WO2016112677A1

WO2016112677A1 - Discovery service code checking processing method and device, and discovery service code checking method and device

Info

Publication number: WO2016112677A1
Application number: PCT/CN2015/085362
Authority: WO
Inventors: 游世林; 蔡继燕; 彭锦; 梁爽; 林兆骥
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-01-13
Filing date: 2015-07-28
Publication date: 2016-07-21
Also published as: CN104540106B; CN104540106A

Abstract

The present invention provides a discovery service code checking processing method and device, and a discovery service code checking method and device. The checking processing method comprises: a broadcast user equipment (UE) acquires a discovery code suffix of a discovery service code and a first key corresponding to the discovery code suffix; the broadcast UE generates, according to the discovery code suffix and the first key, a first check code used for checking the discovery code suffix; and the broadcast UE broadcasts the first check code to a monitoring UE. By using the technical scheme provided in the present invention, the problem in the related art of lacking a technical scheme for protecting a discovery code suffix is solved; and therefore integrity protection is realized on the discovery code suffix, risks of counterfeit and replay attacks to a discovery code prefix are avoided, and risks of counterfeit and replay attacks to the discovery code suffix are also avoided.

Description

Service code verification processing, verification method and device

Technical field

The present invention relates to the field of communications, and in particular to a method and apparatus for verifying a service code.

Background technique

In order to maintain the competitiveness of the third generation mobile communication system in the field of communication, and to provide users with faster, less delayed, more personalized mobile communication services, and at the same time, in order to reduce the operator's operating costs, the third generation of cooperation The Standards Working Group of the 3GPP (3rd Generation Partnership Project) is working on the Evolved Packet System (EPS). The entire EPS includes an E-UTRAN (Evolved Universal Terrestrial Radio Access Network) and an Evolved Packet Core Networking (EPC), where the EPC includes a Home Subscriber Server (HSS), mobility. Management entity (MME, Mobility Management Entity), Serving GPRS Support Node (SGSN), Policy and Charging Rule Function (PCRF), Serving Gateway (S-GW), grouping Data Gateway (P-GW, PDN Gateway) and Packet Data Network (PDN).

When two user equipments (UE, User Equipment) communicate through the EPS, the two UEs need to establish bearers with the EPS respectively. However, considering the rapid development of the UE and various mobile Internet services, many services want to be able to discover neighboring UEs and communicate, thus spawning a device-to-device (D2D) service. The D2D service is also called distance-based. Business (ProSe, Proximity-based Services). In the D2D service, when the two UEs are relatively close, they can communicate directly, and the connected data path can be bypassed to the core network. Thus, on the one hand, data routing can be reduced, and on the other hand, the network can be reduced. Data load. Therefore, D2D services have received the attention of many operators.

At present, the commonly used D2D service has a D2D discovery service. FIG. 1 is a structural block diagram of a communication architecture of the D2D discovery service in the prior art. As shown in FIG. 1 , two UEs accessed by the D2D can only access the EPC through the E-UTRAN. The two UEs may belong to one Public Land Mobile Network (PLMN) or belong to two PLMNs; for one UE, the PLMN may be divided into a Home PLMN (HPLMN, Home PLMN) and when the UE is from other The visited PLMN (VPLMN, Visited PLMN) when the PLMN is accessed may be collectively referred to as a local public land mobile network (LPLMN, Local PLMN) for the PLMN in which the UE is currently located, regardless of whether the local PLMN is HPLMN or VPLMN. In order to implement the D2D discovery service, not only the EPS but also the ProSe Application Server that deploys the D2D discovery service can be deployed on the carrier side. The ProSe application server can be provided by the service provider that operates the D2D service, or can be operated by the service provider. The network operator of the EPS provides a ProSe Function entity in different PLMNs. For the two UEs of the ProSe service, one of the UEs obtains the service identifier from the ProSe function entity, and then obtains the broadcastable service code from the ProSe function entity. This UE is called an Announcing UE (A-UE). The other UE accepts the broadcast of the A-UE and then matches the ProSe functional entity of the UE. If the matching is successful, the ProSe service is performed with the A-UE. Then, the non-broadcast UE is called a monitoring UE (M-UE).

In the D2D discovery service communication architecture, since the UE provides a related ProSe application (APP, Application), the interface with the ProSe application server is a PC1 interface, and provides related authentication functions. The interface between the UE and the UE is the PC5, which is used for direct mutual discovery and communication between the UEs, and the interface between the UE and the ProSe functional entity is the PC3, which is used for discovery and authentication through the network. The interface between the ProSe functional entity and the existing EPC is PC4, which includes a user plane interface with the P-GW and a control plane interface with the HSS for D2D discovery service discovery authentication. The interface between the ProSe functional entity and the ProSe application server is PC2, which is used for application implementation of the D2D discovery service. The ProSe function entity and the ProSe function entity have PC6 and PC7 interfaces respectively, which are used for the UE in both roaming and non-roaming situations. When the UE roams, it is the PC7 interface, and when the UE is not roaming, it is the PC6 interface. When the UE performs the D2D discovery service, the information interaction between the two ProSe functional entities is performed.

2 is a schematic flowchart of a method for limiting discovery service in the prior art. As shown in FIG. 2, the method includes:

Step S200: The A-UE obtains the configuration parameter from the ProSe server, and obtains the restriction discovery service permission, where the configuration parameter includes the user close-range restriction service identifier;

Step S201: After the A-UE and the ProSe functional entity under the HPLMN establish a secure connection, the A-UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the user close-range restricted service identifier, the discovered service type, and the user. Identification, the discovery service type is the broadcast service Announce;

Step S202: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE. If the request is found to be authenticated, the ProSe functional entity sends a broadcast authentication request to the ProSe functional entity of the VPLMN, the message carries the user close-range restricted service identifier, the user identifier, and the ProSe functional entity under the HPLMN of the A-UE allocates the discovery service code, and the ProSe service The code is a broadcast code of the A-UE;

Step S203: After the ProSe function entity of the A-UE of the A-UE authenticates the broadcast request, the device sends a broadcast authentication request response message to the ProSe function entity in the HPLMN of the A-UE.

Step S204: The ProSe functional entity of the HPLMN sends a discovery service request response message to the A-UE. The message carries the discovery service code, the discovery key, the current time, and the maximum duration.

The ProSe service code is a broadcast service code allocated by the ProSe functional entity of the HPLMN of the A-UE to the A-UE, and the key is found to be 128 bits in total. The current time is the Greenwich Mean Time, that is, the world unified clock, A- The UE sets the ProSe time of the A-UE according to the current time, that is, the time of the synchronization and the network, and the maximum duration and the current time constitute the discovery time slot of the current discovery, that is, the life cycle of the service code is found, and the maximum duration is invalid;

Step S205: The A-UE broadcasts to the air through a broadcast channel, and the broadcast message carries the discovery service code.

Step S206: The M-UE obtains the configuration parameter from the ProSe server, and obtains the restriction discovery service permission, where the configuration parameter includes the user proximity restriction service identifier list;

Step S207: After the M-UE is interested in monitoring at least one user close-range restricted service identity, and establishing a secure connection with the ProSe functional entity under the HPLMN of the M-UE, the M-UE sends a discovery service request message to the ProSe functional entity under the HPLMN. The message includes a user close-range restricted service identifier list, and the found service type is a monitor service monitor and a user identifier;

Step S208: If the ProSe functional entity under the HPLMN of the M-UE has no associated UE context, the ProSe functional entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE. If the request is found to be authenticated, the ProSe functional entity of the MLM of the M-UE sends a monitoring authentication request to the ProSe functional entity of the other PLMN, and the message carries the user close-range restricted service identifier list and the user identifier;

The ProSe functional entity of the other PLMN also includes the ProSe functional entity in the HPLMN corresponding to the A-UE. Therefore, the user close-range restricted service identifier list also includes at least one A-UE user close-range restricted service identifier.

Step S209: the ProSe functional entity of the other PLMN obtains the authentication permission from the ProSe server;

Step S210: If the ProSe function entity of the other PLMN saves the discovery service code corresponding to the user's short-range restriction service identifier, the authentication and monitoring authentication request message is sent back to the ProSe function entity of the M-UE of the M-UE to send a monitoring authentication request response message, and the message carries The mask corresponding to the service code and the life cycle corresponding to the discovery service code, that is, the current time and the maximum duration of the ProSe functional entity of other PLMNs;

Step S211: The ProSe functional entity of the HPLMN of the M-UE parses the ProSe service code composition discovery template according to the mask in the interception authentication request response message, and sends a discovery service request response message to the M-UE. The message carries the discovery template, the current time, and the maximum duration;

The current time is the current time of the ProSe functional entity of the HPLMN of the M-UE if the ProSe functional entity time of the HPLMN of the M-UE has been time synchronized with the ProSe functional entity of the other PLMN, otherwise it is carried by the monitoring authentication response request. The current time, the maximum duration is the maximum duration of the listening authentication response request. The M-UE sets the ProSe clock according to the current time;

Step S212: The M-UE receives the broadcast information of the A-UE, where the broadcast information includes the discovery service code.

Step S213: If the M-UE finds that the discovery service code broadcast by the A-UE exists in the discovery template, and the discovery service code is within the lifecycle of the discovery template, sends a matching report message to the ProSe functional entity of the HPLMN of the M-UE, The message carries the discovery service code, and the message also carries the ProSe time corresponding to the UE;

Step S214: ProSe function of the HPLMN of the M-UE to the ProSe function of the HPLMN of the A-UE The entity forwards the matching report message.

Step S215: The ProSe function entity of the HPLMN of the A-UE carries the parameter according to the matching report, the ProSe time and the discovery service code received by the broadcast, and checks whether the service code is integrity passed, otherwise it fails, that is, the M-UE discovery service code does not. complete;

Step S216: After the ProSe functional entity integrity check of the HPLMN of the A-UE is successful, the matching report response message is sent back to the ProSe functional entity of the HPLMN of the M-UE;

Step S217: The ProSe functional entity of the HPLMN of the M-UE sends a matching report response message to the M-UE, where the message carries the current time of the ProSe functional entity of the HPLMN of the M-UE, and the M-UE sets the ProSe time. After the matching is successful, the M-UE discovers the A-UE.

In the prior art, the service code is found to be divided into a discovery code prefix and a discovery code suffix, wherein the discovery code prefix is allocated by the ProSe functional entity, and the discovery code suffix is controlled by the service and allocated at the service layer. In addition, in Figure 2, only the discovery service code assigned by the ProSe functional entity is protected against integrity, spoofing and replay attacks, and the code suffix is also intact, and the risk of counterfeiting and replay attacks is also possible. At present, how to protect the discovery code suffix does not propose an effective solution.

In view of the related art, the technical solution of the protection of the discovery code suffix has not been proposed, and an effective solution has not been proposed.

Summary of the invention

In order to solve the above technical problem, an embodiment of the present invention provides a verification processing, a verification method, and a device for discovering a service code.

According to an embodiment of the present invention, a method for verifying a service code is provided, including: a broadcast user equipment UE acquiring a discovery code suffix of a discovery service code and a first key corresponding to the discovery code suffix; Generating, by the broadcast UE, a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key; the broadcast UE broadcasts the first check code to a monitoring UE .

In the embodiment of the present invention, the broadcast UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix, including: the broadcast UE acquires from the distance-based service ProSe server and/or the ProSe functional entity. The discovery code suffix and the first key.

In the embodiment of the present invention, when the broadcast UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix, the method further includes: the broadcast UE acquiring the discovery service from the ProSe functional entity. a discovery code prefix of the code and a second key corresponding to the discovery code prefix; the method further includes: the broadcast UE generating, according to the discovery code prefix and the second key, a prefix for the discovery code The second check code for verification.

In the embodiment of the present invention, the first check code and/or the second check code are generated by the following algorithm: The hash function message authentication code - secure hash algorithm HMAC-SHA.

In the embodiment of the present invention, when the broadcast UE broadcasts the first check code to the monitoring UE, the method further includes: sending the second check code to the monitoring UE.

According to another embodiment of the present invention, a method for verifying a service code is further provided, including: monitoring, by a user equipment, UE, broadcast information broadcast by a broadcast UE; and the intercepting UE acquiring, by using the broadcast information, The second check code of the discovery code suffix of the discovery service code is checked; the interception UE checks the discovery code suffix according to the second check code.

In the embodiment of the present invention, the method further includes: the intercepting UE further acquiring, according to the broadcast information, a second check code for verifying a discovery code prefix of the discovery service code; And verifying the discovery code prefix according to the second check code.

According to another embodiment of the present invention, a method for verifying a service code is provided. The method includes: a broadcast user equipment UE acquires a prefix of the discovery service code, and obtains a suffix of the discovery service code. And obtaining a third key corresponding to the discovery service code, where the discovery service code includes: a prefix of the discovery service code, a suffix of the discovery service code; and the broadcast UE according to the discovery service code and the The third key generates a third check code for verifying the discovery service code; the broadcast UE broadcasts the third check code to the monitoring UE.

In the embodiment of the present invention, the broadcast UE acquires the prefix of the discovery service code, obtains the suffix of the discovery service code, and acquires the third key corresponding to the discovery service code, including: the broadcast UE from the ProSe function The entity obtains the prefix of the discovery service code, acquires the suffix of the discovery service code from the ProSe server, and acquires a third key corresponding to the discovery service code from the ProSe function entity.

According to another embodiment of the present invention, a verification processing apparatus for discovering a service code is further applied to a broadcast user equipment UE, including: an obtaining module, configured to acquire a discovery code suffix of the discovery service code, and the discovery a first key corresponding to the code suffix; a generating module, configured to generate a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key; The first check code is broadcast to the monitoring UE.

In the embodiment of the present invention, the acquiring module is configured to acquire the discovery code suffix and the first key from a distance-based service ProSe server.

According to another embodiment of the present invention, a verification device for discovering a service code is further provided, which is applied to the monitoring UE, and includes: a receiving module, configured to receive broadcast information broadcast by the broadcast UE; and an acquiring module, configured to Obtaining, by the broadcast information, a second check code for verifying the discovery code suffix of the discovery service code; and the verification module is configured to check the discovery code suffix according to the second check code.

After obtaining the discovery code suffix and the key corresponding to the discovery code suffix, the technical solution of generating the verification code according to the discovery code suffix and the corresponding key is solved by the related art. The problem that the code suffix proposes the technical solution of the protection, and the integrity protection of the discovery code suffix is realized, which not only prevents the risk of the code prefix being spoofed and replayed, but also prevents the discovery code suffix from being counterfeited and replayed. risks of.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a structural block diagram of a communication architecture of a D2D discovery service in the related art;

2 is a schematic flowchart of a method for limiting discovery service in the related art;

3 is a flowchart of a method for verifying a service code discovery according to an embodiment of the present invention;

4 is a structural block diagram of a check processing device for discovering a service code according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for verifying a service code according to an embodiment of the present invention; FIG.

6 is a structural block diagram of a device for verifying a service code according to an embodiment of the present invention;

7 is a flowchart of a method for broadcasting a device-to-device D2D restricted discovery service according to a preferred embodiment of the present invention;

FIG. 8 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment of the present invention; FIG.

9 is a flowchart of a method for matching a D2D restriction discovery service according to a preferred embodiment of the present invention;

10 is a flowchart of a broadcast method of a D2D restriction discovery service according to a preferred embodiment 2 of the present invention;

11 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment 2 of the present invention;

12 is a flowchart of a matching method of a D2D restriction discovery service according to a preferred embodiment 2 of the present invention;

13 is a flowchart of a broadcast method of a D2D restriction discovery service according to a preferred embodiment 3 of the present invention;

14 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment 3 of the present invention;

15 is a flowchart of a method for matching a D2D restriction discovery service according to a preferred embodiment 3 of the present invention;

FIG. 16 is another flow chart of a method for verifying a service code according to an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

Other features and advantages of the invention will be set forth in the description which follows, and in part become It will be obvious or understood by practicing the invention. The objectives and other advantages of the invention may be realized and obtained by means of the structure particularly pointed in the appended claims.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

In order to solve the above technical problem, a verification processing method for the discovery service code is provided in the embodiment, and FIG. 3 is a flowchart of a verification processing method for the discovery service code according to the embodiment of the present invention, as shown in FIG. , including the following steps:

Step S302, the broadcast user equipment UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix;

Step S304, the broadcast UE generates a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key.

Step S306, the broadcast UE broadcasts the first check code to the monitoring UE.

After obtaining the discovery code suffix and the key corresponding to the discovery code suffix, the foregoing steps can generate a verification code according to the discovery code suffix and its corresponding key, and then solve the technical solution for verifying the code suffix. In the related art, the problem of the technical solution for discovering the code suffix has not been proposed, thereby implementing the integrity protection of the discovery code suffix, not only preventing the risk of the code prefix being attacked by the spoofing attack, but also preventing the discovery code suffix. The risk of being spoofed and replayed.

Optionally, the foregoing step S302 may have multiple implementation manners. In an optional example of the embodiment of the present invention, the broadcast UE may obtain the foregoing discovery code suffix and the first first from the distance-based service ProSe server and/or the ProSe functional entity. Key.

It should be noted that, when performing the solution of step S302: when the broadcast UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix, the following process may also be performed: the foregoing broadcast UE from the ProSe functional entity Obtaining a discovery code prefix of the foregoing discovery service code and a second key corresponding to the discovery code prefix; and the broadcast UE generates a second verification for verifying the discovery code prefix according to the discovery code prefix and the second key. The code, that is, the technical solution for simultaneously verifying the discovery code prefix and the discovery code suffix at the same time is implemented in the embodiment of the present invention.

For the calculation method of calculating the discovery code suffix check code in the above step S304, the first check code and/or the second check code may be generated by the following algorithm: a hash function message authentication code-safe hash algorithm HMAC-SHA.

And, when the broadcast UE broadcasts the first check code to the monitoring UE, the broadcast UE further needs to use the second The check code is sent to the above monitoring UE.

In this embodiment, a check processing device for discovering a service code is also provided, which is applied to the broadcast user equipment UE, and is used to implement the foregoing embodiments and preferred embodiments. The modules involved in the device are described. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated. FIG. 4 is a structural block diagram of a verification processing apparatus for discovering a service code according to an embodiment of the present invention, as shown in FIG. 4:

The obtaining module 40 is configured to obtain a discovery code suffix of the discovery service code and a first key corresponding to the discovery code suffix;

The generating module 42 is connected to the obtaining module 40, and configured to generate a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key;

The broadcast module 44 is connected to the generating module 42 and configured to broadcast the first check code to the monitoring UE.

Through the comprehensive function of the above modules, after obtaining the discovery code suffix and the key corresponding to the discovery code suffix, the verification code can be generated according to the discovery code suffix and its corresponding key, and then the technical solution for verifying the discovery code suffix can be verified. The problem of the technical solution that the protection of the code suffix has not been proposed is solved, and the integrity protection of the discovery code suffix is realized, which not only prevents the risk of the code prefix being attacked by the spoofing attack, but also prevents the risk. The discovery that the code suffix is at risk of counterfeiting and replaying attacks.

A further improvement of the foregoing technical solution in the embodiment of the present invention is that the obtaining module 40 is configured to obtain the discovery code suffix and the first key from the distance-based service ProSe server.

In order to improve the overall process of the foregoing technical solution, in the embodiment of the present invention, a method for verifying a service code is also provided, and FIG. 5 is a flowchart of a method for verifying a service code according to an embodiment of the present invention. As shown in 5, the following steps are included:

Step S502: The monitoring user equipment UE receives the broadcast information broadcast by the broadcast UE.

Step S504: The monitoring UE acquires, from the broadcast information, a first check code for verifying a discovery code suffix of the discovery service code.

Step S506, the monitoring UE verifies the discovery code suffix according to the first check code.

Through the foregoing steps, the technical solution for verifying the discovery code suffix can be verified according to the discovery code suffix corresponding to the discovery code suffix of the service code in the monitored broadcast information, and the related technology is not solved for the discovery code. The suffix raises the problem of the technical solution of protection, thereby implementing the integrity protection of the discovery code suffix, not only preventing the risk of the code prefix being spoofed and replaying attacks, but also preventing the risk of the suffix being found to be counterfeited and replayed. .

Optionally, the embodiment of the present invention further provides the following technical solution: the monitoring UE further acquires according to the foregoing broadcast information. a second check code for verifying the discovery code prefix of the discovery service code; the monitoring UE checks the discovery code prefix according to the second check code, that is, the embodiment of the present invention focuses on implementing the discovery code prefix and The verification process of the code suffix is found at the same time.

In this embodiment, a device for verifying the service code is also provided, which is applied to the monitoring UE, and is used to implement the foregoing embodiment and the preferred embodiment. The module to be explained. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated. FIG. 6 is a structural block diagram of a device for verifying a service code according to an embodiment of the present invention, as shown in FIG.

The receiving module 60 is configured to receive broadcast information broadcast by the broadcast UE;

The obtaining module 62 is connected to the receiving module 60, and is configured to obtain, from the broadcast information, a first check code for verifying the discovery code suffix of the discovery service code;

The verification module 64 is connected to the acquisition module 62 and configured to verify the discovery code suffix according to the first verification code.

Through the comprehensive application of each module, the technical solution for verifying the discovery code suffix can be found according to the discovery code suffix corresponding to the discovery code suffix of the service code in the monitored broadcast information, and the related technology has not been solved yet. The problem of the technical solution for discovering the code suffix is implemented, and the integrity protection of the discovery code suffix is realized, which not only prevents the risk of the code prefix being spoofed and replayed, but also prevents the discovery code suffix from being counterfeited and replayed. The risk of an attack.

In order to better understand the verification process and the verification process of the above discovered service code, the following description will be made with reference to the preferred embodiment 1 to the preferred embodiment 3 and FIGS. 7 to 15:

Preferred embodiment 1

A preferred embodiment of the present invention provides a device-to-device restriction discovery service, wherein FIG. 7, 8, and 9 correspond to a preferred embodiment 1. The core idea of the preferred embodiment of the present invention is that during broadcast, broadcast The UE obtains the discovery code suffix and the corresponding discovery key from the ProSe functional entity, and obtains the key corresponding to the discovery code prefix from the ProSe server body, and the broadcast UE separately calculates the discovery code prefix check code and the discovery code suffix check code, and broadcasts The UE broadcasts the discovery code prefix, the discovery code suffix, and the corresponding check code discovery code prefix check code and the discovery code suffix check code, and the monitoring UE receives the broadcast information and then checks the discovery code prefix in the ProSe function entity, and applies the code prefix in the ProSe application. The server verifies the discovery code suffix.

FIG. 7 is a flowchart of a method for broadcasting a D2D restriction discovery service according to a preferred embodiment of the present invention, and the specific process is as follows:

Step S700: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, obtains the user close-range restriction service identifier from the ProSe APP Server, and discovers the code suffix and the discovery key corresponding to the discovery code suffix.

Step S702: After the UE establishes a secure connection with the ProSe functional entity under the HPLMN, the UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the user's proximity restricted service identifier, and the found service type is the restricted discovery service, and User identification, the discovery service type is the broadcast service Announce;

Step S704: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S706: If the service authentication is successful, the ProSe function entity in the HPLMN sends an authentication request to the ProSe application server, where the message carries the user close-range restricted service identifier;

Step S708: The ProSe application server finds the UE discovery identifier corresponding to the user according to the user proximity restriction service identifier, and sends an authentication response message to the ProSe function entity in the HPLMN, where the message carries the UE discovery identifier.

Step S710: The ProSe functional entity in the HLPMN authenticates the UE to discover the identifier, and after the success, allocates the discovery code prefix, and discovers the validity period of the code prefix, and finds the code prefix corresponding to the key;

Step S712: The ProSe functional entity under the HLPMN sends a broadcast authentication request to the ProSe functional entity of the VPLMN, the message carries the user close-range restricted service identifier, the user identifier, and the ProSe functional entity under the HPLMN of the UE allocates a discovery code prefix, and the discovery code prefix. Corresponding validity period;

Step S714: The ProSe functional entity under the VLPMN sends back a broadcast authentication request response message to the ProSe functional entity of the HPLMN;

Step S716: The ProSe functional entity of the HPLMN sends back a discovery service request response message to the UE. The message carries the discovery code prefix, the discovery code prefix key, and the validity period of the discovery code prefix.

The discovery code prefix is a broadcast service code allocated by the ProSe functional entity of the HPLMN of the UE to the UE, and the discovery key has a total of 128 bits. The validity period is the current time is the Greenwich Mean Time, that is, the world unified clock, and the UE is based on the current time. Set the ProSe time of the A-UE, that is, the time of the synchronization and the network, and the maximum duration and the current time constitute the discovery time slot of the discovery. That is, the validity period of the code prefix is found, and the maximum duration is invalid.

Step S718: The UE allocates radio resources, calculates a discovery code prefix check code and a discovery code suffix check code, and broadcasts a discovery code prefix, a discovery code suffix, a discovery code prefix check code, a discovery code suffix check code, and a time calculation to the air. Device.

The above check code is calculated using the signature algorithm HMAC-SHA-256. That is, the code prefix check code = HMAC-SHA-256 (discovery code prefix key, string S) is found, and the string S is composed of S=FC||P0||L0||P1||L1, where FC is Fixed length algorithm type, P0 is the broadcast time, L0 is the time length, P1 is the discovery code prefix, L1 is the length of the discovery code prefix, and the discovery code suffix check code is HMAC-SHA-256 (the discovery code suffix key, character) String S), the string S consists of S=FC||P0||L0||P1||L1, where FC is a fixed-length algorithm type, P0 is the broadcast time, L0 is the time length, and P1 is the discovery code suffix. L1 is the length of the discovery code suffix.

The time counter is the last 4 digits after the current time is intercepted to the second, that is, the maximum is 16 seconds, and can be revised for 8 seconds. Error.

FIG. 8 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment of the present invention, and the specific process is as follows;

Step S800: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, obtains the user close-range restriction service identifier from the ProSe APP Server, and finds the code suffix template, and the template can match and filter the suffix of the discovery code.

Step S802: After the ProSe function entity in the HPLMN of the UE establishes a secure connection, the UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the user's close-range restricted service identifier, and the service type is restricted to discover the service, and the discovery service is monitored. The service monitor, and the user identifier, and the application layer service transparent container, the application layer service transparent container is a target user close-range restricted service identifier list, and is transparent to the ProSe functional entity under the HPLMN, and the transparent can be implemented by using an encryption technology;

Step S804: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication and authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S806: The ProSe function entity in the HPLMN initiates an authentication request to the ProSe application server, where the authentication request carries the user close-range restricted service identifier and the application layer service transparent container;

Step S808: After the ProSe application server authenticates the user close-range restricted service identifier and the application layer service transparent container, the ProSe function entity sends an authentication request response message to the ProSe functional entity in the HPLMN, where the message carries the UE discovery identifier, and the target UE discovers the identifier and the user. Limit the list of business identifiers;

The ProSe functional entity of the other PLMN also includes the ProSe functional entity under the HPLMN corresponding to the broadcast UE. Therefore, the user close-range restricted service identifier list also includes at least one broadcast UE user close-range restricted service identifier. Similarly, the UE discovers the identifier list. Also including the UE discovery identifier of the broadcast UE;

Step S810: After the ProSe functional entity in the HPLMN authenticates the UE, the UE discovers that the identifier is successful, and determines to obtain the discovery code prefix of the target UE discovery identifier (that is, the discovery code prefix of the broadcast UE).

Step S812: The ProSe function entity in the HPLMN sends a monitoring authentication request to the ProSe functional entity of the other PLMN, and the message carries the user close-range restricted service identifier, the user identifier, the target UE discovery identifier, the service identifier, and the target user close-range restricted service identifier.

Step S814: The ProSe functional entity of the other PLMN acquires the discovery code prefix and the validity period of the broadcast UE according to the target user close-range restricted service identifier or the target UE discovery identifier.

Step S816: The ProSe functional entity of the other PLMN obtains the authentication permission from the ProSe application server, where the message carries the user close-range restricted service identifier and the target user close-range restricted service identifier;

Step S818: The ProSe application server sends an authentication permission response message to the ProSe functional entity of the other PLMN, where the message carries the UE discovery identifier and the target UE discovery identifier.

Step S820: The ProSe function entity of the other PLMN sends a monitoring authentication request response message to the ProSe function entity of the HPLMN of the UE, where the message carries the discovery code prefix and the validity period corresponding to the discovery code prefix.

Step S822: The ProSe functional entity of the HPLMN of the UE forms a discovery code prefix template according to the discovery code prefix in the interception authentication request response message, and sends a discovery service request response message to the UE. The message carries a discovery code prefix template and a corresponding validity period;

The current time is the current time of the ProSe functional entity of the HPLMN of the UE, if the ProSe functional entity time of the HPLMN of the UE has been time synchronized with the ProSe functional entity of the other PLMN, otherwise the current time carried by the monitoring authentication response request is the largest. The duration is the maximum duration of the listening authentication response request. The UE sets the ProSe clock according to the current time.

Step S824: The UE allocates radio resources, and starts to listen to the broadcast UE to send broadcast information.

FIG. 9 is a flowchart of a method for matching a D2D restriction discovery service according to the first embodiment of the present invention, and the specific process is as follows;

Step S900: After receiving the broadcast information sent by the broadcast UE, the UE finds that the discovery code prefix and the discovery code suffix of the broadcast UE are in the corresponding discovery code prefix template and the discovery code suffix template, and the discovery code prefix is found in the prefix. The template sends a matching report message to the ProSe function entity of the HPLMN of the UE. The message carries the user close-range restricted service identifier, user identifier, discovery type, service identifier, discovery code prefix, prefix check code, and discovery code suffix. a suffix check code, a time counter, and the time calculator is a revision time;

Step S902: If the ProSe functional entity has no associated UE context, the ProSe functional entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S904: The ProSe functional entity of the HPLMN of the UE sends a matching report message to the ProSe functional entity of the other PLMN, where the ProSe functional entity of the other PLMN is a ProSe functional entity of the HPLMN of the broadcast UE, and the message carries the user close-range restriction. Service identity, user identity, discovery type, service identity, discovery code prefix, discovery code prefix check code, time counter;

Step S906: The ProSe functional entity of the other PLMN checks whether the discovery code prefix check code is accurate. The verification method may verify whether the prefix check code is consistent with the ProSe functional entity by using a signature algorithm, or may be a key. The algorithm calculates the corresponding discovery code prefix and checks whether it is accurate.

Step S908: After the ProSe functional entity integrity check of the other HPLMN is successful, the matching report response message is sent back to the ProSe functional entity of the HPLMN of the UE.

Step S910: The ProSe function entity of the HPLMN of the UE sends a matching report message to the ProSe application server, where the message carries the user close-range restricted service identifier, the target user closes the service identifier, the code suffix, the discovery code suffix check code, and the time. counter;

Step S912: The ProSe application server verifies whether the discovery code suffix check code is accurate, and the verification method may be Whether the discovery code prefix check code is consistent with the ProSe application server is verified by the signature algorithm, or the corresponding discovery code prefix is calculated by the key algorithm, and the check is accurate.

Step S914: After the ProSe application server integrity check succeeds, the device sends a match report response message to the ProSe function entity of the HPLMN of the UE, where the message carries the UE discovery identifier and the discovery identifier of the target UE.

Steps S910-S914 may also be performed after the step S906, when the ProSe functional entity of the other HPLMN performs the operation to the ProSe application server, the step S904 is required to carry the response discovery code suffix and the discovery code suffix check code, and other ProSe operation modes. constant.

Step S916: The ProSe functional entity of the HPLMN of the UE verifies the UE discovery identifier and the target UE discovery identifier;

Step S918: After the ProSe functional entity of the UE is successfully authenticated, the UE sends a matching report response message to the UE, where the message carries the discovery code prefix, the service identifier, the target user close-range restricted service identifier, and the validity period corresponding to the discovery code prefix.

At this point, the listening UE discovers the broadcast UE, preventing the discovery code prefix and suffix from being counterfeited and replaying attacks, and also ensuring its integrity.

Preferred embodiment two

The preferred embodiment 2 of the present invention provides a device-to-device restriction discovery service, wherein FIG. 10, FIG. 11 and FIG. 12 correspond to a preferred embodiment 2. The core idea of the preferred embodiment 2 is that during the broadcast process, The broadcast UE ProSe server obtains the discovery code prefix, the discovery code suffix and the corresponding key, and the broadcast UE separately calculates the discovery code prefix check code and the discovery code suffix check code, the broadcast UE broadcasts the discovery code prefix, the discovery code suffix, and the corresponding The check code finds the code prefix check code and the discovery code suffix check code, and the monitoring UE receives the broadcast information and checks the discovery code prefix and the check discovery code suffix respectively in the ProSe function entity.

10 is a flowchart of a method for broadcasting a D2D restriction discovery service according to a preferred embodiment 2 of the present invention, and the specific process is as follows;

Step S1000: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, and obtains the user close-range restricted service identifier from the ProSe APP Server.

Step S1002: After the UE establishes a secure connection with the ProSe functional entity under the HPLMN, the UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the user's proximity restricted service identifier, and the found service type is the restricted discovery service, and User identification, the discovery service type is the broadcast service Announce;

Step S1004: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication and authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1006: If the service authentication is successful, the ProSe functional entity in the HPLMN sends an authentication request to the ProSe application server, where the message carries the user close-range restricted service identifier;

Step S1008: The ProSe application server finds the UE discovery identifier corresponding to the user according to the user close-range restriction service identifier, and sends an authentication response message to the ProSe function entity in the HPLMN, where the message carries the UE discovery identifier, and the message is further Contains the ProSe application server to assign a discovery code suffix.

Step S1010: The ProSe functional entity under the HLMMN authenticates the UE to discover the identifier, and after the success, allocates the discovery code prefix, and discovers the code prefix validity period, the discovery code prefix corresponding key, and the key corresponding to the discovery code suffix;

Step S1012: The ProSe functional entity under the HLPMN sends a broadcast authentication request to the ProSe functional entity of the VPLMN. The message carries the user close-range restricted service identifier, the user identifier, and the ProSe functional entity under the HPLMN of the UE allocates a discovery code prefix or a discovery code suffix. And the validity period corresponding to the discovery code prefix;

Step S1014: The ProSe functional entity under the VLPMN sends a broadcast authentication request response message to the ProSe functional entity of the HPLMN.

Step S1016: The ProSe functional entity of the HPLMN sends a discovery service request response message to the UE. The message carries the discovery code prefix, the discovery code prefix key, the discovery code suffix, the discovery code suffix key, and the validity period of the discovery code prefix.

The discovery code prefix is a broadcast service code allocated by the ProSe functional entity of the HPLMN of the UE to the UE, and the discovery key has a total of 128 bits. The validity period is the current time is the Greenwich Mean Time, that is, the world unified clock, and the UE is based on the current time. Set the ProSe time of the A-UE, that is, the time of the synchronization and the network, and the maximum duration and the current time constitute the discovery time slot of the discovery, that is, the validity period of the code prefix is found, and the maximum duration is invalid;

Step S1018: The UE allocates radio resources, calculates a discovery code prefix check code and a discovery code suffix check code, and broadcasts a discovery code prefix, a discovery code suffix, a discovery code prefix check code, a discovery code suffix check code, and a time calculation to the air. Device.

The time counter is the last 4 bits after the current time is intercepted to the second, that is, the maximum is 16 seconds, and the error of 8 seconds can be revised.

11 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment of the present invention, and the specific process is as follows;

Step S1100: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, and obtains the user close-range restricted service identifier from the ProSe APP Server.

Step S1102: After the ProSe functional entity of the UE's HPLMN establishes a secure connection, the UE sends a discovery service request message to the ProSe functional entity of the HPLMN, where the message includes the user's close-range restricted service identifier, and the service type restricts the discovery service, and the discovery service is the interception. The service monitor, and the user identifier, and the application layer service transparent container, the application layer service transparent container is a target user close-range restricted service identifier list, and is transparent to the ProSe functional entity under the HPLMN, and the transparent can be implemented by using an encryption technology;

Step S1104: If the ProSe functional entity has no associated UE context, the ProSe functional entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1106: The ProSe function entity in the HPLMN initiates an authentication request to the ProSe application server, where the authentication request carries the user close-range restricted service identifier and the application layer service transparent container;

Step S1108: After the ProSe application server authenticates the user to the proximity-restricted service identifier and the application-layer service transparent container, it sends an authentication request response message to the ProSe functional entity in the HPLMN, where the message carries the UE discovery identifier, and the target UE discovers the identifier and the user. Limit the list of business identifiers;

Step S1110: After the ProSe function entity of the HPLMN authenticates the UE, the UE obtains the discovery code prefix and the discovery code suffix of the target UE discovery identifier (that is, the discovery code prefix and the discovery code suffix of the broadcast UE).

Step S1112: The ProSe function entity in the HPLMN sends a monitoring authentication request to the ProSe functional entity of the other PLMN, and the message carries the user close-range restricted service identifier, the user identifier, the target UE discovery identifier, the service identifier, and the target user close-range restricted service identifier.

Step S1114: The ProSe functional entity of the other PLMN acquires the discovery code prefix and the validity period of the broadcast UE according to the target user close-range restricted service identifier or the target UE discovery identifier, and the discovery code suffix;

Step S1116: The ProSe functional entity of the other PLMN obtains the authentication permission from the ProSe application server, where the message carries the user close-range restricted service identifier and the target user close-range restricted service identifier;

Step S1118: The ProSe application server sends an authentication permission response message to the ProSe functional entity of the other PLMN, where the message carries the UE discovery identifier and the target UE discovery identifier.

Step S1120: The ProSe function entity of the other PLMN sends a monitoring authentication request response message to the ProSe function entity of the HPLMN of the UE, where the message carries the discovery code prefix and the validity period corresponding to the discovery code prefix, and the code suffix is found;

Step S1122: The ProSe functional entity of the HPLMN of the UE sends a discovery service request response message to the UE according to the discovery code prefix composition template in the interception authentication request response message and the discovery code suffix template according to the discovery code suffix. The message carries a discovery code prefix template, and a corresponding validity period, and a code suffix template is found;

The current time is the current time of the ProSe functional entity of the HPLMN of the UE, if the ProSe functional entity time of the HPLMN of the UE has been time synchronized with the ProSe functional entity of the other PLMN, otherwise the current time carried by the monitoring authentication response request is the largest. The duration is the maximum duration of the listening authentication response request. The UE sets the ProSe clock according to the current time;

Step S1124: The UE allocates radio resources, and starts to listen to the broadcast UE to send broadcast information.

12 is a flowchart of a method for matching a D2D restriction discovery service according to a preferred embodiment 2 of the present invention, and the specific process is as follows;

Step S1200: After receiving the broadcast information sent by the broadcast UE, the UE finds that the discovery code prefix and the discovery code suffix of the broadcast UE are in the corresponding discovery code prefix template and the discovery code suffix template, and the discovery code prefix is in the discovery code. The validity period corresponding to the prefix template sends a matching report message to the ProSe functional entity of the HPLMN of the UE, where the message carries the user close-range restricted service identifier, user identifier, discovery type, service identifier, discovery code prefix, prefix check code, and discovery code. Suffix, suffix check code, time counter, the time calculator is the revision time;

Step S1202: If the ProSe functional entity has no associated UE context, the ProSe functional entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1204: The ProSe functional entity of the HPLMN of the UE sends a matching report message to the ProSe functional entity of the other PLMN, where the ProSe functional entity of the other PLMN is a ProSe functional entity of the HPLMN of the broadcast UE, and the message carries the user close-range restriction. Service identity, user identity, discovery type, service identity, discovery code prefix, discovery code prefix check code, discovery code suffix, discovery code suffix check code, time counter;

Step S1206: The ProSe functional entity of the other PLMN checks whether the discovery code prefix check code is accurate. The verification method may verify whether the prefix check code is consistent with the ProSe functional entity by using a signature algorithm, or may be a key. The algorithm calculates the corresponding discovery code prefix and checks whether it is accurate.

Step S1208: The ProSe functional entity of the other PLMN checks whether the discovery code suffix check code is accurate. The verification method can verify whether the suffix check code is consistent with the ProSe functional entity by using a signature algorithm, or The key algorithm calculates the corresponding discovery code suffix and checks whether it is accurate.

Step S1210: After the verification succeeds, the ProSe functional entity of the other PLMN sends a matching report response message to the ProSe functional entity under the HPLMN of the UE;

Step S1212: The ProSe function entity of the HPLMN of the UE sends an authentication request message to the ProSe application server, where the message carries the user close-range restricted service identifier, and the target user closely limits the service identifier;

Step S1214: After the ProSe application server is successfully authenticated, the device sends a matching report response message to the ProSe functional entity of the HPLMN of the UE, where the message carries the UE discovery identifier and the discovery identifier of the target UE.

Step S1216: The ProSe functional entity of the HPLMN of the UE verifies the UE discovery identifier and the target UE discovery identifier;

Step S1218: After the ProSe functional entity of the UE is successfully authenticated, the UE sends a matching report response message to the UE, where the message carries the discovery code prefix, the service identifier, the target user close-range restricted service identifier, and the validity period corresponding to the discovery code prefix.

Preferred embodiment three

The preferred embodiment 3 of the present invention provides a device-to-device limitation discovery service, wherein FIG. 13, 14, and 15 correspond to the third embodiment of the present invention, and the core idea of the preferred embodiment 3 of the present invention is that during the broadcast process, the broadcast is performed. The UE obtains the discovery code suffix from the ProSe server and obtains the discovery code prefix from the ProSe functional entity, and forms a discovery code in the ProSe functional entity, and the ProSe functional entity allocates a key of the corresponding discovery code, and the broadcast UE separately calculates the discovery code check code. The broadcast UE broadcasts the discovery code prefix and the corresponding check code discovery code check code, and the monitoring UE receives the broadcast information and then checks the discovery code in the ProSe functional entity, thereby verifying the prefix and discovery of the discovery code in the ProSe functional entity. Code suffix.

13 is a flowchart of a method for broadcasting a D2D restriction discovery service according to a preferred embodiment 3 of the present invention, and the specific process is as follows;

Step S1300: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, and obtains the user close-range restricted service identifier from the ProSe APP Server.

Step S1202: After the UE establishes a secure connection with the ProSe functional entity under the HPLMN, the UE sends a discovery service request message to the ProSe functional entity in the HPLMN, where the message includes the user close-range restricted service identifier, and the discovered service type is the restricted discovery service, and User identification, the discovery service type is the broadcast service Announce;

Step S1304: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1306: If the service authentication is successful, the ProSe function entity in the HPLMN sends an authentication request to the ProSe application server, where the message carries the user close-range restricted service identifier;

Step S1308: The ProSe application server finds the UE discovery identifier corresponding to the user according to the user proximity restriction service identifier, and sends an authentication response message to the ProSe function entity in the HPLMN, where the message carries the UE discovery identifier, and the message is further Contains the ProSe application server to assign a discovery code suffix.

Step S1310: The ProSe functional entity in the HLPMN authenticates the UE to discover the identifier, and after the success, allocates the discovery code prefix, the discovery code prefix and the discovery code suffix constitute a discovery code, and the discovery code key and the discovery code validity period;

Step S1312: The ProSe functional entity under the HLPMN sends a broadcast authentication request to the ProSe functional entity of the VPLMN. The message carries the user close-range restricted service identifier, the user identifier, and the ProSe functional entity allocation discovery code under the HPLMN of the UE, and the discovery code corresponding to the discovery code. Validity period

Step S1314: The ProSe functional entity under the VLPMN sends a broadcast authentication request response message to the ProSe functional entity of the HPLMN;

Step S1316: The ProSe functional entity of the HPLMN sends back a discovery service request response message to the UE. The message carries the discovery code, the discovery code key, and the validity period of the discovery code.

The key is found to be a total of 128 bits. The validity period is the current time is the Greenwich Mean Time, that is, the world unified clock. The UE sets the ProSe time of the A-UE according to the current time, that is, the time of the synchronization and the network, and the maximum duration. The time of the discovery constitutes the discovery time slot of this discovery, that is, the validity period of the code prefix is found, and the maximum duration is invalid;

Step S1318: The UE allocates radio resources, calculates a discovery code check code, and broadcasts a discovery code discovery code check code and a time calculator to the air.

The above check code is calculated using the signature algorithm HMAC-SHA-256. That is, the code check code = HMAC-SHA-256 (discovery code key, string S) is found, and the string S is composed of S=FC||P0||L0||P1||L1, where FC is a fixed length. The algorithm type, P0 is the broadcast time, L0 is the time length, P1 is the discovery code, and L1 is the length of the discovery code.

14 is a flowchart of a method for monitoring a D2D restriction discovery service according to a preferred embodiment 3 of the present invention, and the specific process is as follows;

Step S1400: The UE obtains the service authorization from the ProSe application server, provides the discovery identifier of the UE, and obtains the user close-range restricted service identifier from the ProSe APP Server.

Step S1402: After the ProSe functional entity of the UE's HPLMN establishes a secure connection, the UE sends a discovery service request message to the ProSe functional entity of the HPLMN, where the message includes the user's close-range restricted service identifier, and the service type is restricted to discover the service, and the discovery service is monitored. The service monitor, and the user identifier, and the application layer service transparent container, the application layer service transparent container is a target user close-range restricted service identifier list, and is transparent to the ProSe functional entity under the HPLMN, and the transparent can be implemented by using an encryption technology;

Step S1404: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication and authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1406: The ProSe function entity in the HPLMN initiates an authentication request to the ProSe application server, where the authentication request carries the user close-range restricted service identifier and the application layer service transparent container;

Step S1408: After the ProSe application server authenticates the user's proximity-restricted service identifier and the application-layer service transparent container, it sends an authentication request response message to the ProSe function entity in the HPLMN, where the message carries the UE discovery identifier, and the target UE discovers the identifier and the user. Limit the list of business identifiers;

The ProSe functional entity of the other PLMN also includes the ProSe under the HPLMN corresponding to the broadcast UE. a functional entity, so the user close-range restricted service identifier list at least includes a broadcast UE user close-range restricted service identifier. Similarly, the UE discovery identifier list also includes the UE discovery identifier of the broadcast UE.

Step S1410: After the ProSe function entity of the HPLMN authenticates the UE, the UE discovers that the identifier is successful, and determines to obtain the discovery code of the target UE discovery identifier (that is, the discovery code of the broadcast UE).

Step S1412: The ProSe functional entity in the HPLMN sends a monitoring authentication request to the ProSe functional entity of the other PLMN, and the message carries the user close-range restricted service identifier, the user identifier, the target UE discovery identifier, the service identifier, and the target user close-range restricted service identifier;

Step S1414: The ProSe functional entity of the other PLMN acquires the discovery code and the validity period of the broadcast UE according to the target user close-range restricted service identifier or the target UE discovery identifier.

Step S1416: The ProSe functional entity of the other PLMN obtains the authentication permission from the ProSe application server, where the message carries the user close-range restricted service identifier and the target user close-range restricted service identifier;

Step S1418: The ProSe application server sends an authentication permission response message to the ProSe functional entity of the other PLMN, where the message carries the UE discovery identifier and the target UE discovery identifier.

Step S1420: The ProSe function entity of the other PLMN sends a monitoring authentication request response message to the ProSe function entity of the HPLMN of the UE, where the message carries the discovery code and the validity period corresponding to the corresponding discovery code;

Step S1422: The ProSe functional entity of the HPLMN of the UE sends a discovery service request response message to the UE according to the discovery code composition discovery code template in the interception authentication request response message. The message carries a discovery code template and a corresponding validity period;

Step S1424: The UE allocates radio resources, and starts to listen to the broadcast UE to send broadcast information.

15 is a flowchart of a method for matching a D2D restriction discovery service according to a preferred embodiment 3 of the present invention, and the specific process is as follows;

Step S1500: After receiving the broadcast information sent by the broadcast UE, the UE finds that the discovery code broadcast by the broadcast UE exists in the corresponding discovery code template, and the discovery code is in the validity period corresponding to the discovery code template, and then the ProSe function of the HPLMN to the UE. The entity sends a matching report message, where the message carries the user close-range restricted service identifier, user identifier, discovery type, service identifier, discovery code, discovery code check code, time counter, and the time calculator is the revision time;

Step S1502: If the ProSe function entity has no associated UE context, the ProSe function entity performs authentication service authentication and authentication with the HSS, and establishes a new UE context, where the UE context includes the subscription parameters of the UE.

Step S1504: The ProSe functional entity of the HPLMN of the UE sends a matching report message to the ProSe functional entity of the other PLMN, where the ProSe functional entity of the other PLMN is a ProSe functional entity of the HPLMN of the broadcast UE, and the message carries the user close-range restriction. Service identity, user identity, discovery type, service identity, discovery code, discovery code check code, time counter;

Step S1506: The ProSe functional entity of the other PLMN checks whether the discovery code check code is accurate. The verification method may verify whether the check code is consistent with the ProSe functional entity by using a signature algorithm, or may be calculated by a key algorithm. Corresponding discovery code, check whether it is accurate.

Step S1508: After the verification succeeds, the ProSe functional entity of the other PLMN sends a matching report response message to the ProSe functional entity under the HPLMN of the UE;

Step S1510: The ProSe function entity of the HPLMN of the UE sends an authentication request message to the ProSe application server, where the message carries the user close-range restricted service identifier, and the target user closely limits the service identifier;

Step S1512: After the ProSe application server is successfully authenticated, the device sends a matching report response message to the ProSe functional entity of the HPLMN of the UE, where the message carries the UE discovery identifier and the discovery identifier of the target UE.

Step S1514: The ProSe functional entity of the HPLMN of the UE verifies the UE discovery identifier and the target UE discovery identifier;

Step S1516: After the ProSe functional entity of the UE is successfully authenticated, the UE sends a matching report response message to the UE, where the message carries the discovery code prefix, the service identifier, the target user close-range restricted service identifier, and the validity period corresponding to the discovery code prefix.

Corresponding to the foregoing preferred embodiment 3, in the embodiment of the present invention, a method for verifying a service code is further provided, and FIG. 16 is another flowchart of a method for verifying a service code according to an embodiment of the present invention, such as As shown in Figure 16, the following steps are included:

Step S1602: The broadcast UE acquires the prefix of the discovery service code, obtains the suffix of the discovery service code, and acquires a third key corresponding to the discovery service code, where the discovery service code includes: the prefix of the discovery service code, the foregoing Discover the suffix of the service code;

Step S1604: The broadcast UE generates a third check code for verifying the discovery service code according to the discovery service code and the third key.

Step S1606: The broadcast UE broadcasts the third parity check code to the monitoring UE.

After obtaining the discovery code service code and the discovery service code corresponding key (that is, assigning a key to the discovery code prefix and the discovery code suffix), the verification code can be generated according to the corresponding key of the discovery service code. Further, the technical solution for verifying the service code is solved, and the related technology is not yet proposed for the discovery code suffix. The problem of the protected technical solution, in turn, achieves the integrity protection of the discovery code suffix, not only prevents the risk of the code prefix being spoofed by the replay attack, but also prevents the risk of the code suffix being counterfeited and replayed.

For the technical solution of the foregoing step S1602, in an optional example of the embodiment of the present invention, the following technical solutions may be implemented: the broadcast UE acquires the prefix of the discovery service code, obtains the suffix of the discovery service code, and acquires the discovery service code. The corresponding third key includes: the foregoing broadcast UE acquires the prefix of the discovery service code from the ProSe function entity, acquires the suffix of the discovery service code from the ProSe server, and acquires the third key corresponding to the discovery service code from the ProSe function entity. .

In summary, the embodiment of the present invention achieves the following technical effects: the problem of the technical solution that the protection of the code suffix has not been proposed is solved in the related art, and the integrity protection of the discovery code suffix is realized, which not only prevents the discovery. The code prefix is at risk of spoofing replay attacks, while also preventing the risk of spoofing and replay attacks being discovered.

In another embodiment, software is also provided for performing the technical solutions described in the above embodiments and preferred embodiments.

In another embodiment, a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. It is to be understood that the objects so used are interchangeable, where appropriate, so that the embodiments of the invention described herein can be carried out in a sequence other than those illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

After the foregoing technical solution provided by the present invention, after obtaining the discovery code suffix and the key corresponding to the discovery code suffix, the technical solution for generating the verification code according to the discovery code suffix and the corresponding key thereof is solved, and the related technology has not been solved yet. The problem of the technical solution for discovering the code suffix is implemented, and the integrity protection of the discovery code suffix is realized, which not only prevents the risk of the code prefix being spoofed and replayed, but also prevents the discovery code suffix from being counterfeited and replayed. The risk of an attack.

Claims

A method for verifying a service code, comprising:

The broadcast user equipment UE acquires a discovery code suffix of the discovery service code and a first key corresponding to the discovery code suffix;

Generating, by the broadcast UE, a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key;

The broadcast UE broadcasts the first check code to the listening UE.
The method according to claim 1, wherein the broadcast UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix, including:

The broadcast UE acquires the discovery code suffix and the first key from a distance-based service ProSe server and/or a ProSe functional entity.
The method of claim 1 wherein

When the broadcast UE acquires the discovery code suffix of the discovery service code and the first key corresponding to the discovery code suffix, the method further includes: the broadcast UE acquiring the discovery code prefix of the discovery service code from the ProSe functional entity and the Depicting a second key corresponding to the code prefix;

The method further includes: the broadcast UE generating a second check code for verifying the discovery code prefix according to the discovery code prefix and the second key.
The method of claim 3, wherein the first check code and/or the second check code are generated by a hash function message authentication code-secure hash algorithm HMAC-SHA.
The method according to claim 4, wherein when the broadcast UE broadcasts the first check code to the snooping UE, the method further comprises: sending the second check code to the snooping UE.
A method for verifying a service code, comprising:

Monitoring the user equipment UE to receive broadcast information broadcast by the broadcast UE;

Obtaining, by the monitoring UE, a second check code for verifying a discovery code suffix of the discovery service code from the broadcast information;

The listening UE checks the discovery code suffix according to the second check code.
The method of claim 6 wherein the method further comprises:

And the intercepting UE further acquires, according to the broadcast information, a second check code for verifying a discovery code prefix of the discovery service code;

The listening UE checks the discovery code prefix according to the second check code.
A method for verifying a service code, comprising:

The broadcast user equipment UE obtains the prefix of the discovery service code, obtains the suffix of the discovery service code, and acquires a third key corresponding to the discovery service code, where the discovery service code includes: the discovery service code a prefix, a suffix of the discovery service code;

Generating, by the broadcast UE, a third check code for verifying the discovery service code according to the discovery service code and the third key;

The broadcast UE broadcasts the third check code to the listening UE.
The method according to claim 8, wherein the broadcast UE acquires a prefix of the discovery service code, obtains a suffix of the discovery service code, and acquires a third key corresponding to the discovery service code, including: the broadcast The UE obtains the prefix of the discovery service code from the ProSe function entity, acquires the suffix of the discovery service code from the ProSe server, and acquires a third key corresponding to the discovery service code from the ProSe function entity.
A verification processing device for discovering a service code, which is applied to a broadcast user equipment UE, includes:

An acquiring module, configured to obtain a discovery code suffix of the discovery service code and a first key corresponding to the discovery code suffix;

Generating a module, configured to generate a first check code for verifying the discovery code suffix according to the discovery code suffix and the first key;

And a broadcast module, configured to broadcast the first check code to the monitoring UE.
The apparatus of claim 10, wherein the acquisition module is configured to obtain the discovery code suffix and the first key from a distance-based service ProSe server.
A verification device for discovering a service code, which is applied to the monitoring UE, includes:

a receiving module, configured to receive broadcast information broadcast by the broadcast UE;

An obtaining module, configured to obtain, from the broadcast information, a second check code for verifying a discovery code suffix of the discovery service code;

And a verification module, configured to verify the discovery code suffix according to the second verification code.