service in the prior art;

2 is a structural block diagram of a general authentication mechanism in the prior art;

3 is a schematic flowchart of a method for limiting discovery service in the prior art;

4 is a flowchart of a method for broadcasting a device-to-device D2D restriction discovery service according to a preferred embodiment of the present invention;

FIG. 5 is a GBA authentication process of a universal authentication mechanism according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic flowchart of a device-to-device D2D method for monitoring a discovery service according to an embodiment of the present invention;

7 is a structural block diagram of a broadcast apparatus for limiting a discovery service from a device to a device D2D according to an embodiment of the present invention;

FIG. 8 is a structural block diagram of a device to device D2D limiting discovery service monitoring device according to an embodiment of the present invention; FIG.

9 is a schematic diagram of a broadcast process for limiting discovery service A-UE according to a preferred embodiment of the present invention;

FIG. 10 is a schematic flowchart of a method for monitoring a discovery service M-UE according to a preferred embodiment of the present invention.

detailed description

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The invention will be described in detail below with reference to the drawings in conjunction with the embodiments.

The steps illustrated in the flowchart of the figures may be performed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, may differ from this The steps shown are performed in the order shown or described.

The embodiment of the present invention provides a device to device D2D restriction discovery service broadcast method, and FIG. 4 is a flowchart of a device to device D2D restriction discovery service broadcast method according to a preferred embodiment of the present invention, as shown in FIG. Methods include:

Step S402: The broadcast terminal A-UE sends a service request message to the distance-based service ProSe server.

Step S404: The A-UE receives the discovery service code acquired by the ProSe server after the service request message is authenticated and passed.

Step S406: The A-UE broadcasts the discovery service code.

According to the embodiment of the present invention, the broadcast terminal A-UE sends a service request message to the distance-based service ProSe server; the A-UE receives the discovery service code obtained by the ProSe server after authenticating the service request message; A-UE broadcast The discovery of the service code solves the problem that the limitation of the discovery service in the prior art requires the service permission of the ProSe server, which leads to the cumbersome process of implementing the D2D discovery service, thereby enabling the A-UE to directly By obtaining a broadcast or authentication license to the ProSe server, it is not necessary to pass the ProSe functional entity, which simplifies the process steps of discovering the service.

In this embodiment, when the A-UE receives the discovery service code that is obtained by the ProSe server after the service request message is authenticated, the embodiment of the present invention can receive the valid service life of the discovery service code obtained by the ProSe server through the A-UE. .

In this embodiment, the server sends information that is responsive to the service request information, where the information carries the A-UE pre-signed restricted service ProSe application identifier.

It should be noted that the service request message in the embodiment of the present invention is the encrypted service request information, and the service request message carries, but is not limited to, the following information: limiting the type of the discovery service request and the service application type information; The type of the service request is found to be broadcast, and the service request type information is the restricted service ProSe application identifier of the A-UE.

In this embodiment, when the A-UE sends the service request message to the ProSe server, the method further includes: the A-UE sends the B-TID to the ProSe server, and the key period of the B-TID.

In this embodiment, the ProSe server authenticates the service request message by: the ProSe server sends the B-TID, the ID of the service platform NAF to the A-UE home domain ProSe function requesting entity, and the ProSe server receives the A-UE attribution. The service key sent by the domain ProSe function requesting entity, wherein the A-UE home domain ProSe function requesting entity acquires the service key according to the B-TID and the ID of the service platform NAF; the ProSe server decrypts the service request message according to the service key; The ProSe server authenticates the decrypted restricted service ProSe application identifier.

In this embodiment, the ProSe server obtains the discovery service code and the effective service life of the discovery service code. After the ProSe server authenticates the service request message, the ProSe server sends a broadcast request message to the A-UE home domain ProSe function entity. The broadcast request message carries the restricted service ProSe application identifier; the ProSe server receives the broadcast request response message in response to the broadcast request message, and the broadcast request response message carries the A-UE home domain ProSe functional entity as the restricted service ProSe application identifier. Discover the service code and discover the effective life of the service code.

In this embodiment, after the A-UE receives the authentication request from the ProSe server, the obtained discovery service code includes: the A-UE receives the encrypted service request response message sent by the ProSe server, where the service request response The message carries the discovery service code that is restricted by the service ProSe application, the service ProSe application identifier, and the effective service life of the discovery service code.

In this embodiment, before the A-UE sends the service request message to the ProSe server, the method includes: the A-UE performs authentication and key agreement AKA authentication with the A-UE home domain ProSe functional entity to obtain the B-TID and the B-TID. The key period of the TID.

5 is a GBA authentication process of a universal authentication mechanism according to an embodiment of the present invention. The AKA authentication of the A-UE is implemented by the process, wherein steps 501-506 are bootstrapped through the AKA authentication process, and steps 507-510 are service authentication. The process, as shown in Figure 5, includes:

Step S501: The UE sends an initialization request to the BSF.

Step S502: The BSF retrieves the user's security configuration information and an authentication vector AV from the HSS (AV=RAND||AUTN||XRES||CK||IK);

Where RAND is a random number, and AUTN is an Authentication Token (AUTN);

Step S503: encryption key CK, integrity protection key IK;

Wherein, in a multi-HSS environment, the BSF obtains an HSS address for storing user information by querying the SLF;

Step S504: The BSF sends the RAND and the AUTN to the UE through the 401 message, and saves (CK, IK, XRES), and requests the UE to authenticate the BSF.

The UE verifies the AUTN by the authentication algorithm, and confirms that the message is from the authorized network, and the UE calculates CK, IK, RES (authorization result parameter), which makes the session key IK and CK in both the BSF and the UE;

Step S505: The UE sends an authorization request message to the BSF, where the message carries an authorization result parameter RES;

The BSF verifies the correctness of the authorization result parameter RES by the saved (CK, IK, XRES); if correct, the root key Ks=CK||IK is calculated, and the value of the B-TID is generated;

Step S506: The BSF sends a 200 OK (Success Message) message containing the B-TID to the UE indicating that the authentication is successful, and in the 200 OK message, the BSF provides the lifetime of the Ks;

After receiving the 200 OK message, the UE also calculates Ks=CK||IK, which is the GBA root key, and is used to derive the service key of the application platform NAF.

Step S507: The UE and the BSF use Ks to derive the service key Ks_NAF=KDF(Ks, "gba-me", RAND, IMPI, NAF_ID). Among them, KDF is a key generation algorithm, and IMPI is the IMS identifier of the terminal. The NAF_ID is the ID of the service platform NAF, and the UE sends a B-TID (Bootstrapping Transaction Identifier) to the NAF, and requests to negotiate a key with the NAF;

The message also contains the content of the service message, and the message is encrypted using the encryption algorithm using the service key.

Step S508: The NAF sends the B-TID and the NAF_ID to the BSF to obtain the service key of the user.

Step S509: The BSF derives the Ks_NAF from the Ks by using the same method as the UE, and sends the Ks_NAF to the NAF through the secure channel, and includes information such as the key lifetime of its Ks_NAF;

The NAF can decrypt the content in the service message by using the same algorithm as the UE by using the obtained Ks_NAF;

Step S510: After the KSF saves the Ks_NAF and the validity period information, the NAF returns a 200 OK response to the UE, and the key Ks_NAF is shared between the UE and the NAF, and can be used for operations such as authentication and message encryption.

A preferred embodiment of the present invention further provides a device-to-device D2D method for monitoring a discovery service. FIG. 6 is a schematic flowchart of a device-to-device D2D method for monitoring a discovery service according to an embodiment of the present invention. The method includes:

Step S602: The monitoring terminal M-UE sends a service request message to the distance-based service ProSe server.

Step S604: The M-UE receives a mask corresponding to the discovery service code acquired by the ProSe server after the service request message is authenticated and passed.

Step S606: The M-UE listens to the broadcast channel according to the mask corresponding to the discovery service code.

In this embodiment, the M-UE receives the discovery service code that is obtained by the ProSe server after the service request message is authenticated, and the method further includes: the M-UE receiving the effective use period of the discovery service code obtained by the ProSe server.

In this embodiment, the service request message is the encrypted service request information, and the service request message carries the following information: the type of the discovery service request and the service application type information.

In this embodiment, the type of the discovery service request is restricted to be monitored, and the service application type information is the restricted service ProSe application identifier of the M-UE.

In this embodiment, when the A-UE sends the service request message to the ProSe server, the method further includes: the M-UE sends the B-TID to the ProSe server, and the key period of the B-TID.

In this embodiment, the ProSe server authenticates the service request message by: the ProSe server sends the B-TID, the ID of the service platform NAF to the M-UE home domain ProSe function requesting entity, and the ProSe server receives the M-UE attribution. The service key sent by the domain ProSe function requesting entity, where the M-UE home domain ProSe function requesting entity acquires the service key according to the B-TID and the ID of the service platform NAF; the ProSe server decrypts the service request message according to the service key; The ProSe server authenticates the decrypted restricted service ProSe application identifier.

In this embodiment, the ProSe server obtains the discovery service code and the effective service life of the discovery service code. After the ProSe server authenticates the service request message, the ProSe server sends a monitoring authentication request message to the M-UE home domain ProSe functional entity. The monitoring authentication request message carries the restricted service ProSe application identifier; the ProSe server receives the broadcast request response message in response to the broadcast request message, where the broadcast request response message carries the M-UE home domain ProSe functional entity as the restricted service ProSe application. Identifies the mask corresponding to the distribution discovery service code and the effective lifetime of the mask.

In this embodiment, the M-UE receives the mask corresponding to the discovery service code after the ProSe server authenticates the service request message, and the M-UE receives the encrypted service request response message sent by the ProSe server, where The service request response message carries a mask and a valid use period of the mask corresponding to the discovery service code of the service ProSe application identifier and the service ProSe application identifier.

In this embodiment, before the M-UE sends the service request message to the ProSe server, the M-UE performs the authentication and key agreement AKA authentication with the M-UE home domain ProSe functional entity to obtain the B-TID and the B-TID. The key period of the TID.

The embodiment of the present invention further provides a device to device D2D limiting discovery service broadcast device, and FIG. 7 is a structural block diagram of a device to device D2D restriction discovery service according to an embodiment of the present invention, where the broadcast device is located in a broadcast terminal, such as As shown in FIG. 7, the apparatus includes: a first sending module 72, configured to send a service request message to the distance-based service ProSe server; the first receiving module 74 is coupled to the first sending module 72, and is configured to receive the ProSe server in the pair. After the service request message is authenticated, the obtained discovery service code is obtained; the broadcast module 76 is coupled to the first receiving module 74 for broadcasting the discovery service code.

In this embodiment, the service request message is an encrypted service request message.

In this embodiment, the first receiving module is further configured to receive the encrypted service request response message sent by the ProSe server, where the service request response message carries the restricted service ProSe application identifier, the restriction The discovery service code identified by the service ProSe application, and the effective use period of the discovery service code.

The embodiment of the present invention further provides a device-to-device D2D-restricted discovery service monitoring device, and FIG. 8 is a structural block diagram of a device-to-device D2D-restricted discovery service monitoring device according to an embodiment of the present invention. The monitoring device is located in the monitoring terminal. The device is located in the monitoring terminal. As shown in FIG. 8, the device includes: a second sending module 82, configured to send a service request message to the distance-based service ProSe server; and the second receiving module 84 is coupled to the second sending module 82. After receiving the authentication request, the ProSe server obtains a discovery template consisting of a mask corresponding to the discovery service code. The monitoring module 86 is coupled to the second receiving module 84 and configured to be configured according to the mask corresponding to the discovery service code. The composed discovery template listens to the broadcast channel.

In this embodiment, the second receiving module is further configured to receive the encrypted service request response message sent by the ProSe server, where the service request response message carries the restricted service ProSe application identifier, the restriction A discovery template consisting of a mask corresponding to the discovery service code of the service ProSe application identifier, and an effective use period of the mask.

The modules and units involved in the embodiments of the present invention may be implemented by software or by hardware. The described modules and units in this embodiment may also be disposed in a processor. For example, it may be described that a processor includes a second sending module and a second receiving module. The names of these modules do not constitute a limitation on the module itself in some cases. For example, the second sending module may also be described as “set to send a service request message to the distance-based service ProSe server”.

The present invention also provides a device-to-device D2D-restricted discovery service processing system, which includes a broadcast terminal located on the broadcast terminal side, a listening terminal located on the monitoring terminal side, and a ProSe server;

The broadcast terminal includes: a first sending module 72, configured to send a service request message to the distance-based service ProSe server; the first receiving module 74 is coupled to the first sending module 72, and is configured to receive the ProSe server to authenticate the service request message. After the obtaining, the discovery service code is obtained; the broadcast module 76 is coupled to the first receiving module 74 and configured to be a broadcast discovery service code;

The monitoring device includes: a second sending module 82, configured to send a service request message to the distance-based service ProSe server; the second receiving module 84 is coupled to the second sending module 82, and is configured to receive the ProSe server to authenticate the service request message. After the obtaining, the mask corresponding to the discovery service code is obtained. The monitoring module 86 is coupled to the second receiving module 84 and configured to listen to the broadcast channel according to the mask corresponding to the discovery service code. ;

It should be noted that the service request message in the system is encrypted.

The invention will now be described in detail in conjunction with the preferred embodiments of the invention;

A preferred embodiment of the present invention provides a broadcast terminal A-UE, which initiates a discovery request to a ProSe server, the ProSe server acquires a shared key from the ProSe functional entity, and the ProSe server authenticates the discovery request, and acquires the discovery service code from the ProSe functional entity. And then sent to the A-UE by encryption.

The preferred embodiment of the present invention further provides a listening terminal M-UE. The M-UE initiates a discovery request to the ProSe server, the ProSe server acquires a shared key from the ProSe functional entity, and the ProSe server authenticates the discovery request, and acquires the discovery service code from the ProSe functional entity. The template is then sent to the M-UE by encryption.

The D2D restriction discovery service flow of the preferred embodiment of the present invention will be described below in conjunction with the broadcast terminal A-UE and the interception terminal M-UE.

In a preferred embodiment of the present invention, the main inventive idea of the discovery service A-UE is: the A-UE initiates a discovery request to the ProSe server, the ProSe server acquires the shared key from the ProSe functional entity, and the ProSe server authenticates the discovery request. The discovery service code is obtained from the ProSe functional entity and then sent to the A-UE through encryption. FIG. 9 is a schematic diagram of a broadcast process for limiting a discovery service A-UE according to a preferred embodiment of the present invention. As shown in FIG. 9, the method includes:

Step S901: The A-UE and the A-UE home domain ProSe functional entity perform the steps 501-506 AKA authentication in FIG. 5 to obtain the B-TID and the key period;

Step S902: The A-UE initiates a service request to the ProSe server, where the service request carries the B-TID and the encrypted service request message, where the encrypted message includes a restriction discovery request, and the restriction discovery request carries the discovery type as broadcast announce, and the service application type. Or the restricted service ProSe application identifier already existing in the A-UE. Restricting the service ProSe application identifier to be pre-signed by the A-UE or obtained by step 306;

Step S903: The ProSe server sends a B-TID and a NAF_ID to the A-UE home domain ProSe function to obtain a service key of the user.

Step S904: The A-UE home domain ProSe functional entity derives the Ks_NAF from the Ks by using the same method as the A-UE, and sends the Ks_NAF to the ProSe server through the secure channel, and includes information such as the key lifetime of its Ks_NAF;

Step S905: The ProSe server uses the obtained Ks_NAF decryption service request message, the authentication service request and the restriction service ProSe application identifier, or allocates a restricted service ProSe application identifier according to the service application type, and sends a broadcast request message to the A-UE home domain ProSe functional entity. The broadcast request message carries a restricted service ProSe application identifier;

Step S906: The A-UE home domain ProSe functional entity allocates a discovery service code for the restricted service ProSe application identifier, and a corresponding validity period. Sending a broadcast request response message to the ProSe server, where the message carries the discovery service code and the corresponding validity period;

Step S907: The ProSe server sends a service request response message to the A-UE, where the message carries the encrypted service response message, and the service response message carries the restricted service ProSe application identifier, the service code, and the corresponding validity period;

Step S908: The A-UE decrypts the response message, and saves the restricted service ProSe application identifier. The service code is found, and the corresponding validity period, the radio resource is allocated, the service code is broadcasted on the broadcast channel, and the M-UE discovery is provided.

The core idea of the discovery process of the discovery service M-UE is that the M-UE initiates a discovery request to the ProSe server, the ProSe server acquires the shared key from the ProSe functional entity, the ProSe server authenticates the discovery request, and obtains the discovery service from the ProSe functional entity. The code template is then sent to the M-UE by encryption. FIG. 10 is a schematic flowchart of a method for monitoring a discovery service M-UE according to a preferred embodiment of the present invention. As shown in FIG. 10, the method includes:

Step S1001: The M-UE and the M-UE home domain ProSe functional entity perform the step 101-106 AKA authentication in FIG. 3 to obtain the B-TID and the key period;

Step S1002: The M-UE initiates a service request to the ProSe server, and the service request carries the B-TID and the encrypted service request message, where the encrypted message includes a restriction discovery request, and the restriction discovery request carries the discovery type as the monitoring monitor, and the service application type. Or the restricted service ProSe application identifier already existing in the M-UE. Restricting the service ProSe application identifier to be pre-signed by the M-UE or obtained by step 408;

Step S1003: The ProSe server sends a B-TID and a NAF_ID to the M-UE home domain ProSe function to obtain a service key of the user.

Step S1004: The M-UE home domain ProSe functional entity derives the Ks_NAF from the Ks by using the same method as the M-UE, and sends the Ks_NAF to the ProSe server through the secure channel, and includes information such as the key lifetime of the Ks_NAF.

Step S1005: The ProSe server uses the obtained Ks_NAF decryption service request message, the authentication service request and the restricted service ProSe application identifier, or allocates a restricted service ProSe application identifier or a restricted service ProSe application identifier list according to the service request type, to the M-UE home domain ProSe. The function entity sends a monitoring authentication request message, and the monitoring authentication request message carries a restricted service ProSe application identifier or a restricted service ProSe application identifier list;

Step S1006: The M-UE home domain ProSe functional entity sends a listening request to the ProSe functional entity of the other PLMN, and the message carries the restricted service ProSe application identifier or the restricted service ProSe application identifier list. The ProSe functional entity of the other PLMN also includes the ProSe functional entity under the HPLMN corresponding to the A-UE, so the restricted service ProSe application identifier list also includes at least one A-UE restricted service ProSe application identifier;

Step S1007: If the ProSe function entity of the other PLMN saves the discovery service code corresponding to the restricted service ProSe application identifier, the authentication and listening request message is sent back to the ProSe function entity of the M-UE of the M-UE to send a monitoring request response message, and the message carries the discovery service code. Corresponding mask, and expiration date, that is, the current time and maximum duration of the ProSe functional entities of other PLMNs;

Step S1008: The ProSe functional entity of the HPLMN of the M-UE forms a discovery template according to the mask composed of the ProSe service code in the interception request response message, and sends a monitoring authentication request response message to the ProSe server, where the message carries the mask corresponding to the discovery service code, and the validity period. , that is, the current time and maximum duration of the ProSe functional entities of other PLMNs;

Step S1009: The ProSe server sends a service request response message to the M-UE, where the message carries the encrypted service response message, the service response message carries the restriction service ProSe application identifier, the mask corresponding to the service code, and the validity period, that is, the ProSe of other PLMNs. The current time and maximum duration of the functional entity;

Step S1010: The M-UE decrypts the response message, and saves the restricted service ProSe application identifier. The mask corresponding to the service code is found, and the validity period is allocated. The radio resource is allocated, and the A-UE broadcast is intercepted on the broadcast channel. When the M-UE receives the broadcast discovery service code, the matching process is initiated. After the matching is successful, the A- is found. UE.

With the preferred embodiment of the present invention, the UE to the ProSe server is guaranteed, and the UE can directly obtain the broadcast or authentication permission to the ProSe server without having to pass the ProSe functional entity, thereby saving the message.

The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

According to the foregoing technical solution provided by the embodiment of the present invention, the broadcast terminal A-UE sends a service request message to the distance-based service ProSe server; and the A-UE receives the discovery service after the ProSe server authenticates the service request message. The A-UE broadcasts the discovery service code, which solves the problem that the limitation of the discovery service must require the service permission of the ProSe server in the prior art, and the implementation process of the D2D discovery service is cumbersome. In turn, the A-UE can directly obtain a broadcast or authentication license to the ProSe server without having to pass the ProSe functional entity, which simplifies the process steps of discovering the service.

Claims

A device-to-device D2D broadcast method for limiting discovery services, including:

The broadcast terminal A-UE sends a service request message to the distance-based service ProSe server;

Receiving, by the A-UE, the ProSe server, after obtaining the service request message, the discovery service code;

The A-UE broadcasts the discovery service code.
The method according to claim 1, wherein the A-UE further includes: when the A-UE receives the discovery service code that is obtained by the ProSe server after the service request message is authenticated, the method further includes:

The A-UE receives an effective use period of the discovery service code acquired by the ProSe server.
The method of claim 1, wherein the server sends information responsive to the service request information, the information carrying the A-UE pre-signed restricted service ProSe application identifier.
The method according to claim 1, wherein the service request message is encrypted service request information, and the service request message carries the following information: limiting the type of the discovery service request and the service application type information.
The method according to claim 4, wherein the type of the restriction discovery service request is a broadcast, and the service application type information is a restricted service ProSe application identifier of the A-UE.
The method of claim 5, wherein when the A-UE sends the service request message to the ProSe server, the method further includes:

The A-UE sends a B-TID to the ProSe server and a key period for guiding the transaction identifier B-TID.
The method according to claim 6, wherein the ProSe server authenticates the service request message by:

Sending, by the ProSe server, the ID of the B-TID and the service platform NAF to the A-UE home domain ProSe function requesting entity;

The ProSe server receives the service key sent by the A-UE home domain ProSe function requesting entity, where the A-UE home domain ProSe function requesting entity acquires the information according to the B-TID and the service platform NAF ID. Business key

Decrypting, by the ProSe server, the service request message according to the service key;

The ProSe server authenticates the decrypted restricted service ProSe application identifier.
The method according to claim 7, wherein the ProSe server acquires the discovery service code and the effective service life of the discovery service code by:

After the ProSe server authenticates the service request message, the ProSe server sends a broadcast request message to the A-UE home domain ProSe function entity, where the broadcast request message carries the restricted service ProSe application identifier;

The ProSe server receives a broadcast request response message in response to the broadcast request message, where the broadcast request response message carries the A-UE home domain ProSe functional entity to allocate the discovery service to the restricted service ProSe application identifier. The code, and the validity period of the discovery service code.
The method according to claim 8, wherein the A-UE receives the discovery service code obtained by the ProSe server after the authentication of the service request message is obtained, and the acquired service code includes:

The A-UE receives the encrypted service request response message sent by the ProSe server, where the service request response message carries the discovery service code identified by the restricted service ProSe application identifier, the restricted service ProSe application identifier, The effective service life of the discovery service code.
The method of claim 6, wherein before the A-UE sends the service request message to the ProSe server, the method includes:

The A-UE obtains the key period of the B-TID and the B-TID by performing authentication and key agreement AKA authentication with the A-UE home domain ProSe functional entity.
A device-to-device D2D method for monitoring a discovery service includes:

The monitoring terminal M-UE sends a service request message to the distance-based service ProSe server;

After receiving the authentication of the service request message, the M-UE obtains a discovery template consisting of a mask corresponding to the discovery service code;

The M-UE monitors a broadcast channel according to a mask corresponding to the discovery service code in the discovery template.
The method of claim 11, wherein the M-UE further includes: when the M-UE receives the discovery service code that is obtained by the ProSe server after the service request message is authenticated, the method further includes:

The M-UE receives an effective use period of the discovery service code acquired by the ProSe server.
The method according to claim 12, wherein the service request message is encrypted service request information, and the service request message carries the following information: limiting the type of the discovery service request and the service application type information.
The method of claim 13, wherein the type of the restricted discovery service request is a snoop, and the service request type information is a restricted service ProSe application identifier of the M-UE.
The method of claim 14, wherein when the A-UE sends the service request message to the ProSe server, the method further includes:

The M-UE sends a B-TID to the ProSe server, and a key period of the B-TID.
The method of claim 15, wherein the ProSe server authenticates the service request message by:

Sending, by the ProSe server, the ID of the B-TID and the service platform NAF to the M-UE home domain ProSe function requesting entity;

The ProSe server receives the service key sent by the M-UE home domain ProSe function requesting entity, where the M-UE home domain ProSe function requesting entity acquires the information according to the B-TID and the service platform NAF ID. Business key

Decrypting, by the ProSe server, the service request message according to the service key;

The ProSe server authenticates the decrypted restricted service ProSe application identifier.
The method according to claim 16, wherein said ProSe server obtains said discovery service code and said discovery service code effective use period by:

After the ProSe server authenticates the service request message, the ProSe server sends a monitoring authentication request message to the M-UE home domain ProSe functional entity, where the monitoring authentication request message carries the restricted service ProSe application identifier. ;

The ProSe server receives a broadcast request response message in response to the broadcast request message, where the broadcast request response message carries the M-UE home domain ProSe functional entity to allocate the discovery service to the restricted service ProSe application identifier. The mask corresponding to the code, and the effective lifetime of the mask.
The method of claim 17, wherein the M-UE receives a mask corresponding to the discovery service code that is obtained by the ProSe server after the authentication of the service request message is performed:

The M-UE receives the encrypted service request response message sent by the ProSe server, where the service request response message carries the restricted service ProSe application identifier and the discovery service code of the restricted service ProSe application identifier. The corresponding mask, the effective use period of the mask.
The method of claim 15, wherein before the M-UE sends the service request message to the ProSe server, the method includes:

The M-UE obtains the key period of the B-TID and the B-TID by performing authentication and key agreement AKA authentication with the M-UE home domain ProSe functional entity.
A device-to-device D2D broadcast device for limiting a discovery service, the broadcast device being located in a broadcast terminal, comprising:

a first sending module, configured to send a service request message to the distance-based service ProSe server;

a first receiving module, configured to receive a discovery service code acquired by the ProSe server after the service request message is authenticated and passed;

A broadcast module, configured to broadcast the discovery service code.
The apparatus of claim 20 wherein said service request message is an encrypted service request message.
The apparatus according to claim 20, wherein the first receiving module is further configured to receive an encrypted service request response message sent by the ProSe server, wherein the service request response message carries an identifier of the restricted service ProSe application, And limiting the discovery service code of the service ProSe application identifier and the effective use period of the discovery service code.
A device-to-device D2D device for monitoring a discovery service, the device being located in the monitoring terminal, comprising:

a second sending module, configured to send a service request message to the distance-based service ProSe server;

And the second receiving module is configured to: after receiving the authentication, the ProSe server obtains a discovery template consisting of a mask corresponding to the discovery service code;

The monitoring module is configured to monitor the broadcast channel according to a mask corresponding to the discovery service code in the discovery template.
The apparatus of claim 23 wherein said service request message is an encrypted service request message.
The apparatus according to claim 23, wherein said second receiving module is further configured to receive an encrypted service request response message sent by said ProSe server, wherein said service request response message carries A discovery template consisting of a mask corresponding to the discovery service code of the restricted service ProSe application identifier and the restricted service ProSe application identifier, and an effective use period of the mask.
A device-to-device D2D processing system for limiting discovery services, the system comprising a broadcast terminal located at a broadcast terminal side, a listening terminal located at a listening terminal side, and a distance-based service ProSe server;

The broadcast terminal includes:

a first sending module, configured to send a service request message to the ProSe server;

a first receiving module, configured to receive, after the ProSe server authenticates the service request message, obtain a discovery service code;

a broadcast module, configured to broadcast the discovery service code;

The monitoring device includes:

a second sending module, configured to send a service request message to the ProSe server;

And the second receiving module is configured to: after receiving the authentication, the ProSe server obtains a discovery template consisting of a mask corresponding to the discovery service code;

a monitoring module, configured to listen to a broadcast channel according to a mask corresponding to the discovery service code in the discovery template;

The service request message is encrypted.