WO2017117775A1 - Procédé et système de gestion de la sécurité de communications, et dispositif associé - Google Patents

Procédé et système de gestion de la sécurité de communications, et dispositif associé Download PDF

Info

Publication number
WO2017117775A1
WO2017117775A1 PCT/CN2016/070379 CN2016070379W WO2017117775A1 WO 2017117775 A1 WO2017117775 A1 WO 2017117775A1 CN 2016070379 W CN2016070379 W CN 2016070379W WO 2017117775 A1 WO2017117775 A1 WO 2017117775A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
security
terminal
identifier
group
Prior art date
Application number
PCT/CN2016/070379
Other languages
English (en)
Chinese (zh)
Inventor
应江威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/070379 priority Critical patent/WO2017117775A1/fr
Publication of WO2017117775A1 publication Critical patent/WO2017117775A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a communication security processing method, system, and related device.
  • D2D device-to-device
  • LTE Long Term Evolution
  • 3GPP 3rd Generation Partnership Project
  • the discovery is that the network side short-range communication function entity allocates a Proximity Service Code (ProSeimity Service Code, ProSe Code) for the D2D-capable user equipment (User Equipment, UE for short), and the broadcast UE (Announcing UE, referred to as A- The UE) indicates its own existence by broadcasting its own short-range service code, and the monitoring UE (M-UE) detects the A-UE and the A-UE by listening to the short-range service code of the broadcast UE on the air interface. A connection is established, after which the A-UE and the M-UE can communicate.
  • Proximity Service Code ProSe Code
  • ProSe Code Proximity Service Code
  • the attacker can intercept the short-range service code and replay the discovery message carrying the adjacent service code to let the M-UE discover it and establish communication with it.
  • the attacker can perform the security attacks such as forging the M-UE and obtaining the M-UE information illegally. Therefore, a security mechanism is needed in the D2D technology to prevent such a security threat.
  • the first security key is used to improve the security.
  • the A-UE applies for an authorization message to the network side neighboring functional entity, and the authorization message includes a short-range service code and a first security key.
  • the timer value, etc. the A-UE generates a MIC verification value according to the first security key, and then performs integrity protection on the discovery process based on the MIC.
  • the A-UE broadcast discovery message carries the proximity service code, the MIC verification value, and the timer value in the discovery message.
  • the M-UE After receiving the discovery message, the M-UE sends the MIC verification value and the timer value to the network side neighboring functional entity, and the network side The near-function entity performs verification of the MIC verification value, and after the network side neighboring functional entity successfully verifies, returns a verification response to the M-UE, and the M-UE establishes communication with the A-UE according to the returned verification response of the successfully verified MIC verification value.
  • the security of the communication content is improved by a group key (Group Keys, PGK for short).
  • PGK Group Keys
  • the UE1 applies for key information to the network side neighboring function entity, the network side neighboring function entity returns key information, the key information carries the PGK, and the UE1 broadcasts the discovery message based on the PGK and communicates with the UE2.
  • the above D2D discovery and communication schemes are implemented in a networked mode (operator network coverage). If the D2D discovery and communication are in the off-network mode (without carrier network coverage), the UE cannot connect with the network side neighboring functional entity to obtain Authorization messages or key information, etc., therefore, the security mechanism in the networked mode cannot be used in the off-network mode. Further, in the off-network mode, D2D discovery and communication are still subject to security threats.
  • the embodiments of the present invention provide a communication security processing method, system, and related device, which are used to solve the security problem of communication in the off-network mode.
  • a first aspect of the present invention provides a communication security processing method, which is applied to a terminal, and may include:
  • the terminal sends an authorization request to the network side short-range communication function entity, where the authorization request includes the identification information of the terminal, and the authorization request is used to request the security information of the terminal from the network-side short-range communication function entity, where the security information includes the group a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate a group to which the terminal belongs, and the group key identifier is used to indicate the group key;
  • the terminal receives the authorization response sent by the network side short-range communication function entity, and the authorization response includes the security information of the terminal;
  • the terminal generates a security protection key for processing a short-range message according to the security information of the terminal.
  • the terminal requests the security information from the network side short-range communication function entity, and then the terminal can also generate the security protection key according to the security information when the terminal is not under the network coverage of the operator.
  • the security protection key is used to process the close-range message, thereby implementing communication security in the off-network mode.
  • the processing here includes the security protection of close-range messages. Processing or security verification processing.
  • the foregoing security information further includes at least one of a first integrity protection algorithm identifier, a second integrity protection algorithm identifier, and an encryption algorithm identifier.
  • first integrity protection algorithm identifier, the second integrity protection algorithm identifier, and the encryption algorithm identifier may also be determined by negotiation between the two terminals.
  • the foregoing security information further includes at least one of an identity of the sending terminal and an identity of the receiving terminal.
  • the foregoing terminal generates a security protection key for processing a short-range message according to the security information of the terminal, where the terminal includes: a key generation function KDF algorithm, the group identifier, and the group key. And generating a first security key; the terminal generates a security protection key according to the security protection algorithm identifier, the KDF algorithm, and the first security key.
  • the KDF algorithm is configured in the terminal, and the security information further includes the security protection algorithm identifier.
  • the security protection algorithm identifier may also be negotiated by the two terminals.
  • the security protection key may be a first integrity protection key, or an encryption key, or a second integrity protection key.
  • the short-range message is a short-range discovery message
  • the security protection algorithm identifier is a first integrity protection algorithm identifier
  • the first integrity protection algorithm identifier is used to identify a first-party discovery message.
  • An integrity protection algorithm; the foregoing terminal generates the security protection key according to the security protection algorithm identifier, the KDF algorithm, and the first security key, where the terminal includes: the foregoing first integrity protection algorithm identifier, the KDF algorithm, and the foregoing
  • the first security key is generated by the first security key
  • the first integrity protection key is the security protection key.
  • the first integrity protection key is further generated according to the KDF algorithm, the first integrity protection algorithm identifier, and the first security key. Therefore, the first integrity protection key is used to perform integrity protection or integrity verification of the proximity discovery message to improve security.
  • the short-range message is a short-range communication message
  • the security protection algorithm is identified as an encryption key identifier
  • the encryption key identifier is used to identify an encryption algorithm for processing a short-range communication message
  • the KDF algorithm and the first security key generate an encryption key
  • the encryption key is the security protection key.
  • the encryption key is further generated according to the KDF algorithm, the first security key, and the encryption algorithm identifier, and the proximity communication is performed according to the encryption key.
  • the message is encrypted or protected by a secure authentication process to improve security.
  • the short-range message is a short-range communication message
  • the security protection algorithm identifier is a second integrity protection algorithm identifier
  • the second integrity protection algorithm identifier is used to identify a short-range communication message.
  • a second integrity protection algorithm the terminal generates the security protection key according to the security protection algorithm identifier, the KDF algorithm, and the first security key, where the terminal protects according to the second integrity
  • the algorithm identifier, the KDF algorithm, and the first security key generate a second integrity protection key
  • the second integrity protection key is the security protection key.
  • the second integrity protection key is further generated according to the KDF algorithm, the first security key, and the second integrity protection algorithm identifier, The security protection process or the security verification process is performed on the short-range communication message according to the second integrity protection key to improve security.
  • the terminal after the terminal generates the security protection key for processing the short-range message according to the security information, the terminal includes: performing security protection processing on the short-distance message according to the security protection key; or The terminal performs security verification processing on the short-range message according to the security protection key.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • a second aspect of the present invention provides a communication security processing method, which is applied to a network side short-range communication function entity, and may include:
  • the network side short-range communication function entity receives an authorization request sent by the terminal, where the authorization request includes the identifier information of the terminal;
  • the network side short-range communication function entity searches for the security information of the terminal according to the identifier information of the terminal, where the security information includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate that the terminal belongs to a group, the group key identifier is used to indicate the group key, and the security information of the terminal is used to generate a security protection key for processing a short-range message;
  • the network side short-range communication function entity sends an authorization response to the terminal, and the authorization response includes the security information of the terminal.
  • the network side short-range communication function entity searches for the security information of the terminal according to the authorization request sent by the terminal, and then returns the security information to the terminal, so that the terminal is not under the coverage of the operator network. It is also possible to implement secure communication.
  • the network side short-range communication function entity searches for the security information of the terminal according to the identifier information of the terminal, and the network-side short-range communication function entity searches for the terminal to belong to the terminal according to the identifier information of the terminal.
  • the authorization information of the group includes the group identifier of the group to which the terminal belongs; the network side short-range communication function entity searches for the group indicated by the group identifier according to the identifier information of the terminal and the group identifier. Group of security information.
  • the security information of the terminal further includes at least one of a first integrity protection algorithm identifier, a second integrity protection algorithm identifier, and an encryption algorithm identifier.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • a third aspect of the present invention provides a terminal, which may include:
  • a transmitter configured to send an authorization request to the network side short-range communication function entity, where the authorization request includes the identifier information of the terminal, where the authorization request is used to request the network side short-range communication function entity to request the security information of the terminal, where the security is performed.
  • the information includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate a group to which the terminal belongs, and the group key identifier is used to indicate the group key.
  • a receiver configured to receive an authorization response sent by the network side short-range communication function entity, where the authorization response includes security information of the terminal;
  • a processor configured to generate a security protection key for processing the short-range message according to the security information of the terminal.
  • the processor is specifically configured to: generate a first security key according to a key generation function KDF algorithm, the group identifier, and the group key; according to a security protection algorithm identifier, the KDF algorithm, and The first security key generates the security protection key.
  • the protection algorithm is identified as a first integrity protection algorithm identifier, and the first integrity protection algorithm identifier is used to identify a first integrity protection algorithm for processing a proximity discovery message, where the processor is further specifically configured to perform the first integrity according to the foregoing
  • the protection algorithm identifier, the KDF algorithm, and the first security key are generated to generate a first integrity protection key, where the first integrity protection key is the security protection key.
  • the security protection algorithm is identified as an encryption key identifier, and the encryption key identifier is used to identify an encryption algorithm for processing a short-range communication message, where the processor is Further specifically, the encryption key is generated according to the encryption algorithm identifier, the KDF algorithm, and the first security key, and the encryption key is the security protection key.
  • the short-range message is a short-range communication message
  • the security protection algorithm identifier is a second integrity protection algorithm identifier
  • the second integrity protection algorithm identifier is used to identify a short-range communication message.
  • the processor is further configured to generate a second integrity protection key according to the second integrity protection algorithm identifier, the KDF algorithm, and the first security key, and the second integrity The protection key is the above security protection key.
  • the processor is further configured to perform security protection processing on the short-range message according to the security protection key after generating a security protection key for processing a short-range message according to the security information. Or, according to the above security protection key, perform security verification processing on the above short-range message.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • a fourth aspect of the present invention provides a network side short-range communication function entity, which may include:
  • a communication interface configured to receive an authorization request sent by the terminal, where the authorization request includes the identifier information of the terminal;
  • a processor configured to search for security information of the terminal according to the identifier information of the terminal, where the security information of the terminal includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate the group to which the terminal belongs
  • the group key identifier is used to indicate the group key, and the security information of the terminal is used to generate a security protection key for processing a short-range message;
  • the communication interface is further configured to send an authorization response to the terminal, where the authorization response includes security information of the terminal.
  • the processor is specifically configured to: according to the identifier information of the terminal, search for authorization information of a group to which the terminal belongs, where the authorization information includes a group identifier of a group to which the terminal belongs;
  • the identification information and the group identifier are used to search for security information of the group indicated by the group identifier.
  • the foregoing security information further includes at least one of a first integrity protection algorithm identifier, a second integrity protection algorithm identifier, and an encryption algorithm identifier.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • a fifth aspect of the present invention provides a communication security processing system, which may include:
  • the terminal provided by the third aspect and the network side close-range functional entity provided by the fourth aspect are identical to the terminal provided by the third aspect and the network side close-range functional entity provided by the fourth aspect.
  • FIG. 1a is a signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 1b is a schematic diagram of generating a security protection key according to an embodiment of the present invention.
  • 2a is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • 2b is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 3a is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 3b is a schematic diagram of generating a discovery key according to an embodiment of the present invention.
  • FIG. 3c is a schematic diagram of generating a first integrity protection key according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of processing of integrity protection according to an embodiment of the present invention.
  • FIG. 4 is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 5a is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 5b is a schematic diagram of generating a communication key according to an embodiment of the present invention.
  • FIG. 5c is a schematic diagram of generating an encryption key according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of processing of integrity protection according to another embodiment of the present invention.
  • FIG. 6 is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 7 is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a network side short-range functional entity according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a communication security processing system according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a terminal according to another embodiment of the present invention.
  • the embodiment of the invention provides a communication security processing method for improving the security of communication in the off-network mode.
  • the embodiment of the invention further provides a system corresponding to the communication security processing method, and a terminal and a network side short-range communication function entity.
  • the embodiment of the present invention is applied to a D2D communication system in a short-distance service.
  • a terminal User Equipment, UE for short
  • a terminal can establish D2D communication under the network coverage of the operator (that is, in the network mode), or The D2D communication is not established under the network coverage of the operator (ie, in the off-network mode).
  • the terminal and the terminal may perform the D2D discovery process first, and then perform the D2D communication; or the terminal and the terminal may not initiate the D2D discovery process. Direct D2D communication.
  • a security protection policy is provided for both D2D discovery and D2D communication under the network coverage of the operator, and for the D2D discovery and D2D communication not under the operator's network coverage, the terminal is in the off-network mode. Cannot get related from functional entities near the network side The information is protected against D2D discovery and D2D communication, resulting in a large security problem in D2D discovery and D2D communication that are not under the operator's network coverage.
  • the embodiment of the present invention is used to solve the security problem of the D2D discovery and the D2D communication that the terminal is not in the network coverage of the operator, so as to improve the communication security.
  • the embodiment of the present invention can also be used when the terminal is under the network coverage of the operator.
  • D2D discovery and security issues with D2D communication In D2D discovery, the terminal discovers the message through the broadcast, so that other terminals in the same group discover it, so that there is communication demand and D2D communication between the terminals; D2D communication may be one-to-many communication, or may be one-to-one. Communication.
  • a group can be divided by an operator according to a service type or the like.
  • FIG. 1a is a signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • a communication security processing method may include:
  • the terminal sends an authorization request to the network side short-range communication function entity, where the authorization request includes the identifier information of the terminal.
  • the authorization request is used to request security information of the terminal from the network side short-range communication function entity, where the security information includes a group identifier (ProSe group ID), a group key (ProSe group key), and a group.
  • a key identifier (ProSe group key ID)
  • the group identifier is used to indicate a group to which the terminal belongs
  • the group key identifier is used to indicate the group key
  • the group key refers to the same group The key shared by the terminals in the group.
  • the identifier information of the terminal may be an International Mobile Subscriber Identification Number (IMSI) and/or a Mobile Subscriber International ISDN/PSTN number (MSISDN).
  • IMSI International Mobile Subscriber Identification Number
  • MSISDN Mobile Subscriber International ISDN/PSTN number
  • the terminal may include any mobile terminal, a tablet computer, a personal digital assistant (PDA), a point of sales (POS), an in-vehicle computer, and the like.
  • the network side short-range communication function entity may be a ProSe Function or the like.
  • the terminal sending the authorization request to the network side short-range communication function entity may be based on three situations: the terminal completes the subscription in the network operator, before the first communication; and the public land mobile network needs to be performed on the terminal ( When the Public Land Mobile Network (PLMN) is switched, the terminal periodically requests security information from the network side short-range communication function entity.
  • PLMN Public Land Mobile Network
  • the network side short-range communication function entity receives an authorization request.
  • the network side short-range communication function entity searches for security information of the terminal according to the identifier information of the terminal.
  • the identification information of the terminal, the authorization information of the group to which the terminal belongs, and the correspondence relationship of the security information are set.
  • the authorization information lists the group identifier of each group that the terminal is authorized to join, and the terminal corresponds to the corresponding security information in each group.
  • the group to which the terminal is authorized to join includes the group A, the group B, and the group C, where the authorization information includes the group identifiers of the group A, the group B, and the group C, according to the terminal.
  • the identification information and the group identifier of the group A can be used to find the corresponding security information A.
  • the corresponding security information B can be found, according to the identification information and the group of the terminal.
  • the corresponding security information C can be found. That is, the terminal uses the security information A in the group A, the terminal uses the security information B in the group B, and the terminal uses the security information C in the group C.
  • the network side short-range communication function entity when the network side short-range communication function entity receives the authorization request of the terminal, the security information of the group indicated by each group identifier in the authorization information is sent to the terminal, in the above example, The network side short-range communication function entity will send three security information to the terminal, namely, security information A, security information B, and security information C.
  • the network side short-range communication function entity sends an authorization response to the terminal, where the authorization response includes security information of the terminal.
  • the terminal receives the authorization response.
  • the security information of the terminal and the terminal generate a security protection key for processing a short-range message
  • a Key Derivation Function (KDF) algorithm is configured in the terminal, and the step 106 specifically includes: according to the KDF algorithm, the group identifier, and the group key, the first security secret is formed. The key then generates a security protection key according to the KDF algorithm, the first security key, and the security protection algorithm identifier.
  • the security information of the terminal may further include a security protection algorithm identifier in addition to the group identifier, the group key, and the group key identifier.
  • FIG. 1b is a schematic diagram of generating a security protection key according to an embodiment of the present invention.
  • two KDF algorithms are used to form a two-layer structure.
  • the KDF algorithm in each layer structure is treated as a function (or an algorithm processing module).
  • the group identifier and group key are used in the first layer structure.
  • the KDF algorithm obtains the output as the first security key, as shown in the left flow in Figure 1b.
  • the first security key is used as the input parameter of the second layer structure, and the other input parameter is the security protection algorithm identifier.
  • the output is the security protection key (as shown in the right flow in Figure 1b).
  • the security protection algorithm identifier may be a first integrity protection algorithm identifier, and the first integrity protection algorithm identifier is used to identify and process a close-range discovery.
  • the first integrity protection algorithm for the message may be a close-range discovery.
  • the security protection algorithm identifier may be an encryption algorithm identifier, and the encryption algorithm identifier is used to identify an encryption algorithm for processing the short-range communication message.
  • the security protection algorithm identifier may be an encryption algorithm identifier and a second integrity protection algorithm identifier, where the second integrity protection algorithm identifier is used.
  • a second integrity protection algorithm that identifies a short-range communication message.
  • the security information may further carry the first integrity protection algorithm identifier, the second integrity protection algorithm, and the encryption algorithm identifier.
  • the first integrity protection algorithm identifier and the second integrity protection algorithm And the encryption algorithm identifier can also be negotiated by two mutually communicating terminals.
  • the terminal performs security protection processing on the short-distance message or performs security verification processing on the short-distance message according to the security protection key.
  • the terminal may send a short-range message and/or receive a short-range message. If the terminal sends a short-range message, the terminal performs security protection processing on a close distance according to the security protection key before sending. If the terminal receives a short-range message, after receiving the short-range message, the terminal performs security verification processing on the short-range message according to the security protection key to ensure that the close-range message is a security message.
  • security protection processing and the security verification processing will be described in detail in the following embodiments, and details are not described herein again.
  • the terminal is in the coverage of the operator network in steps 101 to 107.
  • the terminal may be under the coverage of the operator network in steps 101 to 105, and not in the operator network coverage in steps 106 and 107, so that the terminal can also be in the time when the terminal is not in the coverage of the operator network. Ensure the communication of the terminal is safe.
  • the security protection key may be at least one of a first integrity protection key, a second integrity protection key, and an encryption key.
  • the first integrity protection key is used to process the proximity discovery message
  • the second integrity protection key is used to process the proximity communication message
  • the encryption key is used to process the proximity communication message.
  • FIG. 2 is another signaling diagram of a communication security processing method according to another embodiment of the present invention.
  • a communication security processing method may include:
  • UE1 transmitting terminal
  • UE2 receiving terminal
  • the first authorization request is used by the UE1 to request security information from the ProSe Function A
  • the second authorization request is used by the UE2 to request security information from the ProSe Function B.
  • the first authorization request includes the identification information of the UE1
  • the second authorization request includes the identification information of the UE2.
  • the UE1 and the UE2 belong to the same group, and the security information of the UE1 and the UE2 are the same.
  • the group key refers to a key shared by the UEs in the same group, where the UE1 and the UE2 are referred to herein. Shared key.
  • the foregoing security information may further include at least one of a first integrity protection algorithm identifier, a second integrity protection algorithm identifier, and an encryption algorithm identifier;
  • the foregoing security information may further include at least one of an identity of the UE1 and an identity of the UE2.
  • ProSe Function A searches for security information according to the first authorization request
  • ProSe Function B searches for security information according to the second authorization request.
  • the ProSe Function A configures the correspondence between the identification information, the authorization information, and the security information of the UE1.
  • the ProSe Function A finds the authorization information of the UE1 through the UE1, and then finds the security information corresponding to each group identifier according to the group identifier in the authorization information of the UE1.
  • the authorization information of the UE2 is configured in the ProSe Function B, and then the security information corresponding to each group identifier is respectively found according to the group identifier of the authorization information of the UE2.
  • the UE1 and the UE2 are both ends of the communication.
  • the authorization information of the UE1 and the authorization information of the UE2 include at least one common group identifier, and then the public group is found according to the common group identifier.
  • the security information (the security information is the security information indicated in the embodiment of the present invention), and then the UE1 and the UE2 communicate in the same group based on the security information.
  • the ProSe Function A will also belong to other groups to which the UE1 belongs.
  • the security information is sent to the UE1, and the ProSe Function B also sends the security information of the other groups to which the UE2 belongs to the UE2.
  • the UE1 and the UE2 need to communicate, and both the UE1 and the UE2 have at least one common security information. Then, the communication is performed in a group. Therefore, in the embodiment of the present invention, only the security information common to the UE1 and the UE2 is taken as an example for description.
  • the ProSe Function A sends an authorization response to the UE1, where the authorization response includes the security information
  • the ProSe Function B sends an authorization response to the UE2, where the authorization response includes the security information.
  • UE1 receives an authorization response sent by ProSe Function A
  • UE2 receives an authorization response sent by ProSe Function B.
  • both UE1 and UE2 are under the coverage of the operator network, and complete the operation of requesting security information from the ProSe Function.
  • the UE1 under the coverage of the operator network, the UE1 requests the security information by sending a first authorization request to the ProSe Function A.
  • UE2 requests security information by sending a second authorization request to ProSe Function B.
  • FIG. 2b is another signaling diagram of a communication security processing method according to another embodiment of the present invention. As shown in FIG. 2b, a communication security processing method includes the following steps:
  • ProSe Function A finds security information
  • ProSe Function B finds security information
  • steps 203 to 204 are the same as steps 203 to 204, and are not described here.
  • the difference between the embodiment shown in FIG. 2b and the embodiment shown in FIG. 2a is that the UE1 and the UE2 are in the coverage of the carrier network, and the ProSe Function A actively sends the security information to the UE1, and the ProSe Function B actively sends the UE2 to the UE2.
  • the security information is sent, and then UE1 and UE2 respectively store the security information in the memory.
  • ProSe Function A and ProSe Function B may be the same ProSe Function, meaning that UE1 and UE2 are subordinate to the same ProSe Function, and obtain security information from the same ProSe Function.
  • UE1 and UE2 are subordinate to different ProSe Functions, and two ProSe Functions need to share the same security information.
  • FIG. 3a is another signaling diagram of a communication security processing method according to an embodiment of the present invention.
  • the UE1 and the UE2 perform the short-distance discovery process under the coverage of the operator network or not under the coverage of the operator network.
  • a communication security processing method may include:
  • UE1 generates a discovery secret according to a KDF algorithm, a group identifier and a group key in the security information. key;
  • FIG. 3b is a schematic diagram of generating a discovery key according to an embodiment of the present invention.
  • the key is the first security key in FIG. 1b
  • FIG. 3b is the actual application of generating the first security key on the left side of FIG. 1b.
  • at least one of a PGK ID, a Discovery key ID, a UE1ID, and a UE2ID may be selected as an input parameter of the KDF algorithm.
  • Discovery key KDF (Group ID, PGK, (PGK ID), (Discovery key ID), (UE1ID), (UE2ID)).
  • the Discovery key is used to indicate the discovery key
  • the Discovery key ID is used to indicate the discovery key identifier.
  • the PGK ID, the Discovery key ID, the UE1ID, and the UE2ID are optional generation parameters.
  • the Discovery key ID may be obtained by UE1 from ProSe Function A or by UE1. If the UE1 is generated, the UE1 needs to carry the Discovery key ID in the discovery message, so that the UE2 obtains the Discovery key ID from the discovery message, and is also used to tell the UE2 to generate a discovery key and also needs a Discovery key ID.
  • the UE1ID and/or the UE2ID are also used as the generation parameters of the Discovery key, it is also required to be carried in the discovery message to inform the UE2 that the UE1ID and the UE2ID need to be considered when generating the discovery key.
  • the UE1 generates a first integrity protection key according to the KDF algorithm, the first integrity protection algorithm identifier, and the foregoing discovery key.
  • FIG. 3c is a schematic diagram of generating a first integrity protection key according to some embodiments of the present invention.
  • the first integrity protection key in Figure 3c is the security protection key in Figure 1b
  • Figure 3c is the actual application of generating the security protection key on the right in Figure 1b.
  • the first integrity protection algorithm is identified as the security protection algorithm identifier in FIG. 1b, and the algorithm type indication may also be included in the embodiment of the present invention.
  • PIK1 KDF ⁇ Discovery key, algorithm identity1, (algorithm type distinguisher) ⁇ .
  • PIK1 represents a first integrity protection key
  • an algorithm identity1 represents a first integrity protection algorithm identifier
  • an algorithm type distinguisher is an algorithm type indication (also in the above An algorithm type distinguisher is added to the formula to indicate the type of algorithm used.
  • the UE1 performs integrity protection on the short-distance discovery message according to the first integrity protection key, and obtains a target close-distance discovery message.
  • the first integrity protection algorithm is further configured in the UE1.
  • FIG. 3d is a schematic diagram of processing of integrity protection according to an embodiment of the present invention
  • the first integrity protection algorithm is regarded as a function (or an algorithm processing module), which is near
  • the distance discovery message and the first integrity protection key are regarded as input parameters of the first integrity protection algorithm, and are processed by the first integrity protection algorithm to obtain a verification value, and the verification value is carried at the end of the close-range discovery message to obtain a target near Distance message.
  • the UE1 sends a target close proximity discovery message to the UE2.
  • the UE2 receives the target close-range discovery message.
  • the UE2 generates a discovery key according to the security information by using the configured KDF algorithm.
  • the KDF algorithm is also built in UE2, and the first integrity protection algorithm is configured.
  • the security information in the UE2 further includes a first integrity protection algorithm identifier. It may further include an identity (ID) of UE1 and/or an identity (ID) of UE2.
  • the foregoing security information further includes a discovery key identifier. The discovery key is generated according to the generation method shown in FIG. 3b, and details are not described herein again.
  • the UE2 generates a first integrity protection key according to the KDF algorithm, according to the first integrity protection algorithm identifier, and the foregoing discovery key.
  • the UE1 performs integrity protection processing on the short-range message according to the first integrity protection key to obtain a target close-range message.
  • the UE 2 performs security verification processing on the target close-range message according to the first integrity protection key.
  • the UE2 determines, according to the first integrity protection key, that the target close-distance discovery message is a security message, and processes the target close-range discovery message.
  • UE2 generates a verification value according to the first integrity protection algorithm, the first integrity protection key, and the proximity discovery message.
  • the target close-range discovery message includes a verification value and a close-range discovery message (the proximity discovery message here is also a close-range discovery message in UE1), and similarly, the UE2 detects the close-range in the message according to the target close-range discovery.
  • the message, and the first integrity protection key generated by the receiving terminal generate a verification value. Compare the two verification values, If the two verification values are the same, it indicates that the verification is passed, and the UE2 can confirm that the target close-range discovery message is a security message, thereby establishing communication with the UE1. If the verification values are not the same, the verification does not pass.
  • FIG. 4 is another signaling diagram of a communication security processing method according to an embodiment of the present invention. As shown in FIG. 4, a communication security processing method may include:
  • Steps 401-402 are the same as steps 301-302 above, and are not described here.
  • the UE1 generates a first security parameter, and carries the first security parameter in a short-range discovery message.
  • UE1 can generate the first parameter by means of random generation.
  • Steps 404-409 are the same as steps 301-308 above, and are not described here.
  • the UE2 obtains the first security parameter from the target close-range discovery message.
  • the UE2 generates a second security parameter.
  • UE2 can generate the second parameter by means of random generation.
  • the UE2 sends the second security parameter to the UE1.
  • the UE1 sends the first security parameter to the UE2 in the short-range discovery message, and then the UE2 can send the second security parameter to the UE1 by responding to the short-distance discovery message.
  • the UE2 saves the first security parameter and the second security parameter.
  • the UE1 receives the second security parameter and saves it together with the first security parameter.
  • the UE1 carries the first security parameter in the short-distance discovery message, and then the UE2 generates the second security parameter according to the first security parameter, and sends the second security parameter to the UE1.
  • UE1 and UE2 simultaneously save the first security parameter and the second security parameter, and generate the generated parameter as protection parameter according to the first security parameter, the second security parameter, and the group key in the security information during the D2D communication process.
  • the security key of the short-range communication message and/or the second integrity protection key thereby performing security protection processing on the short-range communication message.
  • FIG. 5a is another signaling diagram of a communication security processing method according to an embodiment of the present invention. As shown in FIG. 5a, a communication security processing method may include:
  • the UE1 generates a communication key according to the KDF algorithm and the group identifier and the group key in the security information.
  • FIG. 5b is a schematic diagram of generating a communication key according to an embodiment of the present invention.
  • the communication key is the first security key in FIG. 1b
  • FIG. 3b is the actual application of generating the first security key on the left side of FIG. 1b.
  • PGK At least one of ID, Communication key ID, UE1ID, and UE2ID is an input parameter of the KDF algorithm.
  • the communication key is generated as follows:
  • KDF Group ID, PGK, (PGK ID), (Communication key ID), (UE1ID), (UE2ID)).
  • the Communication key is used to indicate a communication key, and the Communication key ID is used to indicate the above communication key identifier.
  • the PGK ID, Communication Key ID, UE1ID, and UE2ID are optional input parameters.
  • the Communication key ID may be obtained by the UE1 from the ProSe Function A or by the UE1. If it is generated by the UE1, the UE1 is required to carry the Communication key ID in the communication message, so that the UE2 needs the Communication key ID as an input parameter when acquiring the Communication key ID and the notification to generate the communication key through the communication message.
  • the UE1ID and the UE2ID are used as the generation parameters of the Communication key, they are also required to be carried in the communication message to notify the UE2 that when the communication key is generated, the UE1ID and the UE2ID are required as input parameters.
  • the UE1 generates an encryption key according to the KDF algorithm, the encryption algorithm identifier, and the communication key.
  • FIG. 5c is a schematic diagram of generating an encryption key according to some embodiments of the present invention.
  • the first integrity protection key in Figure 5c is the security protection key in Figure 1b
  • Figure 3c is the actual application of generating the security protection key on the right side of Figure 1b.
  • the encryption algorithm is identified as the security protection algorithm identifier in FIG. 1b, and the algorithm type indication may also be included in the embodiment of the present invention.
  • PEK KDF (Communication key, algorithm identity 2, (algorithm type distinguisher) ⁇ .
  • the PEK indicates an encryption key
  • the algorithm identity 2 indicates an encryption algorithm identifier
  • the algorithm type distinguisher er indicates an algorithm type (an algorithm type distinguisher may also be added to the above formula to indicate the type of the algorithm to be used).
  • the UE1 performs encryption processing on the short-range communication message according to the encryption key to obtain a target short-range communication message.
  • FIG. 5d is a schematic diagram of an integrity protection process according to an embodiment of the present invention
  • a string of key streams is generated according to an encryption algorithm and an encryption key, and then the key stream and the key stream are The distance communication message is XORed to obtain a target short-range communication message.
  • the encryption algorithm can be regarded as a function (or an operation processing module), an encryption algorithm and an encryption key as input parameters of the function.
  • the UE1 sends a target short-range communication message to the UE2.
  • the UE2 receives the target short-range communication message.
  • the UE2 generates a communication key according to the KDF algorithm, the group identifier, and the group key.
  • the KDF algorithm is also built in UE2, and the encryption algorithm is configured.
  • the UE2 security information further includes an encryption algorithm identifier, and further includes an identity (ID) of the UE1 and/or an identity (ID) of the UE2.
  • the foregoing security information further includes a communication key identifier. The communication key is generated according to FIG. 5b, and details are not described herein again.
  • the UE2 generates an encryption key according to the KDF algorithm, the communication key, and the encryption algorithm identifier.
  • the UE1 performs encryption protection processing on the close-range message according to the encryption key to obtain a target close-range message.
  • the target proximity message is decrypted in accordance with the encryption key in UE2.
  • the UE2 decrypts the target short-range communication message according to the encryption key, and processes the target short-range communication message if the target short-range communication message is a security message.
  • UE2 In conjunction with UE2 in Figure 5d, UE2 generates a keystream based on the encryption algorithm and the encrypted password. Then, the key stream is XORed with the received target short-range communication message, and the short-distance communication message is decrypted, and the verification is passed.
  • the UE1 and the UE2 are in the security protection process and the security verification process of the short-range communication message, where the discovery key is the first security key provided by the embodiment of the present invention, and the encryption key is encrypted.
  • the key is the security protection key provided by the embodiment of the present invention.
  • the UE1 performs security protection processing on the short-range communication message according to the encryption key and the encryption algorithm to obtain the target short-range communication message.
  • UE2 performs a security verification process of decrypting the target short-range communication message according to the encryption key and the encryption algorithm, thereby obtaining a short-range communication message.
  • FIG. 6a is another signaling diagram of a communication security processing method according to an embodiment of the present invention. As shown in FIG. 6a, a communication security processing method may include:
  • the UE1 generates a communication key according to the KDF algorithm, the group identifier, and the group key.
  • a communication key is generated according to the communication key generation method shown in FIG. 5b.
  • the UE1 generates an encryption key according to the KDF algorithm, the encryption algorithm identifier, and the communication key, and generates a second integrity protection key according to the second integrity protection algorithm identifier and the communication key.
  • an encryption key is generated according to the encryption key generation method shown in FIG. 5c, and details are not described herein again.
  • the formula for the second integrity protection key is as follows:
  • PIK2 KDF ⁇ Communication key, algorithm identity3, algorithm type distinguisher ⁇ .
  • the PIK2 is used to indicate the second integrity protection key
  • the algorithm identity3 is used to indicate the second integrity protection algorithm identifier
  • the algorithm type distinguisher is the algorithm type indication (you can also add an algorithm type distinguisher in the above formula to indicate the location The type of algorithm used).
  • the second integrity protection key may be generated by using the generation method shown in FIG. 3c.
  • the second integrity protection key is generated by using the generation method shown in 3c, Replace the identity identity1 in Figure 3c with the algorithm identity3, replace the Discovery key with the Communication key, and replace the algorithm type distinguisher in Figure 3c with the algorithm type distinctioner.
  • the UE1 performs encryption processing on the short-range communication message that needs to be sent by using the encryption key, and performs integrity protection on the encrypted short-range communication message by using the second integrity protection key to obtain a target short-range communication message.
  • the UE1 performs the encryption processing on the short-range communication message, and the process shown in the above-mentioned UE1 is shown in FIG. 5d, and details are not described herein again.
  • the short-distance communication message is encrypted according to the encryption key to obtain a first short-range communication message.
  • the second integrity protection key and the first short-range communication message are processed by using the configured second integrity protection algorithm to obtain a target short-range communication message.
  • the process is the UE1 shown in FIG. 3d.
  • the processing flow is the same, except that in this embodiment, a second integrity protection algorithm is employed, the parameters being the second integrity protection key and the initial near field communication message.
  • the target near-field communication message includes a verification value and a first-time short-range communication message.
  • the UE1 sends a target short-range communication message to the UE2.
  • the UE2 receives the target short-range communication message.
  • the UE2 generates a communication key according to the KDF algorithm, the group identifier, and the group key.
  • the generation of the communication key is the same as the above step 601, and details are not described herein again.
  • the UE2 generates a second integrity guarantee according to the communication key and the second integrity protection algorithm identifier. Protecting the key and generating an encryption key according to the communication key and the encryption algorithm identifier;
  • the generation of the encryption key is the same as the above step 602, and details are not described herein again.
  • the UE2 verifies, according to the second integrity protection key, whether the target short-range communication message is a security message, and if yes, decrypts the target short-range communication message.
  • the UE2 obtains a verification value according to the second integrity protection algorithm, the second integrity protection key, and the target close distance message, and the verification value is carried in the target close distance message.
  • the verification passes.
  • a string of key streams is generated according to the encryption algorithm and the encryption key, and the first short-range communication message and the key stream are XORed to complete the decryption.
  • the target short-range communication message has both integrity protection and encryption protection
  • the target proximity communication message is first verified for integrity, and if the verification is passed, the decryption process is performed; if the target near communication distance message is only integrity protected, then Perform integrity verification on the target short-range communication message; if the target near-communication distance message is only encrypted, the target close-range message is decrypted.
  • FIG. 7 is another signaling diagram of a communication security processing method according to an embodiment of the present invention. As shown in FIG. 7, a communication security processing method may include:
  • the UE1 reads the first security parameter, the second security parameter, and the group key of the security information, and generates a security protection key according to the first security parameter, the second security parameter, and the group key.
  • the security protection key may include an encryption key and/or an integrity protection key. It should be noted that the encryption key herein is different from the encryption key provided in the embodiments of FIGS. 5 and 6, and the integrity protection key is different from the second integrity protection key provided in FIGS. 5 and 6.
  • the UE1 performs security protection processing on the short-range communication message according to the security protection key, to obtain a target short-range communication message.
  • the UE1 sends a target short-range communication message to the UE2.
  • the UE2 receives the target short-range communication message, and reads the first security parameter, the second security parameter, and the group key of the security information to generate a security verification key.
  • the security verification key here is the same as the security protection key in step 701 above, and is only used to verify whether the target short-range communication message is secure.
  • the UE2 performs security verification on the target short-range communication message according to the security verification key, and processes the target short-range communication message when the target short-range communication message is a security message.
  • the UE1 and the UE2 obtain the first security parameter and the second security parameter on the basis of the embodiment shown in FIG. 4, and then implement the close proximity according to the first security parameter and the second security parameter. Security protection of communication messages.
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • a terminal 800 may include at least one processor 810 (for example, a CPU, Central Processing Unit) and at least one transmitter 820.
  • the processor 810 is configured to execute executable modules, such as computer programs, stored in the memory 840.
  • the above memory 840 may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory.
  • the communication connection between the system gateway and at least one other network element is implemented by at least one network interface (which may be wired or wireless), and an Internet, a wide area network, a local network, a metropolitan area network, etc. may be used.
  • the transmitter 820 is configured to send an authorization request to the network side short-range communication function entity, where the authorization request includes identifier information of the terminal, where the authorization request is used to request the network side short-range communication function entity
  • the security information of the terminal where the security information includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate a group to which the terminal belongs, and the group key identifier is used to indicate Group key
  • the receiver 830 is configured to receive an authorization response sent by the network side short-range communication function entity, where the authorization response includes security information of the terminal;
  • the processor 810 is configured to generate a security protection key for processing the short-range message according to the security information of the terminal.
  • the processor 810 is specifically configured to: generate a first security key according to a key generation function KDF algorithm, the group identifier, and the group key; according to a security protection algorithm
  • the security protection key is generated by the identifier, the KDF algorithm, and the first security key.
  • the short-range message is a short-range discovery message
  • the security protection algorithm identifier is a first integrity protection algorithm identifier
  • the first integrity protection algorithm identifier is used to identify a short-distance discovery process.
  • a first integrity protection algorithm of the message; the processor 810 is further configured to: according to the first integrity protection algorithm identifier, the KDF algorithm, and the first security key, A first integrity protection key is generated, and the first integrity protection key is the security protection key.
  • the short-range message is a short-range communication message
  • the security protection algorithm is identified as an encryption key identifier
  • the encryption key identifier is used to identify an encryption algorithm for processing a short-range communication message
  • the processor 810 is further configured to generate an encryption key according to the encryption algorithm identifier, the KDF algorithm, and the first security key, where the encryption key is the security protection key.
  • the short-range message is a short-range communication message
  • the security protection algorithm identifier is a second integrity protection algorithm identifier
  • the second integrity protection algorithm identifier is used to identify and process short-range communication.
  • a second integrity protection algorithm of the message; the processor 810 is further configured to generate a second integrity protection secret according to the second integrity protection algorithm identifier, the KDF algorithm, and the first security key
  • the second integrity protection key is the security protection key.
  • the processor 810 is further configured to: after generating a security protection key for processing a short-range message according to the security information, according to the security protection key, the close-range The message is subjected to security protection processing; or, according to the security protection key, the proximity message is subjected to security verification processing.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • FIG. 9 is a schematic structural diagram of a network side short-range communication function entity according to an embodiment of the present invention
  • a network-side short-range communication function entity 900 may include at least one processor 910 (for example, A CPU (Central Processing Unit), a memory 920 and at least one network interface or other communication interface 930, and at least one communication bus for implementing connection communication between the processor 910, the communication interface 930, and the memory 920.
  • the processor 910 is configured to execute executable modules, such as computer programs, stored in the memory 920.
  • the above memory 910 may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory.
  • the communication connection between the system gateway and at least one other network element is implemented by at least one network interface (which may be wired or wireless), and an Internet, a wide area network, a local network, a metropolitan area network, etc. may be used.
  • the communication interface 930 is configured to receive an authorization request sent by the terminal, where the authorization request includes identifier information of the terminal.
  • the processor 910 is configured to search for security information of the terminal according to the identifier information of the terminal, where the security information of the terminal includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate The group key identifier is used to indicate the group key, and the security information of the terminal is used to generate a security protection key for processing a short-range message;
  • the communication interface is further configured to send an authorization response to the terminal, where the authorization response includes security information of the terminal.
  • the processor 910 is specifically configured to: according to the identifier information of the terminal, search for authorization information of a group to which the terminal belongs, where the authorization information includes a group of the group to which the terminal belongs. And determining, according to the identifier information of the terminal and the group identifier, security information of the group indicated by the group identifier.
  • the security information further includes at least one of a first integrity protection algorithm identifier, a second integrity protection algorithm identifier, and an encryption algorithm identifier.
  • the identification information of the terminal includes at least one of an International Mobile Subscriber Identity (IMSI) and a Mobile Subscriber Number (IMSISDN).
  • IMSI International Mobile Subscriber Identity
  • IMSISDN Mobile Subscriber Number
  • FIG. 10 is a schematic structural diagram of a communication security processing system according to an embodiment of the present invention.
  • a communication security processing system may include: the terminal shown in FIG. 8 and the terminal shown in FIG. Network side close-range functional entity.
  • the embodiment of the present invention further provides a schematic structural diagram of another terminal. As shown in FIG. 11 , for the convenience of description, only parts related to the embodiment of the present invention are shown. If the specific technical details are not disclosed, refer to the implementation of the present invention.
  • FIG. 11 is a block diagram showing a partial structure of a mobile phone related to a terminal provided by an embodiment of the present invention.
  • the mobile phone includes: a radio frequency (RF) circuit 1110 , a memory 1120 , an input unit 1130 , a display unit 1140 , a sensor 1150 , an audio circuit 1160 , a wireless fidelity (WiFi) module 1170 , and a processor 1180 .
  • RF radio frequency
  • the RF circuit 1110 can be used for receiving and transmitting signals during and after receiving or transmitting information, in particular, after receiving the downlink information of the base station, and processing it to the processor 1180; in addition, transmitting the designed uplink data to the base station.
  • RF circuit 1110 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like.
  • LNA Low Noise Amplifier
  • RF circuitry 1110 can also communicate with the network and other devices via wireless communication.
  • the above wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code Division). Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), E-mail, Short Messaging Service (SMS), and the like.
  • GSM Global System of Mobile communication
  • GPRS General Packe
  • the memory 1120 can be used to store software programs and modules, and the processor 1180 executes various functional applications and data processing of the mobile phone by running software programs and modules stored in the memory 1120.
  • the memory 1120 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a D2D communication function), and the like; the storage data area may be stored according to the use of the mobile phone. Data (such as configured KDF algorithm, first integrity protection algorithm, second integrity protection algorithm, encryption algorithm and D2D communication data, etc.).
  • memory 1120 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 1130 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function controls of the handset.
  • the input unit 1130 may include a touch panel 1131 and other input devices 1132.
  • the touch panel 1131 also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 1131 or near the touch panel 1131. Operation), and drive the corresponding connecting device according to a preset program.
  • the touch panel 1131 may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 1180 is provided and can receive commands from the processor 1180 and execute them. In addition, resistive, capacitive, infrared, and surface acoustics can be used.
  • the touch panel 1131 is implemented in various types such as waves.
  • the input unit 1130 may also include other input devices 1132. Specifically, other input devices 1132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 1140 can be used to display information input by the user or information provided to the user as well as various menus of the mobile phone.
  • the display unit 1140 may include a display panel 1141.
  • the display panel 1141 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • the touch panel 1131 can cover the display panel 1141. After the touch panel 1131 detects a touch operation thereon or nearby, the touch panel 1131 transmits to the processor 1180 to determine the type of the touch event, and then the processor 1180 according to the touch event. The type provides a corresponding visual output on the display panel 1141.
  • the touch panel 1131 and the display panel 1141 are used as two independent components to implement the input and input functions of the mobile phone, in some embodiments, the touch panel 1131 and the display panel 1141 may be integrated. Realize the input and output functions of the phone.
  • the handset may also include at least one type of sensor 1150, such as a light sensor, motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1141 according to the brightness of the ambient light, and the proximity sensor may close the display panel 1141 and/or when the mobile phone moves to the ear. Or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in all directions (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity.
  • the mobile phone can be used to identify the gesture of the mobile phone (such as horizontal and vertical screen switching, related Game, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for the mobile phone can also be configured with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors, no longer Narration.
  • the gesture of the mobile phone such as horizontal and vertical screen switching, related Game, magnetometer attitude calibration
  • vibration recognition related functions such as pedometer, tapping
  • the mobile phone can also be configured with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors, no longer Narration.
  • An audio circuit 1160, a speaker 1161, and a microphone 1162 can provide an audio interface between the user and the handset.
  • the audio circuit 1160 can transmit the converted electrical data of the received audio data to the speaker 1161, and convert it into a sound signal output by the speaker 1161; on the other hand, the microphone 1162 converts the collected sound signal into an electrical signal, and the audio circuit 1160 After receiving, it is converted into audio data, and then processed by the audio data output processor 1180, transmitted to the other mobile phone via the RF circuit 1110, or outputted to the memory 1120 for further processing.
  • WiFi is a short-range wireless transmission technology.
  • the mobile phone can help users to perform D2D discovery, D2D communication, send and receive emails, browse web pages and access streaming media through the WiFi module 1170, which provides users with wireless broadband Internet access.
  • FIG. 11 shows the WiFi module 1170, it can be understood that it does not belong to the essential configuration of the mobile phone, and may be omitted as needed within the scope of not changing the essence of the invention.
  • the processor 1180 is a control center for the handset, which connects various portions of the entire handset using various interfaces and lines, by executing or executing software programs and/or modules stored in the memory 1120, and invoking data stored in the memory 1120, The phone's various functions and processing data, so that the overall monitoring of the phone.
  • the processor 1180 may include one or more processing units; preferably, the processor 1180 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 1180.
  • the handset also includes a power source 1190 (such as a battery) that powers the various components.
  • a power source can be logically coupled to the processor 1180 via a power management system to manage functions such as charging, discharging, and power management through the power management system.
  • the mobile phone may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the processor 1180 included in the terminal further has a function of: sending an authorization request to the network side short-range communication function entity, where the authorization request includes identification information of the terminal, and the authorization request is used for And requesting, by the network side short-range communication function entity, security information of the terminal, where the security information includes a group identifier, a group key, and a group key identifier, where the group identifier is used to indicate the group to which the terminal belongs The group key identifier is used to indicate the group key; receiving an authorization response sent by the network side short-range communication function entity, the authorization response including security information of the terminal; Information, generating a security key for handling close-range messages.
  • the processor 1180 included in the terminal further has the following functions: generating a first security key according to the key generation function KDF algorithm, the group identifier, and the group key; The algorithm identifier, the KDF algorithm, and the first security key generate the security protection key.
  • the processor 1180 included in the terminal further has the following function: when the short-range message is a close-range discovery message, the security protection algorithm is identified as the first integrity protection.
  • An algorithm identifier, the first integrity protection algorithm identifier identifying a first integrity protection algorithm for processing a proximity discovery message, the first integrity protection algorithm identifier, the KDF algorithm, and the first security secret The key generates a first integrity protection key, and the first integrity protection key is the security protection key.
  • the processor 1180 included in the terminal further has the following functions: the short-range communication message is a short-range communication message, the security protection algorithm identifier is an encryption key identifier, and the encryption key identifier is And an encryption algorithm for identifying a short-range communication message; generating an encryption key according to the encryption algorithm identifier, the KDF algorithm, and the first security key, where the encryption key is the security protection key.
  • the processor 1180 included in the terminal further has the following functions: the short-range message is a short-range communication message, the security protection algorithm identifier is a second integrity protection algorithm identifier, and the second An integrity protection algorithm identifies a second integrity protection algorithm for identifying a short-range communication message; generating a second integrity based on the second integrity protection algorithm identifier, the KDF algorithm, and the first security key A protection key, the second integrity protection key being the security protection key.
  • the processor 1180 included in the terminal further has a function of: after generating a security protection key for processing a short-range message according to the security information, according to the security protection key, The short-range message is subjected to security protection processing; or the terminal performs security verification processing on the short-range message according to the security protection key.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling or communication connection may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé et un système de gestion de la sécurité de communications, et un dispositif associé. L'invention vise à améliorer la sécurité de communications et, en particulier, la sécurité de communications dans un mode de fonctionnement en émetteur récepteur. Certains modes de réalisation du procédé selon la présente invention peuvent comprendre les étapes suivantes : le terminal envoie une demande d'autorisation à une entité de fonction de communication de proximité sur le côté réseau, la demande d'autorisation contenant des informations d'identification relatives au terminal, la demande d'autorisation étant utilisée pour demander des informations de sécurité relatives au terminal, à l'entité de fonction de communication de proximité sur le côté réseau, les informations de sécurité comprenant un identifiant de groupe, une clé de groupe et un identifiant de clé de groupe, l'identifiant de groupe étant utilisé pour indiquer un groupe auquel appartient le terminal, et l'identifiant de clé de groupe étant utilisé pour indiquer la clé de groupe ; le terminal reçoit une réponse d'autorisation envoyée par l'entité de fonction de communication de proximité sur le côté réseau, la réponse d'autorisation contenant des informations de sécurité relatives au terminal ; et, d'après les informations de sécurité relatives au terminal, le terminal génère une clé de protection de sécurité pour traiter un message de proximité.
PCT/CN2016/070379 2016-01-07 2016-01-07 Procédé et système de gestion de la sécurité de communications, et dispositif associé WO2017117775A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/070379 WO2017117775A1 (fr) 2016-01-07 2016-01-07 Procédé et système de gestion de la sécurité de communications, et dispositif associé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/070379 WO2017117775A1 (fr) 2016-01-07 2016-01-07 Procédé et système de gestion de la sécurité de communications, et dispositif associé

Publications (1)

Publication Number Publication Date
WO2017117775A1 true WO2017117775A1 (fr) 2017-07-13

Family

ID=59273338

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/070379 WO2017117775A1 (fr) 2016-01-07 2016-01-07 Procédé et système de gestion de la sécurité de communications, et dispositif associé

Country Status (1)

Country Link
WO (1) WO2017117775A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114697945A (zh) * 2022-04-02 2022-07-01 中国电信股份有限公司 发现响应消息的生成方法及装置、发现消息的处理方法
CN115250450A (zh) * 2021-04-28 2022-10-28 大唐移动通信设备有限公司 一种获取组通信密钥的方法及设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015105402A1 (fr) * 2014-01-13 2015-07-16 삼성전자 주식회사 Procédé et système de prise en charge de sécurité pour découverte de service et communication de groupe dans un système de communication mobile
CN104935426A (zh) * 2014-03-21 2015-09-23 华为技术有限公司 密钥协商方法、用户设备和近距离通信控制网元
CN105025478A (zh) * 2014-04-30 2015-11-04 中兴通讯股份有限公司 D2D通信安全配置方法、ProSe密钥管理功能实体、终端及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015105402A1 (fr) * 2014-01-13 2015-07-16 삼성전자 주식회사 Procédé et système de prise en charge de sécurité pour découverte de service et communication de groupe dans un système de communication mobile
CN104935426A (zh) * 2014-03-21 2015-09-23 华为技术有限公司 密钥协商方法、用户设备和近距离通信控制网元
CN105025478A (zh) * 2014-04-30 2015-11-04 中兴通讯股份有限公司 D2D通信安全配置方法、ProSe密钥管理功能实体、终端及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SAMSUNG: "Solution for key establishment between the Remote UE and UE-to-Network Relay", 3GPP TSG SA WG3 (SECURITY) MEETING #79 S3-151398, 24 April 2015 (2015-04-24), XP050943600 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115250450A (zh) * 2021-04-28 2022-10-28 大唐移动通信设备有限公司 一种获取组通信密钥的方法及设备
CN114697945A (zh) * 2022-04-02 2022-07-01 中国电信股份有限公司 发现响应消息的生成方法及装置、发现消息的处理方法
CN114697945B (zh) * 2022-04-02 2023-10-24 中国电信股份有限公司 发现响应消息的生成方法及装置、发现消息的处理方法

Similar Documents

Publication Publication Date Title
EP4007321B1 (fr) Procédé de partage d'informations, appareil terminal, support d'informations et produit-programme d'ordinateur
CN109257740B (zh) Profile下载方法、移动终端及可读存储介质
Barua et al. Security and privacy threats for bluetooth low energy in iot and wearable devices: A comprehensive survey
WO2017024579A1 (fr) Procédé, dispositif et système correspondants de protection de message
US8467770B1 (en) System for securing a mobile terminal
WO2020164526A1 (fr) Procédé de commande pour nœuds dans un système distribué et dispositif associé
EP3499936B1 (fr) Procédé d'établissement d'une association dans un réseau local sans fil, terminal et point d'accès
CN110677851B (zh) 一种终端网络接入方法及网络接入设备的接入方法
CN108616878B (zh) 一种加密解密方法、设备和计算机存储介质
CN111355707B (zh) 一种数据处理方法及相关设备
US10454905B2 (en) Method and apparatus for encrypting and decrypting picture, and device
CN107317680B (zh) 安全账号的标记方法、系统及计算机可读存储介质
CN106657165B (zh) 一种网络攻击的防御方法、服务器及终端
CN106550361B (zh) 一种数据传输方法，设备及计算机可读存储介质
CN108763876B (zh) 一种资源版权校验方法、装置以及设备
CN108601062B (zh) WiFi连接共享方法、终端及计算机存储介质
US10673611B2 (en) Data transmission method, device, and system
CN108012270B (zh) 一种信息处理的方法、设备和计算机可读存储介质
CN116325664A (zh) 一种智能设备配网的方法和装置
WO2017117775A1 (fr) Procédé et système de gestion de la sécurité de communications, et dispositif associé
CN107835167A (zh) 一种数据保护的方法、终端及计算机可读存储介质
WO2018040805A1 (fr) Procédé d'établissement d'une association dans un réseau local sans fil, terminal et point d'accès
CN107925565B (zh) 算法更新方法、待更新设备及服务器
CN115379425A (zh) 蓝牙攻击检测方法、装置、存储介质及移动终端
WO2018049882A1 (fr) Procédé et dispositif de migration de données

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16882920

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16882920

Country of ref document: EP

Kind code of ref document: A1