WO2016180153A1 - 业务处理方法及装置 - Google Patents

业务处理方法及装置 Download PDF

Info

Publication number
WO2016180153A1
WO2016180153A1 PCT/CN2016/079314 CN2016079314W WO2016180153A1 WO 2016180153 A1 WO2016180153 A1 WO 2016180153A1 CN 2016079314 W CN2016079314 W CN 2016079314W WO 2016180153 A1 WO2016180153 A1 WO 2016180153A1
Authority
WO
WIPO (PCT)
Prior art keywords
relay node
relay
signature
key
service identifier
Prior art date
Application number
PCT/CN2016/079314
Other languages
English (en)
French (fr)
Inventor
游世林
朱进国
彭锦
林兆骥
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016180153A1 publication Critical patent/WO2016180153A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • This document relates to, but is not limited to, the field of communications, and in particular, to a service processing method and apparatus.
  • Direct communication between devices in the vicinity using Device to Device can bring many benefits to the terminal, such as higher speed, lower latency and lower power consumption, and greatly improved.
  • the radio resource efficiency of the operator, D2D relay relay mode is beneficial to operators to improve wireless coverage; Public Safety (Public Safety) system can also use D2D technology to realize communication between terminals without wireless coverage.
  • FIG. 1 is a schematic diagram of a D2D architecture related to the 3rd Generation Partnership Project (3GPP) in the related art. As shown in FIG. 1 , the functions of the key network elements are described below.
  • 3GPP 3rd Generation Partnership Project
  • the remote UE also called the remote terminal, is in the no-radio coverage area and accesses the network through the relay node Relay UE.
  • the far terminal and the relay node Relay UE communicate directly through the D2D interface 3.
  • the Relay UE also called the relay node, is in the wireless coverage and can access the network.
  • the terminal further provides an access function to the remote terminal, so that the remote terminal accesses the network through the relay node.
  • the relay node provides the IP address and IP routing function for the far terminal.
  • EPS Evolved Packet System
  • MME Mobility Management Entity
  • SGW Serving GateWay
  • PGW Public Data Network Gateway
  • ProSe Function a close-range communication server, which mainly provides service authorization for D2D communication, assigns temporary identifiers, and assists in D2D discovery and billing functions.
  • PLMN Public Land Mobile Network
  • the letter server may take into account the roaming situation, and the ProSe Function of the relay node and the ProSe Function of the Remote UE may be different.
  • the far terminal interacts with the ProSe Function through interface 1.
  • the third-party application which mainly provides application layer services for the terminal, such as a public security server.
  • the relay node broadcasts a relay service identifier, and the far terminal receives the relay service identifier, and establishes a relay with the relay node to implement the D2D service.
  • the relay service identifier is easily attacked by the counterfeit and replay attacks.
  • the related technology has no specific measures to protect the remote terminal from using a legitimate relay node, and the relay node provides a relay service for a legitimate remote terminal.
  • the embodiment of the invention provides a service processing method and device, which can ensure that a remote terminal uses a legal relay node, or the relay node provides a relay service for a legitimate remote terminal.
  • a service processing method including: verifying whether a relay node is legal; and if the verification result is yes, performing device-to-device D2D service processing with the relay node.
  • verifying whether the relay node is legal includes: obtaining parameter information for determining a first signature parameter generated by the relay node, and generating a second signature parameter by using the parameter information; determining the generated second Whether the signature parameter is equal to the first signature parameter generated by the relay node; if the determination result is equal, determining that the relay node is legal; and/or, if the determination result is unequal, determining The relay node is illegal.
  • the first signature parameter is determined by using a first character string and a first signature key according to a signature algorithm, where the first character string is obtained by the relay node from a proximity communication server. a service identifier and an address of the relay node, wherein the first signature key is based
  • the key algorithm is determined by using a relay node identification authentication key acquired by the relay node from the short-range communication server and a random number generated by the relay node, where the short-range communication server is both a remote terminal and a medium
  • the node is provided with a service; and/or the first signature key is a relay node identification authentication key acquired by the relay node from the near-field communication server according to the key algorithm, and the relay node broadcasts Determining the international standard time at the time of broadcasting the message, the short-range communication server simultaneously provides services for the remote terminal and the relay node; wherein, when the first signature key is a relay node identifier according to the relay node When the authentication key is determined by the random number generated by the relay
  • obtaining parameter information for determining a first signature parameter generated by the relay node, and generating a second signature parameter by using the parameter information including: acquiring a relay service identifier of the relay node, and relaying Determining, by the node, an authentication key and an address of the relay node; determining, according to the relay service identifier, the first broadcast message broadcast by the relay node from two or more received broadcast messages; When the first random number is carried in the broadcast message, the second signature key is determined according to the key algorithm using the obtained relay node identifier authentication key and the determined first random number; and the determined identifier is used according to the signature algorithm.
  • the second signature key and the second character string generate the second signature parameter, where the second character string is a relay service identifier of the relay node and an address of the relay node according to the acquired And/or when the first random number is not carried in the first broadcast message, using the acquired relay node identification authentication key and the relay node to broadcast the wide according to a key algorithm
  • the second standard key is determined by the international standard time when the message is broadcasted; the second signature parameter is generated according to the signature algorithm using the determined second signature key and the second character string, wherein the second character string is based on Obtaining the relay service identifier of the relay node and the address of the relay node.
  • the first signature parameter is determined according to a third character string and a relay node identifier authentication key acquired by the relay node from a proximity communication server, where the third character string is
  • the second broadcast eliminates the relay service identifier acquired by the node from the short-range communication server, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message.
  • the relay carries the relay service identifier of the relay node and the first signature parameter.
  • obtaining parameter information for determining a first signature parameter generated by the relay node, and generating a second signature parameter by using the parameter information including: acquiring a relay service identifier of the relay node, and relaying Determining, by the node, an authentication key and an address of the relay node; determining, according to the relay service identifier, the second broadcast message broadcast by the relay node from two or more received broadcast messages;
  • the second signature parameter is generated by the service identifier, the relay node identification authentication key, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message.
  • acquiring the relay service identifier, the relay node identifier authentication key, and the address of the relay node of the relay node includes: sending a relay service for requesting acquisition of a relay node to a short-range communication server And the first request message, wherein the short-range communication server provides services for the remote terminal and the relay node, the first request message carries the authorization verification information of the remote terminal; and the receiving the short-range communication server is The authorization verification information of the remote terminal is verified, and the first response message returned after the verification is verified, where the first response message carries the relay service identifier and the relay node identifier authentication key of the relay node. And the address of the relay node.
  • acquiring the relay service identifier, the relay node identifier authentication key, and the address of the relay node of the relay node includes: sending, to the near-end communication server of the remote terminal, a request for acquiring the relay node. a second request message of the relay service identifier, where the second request message carries the authorization verification information of the remote terminal, and after the short-distance communication server of the remote terminal verifies the verification information and passes the verification, Transmitting a user identifier and location information of the remote terminal carried in the second request message to a proximity communication server of the relay node; and receiving, by the proximity communication server of the relay node, the user identifier and location of the remote terminal And a second response message returned by the information, where the second response message carries a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node.
  • performing service processing with the relay node includes: generating a third signature parameter; and transmitting at least the third signature parameter to the relay node, where The third signature parameter is used by the relay node to verify whether the remote terminal is legal; receiving a response message returned by the relay node when verifying that the third signature parameter is legal; establishing a relay with the relay node Connecting, and performing device-to-device D2D service processing with the relay node.
  • performing service processing with the relay node includes: generating a third signature parameter; sending at least the third signature parameter to a short-range communication server, where the near The distance communication server simultaneously provides services for the remote terminal and the relay node, the third signature parameter is used by the proximity communication server to verify whether the remote terminal is legal; and the receiving the short-range communication service is verifying that the third signature parameter is a response message returned in a legitimate case; establishing a relay connection with the relay node, and performing device-to-device D2D service processing with the relay node.
  • performing service processing with the relay node includes: generating a third signature parameter; and transmitting at least the third signature parameter to the relay node, where The third signature parameter is used to instruct the relay node to forward the third signature parameter to the proximity communication server of the relay node, so that the short-distance communication server of the relay node is configured according to the third signature parameter Verifying that the remote terminal is legal, and returning a second response message to the relay node if the verification result is legal; receiving a third response message returned by the relay node according to the second response message; The third response message establishes a relay connection with the relay node, and performs device-to-device D2D service processing with the relay node.
  • generating the third signature parameter includes at least one of: generating a second random number; using the second random number according to a key algorithm and acquiring by using a broadcast message broadcast by the relay node
  • the relay node identification authentication key determines a third signature key
  • the third signature parameter is determined according to the signature algorithm by using the determined third signature key and the fourth character string, wherein the fourth character string is And comprising: a relay service identifier of the relay node acquired by receiving the broadcast message broadcast by the relay node and an address of the relay node; and/or utilizing the relay node according to a key algorithm Determining a fourth signature key by an international standard time when broadcasting a broadcast message and the relay node identification authentication key acquired by receiving the broadcast message broadcast by the relay node; using the determined Determining, by the fourth signature key and the fifth character string, the third signature parameter, wherein the fifth character string is obtained according to a broadcast message broadcasted by receiving the relay node
  • a service processing method including: verifying whether a remote terminal is legal; and if the verification result is yes, performing device-to-device D2D service processing with the remote terminal.
  • the method before verifying whether the remote terminal is legal, the method further includes: at least one of: determining a relay service identifier of the relay node, and a relay service identifier authentication key; and using the relay service identifier to authenticate the secret according to the key algorithm.
  • the string is composed of the relay service identifier and an address of the relay node; the first signature parameter, the first random number, and the relay service identifier are broadcasted, and the first random number and the broadcast are broadcasted
  • the relay service identifier is used by the remote terminal to verify whether the relay node is legal, and uses the relay node to perform service processing in a legitimate case; and determines a relay service identifier and a relay service identifier of the relay node.
  • An authentication key determining, according to the key algorithm, the second signature key by using the relay service identifier authentication key and the international standard time when the relay node broadcasts the first broadcast message, and calculating according to the signature Determining, by the second signature key and the second character string, the first signature parameter, wherein the second character string is composed of the relay service identifier and an address of the relay node; broadcasting the first broadcast a message, wherein the first broadcast message carries the first signature parameter and the relay service identifier, and the broadcasted relay service identifier is used by the remote terminal to verify whether the relay node is legal, and Using the relay node to perform service processing in a legal situation; determining a relay service identifier and a relay service identifier authentication key of the relay node; and using the relay service identifier authentication key and the third character according to a signature algorithm
  • the string determines a first signature parameter, wherein the third character string is composed of the relay service identifier, an address of the relay node, and an international standard time when the
  • the method for verifying whether the remote terminal is legal or not includes: receiving, by the remote terminal, a setup request message for requesting to establish a relay connection, where the setup request message carries at least a third signature generated by the remote terminal Determining whether the third signature parameter is legal; determining that the remote terminal is legal if the third signature parameter is valid; and/or verifying that the third signature parameter is illegal Next, it is determined that the remote terminal is illegal.
  • the third signature parameter is determined by using a third signature key and a fourth character string according to a signature algorithm, where the third signature key is generated by using the remote terminal according to a key algorithm.
  • a second random number and the remote terminal determined by receiving a broadcast message broadcasted by the relay node, the fourth character string being broadcast according to the remote terminal by the receiving relay node.
  • the relay service identifier of the relay node obtained by the broadcast message and the address of the relay node are composed.
  • the establishing request message further carries the second random number generated by the remote terminal, and verifying whether the third signature parameter is legal includes at least one of: using a fifth signature key according to a signature algorithm.
  • the sixth character string determines a fourth signature parameter, where the fifth signature key is a relay service identity authentication key that is determined by the relay node according to the key algorithm and is received in the received setup request message.
  • the sixth character string is composed according to the predetermined relay service identifier and the address of the relay node; determining whether the fourth signature parameter and the third signature parameter are the same; In the same case, determining that the third signature parameter is legal; and/or, if the determination result is different, determining that the third signature parameter is illegal; forwarding the establishment request message to the relay node a proximity communication server, wherein the setup request message is used to indicate that the proximity communication server of the relay node performs the following operation: using the signature algorithm
  • the sixth signature key and the seventh character string determine a fifth signature parameter, wherein the sixth signature key is a relay service identifier authentication key that is utilized by the relay node according to the key algorithm and is carried in the setup request message Determining, by the second random number, that the seventh character string is composed according to a relay service identifier of the relay node and an address of the relay node; determining whether the fifth signature parameter and the third signature parameter are the same; If the result is the same, the third signature parameter is determined
  • the third signature parameter is determined by using a fourth signature key and a fifth character string according to a signature algorithm, where the fourth signature key is when the broadcast message is broadcast by using the relay node according to the key algorithm.
  • the international standard time is determined by the relay node identification authentication key obtained by receiving the broadcast message broadcasted by the relay node, and the fifth character string is received by the remote terminal according to the receiving terminal.
  • the relay service identifier of the relay node acquired by the broadcast broadcast message and the address of the relay node.
  • verifying whether the third signature parameter is legal includes at least one of: determining, according to the signature algorithm, a sixth signature parameter by using a seventh signature key and an eighth character string, wherein the seventh signature key is based on The key algorithm utilizes a relay service identifier authentication key and a predetermined node of the relay node.
  • the eighth character string is composed according to a predetermined relay service identifier and an address of a relay node; determining the sixth signature parameter and the Whether the third signature parameter is the same; if the determination result is the same, determining that the third signature parameter is legal; and/or, if the determination result is different, determining that the third signature parameter is illegal;
  • the setup request message is forwarded to the proximity communication server of the relay node, where the setup request message is used to indicate that the proximity communication server of the relay node performs the following operations: using the eighth signature key according to the signature algorithm and
  • the ninth character string determines a seventh signature parameter, wherein the eighth signature key is an international protocol when the relay service identifier authentication key of the relay node is used according to the key algorithm and the broadcast message is broadcast by the relay node Determined by the standard time, the ninth character string is composed according to a relay service identifier of the relay node and an address of the relay node; determining the seventh signature
  • determining a relay service identity authentication key and the relay service identifier of the relay node including: sending a short-distance communication server to a short-range communication server or a relay node for obtaining a relay service And a third request message, wherein the short-range communication server is configured to provide a server for the relay node and the remote terminal, and the third request message carries the authorization verification information of the relay node; and receives the distance communication server. Or the third response message returned by the short-distance communication server of the relay node after verifying the authorization verification information of the relay node and verifying the pass, wherein the third response message carries the relay node The relay service identification authentication key and the relay service identifier.
  • a service processing apparatus including: a first verification module, configured to verify whether a relay node is legal; and a first processing module configured to perform verification at the first verification module If the result is YES, device-to-device D2D service processing is performed with the relay node.
  • the first verification module includes: a first generating unit, configured to acquire parameter information for determining a first signature parameter generated by the relay node, and generate a second signature parameter by using the parameter information; a determining unit, configured to determine the generated second signature parameter and the relay section Whether the first signature parameters generated by the points are equal; the first determining unit is configured to determine that the relay node is legal if the determination result is equal; and/or, if the determination result is not equal, determine the The relay node is illegal.
  • a first generating unit configured to acquire parameter information for determining a first signature parameter generated by the relay node, and generate a second signature parameter by using the parameter information
  • a determining unit configured to determine the generated second signature parameter and the relay section Whether the first signature parameters generated by the points are equal
  • the first determining unit is configured to determine that the relay node is legal if the determination result is equal; and/or, if the determination result is not equal, determine the The relay node is illegal.
  • the first signature parameter is determined by using a first character string and a first signature key according to a signature algorithm, where the first character string is obtained by the relay node from a proximity communication server. a service identifier and an address of the relay node, wherein the first signature key is a relay node identifier authentication key obtained by the relay node from the near-field communication server according to a key algorithm Determining, by the random number generated by the relay node, the short-range communication server provides services for both the far terminal and the relay node; and/or, the first signature key is using the relay node according to a key algorithm Determining the relay node identification authentication key acquired from the short-range communication server and the international standard time when the relay node broadcasts the first broadcast message, the proximity communication server simultaneously provides services for the far terminal and the relay node Wherein, when the first signature key is determined according to a relay node identification authentication key of the relay node and a random number generated by the relay node, the first wide The broadcast message carries the relay service identifier
  • the first generating unit includes: a first acquiring subunit, configured to acquire a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node; Determining a subunit, configured to determine, according to the relay service identifier, the first broadcast message broadcast by the relay node from two or more received broadcast messages; the first generation subunit is set to be the first When the first random number is carried in the broadcast message, the second signature key is determined according to the key algorithm using the obtained relay node identifier authentication key and the determined first random number; and the determined identifier is used according to the signature algorithm.
  • the second signature key and the second character string generate the second signature parameter, where the second character string is a relay service identifier of the relay node and an address of the relay node according to the acquired And/or, when the first random number is not carried in the first broadcast message, using the acquired relay node identifier authentication key and the relay node to broadcast the according to a key algorithm Broadcast elimination
  • the second standard key is determined by the international standard time; the second signature is generated according to the signature algorithm using the determined second signature key and the second character string, wherein the second word
  • the string is composed of the obtained relay service identifier of the relay node and the address of the relay node.
  • the first signature parameter is determined according to a third character string and a relay node identifier authentication key acquired by the relay node from a proximity communication server, where the third character string is
  • the second broadcast message carries the second broadcast message, which is composed of a relay service identifier obtained by the node from the short-range communication server, an address of the relay node, and an international standard time when the relay node broadcasts the second broadcast message. a relay service identifier of the relay node and the first signature parameter.
  • the first generating unit includes: a second acquiring subunit, configured to acquire a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node; Determining a subunit, configured to determine, according to the relay service identifier, the second broadcast message broadcast by the relay node from two or more received broadcast messages; and the second generation subunit, configured to be according to the relay
  • the second signature parameter is generated by the service identifier, the relay node identification authentication key, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message.
  • the first obtaining subunit or the second acquiring subunit is configured to: send, to the near field communication server, a first request message for requesting to acquire a relay service identifier of the relay node, where
  • the short-range communication server provides services for the remote terminal and the relay node, and the first request message carries the authorization verification information of the remote terminal; and the receiving the proximity communication server verifies the authorization verification information of the remote terminal.
  • verifying the first response message that is returned after the pass wherein the first response message carries the relay service identifier of the relay node, the relay node identifier authentication key, and the address of the relay node.
  • the first obtaining subunit or the second acquiring subunit is configured to: send a second request message for requesting to acquire a relay service identifier of the relay node to the near field communication server of the remote terminal,
  • the second request message carries the authorization verification information of the remote terminal, and the short-distance communication server of the remote terminal carries the second request message after verifying the authorization verification information and verifying the passage.
  • the user identifier and the location information of the remote terminal are sent to the short-distance communication server of the relay node; the second response message that is received by the short-distance communication server of the relay node according to the user identifier and the location information of the remote terminal, where The second response message carries a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node.
  • the first processing module includes: a second generating unit, configured to generate a third signature parameter, where the first sending unit is configured to send the third signature parameter to the relay node, where The third signature parameter is set to whether the relay node verifies whether the remote terminal is legal; the first receiving unit is configured to receive a response message that is returned by the relay node when verifying that the third signature parameter is legal; The first processing unit is configured to establish a relay connection with the relay node, and perform device-to-device D2D service processing with the relay node.
  • the first processing module includes: a third generating unit configured to generate a third signature parameter; and a second sending unit configured to send the third signature parameter to the near-range communication server, where The short-range communication server simultaneously provides services for the remote terminal and the relay node, the third signature parameter is used by the short-range communication server to verify whether the remote terminal is legal; and the second receiving unit is configured to receive the short-range communication service. a response message returned in the case of verifying that the third signature parameter is legal; the second processing unit is configured to establish a relay connection with the relay node, and perform device-to-device D2D service processing with the relay node .
  • the first processing module includes: a fourth generating unit, configured to generate a third signature parameter; and a third sending unit, configured to send the third signature parameter to the relay node, where
  • the third signature parameter is used to instruct the relay node to forward the third signature parameter to a short-range communication server of the relay node, so that the short-distance communication server of the relay node is according to the third Determining, by the signature parameter, whether the remote terminal is legal, and returning a second response message to the relay node if the verification result is legal;
  • the third receiving unit is configured to receive the relay node according to the second response message Returning a third response message;
  • the third processing unit is configured to establish a relay connection with the relay node according to the third response message, and perform device-to-device D2D service processing with the relay node.
  • the second generating unit, the third generating unit, or the fourth generating unit is configured to: generate a second random number; utilize the second random number according to a key algorithm, and by receiving the Determining, by the relay node, a broadcast message, the relay node identification authentication key to determine a third signature key; determining the third signature by using the determined third signature key and the fourth character string according to a signature algorithm a parameter, wherein the fourth character string is composed of a relay service identifier of the relay node acquired by receiving a broadcast message broadcast by the relay node, and an address of the relay node; and/or International standard time when the broadcast message is broadcast by the relay node according to a key algorithm Determining a fourth signature key by using the relay node identification authentication key acquired by receiving the broadcast message broadcast by the relay node; using the determined fourth signature key and fifth character according to a signature algorithm Determining, by the string, the third signature parameter, wherein the fifth character string is a relay service identifier of the relay node acquired according to a broadcast
  • a service processing apparatus including: a second verification module configured to verify whether a remote terminal is legal; and a second processing module configured to verify a result in the second verification module In the case of YES, device-to-device D2D service processing is performed with the far terminal.
  • the method further includes: at least one of the following: a first determining module, configured to determine a relay service identifier and a relay service identifier authentication key of the relay node before verifying whether the remote terminal is legal; the second determining module, setting Determining, by the key algorithm, the first signature key by using the relay service identity authentication key and the first random number generated by the relay node, and using the first signature key and the first character according to a signature algorithm Determining, by the string, a first signature parameter, where the first character string is composed of the relay service identifier and an address of the relay node; the first broadcast module is configured to broadcast the first signature parameter, the first a random number and the relay service identifier, the first random number broadcasted and the relay service identifier are used by the remote terminal to verify whether the relay node is legal, and the legal use case
  • the relay node performs service processing; the third determining module is configured to determine the relay service identifier and the relay service identifier authentication key of the relay node before verifying whether the
  • the fifth determining module is configured to determine a relay service identifier and a relay service identifier authentication key of the relay node before verifying whether the remote terminal is legal;
  • Six determining module, set to the third based signature algorithm Determining, by the relay service identifier authentication key and the third character string, the first signature parameter, wherein the third character string is represented by the relay service identifier, an address of the relay node, and the relay node
  • the second standard broadcast module is configured to broadcast the second broadcast message, where the second broadcast message carries the relay service identifier of the relay node and the The first signature parameter, the broadcasted relay service identifier is used by the remote terminal to verify whether the relay node is legal, and the service processing is performed by using the relay node in a legal situation.
  • the second verification module includes: a fourth receiving unit, configured to receive, by the remote terminal, a setup request message for requesting to establish a relay connection, where the setup request message carries at least the a third signature parameter generated by the remote terminal; the verification unit is configured to verify whether the third signature parameter is legal; and the second determining unit is configured to determine the remote terminal if the third signature parameter is valid If it is legal; and/or, if it is verified that the third signature parameter is illegal, it is determined that the remote terminal is illegal.
  • a fourth receiving unit configured to receive, by the remote terminal, a setup request message for requesting to establish a relay connection, where the setup request message carries at least the a third signature parameter generated by the remote terminal
  • the verification unit is configured to verify whether the third signature parameter is legal
  • the second determining unit is configured to determine the remote terminal if the third signature parameter is valid If it is legal; and/or, if it is verified that the third signature parameter is illegal, it is determined that the remote terminal is illegal.
  • the third signature parameter is determined by using a third signature key and a fourth character string according to a signature algorithm, where the third signature key is generated by using the remote terminal according to a key algorithm. And determining, by the remote terminal, the relay node identification authentication key obtained by receiving the broadcast message broadcasted by the relay node, where the fourth character string is a broadcast broadcast according to the remote terminal by receiving the relay node.
  • the relay service identifier of the relay node obtained by the message and the address of the relay node are composed.
  • the establishing request message further carries the second random number generated by the remote terminal, where the verification unit is configured to verify whether the third signature parameter is legal by at least one of: according to the signature
  • the algorithm determines a fourth signature parameter by using a fifth signature key and a sixth character string, wherein the fifth signature key is a relay service identifier authentication key and a received location determined by the relay node according to the key algorithm.
  • the sixth character string is composed according to a predetermined relay service identifier and an address of the relay node; determining the fourth signature parameter and the third signature Whether the parameters are the same; if the judgment result is the same, determining that the third signature parameter is legal; and/or, if the determination result is different, determining that the third signature parameter is illegal;
  • the request message is forwarded to the proximity communication server of the relay node, wherein the setup request message is used to indicate that the relay node's short-range communication server performs the following Operation: determining the fifth signature parameter by using the sixth signature key and the seventh character string according to the signature algorithm a number, wherein the sixth signature key is determined according to a key algorithm using a relay service identity authentication key of the relay node and a second random number carried in the setup request message, the seventh string And determining whether the fifth signature parameter and the third signature parameter are the same according to the relay service identifier of the relay node and the address of the relay node; and
  • the third signature parameter is determined by using a fourth signature key and a fifth character string according to a signature algorithm, where the fourth signature key is when the broadcast message is broadcast by using the relay node according to the key algorithm.
  • the international standard time is determined by the relay node identification authentication key obtained by receiving the broadcast message broadcasted by the relay node, and the fifth character string is received by the remote terminal according to the receiving terminal.
  • the relay service identifier of the relay node acquired by the broadcast broadcast message and the address of the relay node.
  • the verification unit is configured to verify whether the third signature parameter is legal by using at least one of: determining, according to the signature algorithm, a sixth signature parameter by using a seventh signature key and an eighth character string, where
  • the seventh signature key is determined according to a key algorithm using a relay service identifier authentication key predetermined by the relay node and an international standard time when the relay node broadcasts the broadcast message, the eighth string And determining, according to the predetermined relay service identifier and the address of the relay node, determining whether the sixth signature parameter and the third signature parameter are the same; if the determination result is the same, determining the third signature parameter If it is legal; and/or, if the judgment result is different, determining that the third signature parameter is illegal; forwarding the establishment request message to a proximity communication server of the relay node, wherein the establishment request message A short-range communication server for indicating the relay node performs an operation of: determining, by using a eighth signature key and a ninth character string according to a signature algorithm a seven-signature parameter, where
  • the determining module is configured to implement determining the relay of the relay node by: a service identification authentication key and the relay service identifier: transmitting, to a short-range communication server of the short-range communication server or the relay node, a third request message for obtaining a relay service identifier, wherein the short-range communication server And a server for providing a relay node and a remote terminal, wherein the third request message carries the authorization verification information of the relay node; and the short-distance communication server that receives the distance communication server or the relay node is in the The authorization verification information of the relay node is verified and the third response message returned after the verification is verified, wherein the third response message carries the relay service identifier authentication key of the relay node and the relay service identifier.
  • the relay node it is verified whether the relay node is legal; if the verification result is yes, the device-to-device D2D service processing is performed with the relay node, so that the remote terminal can ensure that the remote terminal uses a legal relay node, or
  • the relay node provides a relay service for a legitimate remote terminal, thereby achieving the effect of ensuring that the remote terminal uses a legitimate relay node.
  • FIG. 1 is a schematic diagram of a D2D architecture related to 3GPP in the related art
  • FIG. 2 is a flowchart of a first service processing method according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a second service processing method according to an embodiment of the present invention.
  • FIG. 4 is a first structural block diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of a first verification module 42 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 6 is a structural block diagram 1 of a first generating unit 52 in a service processing apparatus according to an embodiment of the present invention
  • FIG. 7 is a second structural block diagram of a first generating unit 52 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 8 is a structural block diagram 1 of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 9 is a second structural block diagram of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 10 is a block diagram 3 of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 11 is a block diagram showing a second structure of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 12 is a block diagram showing an optional structure of a second structural block diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 13 is a structural block diagram of a second verification module 112 in a service processing apparatus according to an embodiment of the present invention.
  • FIG. 14 is a flowchart 1 of a method for authenticating a relay node in a D2D service in a non-roaming situation according to an embodiment of the present invention
  • 15 is a second flowchart of a relay node authentication method in a D2D service in a non-roaming situation according to an embodiment of the present invention
  • 16 is a flowchart 1 of a method for authenticating a relay node in a D2D service in a roaming situation according to an embodiment of the present invention
  • 17 is a second flowchart of a relay node authentication method in a D2D service in a roaming situation according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a first service processing method according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:
  • Step S202 verifying whether the relay node is legal
  • step S204 if the verification result is yes, the device-to-device D2D service processing is performed with the relay node.
  • the step of performing the foregoing steps may be a remote terminal, thereby ensuring that the remote terminal authenticates the relay node before performing the D2D service processing with the relay node, and ensures that the remote terminal uses a legal relay node, or
  • the relay node provides a relay service for a legitimate remote terminal, thereby achieving the effect of ensuring that the remote terminal uses a legitimate relay node.
  • verifying whether the relay node is legal comprises: obtaining parameter information for determining a first signature parameter generated by the relay node, and using the parameter information to generate a second signature parameter; determining the generated second Whether the signature parameter is equal to the first signature parameter generated by the relay node; if the judgment result is equal, determining that the relay node is legal; and/or, if the judgment result is unequal, determining that the relay node is illegal . That is to say, when the parameter information used by the relay node to generate the signature parameter is successfully obtained, the relay node to be D2D service processing is a legal relay node, so that the legal relay node can be used for D2D service. deal with.
  • the first signature parameter is determined by using a first character string and a first signature key according to a signature algorithm, where the first character string is obtained by the relay node from the short-range communication server.
  • the service identifier and the address of the relay node are formed.
  • the method for determining the first signature key may be multiple.
  • the first signature key may be that the first signature key is used by the relay node according to the key algorithm.
  • the proximity node identification authentication key obtained by the proximity communication server and the random number generated by the relay node determine that the short-range communication server provides services for both the far terminal and the relay node; another determination method is: first The signature key is determined according to the international standard time when the relay node identifies the authentication key acquired by the relay node from the short-range communication server and the relay node broadcasts the first broadcast message according to the key algorithm, and the short-distance communication server is simultaneously The remote terminal and the relay node provide services; wherein, when the first signature key is a relay node identification authentication key according to the relay node and by the relay node When the random number is determined, the first broadcast message carries the relay service identifier of the relay node, the first signature parameter, and the first random number; when the first signature key is the authentication of the relay node identifier according to the relay node When the international standard time when the key and the relay node broadcast the first broadcast message is determined, the first broadcast message carries the relay service identifier of the relay node and the first signature parameter
  • acquiring parameter information for determining a first signature parameter generated by the relay node, and generating the second signature parameter by using the parameter information includes: acquiring a relay service identifier of the relay node, and relaying The node identifies the authentication key and the address of the relay node; according to the relay service identifier Determining, by the received two broadcast messages, a first broadcast message broadcast by the relay node; when the first broadcast message carries the first random number, using the acquired relay node identifier authentication key and the determined Determining, by the first random number, a second signature key; generating, according to the signature algorithm, the second signature parameter by using the determined second signature key and the second character string, wherein the second character string is a relay according to the acquired relay node And the service identifier and the address of the relay node are formed; and/or, when the first broadcast message does not carry the first random number, the obtained relay node identifier authentication key and the relay node broadcast broadcast are used according to the key algorithm.
  • the international standard time at the time of the message determines the second signature key; the second signature parameter is generated according to the signature algorithm using the determined second signature key and the second character string, wherein the second character string is based on the acquired relay node
  • the trunk service identifier and the address of the relay node are composed.
  • the first signature parameter is determined according to the third character string and the relay node identifier authentication key obtained by the relay node from the proximity communication server, where the third string is relayed.
  • the relay service identifier obtained by the node from the short-range communication server, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message, and the second broadcast message carries the relay service identifier of the relay node and First signature parameter.
  • acquiring parameter information for determining a first signature parameter generated by the relay node, and generating the second signature parameter by using the parameter information includes: acquiring a relay service identifier of the relay node, and relaying Determining, by the node, an authentication key and an address of the relay node; determining, according to the relay service identifier, a second broadcast message broadcast by the relay node from the received two or more broadcast messages; and authenticating according to the relay service identifier and the relay node identifier
  • the second signature parameter is generated by the key, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message.
  • acquiring the relay service identifier of the relay node, the relay node identifier authentication key, and the address of the relay node include: sending a relay for requesting acquisition of the relay node to the proximity communication server The first request message of the service identifier, wherein the proximity communication server provides services for the remote terminal and the relay node at the same time, the first request message carries the authorization verification information of the remote terminal, and the proximity communication server receives the authorization verification of the remote terminal. The information is verified, and the first response message returned after the verification is verified, wherein the first response message carries the relay service identifier of the relay node, the relay node identifier authentication key, and the address of the relay node.
  • acquiring the relay service identifier of the relay node, the relay node identifier authentication key, and the address of the relay node include: sending the short-distance communication server to the remote terminal for requesting Obtaining a second request message of the relay service identifier of the relay node, where the second request message carries the authorization verification information of the remote terminal, and the short-distance communication server of the remote terminal verifies the authorization verification information and passes the verification Transmitting the user identifier and location information of the remote terminal carried in the second request message to the proximity communication server of the relay node; and receiving the second response of the proximity communication server of the relay node according to the user identifier and the location information of the remote terminal a message, where the second response message carries a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node.
  • performing service processing by using the relay node includes: generating a third signature parameter; and transmitting at least the third signature parameter to the relay node, where the third signature The parameter is used by the relay node to verify whether the far terminal is legal; the receiving relay node returns a response message when the third signature parameter is valid; establishing a relay connection with the relay node, and performing device-to-device with the relay node D2D business processing.
  • performing service processing by using the relay node includes: generating a third signature parameter; and transmitting at least the third signature parameter to the short-range communication server, where the close-range
  • the communication server provides services for the remote terminal and the relay node at the same time, and the third signature parameter is used for the proximity communication server to verify whether the remote terminal is legal; and the response message returned by the proximity communication service in the case of verifying that the third signature parameter is legal; Establish a relay connection with the relay node, and perform device-to-device D2D service processing with the relay node.
  • performing service processing by using the relay node includes: generating a third signature parameter; and transmitting at least the third signature parameter to the relay node, where the third signature The parameter is used to instruct the relay node to forward the third signature parameter to the short-distance communication server of the relay node, so that the short-distance communication server of the relay node verifies whether the far terminal is legal according to the third signature parameter, and the verification result is legal.
  • returning a second response message to the relay node receiving a third response message returned by the relay node according to the second response message; establishing a relay connection with the relay node according to the third response message, and performing equipment with the relay node Go to device D2D service processing.
  • generating the third signature parameter includes at least one of: generating a second random number; using the second random number and the relay acquired by receiving the broadcast message broadcasted by the relay node according to the key algorithm Determining, by the signature algorithm, a third signature key; determining, by the signature algorithm, a third signature parameter by using the determined third signature key and the fourth character string, wherein the fourth character string is a root According to the relay service identifier of the relay node acquired by receiving the broadcast message broadcasted by the relay node and the address of the relay node; and/or the international standard time when the broadcast message is broadcast by the relay node according to the key algorithm Determining a fourth signature key by using a relay node identification authentication key acquired by receiving a broadcast message broadcast by the relay node; determining a third signature parameter by using the determined fourth signature key and the fifth character string according to the signature algorithm, wherein The fifth character string is composed of a relay service identifier of the relay node acquired by the broadcast message broadcasted by the receiving relay node and
  • FIG. 3 is a flowchart of a second service processing method according to an embodiment of the present invention. As shown in FIG. 3, the method includes the following steps:
  • Step S302 verifying whether the remote terminal is legal
  • step S304 if the verification result is yes, the device-to-device D2D service processing is performed with the far terminal.
  • the step of performing the foregoing steps may be a relay node.
  • the relay node may first verify whether the remote terminal is legal, and if it is legal, and then the remote terminal.
  • the D2D service processing can ensure that the remote terminal uses a legal relay node, or the relay node provides a relay service for a legitimate remote terminal, thereby ensuring that the relay node provides a relay service for a legitimate remote terminal. effect.
  • the method before verifying whether the remote terminal is legal, further includes: at least one of: determining a relay service identifier of the relay node, and a relay service identifier authentication key; and utilizing the relay service according to the key algorithm. Determining, by the identifier authentication key, the first random number generated by the relay node, the first signature key, and determining, by using the first signature key and the first character string, the first signature parameter according to the signature algorithm, where the first string is determined by Following the service identifier and the address of the relay node; broadcasting the first signature parameter, the first random number, and the relay service identifier, and the first random number broadcasted and the relay service identifier are used by the remote terminal to verify whether the relay node is legal, and Using a relay node for service processing in a legitimate case; determining a relay service identifier of the relay node and a relay service identity authentication key; using the relay service identity authentication key and the relay node to broadcast the first according to the key algorithm International standard time determination
  • the verification that the remote terminal is legal may have multiple authentication manners, for example, the verification may be performed by: receiving an establishment request message sent by the remote terminal for requesting to establish a relay connection, where the establishment is performed.
  • the request message carries at least a third signature parameter generated by the remote terminal; whether the third signature parameter is valid; if the third signature parameter is valid, the remote terminal is determined to be legal; and/or, the third signature is verified. If the parameter is illegal, it is illegal to determine the far terminal.
  • the foregoing third signature parameter may be determined by using a third signature key and a fourth character string according to a signature algorithm, where the third signature key is generated by using a remote terminal according to a key algorithm.
  • the second random number and the remote terminal are determined by the relay node identification authentication key obtained by receiving the broadcast message broadcasted by the relay node, and the fourth character string is obtained according to the broadcast message broadcast by the remote terminal through the receiving relay node.
  • the setup request message further carries a second random number generated by the remote terminal, and whether the third signature parameter is legally included includes at least one of: using the fifth signature key and the sixth character according to the signature algorithm Determining, by the string, the fourth signature parameter, wherein the fifth signature key is determined by using a relay service identifier authentication key predetermined by the relay node and a second random number carried in the received setup request message according to the key algorithm,
  • the sixth character string is composed according to the predetermined relay service identifier and the address of the relay node; determining whether the fourth signature parameter and the third signature parameter are the same; If the result of the disconnection is the same, determining that the third signature parameter is legal; and/or, if the determination result is different, determining that the third signature parameter is illegal; and transmitting the setup request message to the relay node for short-range communication a server, wherein the setup request message is used to indicate that the proximity communication server of the relay node performs an operation of: determining, according to the signature algorithm, the fifth signature parameter by
  • the third signature parameter is determined according to the signature algorithm using the fourth signature key and the fifth character string, wherein the fourth signature key is broadcasted by the relay node according to the key algorithm.
  • the international standard time at the time of the message and the remote terminal are determined by the relay node identification authentication key acquired by receiving the broadcast message broadcasted by the relay node, and the fifth character string is based on the broadcast message broadcast by the remote terminal through the receiving relay node.
  • the obtained relay node's relay service identifier and the address of the relay node are composed.
  • verifying whether the third signature parameter is legal includes at least one of: determining a sixth signature parameter by using a seventh signature key and an eighth character string according to a signature algorithm, wherein the seventh signature key The eighth character string is determined according to a predetermined relay service identifier and relay according to a key algorithm that utilizes a relay service identifier authentication key predetermined by the relay node and an international standard time when the relay node broadcasts the broadcast message.
  • the address of the node is composed; determining whether the sixth signature parameter and the third signature parameter are the same; if the determination result is the same, determining that the third signature parameter is legal; and/or, if the determination result is different, determining The third signature parameter is illegal; the setup request message is forwarded to the proximity communication server of the relay node, wherein the setup request message is used to indicate that the proximity communication server of the relay node performs the following operation: using the eighth signature key according to the signature algorithm And determining a seventh signature parameter by the ninth string, wherein the eighth signature key is a relay node according to the key algorithm The relay service identification authentication key and the international standard time when the relay node broadcasts the broadcast message are determined, and the ninth character string is composed of the relay service identifier of the relay node and the address of the relay node; determining the seventh signature parameter Whether the third signature parameter is the same; if the judgment result is the same, determining that the third signature parameter is legal; and/or, if the judgment result is different, determining the first The three
  • the method may include: sending the short-distance communication server to the short-range communication server or the short-distance communication server of the relay node a third request message for obtaining a relay service identifier, wherein the short-range communication server is configured to provide a server for the relay node and the remote terminal at the same time, and the third request message carries the authorization verification information of the relay node;
  • the third response message returned by the short-distance communication server of the server or the relay node after verifying the authorization verification information of the relay node and verifying the pass, wherein the third response message carries the relay service identifier authentication secret of the relay node Key and relay service ID.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present invention.
  • a service processing device is also provided, which is used to implement the foregoing embodiments and optional implementations, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 4 is a first structural block diagram of a service processing apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes a first verification module 42 and a first processing module 44, which will be described below.
  • the first verification module 42 is configured to verify whether the relay node is legal.
  • the first processing module 44 is connected to the first verification module 42 and is configured to be in the case that the verification result of the first verification module 42 is YES.
  • the node performs device-to-device D2D service processing.
  • FIG. 5 is a structural block diagram of a first verification module 42 in a service processing apparatus according to an embodiment of the present invention.
  • the first verification module 42 includes a first generation unit 52, a determination unit 54, and a first determination unit 56.
  • the first verification module 42 will be described below.
  • the first generating unit 52 is configured to acquire parameter information for determining a first signature parameter generated by the relay node, and generate a second signature parameter by using the parameter information;
  • the determining unit 54 is connected to the first generating unit 52, and is configured to To determine whether the generated second signature parameter is equal to the first signature parameter generated by the relay node, the first determining unit 56 is connected to the determining unit 54 and configured to determine that the relay node is legal if the determination result is equal. And/or, in the case where the judgment result is unequal, it is determined that the relay node is illegal.
  • the first signature parameter is determined by using a first character string and a first signature key according to a signature algorithm, and the first character string is obtained by the relay node from the proximity communication server.
  • the service identifier and the address of the relay node wherein the first signature key is a relay node identification authentication key acquired by the relay node from the short-range communication server according to the key algorithm, and a random number generated by the relay node Determining that the short-range communication server provides services for both the far terminal and the relay node; and/or, the first signature key is a relay node identifier authentication secret obtained from the near-field communication server by using the relay node according to the key algorithm.
  • the international standard time determines that the short-range communication server provides services for both the far terminal and the relay node; wherein, when the first signature key is a relay node according to the relay node When the identification authentication key and the random number generated by the relay node are determined, the first broadcast message carries the relay service identifier of the relay node, and the first signature parameter And the first random number; when the first signature key is determined according to the relay node identification authentication key of the relay node and the international standard time when the relay node broadcasts the first broadcast message, the first broadcast message is carried in The relay service identifier and the first signature parameter of the node.
  • FIG. 6 is a structural block diagram 1 of a first generating unit 52 in a service processing apparatus according to an embodiment of the present invention.
  • the first generating unit 52 includes a first obtaining subunit 62, a first determining subunit 64, and The first generation subunit 66 will be described below with respect to the first generation unit 52.
  • the first obtaining sub-unit 62 is configured to acquire a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node; the first determining sub-unit 64 is connected to the first acquiring sub-unit 62, The first broadcast message broadcasted by the relay node is determined from the received two or more broadcast messages according to the relay service identifier; the first generation sub-segment 66 is connected to the first determining sub-unit 64, When the first broadcast message carries the first random number, the second signature key is determined according to the key algorithm using the obtained relay node identifier authentication key and the determined first random number; and the determined identifier is used according to the signature algorithm.
  • the second signature key is determined according to the key algorithm using the obtained relay node identifier authentication key and the international standard time when the relay node broadcasts the broadcast message;
  • the second signature key and the second character string generate a second signature parameter, wherein the second character string is composed according to the obtained relay service identifier of the relay node and the address of the relay node.
  • the first signature parameter is determined according to the third character string and the relay node identifier authentication key acquired by the relay node from the proximity communication server, and the third string is determined by the relay node.
  • the relay service identifier obtained from the short-range communication server, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message, and the second broadcast message carries the relay service identifier of the relay node and the A signature parameter.
  • FIG. 7 is a structural block diagram 2 of a first generating unit 52 in a service processing apparatus according to an embodiment of the present invention.
  • the first generating unit 52 includes a second obtaining subunit 72, a second determining subunit 74, and The second generation subunit 76 will be described below for the first generation subunit 52.
  • the second obtaining sub-unit 72 is configured to acquire a relay service identifier of the relay node, a relay node identifier authentication key, and an address of the relay node, and a second determining sub-unit 74 connected to the second acquiring sub-unit 72, And being configured to determine, according to the relay service identifier, the second broadcast message broadcasted by the relay node from the received two or more broadcast messages; the second generation sub-segment 76 is connected to the second determining sub-unit 74, and is configured to be according to the relay service.
  • the identifier, the relay node identification authentication key, the address of the relay node, and the international standard time when the relay node broadcasts the second broadcast message generate a second signature parameter.
  • the first obtaining sub-unit 62 or the second obtaining sub-unit 72 is configured to: send a first request for requesting acquisition of a relay service identifier of the relay node to the near-field communication server.
  • the message wherein the proximity communication server provides services for the remote terminal and the relay node at the same time, the first request message carries the authorization verification information of the remote terminal; the receiving proximity communication server verifies the authorization verification information of the remote terminal, and verifies The first response message returned by the first response message, wherein the first response message carries the relay service identifier of the relay node, and the relay node identifier is authenticated.
  • the first obtaining sub-unit 62 or the second obtaining sub-unit 72 is configured to: send a request for acquiring a relay service identifier of the relay node to the short-range communication server of the remote terminal.
  • the second request message wherein the second request message carries the authorization verification information of the remote terminal, and the short-distance communication server of the remote terminal authenticates the authorization verification information and passes the verification, and then the user of the remote terminal carried in the second request message
  • the second communication message is sent to the short-distance communication server of the relay node; the second response message returned by the short-distance communication server of the receiving node according to the user identifier and the location information of the remote terminal, wherein the second response message carries the relay The relay service ID of the node, the relay node ID authentication key, and the address of the relay node.
  • FIG. 8 is a block diagram of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • the first processing module 44 includes a second generating unit 82, a first sending unit 84, and a first The receiving unit 86 and the second processing unit 88 describe the first processing module 44 below.
  • the second generating unit 82 is configured to generate a third signature parameter.
  • the first sending unit 84 is connected to the second generating unit 82, and is configured to send at least the third signature parameter to the relay node, where the third signature parameter For the relay node to verify whether the remote terminal is legal;
  • the first receiving unit 86 is connected to the first sending unit 84, and is configured to receive a response message returned by the relay node when verifying that the third signature parameter is legal;
  • the processing unit 88 is connected to the first receiving unit 86, is configured to establish a relay connection with the relay node, and performs device-to-device D2D service processing with the relay node.
  • FIG. 9 is a second structural block diagram of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • the first processing module 44 includes a third generating unit 92, a second sending unit 94, and a second.
  • the receiving unit 96 and the second processing unit 98, the first processing module 44 will be described below.
  • the third generating unit 92 is configured to generate a third signature parameter
  • the second sending unit 94 is connected to the third generating unit 92, and is configured to send at least the third signature parameter to the short-range communication server, wherein the short-range communication
  • the server provides services for the remote terminal and the relay node, and the third signature parameter is used for the proximity communication server to verify whether the remote terminal is legal.
  • the second receiving unit 96 is connected to the second sending unit 94 and configured to receive the short-range communication. The service returns a response message when the third signature parameter is valid; the second processing unit 98 is connected to the second receiving unit 96, It is set up to establish a relay connection with the relay node and perform device-to-device D2D service processing with the relay node.
  • FIG. 10 is a block diagram 3 of a first processing module 44 in a service processing apparatus according to an embodiment of the present invention.
  • the first processing module 88 includes a fourth generating unit 102, a third sending unit 104, and a third.
  • the receiving unit 106 and the third processing unit 108 describe the first processing module 88 below.
  • the fourth generating unit 102 is configured to generate a third signature parameter
  • the third sending unit 104 is connected to the fourth generating unit 102, and is configured to send at least a third signature parameter to the relay node, where the third signature parameter And a method for instructing the relay node to forward the third signature parameter to the short-distance communication server of the relay node, so that the short-distance communication server of the relay node verifies whether the remote terminal is legal according to the third signature parameter, and the verification result is legal And returning a second response message to the relay node;
  • the third receiving unit 106 is connected to the third sending unit 104, and configured to receive a third response message that is returned by the relay node according to the second response message;
  • the foregoing second generating unit 82, the third generating unit 84 or the fourth generating unit 86 is configured to: generate a second random number; utilize the second random number according to the key algorithm and pass the receiving relay a relay node identification authentication key obtained by the broadcast message broadcast by the node determines a third signature key; determining a third signature parameter by using the determined third signature key and the fourth character string according to the signature algorithm, wherein the fourth string Comprising the relay service identifier of the relay node acquired according to the broadcast message broadcasted by the receiving relay node and the address of the relay node; and/or an international standard when the broadcast message is broadcasted by the relay node according to the key algorithm Determining a fourth signature key by using a relay node identification authentication key acquired by receiving a broadcast message broadcasted by the relay node; determining a third signature parameter by using the determined fourth signature key and the fifth character string according to the signature algorithm,
  • the fifth character string is a relay service identifier of the relay node and an address of
  • FIG. 11 is a block diagram showing a second structure of a service processing apparatus according to an embodiment of the present invention. As shown in FIG. 11, the apparatus includes a second verification module 112 and a second processing module 114, which will be described below.
  • the second verification module 112 is configured to verify whether the remote terminal is legal.
  • the second processing module 114 is connected to the second verification module 112, and is configured to perform the verification with the remote terminal if the verification result of the second verification module 112 is YES.
  • Device to device D2D service processing is configured to perform the verification with the remote terminal if the verification result of the second verification module 112 is YES.
  • FIG. 12 is an optional structural block diagram of a second structural block diagram of a service processing apparatus according to an embodiment of the present invention.
  • the apparatus includes a first determining module 122 in addition to all the modules shown in FIG.
  • the apparatus includes, in addition to all the modules shown in FIG. 11, a fifth determining module 1214, a sixth determining module 1216, and a third broadcast module 1218, which are described below.
  • the first determining module 122 is configured to determine a relay service identifier and a relay service identifier authentication key of the relay node before verifying whether the remote terminal is legal.
  • the second determining module 124 is connected to the first determining module 122, and is configured to Determining, by using a relay service identifier authentication key and a first random number generated by the relay node according to the key algorithm, a first signature key, and determining, according to the signature algorithm, the first signature parameter by using the first signature key and the first character string
  • the first character string is composed of the relay service identifier and the address of the relay node;
  • the first broadcast module 126 is connected to the second determining module 124 and the second verification module 112, and is configured to broadcast the first signature parameter,
  • the first random number and the relay service identifier, the broadcasted first random number and the relay service identifier are used by the remote terminal to verify whether the relay node is legal, and the relay node is used for service processing in a legitimate situation;
  • the third determining module 128 is configured to determine a relay service identifier and a relay service identifier authentication key of the relay node before verifying whether the remote terminal is legal.
  • the fourth determining module 1210 is connected to the third determining module 128, and is configured to Determining a second signature key according to an international standard time when the relay service identification authentication key and the relay node broadcast the first broadcast message according to the key algorithm, and determining by using the second signature key and the second character string according to the signature algorithm a first signature parameter, wherein the second character string is composed of a relay service identifier and an address of the relay node;
  • the second broadcast module 1212 is connected to the fourth determining module 1210 and the second verification module 112, and is set to broadcast a broadcast message, where the first broadcast message carries a first signature parameter and a relay service identifier, and the broadcast relay service identifier is used by the remote terminal to verify whether the relay node is legal, and the relay node is used in a legitimate situation.
  • the fifth determining module 1214 is configured to determine a relay service identifier and a relay service identifier authentication key of the relay node before verifying whether the remote terminal is legal.
  • the sixth determining module 1216 is connected to the fifth determining module 1214, and configured. Determining, by the third signature algorithm, a first signature parameter by using a relay service identifier and a third string, where the third string is broadcasted by the relay service identifier, the address of the relay node, and the relay node.
  • the international standard time component of the broadcast message; the third broadcast module 1218 is connected to the sixth determining module 1216 and the second verifying module 112, and is configured to broadcast a second broadcast message, where the second broadcast message carries the relay node
  • the relay service identifier and the first signature parameter are used by the remote terminal to verify whether the relay node is legal, and the relay node is used for service processing in a legitimate situation.
  • FIG. 13 is a structural block diagram of a second verification module 112 in a service processing apparatus according to an embodiment of the present invention. As shown in FIG. 13, the second verification module 112 includes a fourth receiving unit 132, a verification unit 134, and a second determining unit 136. The second verification module 112 will be described below.
  • the fourth receiving unit 132 is configured to receive a setup request message sent by the remote terminal for requesting to establish a relay connection, where the setup request message carries at least a third signature parameter generated by the remote terminal, and the verification unit 134 is connected to the foregoing
  • the fourth receiving unit 132 is configured to verify whether the third signature parameter is legal;
  • the second determining unit 136 is connected to the verification unit 134, and is configured to determine that the remote terminal is legal when the third signature parameter is verified to be legal; / or, in the case of verifying that the third signature parameter is illegal, it is determined that the remote terminal is illegal.
  • the third signature parameter is determined by using a third signature key and a fourth character string according to a signature algorithm, where the third signature key is generated by using a remote terminal according to a key algorithm.
  • the second random number and the remote terminal are determined by the relay node identification authentication key acquired by receiving the broadcast message broadcasted by the relay node, and the fourth character string is obtained according to the broadcast message broadcast by the remote terminal through the receiving relay node. It is composed of the relay service identifier of the node and the address of the relay node.
  • the foregoing setup request message further carries a second random number generated by the remote terminal
  • the verification unit 134 is configured to: determine, according to the signature algorithm, the fourth signature parameter by using the fifth signature key and the sixth character string.
  • the fifth signature key is determined according to the key algorithm using the relay service identifier authentication key predetermined by the relay node and the second random number carried in the received setup request message, and the sixth character string is based on the advance The determined relay service identifier and the address of the relay node; Determining whether the fourth signature parameter and the third signature parameter are the same; determining that the third signature parameter is legal if the determination result is the same; and/or determining that the third signature parameter is illegal if the determination result is different Transmitting the setup request message to the proximity communication server of the relay node, wherein the setup request message is used to instruct the proximity communication server of the relay node to perform the following operation: using the sixth signature key and the seventh character according to the signature algorithm
  • the string determines a fifth signature parameter, wherein the sixth signature key is
  • the third signature parameter is determined by using a fourth signature key and a fifth character string according to a signature algorithm, wherein the fourth signature key is broadcast by using a relay node according to a key algorithm.
  • the international standard time at the time of broadcasting the message and the remote terminal are determined by the relay node identification authentication key acquired by receiving the broadcast message broadcasted by the relay node, and the fifth character string is a broadcast message broadcasted by the remote terminal according to the receiving relay node.
  • the obtained relay node's relay service identifier and the address of the relay node are composed.
  • the verification unit 134 is configured to: determine, according to the signature algorithm, the sixth signature parameter by using the seventh signature key and the eighth character string, wherein the seventh signature key is utilized according to the key algorithm.
  • the relay node identifies the relay service identifier authentication key and the international standard time when the relay node broadcasts the broadcast message, and the eighth character string is composed according to the predetermined relay service identifier and the address of the relay node; Whether the sixth signature parameter and the third signature parameter are the same; if the determination result is the same, determining that the third signature parameter is legal; and/or, if the determination result is different, determining that the third signature parameter is illegal Transmitting a request message to a proximity communication server of the relay node, wherein the setup request message is used to instruct the proximity communication server of the relay node to perform an operation of: utilizing the eighth signature key and the ninth string according to the signature algorithm Determining a seventh signature parameter, wherein the eighth signature key is a relay service identifier recognized by the relay node according to the key algorithm
  • the method when determining the relay service identifier authentication key and the relay service identifier of the relay node, includes: sending to the short-range communication server of the short-range communication server or the relay node for strong acquisition a third request message of the relay service identifier, wherein the short-range communication server is configured to provide a server for the relay node and the remote terminal at the same time, and the third request message carries the authorization verification information of the relay node; the receiving distance communication server or the relay The third-response message returned by the short-distance communication server of the node after verifying the authorization verification information of the relay node and verifying the pass, wherein the third response message carries the relay service identity authentication key and the relay of the relay node Business identity.
  • the authentication modes provided in the embodiments of the present invention are mainly as follows: 1 is that the remote terminal authenticates the relay node, the relay node authenticates the far terminal, and 2 the remote terminal authenticates the relay node, and the relay node is near.
  • the communication server authenticates the far terminal.
  • FIG. 14 is a flowchart 1 of a method for authenticating a relay node in a D2D service in a non-roaming situation, in which a relay node is in the same carrier network as a remote terminal, and thus is relayed.
  • the short-distance communication server of the node is the same as the short-distance communication server of the far terminal.
  • the far-end short-range communication server/relay node short-distance communication server described below is a short-distance communication server that serves both the relay node and the far terminal.
  • the process includes the following steps:
  • Step S1401 After the relay node establishes a secure link with the remote terminal short-distance communication server/relay node close-range communication server, the relay node initiates a relay service identifier acquisition to the remote terminal short-range communication server/relay node close-range communication server.
  • the request message, the relay service identifier acquisition request message further carries a relay node user identifier, and optionally, the message carries a relay indication, and the message further carries the location information of the user;
  • Step S1402 The remote terminal short-distance communication server/relay node short-distance communication server performs authorization authentication, and determines whether the relay function is allowed in the subscription information of the user;
  • Step S1403 If the authorization is successful, the remote terminal short-distance communication server/relay node close-range communication server sends a relay service identifier acquisition request response message to the relay node, where the message carries the relay service identifier and the relay service identifier authentication key. And the duration of the validity period (which may or may not carry Take the validity period);
  • Step S1405 When there is a coverage area in the remote terminal, and there is no local subscription service identifier in the remote terminal, or the relay service identifier has expired, establish a secure link with the remote terminal short-distance communication server/relay node close-range communication server.
  • the remote terminal initiates a relay service identifier acquisition request message to the remote terminal short-distance communication server/relay node short-range communication server, and the message further carries the far-end terminal user identifier, the message carries the accessed operator network identifier, and The local carrier network identifier, where the accessed carrier network identifier is the same as the relay node, and the message also carries the location information of the user;
  • Step S1406 The remote terminal short-distance communication server/relay node short-distance communication server performs authorization authentication, performs authorization authentication, determines whether the subscription information of the user allows access to the network through the relay node, and the access network that authorizes authentication. And local carrier authorization information;
  • Step S1407 If the authorization is successful, the remote terminal short-distance communication server/relay node short-distance communication server sends a relay service identifier acquisition request response message to the remote terminal, and the message carries the relay service identifier, the relay service identifier authentication key, and Validity period;
  • Step S1408 The far terminal enters the uncovered area, allocates radio resources, and listens to the relay node broadcast;
  • string is composed of the relay service identifier and the layer 2 address of the far terminal, and the random number may also be an international standard time counter;
  • Step S1411 The remote terminal initiates a relay establishment request message to the relay node, where the message carries the signature parameter A.
  • the message may also carry a random number.
  • the relay service identifier and the layer 2 address of the relay node are composed to verify whether A and B are equal. If they are equal, they are legal far terminals; the random number may also be an international standard time counter on the relay node;
  • Step S1413 After the relay node is successfully authenticated, the relay establishment request response message is sent back to the remote terminal, and the remote terminal can implement the D2D service through the relay node.
  • FIG. 15 is a flowchart 2 of a method for authenticating a relay node in a D2D service in a non-roaming situation according to an embodiment of the present invention, in which a relay node and a remote terminal are in the same carrier network, and thus the relay node
  • the proximity communication server is the same as the proximity communication server of the far terminal. The process includes the following steps:
  • Step S1501 After the relay node establishes a secure link with the remote terminal short-distance communication server/relay node close-range communication server, the relay node initiates a relay service identifier acquisition to the remote terminal short-range communication server/relay node close-range communication server. a request message, where the message further carries a relay node user identifier, and optionally, the message carries a relay indication, and further carries the location information of the user;
  • Step S1502 The remote terminal short-distance communication server/relay node short-distance communication server performs authorization authentication, and determines whether the relay function is allowed in the subscription information of the user;
  • Step S1503 If the authorization is successful, the remote terminal short-distance communication server/relay node short-distance communication server sends a relay service identifier acquisition request response message to the relay node, and the message carries the relay service identifier and the relay service identifier authentication key. And the length of validity;
  • Step S1504 the relay node allocates radio resources, generates a random number, starts broadcasting, and
  • Step S1505 When the remote terminal has a coverage area, and there is no local subscription service identifier in the remote terminal, or the relay service identifier has expired, establish a secure link with the remote terminal short-distance communication server/relay node close-range communication server. Then, the remote terminal initiates a relay service identifier acquisition request message to the remote terminal short-distance communication server/relay node short-range communication server, and the message further carries the far-end terminal user identifier, and the message also carries the accessed operator network identifier. And the local carrier network identifier, the accessed carrier network identifier is the same as the remote terminal and the relay node, and the message may also carry the location information of the user;
  • Step S1506 The remote terminal short-distance communication server/relay node close-range communication server performs authorization authentication, performs authorization authentication, determines whether the subscription information of the user allows access to the network through the relay node, and the access network that authorizes authentication. And local carrier authorization information;
  • step S1507 if the authorization is successful, the remote terminal short-distance communication server/relay node short-distance communication server sends a relay service identifier acquisition request response message to the remote terminal, where the message carries the relay service identifier and the relay service identifier authentication key. And the duration of the validity period;
  • Step S1508 the far terminal enters the uncovered area, allocates radio resources, and listens to the relay node broadcast;
  • string is composed of the relay service identifier and the layer 2 address of the far terminal, and the random number may also be an international standard time counter;
  • Step S1511 The remote terminal initiates a relay establishment request message to the relay node, where the message carries the signature parameter A.
  • the message may also carry a random number.
  • the step is S1512.
  • the relay node forwards a relay establishment request message to the remote terminal short-distance communication server/relay node short-range communication server, where the message carries the relay service identifier authentication key.
  • the message may also carry a random Number or international standard time counter;
  • Step S1514 after the remote terminal short-distance communication server/relay node short-distance communication server successfully verifies, the relay establishment request response message is sent back to the relay node;
  • step S1515 the relay node sends a relay establishment request response message to the remote terminal, and the remote terminal can implement the D2D service through the relay node.
  • 16 is a flowchart 1 of a method for authenticating a relay node in a D2D service in a roaming situation according to an embodiment of the present invention, in which a relay node and a remote terminal are in different carrier networks, and thus the relay node
  • the proximity communication server is not the same as the proximity communication server of the far terminal. The process includes the following steps:
  • Step S1601 After the relay node establishes a secure link with the relay node proximity communication server, the relay node initiates a relay service identifier acquisition request message to the relay node short-range communication server, where the message carries the relay node user identifier.
  • the message carries a relay indication and also carries the location information of the user;
  • Step S1602 The relay node short-distance communication server performs authorization authentication, and determines whether the relay function is allowed in the subscription information of the user.
  • Step S1603 If the authorization is successful, the relay node near-distance communication server sends a relay service identifier acquisition request response message to the relay node, where the message carries the relay service identifier, the relay service identifier authentication key, and the validity period;
  • the international standard time counter there is no need to broadcast random numbers, and the international standard time counter is used instead of the random number;
  • Step S1605 When the remote terminal has a coverage area, and there is no local subscription service identifier in the remote terminal, or the relay service identifier has expired, and the remote terminal establishes a secure link with the remote terminal proximity communication server, the far terminal approaches the far terminal.
  • the communication server initiates a relay service identifier acquisition request message, and the message further carries a remote terminal user identifier, where the message carries the accessed operator network identifier, and the local operator network identifier, and the accessed carrier network identifier remote terminal and The relay node is different, and the message also carries the location information of the user;
  • Step S1606 The remote terminal short-distance communication server performs authorization authentication, performs authorization authentication, and determines whether the subscription information of the user is allowed to access the network through the relay node, and the authorized authentication access network and the local operator authorization information;
  • Step S1607 If the authorization is successful, the remote terminal proximity communication server sends a relay service identifier listening request message to the relay node short-distance communication server of the authorized operator, where the message carries the location information of the far terminal and the far terminal user identifier;
  • Step S1608 The relay node short-distance communication server of the authorized operator selects the relay service identifier of the relay node near the far terminal and the corresponding valid period relay service identifier authentication key according to the location information of the far terminal, and approaches the far terminal.
  • the communication server sends back a relay service identifier listening request message, where the message carries a relay service identifier, a relay service identifier authentication key, and a validity period;
  • Step S1609 The remote terminal short-distance communication server sends a relay service identifier acquisition request response message to the remote terminal, where the message carries the relay service identifier, the relay service identifier authentication key, and the validity period;
  • Step S1610 The far terminal enters the uncovered area, allocates radio resources, and listens to the relay node broadcast;
  • string is composed of the relay service identifier and the layer 2 address of the far terminal, and the random number may also be an international standard time counter;
  • Step S1613 The remote terminal initiates a relay establishment request message to the relay node, where the message carries the signature parameter A, and optionally carries a random number.
  • the relay service identifier and the layer 2 address of the relay node are composed to verify whether A and B are equal. If they are equal, they are legal far terminals; the random number may also be an international standard time counter on the relay node;
  • Step S1615 After the relay node successfully authenticates, the relay establishment request response message is sent back to the remote terminal, and the remote terminal can implement the D2D service through the relay node.
  • FIG. 17 is a second flowchart of a relay node authentication method in a D2D service in a roaming situation according to an embodiment of the present invention, in which a relay node and a remote terminal are in different carrier networks, and thus the relay node is near It is different from the proximity server of the communication server and the far terminal.
  • the process includes the following steps:
  • Step S1701 After the relay node establishes a secure link with the relay node proximity communication server, the relay node initiates a relay service identifier acquisition request message to the relay node short-range communication server, and the message further carries the relay node user identifier.
  • the message carries a relay indication and also carries the location information of the user;
  • Step S1702 The relay node proximity communication server performs authorization authentication, and determines whether the relay function is allowed in the subscription information of the user.
  • Step S1703 if the authorization is successful, the relay node close communication server returns to the relay node.
  • the string is composed of the relay service identifier and the layer 2 address of the relay node, and a standard time counter;
  • Step S1705 When the remote terminal has a coverage area, and there is no local subscription service identifier in the remote terminal, or the relay service identifier has expired, after establishing a secure link with the far terminal proximity communication server, the far terminal is closer to the far terminal.
  • the communication server initiates a relay service identifier acquisition request message, and the message further carries a remote terminal user identifier, where the message carries the accessed operator network identifier, and the local carrier network identifier, and the accessed carrier network identifier is far
  • the terminal is the same as the relay node, and the message also carries the location information of the user;
  • Step S1706 The remote terminal short-distance communication server performs authorization authentication, performs authorization authentication, determines whether the subscription information of the user allows access to the network through the relay node, and the authorized authentication access network and local carrier authorization information;
  • Step S1707 If the authorization is successful, the remote terminal short-distance communication server sends a relay service identifier listening request message to the relay node short-distance communication server of the authorized operator, where the message carries the location information of the far terminal and the far terminal user identifier;
  • Step S1708 The relay node short-distance communication server of the authorized operator selects the relay service identifier of the relay node in the vicinity of the remote terminal and the corresponding valid period relay service identifier authentication key according to the location information of the remote terminal, and approaches the far terminal.
  • the communication server sends back a relay service identifier listening request message, where the message carries a relay service identifier, a relay service identifier authentication key, and a validity period;
  • Step S1709 The remote terminal short-distance communication server sends a relay service identifier acquisition request response message to the remote terminal, where the message carries the relay service identifier, the relay service identifier authentication key, and the validity period;
  • Step S1710 The remote terminal enters the uncovered area, allocates radio resources, and listens to the relay node broadcast;
  • string is composed of the relay service identifier and the layer 2 address of the far terminal, and the random number may also be an international standard time counter;
  • Step S1713 The remote terminal initiates a relay establishment request message to the relay node, where the message carries the signature parameter A, and optionally the message also carries a random number;
  • Step S1714 The relay node forwards a relay establishment request message to the relay node short-range communication server, where the message carries a relay service identifier authentication key, and optionally the message also carries a random number or an international standard time counter;
  • the character string consists of the relay service identifier and the layer 2 address of the relay node, and verifies whether A and B are equal. If they are equal, they are legal far terminals; the random number may also be an international standard time counter on the relay node;
  • Step S1716 after the relay node short-distance communication server successfully verifies, return a relay establishment request response message to the relay node;
  • Step S1717 The relay node sends a relay establishment request response message to the remote terminal, and the remote terminal can implement the D2D service through the relay node.
  • the signature algorithm may be: a Hash-based Message Authentication Code (MAC)-Secure Hash Algorithm (SHA)-256.
  • MAC Message Authentication Code
  • SHA Secure Hash Algorithm
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • the processor performs the above steps S11-S12 according to the stored program code in the storage medium.
  • the processor performs the above steps S21-S22 according to the stored program code in the storage medium.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any particular hardware and software. Combine.
  • the foregoing technical solution can ensure that the remote terminal uses a legal relay node, or the relay node provides a relay service for a legitimate remote terminal, thereby achieving the effect of ensuring that the remote terminal uses a legal relay node.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种业务处理方法及装置，其中，该方法包括：验证中继节点是否合法；在验证结果为是的情况下，与中继节点进行设备到设备D2D业务处理。上述技术方案实现了远终端使用一个合法的中继节点，进而达到了保证远终端使用一个合法的中继节点的效果。

Description

业务处理方法及装置 技术领域
本文涉及但不限于通信领域，具体而言，涉及一种业务处理方法及装置。
背景技术
临近区域的终端利用设备到设备(Device to Device，简称为D2D)直接通信能够给终端带来很多好处，比如更高的速率，更低的延迟以及更小的功耗，同时也极大地提高了运营商的无线资源效率，D2D的中继Relay模式有利于运营商提高无线覆盖；公共安全(Public Safety)系统也可以利用D2D技术实现没有无线覆盖的情况下终端之间的通讯。
图1是相关技术中和第三代合作伙伴计划(3rd Generation Partnership Project，简称为3GPP)相关的D2D架构示意图，如图1所示，重点网元的功能说明如下。
Remote UE，也叫远终端，该终端处于无无线覆盖范围内，通过中继节点Relay UE接入网络。远终端和中继节点Relay UE之间通过D2D接口3直接通信。
Relay UE，也叫中继节点，该终端处于有无线覆盖范围内，能够接入网络。同时该终端还给远终端提供接入功能，使得远终端通过该中继节点接入网络。中继节点为远终端提供分配IP地址以及IP路由功能。
演进分组系统(Evolved Packet System，简称为EPS)，包括无线接入网演进节点eNodeB和核心网移动管理实体(Mobility Management Entity，简称为MME)、服务网管(Serving GateWay，简称为SGW)以及公共数据网网管(Public Data Network Gateway，简称为PGW)，为中继节点提供接入通道。
ProSe Function，近距离通信服务器，该服务器主要提供D2D通信的业务授权，分配临时标识、协助进行D2D发现和计费等功能。目前一个公共陆地移动网络(Public Land Mobile Network，简称为PLMN)只部署一个近距离通 信服务器，考虑到漫游情况，中继节点的ProSe Function和Remote UE的ProSe Function可能不同。远终端通过接口1和ProSe Function交互。
第三方应用Application，主要为终端提供应用层业务，例如公共安全服务器等。
在相关技术中，中继节点广播一个中继业务标识，远终端接收到中继业务标识，同中继节点建立中继，实现D2D业务。但是中继业务标识容易被仿冒和重放攻击，相关技术还没有具体措施来保护远终端使用一个合法的中继节点，中继节点为一个合法的远终端提供中继业务。
针对相关技术中存在的无法保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务的问题，目前尚未提出有效的解决方案。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供了一种业务处理方法及装置，可以保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务。
根据本发明实施例的一个方面，提供了一种业务处理方法，包括：验证中继节点是否合法；在验证结果为是的情况下，与所述中继节点进行设备到设备D2D业务处理。
可选地，验证中继节点是否合法包括：获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数；判断生成的所述第二签名参数与所述中继节点生成的第一签名参数是否相等；在判断结果为相等的情况下，确定所述中继节点合法；和/或，在判断结果为不相等的情况下，确定所述中继节点为非法。
可选地，所述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，所述第一字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识和所述中继节点的地址组成，其中，所述第一签名密钥为根据 密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由所述中继节点生成的随机数确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；和/或，所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；其中，当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和由所述中继节点生成的随机数确定时，所述第一广播消息中携带所述中继节点的中继业务标识、所述第一签名参数和所述第一随机数；当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定时，所述第一广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
可选地，获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数包括：获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第一广播消息；当所述第一广播消息中携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和确定的所述第一随机数确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或当所述第一广播消息中未携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，所述第一签名参数为根据第三字符串和所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，所述第三字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成，所述第二广播消 息中携带所述中继节点的中继业务标识和所述第一签名参数。
可选地，获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数包括：获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第二广播消息；根据所述中继业务标识、中继节点标识认证密钥、所述中继节点的地址和所述中继节点广播所述第二广播消息时的国际标准时间生成所述第二签名参数。
可选地，获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址包括：向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第一请求消息中携带远终端的授权验证信息；接收所述近距离通讯服务器在对所述远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，所述第一响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
可选地，获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址包括：向远终端的近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第二请求消息，其中，所述第二请求消息中携带远终端的授权验证信息，所述远终端的近距离通讯服务器在对所述授权验证信息进行验证且验证通过后，将所述第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；接收所述中继节点的近距离通讯服务器根据所述远终端的用户标识和位置信息返回的第二响应消息，其中，所述第二响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
可选地，在验证结果为是的情况下，与所述中继节点进行业务处理包括：生成第三签名参数；至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于所述中继节点验证远终端是否合法；接收所述中继节点在验证所述第三签名参数为合法的情况下返回的响应消息；与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，在验证结果为是的情况下，与所述中继节点进行业务处理包括：生成第三签名参数；至少将所述第三签名参数发送给近距离通讯服务器，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第三签名参数用于所述近距离通讯服务器验证远终端是否合法；接收所述近距离通讯服务在验证所述第三签名参数为合法的情况下返回的响应消息；与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，在验证结果为是的情况下，与所述中继节点进行业务处理包括：生成第三签名参数；至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于指示所述中继节点向所述中继节点的近距离通讯服务器转发所述第三签名参数，以使所述中继节点的近距离通讯服务器根据所述第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向所述中继节点返回第二响应消息；接收所述中继节点根据所述第二响应消息返回的第三响应消息；根据所述第三响应消息与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，生成所述第三签名参数包括以下至少之一：生成第二随机数；根据密钥算法利用所述第二随机数和通过接收所述中继节点广播的广播消息而获取的所述中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的所述第三签名密钥和第四字符串确定所述第三签名参数，其中，所述第四字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，根据密钥算法利用所述中继节点广播广播消息时的国际标准时间和通过接收所述中继节点广播的所述广播消息而获取的所述中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的所述第四签名密钥和第五字符串确定所述第三签名参数，其中，所述第五字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
根据本发明实施例的另一方面，提供了一种业务处理方法，包括：验证远终端是否合法；在验证结果为是的情况下，与所述远终端进行设备到设备D2D业务处理。
可选地，在验证远终端是否合法之前，还包括以下至少之一：确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用所述中继业务标识认证密钥和所述中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用所述第一签名密钥和第一字符串确定第一签名参数，其中，所述第一字符串由所述中继业务标识和所述中继节点的地址组成；广播所述第一签名参数、所述第一随机数和所述中继业务标识，广播的所述第一随机数和所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用所述中继业务标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定第二签名密钥，并根据签名算法利用所述第二签名密钥和第二字符串确定第一签名参数，其中，所述第二字符串由所述中继业务标识和所述中继节点的地址组成；广播所述第一广播消息，其中，所述第一广播消息中携带所述第一签名参数和所述中继业务标识，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；确定中继节点的中继业务标识、中继业务标识认证密钥；根据签名算法利用所述中继业务标识认证密钥和第三字符串确定第一签名参数，其中，所述第三字符串由所述中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成；广播所述第二广播消息，其中，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理。
可选地，验证远终端是否合法，包括：接收所述远终端发送的用于请求建立中继连接的建立请求消息，其中，所述建立请求消息中至少携带所述远终端生成的第三签名参数；验证所述第三签名参数是否合法；在验证所述第三签名参数为合法的情况下，确定所述远终端为合法；和/或，在验证所述第三签名参数为非法的情况下，确定所述远终端为非法。
可选地，所述第三签名参数为根据签名算法利用第三签名密钥和第四字符串确定的，其中，所述第三签名密钥为根据密钥算法利用所述远终端生成 的第二随机数和所述远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，所述第四字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，所述建立请求消息中还携带所述远终端生成的所述第二随机数，验证所述第三签名参数是否合法包括以下至少之一：根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，所述第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的所述建立请求消息中携带的第二随机数确定的，所述第六字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第四签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参数，其中，所述第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述建立请求消息中携带的第二随机数确定的，所述第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第五签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
可选地，所述第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，所述第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和所述远终端通过接收中继节点广播的所述广播消息而获取的中继节点标识认证密钥确定的，所述第五字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，验证所述第三签名参数是否合法包括以下至少之一：根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，所述第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和所 述中继节点广播所述广播消息时的国际标准时间确定的，所述第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第六签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，所述第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第七签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
可选地，确定所述中继节点的中继业务标识认证密钥和所述中继业务标识，包括：向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，所述近距离通讯服务器用于同时为中继节点和远终端提供服务器，所述第三请求消息中携带中继节点的授权验证信息；接收所述距离通讯服务器或者所述中继节点的近距离通讯服务器在对所述中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，所述第三响应消息中携带所述中继节点的中继业务标识认证密钥和所述中继业务标识。
根据本发明实施例的另一方面，提供了一种业务处理装置，包括：第一验证模块，设置为验证中继节点是否合法；第一处理模块，设置为在所述第一验证模块的验证结果为是的情况下，与所述中继节点进行设备到设备D2D业务处理。
可选地，所述第一验证模块包括：第一生成单元，设置为获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数；判断单元，设置为判断生成的所述第二签名参数与所述中继节 点生成的第一签名参数是否相等；第一确定单元，设置为在判断结果为相等的情况下，确定所述中继节点合法；和/或，在判断结果为不相等的情况下，确定所述中继节点为非法。
可选地，所述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，所述第一字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识和所述中继节点的地址组成，其中，所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由所述中继节点生成的随机数确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；和/或，所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；其中，当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和由所述中继节点生成的随机数确定时，所述第一广播消息中携带所述中继节点的中继业务标识、所述第一签名参数和所述第一随机数；当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定时，所述第一广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
可选地，所述第一生成单元包括：第一获取子单元，设置为获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；第一确定子单元，设置为根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第一广播消息；第一生成子单元，设置为当所述第一广播消息中携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和确定的所述第一随机数确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，当所述第一广播消息中未携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字 符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，所述第一签名参数为根据第三字符串和所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，所述第三字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
可选地，所述第一生成单元包括：第二获取子单元，设置为获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；第二确定子单元，设置为根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第二广播消息；第二生成子单元，设置为根据所述中继业务标识、中继节点标识认证密钥、所述中继节点的地址和所述中继节点广播所述第二广播消息时的国际标准时间生成所述第二签名参数。
可选地，所述第一获取子单元或所述第二获取子单元是设置为：向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第一请求消息中携带远终端的授权验证信息；接收所述近距离通讯服务器在对所述远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，所述第一响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
可选地，所述第一获取子单元或所述第二获取子单元是设置为：向远终端的近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第二请求消息，其中，所述第二请求消息中携带远终端的授权验证信息，所述远终端的近距离通讯服务器在对所述授权验证信息进行验证且验证通过后，将所述第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；接收所述中继节点的近距离通讯服务器根据所述远终端的用户标识和位置信息返回的第二响应消息，其中，所述第二响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
可选地，所述第一处理模块包括：第二生成单元，设置为生成第三签名参数；第一发送单元，设置为至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数设置为所述中继节点验证远终端是否合法；第一接收单元，设置为接收所述中继节点在验证所述第三签名参数为合法的情况下返回的响应消息；第一处理单元，设置为与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，所述第一处理模块包括：第三生成单元，设置为生成第三签名参数；第二发送单元，设置为至少将所述第三签名参数发送给近距离通讯服务器，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第三签名参数用于所述近距离通讯服务器验证远终端是否合法；第二接收单元，设置为接收所述近距离通讯服务在验证所述第三签名参数为合法的情况下返回的响应消息；第二处理单元，设置为与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，所述第一处理模块包括：第四生成单元，设置为生成第三签名参数；第三发送单元，设置为至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于指示所述中继节点向所述中继节点的近距离通讯服务器转发所述第三签名参数，以使所述中继节点的近距离通讯服务器根据所述第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向所述中继节点返回第二响应消息；第三接收单元，设置为接收所述中继节点根据所述第二响应消息返回的第三响应消息；第三处理单元，设置为根据所述第三响应消息与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
可选地，所述第二生成单元、所述第三生成单元或所述第四生成单元是设置为：生成第二随机数；根据密钥算法利用所述第二随机数和通过接收所述中继节点广播的广播消息而获取的所述中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的所述第三签名密钥和第四字符串确定所述第三签名参数，其中，所述第四字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，根据密钥算法利用所述中继节点广播广播消息时的国际标准时间 和通过接收所述中继节点广播的所述广播消息而获取的所述中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的所述第四签名密钥和第五字符串确定所述第三签名参数，其中，所述第五字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
根据本发明实施例的另一方面，提供了一种业务处理装置，包括：第二验证模块，设置为验证远终端是否合法；第二处理模块，设置为在所述第二验证模块的验证结果为是的情况下，与所述远终端进行设备到设备D2D业务处理。
可选地，还包括以下至少之一：第一确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第二确定模块，设置为根据密钥算法利用所述中继业务标识认证密钥和所述中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用所述第一签名密钥和第一字符串确定第一签名参数，其中，所述第一字符串由所述中继业务标识和所述中继节点的地址组成；第一广播模块，设置为广播所述第一签名参数、所述第一随机数和所述中继业务标识，广播的所述第一随机数和所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；第三确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第四确定模块，设置为根据密钥算法利用所述中继业务标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定第二签名密钥，并根据签名算法利用所述第二签名密钥和第二字符串确定第一签名参数，其中，所述第二字符串由所述中继业务标识和所述中继节点的地址组成；第二广播模块，设置为广播所述第一广播消息，其中，所述第一广播消息中携带所述第一签名参数和所述中继业务标识，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；第五确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第六确定模块，设置为第三根据签名算法 利用所述中继业务标识认证密钥和第三字符串确定第一签名参数，其中，所述第三字符串由所述中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成；第三广播模块，设置为广播所述第二广播消息，其中，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理。
可选地，所述第二验证模块包括：第四接收单元，设置为接收所述远终端发送的用于请求建立中继连接的建立请求消息，其中，所述建立请求消息中至少携带所述远终端生成的第三签名参数；验证单元，设置为验证所述第三签名参数是否合法；第二确定单元，设置为在验证所述第三签名参数为合法的情况下，确定所述远终端为合法；和/或，在验证所述第三签名参数为非法的情况下，确定所述远终端为非法。
可选地，所述第三签名参数为根据签名算法利用第三签名密钥和第四字符串确定的，其中，所述第三签名密钥为根据密钥算法利用所述远终端生成的第二随机数和所述远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，所述第四字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，所述建立请求消息中还携带所述远终端生成的所述第二随机数，所述验证单元是设置为通过以下至少之一实现验证所述第三签名参数是否合法：根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，所述第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的所述建立请求消息中携带的第二随机数确定的，所述第六字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第四签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参 数，其中，所述第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述建立请求消息中携带的第二随机数确定的，所述第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第五签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
可选地，所述第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，所述第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和所述远终端通过接收中继节点广播的所述广播消息而获取的中继节点标识认证密钥确定的，所述第五字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
可选地，所述验证单元是设置为通过以下至少之一实现验证所述第三签名参数是否合法：根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，所述第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第六签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，所述第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第七签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
可选地，确定模块是设置为通过如下方式实现确定所述中继节点的中继 业务标识认证密钥和所述中继业务标识：向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，所述近距离通讯服务器用于同时为中继节点和远终端提供服务器，所述第三请求消息中携带中继节点的授权验证信息；接收所述距离通讯服务器或者所述中继节点的近距离通讯服务器在对所述中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，所述第三响应消息中携带所述中继节点的中继业务标识认证密钥和所述中继业务标识。
通过本发明实施例，采用验证中继节点是否合法；在验证结果为是的情况下，与所述中继节点进行设备到设备D2D业务处理，可以保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务，进而达到了保证远终端使用一个合法的中继节点的效果。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1是相关技术中和3GPP相关的D2D架构示意图；
图2是根据本发明实施例的第一种业务处理方法的流程图；
图3是根据本发明实施例的第二种业务处理方法的流程图；
图4是根据本发明实施例的业务处理装置的第一种结构框图；
图5是根据本发明实施例的业务处理装置中第一验证模块42的结构框图；
图6是根据本发明实施例的业务处理装置中第一生成单元52的结构框图一；
图7是根据本发明实施例的业务处理装置中第一生成单元52的结构框图二；
图8是根据本发明实施例的业务处理装置中第一处理模块44的结构框图一；
图9是根据本发明实施例的业务处理装置中第一处理模块44的结构框图二；
图10是根据本发明实施例的业务处理装置中第一处理模块44的结构框图三；
图11是根据本发明实施例的业务处理装置的第二种结构框图；
图12是根据本发明实施例的业务处理装置的第二种结构框图的可选结构框图；
图13是根据本发明实施例的业务处理装置中第二验证模块112的结构框图；
图14是根据本发明实施例的非漫游情况下的在D2D业务中中继节点认证方法的流程图一；
图15是根据本发明实施例的非漫游情况下在D2D业务中中继节点认证方法的流程图二；
图16是根据本发明实施例的漫游情况下在D2D业务中中继节点认证方法流程图一；
图17是根据本发明实施例的漫游情况下在D2D业务中中继节点认证方法流程图二。
本发明的实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在本实施例中提供了一种业务处理方法，图2是根据本发明实施例的第一种业务处理方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，验证中继节点是否合法；
步骤S204，在验证结果为是的情况下，与中继节点进行设备到设备D2D业务处理。
其中，执行上述步骤的可以是远终端，从而保证了远终端在与中继节点进行D2D业务处理之前，对中继节点是否合法进行验证，可以保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务，进而达到了保证远终端使用一个合法的中继节点的效果。其中，验证中继节点是否的方法有多种，下面对如何验证中继节点是否合法进行说明。
在一个可选的实施例中，验证中继节点是否合法包括：获取用于确定中继节点生成的第一签名参数的参数信息，并利用该参数信息生成第二签名参数；判断生成的第二签名参数与中继节点生成的第一签名参数是否相等；在判断结果为相等的情况下，确定中继节点合法；和/或，在判断结果为不相等的情况下，确定中继节点为非法。也就是说，当成功获取到中继节点用于生成签名参数的参数信息时，说明待进行D2D业务处理的中继节点是合法的中继节点，从而可以利用该合法的中继节点进行D2D业务处理。
在一个可选的实施例中，上述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，该第一字符串由中继节点从近距离通讯服务器中获取的中继业务标识和中继节点的地址组成，其中，上述的第一签名密钥的确定方式也可以是多种，一种方式可以是：第一签名密钥为根据密钥算法利用中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由中继节点生成的随机数确定的，近距离通讯服务器同时为远终端和中继节点提供服务；另一种确定方式是：第一签名密钥为根据密钥算法利用中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定的，近距离通讯服务器同时为远终端和中继节点提供服务；其中，当第一签名密钥为根据中继节点的中继节点标识认证密钥和由中继节点生成的随机数确定时，第一广播消息中携带中继节点的中继业务标识、第一签名参数和第一随机数；当第一签名密钥为根据中继节点的中继节点标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定时，第一广播消息中携带中继节点的中继业务标识和第一签名参数。
在一个可选的实施例中，获取用于确定中继节点生成的第一签名参数的参数信息，并利用该参数信息生成第二签名参数包括：获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址；根据该中继业务标识 从接收的两个以上广播消息中确定中继节点广播的第一广播消息；当第一广播消息中携带第一随机数时，根据密钥算法利用获取的中继节点标识认证密钥和确定的第一随机数确定第二签名密钥；根据签名算法利用确定的第二签名密钥和第二字符串生成第二签名参数，其中，该第二字符串为根据获取的中继节点的中继业务标识和中继节点的地址组成的；和/或，当上述第一广播消息中未携带第一随机数时，根据密钥算法利用获取的中继节点标识认证密钥和中继节点广播广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的第二签名密钥和第二字符串生成第二签名参数，其中，该第二字符串为根据获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，上述第一签名参数为根据第三字符串和中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，该第三字符串由中继节点从近距离通讯服务器中获取的中继业务标识、中继节点的地址和中继节点广播第二广播消息时的国际标准时间组成，第二广播消息中携带中继节点的中继业务标识和第一签名参数。
在一个可选的实施例中，获取用于确定中继节点生成的第一签名参数的参数信息，并利用该参数信息生成第二签名参数包括：获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址；根据该中继业务标识从接收的两个以上广播消息中确定中继节点广播的第二广播消息；根据该中继业务标识、中继节点标识认证密钥、中继节点的地址和中继节点广播第二广播消息时的国际标准时间生成第二签名参数。
在一个可选的实施例中，获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址包括：向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，近距离通讯服务器同时为远终端和中继节点提供服务，第一请求消息中携带远终端的授权验证信息；接收近距离通讯服务器在对远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，第一响应消息中携带中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址。
在一个可选的实施例中，获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址包括：向远终端的近距离通讯服务器发送用于请 求获取中继节点的中继业务标识的第二请求消息，其中，第二请求消息中携带远终端的授权验证信息，远终端的近距离通讯服务器在对授权验证信息进行验证且验证通过后，将第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；接收中继节点的近距离通讯服务器根据远终端的用户标识和位置信息返回的第二响应消息，其中，第二响应消息中携带中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址。
在一个可选的实施例中，在验证结果为是的情况下，利用中继节点进行业务处理包括：生成第三签名参数；至少将第三签名参数发送给中继节点，其中，第三签名参数用于中继节点验证远终端是否合法；接收中继节点在验证第三签名参数为合法的情况下返回的响应消息；与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
在一个可选的实施例中，在验证结果为是的情况下，利用中继节点进行业务处理包括：生成第三签名参数；至少将第三签名参数发送给近距离通讯服务器，其中，近距离通讯服务器同时为远终端和中继节点提供服务，第三签名参数用于近距离通讯服务器验证远终端是否合法；接收近距离通讯服务在验证第三签名参数为合法的情况下返回的响应消息；与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
在一个可选的实施例中，在验证结果为是的情况下，利用中继节点进行业务处理包括：生成第三签名参数；至少将第三签名参数发送给中继节点，其中，第三签名参数用于指示中继节点向中继节点的近距离通讯服务器转发第三签名参数，以使中继节点的近距离通讯服务器根据第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向中继节点返回第二响应消息；接收中继节点根据第二响应消息返回的第三响应消息；根据第三响应消息与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
在一个可选的实施例中，生成第三签名参数包括以下至少之一：生成第二随机数；根据密钥算法利用第二随机数和通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的第三签名密钥和第四字符串确定第三签名参数，其中，第四字符串为根 据通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的；和/或，根据密钥算法利用中继节点广播广播消息时的国际标准时间和通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的第四签名密钥和第五字符串确定第三签名参数，其中，第五字符串为根据通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
在上述的实施例中，主要针对如何验证中继节点是否合法进行说明的，下面针对如何验证远终端是否合法进行说明。
图3是根据本发明实施例的第二种业务处理方法的流程图，如图3所示，该方法包括如下步骤：
步骤S302，验证远终端是否合法；
步骤S304，在验证结果为是的情况下，与远终端进行设备到设备D2D业务处理。
其中，执行通过上述步骤的可以是中继节点，通过上述步骤，中继节点在与远终端进行D2D业务处理之前，可以先验证该远终端是否合法，在合法的情况下，再与该远终端进行D2D业务处理，可以保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务，进而实现了保证中继节点为一个合法的远终端提供中继业务的效果。
在一个可选的实施例中，在验证远终端是否合法之前，还包括以下至少之一：确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用中继业务标识认证密钥和中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用第一签名密钥和第一字符串确定第一签名参数，其中，第一字符串由中继业务标识和中继节点的地址组成；广播第一签名参数、第一随机数和中继业务标识，广播的第一随机数和中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理；确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用中继业务标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定第 二签名密钥，并根据签名算法利用第二签名密钥和第二字符串确定第一签名参数，其中，第二字符串由中继业务标识和中继节点的地址组成；广播第一广播消息，其中，第一广播消息中携带第一签名参数和中继业务标识，广播的中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理；确定中继节点的中继业务标识、中继业务标识认证密钥；根据签名算法利用中继业务标识认证密钥和第三字符串确定第一签名参数，其中，第三字符串由中继业务标识、中继节点的地址和中继节点广播第二广播消息时的国际标准时间组成；广播第二广播消息，其中，第二广播消息中携带中继节点的中继业务标识和第一签名参数，广播的中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理。
在一个可选的实施例中，验证远终端是否合法可以有多种验证方式，例如可以采用如下方式进行验证：接收远终端发送的用于请求建立中继连接的建立请求消息，其中，该建立请求消息中至少携带远终端生成的第三签名参数；验证第三签名参数是否合法；在验证第三签名参数为合法的情况下，确定远终端为合法；和/或，在在验证第三签名参数为非法的情况下，确定远终端为非法。
在一个可选的实施例中，上述的第三签名参数可以是根据签名算法利用第三签名密钥和第四字符串确定的，其中，第三签名密钥为根据密钥算法利用远终端生成的第二随机数和远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，第四字符串为根据远终端通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，建立请求消息中还携带远终端生成的第二随机数，验证第三签名参数是否合法包括以下至少之一：根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，该第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的建立请求消息中携带的第二随机数确定的，第六字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断第四签名参数和第三签名参数是否相同；在判 断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法；将建立请求消息转发给中继节点的近距离通讯服务器，其中，建立请求消息用于指示中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参数，其中，第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和建立请求消息中携带的第二随机数确定的，第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断第五签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法。
在一个可选的实施例中，第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，该第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，该第五字符串为根据远终端通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，验证第三签名参数是否合法包括以下至少之一：根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，该第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和中继节点广播广播消息时的国际标准时间确定的，第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断第六签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法；将建立请求消息转发给中继节点的近距离通讯服务器，其中，建立请求消息用于指示中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和中继节点广播广播消息时的国际标准时间确定的，第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断第七签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第 三签名参数为非法。
在一个可选的实施例中，在确定上述中继节点的中继业务标识认证密钥和中继业务标识时，可以包括如下方式：向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，近距离通讯服务器用于同时为中继节点和远终端提供服务器，第三请求消息中携带中继节点的授权验证信息；接收距离通讯服务器或者中继节点的近距离通讯服务器在对中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，第三响应消息中携带中继节点的中继业务标识认证密钥和中继业务标识。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
在本实施例中还提供了一种业务处理装置，该装置用于实现上述实施例及可选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图4是根据本发明实施例的业务处理装置的第一种结构框图，如图4所示，该装置包括第一验证模块42和第一处理模块44，下面对该装置进行说明。
第一验证模块42，设置为验证中继节点是否合法；第一处理模块44，连接至上述第一验证模块42，设置为在第一验证模块42的验证结果为是的情况下，与中继节点进行设备到设备D2D业务处理。
图5是根据本发明实施例的业务处理装置中第一验证模块42的结构框图，如图5所示，该第一验证模块42包括第一生成单元52、判断单元54和第一确定单元56，下面对该第一验证模块42进行说明。
第一生成单元52，设置为获取用于确定中继节点生成的第一签名参数的参数信息，并利用该参数信息生成第二签名参数；判断单元54，连接至上述第一生成单元52，设置为判断生成的第二签名参数与中继节点生成的第一签名参数是否相等；第一确定单元56，连接至上述判断单元54，设置为在判断结果为相等的情况下，确定中继节点合法；和/或，在判断结果为不相等的情况下，确定中继节点为非法。
在一个可选的实施例中，上述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，第一字符串由中继节点从近距离通讯服务器中获取的中继业务标识和中继节点的地址组成，其中，第一签名密钥为根据密钥算法利用中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由中继节点生成的随机数确定的，近距离通讯服务器同时为远终端和中继节点提供服务；和/或，第一签名密钥为根据密钥算法利用中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定的，近距离通讯服务器同时为远终端和中继节点提供服务；其中，当第一签名密钥为根据中继节点的中继节点标识认证密钥和由中继节点生成的随机数确定时，第一广播消息中携带中继节点的中继业务标识、第一签名参数和第一随机数；当第一签名密钥为根据中继节点的中继节点标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定时，第一广播消息中携带中继节点的中继业务标识和第一签名参数。
图6是根据本发明实施例的业务处理装置中第一生成单元52的结构框图一，如图6所示，该第一生成单元52包括第一获取子单元62、第一确定子单元64和第一生成子单元66，下面对该第一生成单元52进行说明。
第一获取子单元62，设置为获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址；第一确定子单元64，连接至上述第一获取子单元62，设置为根据中继业务标识从接收的两个以上广播消息中确定中继节点广播的第一广播消息；第一生成子单66，连接至上述第一确定子单元64， 设置为当第一广播消息中携带第一随机数时，根据密钥算法利用获取的中继节点标识认证密钥和确定的第一随机数确定第二签名密钥；根据签名算法利用确定的第二签名密钥和第二字符串生成第二签名参数，其中，第二字符串为根据获取的中继节点的中继业务标识和中继节点的地址组成的；和/或，当第一广播消息中未携带第一随机数时，根据密钥算法利用获取的中继节点标识认证密钥和中继节点广播广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的第二签名密钥和第二字符串生成第二签名参数，其中，第二字符串为根据获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，上述第一签名参数为根据第三字符串和中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，第三字符串由中继节点从近距离通讯服务器中获取的中继业务标识、中继节点的地址和中继节点广播第二广播消息时的国际标准时间组成，第二广播消息中携带中继节点的中继业务标识和第一签名参数。
图7是根据本发明实施例的业务处理装置中第一生成单元52的结构框图二，如图7所示，该第一生成单元52包括第二获取子单元72、第二确定子单元74和第二生成子单元76，下面对该第一生成子单元52进行说明。
第二获取子单元72，设置为获取中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址；第二确定子单元74，连接至上述第二获取子单元72，设置为根据中继业务标识从接收的两个以上广播消息中确定中继节点广播的第二广播消息；第二生成子单76，连接至上述第二确定子单元74，设置为根据中继业务标识、中继节点标识认证密钥、中继节点的地址和中继节点广播第二广播消息时的国际标准时间生成第二签名参数。
在一个可选的实施例中，上述的第一获取子单元62或第二获取子单元72均设置为：向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，近距离通讯服务器同时为远终端和中继节点提供服务，第一请求消息中携带远终端的授权验证信息；接收近距离通讯服务器在对远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，第一响应消息中携带中继节点的中继业务标识、中继节点标识认证密 钥和中继节点的地址。
在一个可选的实施例中，上述第一获取子单元62或第二获取子单元72均设置为：向远终端的近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第二请求消息，其中，第二请求消息中携带远终端的授权验证信息，远终端的近距离通讯服务器在对授权验证信息进行验证且验证通过后，将第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；接收中继节点的近距离通讯服务器根据远终端的用户标识和位置信息返回的第二响应消息，其中，第二响应消息中携带中继节点的中继业务标识、中继节点标识认证密钥和中继节点的地址。
图8是根据本发明实施例的业务处理装置中第一处理模块44的结构框图一，如图8所示，该第一处理模块44包括第二生成单元82、第一发送单元84、第一接收单元86和第二处理单元88，下面对该第一处理模块44进行说明。
第二生成单元82，设置为生成第三签名参数；第一发送单元84，连接至上述第二生成单元82，设置为至少将第三签名参数发送给中继节点，其中，该第三签名参数用于中继节点验证远终端是否合法；第一接收单元86，连接至上述第一发送单元84，设置为接收中继节点在验证第三签名参数为合法的情况下返回的响应消息；第一处理单元88，连接至上述第一接收单元86，设置为与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
图9是根据本发明实施例的业务处理装置中第一处理模块44的结构框图二，如图9所示，该第一处理模块44包括第三生成单元92、第二发送单元94、第二接收单元96和第二处理单元98，下面对该第一处理模块44进行说明。
第三生成单元92，设置为生成第三签名参数；第二发送单元94，连接至上述第三生成单元92，设置为至少将第三签名参数发送给近距离通讯服务器，其中，该近距离通讯服务器同时为远终端和中继节点提供服务，该第三签名参数用于近距离通讯服务器验证远终端是否合法；第二接收单元96，连接至上述第二发送单元94，设置为接收近距离通讯服务在验证第三签名参数为合法的情况下返回的响应消息；第二处理单元98，连接至上述第二接收单元96， 设置为与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
图10是根据本发明实施例的业务处理装置中第一处理模块44的结构框图三，如图10所示，该第一处理模块88包括第四生成单元102、第三发送单元104、第三接收单元106、第三处理单元108，下面对该第一处理模块88进行说明。
第四生成单元102，设置为生成第三签名参数；第三发送单元104，连接至上述第四生成单元102，设置为至少将第三签名参数发送给中继节点，其中，该第三签名参数用于指示中继节点向中继节点的近距离通讯服务器转发第三签名参数，以使中继节点的近距离通讯服务器根据第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向中继节点返回第二响应消息；第三接收单元106，连接至上述第三发送单元104，设置为接收中继节点根据第二响应消息返回的第三响应消息；第三处理单元108，连接至上述第三接收单元106，设置为根据第三响应消息与中继节点建立中继连接，并与中继节点进行设备到设备D2D业务处理。
在一个可选的实施例中，上述第二生成单元82、第三生成单元84或第四生成单元86设置为：生成第二随机数；根据密钥算法利用第二随机数和通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的第三签名密钥和第四字符串确定第三签名参数，其中，第四字符串为根据通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的；和/或，根据密钥算法利用中继节点广播广播消息时的国际标准时间和通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的第四签名密钥和第五字符串确定第三签名参数，其中，第五字符串为根据通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
图11是根据本发明实施例的业务处理装置的第二种结构框图，如图11所示，该装置包括第二验证模块112和第二处理模块114，下面对该装置进行说明。
第二验证模块112，设置为验证远终端是否合法；第二处理模块114，连接至上述第二验证模块112，设置为在第二验证模块112的验证结果为是的情况下，与远终端进行设备到设备D2D业务处理。
图12是根据本发明实施例的业务处理装置的第二种结构框图的可选结构框图，如图12所示，该装置除包括图11所示的所有模块外，还包括第一确定模块122、第二确定模块124和第一广播模块126；和/或，该装置除包括图11所示的所有模块外，还包括第三确定模块128、第四确定模块1210和第二广播模块1212；和/或，该装置除包括图11所示的所有模块外，还包括第五确定模块1214、第六确定模块1216和第三广播模块1218，下面对该装置进行说明。
第一确定模块122，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第二确定模块124，连接至上述第一确定模块122，设置为根据密钥算法利用中继业务标识认证密钥和中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用第一签名密钥和第一字符串确定第一签名参数，其中，该第一字符串由中继业务标识和中继节点的地址组成；第一广播模块126，连接至上述第二确定模块124和第二验证模块112，设置为广播第一签名参数、第一随机数和中继业务标识，广播的第一随机数和中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理；
第三确定模块128，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第四确定模块1210，连接至上述第三确定模块128，设置为根据密钥算法利用中继业务标识认证密钥和中继节点广播第一广播消息时的国际标准时间确定第二签名密钥，并根据签名算法利用第二签名密钥和第二字符串确定第一签名参数，其中，该第二字符串由中继业务标识和中继节点的地址组成；第二广播模块1212，连接至上述第四确定模块1210和第二验证模块112，设置为广播第一广播消息，其中，该第一广播消息中携带第一签名参数和中继业务标识，广播的中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理；
第五确定模块1214，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第六确定模块1216，连接至上述第五确定模块1214，设置为第三根据签名算法利用中继业务标识认证密钥和第三字符串确定第一签名参数，其中，该第三字符串由中继业务标识、中继节点的地址和中继节点广播第二广播消息时的国际标准时间组成；第三广播模块1218，连接至上述第六确定模块1216和第二验证模块112，设置为广播第二广播消息，其中，该第二广播消息中携带中继节点的中继业务标识和第一签名参数，广播的中继业务标识用于远终端验证中继节点是否合法，并在合法的情况下利用中继节点进行业务处理。
图13是根据本发明实施例的业务处理装置中第二验证模块112的结构框图，如图13所示，该第二验证模块112包括第四接收单元132、验证单元134和第二确定单元136，下面对该第二验证模块112进行说明。
第四接收单元132，设置为接收远终端发送的用于请求建立中继连接的建立请求消息，其中，该建立请求消息中至少携带远终端生成的第三签名参数；验证单元134，连接至上述第四接收单元132，设置为验证第三签名参数是否合法；第二确定单元136，连接至上述验证单元134，设置为在验证第三签名参数为合法的情况下，确定远终端为合法；和/或，在验证第三签名参数为非法的情况下，确定远终端为非法。
在一个可选的实施例中，上述第三签名参数为根据签名算法利用第三签名密钥和第四字符串确定的，其中，该第三签名密钥为根据密钥算法利用远终端生成的第二随机数和远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，第四字符串为根据远终端通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，上述建立请求消息中还携带远终端生成的第二随机数，验证单元134设置为：根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的建立请求消息中携带的第二随机数确定的，第六字符串为根据预先确定的中继业务标识和中继节点的地址组成； 判断第四签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法；将建立请求消息转发给中继节点的近距离通讯服务器，其中，该建立请求消息用于指示中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参数，其中，该第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和建立请求消息中携带的第二随机数确定的，第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断第五签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法。
在一个可选的实施例中，上述第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，该第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，该第五字符串为根据远终端通过接收中继节点广播的广播消息而获取的中继节点的中继业务标识和中继节点的地址组成的。
在一个可选的实施例中，上述验证单元134设置为：根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，该第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和中继节点广播广播消息时的国际标准时间确定的，第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断第六签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定上述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法；将建立请求消息转发给中继节点的近距离通讯服务器，其中，建立请求消息用于指示中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和中继节点广播广播消息时的国际标准时间确定的，第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断第七签名参数和第三签名参数是否相同；在判断结果为相同的情况下，确定第三 签名参数为合法；和/或，在判断结果为不同的情况下，确定第三签名参数为非法。
在一个可选的实施例中，在确定中继节点的中继业务标识认证密钥和中继业务标识时，包括：向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，近距离通讯服务器用于同时为中继节点和远终端提供服务器，第三请求消息中携带中继节点的授权验证信息；接收距离通讯服务器或者中继节点的近距离通讯服务器在对中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，第三响应消息中携带中继节点的中继业务标识认证密钥和中继业务标识。
从上述各实施例可知，本发明实施例中提供的认证方式主要如下：1是在远终端认证中继节点，中继节点认证远终端，2是在远终端认证中继节点，中继节点近距离通讯服务器认证远终端。
下面结合具体实施例对本发明进行说明：
图14是根据本发明实施例的非漫游情况下的在D2D业务中中继节点认证方法的流程图一，在该实施例中，中继节点与远终端同处于一个运营商网络，因此中继节点的近距离通讯服务器和远终端的近距离通讯服务器相同，下述的远终端近距离通讯服务器/中继节点近距离通讯服务器即为同时为中继节点和远终端服务的近距离通讯服务器。该流程包括如下步骤：
步骤S1401，中继节点与远终端近距离通讯服务器/中继节点近距离通讯服务器建立安全链接后，中继节点向远终端近距离通讯服务器/中继节点近距离通讯服务器发起中继业务标识获取请求消息，该中继业务标识获取请求消息中还携带中继节点用户标识，可选地，该消息携带relay指示，消息还携带用户的位置信息；
步骤S1402，远终端近距离通讯服务器/中继节点近距离通讯服务器进行授权认证，判断该用户的签约信息中，是否允许Relay功能；
步骤S1403，如果授权成功，远终端近距离通讯服务器/中继节点近距离通讯服务器向中继节点回送中继业务标识获取请求响应消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长(其中，也可以不携 带该有效期时长)；
步骤S1404，中继节点分配无线资源，生成一个随机数，开始广播，其中广播中携带中继业务标识，随机数，签名参数m，其中签名参数m＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址(同上述的中继节点的地址)组成，如果随机数采用国际标准时间计数器，则不需要广播随机数，使用国际标准时间计数器替代随机数；
步骤S1405，远终端在有覆盖区域时，且远终端中无本地签约的中继业务标识，或者中继业务标识已经过期，与远终端近距离通讯服务器/中继节点近距离通讯服务器建立安全链接后，远终端向远终端近距离通讯服务器/中继节点近距离通讯服务器发起中继业务标识获取请求消息，该消息中还携带远终端用户标识，该消息携带接入的运营商网络标识，和本地的运营商网络标识，该接入的运营商网络标识远终端和中继节点相同，该消息还携带用户的位置信息；
步骤S1406，远终端近距离通讯服务器/中继节点近距离通讯服务器进行授权认证，进行授权认证，判断该用户的签约信息中，是否允许通过中继节点接入网络，以及授权认证的接入网络和本地的运营商授权信息；
步骤S1407，如果授权成功，远终端近距离通讯服务器/中继节点近距离通讯服务器向远终端回送中继业务标识获取请求响应消息，消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1408，远终端进入无覆盖区域，分配无线资源，侦听中继节点广播；
步骤S1409，当远终端需要建立D2D业务时，远终端根据中继业务标识选择中继节点，验证签名参数m，计算签名参数n＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，验证m与n是否相当，如果相等，则为合法的中继节点，如果随机数采用国际标准时间计数器，使用国际标准时间计数器替代随机数；
步骤S1410，远终端产生一个随机数，再生产一个签名参数A，计算签名参数A＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和远终端的层2地址组成，随机数也可以是国际标准时间计数器；
步骤S1411，远终端向中继节点发起中继建立请求消息，该消息中携带签名参数A，可选地，该消息还可以携带随机数；
步骤S1412，中继节点验证签名参数A，计算签名参数B＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，验证A与B是否相当，如果相等，则为合法的远终端；随机数也可以是中继节点上的国际标准时间计数器；
步骤S1413，中继节点验证成功后，向远终端回送中继建立请求响应消息，远终端即可以通过中继节点实现D2D业务。
图15是根据本发明实施例的非漫游情况下在D2D业务中中继节点认证方法的流程图二，在该方法中，中继节点与远终端同处于一个运营商网络，因此中继节点的近距离通讯服务器和远终端的近距离通讯服务器相同。该流程包括如下步骤：
步骤S1501，中继节点与远终端近距离通讯服务器/中继节点近距离通讯服务器建立安全链接后，中继节点向远终端近距离通讯服务器/中继节点近距离通讯服务器发起中继业务标识获取请求消息，该消息中还携带中继节点用户标识，可选地，该消息携带relay指示，还携带用户的位置信息；
步骤S1502，远终端近距离通讯服务器/中继节点近距离通讯服务器进行授权认证，判断该用户的签约信息中，是否允许Relay功能；
步骤S1503，如果授权成功，远终端近距离通讯服务器/中继节点近距离通讯服务器向中继节点回送中继业务标识获取请求响应消息，消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1504，中继节点分配无线资源，生成一个随机数，开始广播，其 中广播中携带中继业务标识，签名参数m，其中签名参数m＝签名算法(字符串，中继业务标识认证密钥)，字符串由中继业务标识和中继节点的层2地址，标准时间计数器组成；
步骤S1505，远终端在有覆盖区域时，且远终端中无本地签约的中继业务标识，或者中继业务标识已经过期，与远终端近距离通讯服务器/中继节点近距离通讯服务器建立安全链接后，远终端向远终端近距离通讯服务器/中继节点近距离通讯服务器发起中继业务标识获取请求消息，该消息中还携带远终端用户标识，该消息还携带接入的运营商网络标识，和本地的运营商网络标识，接入的运营商网络标识远终端和中继节点相同，该消息还可以携带用户的位置信息；
步骤S1506，远终端近距离通讯服务器/中继节点近距离通讯服务器进行授权认证，进行授权认证，判断该用户的签约信息中，是否允许通过中继节点接入网络，以及授权认证的接入网络和本地的运营商授权信息；
步骤S1507，如果授权成功，远终端近距离通讯服务器/中继节点近距离通讯服务器向远终端回送中继业务标识获取请求响应消息，该消息中携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1508，远终端进入无覆盖区域，分配无线资源，侦听中继节点广播；
步骤S1509，当远终端需要建立D2D业务时，远终端根据中继业务标识选择中继节点，验证签名参数m，计算签名参数n＝签名算法(字符串，中继业务标识认证密钥)，字符串由中继业务标识和中继节点的层2地址、标准时间计数器组成，验证m＝n，如果相等，则为合法的中继节点；
步骤S1510，远终端产生一个随机数，再生产一个签名参数A，计算签名参数A＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和远终端的层2地址组成，随机数也可以是国际标准时间计数器；
步骤S1511，远终端向中继节点发起中继建立请求消息，该消息携带签名参数A，可选地，该消息还可以携带随机数；
步骤是S1512，中继节点向远终端近距离通讯服务器/中继节点近距离通讯服务器转发中继建立请求消息，该消息携带中继业务标识认证密钥，可选地，该消息还可以携带随机数或者国际标准时间计数器；
步骤S1513，远终端近距离通讯服务器/中继节点近距离通讯服务器验证签名参数A，计算签名参数B＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，验证A与B是否相当，如果相等，则为合法的远终端；随机数也可以是中继节点上的国际标准时间计数器；
步骤S1514，远终端近距离通讯服务器/中继节点近距离通讯服务器验证成功后，向中继节点回送中继建立请求响应消息；
步骤S1515，中继节点向远终端回送中继建立请求响应消息，远终端即可以通过中继节点实现D2D业务。
图16是给根据本发明实施例的漫游情况下在D2D业务中中继节点认证方法流程图一，在该方法中，中继节点与远终端同处于不同的运营商网络，因此中继节点的近距离通讯服务器和远终端的近距离通讯服务器不相同。该流程包括如下步骤：
步骤S1601，中继节点与中继节点近距离通讯服务器建立安全链接后，中继节点向中继节点近距离通讯服务器发起中继业务标识获取请求消息，该消息中携带中继节点用户标识，可选地，该消息携带relay指示，还携带用户的位置信息；
步骤S1602，中继节点近距离通讯服务器进行授权认证，判断该用户的签约信息中，是否允许Relay功能；
步骤S1603，如果授权成功，中继节点近距离通讯服务器向中继节点回送中继业务标识获取请求响应消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1604，中继节点分配无线资源，生成一个随机数，开始广播，其中广播中携带中继业务标识，随机数，签名参数m，其中签名参数m＝签名算 法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，如果随机数采用国际标准时间计数器，则不需要广播随机数，使用国际标准时间计数器替代随机数；
步骤S1605，远终端在有覆盖区域时，且远终端中无本地签约的中继业务标识，或者中继业务标识已经过期，与远终端近距离通讯服务器建立安全链接后，远终端向远终端近距离通讯服务器发起中继业务标识获取请求消息，该消息还携带远终端用户标识，该消息携带接入的运营商网络标识，和本地的运营商网络标识，接入的运营商网络标识远终端和中继节点不相同，该消息还携带用户的位置信息；
步骤S1606，远终端近距离通讯服务器进行授权认证，进行授权认证，判断该用户的签约信息中，是否允许通过中继节点接入网络，以及授权认证的接入网络和本地的运营商授权信息；
步骤S1607，如果授权成功，远终端近距离通讯服务器向授权的运营商的中继节点近距离通讯服务器发送中继业务标识监听请求消息，该消息携带远终端的位置信息和远终端用户标识；
步骤S1608，授权的运营商的中继节点近距离通讯服务器根据远终端的位置信息，选择远终端附近中继节点的中继业务标识以及对应的有效期中继业务标识认证密钥，向远终端近距离通讯服务器回送中继业务标识监听请求消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1609，远终端近距离通讯服务器向远终端回送中继业务标识获取请求响应消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1610，远终端进入无覆盖区域，分配无线资源，侦听中继节点广播；
步骤S1611，当远终端需要建立D2D业务时，远终端根据中继业务标识选择中继节点，验证签名参数m，计算签名参数n＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由 中继业务标识和中继节点的层2地址组成，验证m与n是否相当，如果相等，则为合法的中继节点，如果随机数采用国际标准时间计数器，使用国际标准时间计数器替代随机数；
步骤S1612，远终端产生一个随机数，再生产一个签名参数A，计算签名参数A＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和远终端的层2地址组成，随机数也可以是国际标准时间计数器；
步骤S1613，远终端向中继节点发起中继建立请求消息，该消息携带签名参数A，可选地还携带随机数；
步骤S1614，中继节点验证签名参数A，计算签名参数B＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，验证A与B是否相当，如果相等，则为合法的远终端；该随机数也可以是中继节点上的国际标准时间计数器；
步骤S1615，中继节点验证成功后，向远终端回送中继建立请求响应消息，远终端即可以通过中继节点实现D2D业务。
图17是根据本发明实施例的漫游情况下在D2D业务中中继节点认证方法流程图二，在该方法中，中继节点与远终端同处于不同的运营商网络，因此中继节点的近距离通讯服务器和远终端的近距离通讯服务器不相同。该流程包括如下步骤：
步骤S1701，中继节点与中继节点近距离通讯服务器建立安全链接后，中继节点向中继节点近距离通讯服务器发起中继业务标识获取请求消息，该消息还携带中继节点用户标识，可选地，该消息携带relay指示，还携带用户的位置信息；
步骤S1702，中继节点近距离通讯服务器进行授权认证，判断该用户的签约信息中，是否允许Relay功能；
步骤S1703，如果授权成功，中继节点近距离通讯服务器向中继节点回 送中继业务标识获取请求响应消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1704，中继节点分配无线资源，生成一个随机数，开始广播，其中广播中携带中继业务标识，签名参数m，其中签名参数m＝签名算法(字符串，中继业务标识认证密钥)，字符串由中继业务标识和中继节点的层2地址，标准时间计数器组成；
步骤S1705，远终端在有覆盖区域时，且远终端中无本地签约的中继业务标识，或者中继业务标识已经过期，与远终端近距离通讯服务器建立安全链接后，远终端向远终端近距离通讯服务器发起中继业务标识获取请求消息，该消息中还携带远终端用户标识，该消息中携带接入的运营商网络标识，和本地的运营商网络标识，接入的运营商网络标识远终端和中继节点相同，该消息还携带用户的位置信息；
步骤S1706，远终端近距离通讯服务器进行授权认证，进行授权认证，判断该用户的签约信息中，是否允许通过中继节点接入网络，以及授权认证的接入网络和本地的运营商授权信息；
步骤S1707，如果授权成功，远终端近距离通讯服务器向授权的运营商的中继节点近距离通讯服务器发送中继业务标识监听请求消息，该消息携带远终端的位置信息和远终端用户标识；
步骤S1708，授权的运营商的中继节点近距离通讯服务器根据远终端的位置信息，选择远终端附近中继节点的中继业务标识以及对应的有效期中继业务标识认证密钥，向远终端近距离通讯服务器回送中继业务标识监听请求消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1709，远终端近距离通讯服务器向远终端回送中继业务标识获取请求响应消息，该消息携带中继业务标识，中继业务标识认证密钥，以及有效期时长；
步骤S1710，远终端进入无覆盖区域，分配无线资源，侦听中继节点广播；
步骤S1711，当远终端需要建立D2D业务时，远终端根据中继业务标识 选择中继节点，验证签名参数m，根据中继业务标识选择中继节点，验证签名参数m，计算签名参数n＝签名算法(字符串，中继业务标识认证密钥)，字符串由中继业务标识和中继节点的层2地址、标准时间计数器组成，验证m＝n，如果相等，则为合法的中继节点；
步骤S1712，远终端产生一个随机数，再生产一个签名参数A，计算签名参数A＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和远终端的层2地址组成，该随机数也可以是国际标准时间计数器；
步骤S1713，远终端向中继节点发起中继建立请求消息，消息携带签名参数A，可选地该消息还携带随机数；
步骤S1714，中继节点向中继节点近距离通讯服务器转发中继建立请求消息，该消息携带中继业务标识认证密钥，可选地该消息还携带随机数或者国际标准时间计数器；
步骤S1715，中继节点近距离通讯服务器验证签名参数A，计算签名参数B＝签名算法(字符串，签名密钥)，签名密钥＝密钥算法(中继业务标识认证密钥，随机数)，字符串由中继业务标识和中继节点的层2地址组成，验证A与B是否相当，如果相等，则为合法的远终端；随机数也可以是中继节点上的国际标准时间计数器；
步骤S1716，中继节点近距离通讯服务器验证成功后，向中继节点回送中继建立请求响应消息；
步骤S1717，中继节点向远终端回送中继建立请求响应消息，远终端即可以通过中继节点实现D2D业务。
上述实施例中，签名算法可以为：基于哈希函数消息认证码(Hash-based Message Authentication Code，简称为MAC)-安全散列算法(Secure Hash Algorithm，简称为SHA)-256。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块分别位于多个处理器中。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S11，验证中继节点是否合法；
S12，在验证结果为是的情况下，与中继节点进行设备到设备D2D业务处理。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
S21，验证远终端是否合法；
S22，在验证结果为是的情况下，与远终端进行设备到设备D2D业务处理。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述的步骤S11-S12。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述的步骤S21-S22。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件 结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
上述技术方案可以保证远终端使用一个合法的中继节点，或者中继节点为一个合法的远终端提供中继业务，进而达到了保证远终端使用一个合法的中继节点的效果。

Claims (40)

  1. 一种业务处理方法，包括：
    验证中继节点是否合法；
    在验证结果为是的情况下，与所述中继节点进行设备到设备D2D业务处理。
  2. 根据权利要求1所述的方法，其中，验证中继节点是否合法包括：
    获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数；
    判断生成的所述第二签名参数与所述中继节点生成的第一签名参数是否相等；
    在判断结果为相等的情况下，确定所述中继节点合法；和/或，
    在判断结果为不相等的情况下，确定所述中继节点为非法。
  3. 根据权利要求2所述的方法，其中，所述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，所述第一字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识和所述中继节点的地址组成，其中，
    所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由所述中继节点生成的随机数确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；和/或，
    所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；
    其中，当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和由所述中继节点生成的随机数确定时，所述第一广播消息中携带所述中继节点的中继业务标识、所述第一签名参数和所述第一随机数；当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和所述中继节点广播 第一广播消息时的国际标准时间确定时，所述第一广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
  4. 根据权利要求3所述的方法，其中，获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数包括：
    获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；
    根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第一广播消息；
    当所述第一广播消息中携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和确定的所述第一随机数确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，
    当所述第一广播消息中未携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  5. 根据权利要求2所述的方法，其中，所述第一签名参数为根据第三字符串和所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，所述第三字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
  6. 根据权利要求5所述的方法，其中，获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数包括：
    获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；
    根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第二广播消息；
    根据所述中继业务标识、中继节点标识认证密钥、所述中继节点的地址和所述中继节点广播所述第二广播消息时的国际标准时间生成所述第二签名参数。
  7. 根据权利要求4或6所述的方法，其中，获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址包括：
    向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第一请求消息中携带远终端的授权验证信息；
    接收所述近距离通讯服务器在对所述远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，所述第一响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
  8. 根据权利要求4或6所述的方法，其中，获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址包括：
    向远终端的近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第二请求消息，其中，所述第二请求消息中携带远终端的授权验证信息，所述远终端的近距离通讯服务器在对所述授权验证信息进行验证且验证通过后，将所述第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；
    接收所述中继节点的近距离通讯服务器根据所述远终端的用户标识和位置信息返回的第二响应消息，其中，所述第二响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
  9. 根据权利要求1所述的方法，其中，在验证结果为是的情况下，与所述中继节点进行业务处理包括：
    生成第三签名参数；
    至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于所述中继节点验证远终端是否合法；
    接收所述中继节点在验证所述第三签名参数为合法的情况下返回的响应消息；
    与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
  10. 根据权利要求1所述的方法，其中，在验证结果为是的情况下，与所述中继节点进行业务处理包括：
    生成第三签名参数；
    至少将所述第三签名参数发送给近距离通讯服务器，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第三签名参数用于所述近距离通讯服务器验证远终端是否合法；
    接收所述近距离通讯服务在验证所述第三签名参数为合法的情况下返回的响应消息；
    与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
  11. 根据权利要求1所述的方法，其中，在验证结果为是的情况下，与所述中继节点进行业务处理包括：
    生成第三签名参数；
    至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于指示所述中继节点向所述中继节点的近距离通讯服务器转发所述第三签名参数，以使所述中继节点的近距离通讯服务器根据所述第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向所述中继节点返回第二响应消息；
    接收所述中继节点根据所述第二响应消息返回的第三响应消息；
    根据所述第三响应消息与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
  12. 根据权利要求9至11中任一项所述的方法，其中，生成所述第三签名参数包括以下至少之一：
    生成第二随机数；根据密钥算法利用所述第二随机数和通过接收所述中继节点广播的广播消息而获取的所述中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的所述第三签名密钥和第四字符串确定所述第三签名参数，其中，所述第四字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，
    根据密钥算法利用所述中继节点广播广播消息时的国际标准时间和通过接收所述中继节点广播的所述广播消息而获取的所述中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的所述第四签名密钥和第五字符串确定所述第三签名参数，其中，所述第五字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  13. 一种业务处理方法，包括：
    验证远终端是否合法；
    在验证结果为是的情况下，与所述远终端进行设备到设备D2D业务处理。
  14. 根据权利要求13所述的方法，还包括：
    在验证远终端是否合法之前，执行以下至少之一：
    确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用所述中继业务标识认证密钥和所述中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用所述第一签名密钥和第一字符串确定第一签名参数，其中，所述第一字符串由所述中继业务标识和所述中继节点的地址组成；广播所述第一签名参数、所述第一随机数和所述中继业务标识，广播的所述第一随机数和所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；
    确定中继节点的中继业务标识、中继业务标识认证密钥；根据密钥算法利用所述中继业务标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定第二签名密钥，并根据签名算法利用所述第二签名密钥和第二 字符串确定第一签名参数，其中，所述第二字符串由所述中继业务标识和所述中继节点的地址组成；广播所述第一广播消息，其中，所述第一广播消息中携带所述第一签名参数和所述中继业务标识，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；
    确定中继节点的中继业务标识、中继业务标识认证密钥；根据签名算法利用所述中继业务标识认证密钥和第三字符串确定第一签名参数，其中，所述第三字符串由所述中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成；广播所述第二广播消息，其中，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理。
  15. 根据权利要求13所述的方法，其中，验证远终端是否合法，包括：
    接收所述远终端发送的用于请求建立中继连接的建立请求消息，其中，所述建立请求消息中至少携带所述远终端生成的第三签名参数；
    验证所述第三签名参数是否合法；
    在验证所述第三签名参数为合法的情况下，确定所述远终端为合法；和/或，
    在验证所述第三签名参数为非法的情况下，确定所述远终端为非法。
  16. 根据权利要求15所述的方法，其中，所述第三签名参数为根据签名算法利用第三签名密钥和第四字符串确定的，其中，所述第三签名密钥为根据密钥算法利用所述远终端生成的第二随机数和所述远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，所述第四字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  17. 根据权利要求16所述的方法，所述建立请求消息中还携带所述远终端生成的所述第二随机数，验证所述第三签名参数是否合法包括以下至少之一：
    根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，所述第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的所述建立请求消息中携带的第二随机数确定的，所述第六字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第四签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；
    将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参数，其中，所述第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述建立请求消息中携带的第二随机数确定的，所述第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第五签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
  18. 根据权利要求15所述的方法，其中，所述第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，所述第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和所述远终端通过接收中继节点广播的所述广播消息而获取的中继节点标识认证密钥确定的，所述第五字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  19. 根据权利要求18所述的方法，其中，验证所述第三签名参数是否合法包括以下至少之一：
    根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，所述第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第六签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所 述第三签名参数为非法；
    将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，所述第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第七签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
  20. 根据权利要求14、16、17、18、19中任一项所述的方法，其中，确定所述中继节点的中继业务标识认证密钥和所述中继业务标识，包括：
    向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，所述近距离通讯服务器用于同时为中继节点和远终端提供服务器，所述第三请求消息中携带中继节点的授权验证信息；
    接收所述距离通讯服务器或者所述中继节点的近距离通讯服务器在对所述中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，所述第三响应消息中携带所述中继节点的中继业务标识认证密钥和所述中继业务标识。
  21. 一种业务处理装置，包括：
    第一验证模块，设置为验证中继节点是否合法；
    第一处理模块，设置为在所述第一验证模块的验证结果为是的情况下，与所述中继节点进行设备到设备D2D业务处理。
  22. 根据权利要求21所述的装置，其中，所述第一验证模块包括：
    第一生成单元，设置为获取用于确定所述中继节点生成的第一签名参数的参数信息，并利用所述参数信息生成第二签名参数；
    判断单元，设置为判断生成的所述第二签名参数与所述中继节点生成的 第一签名参数是否相等；
    第一确定单元，设置为在判断结果为相等的情况下，确定所述中继节点合法；和/或，在判断结果为不相等的情况下，确定所述中继节点为非法。
  23. 根据权利要求22所述的装置，其中，所述第一签名参数为根据签名算法利用第一字符串和第一签名密钥确定的，所述第一字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识和所述中继节点的地址组成，其中，
    所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和由所述中继节点生成的随机数确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；和/或，
    所述第一签名密钥为根据密钥算法利用所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定的，所述近距离通讯服务器同时为远终端和中继节点提供服务；
    其中，当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和由所述中继节点生成的随机数确定时，所述第一广播消息中携带所述中继节点的中继业务标识、所述第一签名参数和所述第一随机数；当所述第一签名密钥为根据所述中继节点的中继节点标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定时，所述第一广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
  24. 根据权利要求23所述的装置，其中，所述第一生成单元包括：
    第一获取子单元，设置为获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；
    第一确定子单元，设置为根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第一广播消息；
    第一生成子单元，设置为当所述第一广播消息中携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和确定的所述第一随机数确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字 符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，当所述第一广播消息中未携带所述第一随机数时，根据密钥算法利用获取的所述中继节点标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定第二签名密钥；根据签名算法利用确定的所述第二签名密钥和第二字符串生成所述第二签名参数，其中，所述第二字符串为根据获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  25. 根据权利要求22所述的装置，其中，所述第一签名参数为根据第三字符串和所述中继节点从近距离通讯服务器中获取的中继节点标识认证密钥确定的，所述第三字符串由所述中继节点从近距离通讯服务器中获取的中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数。
  26. 根据权利要求25所述的装置，其中，所述第一生成单元包括：
    第二获取子单元，设置为获取所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址；
    第二确定子单元，设置为根据所述中继业务标识从接收的两个以上广播消息中确定所述中继节点广播的所述第二广播消息；
    第二生成子单元，设置为根据所述中继业务标识、中继节点标识认证密钥、所述中继节点的地址和所述中继节点广播所述第二广播消息时的国际标准时间生成所述第二签名参数。
  27. 根据权利要求24或26所述的装置，其中，所述第一获取子单元或所述第二获取子单元是设置为：
    向近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第一请求消息，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第一请求消息中携带远终端的授权验证信息；
    接收所述近距离通讯服务器在对所述远终端的授权验证信息进行验证，且验证通过后返回的第一响应消息，其中，所述第一响应消息中携带所述中 继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
  28. 根据权利要求24或26所述的装置，其中，所述第一获取子单元或所述第二获取子单元是设置为：
    向远终端的近距离通讯服务器发送用于请求获取中继节点的中继业务标识的第二请求消息，其中，所述第二请求消息中携带远终端的授权验证信息，所述远终端的近距离通讯服务器在对所述授权验证信息进行验证且验证通过后，将所述第二请求消息中携带的远终端的用户标识和位置信息发送给中继节点的近距离通讯服务器；
    接收所述中继节点的近距离通讯服务器根据所述远终端的用户标识和位置信息返回的第二响应消息，其中，所述第二响应消息中携带所述中继节点的中继业务标识、中继节点标识认证密钥和所述中继节点的地址。
  29. 根据权利要求21所述的装置，其中，所述第一处理模块包括：
    第二生成单元，设置为生成第三签名参数；
    第一发送单元，设置为至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于所述中继节点验证远终端是否合法；
    第一接收单元，设置为接收所述中继节点在验证所述第三签名参数为合法的情况下返回的响应消息；
    第一处理单元，设置为与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
  30. 根据权利要求21所述的装置，其中，所述第一处理模块包括：
    第三生成单元，设置为生成第三签名参数；
    第二发送单元，设置为至少将所述第三签名参数发送给近距离通讯服务器，其中，所述近距离通讯服务器同时为远终端和中继节点提供服务，所述第三签名参数用于所述近距离通讯服务器验证远终端是否合法；
    第二接收单元，设置为接收所述近距离通讯服务在验证所述第三签名参数为合法的情况下返回的响应消息；
    第二处理单元，设置为与所述中继节点建立中继连接，并与所述中继节 点进行设备到设备D2D业务处理。
  31. 根据权利要求21所述的装置，其中，所述第一处理模块包括：
    第四生成单元，设置为生成第三签名参数；
    第三发送单元，设置为至少将所述第三签名参数发送给所述中继节点，其中，所述第三签名参数用于指示所述中继节点向所述中继节点的近距离通讯服务器转发所述第三签名参数，以使所述中继节点的近距离通讯服务器根据所述第三签名参数验证远终端是否合法，并在验证结果为合法的情况下，向所述中继节点返回第二响应消息；
    第三接收单元，设置为接收所述中继节点根据所述第二响应消息返回的第三响应消息；
    第三处理单元，设置为根据所述第三响应消息与所述中继节点建立中继连接，并与所述中继节点进行设备到设备D2D业务处理。
  32. 根据权利要求29至31中任一项所述的装置，其中，所述第二生成单元、所述第三生成单元或所述第四生成单元是设置为：
    生成第二随机数；根据密钥算法利用所述第二随机数和通过接收所述中继节点广播的广播消息而获取的所述中继节点标识认证密钥确定第三签名密钥；根据签名算法利用确定的所述第三签名密钥和第四字符串确定所述第三签名参数，其中，所述第四字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的；和/或，
    根据密钥算法利用所述中继节点广播广播消息时的国际标准时间和通过接收所述中继节点广播的所述广播消息而获取的所述中继节点标识认证密钥确定第四签名密钥；根据签名算法利用确定的所述第四签名密钥和第五字符串确定所述第三签名参数，其中，所述第五字符串为根据通过接收所述中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  33. 一种业务处理装置，包括：
    第二验证模块，设置为验证远终端是否合法；
    第二处理模块，设置为在所述第二验证模块的验证结果为是的情况下，与所述远终端进行设备到设备D2D业务处理。
  34. 根据权利要求33所述的装置，还包括以下至少之一：
    第一确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第二确定模块，设置为根据密钥算法利用所述中继业务标识认证密钥和所述中继节点生成的第一随机数确定第一签名密钥，并根据签名算法利用所述第一签名密钥和第一字符串确定第一签名参数，其中，所述第一字符串由所述中继业务标识和所述中继节点的地址组成；第一广播模块，设置为广播所述第一签名参数、所述第一随机数和所述中继业务标识，广播的所述第一随机数和所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；
    第三确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第四确定模块，设置为根据密钥算法利用所述中继业务标识认证密钥和所述中继节点广播第一广播消息时的国际标准时间确定第二签名密钥，并根据签名算法利用所述第二签名密钥和第二字符串确定第一签名参数，其中，所述第二字符串由所述中继业务标识和所述中继节点的地址组成；第二广播模块，设置为广播所述第一广播消息，其中，所述第一广播消息中携带所述第一签名参数和所述中继业务标识，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理；
    第五确定模块，设置为在验证远终端是否合法之前，确定中继节点的中继业务标识、中继业务标识认证密钥；第六确定模块，设置为第三根据签名算法利用所述中继业务标识认证密钥和第三字符串确定第一签名参数，其中，所述第三字符串由所述中继业务标识、所述中继节点的地址和所述中继节点广播第二广播消息时的国际标准时间组成；第三广播模块，设置为广播所述第二广播消息，其中，所述第二广播消息中携带所述中继节点的中继业务标识和所述第一签名参数，广播的所述中继业务标识用于所述远终端验证所述中继节点是否合法，并在合法的情况下利用所述中继节点进行业务处理。
  35. 根据权利要求33所述的装置，其中，所述第二验证模块包括：
    第四接收单元，设置为接收所述远终端发送的用于请求建立中继连接的建立请求消息，其中，所述建立请求消息中至少携带所述远终端生成的第三签名参数；
    验证单元，设置为验证所述第三签名参数是否合法；
    第二确定单元，设置为在验证所述第三签名参数为合法的情况下，确定所述远终端为合法；和/或，在验证所述第三签名参数为非法的情况下，确定所述远终端为非法。
  36. 根据权利要求35所述的装置，其中，所述第三签名参数为根据签名算法利用第三签名密钥和第四字符串确定的，其中，所述第三签名密钥为根据密钥算法利用所述远终端生成的第二随机数和所述远终端通过接收中继节点广播的广播消息而获取的中继节点标识认证密钥确定的，所述第四字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  37. 根据权利要求36所述的装置，所述建立请求消息中还携带所述远终端生成的所述第二随机数，所述验证单元是设置为通过以下至少之一实现验证所述第三签名参数是否合法：
    根据签名算法利用第五签名密钥和第六字符串确定第四签名参数，其中，所述第五签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和接收的所述建立请求消息中携带的第二随机数确定的，所述第六字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第四签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；
    将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第六签名密钥和第七字符串确定第五签名参数，其中，所述第六签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述 建立请求消息中携带的第二随机数确定的，所述第七字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第五签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
  38. 根据权利要求35所述的装置，其中，所述第三签名参数为根据签名算法利用第四签名密钥和第五字符串确定的，其中，所述第四签名密钥为根据密钥算法利用中继节点广播广播消息时的国际标准时间和所述远终端通过接收中继节点广播的所述广播消息而获取的中继节点标识认证密钥确定的，所述第五字符串为根据所述远终端通过接收中继节点广播的广播消息而获取的所述中继节点的中继业务标识和所述中继节点的地址组成的。
  39. 根据权利要求38所述的装置，其中，所述验证单元是设置为通过以下至少之一实现验证所述第三签名参数是否合法：
    根据签名算法利用第七签名密钥和第八字符串确定第六签名参数，其中，所述第七签名密钥为根据密钥算法利用中继节点预先确定的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第八字符串为根据预先确定的中继业务标识和中继节点的地址组成；判断所述第六签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法；
    将所述建立请求消息转发给中继节点的近距离通讯服务器，其中，所述建立请求消息用于指示所述中继节点的近距离通讯服务器执行以下操作：根据签名算法利用第八签名密钥和第九字符串确定第七签名参数，其中，所述第八签名密钥为根据密钥算法利用中继节点的中继业务标识认证密钥和所述中继节点广播所述广播消息时的国际标准时间确定的，所述第九字符串为根据中继节点的中继业务标识和中继节点的地址组成；判断所述第七签名参数和所述第三签名参数是否相同；在判断结果为相同的情况下，确定所述第三签名参数为合法；和/或，在判断结果为不同的情况下，确定所述第三签名参数为非法。
  40. 根据权利要求34所述的装置，其中，确定模块是设置为通过如下方 式实现确定所述中继节点的中继业务标识认证密钥和所述中继业务标识：
    向近距离通讯服务器或者中继节点的近距离通讯服务器发送用于强求获取中继业务标识的第三请求消息，其中，所述近距离通讯服务器用于同时为中继节点和远终端提供服务器，所述第三请求消息中携带中继节点的授权验证信息；
    接收所述距离通讯服务器或者所述中继节点的近距离通讯服务器在对所述中继节点的授权验证信息进行验证且验证通过后返回的第三响应消息，其中，所述第三响应消息中携带所述中继节点的中继业务标识认证密钥和所述中继业务标识。
PCT/CN2016/079314 2015-08-17 2016-04-14 业务处理方法及装置 WO2016180153A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510504093.6 2015-08-17
CN201510504093.6A CN106470420A (zh) 2015-08-17 2015-08-17 业务处理方法及装置

Publications (1)

Publication Number Publication Date
WO2016180153A1 true WO2016180153A1 (zh) 2016-11-17

Family

ID=57248682

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079314 WO2016180153A1 (zh) 2015-08-17 2016-04-14 业务处理方法及装置

Country Status (2)

Country Link
CN (1) CN106470420A (zh)
WO (1) WO2016180153A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11328135B2 (en) * 2018-03-28 2022-05-10 Huawei Technologies Co., Ltd. Radio frequency identification system, method for constructing relay network, reader, and repeater
CN114731576A (zh) * 2019-11-28 2022-07-08 苹果公司 用于空闲或非活动用户装备的链路选择

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109257705B (zh) * 2017-07-14 2023-04-18 华为技术有限公司 数据传输方法、装置和系统
CN109379740B (zh) * 2018-10-10 2022-03-04 北京智芯微电子科技有限公司 无线协作通信安全交互方法
CN112019489B (zh) * 2019-05-31 2022-03-04 华为技术有限公司 验证方法及装置
CN117204000A (zh) * 2021-05-10 2023-12-08 中兴通讯股份有限公司 用于邻近服务的授权的系统与方法
CN114143577B (zh) * 2021-11-26 2023-10-24 中电信数智科技有限公司 一种视频获取方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102118386A (zh) * 2009-12-25 2011-07-06 佳能It解决方案股份有限公司 中继处理装置、中继处理方法
CN102724197A (zh) * 2012-06-25 2012-10-10 上海交通大学 无线中继网络中的链路双向安全认证方法
WO2014208033A2 (en) * 2013-06-28 2014-12-31 Nec Corporation Secure discovery for proximity based service communication
WO2014207506A1 (en) * 2013-06-25 2014-12-31 Nokia Corporation Device to device communication security
CN104754575A (zh) * 2013-12-31 2015-07-01 华为技术有限公司 一种终端认证的方法、装置及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102118386A (zh) * 2009-12-25 2011-07-06 佳能It解决方案股份有限公司 中继处理装置、中继处理方法
CN102724197A (zh) * 2012-06-25 2012-10-10 上海交通大学 无线中继网络中的链路双向安全认证方法
WO2014207506A1 (en) * 2013-06-25 2014-12-31 Nokia Corporation Device to device communication security
WO2014208033A2 (en) * 2013-06-28 2014-12-31 Nec Corporation Secure discovery for proximity based service communication
CN104754575A (zh) * 2013-12-31 2015-07-01 华为技术有限公司 一种终端认证的方法、装置及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"Study on architecture enhancements to support Proximity-based Services (ProSe", 3GPP, TR 23.703, V12.0.0, 10 March 2014 (2014-03-10), XP055329411 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11328135B2 (en) * 2018-03-28 2022-05-10 Huawei Technologies Co., Ltd. Radio frequency identification system, method for constructing relay network, reader, and repeater
CN114731576A (zh) * 2019-11-28 2022-07-08 苹果公司 用于空闲或非活动用户装备的链路选择

Also Published As

Publication number Publication date
CN106470420A (zh) 2017-03-01

Similar Documents

Publication Publication Date Title
WO2016180153A1 (zh) 业务处理方法及装置
CN110300117B (zh) Iot设备与用户绑定的认证方法、设备及介质
US11233817B2 (en) Methods and apparatus for end device discovering another end device
CN103686709B (zh) 一种无线网格网认证方法和系统
CN107005919A (zh) 用于使用未授权频带的单独lte ran的方法和装置
CN105828413A (zh) 一种d2d模式b发现的安全方法、终端和系统
WO2014032552A1 (zh) D2d设备的身份标识处理方法及装置
WO2016131289A1 (zh) 无线热点安全性检测方法、装置及用户设备
CN103297968A (zh) 一种无线终端认证的方法、设备及系统
WO2016112677A1 (zh) 发现业务码的校验处理、校验方法及装置
WO2014029267A1 (zh) 实现ue注册、以及业务呼叫的方法及装置及系统
CN115699678A (zh) 设备注销的方法、设备注册的方法、通信设备和云平台
Yuan et al. Comprose: Shaping future public safety communities with prose-based uavs
WO2016155478A1 (zh) 用户设备的认证方法和装置
CN105208557B (zh) 一种安全建立wifi连接的方法及无线路由器
WO2018049655A1 (zh) 设备配网方法、装置和系统
US20220408253A1 (en) Method and System for Authenticating a Base Station
CN112567812B (zh) 用于移动设备的位置报告
CN105163313A (zh) 一种基于隐藏SSID的WiFi连接鉴权方法
CN105592433A (zh) 设备到设备限制发现业务广播、监听方法、装置及系统
CN110557753B (zh) 一种用于公安网通的基于中继接入的dns重定向方法
CN104602235B (zh) 微型基站接入方法和系统
CN105554757A (zh) 一种基于云的无线接入认证方法
WO2016090578A1 (zh) 认证的处理方法、装置和终端
WO2016112678A1 (zh) 数据处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16792003

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16792003

Country of ref document: EP

Kind code of ref document: A1