WO2017020206A1 - 一种通信方法及相关装置 - Google Patents

一种通信方法及相关装置 Download PDF

Info

Publication number
WO2017020206A1
WO2017020206A1 PCT/CN2015/085890 CN2015085890W WO2017020206A1 WO 2017020206 A1 WO2017020206 A1 WO 2017020206A1 CN 2015085890 W CN2015085890 W CN 2015085890W WO 2017020206 A1 WO2017020206 A1 WO 2017020206A1
Authority
WO
WIPO (PCT)
Prior art keywords
area
area key
enb
key
message
Prior art date
Application number
PCT/CN2015/085890
Other languages
English (en)
French (fr)
Inventor
应江威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201580066251.2A priority Critical patent/CN107005844B/zh
Priority to JP2018504899A priority patent/JP6553806B2/ja
Priority to PCT/CN2015/085890 priority patent/WO2017020206A1/zh
Priority to EP15899981.3A priority patent/EP3319354B1/en
Publication of WO2017020206A1 publication Critical patent/WO2017020206A1/zh
Priority to US15/880,540 priority patent/US10939413B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/021—Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H04W72/04—Wireless resource allocation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/06—Registration at serving network Location Register, VLR or user mobility server
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a communication method and related apparatus.
  • the intelligent transportation system aims to achieve continuous communication between vehicles and vehicles, between vehicles and between vehicles and roads to exchange current vehicles or surrounding environment to reduce traffic accidents, improve the safety of traffic, help alleviate traffic congestion, and reduce Energy consumption, reducing pollution emissions, protecting the environment, improving transportation efficiency and driving related industries.
  • the ITS Intelligent Transport System
  • DSRC Dedicated Short Range Communication
  • the UE (User Equipment) requests a certificate from a CA (Certificate Authority) on the network side. After the UE obtains the certificate and caches it locally, the UE broadcasts a message to the surrounding vehicle at a frequency of 1 to 10 Hz, and carries the vehicle information (for example, CAM (Cooperative Awareness Message), DEMN (Decentralized Environmental Notification Message), distributed environment. Notification message)).
  • vehicle information for example, CAM (Cooperative Awareness Message), DEMN (Decentralized Environmental Notification Message), distributed environment. Notification message).
  • the originating UE In order to enable the receiving UE to verify the validity of the identity of the originating UE, the originating UE needs to carry its certificate in the message; in order to enable the receiving UE to verify whether the CAM/DENM message itself receives a security attack (forgery and tampering), the originating end is required.
  • the UE signs the message using the private key corresponding to the certificate and carries the signature value in the message.
  • the receiving UE first verifies the validity of the certificate in the CAM/DENM message, and then verifies whether the signature value in the message is correct.
  • the format of the V2V (vehicle to vehicle) message can be seen in FIG. 1 , and the certificate needs to carry a Certificate and a Signature.
  • each DSRC message carries a certificate and a signature, and the air interface has a large overhead; in addition, the certificate-based signature and the encryption calculation time are long, and if the delay-sensitive vehicle communication message is too large, the processing delay may be too large. Will have a greater impact.
  • the embodiment of the invention provides a communication method and related device, so as to implement authentication on the network side by the network side in the vehicle-to-vehicle communication, and reduce the air interface overhead.
  • the first aspect provides a communication method, including:
  • the mobility management entity MME receives an attach request message sent by the evolved base station eNB, where the attach request message is used by the user equipment UE to request to attach to the network, and the attach request message includes the identity identifier of the UE;
  • the MME sends an authentication data request message including the identity of the UE to the home subscriber network (HSS) according to the attach request message, so that the HSS performs an authorization check on the UE according to the identity identifier of the UE.
  • HSS home subscriber network
  • an authentication data response message that is sent by the HSS, including an authentication vector AV, where the authentication data response message is used to indicate that the UE is authorized to pass the check;
  • the MME determines, according to the authentication data response message, that the UE is allowed to perform a vehicle to any other terminal V2X service, and authenticates the UE according to the AV.
  • the attach request message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the MME sends an authentication data request message including the identity of the UE to the HSS according to the attach request message, so that the HSS performs an authorization check on the UE according to the identity identifier of the UE, including:
  • the MME sends an authentication data request message including the identity identifier of the UE and the V2X indication information to the HSS according to the attach request message, so that the HSS determines the UE according to the identity identifier of the UE. Whether it is allowed to conduct V2X business.
  • the MME determines, according to the authentication data response message, that the UE is allowed to perform V2X business, including:
  • the MME determines that the UE is allowed to perform V2X service according to the authentication data response message and the V2X indication information included in the attach request message.
  • the authentication data response message further includes V2X indication information, where the V2X indication information is used by Instructing the UE to be a V2X type;
  • Determining, by the MME, that the UE is allowed to perform a V2X service according to the authentication data response message including:
  • the MME determines that the UE is allowed to perform V2X service according to the authentication data response message and the V2X indication information included in the authentication data response message.
  • the MME After the UE is authenticated according to the AV, the method further includes:
  • the MME After the MME authenticates the UE, the MME sends indication information that the UE is allowed to perform V2X service to the eNB, so that the eNB allocates a V2X communication resource to the UE.
  • the attaching The request message further includes location information of the UE.
  • the method further includes:
  • an area key response message sent by the V2X server receives, by the MME, an area key response message sent by the V2X server, where the area key response message includes area key information of an area corresponding to location information of the UE and area density of an adjacent area of the area. Key information
  • the MME sends an area key assignment message to the UE, where the area key assignment message includes area key information of the area corresponding to the location information of the UE and area key information of the adjacent area of the area.
  • the area key information is used by the UE in the area to secure the V2X message.
  • the area key information includes a correspondence between the area key, the area key ID, and the area ID.
  • the method further includes:
  • the MME sends an area key assignment message protected by the NAS security context to the UE.
  • the second aspect provides another communication method, including:
  • the evolved base station eNB receives the first attach request message sent by the user equipment UE;
  • the eNB allocates V2X communication resources to the UE according to the indication information that the UE is allowed to perform V2X service.
  • the eNB before the eNB allocates the V2X communication resource to the UE according to the indication information, the eNB further includes:
  • the eNB receives a V2X resource scheduling request sent by the UE, and the V2X resource scheduling request is used to request a V2X communication resource.
  • the eNB allocates V2X communication resources to the UE, including:
  • the eNB sends an area key assignment message to the UE, where the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located;
  • the area key information is used by the UE in the area to secure the V2X communication message.
  • the method before the eNB sends the area key distribution message to the UE, the method further includes:
  • the eNB sends an area key request message to the V2X server;
  • an area key response message sent by the V2X server receives, by the eNB, an area key response message sent by the V2X server, where the area key response message includes area key information of an area where the eNB is located and a neighboring area of the area where the eNB is located The domain key information of the domain.
  • the area key information includes: an area key, an area key ID, and an area ID. Correspondence relationship.
  • the UE is allowed to perform V2X services.
  • the indication information is carried in the initial context establishment request message;
  • the method further includes:
  • the eNB sends an area key assignment message to the UE, including:
  • the eNB sends an area key assignment message protected by the AS security context to the UE.
  • the third aspect provides another communication method, including:
  • the home subscriber network receives the authentication data request message sent by the mobility management entity MME, including the identity of the user equipment UE;
  • the HSS performs an authorization check on the UE according to the identity identifier of the UE;
  • an authentication data response message including an authentication vector AV to the MME where the authentication data response message indicates that the UE authorizes checking, so that the MME determines that the UE is allowed according to the authentication data response message.
  • the vehicle is carried out to any other terminal V2X service, and the UE is authenticated according to the AV.
  • the authentication data request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the HSS determines, according to the identity identifier of the UE, whether the UE is allowed to perform V2X services.
  • the authentication data request message does not include V2X indication information
  • the authentication data response message further includes the V2X indication information, where the V2X indication The information is used to indicate that the UE is of a V2X type.
  • the fourth aspect provides another communication method, including:
  • the vehicle generates a regional key for the area where the first communication device is located to any other terminal V2X server;
  • the V2X server sends a zone key to the first communication device.
  • the V2X server sends the area key to the first communications device, including:
  • the V2X server sends the area key information of the area where the eNB is located to the evolved base station eNB, and the area key information of the adjacent area of the area where the eNB is located.
  • the V2X server sends the related area key to the corresponding device, including:
  • the V2X server sends an area key response message to the eNB, where the area key response message includes area key information of an area where the eNB is located, and an area key of a neighboring area of the area where the eNB is located information.
  • the V2X server sends the area key to the first communications device, including:
  • the V2X server receives an area key request message sent by the mobility management entity MME, where the area key request message includes location information of the user equipment UE;
  • the V2X server sends an area key response message to the MME, where the area key response message includes area key information of an area corresponding to the location information of the UE, and a regional area of the adjacent area of the area. Key information.
  • the V2X server sends the area key to the first communications device, including:
  • the V2X server establishes a secure connection with the user equipment UE to the universal bootstrapping architecture GBA or the GBA push push security mechanism;
  • the V2X server sends an area key response message to the UE, where the area key response message includes area key information of an area corresponding to the location information of the UE, and a regional area of the adjacent area of the area. Key information.
  • the fifth aspect provides another communication method, including:
  • the user equipment UE sends an attach request message to the evolved base station eNB;
  • the UE Receiving, by the UE, an area key assignment message sent by the mobility management entity MME, where the area key assignment message is that the MME determines that the UE is allowed to perform V2X service, and after the UE is authenticated, the UE is sent to the UE. And sending, the area key assignment message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area.
  • the receiving, by the UE, the V2X communication resource allocated by the evolved base station eNB includes:
  • an area key assignment message sent by the eNB where the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located .
  • the method further includes:
  • an area key response message sent by the eNB where the area key response message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located.
  • the area key information includes: area density Correspondence between the key, the area key ID, and the area ID.
  • the method further includes:
  • V2X message Transmitting, by the UE, a V2X message to the receiving end, where the V2X message includes a message content, an area key ID, an area ID, and a message verification value, where the message verification value is that the area key ID and the area ID are used.
  • the area key is obtained by integrity protection of the message content, the area key ID, and the area ID.
  • the attach request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • a sixth aspect provides a communication device, including:
  • a receiving module configured to receive an attach request message sent by an evolved base station eNB, where the attach request message is used by the user equipment UE to request to attach to the network, where the attach request message includes an identity identifier of the UE;
  • a sending module configured to send, according to the attach request message, an authentication data request message that includes an identity of the UE to the home subscriber network (HSS), so that the HSS performs an authorization check on the UE according to the identity identifier of the UE.
  • HSS home subscriber network
  • the receiving module is further configured to receive an authentication data response message that is sent by the HSS, including an authentication vector AV, where the authentication data response message is used to indicate that the UE is authorized to pass the check;
  • a determining module configured to determine, according to the authentication data response message, that the UE is allowed to perform a vehicle to any other terminal V2X service;
  • an authentication module configured to authenticate the UE according to the AV.
  • the attach request message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the sending module is configured to send, according to the attach request message, an identity data identifier including the identity identifier of the UE and the V2X indication information to the HSS, so that the HSS is based on the identity of the UE
  • the identity determines whether the UE is allowed to perform V2X services.
  • the determining module is specifically configured to: according to the authentication data response message, and the attach request message
  • the V2X indication information included is determined to be that the UE is allowed to perform V2X services.
  • the authentication data response message further includes V2X indication information, where the V2X indication information is used by Instructing the UE to be a V2X type;
  • the determining module is specifically configured to determine that the UE is allowed to perform V2X service according to the authentication data response message and the V2X indication information included in the authentication data response message.
  • the sending The module is further configured to: after the authentication module authenticates the UE, send, to the eNB, indication information that the UE is allowed to perform V2X service, so that the eNB allocates a V2X communication resource to the UE.
  • the attaching The request message further includes location information of the UE;
  • the sending module is further configured to send, to the V2X server, an area key request message that includes location information of the UE;
  • the receiving module is further configured to receive an area key response message sent by the V2X server, where the area key response message includes area key information of an area corresponding to the location information of the UE, and a phase of the area. Area key information of the neighboring area;
  • the sending module is further configured to send an area key assignment message to the UE, where the area key assignment message includes area key information of an area corresponding to the location information of the UE and an adjacent area of the area.
  • the area key information is used by the UE in the area to secure the V2X message.
  • the area key information includes: a region key, an area key ID, and a region ID relationship.
  • the apparatus further includes:
  • the sending module is specifically configured to send an area key distribution message protected by the NAS security context to the UE.
  • a seventh aspect provides another communication device, including:
  • a receiving module configured to receive a first attach request message sent by the user equipment UE
  • a sending module configured to send, according to the first attach request message, a second attach request message to the mobility management entity MME;
  • the receiving module is further configured to receive, by the MME, indication information that the UE is allowed to perform a vehicle to any other terminal V2X service;
  • the allocating module is further configured to allocate the V2X communication resource to the UE according to the indication information that the UE is allowed to perform the V2X service.
  • the receiving module is further configured to receive a V2X resource scheduling request sent by the UE, where the V2X resource scheduling request is used to request a V2X communication resource. .
  • the allocating module is configured to send an area key allocation message to the UE.
  • the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located; the area key information is used for an intra-area UE to V2X Communication messages are secured.
  • the sending module is further configured to send a region key request message to the V2X server;
  • the receiving module is further configured to receive an area key response message sent by the V2X server, where the area key response message includes area key information of an area where the eNB is located, and neighboring area Area key information for the zone.
  • the area key information includes: an area key, an area key ID, and an area ID. Correspondence relationship.
  • the UE is allowed to perform V2X service
  • the indication information is carried in the initial context establishment request message
  • the device also includes:
  • the sending module is specifically configured to send an area key distribution message that is protected by the AS security context to the UE.
  • the eighth aspect provides another communication method, including:
  • a receiving module configured to receive an authentication data request message that is sent by the mobility management entity MME and includes an identity identifier of the user equipment UE;
  • An authorization module configured to perform an authorization check on the UE according to the identity identifier of the UE;
  • a sending module configured to send, to the MME, an authentication data response message that includes an authentication vector AV, where the authentication data response message indicates that the UE authorizes checking, so that the MME determines the UE according to the authentication data response message.
  • the vehicle is allowed to proceed to any other terminal V2X service, and the UE is authenticated according to the AV.
  • the authentication data request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the authorization module is specifically configured to determine, according to the identity identifier of the UE, whether the UE is allowed to perform V2X services.
  • the authentication data request message does not include V2X indication information
  • the authentication data response message further includes the V2X indication information, where the V2X indication The information is used to indicate that the UE is of a V2X type.
  • a ninth aspect provides another communication device, including:
  • Generating a module configured to generate an area key of an area where the first communication device is located
  • a sending module configured to send the area key to the first communications device.
  • the sending module is configured to send, to an evolved base station eNB, area key information of an area where the eNB is located, and where the Area key information for the adjacent area of the area.
  • the sending module is configured to: when the device receives an area key request message sent by an eNB, send a regional secret to the eNB And a key response message, where the area key response message includes area key information of an area where the eNB is located, and area key information of a neighboring area of the area where the eNB is located.
  • the sending module is configured to: when the device receives the area key request message sent by the eNB, send the area secret to the eNB And a key response message, where the area key response message includes area key information of an area where the eNB is located, and area key information of a neighboring area of the area where the eNB is located.
  • the device further includes:
  • Establishing a module configured to establish, by the user equipment UE, a secure connection between the universal bootstrapping architecture GBA or the GBA push push security mechanism;
  • the sending module is configured to: when the device receives the area key request message sent by the UE, where the area key request message includes the location information of the UE, send the area key to the UE In response to the message, the area key response message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area.
  • a tenth aspect provides another communication device, including:
  • a sending module configured to send an attach request message to the evolved base station eNB
  • a receiving module configured to receive, by the eNB, a vehicle to any other terminal V2X communication resource, where the V2X communication resource is allocated to the UE when the eNB receives the indication information that the UE is allowed to perform V2X service; Or receiving an area key assignment message sent by the mobility management entity MME, where the area key assignment message is that the MME determines that the UE is allowed to perform V2X service, and after sending the UE to pass the authentication, sending the message to the UE.
  • the area key assignment message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area.
  • the receiving module is configured to receive an area key allocation message that is sent by the eNB, where the area key allocation message includes the The area key information of the area in which the eNB is located and the area key information of the adjacent area of the area in which the eNB is located.
  • the sending module is further configured to send an area key request message to the eNB;
  • the receiving module is further configured to receive an area key response message sent by the eNB, where the area key response message includes area key information of an area where the eNB is located, and an adjacent area of the area where the eNB is located Area key information.
  • the area key information includes: area density Correspondence between the key, the area key ID, and the area ID.
  • the sending module is configured to send a V2X message to the receiving end, where the V2X message includes a usage The content of the message in which the area key is encrypted, and the area key ID and the area ID corresponding to the area key.
  • the attach request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • the embodiment of the invention has the following beneficial effects:
  • the MME may send an authentication data request message including the identity of the UE to the HSS according to the attach request message, so that the HSS performs authorization check on the UE according to the identity identifier of the UE. And receiving an authentication data response message including the AV sent by the HSS, and determining, according to the authentication data response message, that the UE allows the V2X service, and authenticating the UE according to the AV, so that the UE is authenticated by the network side in the vehicle-to-vehicle communication. , reducing the air interface overhead.
  • FIG. 1 is a schematic diagram of a format of a conventional V2V message
  • FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart diagram of another communication method according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another communication device according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • FIG. 14 is a schematic structural diagram of another communication device according to an embodiment of the present invention.
  • FIG. 15 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • FIG. 16 is a schematic structural diagram of another communication apparatus according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • FIG. 20 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • FIG. 21 is a schematic structural diagram of another communication device according to an embodiment of the present invention.
  • FIG. 22 is a schematic structural diagram of a communication system according to an embodiment of the present invention.
  • the embodiment of the invention provides a communication method, which can implement the authentication of the UE by the network side in the vehicle-to-vehicle communication, and reduce the air interface overhead. The following description will be respectively made.
  • FIG. 2 is a schematic flowchart diagram of a communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 2 is mainly described from the MME side. As shown in FIG. 2, the method may include the following steps:
  • Step 201 The MME receives an attach request message sent by the eNB, where the attach request message is used by the UE to request to attach to the network, where the attach request message includes an identity identifier of the UE.
  • the UE when the UE (User Equipment) needs to be attached to the network, the UE may send an attach request message to the eNB (evolved Node B, the evolved base station), and the eNB receives the attach request message (first attach) After the request message, the second attach request message may be sent to the MME (Mobility Management Entity) according to the first attach request message.
  • the eNB evolved Node B, the evolved base station
  • MME Mobility Management Entity
  • the eNB may not The attach request message is processed and directly forwarded to the MME.
  • the first attach request message is the same as the second attach request message; or the eNB may send the first attach request message after receiving the first attach request message sent by the UE.
  • the second attach message is re-encapsulated and forwarded to the MME.
  • the first attach request message and the second attach request message may be different.
  • the attach request message may further include a V2X (Vehicle-to-Everything) indication information, where the V2X indication information is used to indicate that the UE is of a V2X type, that is, the UE.
  • V2X Vehicle-to-Everything
  • the capability of the V2X communication is provided.
  • the MME can learn that the UE is a V2X type according to the V2X indication information included in the attach request message.
  • the V2X may also be referred to as LTE-V2X, that is, a vehicle based on LTE (Long Term Evolution) and other terminals;
  • the V2X communication may include, but is not limited to, V2V communication, V2I (Vehicle-to-Infrastructure, Vehicle-to-infrastructure) communication, and V2P (Vehicle-to-Pedestrian) communication; wherein V2I communication may include, but is not limited to, vehicle-to-base communication, vehicle-to-roadside unit communication, and vehicle and traffic lights Communication module communication, etc.
  • Step 202 The MME sends an authentication data request message including the identity identifier of the UE to the HSS according to the attach request message, so that the HSS performs an authorization check on the UE according to the identity identifier of the UE.
  • the MME after receiving the attach request message sent by the eNB, the MME needs to determine whether the UE is allowed to perform V2X service.
  • the MME may send an authentication data request message including the identity of the UE to the HSS (Home Subscriber Server).
  • the HSS may query the corresponding subscription information according to the identity identifier of the UE, and determine, according to the subscription information, whether the UE is allowed to perform V2X service; when the HSS determines that the UE is allowed to perform V2X service.
  • the HSS may send an authentication data response message including an AV (Authentication Vector) to the MME.
  • the identity of the UE may include, but is not limited to, an IMSI (International Mobile Subscriber Identification Number) or a TMSI (Temporary Mobile Subscriber Identity).
  • the MME After receiving the authentication data response message sent by the HSS, the MME may ring according to the authentication data.
  • the UE is authenticated by the AV included in the message.
  • the MME to authenticate the UE refer to the related implementation of the MME to authenticate the UE in the prior art, which is not described in detail in the embodiment of the present invention.
  • the MME when the V2X indication information is further included in the attach request message of the UE, in step 202, the MME sends an authentication data request including the identity of the UE to the HSS according to the attach request message.
  • the message is such that the HSS performs an authorization check on the UE according to the identity of the UE, which may include:
  • the MME sends an authentication data request message including the identity identifier of the UE and the V2X indication information to the HSS according to the attach request message, so that the HSS determines whether the UE is allowed to perform the V2X service according to the identity identifier of the UE.
  • the MME may carry the V2X indication information in the authentication data request message sent to the HSS, so that the HSS, when learning that the UE is in the V2X type, queries the UE's subscription information according to the identity identifier of the UE, and according to the subscription information. It is judged whether the UE is allowed to perform V2X service.
  • the authentication data response message sent by the HSS to the MME may include the V2X indication information, or may not include the V2X indication information, and the embodiment of the present invention does not do this. limited.
  • the authentication data response message sent by the HSS to the MME may further include V2X indication information, where the V2X indication information is used to indicate that the UE is of a V2X type, so that the MME learns that the UE is a V2X type.
  • Step 203 The MME receives an authentication data response message including an AV sent by the HSS, where the authentication data response message is used to indicate that the UE authorizes the check.
  • the HSS may send an authentication data response message including the AV to the MME.
  • the MME may determine that the UE authorization check passes, and further, the MME may perform authentication on the UE according to the AV included in the authentication data response message.
  • Step 204 The MME determines, according to the authentication data response message, that the UE is allowed to perform V2X service, and performs authentication on the UE according to the AV.
  • the MME determines, according to the authentication data response message, that the UE is allowed to perform the V2X service, and may include:
  • the MME determines that the UE is allowed to perform V2X service according to the authentication data response message and the V2X indication information included in the attach request message.
  • the MME may determine that the UE is a V2X type, and further, when the MME receives the authentication data response message for indicating that the UE is authorized to pass the check, the MME may determine the UE. Allowed for V2X business.
  • the authentication data response message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the MME determines that the UE is allowed to perform the V2X service according to the authentication data response message, and may include:
  • the MME determines that the UE is allowed to perform V2X service according to the authentication data response message and the V2X indication information included in the authentication data response message.
  • the MME may determine that the UE authorization check is passed. Further, the MME may determine that the UE is a V2X type according to the V2X indication information included in the authentication data response message, and therefore, the MME It can be determined that the UE is allowed to perform V2X services.
  • the MME may perform authentication on the UE according to the AV included in the authentication data response message.
  • the MME may send an authentication request message (UE AuthenticationRequest) to the UE, and receive an authentication response message (UE Authentication Response) returned by the UE, where the authentication response message includes a RES (Response) value, and the MME may compare the RES.
  • the value is the same as the XRES (Expected Response) value included in the AV. If the two are the same, it is determined that the UE authentication is passed; otherwise, it is determined that the UE authentication fails.
  • the MME may further include:
  • the MME After the MME passes the UE authentication, the MME sends indication information that the UE is allowed to perform V2X service to the eNB, so that the eNB allocates V2X communication resources for the UE.
  • the MME determines that the UE is allowed to perform V2X services, and after the UE passes the authentication, the eNB may send indication information that the UE is allowed to perform V2X services.
  • the eNB may consider the UE. It is a legal V2X type UE, and thus, the eNB can allocate information required for the UE to perform V2X communication for the UE.
  • the eNB may actively allocate information required for the UE to perform V2X communication to the UE. Alternatively, after receiving the indication information, the eNB may wait until receiving the V2X communication sent by the UE. When the information acquisition request is made, the information required for the UE to perform V2X communication is transmitted to the UE.
  • information required for the UE to perform V2X communication may include, but is not limited to, time-frequency resources, and area key information of an area where the eNB currently serving the UE is located and area key information of the adjacent area.
  • the area key corresponding to the same area is the same by generating and managing the area key, so that it is not necessary to separately configure and manage the certificate for each UE, thereby reducing the security management workload of the CA;
  • the technical solution provided by the embodiment of the present invention has smaller vehicle communication messages and reduces the safety overhead; and further, the certificate-based communication scheme with the existing DSRC-based vehicle-vehicle communication scheme Compared with the encryption calculation time, the technical solution provided by the embodiment of the present invention takes less time to secure the V2X message by using the area key, and reduces the message processing delay.
  • the attach request message may further include location information of the UE, and correspondingly, after the MME authenticates the UE according to the AV, the MME may further include the following steps:
  • the MME sends an area key request message including location information of the UE to the V2X server.
  • the MME receives the area key response message sent by the V2X server, where the area key response message includes the area key of the area corresponding to the location information of the UE and the area key information of the adjacent area of the area;
  • the MME sends an area key assignment message to the UE, where the area key assignment message includes the area key information of the area corresponding to the location information of the UE and the adjacent area of the area.
  • the area key information is used by the UE in the area to secure the V2X message.
  • the area key is generated and saved by the V2X server.
  • the MME may send the area key request including the location information of the UE to the V2X server. a message to obtain the area key information corresponding to the location information of the UE, and the area key information of the neighboring area of the area; the MME acquires the area key information corresponding to the location information of the UE, and the adjacent area of the area After the area key information, it can be allocated to the UE, so that the UE can secure the V2X message according to the area key information.
  • the area key information may include a relationship between an area key (Area Key), an area key ID (Area Key ID), and an area ID (Area ID); wherein the area key ID is used for unique Identifies an area key that is used to uniquely identify an area.
  • the UE may save the correspondence between the area key, the area key ID, and the area ID of the area corresponding to the location information of the UE included in the area key assignment message, and The correspondence between the area key, the area key ID, and the area ID of the adjacent area of the area.
  • the UE can perform integrity protection on the V2X message by using the area key of the current area, and carry the area key ID and the area ID of the current area in the V2X message.
  • the sending end UE may further encrypt the message content of the V2X message by using the area key of the current area (ie, the V2X message may include the encrypted message content, and the area key ID and the area ID).
  • the receiving end UE may query the corresponding relationship between the area key, the area key ID and the area ID saved by the area according to the area key ID and the area ID carried in the V2X message. And determining an area key corresponding to the area key ID and the area ID carried in the V2X message, and performing integrity verification on the V2X message according to the area key.
  • the receiving UE may decrypt the encrypted message content according to the area key.
  • the MME may further include:
  • the MME establishes a NAS (Non-Access Stratum) security context with the UE;
  • the MME can establish a NAS security context with the UE.
  • a NAS security context For the specific implementation, refer to the related process of establishing the NAS security context in the prior art, which is not repeatedly described in the embodiment of the present invention.
  • the MME sends the area key assignment message to the UE, which may include:
  • the MME transmits an area key assignment message protected by the NAS security context to the UE.
  • an area may be divided according to a geographic location, for example, an area covered by one eNB or multiple eNBs constitutes one area, or one or more TA (Tracking Area Identity) is used as an area, and each The area has a corresponding zone key.
  • the V2X type UE in the area uses the area key to secure the V2X message.
  • one eNB may cover multiple areas, or one area may include multiple eNBs (ie, an area composed of multiple eNBs).
  • an eNB allocates a region key for a UE
  • the UE needs to carry the location information of the UE, and the eNB receives the region key sent by the UE.
  • the area key information of the area corresponding to the location information, and the area key information of the adjacent area of the area are obtained according to the location information of the UE, and are allocated to the UE.
  • the UE When a plurality of eNBs may be included in an area, when the UE requests the area key from the eNB, the UE may not need to carry the location information of the UE. After receiving the area key acquisition request sent by the UE, the eNB may directly acquire the area (eNB). The area key information of the area, and the area key information of the adjacent area of the area in which it is located, and allocates it to the UE.
  • the area key may be generated and managed by an eNB.
  • the area key information of the area key generated by the eNB needs to be advertised to the eNB of the neighboring area; wherein, the eNB
  • the announcement of the inter-area key information can be implemented by modifying the existing X2 interface instructions or by using the new X2 interface instructions.
  • the foregoing area key may be generated and managed by the V2X server and configured to the corresponding eNB.
  • a V2X server can be deployed in the system, the V2X server is used to generate and manage the area key, and the area key is configured to the corresponding eNB. Since the keys of all areas are generated and managed by the V2X server, the reuse of the area key can be avoided.
  • a V2X server may be deployed in the system, where the V2X server is used to generate and manage the area key, and the V2X server does not send the area key to the eNB, that is, the eNB does not sense the area key.
  • the V2X server may directly allocate the area key to the UE or allocate the area key to the UE through the MME.
  • FIG. 3 is a schematic flowchart diagram of another communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 3 is mainly described from the eNB side. As shown in FIG. 3, the method may include the following steps:
  • Step 301 The eNB receives a first attach request message sent by the UE.
  • Step 302 The eNB sends a second attach request message to the MME according to the first attach request message.
  • the UE when the UE needs to be attached to the network, the UE may send an attach request message to the eNB, and after receiving the attach request message, the eNB may send a second attach request message to the MME according to the first attach request message.
  • the eNB may not directly process the first attach request message, and directly forward the message to the MME.
  • the first attach request message is the same as the second attach request message; or
  • the eNB may perform corresponding processing on the first attach request message, re-encapsulate it into a second attach message, and forward the message to the MME.
  • the first attach request message and the first The second attach request message can be different.
  • Step 303 The eNB receives the indication information that the UE sent by the MME is allowed to perform the V2X service.
  • the MME after receiving the second attach request message sent by the eNB, the MME
  • the authentication data request message may be sent to the HSS, and the UE is authenticated after the UE is allowed to perform the V2X service.
  • the specific implementation refer to the related description in the process shown in FIG. 2, and details are not described herein again.
  • the MME determines that the UE is allowed to perform the V2X service, and after the UE is authenticated, the MME may send the indication information that the UE is allowed to perform the V2X service.
  • Step 304 The eNB allocates V2X communication resources to the UE according to the indication information that the UE is allowed to perform V2X service.
  • the eNB may actively allocate the V2X communication resource to the UE.
  • the eNB may wait until the V2X resource scheduling request sent by the UE is received, and then allocate the V2X communication resource to the UE;
  • the eNB before the eNB allocates the V2X communication resource to the UE according to the indication information that the UE is allowed to perform the V2X service, the eNB may further include:
  • the eNB receives the V2X resource scheduling request sent by the UE, and the V2X resource scheduling request is used to request the V2X communication resource.
  • the V2X communication resource may include, but is not limited to, a time-frequency resource, and area key information of an area where the eNB currently serving the UE is located and area key information of the adjacent area.
  • the eNB allocates V2X communication resources to the UE, which may include:
  • the eNB sends an area key assignment message to the UE, where the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the area key information is used for the area.
  • the inner UE secures the V2X communication message.
  • the area key information may be generated and managed by the eNB; or the area key information may be generated and managed by the V2X server and configured to the corresponding eNB.
  • the eNB may further include the following steps:
  • the eNB sends an area key request message to the V2X server.
  • the eNB receives the area key response message sent by the V2X server, where the area key response message includes area key information of the area where the eNB is located, and area key information of the adjacent area of the area.
  • the area key information may include a regional key, an area key ID, and a corresponding relationship of the area IDs.
  • the UE may save the correspondence between the area key, the area key ID, and the area ID included in the area key assignment message, and the area of the adjacent area. Correspondence between the key, the area key ID, and the area ID.
  • the UE can perform integrity protection on the V2X message by using the area key of the current area, and carry the area key ID and the area ID of the current area in the V2X message.
  • the sending end UE may further encrypt the message content of the V2X message by using the area key of the current area (ie, the V2X message may include the encrypted message content, and the area key ID and the area ID).
  • the receiving end UE may query the correspondence between the area key, the area key ID and the area ID saved by the area according to the area key ID and the area ID carried in the V2X message.
  • the area key corresponding to the area key ID and the area ID carried in the V2X message is determined, and the V2X message is integrity verified according to the area key.
  • the receiving UE may decrypt the encrypted message content according to the area key.
  • the indication information that the UE is allowed to perform the V2X service may be carried in the initial context setup request message.
  • the eNB may establish an AS (Access Stratum) security context with the UE.
  • AS Access Stratum
  • the eNB sends the area key assignment message to the UE, which may include:
  • the eNB sends an area key assignment message protected by the AS security context to the UE.
  • FIG. 4 is a schematic flowchart diagram of a communication method according to an embodiment of the present invention. Among them, the communication method described in FIG. 4 is mainly described from the HSS side. As shown in FIG. 4, the method may include the following steps:
  • Step 401 The HSS receives an authentication data request message that is sent by the MME and includes an identity identifier of the UE.
  • the MME may send an authentication data request message including the identity identifier of the UE to the HSS.
  • the identity of the UE may include, but is not limited to, an IMSI or a TMSI of the UE.
  • Step 402 The HSS performs an authorization check on the UE according to the identity identifier of the UE.
  • the HSS may query the subscription information of the UE according to the identity identifier of the UE included in the authentication data request message, and perform authorization check on the UE according to the subscription information.
  • the authentication data request message may include V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the HSS performs an authorization check on the UE according to the identity of the UE, which may include:
  • the HSS determines whether the UE is allowed to perform V2X services according to the identity of the UE.
  • the HSS may first query the corresponding subscription information according to the identity identifier of the UE included in the authentication data request message, and according to the The subscription information determines whether the UE is allowed to perform V2X services.
  • Step 403 The HSS sends an authentication data response message including the AV to the MME, where the authentication data response message indicates that the UE authorizes the check, so that the MME determines that the UE is allowed to perform the V2X service according to the authentication data response message, and authenticates the UE according to the AV.
  • the HSS when the HSS determines that the UE is allowed to perform the V2X service to perform the authorization check on the UE, the HSS may send an authentication data response message including the AV to the MME, so that the MME learns that the UE authorization check passes.
  • the MME determines, according to the authentication data response message, that the UE is allowed to perform
  • the UE is allowed to perform
  • the authentication data response message may further include V2X indication information, where the V2X indication information is used to indicate The UE is of the V2X type.
  • the HSS when the V2X indication information is not included in the authentication data request message, after the HSS queries the corresponding subscription information according to the identity identifier of the UE, if it is determined according to the subscription information that the UE is allowed to perform the V2X service, the HSS may determine The UE is of the V2X type. In addition, the HSS may carry the V2X indication information in the authentication data response message, so that the MME knows that the UE is of the V2X type.
  • FIG. 5 is a schematic flowchart diagram of another communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 5 is mainly described from the V2X server side. As shown in FIG. 5, the method may include the following steps:
  • Step 501 The V2X server generates an area key of an area where the first communication device is located.
  • the area key is generated and managed by the V2X server.
  • the first communications device may include, but is not limited to, an eNB, an MME, or a UE.
  • Step 502 The V2X server sends the area key to the first communications device.
  • the V2X server sends the area key to the first communications device, which may include:
  • the V2X server transmits the area key information of the area in which the eNB is located to the eNB, and the area key information of the area in which the eNB is located.
  • the area key is assigned by the eNB to the UE.
  • the area key information may be actively sent to the eNB according to the area where the eNB is located, and allocated by the eNB to the corresponding UE.
  • the V2X server sends the area to the first communication device.
  • the key can include:
  • the V2X server receives the area key request message sent by the eNB;
  • the V2X server sends a region key response message to the eNB, where the area key response message includes area key information of an area where the eNB is located, and area key information of a neighboring area of the area where the eNB is located.
  • the area key is assigned by the eNB to the UE.
  • the area key information is not sent to the eNB.
  • the area key information is sent to the eNB after receiving the area key request message sent by the eNB.
  • the key information is assigned to the corresponding UE.
  • the V2X server sends the area key to the first communications device, which may include:
  • the V2X server receives the area key request message sent by the MME, where the area key request message includes the location information of the UE.
  • the V2X server sends an area key response message to the MME, where the area key response message includes area key information of the area corresponding to the location information of the UE, and area key information of the adjacent area of the area.
  • the area key is assigned by the MME to the UE.
  • the MME may send an area key request message including the location information of the UE to the V2X server to obtain the area key information corresponding to the location information of the UE.
  • the V2X server may query the area key information of the area corresponding to the location information of the UE and the area key of the adjacent area of the area according to the location information of the UE included therein.
  • the information is carried in the area key response message and returned to the MME, and the MME allocates the area key information to the corresponding UE.
  • the V2X server sends the area key to the first communications device, which may include:
  • the V2X server establishes a secure connection with the UE via the GBA or GBA push security mechanism
  • the V2X server receives the area key request message sent by the UE, where the area key request message includes location information of the UE;
  • the V2X server sends a regional key response message to the UE, where the area key response message includes the area key of the area corresponding to the location information of the UE, and the area key of the adjacent area of the area.
  • the zone key is assigned to the UE by the V2X server.
  • the UE may establish a GBA (Generic Bootstrapping Architecture) or a GBA push (Push) security mechanism with the V2X server, and after the GBA or GBA push security mechanism is successfully established, the UE may send the bearer to the V2X server.
  • the V2X server may query the corresponding area key according to the location information of the UE included in the area key acquisition request, and correspondingly locate the location information of the UE.
  • the area key information of the area and the area key information of the adjacent area are transmitted to the UE.
  • the V2X server functions as a network application function (NAF) entity.
  • NAF network application function
  • the area key information may include a regional key, an area key ID, and a corresponding relationship of the area IDs.
  • the specific implementation of the eNB assigning the area key to the UE, the MME assigning the area key to the UE, and the UE using the area key information to secure the V2X message may be referred to the method flow shown in FIG. 2 or 3. The related description is not repeated here.
  • FIG. 6 is a schematic flowchart diagram of another communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 6 is mainly described from the UE side. As shown in FIG. 6, the method may include the following steps:
  • Step 601 The UE sends an attach request message to the eNB, and proceeds to step 602a or 602b.
  • the UE when the UE is powered on and the UE is within the coverage of the eNB, the UE may send an attach request message to the eNB.
  • the attach request message includes an identity of the UE and location information of the UE, and the identity information may include, but is not limited to, an IMSI or a TMSI.
  • the attach request message may further include V2X indication information, where the V2X indication information is used to indicate that the UE is of a V2X type.
  • Step 602 The UE receives the V2X communication resource allocated by the eNB, where the V2X communication resource is allocated to the UE when the eNB receives the indication information that the UE is allowed to perform the V2X service.
  • the eNB may send a second attach request message to the MME, and when receiving the indication information of the V2X service that is allowed to be sent by the MME, , allocating V2X communication resources to the UE.
  • the MME receives the attach request message sent by the eNB, and the related implementation of the MME transmitting the indication information that the UE is allowed to perform the V2X service to the eNB. For the related implementation in the process shown in FIG. 2 or FIG. 3, details are not described herein.
  • the receiving, by the UE, the V2X communication resource allocated by the eNB may include:
  • the UE receives the area key assignment message sent by the eNB, where the area key assignment message includes the area key information of the area where the eNB is located and the area key information of the adjacent area of the area.
  • the foregoing V2X communication resource may include the area key information
  • the specific implementation of the eNB to allocate the area key information for the UE may be referred to the related description in the method flow shown in FIG. 3, and details are not described herein again.
  • the method may further include:
  • the UE sends an area key request message to the eNB;
  • the UE receives the area key response message sent by the eNB, and the area key response message includes area key information of the area where the eNB is located and area key information of the adjacent area of the area where the eNB is located.
  • the eNB does not include the area key information in the V2X communication resource allocated by the UE, and when the UE wants to acquire the area key, the area key request message needs to be sent to the eNB, and the area key returned by the eNB is received. In response to the message, the area key information included therein is obtained.
  • the UE receives an area key assignment message sent by the MME, where the MME determines that the UE is allowed to perform V2X service, and sends the message to the UE after the UE passes the authentication, where the area key assignment message includes the UE.
  • the area of the area corresponding to the location information Key information, and area key information for neighboring areas of the area.
  • the MME determines that the UE is allowed to perform the V2X service, and after the UE is authenticated, the area key information may be allocated to the UE.
  • the MME determines that the UE is allowed to perform the V2X service, and the specific implementation of the MME to authenticate the UE can be referred to the related implementation in the method flow shown in FIG. 2, and details are not described herein.
  • the area key information may include a regional key, an area key ID, and a corresponding relationship of the area IDs.
  • the V2X message may be sent to the receiving end, where the V2X message includes the message content, the area key ID, the area ID, and the message verification value.
  • the message verification value is obtained by using the area key ID and the area key corresponding to the area ID to perform integrity protection on the message content, the area key ID, and the area ID.
  • the content of the message may be the content of the message that is encrypted by using the area key.
  • the content of the message may be the content of the message that is encrypted by using the area key.
  • FIG. 7 is a schematic flowchart diagram of another communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 7 is mainly described from four aspects: UE, eNB, MME, and HSS. As shown in FIG. 7, the method may include the following steps:
  • Step 701 The UE sends a first attach request message to the eNB.
  • the UE when the UE is powered on and the UE is within the coverage of the eNB, the UE may send an attach request message to the eNB.
  • the attach request message includes an identity of the UE, and the identity information may include, but is not limited to, an IMSI or a TMSI.
  • the first attach request message may further include V2X indication information.
  • Step 702 The eNB sends a second attach request message to the MME.
  • the eNB may send a second attach request message to the MME.
  • the second attach request message may further include V2X indication information.
  • Step 703 The MME sends an authentication data request message to the HSS, where the authentication data request message includes an identity identifier of the UE.
  • the MME may send an authentication data request message to the HSS to request the HSS to perform an authorization check on the UE.
  • the MME may determine, according to the V2X indication information, that the UE is a V2X type, and send the V2X indication information to the HSS in the authentication data request message.
  • Step 704 The HSS performs an authorization check on the UE according to the identity identification information of the UE.
  • the HSS may query the subscription information of the UE according to the identity identifier of the UE included in the authentication data request message, and perform an authorization check on the UE according to the subscription information.
  • the HSS performs an authorization check on the UE, which is mainly to determine whether the UE is allowed to perform V2X services.
  • the HSS may send an authentication data response message including the AVs to the MME.
  • Step 705 The HSS sends an authentication data response message including the AV to the MME.
  • the V2X indication information when the V2X indication information is not included in the attach request message sent by the UE, the V2X indication information is not included in the authentication data request message received by the HSS.
  • the authentication data response message sent by the HSS to the MME may further include V2X indication information, so that the MME knows that the UE is of the V2X type.
  • the MME when the MME receives the authentication data response message sent by the HSS, the MME can be considered as being allowed to perform the V2X service.
  • the authentication data response message may further include indication information for indicating that the UE is allowed to perform V2X service; in this embodiment, the MME receives the authentication data response message sent by the HSS, and It is determined that the UE is allowed to perform V2X service when it is determined that the authentication data response message includes indication information indicating that the UE is allowed to perform V2X service.
  • Step 706 The MME performs authentication on the UE according to the AV.
  • the MME may The UE is authenticated according to the AV included in the authentication response message.
  • the MME when the MME passes the UE authentication, the MME may send the indication information that the UE is allowed to perform the V2X service to the eNB.
  • the indication information may be included in an initial context setup request message.
  • Step 707 The MME sends an initial context setup request message to the eNB, where the initial context setup request message includes indication information that the UE is allowed to perform V2X service.
  • Step 708 The eNB establishes an AS security context with the UE.
  • the eNB may establish an AS security context with the UE.
  • the MME may send an initial context setup response message.
  • Step 709 The eNB sends an area key assignment message to the UE, where the area key assignment message includes area key information.
  • the eNB may allocate the area key to the UE.
  • the area key assignment message includes a regional key, an area key ID, and a regional ID corresponding to the area in which the eNB is located, and an area key, an area key ID, and an area of the adjacent area. The correspondence between the three IDs.
  • the eNB may send the area key assignment message to the UE after being protected by the AS security context.
  • Step 710 The UE sends an area key assignment response message to the eNB.
  • the UE may save the area key information included in the area key assignment response message, and send an area key assignment response message to the eNB.
  • the area key assignment message includes a correspondence between the area key, the area key ID, and the area ID of the area in which the eNB is located, and the area key, the area key ID, and the area of the adjacent area.
  • the corresponding relationship between the three IDs, the UE can save the correspondence.
  • the UE may save the area key, the area key ID, and the area ID included in the area key assignment message.
  • the UE can perform integrity protection on the V2X message by using the area key of the current area, and carry the area key ID and the area ID of the current area in the V2X message.
  • the sending end UE may further encrypt the message content of the V2X message by using the area key of the current area (ie, the V2X message may include the encrypted message content, and the area key ID and the area ID).
  • the receiving end UE may query the correspondence between the area key, the area key ID and the area ID saved by the area according to the area key ID and the area ID carried in the V2X message.
  • the area key corresponding to the area key ID and the area ID carried in the V2X message is determined, and the V2X message is integrity verified according to the area key.
  • the receiving UE may decrypt the encrypted message content according to the area key.
  • the area key may be generated and managed by an eNB.
  • step 701 the following steps (not shown in FIG. 7) may be included before step 701:
  • Step 700a the eNB generates and manages the area key.
  • the area key may be generated and managed by the V2X server and configured to the corresponding eNB.
  • step 701 the following steps (not shown in FIG. 5) may be included before step 701:
  • Step 700b The V2X server generates and manages the area key, and configures the area key to the corresponding eNB.
  • the V2X may be deployed as a separate entity, or may be deployed as a functional entity of the HSS or the MME.
  • the HSS may perform an authentication check on the UE according to the subscription information corresponding to the identity identifier of the UE, determine whether the UE is allowed to perform V2X service, and when the UE is allowed to perform V2X.
  • the authentication data is sent to the MME.
  • the MME sends the indication information that the UE is allowed to perform V2X service to the eNB after the mutual authentication with the UE, so that the eNB allocates the area key to the UE, and then the UE uses the area key to perform the V2X message.
  • the UE performs the authorization check on the UE to ensure the validity of the UE identity, thereby preventing the UE from carrying the certificate in the V2X message.
  • the area keys of the same area are the same, there is no need to be the same.
  • Each UE in the area separately configures and manages the security certificate, which reduces the workload of the CA.
  • FIG. 8 is a schematic flowchart diagram of another communication method according to an embodiment of the present invention.
  • the communication method described in FIG. 8 is mainly described from five aspects of a UE, an eNB, an MME, a V2X server, and an HSS. As shown in FIG. 8, the method may include the following steps:
  • Step 800 The V2X server generates and manages the area key.
  • the area key is generated and managed by the V2X server.
  • Step 801 The UE sends a first attach request message to the eNB.
  • the UE when the UE is powered on and the UE is within the coverage of the eNB, the UE may send an attach request message to the eNB.
  • the attach request message includes an identity of the UE and location information of the UE, and the identity information may include, but is not limited to, an IMSI or a TMSI.
  • the first attach request message may further include V2X indication information.
  • Step 802 The eNB sends a second attach request message to the MME.
  • the eNB after receiving the first attach request message sent by the UE, the eNB needs to send a second attach request message to the MME.
  • the second attach request message may further include V2X indication information.
  • Step 803 The MME sends an authentication data request message to the HSS, where the authentication data request message includes an identity identifier of the UE.
  • the MME may send an authentication data request message to the HSS to request the HSS to perform an authorization check on the UE.
  • the MME may The V2X indication information determines that the UE is of the V2X type, and the V2X indication information is included in the authentication data request message and sent to the HSS.
  • Step 804 The HSS performs an authorization check on the UE according to the identity identification information of the UE.
  • the HSS may query the subscription information of the UE according to the identity identifier of the UE included in the authentication data request message, and perform an authorization check on the UE according to the subscription information.
  • the HSS performs an authorization check on the UE, which is mainly to determine whether the UE is allowed to perform V2X services.
  • the HSS may send an authentication data response message including the AVs to the MME.
  • Step 805 The HSS sends an authentication data response message including the AV to the MME.
  • the V2X indication information when the V2X indication information is not included in the attach request message sent by the UE, the V2X indication information is not included in the authentication data request message received by the HSS.
  • the authentication data response message sent by the HSS to the MME may further include V2X indication information, so that the MME knows that the UE is of the V2X type.
  • the MME when the MME receives the authentication data response message sent by the HSS, the MME can be considered as being allowed to perform the V2X service.
  • the authentication data response message may further include indication information for indicating that the UE is allowed to perform V2X service; in this embodiment, the MME receives the authentication data response message sent by the HSS, and It is determined that the UE is allowed to perform V2X service when it is determined that the authentication data response message includes indication information indicating that the UE is allowed to perform V2X service.
  • Step 806 The MME authenticates the UE according to the AV.
  • the MME may perform authentication on the UE according to the AV included in the authentication response message.
  • Step 807 The MME establishes a NAS security context with the UE.
  • the NAS security context may be established with the UE.
  • the specific implementation of establishing the NAS security context between the MME and the UE refer to the related process of establishing the NAS security context in the prior art. , no longer here Narration.
  • Step 808 The MME sends an area key request message to the V2X server, where the area key request message includes location information of the UE.
  • the MME may send an area key request message to the V2X server to request the area key for the UE.
  • Step 809 The V2X server sends a regional key response message to the MME according to the location information of the UE.
  • the V2X server may query the area key maintained by the area according to the location information of the UE included in the area key request message to determine the location information corresponding to the UE.
  • the area key of the area and the area key of the adjacent area are carried in the area key response message and sent to the MME.
  • the area key response message may include a corresponding relationship between the area key, the area key ID, and the area ID of the area corresponding to the location information of the UE, and the area key and the area key of the adjacent area. The correspondence between the ID and the area ID.
  • Step 810 The MME sends an area allocation message to the UE, where the area allocation message includes area key information.
  • the MME may send the area key information included in the MME to the UE.
  • the area key response message includes a correspondence between the area key, the area key ID, and the area ID of the area corresponding to the location information of the UE, and the area key and the area key ID of the adjacent area. And the correspondence between the three areas of the area ID, and the corresponding relationship is also included in the area key assignment message sent by the MME to the UE.
  • the MME may send the area key assignment message to the UE after being protected by the NAS security context.
  • Step 811 The UE sends an area key assignment response message to the MME.
  • the UE may save the area key information included in the area key assignment response message, and send an area key assignment response message to the MME.
  • the area key assignment message includes a correspondence between the area key, the area key ID, and the area ID of the area corresponding to the location information of the UE, and the area key and the area key ID of the adjacent area. And the correspondence between the three areas of the area ID, the UE can save the correspondence.
  • the UE may save the correspondence between the area key, the area key ID, and the area ID included in the area key assignment message, and the neighbor relationship. Correspondence between the regional key, the area key ID, and the area ID of the area.
  • the UE can perform integrity protection on the V2X message by using the area key of the current area, and carry the area key ID and the area ID of the current area in the V2X message.
  • the sending end UE may further encrypt the message content of the V2X message by using the area key of the current area (ie, the V2X message may include the encrypted message content, and the area key ID and the area ID).
  • the receiving end UE may query the correspondence between the area key, the area key ID and the area ID saved by the area according to the area key ID and the area ID carried in the V2X message.
  • the area key corresponding to the area key ID and the area ID carried in the V2X message is determined, and the V2X message is integrity verified according to the area key.
  • the receiving UE may decrypt the encrypted message content according to the area key.
  • the UE may perform an authentication check on the UE according to the subscription information corresponding to the identity of the UE, and determine whether the UE is allowed to perform V2X services, and when the UE is allowed to perform the UE.
  • the V2X service sends an authentication data response message to the MME, so that after the MME authenticates with the UE, the MME requests the V2X server for the area key corresponding to the location information of the UE, and sends the area key to the UE, and then the UE performs the V2X.
  • the V2X message can be secured according to the area key.
  • the UE performs the authorization check on the UE to ensure the validity of the UE identity, thereby preventing the UE from carrying the certificate in the V2X message.
  • the area keys of the same area are the same, there is no need to be the same.
  • Each UE in the area separately configures and manages the security certificate, which reduces the workload of the CA.
  • unified generation, management, and distribution through V2X servers The area key can avoid the situation where the area key is reused.
  • FIG. 9 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention, where the communication apparatus can be applied to an MME in the foregoing method embodiment.
  • the communication device can include:
  • the receiving module 901 is configured to receive an attach request message sent by the evolved base station eNB, where the attach request message is used by the user equipment UE to request to attach to the network, where the attach request message includes the identity identifier of the UE;
  • the sending module 902 is configured to send, according to the attach request message, an authentication data request message including an identity of the UE to the home subscriber server HSS, so that the HSS authorizes the UE according to the identity identifier of the UE. an examination;
  • the receiving module 901 is further configured to receive an authentication data response message that is sent by the HSS, including an authentication vector AV, where the authentication data response message is used to indicate that the UE is authorized to pass the check;
  • a determining module 903 configured to determine, according to the authentication data response message, that the UE is allowed to perform a vehicle to any other terminal V2X service;
  • the authentication module 904 is configured to authenticate the UE according to the AV.
  • the MME after receiving the attach request message sent by the eNB, the MME needs to determine whether the UE is allowed to perform V2X service.
  • the MME may send an authentication data request message including the identity of the UE to the HSS (Home Subscriber Server).
  • the HSS may query the corresponding subscription information according to the identity identifier of the UE, and determine, according to the subscription information, whether the UE is allowed to perform V2X service; when the HSS determines that the UE is allowed to perform V2X service.
  • the HSS may send an authentication data response message including the AV to the MME.
  • the identity of the UE may include, but is not limited to, an IMSI or a TMSI of the UE.
  • the MME may perform mutual authentication with the UE according to the authentication data response message, where the MME performs specific authentication on the UE.
  • the MME performs specific authentication on the UE.
  • the attach request message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the sending module 902 may be specifically configured to send, according to the attach request message, an authentication data request message including the identity identifier of the UE and the V2X indication information to the HSS, so that the HSS is configured according to the HSS
  • the identity of the UE determines whether the UE is allowed to perform V2X services.
  • the determining module 903 may be specifically configured to determine, according to the authentication data response message and the V2X indication information included in the attach request message, that the UE is allowed to perform V2X service.
  • the MME may determine that the UE is a V2X type, and further, when the MME receives the authentication data response message for indicating that the UE is authorized to pass the check, the MME may determine the UE. Allowed for V2X business
  • the authentication data response message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the determining module 903 may be specifically configured to determine, according to the authentication data response message and the V2X indication information included in the authentication data response message, that the UE is allowed to perform V2X service.
  • the MME may determine that the UE authorization check is passed. Further, the MME may determine that the UE is a V2X type according to the V2X indication information included in the authentication data response message, and therefore, the MME It can be determined that the UE is allowed to perform V2X services.
  • the sending module 902 is further configured to: after the authentication module passes the authentication of the UE, send, to the eNB, indication information that the UE is allowed to perform a V2X service, so that The eNB allocates V2X communication resources to the UE.
  • the attach request message further includes location information of the UE
  • the sending module 902 is further configured to send, to the V2X server, an area key request message that includes location information of the UE;
  • the receiving module 901 is further configured to receive an area key response message sent by the V2X server, where the area key response message includes area key information of the area corresponding to the location information of the UE, and the area Area key information of adjacent areas;
  • the sending module 902 is further configured to send an area key allocation message to the UE, where the area key allocation message includes area key information of an area corresponding to the location information of the UE, and a phase of the area.
  • the area key information of the neighboring area, the area key information is used by the UE in the area to secure the V2X message.
  • the area key is generated and saved by the V2X server.
  • the MME may send an area key request including the location information of the UE to the V2X server. a message to obtain the area key information corresponding to the location information of the UE, and the area key information of the neighboring area of the area; the MME acquires the area key information corresponding to the location information of the UE, and the adjacent area of the area After the area key information, it can be allocated to the UE, so that the UE can secure the V2X message according to the area key information.
  • the area key information includes a correspondence between the area key, the area key ID, and the area ID.
  • FIG. 10 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication apparatus shown in FIG. 10 is optimized by the communication apparatus shown in FIG. Compared with the communication device shown in FIG. 9, the communication device shown in FIG. 10 may further include:
  • the establishing module 905 is configured to establish, by the authentication module 904, the non-access stratum NAS security context with the UE after the UE is authenticated by the UE;
  • the sending module 902 may be specifically configured to send an area key distribution message protected by the NAS security context to the UE.
  • FIG. 11 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication device shown in FIG. 11 may include a bus 1103, and a processor 1101 and a memory 1102 interconnected with the bus 1103.
  • the memory 1102 stores program codes.
  • the structure of the communication device shown in the figure is not The invention is defined by the invention, which may be either a bus-shaped structure or a star-shaped structure, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements.
  • the processor 1101 calls the program code stored in the memory 1102, and can perform the following operations:
  • an authentication data request message that includes an identity of the UE to the HSS, so that the HSS performs an authorization check on the UE according to the identity identifier of the UE;
  • the attach request message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the processor 1101 instructs the program code stored in the memory 1102 to send an authentication data request message including the identity of the UE to the HSS according to the attach request message, so that the HSS performs the identity according to the identity of the UE.
  • the UE performs an authorization check, which may specifically include:
  • the processor 1101 instructs the program code stored in the memory 1102 to determine, according to the authentication data response message, that the UE is allowed to perform a V2X service, and may specifically include:
  • the authentication data response message further includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the processor 1101 calls a program code stored in the memory 1102 according to the number of authentications. According to the response message, it is determined that the UE is allowed to perform the V2X service, which may specifically include:
  • the processor 1101 calls the program code stored in the memory 1102 to authenticate the UE according to the AV, the following operations may also be performed:
  • the MME After the MME authenticates the UE, the MME sends indication information that the UE is allowed to perform V2X service to the eNB, so that the eNB allocates a V2X communication resource to the UE.
  • the attach request message further includes location information of the UE
  • the processor 1101 calls the program code stored in the memory 1102 to authenticate the UE according to the AV, the following operations may also be performed:
  • the area key response message includes area key information of an area corresponding to the location information of the UE and area key information of an adjacent area of the area;
  • the area key assignment message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area,
  • the area key information is used by the UE in the area to secure the V2X message.
  • the area key information includes a correspondence between the area key, the area key ID, and the area ID.
  • the method further includes:
  • the processor 1101 may send the area key assignment message to the UE by using the program code stored in the memory 1102, which may specifically include:
  • An area key assignment message protected by the NAS security context is sent to the UE.
  • FIG. 12 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication device can be applied to the eNB in the foregoing method embodiment.
  • the communication device can include:
  • the receiving module 1201 is configured to receive a first attach request message sent by the user equipment UE.
  • the sending module 1202 is configured to send, according to the first attach request message, a second attach request message to the mobility management entity MME;
  • the receiving module 1201 is further configured to receive, by the MME, indication information that the UE is allowed to perform a vehicle to any other terminal V2X service;
  • the allocating module 1203 is further configured to allocate a V2X communication resource to the UE according to the indication information that the UE is allowed to perform V2X service.
  • the UE when the UE needs to be attached to the network, the UE may send an attach request message to the eNB, and after receiving the attach request message, the eNB may send a second attach request message to the MME according to the first attach request message.
  • the eNB may not directly process the first attach request message, and directly forward the message to the MME.
  • the first attach request message is the same as the second attach request message; or
  • the eNB may perform corresponding processing on the first attach request message, re-encapsulate it into a second attach message, and forward the message to the MME.
  • the first attach request message and the first The second attach request message can be different.
  • the receiving module 1201 is further configured to receive a V2X resource scheduling request sent by the UE, where the V2X resource scheduling request is used to request a V2X communication resource.
  • the allocating module 1203 may be specifically configured to send an area key assignment message to the UE, where the area key assignment message includes area key information and an area of the area where the eNB is located.
  • the area key information of the adjacent area of the area; the area key information is used for security protection of the V2X communication message by the UE in the area.
  • the sending module 1202 may be further configured to send a region key request message to the V2X server.
  • the receiving module 1201 may be further configured to receive an area key response message sent by the V2X server, where the area key response message includes area key information of an area where the eNB is located, and the area where the eNB is located Area key information for adjacent areas.
  • the area key information includes: an area key and an area key ID. Correspondence between the three areas and the area ID.
  • the indication information that the UE is allowed to perform the V2X service is carried in the initial context setup request message
  • FIG. 13 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication apparatus shown in FIG. 13 is optimized by the communication apparatus shown in FIG. .
  • the communication device shown in FIG. 13 may further include:
  • the sending module 1202 may be specifically configured to send an area key distribution message that is protected by the AS security context to the UE.
  • FIG. 14 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication device shown in FIG. 14 may include a bus 1403, and a processor 1401 and a memory 1402 interconnected with the bus 1403; and the program code stored in the memory 1402.
  • the structure of the communication device shown in the figure does not constitute a limitation of the present invention. It may be a bus-shaped structure or a star structure, and may include more or less than the illustration. Parts, or combine some parts, or different parts.
  • the processor 1401 calls the program code stored in the memory 1402, and can perform the following operations:
  • the processor 1401 calls the program code stored in the memory 1402 to perform the following operations before the V2X communication resource is allocated to the UE according to the indication information:
  • V2X resource scheduling request sent by the UE, where the V2X resource scheduling request is used to request a V2X communication resource.
  • the processor 1401 calls the program code stored in the memory 1402 to allocate V2X communication resources to the UE, including:
  • the eNB sends an area key assignment message to the UE, where the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located;
  • the area key information is used by the UE in the area to secure the V2X communication message.
  • the following operations may also be performed:
  • the area key response message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located.
  • the area key information includes: a correspondence between the area key, the area key ID, and the area ID.
  • the indication information that the UE is allowed to perform the V2X service is carried in the initial context setup request message
  • the processor 1401 calls the program code stored in the memory 1402 to receive the initial context setup request message that is sent by the MME and carries the indication information that the UE is allowed to perform the V2X service, the following operations may also be performed:
  • the processor 1401 sends the area key allocation message to the UE by using the program code stored in the memory 1402, which may specifically include:
  • An area key assignment message protected by the AS security context is sent to the UE.
  • FIG. 15 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication device can be applied to the HSS in the above method embodiment.
  • the communication device can include:
  • the receiving module 1501 is configured to receive an authentication data request message that is sent by the mobility management entity MME and includes an identity identifier of the user equipment UE.
  • the authorization module 1502 is configured to perform an authorization check on the UE according to the identity identifier of the UE.
  • the sending module 1503 is configured to send, to the MME, an authentication data response message that includes an authentication vector AV, where the authentication data response message indicates that the UE authorizes the check to pass, so that the MME root According to the authentication data response message, it is determined that the UE is allowed to perform a vehicle to any other terminal V2X service, and the UE is authenticated according to the AV.
  • the HSS may query the subscription information of the UE according to the identity identifier of the UE included in the authentication data request message, and perform authorization check on the UE according to the subscription information.
  • the authentication data request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the authorization module 1502 may be specifically configured to determine, according to the identity identifier of the UE, whether the UE is allowed to perform V2X services.
  • the authentication data request message does not include V2X indication information
  • the authentication data response message further includes the V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • FIG. 16 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication device shown in FIG. 16 may include a bus 1603, and a processor 1601 and a memory 1602 interconnected with the bus 1603; and the program 1602 stores program codes.
  • the structure of the communication device shown in the figure does not constitute a limitation of the present invention. It may be a bus-shaped structure or a star structure, and may include more or less than the illustration. Parts, or combine some parts, or different parts.
  • the processor 1601 calls the program code stored in the memory 1602, and can perform the following operations:
  • the HSS performs an authorization check on the UE according to the identity identifier of the UE;
  • an authentication data response message including an AV to the MME where the authentication data response message indicates that the UE authorizes checking, so that the MME determines, according to the authentication data response message, that the UE is allowed to perform V2X. Traffic, and authenticating the UE according to the AV.
  • the authentication data request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type;
  • the processor 1601 invokes the program code stored in the memory 1602 to perform an authorization check on the UE according to the identity identifier of the UE, and may specifically include:
  • the authentication data request message does not include V2X indication information
  • the authentication data response message further includes the V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • FIG. 17 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication device can be applied to the V2X server in the foregoing method embodiment.
  • the communication device can include:
  • a generating module 1701 configured to generate an area key of a region where the first communications device is located
  • the sending module 1702 is configured to send the area key to the first communications device.
  • the area key is generated and managed by the V2X server.
  • the first communications device may include, but is not limited to, an eNB, an MME, or a UE.
  • the sending module 1702 is configured to send, to an evolved base station eNB, area key information of an area where the eNB is located, and an area key of a neighboring area of the area where the eNB is located. information.
  • the sending module 1702 may be specifically configured to: when the apparatus receives the area key request message sent by the eNB, send the area key response message to the eNB, where the area The key response message includes area key information of an area in which the eNB is located, and area key information of a neighboring area of the area in which the eNB is located.
  • the sending module 1702 may be specifically configured to: when the device receives the area key request message sent by the mobility management entity MME, where the area key request message includes the user equipment UE The location information is sent to the MME, where the area key response message includes the area key information of the area corresponding to the location information of the UE, and the area of the adjacent area of the area. Key information.
  • FIG. 18 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication apparatus shown in FIG. 18 is shown in FIG.
  • the communication device is optimized.
  • the communication device shown in FIG. 18 may further include:
  • the establishing module 1703 is configured to establish, by the user equipment UE, a secure connection between the universal bootstrapping architecture GBA or the GBA push push security mechanism;
  • the sending module 1702 may be specifically configured to: when the device receives the area key request message sent by the UE, where the area key request message includes the location information of the UE, The UE sends an area key response message, where the area key response message includes area key information of the area corresponding to the location information of the UE, and area key information of the adjacent area of the area.
  • the UE may establish a GBA or GBA push security mechanism with the V2X server, and after the GBA or GBA push security mechanism is successfully established, the UE may send the regional secret carrying the location information to the V2X server.
  • the V2X server may query the corresponding area key according to the location information of the UE included in the area key acquisition request, and the area key of the area corresponding to the location information of the UE. The information and the area key information of the adjacent area are transmitted to the UE.
  • the V2X server functions as a NAF entity.
  • the V2X server functions as a NAF entity.
  • the related description in the process of establishing the GBA or GBApush security mechanism in the prior art The examples are not described here.
  • FIG. 19 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication device shown in FIG. 19 may include a bus 1903, and a processor 1901 and a memory 1902 interconnected with the bus 1903; and the program 1902 stores program codes.
  • the structure of the communication device shown in the figure does not constitute a limitation of the present invention. It may be a bus-shaped structure or a star structure, and may include more or less than the illustration. Parts, or combine some parts, or different parts.
  • the processor 1901 calls the program code stored in the memory 1902, and can perform the following operations:
  • the zone key is sent to the first communication device.
  • the processor 1901 in response to the program code stored in the memory 1902, sends the area key to the first communication device, which may specifically include:
  • the processor 1901 in response to the program code stored in the memory 1902, sends the relevant area key to the corresponding device, which may specifically include:
  • the eNB And sending, to the eNB, an area key response message, where the area key response message includes area key information of an area where the eNB is located, and area key information of a neighboring area of the area where the eNB is located.
  • the processor 1901 in response to the program code stored in the memory 1902, sends the area key to the first communication device, which may specifically include:
  • the V2X server sends an area key response message to the MME, where the area key response message includes area key information of an area corresponding to the location information of the UE, and a regional area of the adjacent area of the area. Key information.
  • the processor 1901 in response to the program code stored in the memory 1902, sends the area key to the first communication device, which may specifically include:
  • the area key response message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area.
  • FIG. 20 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication device can be applied to the UE in the foregoing method embodiment.
  • the communication device can include:
  • the sending module 2001 is configured to send an attach request message to the evolved base station eNB.
  • the receiving module 2002 is configured to receive the V2X communication of the vehicle allocated by the eNB to any other terminal a resource, the V2X communication resource is allocated to the UE when the eNB receives the indication information that the UE is allowed to perform V2X service; or receives an area key assignment message sent by the mobility management entity MME, where the area The key assignment message is sent by the MME to the UE after determining that the UE is allowed to perform V2X service, and after the UE is authenticated, the area key assignment message includes location information of the UE. The area key information of the area, and the area key information of the adjacent area of the area.
  • the receiving module 2002 may be specifically configured to receive an area key allocation message sent by the eNB, where the area key allocation message includes area key information of an area where the eNB is located, and The area key information of the adjacent area of the area in which it is located.
  • the sending module is further configured to send an area key request message to the eNB;
  • the receiving module is further configured to receive an area key response message sent by the eNB, where the area key response message includes area key information of an area where the eNB is located, and an adjacent area of the area where the eNB is located Area key information.
  • the area key information includes a correspondence between the area key, the area key ID, and the area ID.
  • the sending module 2001 may be specifically configured to send a V2X message to the receiving end, where the V2X message includes a message content, an area key ID, an area ID, and a message verification value; wherein the message is The verification value is obtained by integrity protection of the message content, the area key ID, and the area ID using the area key ID and the area key corresponding to the area ID.
  • the attach request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • FIG. 21 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention.
  • the communication device shown in FIG. 21 may include a bus 2103, and a processor 2101 and a memory 2102 interconnected with the bus 2103; and the program code stored in the memory 2102.
  • the structure of the communication device shown in the figure does not constitute a limitation of the present invention. It may be a bus-shaped structure or a star structure, and may include more or less than the illustration. Parts, or combine some parts, or different parts.
  • the processor 2101 calls the program code stored in the memory 2102, and can perform the following operations:
  • the eNB Receiving, by the eNB, the allocated vehicle to any other terminal V2X communication resource, where the V2X communication resource is allocated to the UE when the eNB receives the indication information that the UE is allowed to perform V2X service; or
  • the area key assignment message includes area key information of an area corresponding to the location information of the UE, and area key information of a neighboring area of the area.
  • the processor 2101 by using the program code stored in the memory 2102, to receive the V2X communication resource allocated by the evolved base station eNB, may specifically include:
  • the area key assignment message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located.
  • the method further includes:
  • an area key response message sent by the eNB where the area key response message includes area key information of an area where the eNB is located and area key information of a neighboring area of the area where the eNB is located.
  • the area key information includes a correspondence between the area key, the area key ID, and the area ID.
  • processor 2101 invoking the program code stored in the memory 2102 may also perform the following operations:
  • V2X message includes a message content, an area key ID, an area ID, and a message verification value; wherein the message verification value is a regional density corresponding to the area key ID and the area ID
  • the key is obtained by integrity protection of the message content, the area key ID, and the area ID.
  • the attach request message includes V2X indication information, where the V2X indication information is used to indicate that the UE is a V2X type.
  • FIG. 22 is a schematic structural diagram of a communication system according to an embodiment of the present invention.
  • the communication system can include:
  • the eNB 2201 sends an attach request message to the MME, where the attach request message is used for the UE to request to attach to the network, and the attach request message includes an identity identifier of the UE.
  • the MME 2202 is configured to receive an attach request message sent by the evolved base station eNB, and send an authentication data request message including the identity identifier of the UE to the home subscription subscriber server HSS according to the attach request message.
  • the HSS 2203 is configured to perform an authorization check on the UE according to the identity of the UE, and send an authentication data response message including an authentication vector AV to the MME, where the authentication data response message indicates that the UE authorizes the check to pass;
  • the MME 2202 is further configured to determine, according to the authentication data response message, that the UE is allowed to perform a vehicle to any other terminal V2X service, and perform authentication on the UE according to the AV.
  • the communication system further includes:
  • the V2X server 2204 is configured to generate an area key of an area where the first communication device is located, and send the area key to the first communication device.
  • the communication system further includes:
  • the UE2205 is configured to send an attach request message to the eNB 2201.
  • the UE 2205 is further configured to receive the V2X communication resource allocated by the eNB 2201, where the V2X communication resource is allocated to the UE 2205 when the eNB 2201 receives the indication information that the UE 2205 is allowed to perform V2X service; or, receive The area key assignment message sent by the MME 2202, the area key assignment message is sent by the MME 2202 to the UE 2205 after the UE 2205 determines that the UE 2205 is allowed to perform V2X service, and after the UE 2205 passes the authentication.
  • the area key assignment message includes area key information of an area corresponding to the location information of the UE 2205, and area key information of a neighboring area of the area.
  • the eNB 2201 may include the communication device shown in any of Figures 12-14.
  • the MME 2202 may include the communication device shown in any of Figures 9-11.
  • the HSS 2203 can include the communication device shown in any of Figures 15-16.
  • the V2X server 2204 can include the communication device shown in any of Figures 17-19.
  • the UE 2205 can include the communication device shown in any of Figures 20-21.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. Specifically, it can be implemented by means of software and necessary general hardware.
  • the general-purpose hardware includes a general-purpose integrated circuit, a general-purpose CPU, a general-purpose memory, a general-purpose component, and the like, and of course, the dedicated hardware includes an application-specific integrated circuit, a dedicated CPU, and a dedicated memory. , special components, etc. to achieve.
  • the integrated unit is implemented as a software functional unit and as a standalone product When sold or used, it can be stored on a computer readable storage medium.
  • the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (English: Read-Only Memory, abbreviated as ROM), a random access memory (English: Random Access Memory, abbreviated as RAM), a magnetic disk or an optical disk, and the like.
  • ROM Read-Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种通信方法及相关装置，该方法包括：MME接收eNB发送的附着请求消息，所述附着请求消息用于UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；所述MME根据所述附着请求消息，向HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；所述MME接收所述HSS发送的包括AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；所述MME根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。实施上述技术方案可以实现在车车通信中由网络侧对UE进行认证，减少空口开销。

Description

一种通信方法及相关装置 技术领域
本发明涉及通信技术领域，尤其涉及一种通信方法及相关装置。
背景技术
近年来汽车网络越来越受到人们的关注，通过车车通信或者车与路边单元(Road Side Unit，RSU)之间的通信从而提高道路交通的安全性、可靠性，提升交通通行效率。智能交通系统旨在实现车与车、车与人之间、车与路之间持续通信以交换当前车辆或周围环境状态，以减少交通事故、提高交通出行的安全性、帮助缓解交通拥堵、降低能耗、减少污染排放、保护环境、提高运输效率并带动相关产业。
目前，欧洲和美国的ITS(Intelligent Transport System，智能交通系统)都是基于DSRC(Dedicated short range communication，专用短距离通信)技术来实现车车之间的通信，对应的安全解决方案是基于非对称密钥的证书，需要在每条DSRC消息中携带证书和消息签名。其中：
UE(User Equipment，用户设备)从网络侧的CA(Certificate Authority，认证中心)请求获取证书。UE拿到证书后缓存在本地，UE会以1～10HZ的频率向周围车辆广播消息，携带车辆信息(例如，CAM(Cooperative Awareness Message，合作感知消息)、DENM(Decentralized environmental notification message，分布式环境通知消息))。为了使接收端UE能够验证发端UE身份的合法性，需要发端UE将其证书携带在消息中；为了使接收端UE能够验证CAM/DENM消息本身是否收到安全攻击(伪造和篡改)，需要发端UE使用证书对应的私钥对消息进行签名并将签名值携带在消息中。接收端UE会首先验证CAM/DENM消息中证书的合法性，然后再验证消息中签名值是否正确。其中，V2V(vehicle to vehicle，车辆到车辆)消息的格式可以参见图1，该消息中需要携带Certificate(证书)和Signature(签名)。
然而实践发现，上述基于DSRC技术实现的车车通信方案中UE的认证是 基于证书实现的，每条DSRC消息均携带有证书和签名，空口开销大；此外，基于证书的签名和加密计算时间长，对于时延敏感的车车通信消息，如果处理时延太大，可能会产生较大影响。
发明内容
本发明实施例提供了一种通信方法及相关装置，以实现在车车通信中，由网络侧对UE进行认证，减少空口开销。
第一方面提供了一种通信方法，包括：
移动管理实体MME接收演进型基站eNB发送的附着请求消息，所述附着请求消息用于用户设备UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
所述MME根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
所述MME接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
所述MME根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
结合第一方面，在第一方面的第一种可能的实现方式中，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述MME根据所述附着请求消息，向HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查，包括：
所述MME根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述MME根据所述认证数据响应消息，确定所述UE被允许进行 V2X业务，包括：
所述MME根据所述认证数据响应消息，以及所述附着请求消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
结合第一方面，或第一方面的第一种可能的实现方式，在第一方面第三种可能的实现方式中，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述MME根据所述认证数据响应消息，确定所述UE被允许进行V2X业务，包括：
所述MME根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
结合第一方面，以及第一方面的第一种可能的实现方式至第三种可能的实现方式中的任一种实现方式，在第一方面的第四种可能的实现方式中，所述MME根据所述AV对所述UE进行认证之后，还包括：
在所述MME对所述UE认证通过之后，所述MME向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
结合第一方面，以及第一方面的第一种可能的实现方式至第三种可能的实现方式中的任一种实现方式，在第一方面的第五种可能的实现方式中，所述附着请求消息中还包括所述UE的位置信息；所述MME根据所述AV对所述UE进行认证之后，还包括：
所述MME向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
所述MME接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
所述MME向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
结合第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现 方式中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第一方面的第五种可能的实现方式，或第六种可能的实现，在第一方面第七种可能的实现方式中，所述MME对所述UE认证通过之后，还包括：
所述MME与所述UE建立非接入层NAS安全上下文；
所述MME向所述UE发送区域密钥分配消息，包括：
所述MME向所述UE发送通过NAS安全上下文保护后的区域密钥分配消息。
第二方面提供了另一种通信方法，包括：
演进型基站eNB接收用户设备UE发送的第一附着请求消息；
所述eNB根据所述第一附着请求消息，向移动管理实体MME发送第二附着请求消息；
所述eNB接收所述MME发送的所述UE被允许进行车辆到其它任何终端V2X业务的指示信息；
所述eNB根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
结合第二方面，在第二方面的第一种可能的实现方式中，所述eNB根据所述指示信息，为所述UE分配V2X通信资源之前，还包括：
所述eNB接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
结合第二方面，或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述eNB为所述UE分配V2X通信资源，包括：
所述eNB向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
结合第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述eNB向所述UE发送区域密钥分配消息之前，还包括：
所述eNB向V2X服务器发送区域密钥请求消息；
所述eNB接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区 域的区域密钥信息。
结合第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述区域密钥信息中包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第二方面的第二种可能的实现方式至第四种可能的实现方式中的任一种实现方式，在第二方面第五种可能的实现方式中，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
所述eNB接收到所述MME发送的携带所述UE被允许进行V2X业务的指示信息的初始上下文建立请求消息之后，所述方法还包括：
所述eNB与所述UE建立接入层AS安全上下文；
所述eNB向所述UE发送区域密钥分配消息，包括：
所述eNB向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
第三方面提供了另一种通信方法，包括：
归属签约用户服务器HSS接收移动管理实体MME发送的包括用户设备UE的身份标识的认证数据请求消息；
所述HSS根据所述UE的身份标识对所述UE进行授权检查；
所述HSS向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根据所述认证数据响应消息确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
结合第三方面，在第三方面的第一种可能的实现方式中，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述HSS根据所述UE的身份标识对所述UE进行授权检查，包括：
所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
结合第三方面，在第三方面的第二种可能的实现方式中，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
第四方面提供了另一种通信方法，包括：
车辆到其它任何终端V2X服务器生成第一通信设备所在区域的区域密钥；
所述V2X服务器向第一通信设备发送区域密钥。
结合第四方面，在第四方面的第一种可能的实现方式中，所述V2X服务器向第一通信设备发送区域密钥，包括：
所述V2X服务器向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
结合第四方面，在第四方面的第二种可能的实现方式中，所述V2X服务器向相应设备发送相关区域密钥，包括：
所述V2X服务器接收eNB发送的区域密钥请求消息；
所述V2X服务器向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
结合第四方面，在第四方面的第三种可能的实现方式中，所述V2X服务器向第一通信设备发送区域密钥，包括：
所述V2X服务器接收移动管理实体MME发送的区域密钥请求消息，所述区域密钥请求消息中包括用户设备UE的位置信息；
所述V2X服务器向所述MME发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
结合第四方面，在第四方面的第四种可能的实现方式中，所述V2X服务器向第一通信设备发送区域密钥，包括：
所述V2X服务器与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
所述V2X服务器接收所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息；
所述V2X服务器向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
第五方面提供了另一种通信方法，包括：
用户设备UE向演进型基站eNB发送附着请求消息；
所述UE接收所述eNB分配的车辆到任何其它终端V2X通信资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，
所述UE接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
结合第五方面，在第五方面的第一种可能的实现方式中，所述UE接收演进型基站eNB分配的V2X通信资源，包括：
所述UE接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
结合第五方面，在第五方面的第二种可能的实现方式中，所述UE向eNB发送附着请求消息之后，还包括：
所述UE向所述eNB发送区域密钥请求消息；
所述UE接收所述eNB发送的区域密钥响应消息，所述区域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
结合第五方面，以及第五方面的第一种可能的实现方式至第二种可能的实现方式，在第五方面的第三种可能的实现方式中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第五方面的第三种可能的实现方式，在第五方面的第四种可能的实现方式中，所述方法还包括：
所述UE向接收端发送V2X消息，所述V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，所述消息验证值是使用所述区域密钥ID以及区域ID对应的区域密钥对所述消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
结合第五方面，以及第五方面的第一种可能的实现方式至第四种可能的实 现方式中的任一种实现方式，在第五方面的第五种可能的实现方式中，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
第六方面提供了一种通信装置，包括：
接收模块，用于接收演进型基站eNB发送的附着请求消息，所述附着请求消息用于用户设备UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
发送模块，用于根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
所述接收模块，还用于接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
确定模块，用于根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务；
认证模块，用于根据所述AV对所述UE进行认证。
结合第六方面，在第六方面的第一种可能的实现方式中，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述发送模块，具体用于根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
结合第六方面的第一种可能的实现方式，在第六方面的第二种可能的实现方式中，所述确定模块，具体用于根据所述认证数据响应消息，以及所述附着请求消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
结合第六方面，或第六方面的第一种可能的实现方式，在第六方面第三种可能的实现方式中，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述确定模块，具体用于根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
结合第六方面，以及第六方面的第一种可能的实现方式至第三种可能的实现方式中的任一种实现方式，在第六方面的第四种可能的实现方式中，所述发送模块，还用于在所述认证模块对所述UE认证通过之后，向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
结合第六方面，以及第六方面的第一种可能的实现方式至第三种可能的实现方式中的任一种实现方式，在第六方面的第五种可能的实现方式中，所述附着请求消息中还包括所述UE的位置信息；
所述发送模块，还用于向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
所述接收模块，还用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
所述发送模块，还用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
结合第六方面的第五种可能的实现方式，在第六方面的第六种可能的实现方式中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第六方面的第五种可能的实现方式，或第六种可能的实现，在第六方面第七种可能的实现方式中，所述装置还包括：
建立模块，用于所述认证模块对所述UE认证通过之后，与所述UE建立非接入层NAS安全上下文；
所述发送模块，具体用于向所述UE发送通过NAS安全上下文保护后的区域密钥分配消息。
第七方面提供了另一种通信装置，包括：
接收模块，用于接收用户设备UE发送的第一附着请求消息；
发送模块，用于根据所述第一附着请求消息，向移动管理实体MME发送第二附着请求消息；
所述接收模块，还用于接收所述MME发送的所述UE被允许进行车辆到其它任何终端V2X业务的指示信息；
分配模块，还用于根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
结合第七方面，在第七方面的第一种可能的实现方式中，所述接收模块，还用于接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
结合第七方面，或第七方面的第一种可能的实现方式，在第七方面的第二种可能的实现方式中，所述分配模块，具体用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
结合第七方面的第二种可能的实现方式，在第七方面的第三种可能的实现方式中，所述发送模块，还用于向V2X服务器发送区域密钥请求消息；
所述接收模块，还用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
结合第七方面的第三种可能的实现方式，在第七方面的第四种可能的实现方式中，所述区域密钥信息中包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第七方面的第二种可能的实现方式至第四种可能的实现方式中的任一种实现方式，在第七方面第五种可能的实现方式中，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
所述装置还包括：
建立模块，用于与所述UE建立接入层AS安全上下文；
所述发送模块，具体用于向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
第八方面提供了另一种通信方法，包括：
接收模块，用于接收移动管理实体MME发送的包括用户设备UE的身份标识的认证数据请求消息；
授权模块，用于根据所述UE的身份标识对所述UE进行授权检查；
发送模块，用于向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根据所述认证数据响应消息确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
结合第八方面，在第八方面的第一种可能的实现方式中，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述授权模块，具体用于根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
结合第八方面，在第八方面的第二种可能的实现方式中，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
第九方面提供了另一种通信装置，包括：
生成模块，用于生成第一通信设备所在区域的区域密钥；
发送模块，用于向第一通信设备发送区域密钥。
结合第九方面，在第九方面的第一种可能的实现方式中，所述发送模块，具体用于向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
结合第九方面，在第九方面的第二种可能的实现方式中，所述发送模块，具体用于当所述装置接收到eNB发送的区域密钥请求消息时，向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
结合第九方面，在第九方面的第三种可能的实现方式中，所述发送模块，具体用于当所述装置接收到eNB发送的区域密钥请求消息时，向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
结合第九方面，在第九方面的第四种可能的实现方式中，所述装置还包括：
建立模块，用于与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
所述发送模块，具体用于当所述装置接收到所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息时，向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
第十方面提供了另一种通信装置，包括：
发送模块，用于向演进型基站eNB发送附着请求消息；
接收模块，用于接收所述eNB分配的车辆到任何其它终端V2X通信资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
结合第十方面，在第十方面的第一种可能的实现方式中，所述接收模块，具体用于接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
结合第十方面，在第十方面的第二种可能的实现方式中，所述发送模块，还用于向所述eNB发送区域密钥请求消息；
所述接收模块，还用于接收所述eNB发送的区域密钥响应消息，所述区域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
结合第十方面，以及第十方面的第一种可能的实现方式至第二种可能的实现方式，在第十方面的第三种可能的实现方式中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
结合第十方面的第三种可能的实现方式，在第十方面的第四种可能的实现方式中，所述发送模块，具体用于向接收端发送V2X消息，所述V2X消息中包括使用所述区域密钥进行加密的消息内容，以及所述区域密钥对应的区域密钥ID和区域ID。
结合第十方面，以及第十方面的第一种可能的实现方式至第四种可能的实 现方式中的任一种实现方式，在第十方面的第五种可能的实现方式中，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
与现有技术相比，本发明实施例具有以下有益效果：
本发明实施例中，MME接收到eNB发送的附着请求消息之后，可以根据该附着请求消息向HSS发送包括UE的身份标识的认证数据请求消息，使得HSS根据UE的身份标识对UE进行授权检查，进而接收HSS发送的包括AV的认证数据响应消息，并根据该认证数据响应消息确定UE允许进行V2X业务，并根据AV对UE进行认证，实现了在车车通信中，由网络侧对UE进行认证，减少了空口开销。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为一种现有的V2V消息的格式示意图；
图2为本发明实施例提供的一种通信方法的流程示意图；
图3为本发明实施例提供的另一种通信方法的流程示意图；
图4为本发明实施例提供的另一种通信方法的流程示意图；
图5为本发明实施例提供的另一种通信方法的流程示意图；
图6为本发明实施例提供的另一种通信方法的流程示意图；
图7为本发明实施例提供的另一种通信方法的流程示意图；
图8为本发明实施例提供的另一种通信方法的流程示意图；
图9为本发明实施例提供的一种通信装置的结构示意图；
图10为本发明实施例提供的另一种通信装置的结构示意图；
图11为本发明实施例提供的另一种通信装置的结构示意图；
图12为本发明实施例提供的一种通信装置的结构示意图；
图13为本发明实施例提供的另一种通信装置的结构示意图；
图14为本发明实施例提供的另一种通信装置的结构示意图；
图15为本发明实施例提供的一种通信装置的结构示意图；
图16为本发明实施例提供的另一种通信装置的结构示意图；
图17为本发明实施例提供的一种通信装置的结构示意图；
图18为本发明实施例提供的另一种通信装置的结构示意图；
图19为本发明实施例提供的另一种通信装置的结构示意图；
图20为本发明实施例提供的一种通信装置的结构示意图；
图21为本发明实施例提供的另一种通信装置的结构示意图；
图22为本发明实施例提供的一种通信系统的架构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供了一种通信方法，可以实现在车车通信中，由网络侧对UE进行认证，减少空口开销。以下分别进行说明。
请参阅图2，图2为本发明实施例提供的一种通信方法的流程示意图。其中，图2所描述的通信方法主要是从MME一侧来进行描述的。如图2所示，该方法可以包括以下步骤：
步骤201、MME接收eNB发送的附着请求消息，该附着请求消息用于UE请求附着到网络，该附着请求消息包括UE的身份标识。
本发明实施例中，当UE(User Equipment，用户设备)需要附着到网络时，UE可以向eNB(evolved Node B，演进型基站)发送附着请求消息，eNB接收到该附着请求消息(第一附着请求消息)之后，可以根据该第一附着请求消息向MME(Mobility Management Entity，移动管理实体)发送第二附着请求消息。
可选地，eNB接收到UE发送的第一附着请求消息之后，可以不对该第一 附着请求消息进行处理，直接转发给MME，此时，第一附着请求消息与第二附着请求消息相同；或者，eNB接收到UE发送的第一附着请求消息之后，可以对该第一附着请求消息进行相应处理后，重新封装为第二附着消息，并转发给MME，此时，第一附着请求消息和第二附着请求消息可以不同。
在一种可选的实施方式中，该附着请求消息中还可以包括V2X(Vehicle-to-Everything，车辆到其它任何终端)指示信息，该V2X指示信息用于指示UE为V2X类型，即该UE具备进行V2X通信的能力；MME接收到该附着请求消息之后，可以根据该附着请求消息中包括的V2X指示信息获知该UE为V2X类型。
本发明实施例中，V2X也可以称为LTE-V2X，即基于LTE(Long TermEvolution，长期演进)的车辆与其它终端；V2X通信可以包括但不限于：V2V通信、V2I(Vehicle-to-Infrastructure，车辆到基础设施)通信，以及V2P(Vehicle-to-Pedestrian，车辆到行人)通信；其中，V2I通信中可以包括但不限于车辆与基站通信、车辆与路边单元通信以及车辆与交通灯上的通信模块通信等。
步骤202、MME根据该附着请求消息，向HSS发送包括UE的身份标识的认证数据请求消息，使得HSS根据UE的身份标识对UE进行授权检查。
本发明实施例中，MME接收到eNB发送的附着请求消息之后，需要确定UE是否被允许进行V2X业务。
本发明实施例中，MME接收到eNB发送的包括UE的身份标识的附着请求消息之后，可以向HSS(Home Subscriber Server，归属签约用户服务器)发送包括UE的身份标识的认证数据请求消息。HSS接收到MME发送的认证数据请求消息之后，可以根据该UE的身份标识查询对应的签约信息，并根据该签约信息判断该UE是否被允许进行V2X业务；当HSS确定UE被允许进行V2X业务时，HSS可以向MME发送包括AV(Authentication Vector，认证向量)的认证数据响应消息。其中，UE的身份标识可以包括但不限于UE的IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)或TMSI(Temporary Mobile Subscriber Identity，临时移动用户标识)等。
MME接收到HSS发送的认证数据响应消息之后，可以根据该认证数据响 应消息中包括的AV对UE进行认证，其中，MME对UE进行认证的具体实现可以参见现有技术中MME对UE进行认证的相关实现，本发明实施例不再赘述。
在另一种可选的实施方式中，当UE的附着请求消息中还包括V2X指示信息时，上述步骤202中，MME根据所述附着请求消息，向HSS发送包括UE的身份标识的认证数据请求消息，使得HSS根据UE的身份标识对UE进行授权检查，可以包括：
MME根据附着请求消息，向HSS发送包括UE的身份标识，以及V2X指示信息的认证数据请求消息，使得HSS根据UE的身份标识确定UE是否被允许进行V2X业务。
在该实施方式中，MME会在向HSS发送的认证数据请求消息中携带V2X指示信息，以使HSS在获知UE为V2X类型时，根据UE的身份标识查询UE的签约信息，并根据该签约信息判断UE是否被允许进行V2X业务。
其中，当HSS接收到的认证数据请求消息中包括V2X指示信息时，HSS向MME发送的认证数据响应消息中可以包括V2X指示信息，也可以不包括V2X指示信息，本发明实施例对此不做限定。
在一种可选的实施方式中，HSS发送给MME的认证数据响应消息中还可以包括V2X指示信息，该V2X指示信息用于指示UE为V2X类型，以使MME获知UE为V2X类型。
步骤203、MME接收HSS发送的包括AV的认证数据响应消息，该认证数据响应消息用于指示UE授权检查通过。
本发明实施例中，HSS对UE授权检查通过之后，可以向MME发送包括AV的认证数据响应消息。MME接收到该认证数据响应消息之后，可以确定UE授权检查通过，进而，MME可以根据该认证数据响应消息中包括的AV对UE进行认证。
步骤204、MME根据该认证数据响应消息，确定UE被允许进行V2X业务，并根据AV对UE进行认证。
在一种可选的实施方式中，当附着请求消息中包括V2X指示信息时，MME根据认证数据响应消息，确定UE被允许进行V2X业务，可以包括：
MME根据认证数据响应消息，以及附着请求消息中包括的V2X指示信息，确定UE被允许进行V2X业务。
在该实施方式中，当附着请求消息中包括V2X消息时，MME可以确定该UE为V2X类型，进而，当MME接收到用于指示UE授权检查通过的认证数据响应消息时，MME可以确定该UE被允许进行V2X业务。
在另一种可选的实施方式中，认证数据响应消息中还包括V2X指示信息，该V2X指示信息用于指示UE为V2X类型；
相应地，MME根据认证数据响应消息，确定UE被允许进行V2X业务，可以包括：
MME根据认证数据响应消息，以及认证数据响应消息中包括的V2X指示信息，确定UE被允许进行V2X业务。
在该实施方式中，MME接收到HSS发送的认证数据响应消息时，可以确定UE授权检查通过，进一步地，MME根据认证数据响应消息中包括的V2X指示信息可以确定UE为V2X类型，因此，MME可以确定UE被允许进行V2X业务。
本发明实施例中，MME确定UE被允许进行V2X业务之后，可以根据认证数据响应消息中包括的AV对UE进行认证。
具体的，MME可以向UE发送认证请求消息(UE AuthenticationRequest)，并接收UE返回的认证响应消息(UE Authentication Response)，该认证响应消息中包括一个RES(Response，回复)值，MME可以比较该RES值与AV中包括的XRES(Expected Response，期望回复)值，若二者相同，则确定UE认证通过；否则，确定UE认证不通过。
进一步地，在一种可选的实施方式中，MME根据AV对UE进行认证之后，还可以包括：
在MME对UE认证通过之后，MME向eNB发送UE被允许进行V2X业务的指示信息，以使eNB为UE分配V2X通信资源。
在该实施方式中，MME确定UE被允许进行V2X业务，并对UE行认证通过之后，可以向eNB发送UE被允许进行V2X业务的指示信息。
在该实施方式中，eNB接收到上述指示信息之后，可以认为该UE 为一个合法的V2X类型的UE，从而，eNB可以为该UE分配UE进行V2X通信时所需的信息。
在该实施方式中，eNB在接收到上述指示信息之后，可以主动向该UE分配UE进行V2X通信时所需的信息；或者，eNB接收到上述指示信息之后，可以等到接收到UE发送的V2X通信信息获取请求时，才向该UE发送UE进行V2X通信时所需的信息。
本发明实施例中，UE进行V2X通信时所需的信息可以包括但不限于时频资源，以及当前服务该UE的eNB所处区域的区域密钥信息和相邻区域的区域密钥信息。
本发明实施例中，通过生成并管理区域密钥，同一区域对应的区域密钥相同，从而，不需要为每个UE均分别配置并管理证书，降低了CA的安全管理工作量；此外，UE使用区域密钥对V2X消息进行安全保护时，只需要在消息中携带区域密钥ID以及区域ID，而区域密钥ID以及区域ID的大小远小于证书和签名的大小，因而，与现有基于DSRC技术实现的车车通信方案相比，本发明实施例提供的技术方案车车通信消息更小，降低了安全开销；再者，与现有基于DSRC技术实现的车车通信方案中基于证书的签名和加密计算时间相比，本发明实施例提供的技术方案中通过区域密钥对V2X消息进行安全保护花费的时间更少，降低了消息处理时延。
在另一种可选的实施方式中，附着请求消息中还可以包括UE的位置信息，相应地，MME根据AV对UE进行认证之后，还可以包括以下步骤：
11)、MME向V2X服务器发送包括UE的位置信息的区域密钥请求消息；
12)、MME接收V2X服务器发送的区域密钥响应消息，该区域密钥响应消息中包括UE的位置信息对应的区域的区域密钥以及该区域的相邻区域的区域密钥信息；
13)、MME向UE发送区域密钥分配消息，该区域密钥分配消息中包括UE的位置信息对应的区域的区域密钥信息以及该区域的相邻区域 的区域密钥信息，该区域密钥信息用于区域内的UE对V2X消息进行安全保护。
在该实施方式中，区域密钥由V2X服务器生成并保存，当MME确定UE被允许进行V2X业务，且对UE进行认证通过之后，MME可以向V2X服务器发送包括UE的位置信息的区域密钥请求消息，以获取UE的位置信息对应的区域密钥信息，以及该区域的相邻区域的区域密钥信息；MME获取到UE的位置信息对应的区域密钥信息，以及该区域的相邻区域的区域密钥信息之后，可以将其分配给UE，以使UE根据区域密钥信息对V2X消息进行安全保护。
可选地，该区域密钥信息可以包括区域密钥(Area Key)、区域密钥ID(Area Key ID)以及区域ID(Area ID)三者的对应关系；其中，区域密钥ID用于唯一标识一个区域密钥，区域ID用于唯一标识一个区域。
UE接收到MME发送的区域密钥分配消息之后，可以保存该区域密钥分配消息中包括的UE的位置信息对应的区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及该区域的相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。当UE需要进行V2X通信时，发送端UE可以使用当前所处区域的区域密钥对V2X消息进行完整性保护，并在V2X消息中携带当前所处区域的区域密钥ID以及区域ID。优选地，发送端UE还可以使用当前所处区域的区域密钥对V2X消息的消息内容进行加密(即该V2X消息中可以包括加密后的消息内容，以及上述区域密钥ID和区域ID)。
接收端UE接收到发送端UE发送的V2X消息之后，可以根据该V2X消息中携带的区域密钥ID和区域ID，查询自身保存的区域密钥、区域密钥ID以及区域ID三者的对应关系，以确定该V2X消息中携带的区域密钥ID和区域ID共同对应的区域密钥，并根据该区域密钥对该V2X消息进行完整性验证。可选地，当V2X消息中包括的消息内容为加密后的消息内容时，接收端UE可以根据该区域密钥对加密后的消息内容进行解密。
可选地，MME对UE认证通过之后，还可以包括：
MME与UE建立NAS(Non-Access Stratum，非接入层)安全上下文；
具体的，MME对UE认证通过之后，MME可以与UE建立NAS安全上下文，其具体实现可以参见现有技术中NAS安全上下文建立的相关流程，本发明实施例不再赘述。
相应地，MME向UE发送区域密钥分配消息，可以包括：
MME向UE发送通过NAS安全上下文保护后的区域密钥分配消息。
本发明实施例中，可以根据地理位置来划分区域，例如，一个eNB或多个eNB覆盖的范围组成一个区域，或者，一个或多个TA(TrackingArea Identity，跟踪区标识)作为一个区域，每一个区域都有对应的区域密钥。该区域内的V2X类型的UE使用该区域密钥对V2X消息进行安全保护。
基于上述区域划分策略，在本发明实施例中，一个eNB可以覆盖多个区域，或者，一个区域中可以包括多个eNB(即由多个eNB的覆盖范围组成一个区域)。
相应地，在eNB为UE分配区域密钥的实施方式中，当一个eNB覆盖多个区域时，UE向eNB请求区域密钥时，需要携带UE的位置信息，eNB接收到UE发送的区域密钥获取请求之后，需要根据UE的位置信息获取该位置信息对应的区域的区域密钥信息，以及该区域的相邻区域的区域密钥信息，并将其分配给UE。
而当一个区域中可以包括多个eNB时，UE向eNB请求区域密钥时，可以不用携带UE的位置信息，eNB接收到UE发送的区域密钥获取请求之后，直接可以获取自身(eNB)所处区域的区域密钥信息，以及该所处区域的相邻区域的区域密钥信息，并将其分配给UE。
在一种可选的实施方式中，上述区域密钥可以由eNB生成并管理。
在该实施方式中，当区域密钥由eNB生成并管理时，eNB生成区域密钥之后，需要将自身生成的区域密钥的区域密钥信息通告给向相邻区域的eNB；其中，eNB之间的区域密钥信息的通告可以通过对现有的X2接口指令进行改进实现，也可以通过新的X2接口指令实现。
在另一种可选的实施方式中，上述区域密钥可以由V2X服务器生成并管理，并配置到相应eNB上。
在该实施方式中，可以在系统中部署一个V2X服务器，该V2X服务器用于生成并管理区域密钥，并将该区域密钥配置到相应eNB上。由于所有区域的密钥均由V2X服务器生成并管理，从而，能够避免区域密钥的重用问题。
在另一种可选的实施方式中，可以在系统中部署一个V2X服务器，该V2X服务器用于生成并管理区域密钥，V2X服务器不会将区域密钥发送给eNB，即eNB不感知区域密钥，V2X服务器可以直接向UE分配区域密钥或者通过MME向UE分配区域密钥。
请参阅图3，图3为本发明实施例提供的另一种通信方法的流程示意图。其中，图3所描述的通信方法主要是从eNB一侧来进行描述的。如图3所示，该方法可以包括以下步骤：
步骤301、eNB接收UE发送的第一附着请求消息。
步骤302、eNB根据第一附着请求消息，向MME发送第二附着请求消息。
本发明实施例中，当UE需要附着到网络时，UE可以向eNB发送附着请求消息，eNB接收到该附着请求消息之后，可以根据该第一附着请求消息向MME发送第二附着请求消息。
可选地，eNB接收到UE发送的第一附着请求消息之后，可以不对该第一附着请求消息进行处理，直接转发给MME，此时，第一附着请求消息与第二附着请求消息相同；或者，eNB接收到UE发送的第一附着请求消息之后，可以对该第一附着请求消息进行相应处理后，重新封装为第二附着消息，并转发给MME，此时，第一附着请求消息和第二附着请求消息可以不同。
步骤303、eNB接收MME发送的UE被允许进行V2X业务的指示信息。
本发明实施例中，MME接收到eNB发送的第二附着请求消息之后， 可以向HSS发送认证数据请求消息，并当确定UE被允许进行V2X业务之后，对UE进行认证，其具体实现可以参见图2所示流程中的相关描述，在此不再赘述。
本发明实施例中，MME确定UE被允许进行V2X业务，且对UE认证通过之后，可以向eNB发送UE被允许进行V2X业务的指示信息。
步骤304、eNB根据UE被允许进行V2X业务的指示信息，为UE分配V2X通信资源。
在一种可选的实施方式中，eNB在接收到UE被允许进行V2X业务的指示信息之后，可以主动向该UE分配V2X通信资源。
在另一种可选的实施方式中，eNB接收到UE被允许进行V2X业务的指示信息之后，可以等到接收到UE发送的V2X资源调度请求时，才为UE分配V2X通信资源；
相应地，在该实施方式中，eNB根据UE被允许进行V2X业务的指示信息，为UE分配V2X通信资源之前，还可以包括：
eNB接收UE发送的V2X资源调度请求，该V2X资源调度请求用于请求V2X通信资源。
本发明实施例中，V2X通信资源可以包括但不限于时频资源，以及当前服务该UE的eNB所处区域的区域密钥信息和相邻区域的区域密钥信息。
相应地，在一种可选的实施方式中，eNB为UE分配V2X通信资源，可以包括：
eNB向UE发送区域密钥分配消息，该区域密钥分配消息中包括eNB所处区域的区域密钥信息和该所处区域的相邻区域的区域密钥信息，该区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
本发明实施例中，上述区域密钥信息可以由eNB生成并管理；或者，上述区域密钥信息可以由V2X服务器生成并管理，并配置到相应eNB上。
相应地，在一种可选的实施方式中，eNB向UE发送区域密钥分配消息之前，还可以包括以下步骤：
21)、eNB向V2X服务器发送区域密钥请求消息；
22)、eNB接收V2X服务器发送的区域密钥响应消息，该区域密钥响应消息中包括eNB所处区域的区域密钥信息，以及该所述区域的相邻区域的区域密钥信息。
可选地，上述区域密钥信息可以包括区域密钥、区域密钥ID，以及区域ID三者的对应关系。
相应地，UE接收到eNB发送的区域密钥分配消息之后，可以保存该区域密钥分配消息中包括的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。当UE需要进行V2X通信时，发送端UE可以使用当前所处区域的区域密钥对V2X消息进行完整性保护，并在V2X消息中携带当前所处区域的区域密钥ID以及区域ID。优选地，发送端UE还可以使用当前所处区域的区域密钥对V2X消息的消息内容进行加密(即该V2X消息中可以包括加密后的消息内容，以及上述区域密钥ID和区域ID)。
接收端UE接收到发送端发送的V2X消息之后，可以根据该V2X消息中携带的区域密钥ID和区域ID，查询自身保存的区域密钥、区域密钥ID以及区域ID三者的对应关系，以确定该V2X消息中携带的区域密钥ID和区域ID共同对应的区域密钥，并根据该区域密钥对该V2X消息进行完整性验证。可选地，当V2X消息中包括的消息内容为加密后的消息内容时，接收端UE可以根据该区域密钥对加密后的消息内容进行解密。
在一种可选的实施方式中，上述UE被允许进行V2X业务的指示信息可以携带在初始上下文建立请求消息中。
相应地，eNB接收到MME发送的携带UE被允许进行V2X业务的指示信息的初始上下文建立请求消息之后，可以与UE建立AS(AccessStratum，接入层)安全上下文。其中，eNB与UE建立AS安全上下文的具体实现可以参见现有技术中相关流程，本发明实施例不再赘述。
相应地，在该实施方式中，eNB向UE发送区域密钥分配消息，可以包括：
eNB向UE发送通过AS安全上下文保护后的区域密钥分配消息。
请参阅图4，图4为本发明实施例提供的一种通信方法的流程示意图。其中，图4所描述的通信方法主要是从HSS一侧来进行描述的。如图4所示，该方法可以包括以下步骤：
步骤401、HSS接收MME发送的包括UE的身份标识的认证数据请求消息。
本发明实施例中，MME接收到eNB发送的包括UE的身份标识的附着请求消息之后，可以向HSS发送包括该UE的身份标识的认证数据请求消息。
本发明实施例中，UE的身份标识可以包括但不限于UE的IMSI或TMSI等。
步骤402、HSS根据UE的身份标识对UE进行授权检查。
本发明实施例中，HSS接收到MME发送的认证数据请求消息之后，可以根据该认证数据请求消息中包括的UE的身份标识查询UE的签约信息，并根据该签约信息对UE进行授权检查。
在一种可选的实施方式中，认证数据请求消息中可以包括V2X指示信息，该V2X指示信息用于指示UE为V2X类型；
相应地，HSS根据UE的身份标识对UE进行授权检查，可以包括：
HSS根据UE的身份标识确定UE是否被允许进行V2X业务。
在该实施方式中，当认证数据请求消息中包括V2X指示信息时，HSS接收到认证数据请求消息之后，可以先根据该认证数据请求消息中包括的UE的身份标识查询对应的签约信息，并根据该签约信息判断UE是否被允许进行V2X业务。
步骤403、HSS向MME发送包括AV的认证数据响应消息，认证数据响应消息指示UE授权检查通过，以使MME根据认证数据响应消息确定UE被允许进行V2X业务，并根据AV对UE进行认证。
本发明实施例中，HSS判断UE被允许进行V2X业务对UE授权检查通过后时，可以向MME发送包括AV的认证数据响应消息，以使MME获知UE授权检查通过。
本发明实施例中，MME根据认证数据响应消息确定UE被允许进行 V2X业务，并根据AV对UE进行认证的具体实现可以参见图2所示流程中的相关描述，在此不再赘述。
在一种可选的方式中，当认证数据请求消息中不包括V2X指示信息时，为了使MME获知UE为V2X类型，认证数据响应消息中还可以包括V2X指示信息，该V2X指示信息用于指示UE为V2X类型。
在该实施方式中，当认证数据请求消息中不包括V2X指示信息时，HSS根据UE的身份标识查询到对应的签约信息之后，若根据该签约信息确定UE被允许进行V2X业务，则HSS可以确定该UE为V2X类型，进而，HSS可以在认证数据响应消息中携带V2X指示信息，以使MME获知UE为V2X类型。
本发明实施例中，MME对UE认证通过之后的相关处理可以参见图2或图3所示的流程中的相关描述，在此不再赘述。
请参阅图5，图5为本发明实施例提供的另一种通信方法的流程示意图。其中，图5所描述的通信方法主要是从V2X服务器侧进行描述的。如图5所示，该方法可以包括以下步骤：
步骤501、V2X服务器生成第一通信设备所在区域的区域密钥。
本发明实施例中，区域密钥由V2X服务器生成并管理。
本发明实施例中，第一通信设备可以包括但不限于：eNB、MME、或UE等。
步骤502、V2X服务器向第一通信设备发送区域密钥。
在一种可选的实施方式中，V2X服务器向第一通信设备发送区域密钥，可以包括：
V2X服务器向eNB发送eNB所处区域的区域密钥信息，以及该所处区域的区域密钥信息。
在该实施方式中，区域密钥由eNB分配给UE。
V2X服务器生成区域密钥之后，可以根据eNB所处区域，主动将区域密钥信息发送给eNB，由eNB分配给相应UE。
在另一种可选的实施方式中，V2X服务器向第一通信设备发送区域 密钥，可以包括：
V2X服务器接收eNB发送的区域密钥请求消息；
V2X服务器向所述eNB发送区域密钥响应消息，区域密钥响应消息中包括eNB所处区域的区域密钥信息，以及该所处区域的相邻区域的区域密钥信息。
在该实施方式中，区域密钥由eNB分配给UE。
V2X服务器生成区域密钥之后，不会主动将区域密钥信息发送给eNB，而是需要在接收到eNB发送的区域密钥请求消息之后，将区域密钥信息发送给eNB，由eNB将区域密钥信息分配给相应UE。
在再一种可选实施方式中，V2X服务器向第一通信设备发送区域密钥，可以包括：
V2X服务器接收MME发送的区域密钥请求消息，区域密钥请求消息中包括UE的位置信息；
V2X服务器向MME发送区域密钥响应消息，区域密钥响应消息中包括UE的位置信息对应的区域的区域密钥信息，以及该区域的相邻区域的区域密钥信息。
在该实施方式中，区域密钥由MME分配给UE。
当MME确定UE被允许进行V2X业务，且对UE认证通过之后，MME可以向V2X服务器发送包括UE的位置信息的区域密钥请求消息，以获取UE的位置信息对应的区域密钥信息。
V2X服务器接收到MME发送的区域密钥请求消息之后，可以根据其中包括的UE的位置信息，查询UE的位置信息所对应的区域的区域密钥信息，以及该区域的相邻区域的区域密钥信息，并将其携带在区域密钥响应消息中返回给MME，由MME将区域密钥信息分配给相应UE。
在又一种可选实施方式中，V2X服务器向第一通信设备发送区域密钥，可以包括：
V2X服务器与UE建立GBA或GBA push安全机制的安全连接；
V2X服务器接收UE发送的区域密钥请求消息，区域密钥请求消息中包括UE的位置信息；
V2X服务器向UE发送区域密钥响应消息，区域密钥响应消息中包括UE的位置信息对应的区域的区域密钥，以及区域的相邻区域的区域密钥。
在该实施方式中，区域密钥由V2X服务器分配给UE。
当UE附着成功之后，UE可以与V2X服务器建立GBA(GenericBootstrapping Architecture，通用自举架构)或GBA push(推送)安全机制，并在GBA或GBA push安全机制建立成功之后，UE可以向V2X服务器发送携带自身位置信息的区域密钥获取请求，V2X服务器接收到该区域密钥获取请求之后，可以根据该区域密钥获取请求中包括的UE的位置信息查询对应的区域密钥，将UE的位置信息对应的区域的区域密钥信息以及相邻区域的区域密钥信息发送给UE。
其中，UE与V2X服务器建立GBA或GBA push安全机制的流程中，V2X服务器充当NAF(Network Application Function，网络应用功能)实体的角色，其具体流程可以参见现有技术中GBA或GBA push安全机制建立的流程中的相关描述，本发明实施例在此不再赘述。
可选地，在本发明实施例中，上述区域密钥信息可以包括区域密钥、区域密钥ID，以及区域ID三者的对应关系。
本发明实施例中，eNB为UE分配区域密钥、MME为UE分配区域密钥、以及UE使用区域密钥信息对V2X消息进行安全保护的具体实现可以参见图2或3所示的方法流程中的相关描述，在此不再赘述。
请参阅图6，图6为本发明实施例提供的另一种通信方法的流程示意图。其中，图6所描述的通信方法主要是从UE侧来进行描述的。如图6所示，该方法可以包括以下步骤：
步骤601、UE向eNB发送附着请求消息，并转至步骤602a或602b。
本发明实施例中，当UE开机，且UE处于eNB覆盖范围之内时，UE可以向eNB发送附着请求消息。其中，该附着请求消息中包括UE的身份标识以及UE的位置信息，该身份信息可以包括但不限于IMSI或TMSI。
可选地，该附着请求消息中还可以包括V2X指示信息，该V2X指示信息用于指示UE为V2X类型。
步骤602a、UE接收所述eNB分配的V2X通信资源，该V2X通信资源是eNB接收到UE被允许进行V2X业务的指示信息之时向UE分配的。
本发明实施例中，eNB接收到UE发送的附着请求消息(第一附着请求消息)之后，可以向MME发送第二附着请求消息，并在接收到MME发送的被允许进行V2X业务的指示信息时，向UE分配V2X通信资源。
其中，MME接收eNB发送的附着请求消息，以及MME向eNB发送UE被允许进行V2X业务的指示信息的相关实现可以参见图2或图3所示流程中的相关描述，在此不再赘述。
在一种可选的实施方式中，UE接收eNB分配的V2X通信资源，可以包括：
UE接收eNB发送的区域密钥分配消息，该区域密钥分配消息中包括eNB所处区域的区域密钥信息和所处区域的相邻区域的区域密钥信息。
在该实施方式中，上述V2X通信资源可以包括区域密钥信息，eNB为UE分配区域密钥信息的具体实现可以参见上述图3所示的方法流程中的相关描述，在此不再赘述。
在另一种可选的实施方式中，UE向eNB发送附着请求消息之后，还可以包括：
UE向eNB发送区域密钥请求消息；
UE接收eNB发送的区域密钥响应消息，区域密钥响应消息包括eNB所处区域的区域密钥信息和所处区域的相邻区域的区域密钥信息。
在该实施方式中，eNB为UE分配的V2X通信资源中不包括区域密钥信息，当UE想要获取区域密钥时，需要向eNB发送区域密钥请求消息，并接收eNB返回的区域密钥响应消息，获取其中包括的区域密钥信息。
602b、UE接收MME发送的区域密钥分配消息，该区域密钥分配消息是MME确定UE被允许进行V2X业务，且对UE认证通过之后，向UE发送的，该区域密钥分配消息包括UE的位置信息对应的区域的区域 密钥信息，以及该区域的相邻区域的区域密钥信息。
本发明实施例中，MME确定UE被允许进行V2X业务，且对UE认证通过之后，可以为UE分配区域密钥信息。
其中，MME确定UE被允许进行V2X业务，以及MME对UE进行认证的具体实现可以参见上述图2所示的方法流程中的相关实现，在此不再赘述。
可选地，在本发明实施例中，上述区域密钥信息可以包括区域密钥、区域密钥ID，以及区域ID三者的对应关系。
进一步地，在本发明实施例中，UE被分配区域密钥信息之后，还可以向接收端发送V2X消息，该V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，该消息验证值是使用区域密钥ID以及区域ID对应的区域密钥对消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
可选地，该消息内容可以为使用区域密钥加密后的消息内容，其具体实现可以参见上述图2或图3所示方法流程中的相关描述，在此不再赘述。
请参阅图7，图7为本发明实施例提供的另一种通信方法的流程示意图。其中，图7所描述的通信方法主要是从UE、eNB、MME以及HSS四方面来进行描述的。如图7所示，该方法可以包括以下步骤：
步骤701、UE向eNB发送第一附着请求消息。
本发明实施例中，当UE开机，且UE处于eNB覆盖范围之内时，UE可以向eNB发送附着请求消息。其中，该附着请求消息中包括UE的身份标识，该身份信息可以包括但不限于IMSI或TMSI。
可选地，该第一附着请求消息中还可以包括V2X指示信息。
步骤702、eNB向MME发送第二附着请求消息。
本发明实施例中，eNB接收到UE发送的第一附着请求消息之后，可以向MME发送第二附着请求消息。
可选地，该第二附着请求消息中还可以包括V2X指示信息。
步骤703、MME向HSS发送认证数据请求消息，该认证数据请求消息中包括UE的身份标识。
本发明实施例中，MME接收到eNB发送的第二附着请求消息之后，可以向HSS发送认证数据请求消息，以请求HSS对UE进行授权检查。
可选地，当第二附着请求消息中包括V2X指示信息时，MME可以根据该V2X指示信息确定UE为V2X类型，并将该V2X指示信息包括在认证数据请求消息中发送给HSS。
步骤704、HSS根据UE的身份标识信息对UE进行授权检查。
本发明实施例中，HSS接收到MME发送的认证数据请求消息之后，可以根据该认证数据请求消息中包括的UE的身份标识查询该UE的签约信息，并根据该签约信息对UE进行授权检查。
本发明实施例中，HSS对UE进行授权检查主要是判断UE是否被允许进行V2X业务。当HSS判断UE被允许进行V2X业务时，HSS可以向MME发送包括AVs的认证数据响应消息。
步骤705、HSS向MME发送包括AV的认证数据响应消息。
可选地，在本发明实施例中，当UE发送的附着请求消息中不包括V2X指示信息时，HSS接收到的认证数据请求消息中也不会包括V2X指示信息。此时，当HSS判断UE被允许进行V2X业务之后，HSS向MME发送的认证数据响应消息中还可以包括V2X指示信息，以使MME获知UE为V2X类型。
在一种可选的实施方式中，MME接收到HSS发送的认证数据响应消息时，即可认为UE被允许进行V2X业务。
在另一种可选的实施方式中，认证数据响应消息中还可以包括用于指示UE被允许进行V2X业务的指示信息；在该实施方式中，MME接收到HSS发送的认证数据响应消息，并确定该认证数据响应消息中包括用于指示UE被允许进行V2X业务的指示信息时，才可以确定UE被允许进行V2X业务。
步骤706、MME根据该AV对UE进行认证。
本发明实施例中，MME接收到HSS发送的认证响应消息之后，可 以根据该认证响应消息中包括的AV对UE进行认证。
本发明实施例中，当MME对UE认证通过时，MME可以向eNB发送UE被允许进行V2X业务的指示信息。
可选地，该指示信息可以包括在初始上下文建立请求消息中。
步骤707、MME向eNB发送初始上下文建立请求消息，该初始上下文建立请求消息中包括UE被允许进行V2X业务的指示信息。
步骤708、eNB与UE建立AS安全上下文。
本发明实施例中，eNB接收到MME发送的包括UE被允许进行V2X业务的指示信息之后，可以与UE建立AS安全上下文。
其中，eNB与UE成功建立AS安全上下文之后，可以MME发送初始上下文建立响应消息。
步骤709、eNB向UE发送区域密钥分配消息，该区域密钥分配消息中包括区域密钥信息。
本发明实施例中，eNB接收到MME发送的UE被允许进行V2X业务的指示信息之后，可以为该UE分配区域密钥。
可选地，该区域密钥分配消息中包括eNB自身所处区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。
可选地，eNB可以将区域密钥分配消息通过AS安全上下文保护后，发送给UE。
步骤710、UE向eNB发送区域密钥分配响应消息。
本发明实施例中，UE接收到eNB发送的区域密钥分配消息之后，可以保存该区域密钥分配响应消息中包括的区域密钥信息，并向eNB发送区域密钥分配响应消息。
可选地，当区域密钥分配消息中包括eNB自身所处区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，UE可以保存该对应关系。
本发明实施例中，UE接收到eNB发送的区域密钥分配消息之后，可以保存该区域密钥分配消息中包括的区域密钥、区域密钥ID以及区域ID 三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。当UE需要进行V2X通信时，发送端UE可以使用当前所处区域的区域密钥对V2X消息进行完整性保护，并在V2X消息中携带当前所处区域的区域密钥ID以及区域ID。优选地，发送端UE还可以使用当前所处区域的区域密钥对V2X消息的消息内容进行加密(即该V2X消息中可以包括加密后的消息内容，以及上述区域密钥ID和区域ID)。
接收端UE接收到发送端发送的V2X消息之后，可以根据该V2X消息中携带的区域密钥ID和区域ID，查询自身保存的区域密钥、区域密钥ID以及区域ID三者的对应关系，以确定该V2X消息中携带的区域密钥ID和区域ID共同对应的区域密钥，并根据该区域密钥对该V2X消息进行完整性验证。可选地，当V2X消息中包括的消息内容为加密后的消息内容时，接收端UE可以根据该区域密钥对加密后的消息内容进行解密。
作为一种可选的实施方式，在本发明实施例中，上述区域密钥可以由eNB生成并管理。
相应地，图7所示的方法流程示意图中，步骤701之前还可以包括以下步骤(未在图7中示出)：
步骤700a、eNB生成并管理区域密钥。
作为另一种可选的实施方式中，在本发明实施例中，上述区域密钥可以由V2X服务器生成并管理，并配置到相应eNB上。
相应地，图5所示的方法流程示意图中，步骤701之前还可以包括以下步骤(未在图5中示出)：
步骤700b、V2X服务器生成并管理区域密钥，并将区域密钥配置到相应eNB上。
可选地，在本发明实施例中，V2X可以作为一个单独的实体部署，也可以作为HSS或MME的一个功能实体进行部署。
本发明实施例中，图7所描述的通信方法中，可以通过HSS根据UE的身份标识对应的签约信息对UE进行鉴权检查，判断UE是否被允许进行V2X业务，并当UE被允许进行V2X业务时，向MME发送认证数据 响应消息，以使MME在与UE相互认证通过之后，向eNB发送UE被允许进行V2X业务的指示信息，以使eNB为UE分配区域密钥，进而，由UE使用该区域密钥对V2X消息进行安全性保护。一方面，通过HSS对UE进行授权检查的方式保证UE身份的合法性，从而避免了UE在V2X消息中携带证书；另一方面，由于同一区域的区域密钥相同，因此，不需要再为同一区域中的各UE分别配置和管理安全证书，降低了CA的工作负荷。
请参阅图8，图8为本发明实施例提供的另一种通信方法的流程示意图。其中，图8所描述的通信方法主要是从UE、eNB、MME、V2X服务器以及HSS五方面来进行描述的。如图8所示，该方法可以包括以下步骤：
步骤800、V2X服务器生成并管理区域密钥。
本发明实施例中，区域密钥由V2X服务器生成并管理。
步骤801、UE向eNB发送第一附着请求消息。
本发明实施例中，当UE开机，且UE处于eNB覆盖范围之内时，UE可以向eNB发送附着请求消息。其中，该附着请求消息中包括UE的身份标识以及UE的位置信息，该身份信息可以包括但不限于IMSI或TMSI。
可选地，该第一附着请求消息中还可以包括V2X指示信息。
步骤802、eNB向MME发送第二附着请求消息。
本发明实施例中，eNB接收到UE发送的第一附着请求消息之后，需要向MME发送第二附着请求消息。
可选地，该第二附着请求消息中还可以包括V2X指示信息。
步骤803、MME向HSS发送认证数据请求消息，该认证数据请求消息中包括UE的身份标识。
本发明实施例中，MME接收到eNB发送的第二附着请求消息之后，可以向HSS发送认证数据请求消息，以请求HSS对UE进行授权检查。
可选地，当附着请求消息中包括V2X指示信息时，MME可以根据 该V2X指示信息确定UE为V2X类型，并将该V2X指示信息包括在认证数据请求消息中发送给HSS。
步骤804、HSS根据UE的身份标识信息对UE进行授权检查。
本发明实施例中，HSS接收到MME发送的认证数据请求消息之后，可以根据该认证数据请求消息中包括的UE的身份标识查询该UE的签约信息，并根据该签约信息对UE进行授权检查。
本发明实施例中，HSS对UE进行授权检查主要是判断UE是否被允许进行V2X业务。当HSS判断UE被允许进行V2X业务时，HSS可以向MME发送包括AVs的认证数据响应消息。
步骤805、HSS向MME发送包括AV的认证数据响应消息。
可选地，在本发明实施例中，当UE发送的附着请求消息中不包括V2X指示信息时，HSS接收到的认证数据请求消息中也不会包括V2X指示信息。此时，当HSS判断UE被允许进行V2X业务之后，HSS向MME发送的认证数据响应消息中还可以包括V2X指示信息，以使MME获知UE为V2X类型。
在一种可选的实施方式中，MME接收到HSS发送的认证数据响应消息时，即可认为UE被允许进行V2X业务。
在另一种可选的实施方式中，认证数据响应消息中还可以包括用于指示UE被允许进行V2X业务的指示信息；在该实施方式中，MME接收到HSS发送的认证数据响应消息，并确定该认证数据响应消息中包括用于指示UE被允许进行V2X业务的指示信息时，才可以确定UE被允许进行V2X业务。
步骤806、MME根据该AV对UE进行认证。
本发明实施例中，MME接收到HSS发送的认证响应消息之后，可以根据该认证响应消息中包括的AV对UE进行认证。
步骤807、MME与UE建立NAS安全上下文。
本发明实施例中，MME与UE相互认证通过之后，还可以与UE之间建立NAS安全上下文，其中，MME与UE建立NAS安全上下文的具体实现可以参见现有技术中NAS安全上下文建立的相关流程，在此不再 赘述。
步骤808、MME向V2X服务器发送区域密钥请求消息，该区域密钥请求消息中包括UE的位置信息。
本发明实施例中，MME确定UE被允许进行V2X业务，且与UE相互认证通过之后，可以向V2X服务器发送区域密钥请求消息，以为UE请求区域密钥。
步骤809、V2X服务器根据UE的位置信息向MME发送区域密钥响应消息。
本发明实施例中，V2X服务器接收到MME发送的区域密钥请求消息之后，可以根据该区域密钥请求消息包括的UE的位置信息查询自身维护的区域密钥，以确定UE的位置信息对应的区域的区域密钥和相邻区域的区域密钥，并将其携带在区域密钥响应消息中发送给MME。
可选地，该区域密钥响应消息中可以包括UE的位置信息对应的区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。
步骤810、MME向UE发送区域分配消息，该区域分配消息中包括区域密钥信息。
本发明实施例中，MME接收到V2X服务器发送的区域密钥响应消息之后，可以将其中包括的区域密钥信息发送给UE。
可选地，当区域密钥响应消息中包括UE的位置信息对应的区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，MME向UE发送的区域密钥分配消息中也包括该对应关系。
可选地，MME可以将区域密钥分配消息通过NAS安全上下文保护后发送给UE。
步骤811、UE向MME发送区域密钥分配响应消息。
本发明实施例中，UE接收到MME发送的区域密钥分配消息之后，可以保存该区域密钥分配响应消息中包括的区域密钥信息，并向MME发送区域密钥分配响应消息。
可选地，当区域密钥分配消息中包括UE的位置信息对应的区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系，UE可以保存该对应关系。
本发明实施例中，UE接收到MME发送的区域密钥分配消息之后，可以保存该区域密钥分配消息中包括的区域密钥、区域密钥ID以及区域ID三者的对应关系，以及相邻区域的区域密钥、区域密钥ID以及区域ID三者的对应关系。当UE需要进行V2X通信时，发送端UE可以使用当前所处区域的区域密钥对V2X消息进行完整性保护，并在V2X消息中携带当前所处区域的区域密钥ID以及区域ID。优选地，发送端UE还可以使用当前所处区域的区域密钥对V2X消息的消息内容进行加密(即该V2X消息中可以包括加密后的消息内容，以及上述区域密钥ID和区域ID)。
接收端UE接收到发送端发送的V2X消息之后，可以根据该V2X消息中携带的区域密钥ID和区域ID，查询自身保存的区域密钥、区域密钥ID以及区域ID三者的对应关系，以确定该V2X消息中携带的区域密钥ID和区域ID共同对应的区域密钥，并根据该区域密钥对该V2X消息进行完整性验证。可选地，当V2X消息中包括的消息内容为加密后的消息内容时，接收端UE可以根据该区域密钥对加密后的消息内容进行解密。
本发明实施例中，在图8所描述的通信方法中，可以通过HSS根据UE的身份标识对应的签约信息对UE进行鉴权检查，判断UE是否被允许进行V2X业务，并当UE被允许进行V2X业务时，向MME发送认证数据响应消息，以使MME在与UE相互认证通过之后，向V2X服务器请求UE的位置信息对应的区域密钥，并将其发送给UE，进而，UE在进行V2X通信时，可以根据该区域密钥对V2X消息进行安全保护。一方面，通过HSS对UE进行授权检查的方式保证UE身份的合法性，从而避免了UE在V2X消息中携带证书；另一方面，由于同一区域的区域密钥相同，因此，不需要再为同一区域中的各UE分别配置和管理安全证书，降低了CA的工作负荷。此外，通过V2X服务器统一生成、管理并分配 区域密钥，可以避免区域密钥重用的情况发生。
请参阅图9，图9为本发明实施例提供的一种通信装置的结构示意图，其中，该通信装置可以应用于上述方法实施例中的MME。如图9所示，该通信装置可以包括：
接收模块901，用于接收演进型基站eNB发送的附着请求消息，所述附着请求消息用于用户设备UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
发送模块902，用于根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
所述接收模块901，还用于接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
确定模块903，用于根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务；
认证模块904，用于根据所述AV对所述UE进行认证。
本发明实施例中，MME接收到eNB发送的附着请求消息之后，需要确定UE是否被允许进行V2X业务。
本发明实施例中，MME接收到eNB发送的包括UE的身份标识的附着请求消息之后，可以向HSS(Home Subscriber Server，归属签约用户服务器)发送包括UE的身份标识的认证数据请求消息。HSS接收到MME发送的认证数据请求消息之后，可以根据该UE的身份标识查询对应的签约信息，并根据该签约信息判断该UE是否被允许进行V2X业务；当HSS确定UE被允许进行V2X业务时，HSS可以向MME发送包括AV的认证数据响应消息。其中，UE的身份标识可以包括但不限于UE的IMSI或TMSI等。
MME接收到HSS发送的认证数据响应消息之后，可以根据该认证数据响应消息与UE进行相互认证，其中，MME对UE进行认证的具体 实现可以参见现有技术中MME对UE进行认证的相关实现，本发明实施例不再赘述。
在可选实施例中，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
相应地，所述发送模块902，可以具体用于根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
在可选实施例中，所述确定模块903，可以具体用于根据所述认证数据响应消息，以及所述附着请求消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
在该实施例中，当附着请求消息中包括V2X消息时，MME可以确定该UE为V2X类型，进而，当MME接收到用于指示UE授权检查通过的认证数据响应消息时，MME可以确定该UE被允许进行V2X业务
在可选实施例中，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
相应地，所述确定模块903，可以具体用于根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
在该实施例中，MME接收到HSS发送的认证数据响应消息时，可以确定UE授权检查通过，进一步地，MME根据认证数据响应消息中包括的V2X指示信息可以确定UE为V2X类型，因此，MME可以确定UE被允许进行V2X业务。
在可选实施例中，所述发送模块902，还可以用于在所述认证模块对所述UE认证通过之后，向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
在可选实施例中，所述附着请求消息中还包括所述UE的位置信息；
相应地，所述发送模块902，还可以用于向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
所述接收模块901，还可以用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
所述发送模块902，还可以用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
在该实施例中，区域密钥由V2X服务器生成并保存，当MME确定UE被允许进行V2X业务，且对UE进行认证通过之后，MME可以向V2X服务器发送包括UE的位置信息的区域密钥请求消息，以获取UE的位置信息对应的区域密钥信息，以及该区域的相邻区域的区域密钥信息；MME获取到UE的位置信息对应的区域密钥信息，以及该区域的相邻区域的区域密钥信息之后，可以将其分配给UE，以使UE根据区域密钥信息对V2X消息进行安全保护。
在可选实施例中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
请一并参阅图10，图10是本发明实施例公开的另一种通信装置的结构示意图，其中，图10所示的通信装置是由图9所示的通信装置进行优化得到的。与图9所示的通信装置相比较，图10所示的通信装置还可以包括：
建立模块905，用于所述认证模块904对所述UE认证通过之后，与所述UE建立非接入层NAS安全上下文；
相应地，所述发送模块902，可以具体用于向所述UE发送通过NAS安全上下文保护后的区域密钥分配消息。
请参阅图11，图11是本发明实施例提供的另一种通信装置的结构示意图。其中，如图11所示的通信装置可以包括：总线1103，以及与所述总线1103互连的处理器1101、存储器1102；所述存储器1102中存储有程序代码。本领域技术人员可以理解，图中示出的通信装置的结构并不 构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本发明实施例中，处理器1101调用存储器1102中存储的程序代码，可以执行以下操作：
接收eNB发送的附着请求消息，所述附着请求消息用于UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
根据所述附着请求消息，向HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
在可选实施例中，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述处理器1101调用存储器1102中存储的程序代码根据所述附着请求消息，向HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查，可以具体包括：
根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
在可选实施例中，所述处理器1101调用存储器1102中存储的程序代码根据所述认证数据响应消息，确定所述UE被允许进行V2X业务，可以具体包括：
根据所述认证数据响应消息，以及所述附着请求消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
在可选实施例中，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述处理器1101调用存储器1102中存储的程序代码根据所述认证数 据响应消息，确定所述UE被允许进行V2X业务，可以具体包括：
根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
在可选实施例中，所述处理器1101调用存储器1102中存储的程序代码根据所述AV对所述UE进行认证之后，还可以执行以下操作：
在所述MME对所述UE认证通过之后，所述MME向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
在可选实施例中，所述附着请求消息中还包括所述UE的位置信息；
相应地，所述处理器1101调用存储器1102中存储的程序代码根据所述AV对所述UE进行认证之后，还可以执行以下操作：
向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
在可选实施例中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
在可选实施方式中，所述处理器1101调用存储器1102中存储的程序代码对所述UE认证通过之后，还包括：
与所述UE建立非接入层NAS安全上下文；
所述处理器1101调用存储器1102中存储的程序代码向所述UE发送区域密钥分配消息，可以具体包括：
向所述UE发送通过NAS安全上下文保护后的区域密钥分配消息。
请参阅图12，图12为本发明实施例提供的一种通信装置的结构示意图。 其中，该通信装置可以应用于上述方法实施例中的eNB。如图12所示，该通信装置可以包括：
接收模块1201，用于接收用户设备UE发送的第一附着请求消息；
发送模块1202，用于根据所述第一附着请求消息，向移动管理实体MME发送第二附着请求消息；
所述接收模块1201，还用于接收所述MME发送的所述UE被允许进行车辆到其它任何终端V2X业务的指示信息；
分配模块1203，还用于根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
本发明实施例中，当UE需要附着到网络时，UE可以向eNB发送附着请求消息，eNB接收到该附着请求消息之后，可以根据该第一附着请求消息向MME发送第二附着请求消息。
可选地，eNB接收到UE发送的第一附着请求消息之后，可以不对该第一附着请求消息进行处理，直接转发给MME，此时，第一附着请求消息与第二附着请求消息相同；或者，eNB接收到UE发送的第一附着请求消息之后，可以对该第一附着请求消息进行相应处理后，重新封装为第二附着消息，并转发给MME，此时，第一附着请求消息和第二附着请求消息可以不同。
在可选实施例中，所述接收模块1201，还可以用于接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
在可选实施例中，所述分配模块1203，可以具体用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
在可选实施例中，所述发送模块1202，还可以用于向V2X服务器发送区域密钥请求消息；
所述接收模块1201，还可以用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述区域密钥信息中包括：区域密钥、区域密钥ID以 及区域ID三者的对应关系。
在可选实施例中，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
相应地，请一并参阅图13，图13是本发明实施例公开的另一种通信装置的结构示意图，其中，图13所示的通信装置是由图12所示的通信装置进行优化得到的。与图12所示的通信装置相比较，图13所示的通信装置还可以包括：
建立模块1204，用于与所述UE建立接入层AS安全上下文；
所述发送模块1202，可以具体用于向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
请参阅图14，图14是本发明实施例提供的另一种通信装置的结构示意图。其中，如图14所示的通信装置可以包括：总线1403，以及与所述总线1403互连的处理器1401、存储器1402；所述存储器1402中存储有程序代码。本领域技术人员可以理解，图中示出的通信装置的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本发明实施例中，处理器1401调用存储器1402中存储的程序代码，可以执行以下操作：
接收UE发送的第一附着请求消息；
根据所述第一附着请求消息，向MME发送第二附着请求消息；
接收所述MME发送的所述UE被允许进行V2X业务的指示信息；
根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
在可选实施例中，所述处理器1401调用存储器1402中存储的程序代码根据所述指示信息，为所述UE分配V2X通信资源之前，还可以执行以下操作：
接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
在可选实施例中，所述处理器1401调用存储器1402中存储的程序代码为所述UE分配V2X通信资源，包括：
所述eNB向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
在可选实施例中，所述处理器1401调用存储器1402中存储的程序代码向所述UE发送区域密钥分配消息之前，还可以执行以下操作：
向V2X服务器发送区域密钥请求消息；
接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述区域密钥信息中包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
在可选实施例中，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
所述处理器1401调用存储器1402中存储的程序代码接收到所述MME发送的携带所述UE被允许进行V2X业务的指示信息的初始上下文建立请求消息之后，还可以执行以下操作：
与所述UE建立接入层AS安全上下文；
所述处理器1401调用存储器1402中存储的程序代码向所述UE发送区域密钥分配消息，可以具体包括：
向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
请参阅图15，图15为本发明实施例提供的一种通信装置的结构示意图。其中，该通信装置可以应用于上述方法实施例中的HSS。如图15所示，该通信装置可以包括：
接收模块1501，用于接收移动管理实体MME发送的包括用户设备UE的身份标识的认证数据请求消息；
授权模块1502，用于根据所述UE的身份标识对所述UE进行授权检查；
发送模块1503，用于向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根 据所述认证数据响应消息确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
本发明实施例中，HSS接收到MME发送的认证数据请求消息之后，可以根据该认证数据请求消息中包括的UE的身份标识查询UE的签约信息，并根据该签约信息对UE进行授权检查。
在可选实施例中，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
相应地，所述授权模块1502，可以具体用于根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
在可选实施例中，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
请参阅图16，图16是本发明实施例提供的另一种通信装置的结构示意图。其中，如图16所示的通信装置可以包括：总线1603，以及与所述总线1603互连的处理器1601、存储器1602；所述存储器1602中存储有程序代码。本领域技术人员可以理解，图中示出的通信装置的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本发明实施例中，处理器1601调用存储器1602中存储的程序代码，可以执行以下操作：
接收MME发送的包括UE的身份标识的认证数据请求消息；
所述HSS根据所述UE的身份标识对所述UE进行授权检查；
所述HSS向所述MME发送包括AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根据所述认证数据响应消息确定所述UE被允许进行V2X业务，并根据所述AV对所述UE进行认证。
在可选实施例中，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
所述处理器1601调用存储器1602中存储的程序代码根据所述UE的身份标识对所述UE进行授权检查，可以具体包括：
根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
在可选实施例中，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
请参阅图17，图17为本发明实施例提供的一种通信装置的结构示意图。其中，该通信装置可以应用于上述方法实施例中的V2X服务器。如图17所示，该通信装置可以包括：
生成模块1701，用于生成第一通信设备所在区域的区域密钥；
发送模块1702，用于向第一通信设备发送区域密钥。
本发明实施例中，区域密钥由V2X服务器生成并管理。
本发明实施例中，第一通信设备可以包括但不限于：eNB、MME、或UE等。
在一种可选实施例中，所述发送模块1702，具体用于向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
在另一种可选实施例中，所述发送模块1702，可以具体用于当所述装置接收到eNB发送的区域密钥请求消息时，向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
在再一种可选实施例中，所述发送模块1702，可以具体用于当所述装置接收到移动管理实体MME发送的区域密钥请求消息，所述区域密钥请求消息中包括用户设备UE的位置信息时，向所述MME发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在又一种可选实施例中，请一并参阅图18，图18是本发明实施例公开的另一种通信装置的结构示意图，其中，图18所示的通信装置是由图17所示的通信装置进行优化得到的。与图17所示的通信装置相比较，图18所示的通信装置还可以包括：
建立模块1703，用于与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
相应地，所述发送模块1702，可以具体用于当所述装置接收到所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息时，向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在该实施例中，当UE附着成功之后，UE可以与V2X服务器建立GBA或GBA push安全机制，并在GBA或GBA push安全机制建立成功之后，UE可以向V2X服务器发送携带自身位置信息的区域密钥获取请求，V2X服务器接收到该区域密钥获取请求之后，可以根据该区域密钥获取请求中包括的UE的位置信息查询对应的区域密钥，将UE的位置信息对应的区域的区域密钥信息以及相邻区域的区域密钥信息发送给UE。
其中，UE与V2X服务器建立GBA或GBA push安全机制的流程中，V2X服务器充当NAF实体的角色，其具体流程可以参见现有技术中GBA或GBApush安全机制建立的流程中的相关描述，本发明实施例在此不再赘述。
请参阅图19，图19是本发明实施例提供的另一种通信装置的结构示意图。其中，如图19所示的通信装置可以包括：总线1903，以及与所述总线1903互连的处理器1901、存储器1902；所述存储器1902中存储有程序代码。本领域技术人员可以理解，图中示出的通信装置的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本发明实施例中，处理器1901调用存储器1902中存储的程序代码，可以执行以下操作：
生成第一通信设备所在区域的区域密钥；
向第一通信设备发送区域密钥。
在可选实施例中，所述处理器1901调用存储器1902中存储的程序代码向第一通信设备发送区域密钥，可以具体包括：
向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所 处区域的相邻区域的区域密钥信息。
在可选实施例中，所述处理器1901调用存储器1902中存储的程序代码向相应设备发送相关区域密钥，可以具体包括：
接收eNB发送的区域密钥请求消息；
向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述处理器1901调用存储器1902中存储的程序代码向第一通信设备发送区域密钥，可以具体包括：
接收移动管理实体MME发送的区域密钥请求消息，所述区域密钥请求消息中包括用户设备UE的位置信息；
所述V2X服务器向所述MME发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在可选实施例中，所述处理器1901调用存储器1902中存储的程序代码向第一通信设备发送区域密钥，可以具体包括：
与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
接收所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息；
向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
请参阅图20，图20为本发明实施例提供的一种通信装置的结构示意图。其中，该通信装置可以应用于上述方法实施例中的UE。如图20所示，该通信装置可以包括：
发送模块2001，用于向演进型基站eNB发送附着请求消息；
接收模块2002，用于接收所述eNB分配的车辆到任何其它终端V2X通信 资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在可选实施例中，所述接收模块2002，可以具体用于接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述发送模块，还用于向所述eNB发送区域密钥请求消息；
所述接收模块，还用于接收所述eNB发送的区域密钥响应消息，所述区域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
在可选实施例中，所述发送模块2001，可以具体用于向接收端发送V2X消息，所述V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，所述消息验证值是使用所述区域密钥ID以及区域ID对应的区域密钥对所述消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
在可选实施例中，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
请参阅图21，图21是本发明实施例提供的另一种通信装置的结构示意图。其中，如图21所示的通信装置可以包括：总线2103，以及与所述总线2103互连的处理器2101、存储器2102；所述存储器2102中存储有程序代码。本领域技术人员可以理解，图中示出的通信装置的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。本发明实施例中，处理器 2101调用存储器2102中存储的程序代码，可以执行以下操作：
向演进型基站eNB发送附着请求消息；
接收所述eNB分配的车辆到任何其它终端V2X通信资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，
接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在可选实施例中，所述处理器2101调用存储器2102中存储的程序代码接收演进型基站eNB分配的V2X通信资源，可以具体包括：
接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述UE向eNB发送附着请求消息之后，还包括：
所述UE向所述eNB发送区域密钥请求消息；
所述UE接收所述eNB发送的区域密钥响应消息，所述区域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
在可选实施例中，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
在可选实施例中，所述处理器2101调用存储器2102中存储的程序代码还可以执行以下操作：
向接收端发送V2X消息，所述V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，所述消息验证值是使用所述区域密钥ID以及区域ID对应的区域密钥对所述消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
在可选实施例中，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
请参阅图22，图22为本发明实施例提供的一种通信系统的架构示意图。如图22所示，该通信系统可以包括：
eNB2201，向MME发送附着请求消息；所述附着请求消息用于UE请求附着到网络，所述附着请求消息包括UE的身份标识；
MME2202，用于接收演进型基站eNB发送的附着请求消息，并根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息；
HSS2203，用于根据所述UE的身份标识对所述UE进行授权检查；向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过；
所述MME2202，还用于根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
在可选实施例中，所述通信系统还包括：
V2X服务器2204，用于生成第一通信设备所在区域的区域密钥，并向第一通信设备发送区域密钥。
在可选实施例中，所述通信系统还包括：
UE2205，用于向eNB2201发送附着请求消息；
所述UE2205，还用于接收所述eNB2201分配的V2X通信资源，所述V2X通信资源是所述eNB2201接收到所述UE2205被允许进行V2X业务的指示信息时向所述UE2205分配的；或，接收所述MME2202发送的区域密钥分配消息，所述区域密钥分配消息是所述MME2202确定所述UE2205被允许进行V2X业务，且对所述UE2205认证通过之后，向所述UE2205发送的，所述区域密钥分配消息包括所述UE2205的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
在可选实施例中，所述eNB2201可以包括图12-14任一所示的通信装置。
在可选实施例中，所述MME2202可以包括图9-11任一所示的通信装置。
在可选实施例中，所述HSS2203可以包括图15-16任一所示的通信装置。
在可选实施例中，所述V2X服务器2204可以包括图17-19任一所示的通信装置。
在可选实施例中，所述UE2205可以包括图20-21任一所示的通信装置。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本发明实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。具体的，可以借助软件加必需的通用硬件的方式来实现，通用硬件包括通用集成电路、通用CPU、通用存储器、通用元器件等，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品 销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(英文：Read-Only Memory，简称为ROM)、随机存取存储器(英文：Random Access Memory，简称为RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上对本发明实施例提供的一种通信方法及相关装置进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法；同时，对于本领域的一般技术人员，依据本发明，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (56)

  1. 一种通信方法，其特征在于，包括：
    移动管理实体MME接收演进型基站eNB发送的附着请求消息，所述附着请求消息用于用户设备UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
    所述MME根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
    所述MME接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
    所述MME根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
  2. 根据权利要求1所述的方法，其特征在于，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述MME根据所述附着请求消息，向HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查，包括：
    所述MME根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
  3. 根据权利要求2所述的方法，其特征在于，所述MME根据所述认证数据响应消息，确定所述UE被允许进行V2X业务，包括：
    所述MME根据所述认证数据响应消息，以及所述附着请求消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
  4. 根据权利要求1或2所述的方法，其特征在于，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述MME根据所述认证数据响应消息，确定所述UE被允许进行V2X业务，包括：
    所述MME根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述MME根据所述AV对所述UE进行认证之后，还包括：
    在所述MME对所述UE认证通过之后，所述MME向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
  6. 根据权利要求1-4任一项所述的方法，其特征在于，所述附着请求消息中还包括所述UE的位置信息；所述MME根据所述AV对所述UE进行认证之后，还包括：
    所述MME向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
    所述MME接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
    所述MME向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
  7. 根据权利要求6所述的方法，其特征在于，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  8. 根据权利要求6或7所述的方法，其特征在于，所述MME对所述UE认证通过之后，还包括：
    所述MME与所述UE建立非接入层NAS安全上下文；
    所述MME向所述UE发送区域密钥分配消息，包括：
    所述MME向所述UE发送通过NAS安全上下文保护后的区域密钥分配消息。
  9. 一种通信方法，其特征在于，包括：
    演进型基站eNB接收用户设备UE发送的第一附着请求消息；
    所述eNB根据所述第一附着请求消息，向移动管理实体MME发送第二附着请求消息；
    所述eNB接收所述MME发送的所述UE被允许进行车辆到其它任何终端V2X业务的指示信息；
    所述eNB根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
  10. 根据权利要求9所述的方法，其特征在于，所述eNB根据所述指示信息，为所述UE分配V2X通信资源之前，还包括：
    所述eNB接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
  11. 根据权利要求9或10所述的方法，其特征在于，所述eNB为所述UE分配V2X通信资源，包括：
    所述eNB向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
  12. 根据权利要求11所述的方法，其特征在于，所述eNB向所述UE发送区域密钥分配消息之前，还包括：
    所述eNB向V2X服务器发送区域密钥请求消息；
    所述eNB接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  13. 根据权利要求12所述的方法，其特征在于，所述区域密钥信息中包 括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  14. 根据权利要求11-13任一项所述的方法，其特征在于，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
    所述eNB接收到所述MME发送的携带所述UE被允许进行V2X业务的指示信息的初始上下文建立请求消息之后，所述方法还包括：
    所述eNB与所述UE建立接入层AS安全上下文；
    所述eNB向所述UE发送区域密钥分配消息，包括：
    所述eNB向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
  15. 一种通信方法，其特征在于，包括：
    归属签约用户服务器HSS接收移动管理实体MME发送的包括用户设备UE的身份标识的认证数据请求消息；
    所述HSS根据所述UE的身份标识对所述UE进行授权检查；
    所述HSS向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根据所述认证数据响应消息确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
  16. 根据权利要求15所述的方法，其特征在于，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述HSS根据所述UE的身份标识对所述UE进行授权检查，包括：
    所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
  17. 根据权利要求15所述的方法，其特征在于，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
  18. 一种通信方法，其特征在于，包括：
    车辆到其它任何终端V2X服务器生成第一通信设备所在区域的区域密钥；
    所述V2X服务器向第一通信设备发送区域密钥。
  19. 根据权利要求18所述的方法，其特征在于，所述V2X服务器向第一通信设备发送区域密钥，包括：
    所述V2X服务器向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
  20. 根据权利要求18所述的方法，其特征在于，所述V2X服务器向相应设备发送相关区域密钥，包括：
    所述V2X服务器接收eNB发送的区域密钥请求消息；
    所述V2X服务器向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
  21. 根据权利要求18所述的方法，其特征在于，所述V2X服务器向第一通信设备发送区域密钥，包括：
    所述V2X服务器接收移动管理实体MME发送的区域密钥请求消息，所述区域密钥请求消息中包括用户设备UE的位置信息；
    所述V2X服务器向所述MME发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  22. 根据权利要求18所述的方法，其特征在于，所述V2X服务器向第一通信设备发送区域密钥，包括：
    所述V2X服务器与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
    所述V2X服务器接收所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息；
    所述V2X服务器向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  23. 一种通信方法，其特征在于，包括：
    用户设备UE向演进型基站eNB发送附着请求消息；
    所述UE接收所述eNB分配的车辆到任何其它终端V2X通信资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，
    所述UE接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  24. 根据权利要求23所述的方法，其特征在于，所述UE接收演进型基站eNB分配的V2X通信资源，包括：
    所述UE接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  25. 根据权利要求23所述的方法，其特征在于，所述UE向eNB发送附着请求消息之后，还包括：
    所述UE向所述eNB发送区域密钥请求消息；
    所述UE接收所述eNB发送的区域密钥响应消息，所述区域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  26. 根据权利要求23-25任一项所述的方法，其特征在于，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  27. 根据权利要求26所述的方法，其特征在于，所述方法还包括：
    所述UE向接收端发送V2X消息，所述V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，所述消息验证值是使用所述区域密钥ID以及区域ID对应的区域密钥对所述消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
  28. 根据权利要求23-27任一项所述的方法，其特征在于，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
  29. 一种通信装置，其特征在于，包括：
    接收模块，用于接收演进型基站eNB发送的附着请求消息，所述附着请求消息用于用户设备UE请求附着到网络，所述附着请求消息中包括所述UE的身份标识；
    发送模块，用于根据所述附着请求消息，向归属签约用户服务器HSS发送包括所述UE的身份标识的认证数据请求消息，使得所述HSS根据所述UE的身份标识对所述UE进行授权检查；
    所述接收模块，还用于接收所述HSS发送的包括认证向量AV的认证数据响应消息，所述认证数据响应消息用于指示所述UE授权检查通过；
    确定模块，用于根据所述认证数据响应消息，确定所述UE被允许进行车辆到其它任何终端V2X业务；
    认证模块，用于根据所述AV对所述UE进行认证。
  30. 根据权利要求29所述的装置，其特征在于，所述附着请求消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述发送模块，具体用于根据所述附着请求消息，向所述HSS发送包括所述UE的身份标识，以及所述V2X指示信息的认证数据请求消息，使得所述HSS根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
  31. 根据权利要求30所述的装置，其特征在于，
    所述确定模块，具体用于根据所述认证数据响应消息，以及所述附着请求 消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
  32. 根据权利要求29或30所述的装置，其特征在于，所述认证数据响应消息中还包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述确定模块，具体用于根据所述认证数据响应消息，以及所述认证数据响应消息中包括的所述V2X指示信息，确定所述UE被允许进行V2X业务。
  33. 根据权利要求29-32任一项所述的装置，其特征在于，
    所述发送模块，还用于在所述认证模块对所述UE认证通过之后，向所述eNB发送所述UE被允许进行V2X业务的指示信息，以使所述eNB为所述UE分配V2X通信资源。
  34. 根据权利要求29-32任一项所述的装置，其特征在于，所述附着请求消息中还包括所述UE的位置信息；
    所述发送模块，还用于向V2X服务器发送包括所述UE的位置信息的区域密钥请求消息；
    所述接收模块，还用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息；
    所述发送模块，还用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述UE的位置信息对应的区域的区域密钥信息以及所述区域的相邻区域的区域密钥信息，所述区域密钥信息用于区域内的UE对V2X消息进行安全保护。
  35. 根据权利要求34所述的装置，其特征在于，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  36. 根据权利要求34或35所述的装置，其特征在于，所述装置还包括：
    建立模块，用于所述认证模块对所述UE认证通过之后，与所述UE建立非接入层NAS安全上下文；
    所述发送模块，具体用于向所述UE发送通过NAS安全上下文保护后的 区域密钥分配消息。
  37. 一种通信装置，其特征在于，包括：
    接收模块，用于接收用户设备UE发送的第一附着请求消息；
    发送模块，用于根据所述第一附着请求消息，向移动管理实体MME发送第二附着请求消息；
    所述接收模块，还用于接收所述MME发送的所述UE被允许进行车辆到其它任何终端V2X业务的指示信息；
    分配模块，还用于根据所述UE被允许进行V2X业务的指示信息，为所述UE分配V2X通信资源。
  38. 根据权利要求37所述的装置，其特征在于，
    所述接收模块，还用于接收所述UE发送的V2X资源调度请求，所述V2X资源调度请求用于请求V2X通信资源。
  39. 根据权利要求37或38所述的装置，其特征在于，
    所述分配模块，具体用于向所述UE发送区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息；所述区域密钥信息用于区域内UE对V2X通信消息进行安全保护。
  40. 根据权利要求39所述的装置，其特征在于，
    所述发送模块，还用于向V2X服务器发送区域密钥请求消息；
    所述接收模块，还用于接收所述V2X服务器发送的区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  41. 根据权利要求40所述的装置，其特征在于，所述区域密钥信息中包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  42. 根据权利要求39-41任一项所述的装置，其特征在于，所述UE被允许进行V2X业务的指示信息携带在初始上下文建立请求消息中；
    所述装置还包括：
    建立模块，用于与所述UE建立接入层AS安全上下文；
    所述发送模块，具体用于向所述UE发送通过AS安全上下文保护后的区域密钥分配消息。
  43. 一种通信装置，其特征在于，包括：
    接收模块，用于接收移动管理实体MME发送的包括用户设备UE的身份标识的认证数据请求消息；
    授权模块，用于根据所述UE的身份标识对所述UE进行授权检查；
    发送模块，用于向所述MME发送包括认证向量AV的认证数据响应消息，所述认证数据响应消息指示所述UE授权检查通过，以使所述MME根据所述认证数据响应消息确定所述UE被允许进行车辆到其它任何终端V2X业务，并根据所述AV对所述UE进行认证。
  44. 根据权利要求43所述的装置，其特征在于，所述认证数据请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型；
    所述授权模块，具体用于根据所述UE的身份标识确定所述UE是否被允许进行V2X业务。
  45. 根据权利要求43所述的装置，其特征在于，所述认证数据请求消息中不包括V2X指示信息，所述认证数据响应消息还包括所述V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
  46. 一种通信装置，其特征在于，包括：
    生成模块，用于生成第一通信设备所在区域的区域密钥；
    发送模块，用于向第一通信设备发送区域密钥。
  47. 根据权利要求46所述的装置，其特征在于，
    所述发送模块，具体用于向演进型基站eNB发送所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
  48. 根据权利要求46所述的装置，其特征在于，
    所述发送模块，具体用于当所述装置接收到eNB发送的区域密钥请求消息时，向所述eNB发送区域密钥响应消息，所述区域密钥响应消息中包括所述eNB所处区域的区域密钥信息，以及所述所处区域的相邻区域的区域密钥信息。
  49. 根据权利要求46所述的装置，其特征在于，
    所述发送模块，具体用于当所述装置接收到移动管理实体MME发送的区域密钥请求消息，所述区域密钥请求消息中包括用户设备UE的位置信息时，向所述MME发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  50. 根据权利要求46所述的装置，其特征在于，所述装置还包括：
    建立模块，用于与用户设备UE建立通用自举架构GBA或GBA推送push安全机制的安全连接；
    所述发送模块，具体用于当所述装置接收到所述UE发送的区域密钥请求消息，所述区域密钥请求消息中包括所述UE的位置信息时，向所述UE发送区域密钥响应消息，所述区域密钥响应消息中包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  51. 一种通信装置，其特征在于，包括：
    发送模块，用于向演进型基站eNB发送附着请求消息；
    接收模块，用于接收所述eNB分配的车辆到任何其它终端V2X通信资源，所述V2X通信资源是所述eNB接收到所述UE被允许进行V2X业务的指示信息时向所述UE分配的；或，接收移动管理实体MME发送的区域密钥分配消息，所述区域密钥分配消息是所述MME确定所述UE被允许进行V2X业务，且对所述UE认证通过之后，向所述UE发送的，所述区域密钥分配消息包括所述UE的位置信息对应的区域的区域密钥信息，以及所述区域的相邻区域的区域密钥信息。
  52. 根据权利要求51所述的装置，其特征在于，
    所述接收模块，具体用于接收所述eNB发送的区域密钥分配消息，所述区域密钥分配消息中包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  53. 根据权利要求51所述的装置，其特征在于，
    所述发送模块，还用于向所述eNB发送区域密钥请求消息；
    所述接收模块，还用于接收所述eNB发送的区域密钥响应消息，所述区 域密钥响应消息包括所述eNB所处区域的区域密钥信息和所述所处区域的相邻区域的区域密钥信息。
  54. 根据权利要求51-53任一项所述的装置，其特征在于，所述区域密钥信息包括：区域密钥、区域密钥ID以及区域ID三者的对应关系。
  55. 根据权利要求54所述的装置，其特征在于，所述发送模块，具体用于向接收端发送V2X消息，所述V2X消息中包括消息内容、区域密钥ID、区域ID以及消息验证值；其中，所述消息验证值是使用所述区域密钥ID以及区域ID对应的区域密钥对所述消息内容、区域密钥ID以及区域ID进行完整性保护得到的。
  56. 根据权利要求51-55任一项所述的装置，其特征在于，所述附着请求消息中包括V2X指示信息，所述V2X指示信息用于指示所述UE为V2X类型。
PCT/CN2015/085890 2015-07-31 2015-07-31 一种通信方法及相关装置 WO2017020206A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
CN201580066251.2A CN107005844B (zh) 2015-07-31 2015-07-31 一种通信方法及相关装置
JP2018504899A JP6553806B2 (ja) 2015-07-31 2015-07-31 通信方法および関連装置
PCT/CN2015/085890 WO2017020206A1 (zh) 2015-07-31 2015-07-31 一种通信方法及相关装置
EP15899981.3A EP3319354B1 (en) 2015-07-31 2015-07-31 V2x communication methods and related apparatuses
US15/880,540 US10939413B2 (en) 2015-07-31 2018-01-26 Communication method and related apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/085890 WO2017020206A1 (zh) 2015-07-31 2015-07-31 一种通信方法及相关装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/880,540 Continuation US10939413B2 (en) 2015-07-31 2018-01-26 Communication method and related apparatus

Publications (1)

Publication Number Publication Date
WO2017020206A1 true WO2017020206A1 (zh) 2017-02-09

Family

ID=57942244

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/085890 WO2017020206A1 (zh) 2015-07-31 2015-07-31 一种通信方法及相关装置

Country Status (5)

Country Link
US (1) US10939413B2 (zh)
EP (1) EP3319354B1 (zh)
JP (1) JP6553806B2 (zh)
CN (1) CN107005844B (zh)
WO (1) WO2017020206A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170108859A1 (en) * 2015-10-19 2017-04-20 Leauto Intelligent Technology (BEIJING) Co., Ltd. Vehicle operation control method, device and system
CN111405552A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种车联网传输处理方法及设备
CN112954643A (zh) * 2019-11-25 2021-06-11 中国移动通信有限公司研究院 直连通信认证方法、终端、边缘服务节点及网络侧设备

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102015114285B4 (de) * 2015-08-27 2018-10-31 Volkswagen Aktiengesellschaft Vorrichtung, Verfahren und Computerprogramm zum Bereitstellen von Übertragungsparametern
US11671907B2 (en) * 2016-07-26 2023-06-06 Apple Inc. Device for and method of radio access technology selection among multiple radio access technologies
CN109756451B (zh) 2017-11-03 2022-04-22 华为技术有限公司 一种信息交互方法及装置
CN110545252B (zh) * 2018-05-29 2021-10-22 华为技术有限公司 一种认证和信息保护的方法、终端、控制功能实体及应用服务器
US20210400473A1 (en) * 2018-11-02 2021-12-23 Nec Corporation Procedure to update the parameters related to unified access control
US10986605B2 (en) * 2019-07-19 2021-04-20 Cisco Technology, Inc. Providing a network location service when a user equipment is not served by a third generation partnership project (3GPP) radio
EP4106371A4 (en) * 2020-03-13 2023-03-08 Huawei Technologies Co., Ltd. COMMUNICATION METHOD, APPARATUS AND SYSTEM
CN115119164A (zh) * 2021-03-18 2022-09-27 华为技术有限公司 一种通信方法、装置及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102577227A (zh) * 2010-05-31 2012-07-11 三洋电机株式会社 终端装置以及基站装置
CN103209412A (zh) * 2012-01-17 2013-07-17 华为技术有限公司 建立设备到设备连接的方法、设备和系统
CN103379654A (zh) * 2012-04-17 2013-10-30 中兴通讯股份有限公司 D2D终端接入控制方法、D2D终端、eNB和MME
CN103459234A (zh) * 2011-04-05 2013-12-18 西门子公司 用于列车安全系统的密钥管理的系统和方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101136826B (zh) * 2007-09-30 2011-01-05 中兴通讯股份有限公司 一种通过核心网控制终端接入家庭基站覆盖区域的方法
JP2012037940A (ja) 2010-08-03 2012-02-23 Toshiba Corp 車車間通信システム、車載装置、車車間通信方法及びプログラム
WO2013181421A2 (en) 2012-05-31 2013-12-05 Interdigital Patent Holdings, Inc. Method and apparatus for device-to-device (d2d) mobility in wireless systems
CN103546984A (zh) * 2012-07-13 2014-01-29 北京三星通信技术研究有限公司 接入移动通信系统的方法及设备
EP2892302A4 (en) 2012-08-28 2016-05-11 Kyocera Corp MOBILE COMMUNICATION SYSTEM, USER TERMINAL, PROCESSOR, AND STORAGE MEDIUM
KR20140073065A (ko) * 2012-12-06 2014-06-16 한국전자통신연구원 셀룰러 이동통신시스템에서 단말간 멀티캐스트 직접통신 방법 및 장치
US20180049088A1 (en) * 2015-03-20 2018-02-15 Nec Corporation Vehicle communication system, base station, server apparatus, message transmitting method, vehicle related service providing method, and readable medium
KR102415672B1 (ko) * 2015-04-09 2022-07-04 삼성전자주식회사 디바이스 간 메시지 송수신 방법 및 장치

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102577227A (zh) * 2010-05-31 2012-07-11 三洋电机株式会社 终端装置以及基站装置
CN103459234A (zh) * 2011-04-05 2013-12-18 西门子公司 用于列车安全系统的密钥管理的系统和方法
CN103209412A (zh) * 2012-01-17 2013-07-17 华为技术有限公司 建立设备到设备连接的方法、设备和系统
CN103379654A (zh) * 2012-04-17 2013-10-30 中兴通讯股份有限公司 D2D终端接入控制方法、D2D终端、eNB和MME

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170108859A1 (en) * 2015-10-19 2017-04-20 Leauto Intelligent Technology (BEIJING) Co., Ltd. Vehicle operation control method, device and system
US9753458B2 (en) * 2015-10-19 2017-09-05 Leauto Intelligent Technology (BEIJING) Co., Ltd. Vehicle operation control method, device and system
CN111405552A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种车联网传输处理方法及设备
CN112954643A (zh) * 2019-11-25 2021-06-11 中国移动通信有限公司研究院 直连通信认证方法、终端、边缘服务节点及网络侧设备
CN112954643B (zh) * 2019-11-25 2024-03-19 中国移动通信有限公司研究院 直连通信认证方法、终端、边缘服务节点及网络侧设备

Also Published As

Publication number Publication date
CN107005844A (zh) 2017-08-01
JP2018525916A (ja) 2018-09-06
CN107005844B (zh) 2020-12-04
JP6553806B2 (ja) 2019-07-31
US10939413B2 (en) 2021-03-02
US20180167913A1 (en) 2018-06-14
EP3319354B1 (en) 2020-12-30
EP3319354A4 (en) 2018-07-18
EP3319354A1 (en) 2018-05-09

Similar Documents

Publication Publication Date Title
WO2017020206A1 (zh) 一种通信方法及相关装置
US10863356B2 (en) Communications method, apparatus, and system
US10979408B2 (en) Authentication and authorization in proximity based service communication
US10548005B2 (en) Method for security of user equipment connection identifier in wireless communication system and apparatus therefor
Sharma et al. Security challenges in Internet of Vehicles (IoV) environment
Ahmed et al. Secure LTE-based V2X service
JP2020517144A (ja) Ｖ２ｘ通信装置、及びそのデータ通信方法
US10944551B2 (en) Flexible security channel establishment in D2D communications
US20200228988A1 (en) V2x communication device and method for inspecting forgery/falsification of key thereof
CN107852607B (zh) 用于验证对设备使用特征集合的授权的方法和装置
US20170324754A1 (en) Secure group creation in proximity based service communication
CN112752236B (zh) 一种基于区块链的网联汽车认证方法、设备及储存介质
US20160164875A1 (en) Secure system and method of making secure communication
WO2022079572A1 (en) Relay ue and remote ue authorization
CN109756336B (zh) 一种认证方法、v2x计算系统及v2x计算节点
Muhammad et al. 5G-based V2V broadcast communications: A security perspective
Limbasiya et al. Mcomiov: Secure and energy-efficient message communication protocols for internet of vehicles
CN111601280A (zh) 一种接入验证方法及装置
JP6715998B2 (ja) 通信方法および関連装置
Punitha et al. Privacy preservation and authentication on secure geographical routing in VANET
KR20110058067A (ko) 이동통신망을 이용한 싱크 인증 시스템 및 방법
Fukushima et al. Pseudonym and key management scheme for supporting social smart applications
Basta et al. 5G-Enabled Pseudonymity for Cooperative Intelligent Transportation System
Kamalavathi et al. A new secure message transferring in taxi service for vehicular ad hoc network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15899981

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018504899

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2015899981

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE