WO2019051776A1 - Procédé et dispositif de transmission de clé - Google Patents

Procédé et dispositif de transmission de clé Download PDF

Info

Publication number
WO2019051776A1
WO2019051776A1 PCT/CN2017/101890 CN2017101890W WO2019051776A1 WO 2019051776 A1 WO2019051776 A1 WO 2019051776A1 CN 2017101890 W CN2017101890 W CN 2017101890W WO 2019051776 A1 WO2019051776 A1 WO 2019051776A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
information
remote terminal
relay terminal
discovery
Prior art date
Application number
PCT/CN2017/101890
Other languages
English (en)
Chinese (zh)
Inventor
衣强
何岳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201780082724.7A priority Critical patent/CN110192381B/zh
Priority to PCT/CN2017/101890 priority patent/WO2019051776A1/fr
Publication of WO2019051776A1 publication Critical patent/WO2019051776A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a key transmission method and device.
  • the mobile phone and the wearable device each perform network communication.
  • We want wearables to connect to the network via a mobile phone which saves the power of the wearable device and increases the transmission efficiency of the wearable device.
  • the remote terminal Before the remote terminal connects to the network through the relay terminal, the remote terminal needs to discover the relay terminal and establish a trust relationship with the relay terminal to obtain the authorization, and can find the relay when approaching the relay terminal again. terminal.
  • the authorized remote terminal discovers that the discovery process of the relay terminal is specifically: the relay terminal sends the encrypted broadcast message, and after receiving the broadcast message sent by the relay terminal, the remote terminal needs to discover the key (or The content of the broadcast message can be decrypted by calling the decryption key to discover the relay terminal.
  • the discovery key for the remote terminal can be obtained from the network device.
  • the remote terminal cannot directly connect to the network device, and thus cannot obtain the discovery key for discovering the designated relay terminal from the network device.
  • the embodiment of the present application provides a method for transmitting a key and a device, in a process of establishing a trust relationship between a remote terminal and a relay terminal, the network device sends a discovery key to the remote terminal, and implements a designated relay to be used for discovery.
  • the discovery key of the terminal is securely sent to the legal remote terminal, and the discovery of the relay terminal by the remote terminal is further completed.
  • an embodiment of the present invention provides a method for transmitting a key, where the method is used for a network device to which a relay terminal belongs, and the method includes:
  • the network device obtains a discovery key, and the discovery key is used by the remote terminal to discover the relay terminal;
  • the network device acquires the first key and the universal boot architecture push information GPI, or the network device obtains the authentication vector AV;
  • the network device generates a third key according to the first key or the second key in the AV, and encrypts the first information by using the third key, where the first information includes the discovery key;
  • the network device sends the encrypted first information and the GPI to the remote terminal through the relay terminal, or the network device sends the encrypted first information, the RAND information in the AV, and the AUTN information to the remote terminal through the relay terminal; GPI, or in the AV
  • the RAND information and the AUTN information are used by the remote terminal to generate a symmetric key of the third key, and the first key information is decrypted by using the symmetric key of the third key to obtain the discovery key.
  • the remote terminal In the process of establishing a trusted connection between the remote terminal and the relay terminal, the remote terminal is terminated by the network device in the embodiment of the present invention.
  • the terminal accesses the network through the relay terminal for authentication, encrypts the generated discovery key, and sends the encrypted discovery key to the legal remote terminal for subsequent discovery by the remote terminal to the relay terminal.
  • the method further includes:
  • the network device generates a fourth key according to the first key or the second key in the AV, and performs at least integrity protection on the first information by using the fourth key to generate MAC information.
  • the network device sends the encrypted first information and the GPI to the remote terminal through the relay terminal, or the network device sends the encrypted first information, the RAND information and the AUTN information in the AV to the remote terminal through the relay terminal, and further includes:
  • the network device sends the MAC information to the remote terminal through the relay terminal; the RAND information and the AUTN information in the GPI, or the AV, are also used by the remote terminal to generate a symmetric key of the fourth key, and the symmetric key of the fourth key is used according to
  • the MAC information verifies the integrity of the information containing at least the first information.
  • the security of the information including the discovery key is improved by the remote terminal to discover the key, or at least to discover the integrity protection of the key.
  • the network device generates the third according to the first key or the second key in the AV The key, and the network device generates the fourth key according to the first key or the second key in the AV, and the generating the third key or the fourth key further includes:
  • At least one of the identification information of the relay terminal, the identification information of the remote terminal, and the identification information of the network device is used as an input parameter for generating the third key or the fourth key.
  • the first key is a key generated according to a universal booting architecture GBA push mode.
  • the first information further includes: identifier information of the network device, and identifier of the relay terminal At least one of information, a codeword of the broadcast, a remote terminal, and a communication root key for communication by the relay terminal.
  • an embodiment of the present invention provides a method for transmitting a key, where the method includes:
  • the remote terminal receives the first message sent by the relay terminal, where the first message includes the encrypted first information and the universal bootstrapping information GPI, or the first message includes the encrypted first information and the RAND information and the AUTN information in the authentication vector AV. , wherein the first information includes a discovery key;
  • the remote terminal generates a first key based on the GPI, or the RAND information and the AUTN information, and generates a second key based on the first key, and decrypts the encrypted first information using the second key.
  • the remote terminal receives the securely transmitted discovery key in the process of establishing a trusted connection relationship between the remote terminal and the relay terminal, and is used by the subsequent remote terminal to discover the relay terminal.
  • the first message further includes MAC information; the method further includes:
  • the remote terminal generates a third key based on the first key and verifies the MAC information using the third key, thereby verifying the integrity of the information including at least the first information.
  • the generating the second key based on the first key, and generating the third key based on the first key includes:
  • At least one of the identification information of the relay terminal, the identification information of the remote terminal, and the identification information of the network device is used as an input parameter for generating the second key or the third key.
  • an embodiment of the present invention provides a method for transmitting a key, where the method includes:
  • the first device receives the first message sent by the relay terminal, where the first message includes the identifier information of the remote terminal;
  • the first device authenticates the remote terminal by establishing a communication connection through the relay terminal according to the first message
  • the first device acquires a root key of the remote terminal
  • the first device generates a first key according to the root key, and encrypts the first information by using the first key, where the first information includes a discovery key;
  • the first device sends the encrypted first information to the remote terminal through the relay terminal, so that the remote terminal generates a symmetric key of the first key according to the communication root key of the remote terminal, and decrypts using the symmetric key of the first key.
  • the encrypted first information acquires the discovery key.
  • the first device authenticates the remote terminal by establishing a communication connection through the relay terminal, encrypts the obtained discovery key, and sends it to the legally securely.
  • Remote terminal to facilitate subsequent remote terminal discovery of the relay terminal.
  • the method further includes:
  • the first device generates a second key according to the root key, and performs integrity protection on the at least first information by using the second key to generate the MAC information.
  • the method further includes:
  • the first device sends the MAC information to the remote terminal through the relay terminal, and the MAC information is used by the remote terminal to verify the integrity of the at least first information.
  • the first device In conjunction with the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the first device generates the first key according to the root key, and the first device generates the first Two keys, including:
  • the first device generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the first device generates a first key and a second key according to the communication root key.
  • the first device In conjunction with the first possible implementation manner of the third aspect, in a third possible implementation manner of the third aspect, the first device generates the first key according to the root key, and the first device generates the first Two keys, including:
  • the first device generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the first device generates a session key for communication between the remote terminal and the relay terminal according to the communication root key
  • the first device generates the first key and the second key according to the session key.
  • the first device is a network device, before the first device acquires the root key of the remote terminal
  • the method also includes:
  • the first device receives the establishment trust connection request message sent by the relay terminal, and the establishment of the trust connection request message includes the identification information of the relay terminal and the identification information of the remote terminal;
  • the first device authenticates the remote terminal accessing the network through the relay terminal according to the establishment trust connection request message
  • the first device If the authentication passes, the first device generates a discovery key.
  • the first device is a mobility management entity MME; the first device uses the first key Before the first information is used, and the first device uses the second key to perform integrity protection on the first information, the method further includes:
  • the first device acquires a discovery key.
  • the acquiring, by the first device, the discovery key includes:
  • the first device receives the inserted user data information sent by the home subscription subscriber server HSS, and inserts the user data information.
  • the discovery key is included, wherein the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • an embodiment of the present invention provides a method for transmitting a key, where the method includes:
  • the remote terminal generates a first key according to the root key, and decrypts the encrypted first information using the first key to acquire the discovery key.
  • the remote terminal receives the securely transmitted discovery key during the establishment of the communication connection between the remote terminal and the relay terminal for subsequent remote terminal discovery of the relay terminal.
  • the first message further includes MAC information
  • the method further includes:
  • the remote terminal generates a second key based on the root key and verifies the MAC information using the second key, thereby verifying the integrity of the information of at least the first information.
  • the remote terminal in conjunction with the first possible implementation of the fourth aspect, in a second possible implementation manner of the fourth aspect, the remote terminal generates the first key according to the root key, and the remote terminal generates the second secret according to the root key Key, including:
  • the remote terminal generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the remote terminal generates a first key and a second key based on the communication root key.
  • the remote terminal in conjunction with the first possible implementation of the fourth aspect, in a third possible implementation manner of the fourth aspect, the remote terminal generates the first key according to the root key, and the remote terminal generates the second secret according to the root key Key, including:
  • the remote terminal generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the remote terminal generates a session key for communication between the remote terminal and the relay terminal according to the communication root key;
  • the remote terminal generates a first key and a second key based on the session key.
  • the first message is a direct security mode command message or directly
  • the communication accept message includes a discovery key indication information in the direct security mode command message or the direct communication accept message.
  • an embodiment of the present invention provides a method for transmitting a key, where the method includes:
  • the first device receives the first message sent by the relay terminal, where the first message includes the identifier information of the remote terminal;
  • the first device authenticates the remote terminal accessing the network through the relay terminal according to the first message
  • the first device sends a second message to the relay terminal, where the second message includes the first information, where the first information includes a discovery key for the remote terminal to discover the relay terminal, so that the relay terminal will The first information is sent to the remote terminal.
  • the first device is a network device, and before the first device receives the relay terminal to send the first message, the method further includes:
  • the first device receives the establishment trust connection request message sent by the relay terminal, and the establishment of the trust connection request message includes the identification information of the relay terminal and the identification information of the remote terminal;
  • the first device authenticates the remote terminal accessing the network through the relay terminal according to the establishment trust connection request message
  • the first device If the authentication passes, the first device generates a discovery key.
  • the first device is a mobility management entity MME, and before the first device receives the first message sent by the relay terminal, the method further includes:
  • the first device acquires a discovery key.
  • the acquiring, by the first device, the discovery key includes:
  • the first device receives the inserted user data information sent by the home subscriber server HSS, and the inserted user data information includes the discovery key, and the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • an embodiment of the present invention provides a method for transmitting a key, where the method includes:
  • the first terminal Receiving, by the first terminal, the first message, where the first message includes the first information, where the first information includes a discovery key used by the remote terminal to discover the relay terminal;
  • the relay terminal encrypts the first information by using an encryption key that communicates with the remote terminal;
  • the relay terminal sends a second message to the remote terminal, and the second message includes the encrypted first information.
  • the discovery key is encrypted by the relay terminal and sent to the remote terminal for subsequent discovery by the remote terminal to the relay terminal.
  • the second message is a direct security mode command message or a direct communication accept message
  • the direct security mode command message or the direct communication accept message includes a discovery key indication information
  • the embodiment of the present invention provides a device, where the device is a network device to which the relay terminal belongs, and the network device includes:
  • a processor configured to obtain a discovery key, and the discovery key is used by the remote terminal to discover the relay terminal;
  • the processor is further configured to acquire the first key and the universal booting architecture push information GPI, or the network device obtains the authentication vector AV;
  • the processor is further configured to generate a third key according to the first key or the second key in the AV, and encrypt the first information by using the third key, where the first information includes a discovery key;
  • a transmitter configured to send the encrypted first information and the GPI to the remote terminal by using the relay terminal, or the network device sends the encrypted first information, the RAND information in the AV, and the AUTN information to the remote terminal through the relay terminal; GPI, or The RAND information and the AUTN information in the AV are used by the remote terminal to generate a symmetric key of the third key, and the first key information is decrypted by using the symmetric key of the third key to obtain the discovery key.
  • the remote terminal accesses the network through the relay terminal to authenticate the network, encrypts the generated discovery key, and encrypts the discovered discovery.
  • the key is securely sent to a legitimate remote terminal for subsequent discovery by the remote terminal to the relay terminal.
  • the processor is further configured to generate a fourth key according to the first key or the second key in the AV, and adopt the fourth key Performing integrity protection on at least the first information to generate MAC information;
  • the transmitter sends the encrypted first information and the GPI to the remote terminal through the relay terminal, or the network device sends the encrypted first information, the RAND information and the AUTN information in the AV to the remote terminal through the relay terminal, and further includes:
  • the transmitter transmits MAC information to the remote terminal through the relay terminal; GPI, or RAND information in the AV and the AUTN letter
  • the information is further used by the remote terminal to generate a symmetric key of the fourth key, and the symmetric key of the fourth key is used to verify the integrity of the information including at least the first information according to the MAC information.
  • the processor generates a third according to the first key or the second key in the AV And generating, by the processor, the fourth key according to the first key or the second key in the AV, and generating the third key or the fourth key further includes:
  • At least one of the identification information of the relay terminal, the identification information of the remote terminal, and the identification information of the network device is used as an input parameter for generating the third key or the fourth key.
  • the first key is a key generated based on the GBA push mode of the universal bootstrapping architecture.
  • the first information further includes:
  • the eighth aspect of the present invention provides a device, where the device is a remote terminal, and the remote terminal includes:
  • a receiver configured to receive a first message sent by the relay terminal, where the first message includes the encrypted first information and the general bootstrapping information GPI, or the first message includes the encrypted first information and the RAND information in the authentication vector AV And AUTN information, wherein the first information includes a discovery key;
  • a processor configured to generate a first key according to the GPI, or the RAND information and the AUTN information, generate a second key based on the first key, and decrypt the encrypted first information by using the second key.
  • the remote terminal receives the securely transmitted discovery key in the process of establishing a trusted connection relationship between the remote terminal and the relay terminal, and is used by the subsequent remote terminal to discover the relay terminal.
  • the first message further includes MAC information
  • the processor is further configured to generate a third key based on the first key and verify the MAC information using the third key, thereby verifying integrity of the information including at least the first information.
  • the generating the second key based on the first key, and generating the third key based on the first key includes:
  • At least one of the identification information of the relay terminal, the identification information of the remote terminal, and the identification information of the network device is used as an input parameter for generating the second key or the third key.
  • an embodiment of the present invention provides a device, where the device includes:
  • a receiver configured to receive a first message sent by the relay terminal, where the first message includes identifier information of the remote terminal;
  • a processor configured to authenticate, according to the first message, the remote terminal establishes a communication connection by using the relay terminal;
  • the processor acquires a root key of the remote terminal
  • the processor is further configured to generate a first key according to the root key, and encrypt the first information by using the first key, where the first information includes a discovery key;
  • a transmitter configured to send the encrypted first information to the remote terminal by using the relay terminal, so that the remote terminal generates a symmetric key of the first key according to the communication root key of the remote terminal, and uses the symmetric key of the first key Key decryption encryption first Information acquisition discovery key.
  • the device In the process of establishing a communication connection between the remote terminal and the relay terminal, the device authenticates the remote terminal through the relay terminal to establish a communication connection, encrypts the obtained discovery key, and sends the obtained discovery key to the legal remotely.
  • the terminal is used to facilitate the subsequent remote terminal to discover the relay terminal.
  • the processor is further configured to generate a second key according to the root key, and perform integrity protection on the at least first information by using the second key to generate the MAC information.
  • the method further includes:
  • the first device sends the MAC information to the remote terminal through the relay terminal, and the MAC information is used by the remote terminal to verify the integrity of the at least first information.
  • the processor In conjunction with the first possible implementation manner of the ninth aspect, in a second possible implementation manner of the ninth aspect, the processor generates the first key according to the root key, and the processor generates the second secret according to the root key Key, including:
  • the processor generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the processor generates the first key and the second key according to the communication root key.
  • the processor generates the first key according to the root key, and the processor generates the second secret according to the root key Key, including:
  • the processor generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the processor generates a session key for communication between the remote terminal and the relay terminal according to the communication root key
  • the processor generates a first key and a second key based on the session key.
  • the device is a network device, before the processor acquires the root key of the remote terminal,
  • the receiver is further configured to receive a trust connection request message sent by the relay terminal, where the trust connection request message includes the identifier information of the relay terminal and the identifier information of the remote terminal;
  • the processor authenticates the remote terminal accessing the network through the relay terminal according to the establishment trust connection request message
  • the processor If the authentication passes, the processor generates a discovery key.
  • the device is a mobility management entity MME; and the first key pair is used by the processor Information encryption, and before the processor uses the second key to integrity protect the first information
  • obtaining the discovery key in the sixth possible implementation manner of the ninth aspect includes:
  • the receiver receives the inserted user data information sent by the home subscriber server HSS, and the insertion user data information includes a discovery key, wherein the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • the tenth aspect of the present invention provides a device, where the device is a remote terminal, and the remote terminal includes:
  • a receiver configured to receive a first message sent by the relay terminal, where the first message includes the encrypted first information, where the first information includes a discovery key;
  • a processor configured to generate a first key according to the root key, and decrypt the encrypted first information by using the first key to obtain the discovery key.
  • the remote terminal receives the securely transmitted discovery key during the establishment of the communication connection between the remote terminal and the relay terminal for subsequent remote terminal discovery of the relay terminal.
  • the first message further includes MAC information
  • the processor is further configured to generate a second key according to the root key, and verify the MAC information by using the second key, thereby verifying the integrity of the information of the at least first information.
  • the processor In conjunction with the first possible implementation of the tenth aspect, in a second possible implementation manner of the tenth aspect, the processor generates the first key according to the root key, and the remote terminal generates the second according to the root key Key, including:
  • the processor generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the processor generates the first key and the second key according to the communication root key.
  • the processor In conjunction with the first possible implementation of the tenth aspect, in a third possible implementation manner of the tenth aspect, the processor generates the first key according to the root key, and the processor generates the second secret according to the root key Key, including:
  • the processor generates a communication root key for communication between the remote terminal and the relay terminal according to the root key
  • the processor generates a session key for communication between the remote terminal and the relay terminal according to the communication root key
  • the processor generates a first key and a second key based on the session key.
  • the first message is a direct security mode command message or directly
  • the communication accept message includes a discovery key indication information in the direct security mode command message or the direct communication accept message.
  • an embodiment of the present invention provides a device, where the device includes:
  • a receiver configured to receive a first message sent by the relay terminal, where the first message includes identifier information of the remote terminal;
  • a processor configured to authenticate, according to the first message, the remote terminal accessing the network through the relay terminal;
  • the sender sends a second message to the relay terminal, where the second message includes the first information, where the first information includes a discovery key for the remote terminal to discover the relay terminal, so that the relay terminal will A message is sent to the remote terminal.
  • the device is a network device, before the receiver receives the relay terminal and sends the first message,
  • the receiver is further configured to receive a trust connection request message sent by the relay terminal, where the trust connection request message includes the identifier information of the relay terminal and the identifier information of the remote terminal;
  • the processor authenticates the remote terminal accessing the network through the relay terminal according to the establishment trust connection request message
  • the processor If the authentication passes, the processor generates a discovery key.
  • the device is a mobility management entity MME; before the receiver receives the first message sent by the relay terminal,
  • obtaining the discovery key includes:
  • the receiver receives the inserted user data information sent by the home subscriber server HSS, and the inserted user data information includes the discovery key, and the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • the embodiment of the present invention provides a device, where the device is a relay terminal, and the relay terminal includes:
  • a receiver configured to receive, by the first device, a first message, where the first message includes first information, where the first information includes a discovery key for the remote terminal to discover the relay terminal;
  • a processor for encrypting the first information using an encryption key that communicates with the remote terminal
  • a transmitter configured to send a second message to the remote terminal, where the second message includes the encrypted first information.
  • the discovery key is encrypted by the relay terminal and sent to the remote terminal for subsequent discovery by the remote terminal to the relay terminal.
  • the second message is a direct security mode command message or a direct communication accept message
  • the direct security mode command message or the direct communication accept message includes a discovery key Instructions.
  • the embodiment of the present invention provides a computer program product comprising the instructions, when the instruction is run on a computer, performing any one of the first aspect to the sixth aspect or any of the aspects.
  • the embodiment of the present application provides a computer readable storage medium, configured to store an instruction, when the instruction is executed on a computer, perform any one of the foregoing first to sixth aspects or any Any of the possible methods/steps of implementation.
  • FIG. 1 is a flowchart of a key transmission method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of another method for transmitting a key according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a key transmission method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for dynamically establishing a trust relationship according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a remote terminal according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a remote terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a device according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a relay terminal according to an embodiment of the present invention.
  • the embodiment of the present application provides a method for transmitting and receiving a key, a network device, and a remote terminal.
  • the embodiment of the present application can complete the transmission of the key by using two schemes.
  • Solution 1 In the process of establishing a trust relationship between the remote terminal and the relay terminal, the discovery key is sent to the remote terminal;
  • scheme 2 on the basis of establishing a trust relationship between the remote terminal and the relay terminal, the remote terminal and the relay terminal During the establishment of the communication connection, the discovery key is sent to the remote terminal.
  • the remote terminal may be referred to as a remote user device (referred to as a remote UE or an eRemote UE), and the relay terminal may be referred to as a relay user device, referred to as relay UE or eRelay. UE.
  • a remote user device referred to as a remote UE or an eRemote UE
  • the relay terminal may be referred to as a relay user device, referred to as relay UE or eRelay. UE.
  • the short-range communication connection established between the eRemote UE and the eRelay UE is a communication connection established based on D2D communication of the cellular network.
  • the connection established between the eRemote UE and the eRelay UE is simply referred to as a PC5 connection.
  • first key “second key”, “third key”, “first information”, “second information” and “first message” "First”, “Second” and “Third” in “Second Message” and “Third Message” are used to distinguish keys, information or messages, and do not limit keys, information or messages themselves. .
  • the network device mentioned below provides a Proximity Service (Prose) device for the eRemote UE and the eRelay UE, such as a Prose Key Management Function (Prose Key Management Function).
  • PKMF Prose Key Management Function
  • Prose function Prose Function
  • FIG. 1 is a method for transmitting a key according to an embodiment of the present application. As shown in FIG. 1, the method may include the following steps:
  • the network device obtains a discovery key.
  • the eRemote UE cannot automatically discover the eRelay UE if the eRemote UE and the eRelay UE have not established a trust relationship, and the manual cooperation of the user is required to complete the eRemote UE and the eRelay UE. Trust the connection. Therefore, the eRemote UE can discover the eRelay UE through open discovery and establish a trust relationship with the eRelay UE in the process.
  • the network device obtains a discovery key for restricted discovery.
  • the discovery key of the restricted discovery is a key used by the eRemote UE that only allows the establishment of a trust relationship and authorization to discover the eRelay UE.
  • the discovery key may be a root key for restricted discovery or an encryption key, an integrity key, and a scrambling key used in the restricted discovery process, such as A discovery user confidentiality key (DUCK), a discovery user integrity key (DUIK), and a discovery user scrambling key (DUSK) are found.
  • DUCK discovery user confidentiality key
  • DUIK discovery user integrity key
  • DUSK discovery user scrambling key
  • the network device acquires a first key of the remote terminal and a generic bootstrapping architecture push information (GPI), or the network device acquires an eRemote UE authentication vector (AV).
  • GPS generic bootstrapping architecture push information
  • AV eRemote UE authentication vector
  • the network device should first obtain the identifier information of the eRemote UE to obtain the foregoing information, and the identifier information of the eRemote UE is an international mobile subscriber identification number (IMSI) of the eRemote UE, where the IMSI information is requested by the network device according to the establishment information relationship.
  • IMSI international mobile subscriber identification number
  • the identifier information of the carried eRemote UE (such as the proximity service discovery UE identifier) is obtained.
  • the network device acquires the first key and the GPI of the eRemote UE according to the identifier information of the eRemote UE.
  • the first key is Ks(_int/ext)_NAF
  • Ks(_int/ext)_NAF is generated based on the generic bootstrapping architecture (GBA) push mode, and the key associated with the GPI information is available in the eRemote UE.
  • GBA generic bootstrapping architecture
  • Ks(_int/ext)_NAF is used to generate a key for encrypting the first information, and at least
  • the first information is a key for integrity protection, and the first information refers to information including the above discovery key.
  • the network device may acquire the AV of the eRemote UE, and the AV includes information such as a second key Kasme, a random number (RAND), and an authentication token (AUTN).
  • the network device may use the Kasme in the AV as the first key, and generate a key for encrypting the first information and a key for at least integrity protection of the first information based on the first key, the same first information. Refers to information including the discovery key.
  • the GPI is used by the subsequent eRemote UE to generate a symmetric key of the key for encrypting the first information, thereby decrypting the first information to obtain a discovery key, for subsequent eRemote UE and eRelay UE discovery.
  • the network device acquires the key, and generates a key for encrypting the first information based on the key of the eRemote UE, such as
  • the key is a key that the eRemote UE has communicated with the network device before the eRemote UE establishes a trust relationship with the eRelay UE, and the key stored in the network device is used to protect communication between the eRemote UE and the network device, or the key may also be eRemote.
  • the root key used by the UE for relaying such as the proximity service relay user key of the eRemote UE.
  • first information may also be included in the foregoing first information, such as when the discovery key is a root key for restricted discovery, and the first information further includes metadata information on how to protect the discovery message, such as encryption.
  • One or more of integrity protection and scrambling code so that the UE generates an encryption key, an integrity protection key, and a scrambling code key according to the root key.
  • the network device generates a third key according to the first key or the second key in the AV, and encrypts the first information by using the third key.
  • the network device generates a third key PF_enc for encrypting the first information according to the first key Ks(_int/ext)_NAF or the second key Kasme, and encrypts the first information by using PF_enc.
  • the network device may also be used to generate a fourth key for integrity protection according to the first key Ks(_int/ext)_NAF or the second key Kasme in the AV.
  • PF_int and using at least the fourth key PF_int to perform integrity protection on the first information to generate message authentication code (MAC) information
  • MAC message authentication code
  • MIC message integrity code
  • the network device generates an integrity protection key according to Ks(_int/ext)_NAF, and uses the key to perform integrity protection on at least the first information to generate MAC information, where the MAC information is used for subsequent
  • the eRemote UE generates a symmetric key for the integrity protection key according to the GPI, that is, generates a MAC' information, compares the MAC' information with the MAC information generated by the network device, and if yes, determines that at least the first information is included. The integrity of the information.
  • the network device generates, according to the Kasme, an integrity protection key, and uses the key to perform integrity protection on the at least first information, and generates MAC information, where the MAC information is used in the subsequent eRemote UE according to the AV.
  • the RAND information and the AUTN generate a symmetric key for the integrity protection key, that is, generate a MAC' information, compare the MAC' information with the MAC information generated by the network device, and if yes, determine that at least the first The integrity of the information of the information.
  • the network device obtains the key of the saved eRemote UE, and generates a third key and a fourth key based on the key, as described in S120, and adopts the first
  • the third key encrypts the first information
  • the fourth key uses at least the integrity protection of the first information.
  • the first information is encrypted, and at least the first information is performed.
  • the order of integrity protection is not limited.
  • the first information may be encrypted first, and then at least the integrity of the encrypted first information may be included; or at least the first information may be integrity protected, and then the first A message is encrypted.
  • the sequence of encrypting the first information and protecting the first information only affects the encryption and integrity protection after the eRemote UE receives the first information of the encryption and integrity protection.
  • the first information is decrypted first and then integrity verified, or the order of integrity verification and decryption is first. For example, after the network device encrypts the first information and then performs integrity protection, after receiving the first information of the encryption and integrity protection, the eRemote UE first verifies the integrity and decrypts.
  • the parameters for generating the PF_enc and the PF_int may include the identifier information of the eRemote UE, the identifier information of the eRelay UE, and the identifier information of the network device, in addition to the Ks(_int/ext)_NAF or the Kasme. One or more.
  • the above input information for at least integrity protection of the first information should also contain fresh information, which may be time information, or may be counter information stored in the network device and the eRemote UE, eRemote After receiving the first information, the UE needs to verify the received fresh information after verifying the MAC information to ensure that the first information is legal, rather than the first information of the attacker replaying the attack.
  • the input information of the network device for generating the MAC information includes the PF_int, the information including at least the first information, and the fresh information.
  • the first information may further include at least one of identifier information of the eRelay UE, identifier information of the network device, a codeword of the broadcast, a communication root key that the eRemote UE and the eRelay UE communicate, and the like.
  • the identifier information is information for uniquely determining an eRelay UE, an eRemote UE, or a network device.
  • the identifier information of the eRemote UE and the identifier information of the eRelay UE may be identifier information of the 3GPP or identifier information allocated by the network device, respectively.
  • the identifier information of the network device may be a fully qualified domain name (FQDN), and the broadcast codeword used for discovery is a codeword broadcast by the eRelay UE during the relay discovery process, and the communication root of the eRemote UE and the eRelay UE communicates.
  • the key is a key generated by the network device according to the restricted communication key for generating communication data for protecting the communication between the eRemote UE and the eRelay UE, which will be described later.
  • S140 The network device sends the encrypted first information and the GPI to the remote terminal through the relay terminal, or the network device sends the encrypted first information to the remote terminal through the relay terminal, and RAND and AUTN in the AV.
  • the network device may further send the MAC information and the fresh information to the remote terminal by using the relay terminal.
  • the MAC information mentioned herein may be information for integrity protection of the unencrypted first information, or information for integrity protection of the encrypted first information.
  • the combination of RAND and AUTN in the GPI or AV sent by the network device to the remote terminal is used by the eRemote UE to generate a symmetric key of PF_int and PF_enc, and the symmetric key includes a key for decrypting the first information and the pair includes at least The key to the information integrity verification of the first message.
  • the network device in the process of establishing a trust connection between the eRemote UE and the eRelay UE, the network device sends the encrypted first information, GPI, and MAC information to the eRemote UE through the eRelay UE, or the network device sends the eRemote UE to the eRemote UE through the eRelay UE.
  • the specific process of encrypting the first information, RAND and AUTN in the AV, and MAC information may be:
  • the network device sends a trust relationship establishment response message to the eRelay UE, where the response message includes the encrypted first information, the GPI, and the MAC information, or the response message includes the encrypted first information, RAND and AUTN and MAC information in AV; eRelay UE is tied A bonding acknowledge message sends the encrypted first information, GPI, and MAC information to the eRemote UE, or the eRelay UE sends the encrypted first information, the RAND and AUTN in the AV, and the MAC information to the eRemote through the binding determination message.
  • the response message includes the encrypted first information, the GPI, and the MAC information, or the response message includes the encrypted first information, RAND and AUTN and MAC information in AV; eRelay UE is tied A bonding acknowledge message sends the encrypted first information, GPI, and MAC information to the eRemote UE, or the eRelay UE sends the encrypted first information, the RAND and AUTN in the
  • the information type, signaling message, and the like used by the information may be different in the information transmission process from the network device to the eRelay UE and the eRelay UE to the eRemote UE.
  • the trust relationship establishment response message may further include other information, such as identification information of the remote UE, encryption selected by the network device for encrypting the first information, and/or integrity protection algorithm selected by the integrity protection, and the network device performs completeness.
  • the information of the sexual protection may contain the above information in addition to the first information, and the selected algorithm will be described in detail later.
  • the network device sends, by using the relay terminal, the encrypted first information and the saved key identifier obtained by the network device, where the key identifier is used by the remote terminal eRemote UE to obtain the eRemote UE.
  • a corresponding key is generated, and a symmetric key of PF_int and PF_enc is generated based on the key, the symmetric key including a key for decrypting the first information and a key for information integrity verification including at least the first information.
  • the remote terminal generates a symmetric key of the PF_enc according to the GPI, decrypts and obtains the first information, or the remote terminal generates a symmetric key of the PF_enc according to the RAND and the AUTN in the AV, and decrypts and obtains the first information.
  • the remote terminal generates a symmetric key of the PF_int according to the GPI, or generates a symmetric key of the PF_int according to the RAND and the AUTN in the AV, and the at least the first information is included according to the received MAC information. Information integrity is verified.
  • the eRemote UE receives the GPI, generates Ks(_int/ext)_NAF according to the GPI, and generates a symmetric key of PF_int and PF_enc according to Ks(_int/ext)_NAF, for decrypting the first information, and At least the information integrity verification of the first information is included to obtain the discovery key, so that the eRemote UE can discover the eRelay UE.
  • the eRemote UE generates Ks(_int/ext)_NAF according to the GPI, which is a prior art and will not be described herein.
  • the method for generating the PF_int and PF_enc by the eRemote UE is the same as the method for generating the network device in step S130.
  • the eRemote UE generates a symmetric key Kasme of the second key according to RAND and AUTN in the AV, and generates a symmetric key of PF_int and PF_enc based on Kasme for decrypting the first information, and At least the information integrity verification of the first information is included to obtain the discovery key, so that the eRemote UE can discover the eRelay UE.
  • the symmetric key Kasme in which the eRemote UE generates the second key from the RAND and the AUTN in the AV is prior art and will not be described herein.
  • the method for generating the PF_int and PF_enc by the eRemote UE is the same as the method for generating the network device in step S130.
  • the network device can perform integrity protection on the unencrypted or encrypted first information, generate integrity-protected MAC information, and send the MAC and the encrypted first information to the eRemote UE, thereby
  • the eRemote UE side does not limit the order of decryption and verification of the discovery key integrity.
  • the eRemote UE side may first decrypt and obtain the first information, thereby obtaining the discovery key, and then verifying at least the first decryption.
  • the integrity of the information of the information it is also possible to first verify the integrity of at least the encrypted first information, and then decrypt the first information to obtain the discovery key.
  • the remote device obtains the corresponding key of the eRemote UE according to the obtained key identifier, generates a symmetric key of PF_enc, decrypts and obtains the first information, and generates a symmetric key of the PF_int based on the obtained key. And verifying information integrity including at least the first information according to the received MAC information.
  • the eRemote UE After the eRemote UE obtains the first information in this step, after verifying the MAC information, the eRemote UE needs to verify that the fresh information obtained at the same time as the first information is valid, and the specific verification method is: when the fresh information is time information, If the time difference between the eRemote UE verification time and the network device is within the allowable range, the fresh information is considered valid; when the fresh information is the counter value, the network device compares the received counter value with the counter value saved by the network device, and then considers that the received value is received. Fresh information is valid, which in turn determines the legitimacy of the first information received.
  • the method for transmitting and receiving a key provided by the embodiment of the present invention realizes that the discovery key is securely transmitted to the remote terminal, thereby realizing the discovery of the designated relay terminal by the remote terminal.
  • the method before the network device obtains the discovery key, the method further includes:
  • the relay terminal receives a binding request sent by the remote terminal to establish a trust relationship.
  • the remote terminal is also an eRemote UE.
  • the relay terminal When the user cooperates, the relay terminal is discovered through open discovery.
  • the relay terminal is also an eRelay UE, and then sends a binding request, where the binding request includes the identifier information of the eRemote UE. .
  • the network device receives a establish trust relationship request message sent by the relay terminal.
  • the establishment of the trust relationship request message is sent by the relay terminal after receiving the binding request sent by the remote terminal, and includes the identifier information of the eRelay UE and the identifier information of the eRemote UE.
  • the network device authenticates the remote terminal.
  • the network device After receiving the request for establishing a trust relationship, the network device determines whether the eRemote UE can access the network through the eRelay UE. If the authentication succeeds, the network device obtains the discovery key, that is, performs S110.
  • the network device After obtaining the discovery key, the network device sends a trust relationship establishment response message to the eRelay UE; the eRelay UE sends a bonding acknowledge message to the eRemote UE to complete the trust between the eRemote UE and the eRelay UE. The establishment of the relationship.
  • the key security is sent to the legal remote terminal, and the remote terminal can pass the restricted discovery. The way to find the relay terminal.
  • the algorithm selected by the network device to encrypt the first information may be a preset algorithm.
  • the algorithm is also preset on the eRemote UE side, or the network device supports the algorithm according to the eRemote UE subscription information. Selecting a high priority algorithm supported by the network device and transmitting the selected algorithm identifier to the eRemote UE in step 140, wherein the algorithm identifier should not be encrypted, or the binding request message and trust establishment in steps 160, 170
  • the connection request message includes an algorithm supported by the eRemote UE, and the network entity selects the algorithm with the highest priority supported by the network device according to the received algorithm, and sends the selected algorithm identifier to the eRemote UE through step 140.
  • the eRemote UE may decrypt the first information according to the preset algorithm, thereby obtaining the first information, or determining to decrypt the first according to the algorithm identifier received in step 140.
  • Information and an algorithm for verifying the integrity of the information to obtain the first information may be decrypted according to the preset algorithm, thereby obtaining the first information, or determining to decrypt the first according to the algorithm identifier received in step 140.
  • the manner in which the network device performs the integrity protection determining algorithm on the information including the first information is consistent with the encryption algorithm, and details are not described herein again.
  • the selected algorithm may also be applied to the network device and the eRemote UE to generate the encryption key PF_enc according to the first key or the second key, or to generate the integrity key according to the first key or the second key.
  • Key PF_int may also be applied to the network device and the eRemote UE to generate the encryption key PF_enc according to the first key or the second key, or to generate the integrity key according to the first key or the second key.
  • the network device acquires the first key and the GPI, or the AV, including:
  • the network device to which the Relay UE belongs is based on the identification information of the eRemote UE from the BSF (Bootstrapping Server).
  • the function of the function guiding server is to obtain the first key and the GPI, or obtain the first vector and the GPI from the network device after obtaining the authentication vector from the home subscriber server (HSS) according to the identifier of the eRemote UE.
  • HSS home subscriber server
  • the network device of the eRelay UE obtains the first key and the GPI, Or the AV is consistent with the foregoing method. If the eRemote UE and the eRelay UE belong to different network devices, the network device that belongs to the eRelay UE determines the network device to which the eRemote UE belongs according to the identifier information of the eRemote UE, and belongs to the eRemote UE.
  • the network device sends a request message, where the request message includes identification information of the eRemote UE to request Ks(_int/ext)_NAF and GPI, or AV.
  • the network device to which the eRemote UE belongs acquires Ks(_int/ext)_NAF and GPI, or AV, and returns the response message to the network device to which the eRelay UE belongs.
  • the request message sent by the network device to which the eRelay UE belongs to the network device to which the eRemote UE belongs may be referred to as a key request message, which is also referred to as another name, in the embodiment of the present invention. There is no limit to this.
  • the communication root for the 1:1 communication between the eRemote UE and the eRelay UE may be generated as follows.
  • the key which is used to protect the signaling and data during the communication between the eRemote UE and the eRelay UE.
  • the process of generating the communication root key may be specifically: in the process of establishing a communication connection between the remote terminal and the relay terminal, the remote terminal and the relay terminal use the root key of the restricted discovery key, or DUCK, DUIK, as the root key.
  • Deriving a session key for eRemote UE and eRelay UE communication by using a root key or DUCK, DUIK for example, using a PSDK to derive a session key for eRemote UE and eRelay UE communication, and deriving a session secret using DUCK/DUIK
  • the key, which is derived from the session key, is used to encrypt and fully protect the session key, or DUCK/DUIK is used to directly derive the session key for encryption and integrity protection for communication.
  • the method may further include:
  • the network device generates a communication root key for communication between the remote terminal and the relay terminal according to the discovery key; the network device transmits the communication root key to the remote terminal through the relay terminal.
  • the network device may send the communication root key and the discovery key together to the remote terminal.
  • FIG. 1 illustrates a technical solution for transmitting a key security to a legitimate eRemote UE in the process of establishing a trust connection between the eRemote UE and the eRelay UE.
  • a technical solution for transmitting a key securely to a legitimate eRemote UE in the process of establishing a communication connection between the eRemote UE and the eRelay UE will be described below with reference to FIG. 2 to FIG.
  • FIG. 2 is a flowchart of a method for sending a key according to an embodiment of the present invention. As shown in FIG. 2, the method may include the following steps:
  • the first device receives the first message sent by the relay terminal.
  • the first device may be a network device or a mobile network management entity.
  • the eRemote UE discovers the eRelay UE, after which the eRemote UE and the eRelay UE establish a trust relationship with The eRemote UE sends a communication request message to the eRelay UE to request to establish a communication connection between the eRemote UE and the eRelay UE. After receiving the communication request message, the eRelay UE sends a first message to the first device, where the first message is sent.
  • the identifier information of the eRemote UE and the identifier information of the eRelay UE are included.
  • the first message may be referred to as an authentication request (Authorizarion request) message or a key request message, and may also be referred to as another name, which is not limited in the embodiment of the present invention.
  • Authorizarion request authentication request
  • key request message key request message
  • the first device authenticates the remote terminal by establishing a communication connection by using the relay terminal according to the first message.
  • the first device After receiving the first message, the first device verifies whether the eRemote UE is allowed to access the network through the eRelay UE. If
  • the first device After the authentication is passed, the first device performs a subsequent operation to establish a communication connection between the eRemote UE and the eRelay UE, and sends the discovery key to the eRemote UE in the process of establishing the communication connection; if the authentication fails, the terminal is terminated.
  • the establishment of a communication connection After the authentication is passed, the first device performs a subsequent operation to establish a communication connection between the eRemote UE and the eRelay UE, and sends the discovery key to the eRemote UE in the process of establishing the communication connection; if the authentication fails, the terminal is terminated. The establishment of a communication connection.
  • the first device acquires a root key of the remote terminal.
  • the first device After the first device authenticates the eRemote UE through the eRelay UE and authenticates the eRemote UE, the first device acquires the root key of the eRemote UE.
  • the root key of the eRemote UE may be a root key of the eRemote UE preset on the network device, a ProSe Relay User Key, or a network device.
  • the root key of the eRemote UE is a root key in the eRemote UE security context, such as Kasme.
  • the first device generates a first key according to the root key, and encrypts the first information by using the first key, where the first information includes a discovery discovery key.
  • the first information may further include identifier information of the eRemote UE, identifier information of the eRelay UE, identifier information of the first device, and the like.
  • the identification information is information for uniquely identifying the eRemote UE, the eRelay UE, and the first device.
  • the first device may further generate, according to the root key, a second key that performs integrity protection on the at least first information.
  • the first device may further generate a communication root key for the eRemote UE and the eRelay UE communication by using the root key of the eRemote UE.
  • the first device generates a first key for encrypting the first information, and generates a second key for performing complete protection on the at least first information, including: After the device generates a communication root key for the eRemote UE and the eRelay UE communication based on the root key of the eRemote UE, the device generates a first key for encrypting the first information according to the communication root key of the eRemote UE and the eRelay UE communication.
  • a second key for performing integrity protection on the at least first information where the first device generates a communication root key for the eRemote UE and the eRelay UE communication based on the root key of the eRemote UE belongs to the prior art, This article is no longer stated.
  • the first device may also be used according to the The communication root key communicated by the eRemote UE and the eRelay UE pushes out a session key used for communication between the eRemote UE and the eRelay UE, and then generates a first key for encrypting the first information according to the session key and completes at least the first information.
  • the first device generates a communication root key for the eRemote UE and the eRelay UE communication based on the root key of the eRemote UE, and the introduction of the session key belongs to the prior art, and is not stated herein. .
  • the first device encrypts the first information by using the generated first key; the first device performs integrity protection on the first information by using the second key to generate MAC information.
  • the MAC information generated by the first device is obtained by performing integrity protection on at least the encrypted or unencrypted first information, and is not limited to be performed by the first device in the embodiment of the present invention.
  • the order of encryption and integrity is not limited to be performed by the first device in the embodiment of the present invention.
  • the first device sends the encrypted first information to the remote terminal by using the relay terminal.
  • the first device sending the encrypted first information to the eRemote UE by using the eRelay UE may be: the first device sends a response message of the first message to the eRelay UE, where the response message may be an authentication response (Authorizarion) Response) message.
  • the encrypted first information may be included in the response message, and the encrypted first information is sent by the eRelay UE to the eRemote UE through a direct security mode command message or a direct communication accept message.
  • the first device may further send the MAC information to the remote terminal by using the relay terminal.
  • the MAC information is sent with the encrypted first information.
  • the remote terminal decrypts the encrypted first information to obtain a discovery key.
  • the eRemote UE generates a symmetric key of the first key in the same manner as the first device, that is, the eRemote UE obtains its own root key, and the root key may be PRUK or Ks(_int/ext)_NAF, or eRemote UE security context.
  • Kasme and generates a symmetric key of the first key and the second key based on the root key, and decrypts the encrypted first information by using the symmetric key of the first key, and verifies the MAC to verify that at least the first The integrity of the information of the information, thereby obtaining the discovery key, so that the eRemote UE can discover the eRelay UE by means of restricted discovery.
  • the eRemote UE generates the MAC' information according to the symmetric key of the second key, and the eRemote UE compares the generated MAC' information with the received MAC information sent by the first device, and if it is the same, it considers that the first information is included. The information has not been tampered with.
  • the symmetric key generated by the eRemote UE to generate the first key and the second key is the same as the manner in which the first device generates the first key and the second key, that is, the eRemote UE may be based on different methods corresponding to the first device.
  • the first key and the symmetric key of the second key are generated in different ways.
  • the eRemote UE does not restrict the decryption of the encrypted first information and the order of verifying at least the first information integrity.
  • the eRemote UE may first decrypt the encrypted first information. Obtaining the discovery key, and verifying the integrity of the decrypted first information, the integrity of the encrypted first information may also be verified first, and then the encrypted first information is decrypted to obtain the discovery key.
  • the key security is sent to the legal eRemote UE, so that the eRemote UE can discover the eRelay UE to discover the eRelay through the limited discovery manner. UE.
  • the embodiment of the present invention can also send the discovery key to the legal eRemote UE securely by using another key sending method, as shown in FIG. 3 .
  • the embodiment shown in FIG. 3 is different from the embodiment shown in FIG. 2 in that after the first device acquires the discovery key, the discovery key is included in the first information and sent to the eRelay UE, and is established in the eRelay UE and the eRemote UE.
  • the eRelay UE encrypts and integrity protects the first information including the discovery key based on the encryption and the complete protection key used by the eRemote UE and the eRelay UE communication link, and communicates with the eRemote UE through the communication link with the eRemote UE.
  • the encryption and integrity protected discovery key is sent to the eRemote UE. This embodiment will be described in detail below with reference to FIG. 3.
  • the first device receives the first message sent by the relay terminal.
  • the first message includes identification information of the remote terminal.
  • the first device authenticates the remote terminal accessing the network through the relay terminal.
  • the first device After receiving the first message, the first device verifies whether the eRemote UE is allowed to access the network through the eRelay UE. If the authentication is passed, the first device performs a subsequent operation to establish a communication connection between the eRemote UE and the eRelay UE, and sends the discovery key to the eRemote UE in the process of establishing the communication connection.
  • the first device sends a second message to the relay terminal, where the second message includes first information, where the first information includes a discovery key for the remote terminal to discover the relay terminal.
  • the second message is a response message of the first message.
  • the first information may further include one or more pieces of identifier information of the eRemote UE, identifier information of the eRelay UE, and identifier information of the first device.
  • the relay terminal encrypts the first information.
  • the relay terminal After receiving the second message sent by the first device, the relay terminal negotiates with the eRemote UE to generate an encryption key and an integrity protection key for the eRemote UE to communicate with the eRelay UE, and is used to protect the between the eRemote UE and the eRelay UE.
  • the signaling and data the relay terminal generates an encryption key and integrity protection key for the eRemote UE to communicate with the eRelay UE as prior art.
  • the relay terminal When the relay terminal can send the first information to the remote terminal by using a signaling message, for example, by sending a direct security mode command message to the remote terminal, the relay terminal should use the integrity protection of the remote terminal to communicate with the relay terminal.
  • the key performs integrity protection on at least the first information to generate a MAC, and encrypts the first information using an encryption key communicated by the remote terminal and the relay terminal; after the remote terminal and the relay terminal complete the key negotiation, the relay terminal further
  • the first information may be sent via other signaling plane messages, such as by direct communication.
  • the message should be encrypted and integrity protected using the encryption and integrity protection keys communicated by the remote terminal with the relay terminal.
  • the relay terminal after completing the key negotiation with the remote terminal, the relay terminal sends the first information to the remote terminal through the user plane data after establishing the communication link.
  • the relay terminal uses The encryption key communicated by the eRemote UE with the eRelay UE encrypts the first information including the discovery key, and performs integrity protection on the first information to generate the MAC using the integrity protection key communicated by the eRemote UE and the eRelay UE.
  • the relay terminal may generate an encryption key based on the root key communicated with the remote terminal, the encryption key being used for encryption.
  • First information optionally, generating an integrity protection key based on a root key communicated with the remote terminal, the integrity protection key being used for at least integrity protection of the first information, and generating an encryption key at the relay terminal
  • the first information may be sent to the remote terminal through the signaling message or the user plane data.
  • the remote terminal After receiving the first information, the remote terminal generates the encryption key and integrity in the same manner as the relay terminal. Protecting the key, verifying at least the information integrity of the first information, and decrypting the first information.
  • the indication information of the discovery key should be included in the signaling message or the user plane data, so that the remote terminal recognizes the indication information of the discovery key, and then uses the remote
  • the encryption key of the communication between the terminal and the relay terminal or the symmetric key for encrypting the encryption key of the first information decrypts the first information, thereby obtaining the first information.
  • the relay terminal sends the encrypted first information to the remote terminal.
  • the remote terminal decrypts and obtains a discovery key.
  • the eRemote UE negotiates with the eRelay UE to generate a symmetric key for the encryption key and integrity protection key communicated with the eRelay UE.
  • the eRemote UE decrypts the received signaling or data using the symmetric key of the encryption key to obtain the first information, and verifies the first with the symmetric key of the integrity protection.
  • the information or the integrity of the information containing at least the first information, thereby obtaining a discovery key.
  • the process further includes the eRemote UE and the eRelay UE dynamically establishing a trust relationship.
  • the process can be specifically as follows:
  • the relay terminal receives a binding request sent by the remote terminal to establish a trust relationship.
  • the eRemote UE discovers the eRelay UE through open discovery and sends a bonding request to the eRelay UE to request to establish a trust connection relationship with the eRelay UE.
  • the establishing a binding request includes the identifier information of the eRemote UE.
  • the network device receives a establish trust relationship request message sent by the relay terminal.
  • the establishing a trust relationship request message is sent by the relay terminal after receiving the binding request sent by the remote terminal, and the establishing trust relationship request message includes the identification information of the relay terminal and the identification information of the remote terminal.
  • the network device verifies that the remote terminal can access the network through the relay terminal.
  • the network device After receiving the trust relationship request message, the network device verifies that the remote terminal can access the network through the relay terminal.
  • the network device obtains the discovery key.
  • the network device After obtaining the discovery key, the network device sends a trust relationship establishment response message to the eRelay UE; the eRelay UE sends a bonding acknowledge message to the eRemote UE to complete the trust between the eRemote UE and the eRelay UE. The establishment of the relationship.
  • the method may further include: the network device sending the discovery key to the MME to which the relay terminal belongs.
  • the network device may send the discovery key to the MME through a Home Subscriber Server (HSS).
  • HSS Home Subscriber Server
  • the network device sends an update data (updata prose policy data) message to the HSS.
  • the updata prose policy data message includes a discovery key and other parameter information for discovery.
  • the HSS sends the inserted user data information to the MME.
  • the HSS After receiving the update close to the service policy data message, the HSS sends the inserted user data information to the MME to which the eRelay UE belongs, where the inserted data information includes the discovery key and other parameter information used for discovery, such as eRelay UE broadcast for discovery.
  • the MME sends an insertion data acknowledgement message to the HSS.
  • the MME After receiving the inserted user data information, the MME stores the discovery key and other parameters for discovery in the context of the eRelay UE, and returns an insert subscriber data ACK message to the HSS.
  • FIG. 1 to FIG. 4 illustrate a method for transmitting a key.
  • the device provided by the embodiment of the present invention including a network device, an MME, a remote terminal, and a relay terminal, will be described below with reference to FIG. 5 to FIG.
  • FIG. 5 is a network device according to an embodiment of the present disclosure, where the network device is a network device to which the relay terminal belongs. As shown in FIG. 5, the network device can include a processor 510 and a transmitter 520.
  • the processor 510 is configured to obtain a discovery key, and the discovery key is used by the remote terminal to discover the relay terminal.
  • the processor 510 is further configured to acquire the first key and the universal boot architecture push information GPI, or the network device obtains the authentication vector AV.
  • the processor 510 is further configured to generate a third key according to the first key or the second key in the AV, and encrypt the first information by using the third key, where the first information includes the discovery key.
  • the transmitter 520 is configured to send the encrypted first information and the GPI to the remote terminal by using the relay terminal, or the network device sends the encrypted first information, the RAND information in the AV, and the AUTN information to the remote terminal through the relay terminal; Or the RAND information and the AUTN information in the AV are used by the remote terminal to generate a symmetric key of the third key, and the first key information is decrypted by using the symmetric key of the third key to obtain the discovery key.
  • the remote terminal and the relay terminal When the remote terminal and the relay terminal have not established a trust connection relationship, the user needs to manually cooperate to complete the trust connection between the remote terminal and the relay terminal. In the process of establishing a trust connection, the remote terminal needs to send a binding request for establishing a trust relationship to the relay terminal, so as to trigger the relay terminal to send a trust relationship request message to the network device, and establish a trust connection relationship between the remote terminal and the relay terminal. .
  • the network device After receiving the trust relationship request message sent by the relay terminal, the network device authenticates the remote terminal. If the authentication succeeds, the network device generates a discovery key for the remote terminal to discover the designated relay terminal, and the discovery key It may be a root key for restricted discovery or an encryption key, an integrity key, and a scrambling key used in a restricted discovery process, such as DUCK, DUIK, DUSK.
  • the processor 510 acquires a first key Ks(_int/ext)_NAF and GPI information from the HSS, where Ks(_int/ext)_NAF is a key for communication between the network device and the remote terminal, where Ks(_int/ Ext)_NAF is a key generated based on the GBA push mode of the universal bootstrapping architecture. Or the processor 510 obtains the authentication vector AV to complete the encryption of the discovery key.
  • the processor 510 acquires the Ks(_int/ext)_NAF and GPI information, the third key PF_enc that encrypts the first information is generated according to Ks(_int/ext)_NAF. If the processor 510 acquires the AV, the third key PF_enc is generated according to the second key Kasme in the AV. The processor 510 then encrypts the first information using PF_enc, wherein the first information includes a discovery key.
  • the processor 510 may further perform integrity protection on the information of the at least first information.
  • the processor 510 generates a fourth key PF_int according to Ks(_int/ext)_NAF or Kasme, and performs complete protection on at least the first information by using PF_int to generate MAC information.
  • the parameters for generating the PF_enc and the PF_int may include the identification information of the remote terminal, the identifier information of the relay terminal, and the identifier of the network device, in addition to the Ks(_int/ext)_NAF or the Kasme. One or more of the information, etc.
  • the first information may further include other information, such as identifier information of the network device, identifier information of the relay terminal, a codeword of the broadcast, and a communication root key of the remote terminal and the relay terminal performing communication. At least one.
  • the discovery key is a root key for restricted discovery
  • the first information may further include how to protect metadata information of the discovery message, such as one of encryption, integrity protection, and scrambling code.
  • metadata information of the discovery message such as one of encryption, integrity protection, and scrambling code.
  • the remote terminal generates an encryption key, an integrity protection key, and a scrambling code key according to the root key.
  • the transmitter 520 transmits the encrypted first information to the remote terminal through the relay terminal.
  • the specific process is: the transmitter 520 will encrypt the first information, GPI information, And the MAC information is sent to the relay terminal, or the transmitter 520 transmits the encrypted first information, the RAND and AUTN in the AV, and the MAC information to the relay terminal, and then the relay terminal transmits the received information to the remote terminal.
  • a key for decrypting the encrypted first information and a key for performing full protection verification on the at least first information are generated according to the GPI or according to the combination of RAND and AUTN in the AV.
  • the network device in the process of establishing a trusted connection between the remote terminal and the relay terminal, sends the discovery key to the legal remote terminal to implement the discovery of the relay terminal by the subsequent remote terminal.
  • the communication for the 1:1 communication between the remote terminal and the relay terminal may be generated as follows.
  • the root key which is used to protect the signaling and data in the communication process between the remote terminal and the relay terminal.
  • the communication root key can be sent to the remote terminal along with the discovery key.
  • the receiver and the memory.
  • the receiver is configured to receive information sent by the device with which it communicates, such as a resume trust relationship request message sent by the relay terminal to the network device.
  • the memory is used to store instructions or data, such as a discovery key.
  • FIG. 6 is a remote terminal according to an embodiment of the present invention.
  • the remote terminal can include a receiver 610 and a processor 620.
  • the receiver 610 is configured to receive a first message sent by the relay terminal, where the first message includes the encrypted first information and the universal bootstrapping information GPI, or the first message includes the encrypted first information and the RAND in the authentication vector AV Information and AUTN information, wherein the first information includes a discovery key.
  • the processor 620 is configured to generate a first key according to the GPI, or the RAND information and the AUTN information, generate a second key based on the first key, and decrypt the encrypted first information by using the second key.
  • the receiver 610 of the remote terminal receives the first message sent by the relay terminal, and the first message may be a response message for establishing a binding request of the trust relationship.
  • the first message includes the encrypted first information, the GPI information, or the first message includes the encrypted first information and RAND and AUTN in the AV.
  • the processor 620 generates a key for decrypting the encrypted first information according to the GPI or according to RAND and AUTN in the AV, and decrypts the encrypted first information to acquire the discovery key.
  • the first message may further include MAC information that performs integrity protection on the information of the at least first information.
  • the processor 620 may further generate a key for integrity verification of information of at least the first information according to the GPI or according to the RAND and the AUTN in the AV, and generate MAC' information based on the key, and the processor 620 according to the received MAC The information is compared with the generated MAC' information to verify the integrity of the information of at least the first information.
  • the processor 620 generates a key for decrypting and encrypting the first information, and input parameters of the key for integrity protection of the information of the at least first information, except for the GPI, or the AV.
  • the processor 620 In addition to the RAND and the AUT, at least one of the identification information of the relay terminal, the identification information of the remote terminal, and the identification information of the network device may be included.
  • the remote terminal may further include a transmitter and a memory.
  • the transmitter is configured to send information to a device that communicates or establishes with the connection, for example, the remote terminal sends a binding request for establishing a trust relationship to the relay terminal.
  • the memory is used to store instructions and data, such as a discovery key.
  • FIG. 7 is a device according to an embodiment of the present invention.
  • the device may include a receiver 710, a processor 720, and a transmitter 730.
  • the receiver 710 is configured to receive a first message sent by the relay terminal, where the first message includes identifier information of the remote terminal.
  • the processor 720 is configured to authenticate the remote terminal by establishing a communication connection by using the relay terminal according to the first message.
  • the processor 720 acquires the root key of the remote terminal.
  • the processor 720 is further configured to generate a first key according to the root key, and encrypt the first information by using the first key, where the first information includes a discovery key.
  • the transmitter 730 is configured to send, by using the relay terminal, the encrypted first information to the remote terminal, so that the remote terminal generates a symmetric key of the first key according to the communication root key of the remote terminal, and uses the symmetricity of the first key.
  • the key decrypts the encrypted first information to obtain the discovery key.
  • the remote terminal After the remote terminal discovers the relay terminals and establishes a trust relationship with each other, the remote terminal sends a communication request message to the relay terminal to establish a communication link between the remote terminal and the relay terminal, and the relay terminal receives the communication request.
  • the first message is sent to the first device, where the first message may be an authentication request message or a key request message, where the message includes the identification information of the remote terminal and the identification information of the relay terminal.
  • the receiver 710 After receiving the first message, the receiver 710 authenticates the remote terminal to establish a communication connection through the relay terminal according to the identification information of the remote terminal in the first message. If the authentication passes, the processor 720 acquires the root density of the remote terminal. key.
  • the root key of the remote terminal may be Ks(_int/ext)_NAF, or Kasme in the eRemote UE security context.
  • the processor 720 generates a key for encrypting the first information according to Ks(_int/ext)_NAF or Kasme, the first information includes a discovery key, and encrypts the first information.
  • the processor 720 may generate, according to Ks(_int/ext)_NAF or Kasme, a communication root key that the remote terminal communicates with the relay terminal, and generate an encryption first according to the communication root key.
  • Ks(_int/ext)_NAF or Kasme a communication root key that the remote terminal communicates with the relay terminal.
  • the processor 720 may generate a communication root key that the remote terminal communicates with the relay terminal according to Ks(_int/ext)_NAF or Kasme, and generate a remote terminal according to the communication root key.
  • the session key communicated with the relay terminal is generated based on the session key.
  • the processor 720 may further generate a key for integrity protection of at least the first information according to Ks(_int/ext)_NAF or Kasme, and generate MAC information.
  • the processor 720 encrypts the first information, and after performing integrity protection on the at least first information, the transmitter 730 sends the encrypted first information, the root key of the remote terminal, and the MAC information to the relay terminal, and then The relay terminal sends the encrypted first information, the root key of the remote terminal, and the MAC information to the remote terminal, so that after the remote terminal receives the information, the encrypted first information is decrypted, and the integrity of at least the first information is completed. Verify, secure your information, and get a discovery key.
  • the discovery key is securely transmitted to the legal remote terminal.
  • the device may be a network device, before the processor acquires the root key of the remote terminal,
  • the receiver 710 is further configured to receive a establish trust connection request message sent by the relay terminal, where the trust connection request message includes the identifier information of the relay terminal and the identifier information of the remote terminal.
  • Processor 720 is based on establishing a trusted connection. The message is authenticated to the remote terminal accessing the network through the relay terminal. If the authentication passes, the processor 720 generates a discovery key.
  • the device may be a mobility management entity MME; the processor 720 encrypts the first information by using a key that encrypts the first information, and the processor uses the integrity of the at least first information.
  • the protected key acquires the discovery key before performing integrity protection on at least the first information.
  • acquiring the discovery key may include:
  • the receiver 710 receives the inserted user data information sent by the home subscription subscriber server HSS, and the insertion user data information includes a discovery key, wherein the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • FIG. 8 is a remote terminal according to an embodiment of the present invention.
  • the remote terminal may include a receiver 810 and a processor 820.
  • the receiver 810 is configured to receive a first message sent by the relay terminal, where the first message includes the encrypted first information, where the first information includes a discovery key.
  • the processor 820 is configured to generate a first key according to the root key, and decrypt the encrypted first information by using the first key to obtain the discovery key.
  • the processor 820 may further generate, according to the root key, a key for performing integrity protection on the first information, and use the key to perform integrity protection on the at least first information.
  • the MAC information is generated to verify the integrity of the information of at least the first information.
  • the processor 820 generates a communication root key for communication between the remote terminal and the relay terminal according to the root key, generates a key for encrypting the first information according to the communication root key, and generates at least The first information is the key for integrity protection.
  • the processor 820 generates a communication root key for communication between the remote terminal and the relay terminal according to the root key, and generates communication for communication between the remote terminal and the relay terminal according to the communication root key.
  • a session key generating a key for encrypting the first information according to the session key, and generating a key for integrity protection of the at least first information.
  • the first message may be a direct security mode command message or a direct communication accept message, and the direct security mode command message or the direct communication accept message includes the discovery key indication information.
  • the remote terminal may further include a transmitter and a memory. When the remote terminal establishes a communication connection with the relay terminal, the transmitter sends a message to establish a connection request to the relay terminal to trigger the relay terminal to establish a communication connection; the memory is used to store instructions and data, such as a discovery key.
  • FIG. 9 is another device according to an embodiment of the present invention.
  • the device may include a receiver 910, a processor 920, and a transmitter 930.
  • the receiver 910 is configured to receive a first message sent by the relay terminal, where the first message includes identifier information of the remote terminal.
  • the processor 920 is configured to authenticate the remote terminal to the network through the relay terminal according to the first message.
  • the transmitter 930 sends a second message to the relay terminal, where the second message includes the first information, where the first information includes a discovery key for the remote terminal to discover the relay terminal, so that the relay terminal will The first information is sent to the remote terminal.
  • the remote terminal After the remote terminal discovers the relay terminals and establishes a trust relationship with each other, the remote terminal sends a communication request message to the relay terminal to establish a communication link between the remote terminal and the relay terminal, and the relay terminal receives the communication request. Message Then, the first message is sent to the first device, where the first message may be an authentication request message or a key request message, where the message includes the identification information of the remote terminal and the identification information of the relay terminal.
  • the processor 920 After receiving the first message, the processor 920 authenticates the remote terminal to establish a communication connection through the relay terminal according to the identification information of the remote terminal in the first message, and if the authentication passes, the transmitter 930 relays the communication.
  • the terminal sends a second message, and the second message is a response message of the first message.
  • the second message includes first information, and the first information includes a discovery key.
  • the relay terminal After receiving the second message, the relay terminal sends the first information including the discovery key in the second message to the remote terminal.
  • the device may be a network device, and before the receiver 910 receives the relay terminal to send the first message, the receiver 910 is further configured to receive the establishment of a trusted connection request sent by the relay terminal.
  • the message establishing the trust connection request message includes the identifier information of the relay terminal and the identifier information of the remote terminal; the processor 920 authenticates the remote terminal accessing the network through the relay terminal according to the establishing trust connection request message; if the authentication is passed, Processor 920 then generates a discovery key.
  • the device is a mobility management entity MME; and before the receiver 910 receives the first message sent by the relay terminal, acquiring the discovery key.
  • acquiring a discovery key includes:
  • the receiver 910 receives the inserted user data information sent by the home subscriber server HSS, and the inserted user data information includes the discovery key, and the HSS obtains the discovery key from the proximity service server or the proximity service key management function PKMF entity.
  • FIG. 10 is a relay terminal according to an embodiment of the present invention.
  • the relay terminal may include a receiver 1010, a processor 1020, and a transmitter 1030.
  • the receiver 1010 is configured to receive, by the first device, a first message, where the first message includes first information, where the first information includes a discovery key used by the remote terminal to discover the relay terminal.
  • the processor 1020 is configured to encrypt the first information by using an encryption key that communicates with the remote terminal.
  • the sender 1030 is configured to send a second message to the remote terminal, where the second message includes the encrypted first information.
  • the processor 1020 after receiving the first information sent by the first device, the processor 1020 encrypts the first information and sends the first information to the remote terminal to ensure the security of the discovery key included in the first information. Sex.
  • the processor 1020 may send the first information to the remote terminal by using a signaling message, such as by using a direct security mode command message, to the remote terminal, where the relay terminal uses the remote terminal and the relay terminal.
  • the integrity protection key of the communication at least performs integrity protection on the first information to generate a MAC, and encrypts the first information using an encryption key communicated by the remote terminal and the relay terminal; the key agreement is completed at the remote terminal and the relay terminal
  • the relay terminal may also send the first information through other signaling plane messages, such as accepting the message through direct communication.
  • the message should be encrypted using the encryption and integrity protection key communicated by the remote terminal with the relay terminal. Integrity protection.
  • the transmitter 1030 transmits the first information to the remote terminal through the user plane data, in which case, The processor 1020 encrypts the first information including the discovery key using an encryption key communicated by the remote terminal with the relay terminal, and at least integrity of the first information using an integrity protection key communicated by the remote terminal with the relay terminal Protect the generated MAC.
  • the remote terminal receives the second message sent by the sender 1030, decrypts the first method according to the existing conventional method.
  • the first information included in the second message acquires the discovery key.
  • the second message may be a direct security mode command message or a direct communication accept message, and the direct security mode command message or the direct communication accept message includes the discovery key indication information.
  • the first device may be a network device or an MME.
  • An embodiment of the present invention further provides a computer program product comprising instructions for performing the method/step of any of the above-described FIGS. 1 to 4 when the instructions are run on a computer.
  • the embodiment of the present invention further provides a computer readable storage medium for storing instructions, when the instructions are executed on a computer, performing the method/step of any of the above-mentioned FIG. 1 to FIG.
  • the present invention may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable medium to another computer readable medium, for example, the computer instructions can be wired from a website site, computer, server or data center (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.) to another website site, computer, server or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state hard disk) or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Les modes de réalisation de la présente invention se rapportent à un procédé et un dispositif de transmission de clé. Le procédé comprend les étapes suivantes : un dispositif de réseau obtient une clé de découverte pour un terminal distant permettant de découvrir un terminal de relais; l'acquisition d'une première clé et d'informations de poussée d'architecture d'amorçage générique (GPI), ou l'acquisition d'un vecteur d'authentification (AV); générer une troisième clé selon la première clé ou une deuxième clé dans l'AV, et chiffrer des premières informations en utilisant la troisième clé, les premières informations comprenant la clé de découverte; envoyer les premières informations chiffrées et le GPI au terminal distant au moyen du terminal relais, ou envoyer les premières informations chiffrées et les informations RAND et les informations AUTN dans l'AV au terminal distant au moyen du terminal relais, les informations GPI ou RAND et les informations AUTN dans l'AV étant utilisées par le terminal distant pour générer une clé symétrique de la troisième clé; et déchiffrer les premières informations chiffrées en utilisant la clé symétrique de la troisième clé pour acquérir la clé de découverte. Au moyen de cette solution, la clé de découverte est envoyée de manière sécurisée à un terminal distant légitime.
PCT/CN2017/101890 2017-09-15 2017-09-15 Procédé et dispositif de transmission de clé WO2019051776A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201780082724.7A CN110192381B (zh) 2017-09-15 2017-09-15 密钥的传输方法及设备
PCT/CN2017/101890 WO2019051776A1 (fr) 2017-09-15 2017-09-15 Procédé et dispositif de transmission de clé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/101890 WO2019051776A1 (fr) 2017-09-15 2017-09-15 Procédé et dispositif de transmission de clé

Publications (1)

Publication Number Publication Date
WO2019051776A1 true WO2019051776A1 (fr) 2019-03-21

Family

ID=65723163

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/101890 WO2019051776A1 (fr) 2017-09-15 2017-09-15 Procédé et dispositif de transmission de clé

Country Status (2)

Country Link
CN (1) CN110192381B (fr)
WO (1) WO2019051776A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113382454A (zh) * 2020-02-24 2021-09-10 华为技术有限公司 一种通信方法与装置
WO2022067841A1 (fr) * 2020-10-01 2022-04-07 华为技术有限公司 Procédé, appareil et système de communication sécurisée
WO2023205978A1 (fr) * 2022-04-24 2023-11-02 北京小米移动软件有限公司 Procédé et appareil de génération de clé pour service basé sur la proximité, et dispositif et support de stockage
WO2024020868A1 (fr) * 2022-07-27 2024-02-01 北京小米移动软件有限公司 Procédé et appareil de génération de clés, dispositif de communication, et support de stockage

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114339622B (zh) * 2020-09-29 2022-09-23 大唐移动通信设备有限公司 一种ProSe通信组的通信方法、装置及存储介质
CN114915407A (zh) * 2021-02-10 2022-08-16 大唐移动通信设备有限公司 Pc5根密钥处理方法、装置、ausf及远程终端
WO2023155192A1 (fr) * 2022-02-21 2023-08-24 Zte Corporation Procédé de sécurité de relais d'un ue à un réseau dans des services basés sur la proximité
CN115152254A (zh) * 2022-04-02 2022-10-04 北京小米移动软件有限公司 中继通信方法、装置、通信设备及存储介质
WO2023197178A1 (fr) * 2022-04-12 2023-10-19 北京小米移动软件有限公司 Procédés de traitement d'informations, appareil, dispositif de communication et support de stockage
WO2023212903A1 (fr) * 2022-05-06 2023-11-09 Oppo广东移动通信有限公司 Procédé de communication par relais, et dispositif
CN117597957A (zh) * 2022-06-16 2024-02-23 北京小米移动软件有限公司 信息处理方法及装置、通信设备及存储介质
KR20240110596A (ko) * 2022-06-20 2024-07-15 지티이 코포레이션 근접 기반 서비스를 위한 인증 키 리프레싱

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043328A (zh) * 2006-03-24 2007-09-26 华为技术有限公司 通用引导框架中密钥更新方法
WO2017027056A1 (fr) * 2015-08-11 2017-02-16 Intel IP Corporation Découverte directe sécurisée entre des équipements d'utilisateur
CN107046689A (zh) * 2017-05-08 2017-08-15 北京工业大学 一种轻量级的ble可穿戴设备安全认证方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101640887B (zh) * 2008-07-29 2012-10-03 上海华为技术有限公司 鉴权方法、通信装置和通信系统
CN105592433B (zh) * 2014-10-20 2019-12-17 中兴通讯股份有限公司 设备到设备限制发现业务广播、监听方法、装置及系统
CN104540106B (zh) * 2015-01-13 2019-02-12 中兴通讯股份有限公司 发现业务码的校验处理、校验方法及装置
US10142769B2 (en) * 2015-01-14 2018-11-27 Samsung Electronics Co., Ltd. Method and system for establishing a secure communication between remote UE and relay UE in a device to device communication network
US9979730B2 (en) * 2015-10-30 2018-05-22 Futurewei Technologies, Inc. System and method for secure provisioning of out-of-network user equipment
CN106714151B (zh) * 2017-03-07 2020-04-28 北京邮电大学 信息传输方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043328A (zh) * 2006-03-24 2007-09-26 华为技术有限公司 通用引导框架中密钥更新方法
WO2017027056A1 (fr) * 2015-08-11 2017-02-16 Intel IP Corporation Découverte directe sécurisée entre des équipements d'utilisateur
CN107046689A (zh) * 2017-05-08 2017-08-15 北京工业大学 一种轻量级的ble可穿戴设备安全认证方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on Security Architecture Enhancements to ProSe UE-to-Network Relay (Release 15)", 3GPP TR 33.843 0.2.0, 31 August 2017 (2017-08-31), XP051336128 *
HUAWEI: "Enhancement of Setting Up Connection Between eRemote UE and eRelay UE", 3GPP TSG SA WG3 (SECURITY) MEETING #88 S3-171981, 11 August 2017 (2017-08-11), XP051311086 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113382454A (zh) * 2020-02-24 2021-09-10 华为技术有限公司 一种通信方法与装置
CN113382454B (zh) * 2020-02-24 2023-11-17 华为技术有限公司 一种通信方法与装置
WO2022067841A1 (fr) * 2020-10-01 2022-04-07 华为技术有限公司 Procédé, appareil et système de communication sécurisée
WO2023205978A1 (fr) * 2022-04-24 2023-11-02 北京小米移动软件有限公司 Procédé et appareil de génération de clé pour service basé sur la proximité, et dispositif et support de stockage
WO2024020868A1 (fr) * 2022-07-27 2024-02-01 北京小米移动软件有限公司 Procédé et appareil de génération de clés, dispositif de communication, et support de stockage

Also Published As

Publication number Publication date
CN110192381B (zh) 2021-02-09
CN110192381A (zh) 2019-08-30

Similar Documents

Publication Publication Date Title
CN110192381B (zh) 密钥的传输方法及设备
TWI451735B (zh) 用於在通訊系統中將用戶認證與設備認證結合的方法和裝置
KR101350538B1 (ko) 직접 링크 통신의 향상된 보안
JP4649513B2 (ja) 無線携帯インターネットシステムの認証方法及び関連キー生成方法
US20190199532A1 (en) Authentication method, authentication apparatus, and authentication system
WO2022111187A1 (fr) Procédé et appareil d'authentification de terminal, dispositif informatique et support de stockage
US20100211790A1 (en) Authentication
CN108353279B (zh) 一种认证方法和认证系统
CN105553981B (zh) 一种wlan网络快速认证和密钥协商方法
KR101706117B1 (ko) 휴대용 단말기에서 다른 휴대용 단말기를 인증하는 장치 및 방법
US11909869B2 (en) Communication method and related product based on key agreement and authentication
US8819415B2 (en) Method and device for authenticating personal network entity
JP2012217207A (ja) 鍵マテリアルの交換
WO2014180198A1 (fr) Procédé, système et dispositif d'accès d'un terminal et support de stockage informatique
JP6807153B2 (ja) セキュアな聴覚装置の通信のための装置および関係する方法
US12010105B2 (en) Control method, apparatus, and system
WO2015100974A1 (fr) Procédé, dispositif et système d'authentification de terminal
CN101895882A (zh) 一种WiMAX系统中的数据传输方法、系统及装置
US20200120495A1 (en) Mitigation of problems arising from sim key leakage
WO2023083170A1 (fr) Procédé et appareil de génération de clé, dispositif terminal et serveur
JP2007506329A (ja) Ｗｌａｎセキュリティを向上させる方法
CN104243452A (zh) 一种云计算访问控制方法及系统
KR101172876B1 (ko) 사용자 단말기와 서버 간의 상호 인증 방법 및 시스템
WO2016112860A1 (fr) Procédé de communication pour dispositif sans fil, dispositif sans fil et serveur
WO2016176902A1 (fr) Procédé d'authentification de terminal, terminal de gestion et terminal d'application

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17924916

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17924916

Country of ref document: EP

Kind code of ref document: A1