WO2020155138A1

WO2020155138A1 - Techniques for encrypting groupcast wireless communications

Info

Publication number: WO2020155138A1
Application number: PCT/CN2019/074554
Authority: WO
Inventors: Yiqing Cao; Zhimin Du; Yan Li; Shuping Chen
Original assignee: Qualcomm Incorporated
Priority date: 2019-02-02
Filing date: 2019-02-02
Publication date: 2020-08-06

Abstract

Aspects described herein relate to associating with a group of devices for sidelink communications among the devices, obtaining an encryption key for communicating with the group of devices, wherein obtaining the encryption key includes at least one of receiving the encryption key from a base station or from another device in the group of devices, or generating the encryption key, and encrypting or decrypting a sidelink communication based on the encryption key.

Description

TECHNIQUES FOR ENCRYPTING GROUPCAST WIRELESS COMMUNICATIONS

BACKGROUND

Aspects of the present disclosure relate generally to wireless communication systems, and more particularly, to encrypting communications between groups of devices.

Wireless communication systems are widely deployed to provide various types of communication content such as voice, video, packet data, messaging, broadcast, and so on. These systems may be multiple-access systems capable of supporting communication with multiple users by sharing the available system resources (e.g., time, frequency, and power) . Examples of such multiple-access systems include code-division multiple access (CDMA) systems, time-division multiple access (TDMA) systems, frequency-division multiple access (FDMA) systems, and orthogonal frequency-division multiple access (OFDMA) systems, and single-carrier frequency division multiple access (SC-FDMA) systems.

These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate on a municipal, national, regional, and even global level. For example, a fifth generation (5G) wireless communications technology (which can be referred to as 5G new radio (5G NR) ) is envisaged to expand and support diverse usage scenarios and applications with respect to current mobile network generations. In an aspect, 5G communications technology can include: enhanced mobile broadband addressing human-centric use cases for access to multimedia content, services and data; ultra-reliable-low latency communications (URLLC) with certain specifications for latency and reliability; and massive machine type communications, which can allow a very large number of connected devices and transmission of a relatively low volume of non-delay-sensitive information.

In some wireless communication technologies, devices can communicate in groups over a sidelink channel. The group communications may include device-to-device (D2D) communications, such as vehicle-to-vehicle (V2V) or vehicle-to-anything (V2X) communications. In long term evolution (LTE) V2V, certificate-based security communication can be enabled where a device can send data with a certificate and digital signature, in each transmission, for trust verification by a receiving device. This mechanism may not be desirable for securing communications among groups of devices.

SUMMARY

The following presents a simplified summary of one or more aspects in order to provide a basic understanding of such aspects. This summary is not an extensive overview of all contemplated aspects, and is intended to neither identify key or critical elements of all aspects nor delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to the more detailed description that is presented later.

According to an example, a method of wireless communication is provided. The method includes associating with a group of devices for sidelink communications among the devices, obtaining an encryption key for communicating with the group of devices, where obtaining the encryption key comprises at least one of receiving the encryption key from a base station or from another device in the group of devices, or generating the encryption key, and also encrypting or decrypting a sidelink communication based on the encryption key.

In another example, a method for wireless communications is provided. The method includes determining an association of a group of devices for transmitting sidelink communications with one another, generating an encryption key for the group of devices to use in securing sidelink communications, and transmitting the encryption key to one or more devices in the group of devices.

In another example, an apparatus for wireless communication is provided that includes a transceiver, a memory configured to store instructions, and one or more processors communicatively coupled with the transceiver and the memory. The one or more processors are configured to associate with a group of devices for sidelink communications among the devices, obtain an encryption key for communicating with the group of devices at least in part by at least one of receiving the encryption key from a base station or from another device in the group of devices, or generating the encryption key, and also to encrypt or decrypt a sidelink communication based on the encryption key.

In another example, an apparatus for wireless communication is provided that includes a transceiver, a memory configured to store instructions, and one or more processors communicatively coupled with the transceiver and the memory. The one or more processors are configured to determine an association of a group of devices for transmitting sidelink communications with one another, generate an encryption key for the group of devices to use in securing sidelink communications, and transmit the encryption key to one or more devices in the group of devices.

In another example, an apparatus for wireless communication is provided that includes means for associating with a group of devices for sidelink communications among the devices, means for obtaining an encryption key for communicating with the group of devices at least in part by at least one of receiving the encryption key from a base station or from another device in the group of devices, or generating the encryption key, and means for encrypting or decrypting a sidelink communication based on the encryption key.

In another example, an apparatus for wireless communication is provided that includes means for determining an association of a group of devices for transmitting sidelink communications with one another, means for generating an encryption key for the group of devices to use in securing sidelink communications, and means for transmitting the encryption key to one or more devices in the group of devices.

In another example, a computer-readable medium inclduding code executable by a process for wireless communications is provided. The code includes code for associating with a group of devices for sidelink communications among the devices, code for obtaining an encryption key for communicating with the group of devices at least in part by at least one of receiving the encryption key from a base station or from another device in the group of devices, or generating the encryption key, and code for encrypting or decrypting a sidelink communication based on the encryption key.

In another example, a computer-readable medium inclduding code executable by a process for wireless communications is provided. The code includes code for determining an association of a group of devices for transmitting sidelink communications with one another, code for generating an encryption key for the group of devices to use in securing sidelink communications, and code for transmitting the encryption key to one or more devices in the group of devices.

To the accomplishment of the foregoing and related ends, the one or more aspects comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the annexed drawings set forth in detail certain illustrative features of the one or more aspects. These features are indicative, however, of but a few of the various ways in which the principles of various aspects may be employed, and this description is intended to include all such aspects and their equivalents.

BRIEF DESCRIPTION OF THE DRAWINGS

The disclosed aspects will hereinafter be described in conjunction with the appended drawings, provided to illustrate and not to limit the disclosed aspects, wherein like designations denote like elements, and in which:

FIG. 1 illustrates an example of a wireless communication system, in accordance with various aspects of the present disclosure;

FIG. 2 is a block diagram illustrating an example of a UE, in accordance with various aspects of the present disclosure;

FIG. 3 is a block diagram illustrating an example of a base station, in accordance with various aspects of the present disclosure;

FIGs. 4A and 4B include a flow chart illustrating an example of a method for securing sidelink communications, in accordance with various aspects of the present disclosure;

FIG. 5 is a flow chart illustrating an example of providing information for securing sidelink communications, in accordance with various aspects of the present disclosure; and

FIG. 6 is a block diagram illustrating an example of a MIMO communication system including a base station and a UE, in accordance with various aspects of the present disclosure.

DETAILED DESCRIPTION

Various aspects are now described with reference to the drawings. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It may be evident, however, that such aspect (s) may be practiced without these specific details.

The concepts are generally described herein with respect to device-to-device (D2D) communication technologies. For example, D2D communication technologies can include vehicle-to-vehicle (V2V) communications, vehicle-to-infrastructure (V2I) communications (e.g., from a vehicle-based communication device to road infrastructure nodes) , vehicle-to-network (V2N) communications (e.g., from a vehicle-based communication device to one or more network nodes, such as a base station) , a combination thereof and/or with other devices, which can be collectively referred to as vehicle-to-anything (V2X) communications. In V2X communications, vehicle-based communication devices can communicate with one another and/or with infrastructure devices over a sidelink channel. Continued support and implementation of V2X communications is provided in fifth generation (5G) new radio (NR) communication technologies, as well as long term evolution (LTE) . Though aspects are generally described herein in terms of D2D/V2X communications, the concepts and techniques can be similarly applied more generally to substantially any type of wireless communications.

The described features generally relate to providing encryption to secure group cast wireless communications, where group cast communications can include substantially any communications transmitted in a group of devices (e.g., communications transmitted by one device to one or more other devices that are associated in a group) . For example, group cast communications can include D2D and/or V2X sidelink communications among devices that may be of a similar or different type (e.g., a communication from one vehicle to one or more other vehicles or V2I infrastructure nodes, a communication from one device transmitted D2D to multiple other devices) , etc., and/or the devices in the group may have some group association with one another. For example, sidelink channel communications are described herein, although the concepts can be similarly applied to any group cast communications to achieve the desired functionality.

As described, for example, LTE V2V, which is broadcast, can support certificate-based security communication. Where a vehicle (e.g., a vehicle-based UE) sends out the data with certificate and digital signature, and a receiving device (e.g., a receiving vehicle-based UE or other V2X infrastructure node) can verify the certificate and the digital signature to decide whether or not to trust the data based on the verification results. Platooning communication within a group, however, may also benefit from confidentiality, while the cleartext with the sender’s certificate cannot encrypt the data and be decryptable by other devices in the group.

Accordingly, various encryption mechanisms are described herein to facilitate encrypting group cast communications. In one symmetric encryption example, the network can assign an encryption key (or keys) to the group member devices for group communication (e.g., which may be for both group cast and unicast among members) . In another symmetric encryption example, a member device in the group can randomly generate a Session Encryption Key from a Group Root Key for multicasting messages. The key material to derive the Session Encryption Key can be ciphered and can also be multicasted in the messages. In another symmetric encryption example, a member device in the group can randomly generate a Session Encryption Key, which can be ciphered with a Group Public Key and also multicasted in the messages. In an asymmetric encryption example, group communication messages can be ciphered with a Group Public Key, such that the messages can be decrypted with a corresponding Group Private Key that is only known to the group member devices. In the above examples using the Group Public Key and the Group Private Key, these keys can remain unchanged during a lifetime of the group, dynamically changed per certain rules, and/or the like, as further described herein.

The described features will be presented in more detail below with reference to FIGS. 1-6.

As used in this application, the terms “component, ” “module, ” “system” and the like are intended to include a computer-related entity, such as but not limited to hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a computing device and the computing device can be a component. One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers. In addition, these components can execute from various computer readable media having various data structures stored thereon. The components can communicate by way of local and/or remote processes such as in accordance with a signal having one or more data packets, such as data from one component interacting with another component in a local system, distributed system, and/or across a network such as the Internet with other systems by way of the signal.

Techniques described herein may be used for various wireless communication systems such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, and other systems. The terms “system” and “network” may often be used interchangeably. A CDMA system may implement a radio technology such as CDMA2000, Universal Terrestrial Radio Access (UTRA) , etc. CDMA2000 covers IS-2000, IS-95, and IS-856 standards. IS-2000 Releases 0 and A are commonly referred to as CDMA2000 1X, 1X, etc. IS-856 (TIA-856) is commonly referred to as CDMA2000 1xEV-DO, High Rate Packet Data (HRPD) , etc. UTRA includes Wideband CDMA (WCDMA) and other variants of CDMA. A TDMA system may implement a radio technology such as Global System for Mobile Communications (GSM) . An OFDMA system may implement a radio technology such as Ultra Mobile Broadband (UMB) , Evolved UTRA (E-UTRA) , IEEE 802.11 (Wi-Fi) , IEEE 802.16 (WiMAX) , IEEE 802.20, Flash-OFDM ^TM, etc. UTRA and E-UTRA are part of Universal Mobile Telecommunication System (UMTS) . 3GPP Long Term Evolution (LTE) and LTE-Advanced (LTE-A) are new releases of UMTS that use E-UTRA. UTRA, E-UTRA, UMTS, LTE, LTE-A, and GSM are described in documents from an organization named “3rd Generation Partnership Project” (3GPP) . CDMA2000 and UMB are described in documents from an organization named “3rd Generation Partnership Project 2” (3GPP2) . The techniques described herein may be used for the systems and radio technologies mentioned above as well as other systems and radio technologies, including cellular (e.g., LTE) communications over a shared radio frequency spectrum band. The description below, however, describes an LTE/LTE-Asystem for purposes of example, and LTE terminology is used in much of the description below, although the techniques are applicable beyond LTE/LTE-Aapplications (e.g., to fifth generation (5G) new radio (NR) networks or other next generation communication systems) .

The following description provides examples, and is not limiting of the scope, applicability, or examples set forth in the claims. Changes may be made in the function and arrangement of elements discussed without departing from the scope of the disclosure. Various examples may omit, substitute, or add various procedures or components as appropriate. For instance, the methods described may be performed in an order different from that described, and various steps may be added, omitted, or combined. Also, features described with respect to some examples may be combined in other examples.

Various aspects or features will be presented in terms of systems that can include a number of devices, components, modules, and the like. It is to be understood and appreciated that the various systems can include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. A combination of these approaches can also be used.

FIG. 1 is a diagram illustrating an example of a wireless communications system and an access network 100. The wireless communications system (also referred to as a wireless wide area network (WWAN) ) can include base stations 102, UEs 104, an Evolved Packet Core (EPC) 160, and/or a 5G Core (5GC) 190. The base stations 102 may include macro cells (high power cellular base station) and/or small cells (low power cellular base station) . The macro cells can include base stations. The small cells can include femtocells, picocells, and microcells. In an example, the base stations 102 may also include gNBs 180, as described further herein. In one example, some nodes of the wireless communication system may have a modem 240 and communicating component 242 for receiving multiple SR configurations, and some nodes may have a modem 340 and scheduling component 342 for configuring multiple SR configurations, as described herein. Though a UE 104 is shown as having the modem 240 and communicating component 242 and a base station 102/gNB 180 is shown as having the modem 340 and scheduling component 342, this is one illustrative example, and substantially any node or type of node may include a modem 240 and communicating component 242 and/or a modem 340 and scheduling component 342 for providing corresponding functionalities described herein.

The base stations 102 configured for 4G LTE (which can collectively be referred to as Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN) ) may interface with the EPC 160 through backhaul links 132 (e.g., using an S1 interface) . The base stations 102 configured for 5G NR (which can collectively be referred to as Next Generation RAN (NG-RAN) ) may interface with 5GC 190 through backhaul links 184. In addition to other functions, the base stations 102 may perform one or more of the following functions: transfer of user data, radio channel ciphering and deciphering, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity) , inter-cell interference coordination, connection setup and release, load balancing, distribution for non-access stratum (NAS) messages, NAS node selection, synchronization, radio access network (RAN) sharing, multimedia broadcast multicast service (MBMS) , subscriber and equipment trace, RAN information management (RIM) , paging, positioning, and delivery of warning messages. The base stations 102 may communicate directly or indirectly (e.g., through the EPC 160 or 5GC 190) with each other over backhaul links 134 (e.g., using an X2 interface) . The backhaul links 134 may be wired or wireless.

The base stations 102 may wirelessly communicate with one or more UEs 104. Each of the base stations 102 may provide communication coverage for a respective geographic coverage area 110. There may be overlapping geographic coverage areas 110. For example, the small cell 102' may have a coverage area 110' that overlaps the coverage area 110 of one or more macro base stations 102. A network that includes both small cell and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include Home Evolved Node Bs (eNBs) (HeNBs) , which may provide service to a restricted group, which can be referred to as a closed subscriber group (CSG) . The communication links 120 between the base stations 102 and the UEs 104 may include uplink (UL) (also referred to as reverse link) transmissions from a UE 104 to a base station 102 and/or downlink (DL) (also referred to as forward link) transmissions from a base station 102 to a UE 104. The communication links 120 may use multiple-input and multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming, and/or transmit diversity. The communication links may be through one or more carriers. The base stations 102 /UEs 104 may use spectrum up to Y MHz (e.g., 5, 10, 15, 20, 100, 400, etc. MHz) bandwidth per carrier allocated in a carrier aggregation of up to a total of Yx MHz (e.g., for x component carriers) used for transmission in the DL and/or the UL direction. The carriers may or may not be adjacent to each other. Allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or less carriers may be allocated for DL than for UL) . The component carriers may include a primary component carrier and one or more secondary component carriers. A primary component carrier may be referred to as a primary cell (PCell) and a secondary component carrier may be referred to as a secondary cell (SCell) .

In another example, certain UEs 104 may communicate with each other using device-to-device (D2D) communication link 158. The D2D communication link 158 may use the DL/UL WWAN spectrum. The D2D communication link 158 may use one or more sidelink channels, such as a physical sidelink broadcast channel (PSBCH) , a physical sidelink discovery channel (PSDCH) , a physical sidelink shared channel (PSSCH) , and a physical sidelink control channel (PSCCH) . D2D communication may be through a variety of wireless D2D communications systems, such as for example, FlashLinQ, WiMedia, Bluetooth, ZigBee, Wi-Fi based on the IEEE 802.11 standard, LTE, or NR.

The wireless communications system may further include a Wi-Fi access point (AP) 150 in communication with Wi-Fi stations (STAs) 152 via communication links 154 in a 5 GHz unlicensed frequency spectrum. When communicating in an unlicensed frequency spectrum, the STAs 152 /AP 150 may perform a clear channel assessment (CCA) prior to communicating in order to determine whether the channel is available.

The small cell 102' may operate in a licensed and/or an unlicensed frequency spectrum. When operating in an unlicensed frequency spectrum, the small cell 102' may employ NR and use the same 5 GHz unlicensed frequency spectrum as used by the Wi-Fi AP 150. The small cell 102' , employing NR in an unlicensed frequency spectrum, may boost coverage to and/or increase capacity of the access network.

A base station 102, whether a small cell 102' or a large cell (e.g., macro base station) , may include an eNB, gNodeB (gNB) , or other type of base station. Some base stations, such as gNB 180 may operate in a traditional sub 6 GHz spectrum, in millimeter wave (mmW) frequencies, and/or near mmW frequencies in communication with the UE 104. When the gNB 180 operates in mmW or near mmW frequencies, the gNB 180 may be referred to as an mmW base station. Extremely high frequency (EHF) is part of the RF in the electromagnetic spectrum. EHF has a range of 30 GHz to 300 GHz and a wavelength between 1 millimeter and 10 millimeters. Radio waves in the band may be referred to as a millimeter wave. Near mmW may extend down to a frequency of 3 GHz with a wavelength of 100 millimeters. The super high frequency (SHF) band extends between 3 GHz and 30 GHz, also referred to as centimeter wave. Communications using the mmW /near mmW radio frequency band has extremely high path loss and a short range. The mmW base station 180 may utilize beamforming 182 with the UE 104 to compensate for the extremely high path loss and short range. A base station 102 referred to herein can include a gNB 180.

The EPC 160 may include a Mobility Management Entity (MME) 162, other MMEs 164, a Serving Gateway 166, a Multimedia Broadcast Multicast Service (MBMS) Gateway 168, a Broadcast Multicast Service Center (BM-SC) 170, and a Packet Data Network (PDN) Gateway 172. The MME 162 may be in communication with a Home Subscriber Server (HSS) 174. The MME 162 is the control node that processes the signaling between the UEs 104 and the EPC 160. Generally, the MME 162 provides bearer and connection management. All user Internet protocol (IP) packets are transferred through the Serving Gateway 166, which itself is connected to the PDN Gateway 172. The PDN Gateway 172 provides UE IP address allocation as well as other functions. The PDN Gateway 172 and the BM-SC 170 are connected to the IP Services 176. The IP Services 176 may include the Internet, an intranet, an IP Multimedia Subsystem (IMS) , a PS Streaming Service, and/or other IP services. The BM-SC 170 may provide functions for MBMS user service provisioning and delivery. The BM-SC 170 may serve as an entry point for content provider MBMS transmission, may be used to authorize and initiate MBMS Bearer Services within a public land mobile network (PLMN) , and may be used to schedule MBMS transmissions. The MBMS Gateway 168 may be used to distribute MBMS traffic to the base stations 102 belonging to a Multicast Broadcast Single Frequency Network (MBSFN) area broadcasting a particular service, and may be responsible for session management (start/stop) and for collecting eMBMS related charging information.

The 5GC 190 may include a Access and Mobility Management Function (AMF) 192, other AMFs 193, a Session Management Function (SMF) 194, and a User Plane Function (UPF) 195. The AMF 192 may be in communication with a Unified Data Management (UDM) 196. The AMF 192 can be a control node that processes the signaling between the UEs 104 and the 5GC 190. Generally, the AMF 192 can provide QoS flow and session management. User Internet protocol (IP) packets (e.g., from one or more UEs 104) can be transferred through the UPF 195. The UPF 195 can provide UE IP address allocation for one or more UEs, as well as other functions. The UPF 195 is connected to the IP Services 197. The IP Services 197 may include the Internet, an intranet, an IP Multimedia Subsystem (IMS) , a PS Streaming Service, and/or other IP services.

The base station may also be referred to as a gNB, Node B, evolved Node B (eNB) , an access point, a base transceiver station, a radio base station, a radio transceiver, a transceiver function, a basic service set (BSS) , an extended service set (ESS) , a transmit reception point (TRP) , or some other suitable terminology. The base station 102 provides an access point to the EPC 160 or 5GC 190 for a UE 104. Examples of UEs 104 include a cellular phone, a smart phone, a session initiation protocol (SIP) phone, a laptop, a personal digital assistant (PDA) , a satellite radio, a global positioning system, a multimedia device, a video device, a digital audio player (e.g., MP3 player) , a camera, a game console, a tablet, a smart device, a wearable device, a vehicle, an electric meter, a gas pump, a large or small kitchen appliance, a healthcare device, an implant, a sensor/actuator, a display, or any other similar functioning device. Some of the UEs 104 may be referred to as IoT devices (e.g., parking meter, gas pump, toaster, vehicles, heart monitor, etc. ) . The UE 104 may also be referred to as a station, a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communications device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, a client, or some other suitable terminology.

In an example, referring to the D2D communications described above, where the devices are vehicles or otherwise vehicle-based, the D2D communications between the devices (e.g., over a sidelink channel of communication link 158) can be referred to as V2V communications, which are defined for 3GPP LTE and are being defined for 5G NR. When the vehicles or vehicle-based devices communicate with other infrastructure nodes for the vehicle-based communications (e.g., over the sidelink) , this can be referred to as V2I communications. When the vehicles or vehicle-based devices communicate with a base station 102 or other network node (e.g., over a communication link 120) , this can be referred to as V2N communications. The collection of V2V, V2I, V2N, and/or vehicle-to-anything else can be referred to as V2X communications. In an example, LTE can support V2X communications (referred to as “LTE-V2X” ) for safety messages communicated between vehicles and/or from vehicles to infrastructure. 5G NR can also support V2X (referred to as “NR-V2X” ) for communications related to autonomous driving. For example, sidelink V2X communications may occur in a dedicated portion of spectrum such as the 5.9 GHz dedicated short range communications (DSRC) bandwidth reserved for vehicle communications.

In aspects described herein, UE 104 can include a modem 240 for communicating with other UEs and/or base stations in a wireless network. UE 104 can include a communicating component 242 for transmitting or receiving V2X (or more generally D2D) communications to/from one or more other UEs 104 over a sidelink channel, or other group cast communications. As described herein, the communicating component 242 may be configured to obtain an encryption key for securing (e.g., encrypting and/or decrypting) the sidelink channel communications. In addition, for example, the base station 102 can also include a modem 340 for communicating with UEs, and a scheduling component 342, which can, in some examples, assist in providing information related to the encryption key for the group of UEs for securing the sidelink channel communications.

Turning now to FIGS. 2-6, aspects are depicted with reference to one or more components and one or more methods that may perform the actions or operations described herein, where aspects in dashed line may be optional. Although the operations described below in FIGS. 4-5 are presented in a particular order and/or as being performed by an example component, it should be understood that the ordering of the actions and the components performing the actions may be varied, depending on the implementation. Moreover, it should be understood that the following actions, functions, and/or described components may be performed by a specially-programmed processor, a processor executing specially-programmed software or computer-readable media, or by any other combination of a hardware component and/or a software component capable of performing the described actions or functions.

Referring to FIG. 2, one example of an implementation of UE 104 may include a variety of components, some of which have already been described above and are described further herein, including components such as one or more processors 212 and memory 216 and transceiver 202 in communication via one or more buses 244, which may operate in conjunction with modem 240 and/or communicating component 242 to secure sidelink communications.

In an aspect, the one or more processors 212 can include a modem 240 and/or can be part of the modem 240 that uses one or more modem processors. Thus, the various functions related to communicating component 242 may be included in modem 240 and/or processors 212 and, in an aspect, can be executed by a single processor, while in other aspects, different ones of the functions may be executed by a combination of two or more different processors. For example, in an aspect, the one or more processors 212 may include any one or any combination of a modem processor, or a baseband processor, or a digital signal processor, or a transmit processor, or a receiver processor, or a transceiver processor associated with transceiver 202. In other aspects, some of the features of the one or more processors 212 and/or modem 240 associated with communicating component 242 may be performed by transceiver 202.

Also, memory 216 may be configured to store data used herein and/or local versions of applications 275 or communicating component 242 and/or one or more of its subcomponents being executed by at least one processor 212. Memory 216 can include any type of computer-readable medium usable by a computer or at least one processor 212, such as random access memory (RAM) , read only memory (ROM) , tapes, magnetic discs, optical discs, volatile memory, non-volatile memory, and any combination thereof. In an aspect, for example, memory 216 may be a non-transitory computer-readable storage medium that stores one or more computer-executable codes defining communicating component 242 and/or one or more of its subcomponents, and/or data associated therewith, when UE 104 is operating at least one processor 212 to execute communicating component 242 and/or one or more of its subcomponents.

Transceiver 202 may include at least one receiver 206 and at least one transmitter 208. Receiver 206 may include hardware, firmware, and/or software code executable by a processor for receiving data, the code comprising instructions and being stored in a memory (e.g., computer-readable medium) . Receiver 206 may be, for example, a radio frequency (RF) receiver. In an aspect, receiver 206 may receive signals transmitted by at least one base station 102. Additionally, receiver 206 may process such received signals, and also may obtain measurements of the signals, such as, but not limited to, Ec/Io, signal-to-noise ratio (SNR) , reference signal received power (RSRP) , received signal strength indicator (RSSI) , etc. Transmitter 208 may include hardware, firmware, and/or software code executable by a processor for transmitting data, the code comprising instructions and being stored in a memory (e.g., computer-readable medium) . A suitable example of transmitter 208 may including, but is not limited to, an RF transmitter.

Moreover, in an aspect, UE 104 may include RF front end 288, which may operate in communication with one or more antennas 265 and transceiver 202 for receiving and transmitting radio transmissions, for example, wireless communications transmitted by at least one base station 102 or wireless transmissions transmitted by UE 104. RF front end 288 may be connected to one or more antennas 265 and can include one or more low-noise amplifiers (LNAs) 290, one or more switches 292, one or more power amplifiers (PAs) 298, and one or more filters 296 for transmitting and receiving RF signals.

In an aspect, LNA 290 can amplify a received signal at a desired output level. In an aspect, each LNA 290 may have a specified minimum and maximum gain values. In an aspect, RF front end 288 may use one or more switches 292 to select a particular LNA 290 and its specified gain value based on a desired gain value for a particular application.

Further, for example, one or more PA (s) 298 may be used by RF front end 288 to amplify a signal for an RF output at a desired output power level. In an aspect, each PA 298 may have specified minimum and maximum gain values. In an aspect, RF front end 288 may use one or more switches 292 to select a particular PA 298 and its specified gain value based on a desired gain value for a particular application.

Also, for example, one or more filters 296 can be used by RF front end 288 to filter a received signal to obtain an input RF signal. Similarly, in an aspect, for example, a respective filter 296 can be used to filter an output from a respective PA 298 to produce an output signal for transmission. In an aspect, each filter 296 can be connected to a specific LNA 290 and/or PA 298. In an aspect, RF front end 288 can use one or more switches 292 to select a transmit or receive path using a specified filter 296, LNA 290, and/or PA 298, based on a configuration as specified by transceiver 202 and/or processor 212.

As such, transceiver 202 may be configured to transmit and receive wireless signals through one or more antennas 265 via RF front end 288. In an aspect, transceiver may be tuned to operate at specified frequencies such that UE 104 can communicate with, for example, one or more base stations 102 or one or more cells associated with one or more base stations 102. In an aspect, for example, modem 240 can configure transceiver 202 to operate at a specified frequency and power level based on the UE configuration of the UE 104 and the communication protocol used by modem 240.

In an aspect, modem 240 can be a multiband-multimode modem, which can process digital data and communicate with transceiver 202 such that the digital data is sent and received using transceiver 202. In an aspect, modem 240 can be multiband and be configured to support multiple frequency bands for a specific communications protocol. In an aspect, modem 240 can be multimode and be configured to support multiple operating networks and communications protocols. In an aspect, modem 240 can control one or more components of UE 104 (e.g., RF front end 288, transceiver 202) to enable transmission and/or reception of signals from the network based on a specified modem configuration. In an aspect, the modem configuration can be based on the mode of the modem and the frequency band in use. In another aspect, the modem configuration can be based on UE configuration information associated with UE 104 as provided by the network during cell selection and/or cell reselection.

In an aspect, communicating component 242 can optionally include a key determining component 252 for obtaining an encryption key to use in encrypting and/or decrypting sidelink channel communications, and/or a securing component 254 for using the key to encrypt and/or decrypt the sidelink channel communications, as described herein.

In an aspect, the processor (s) 212 may correspond to one or more of the processors described in connection with the UE in FIG. 6. Similarly, the memory 216 may correspond to the memory described in connection with the UE in FIG. 6.

Referring to FIG. 3, one example of an implementation of base station 102 (e.g., a base station 102 and/or gNB 180, as described above) may include a variety of components, some of which have already been described above, but including components such as one or more processors 312 and memory 316 and transceiver 302 in communication via one or more buses 344, which may operate in conjunction with modem 340 and scheduling component 342 for optionally configuring encryption keys or related parameters to one or more UEs for securing sidelink channel communications.

The transceiver 302, receiver 306, transmitter 308, one or more processors 312, memory 316, applications 375, buses 344, RF front end 388, LNAs 390, switches 392, filters 396, PAs 398, and one or more antennas 365 may be the same as or similar to the corresponding components of UE 104, as described above, but configured or otherwise programmed for base station operations as opposed to UE operations.

In an aspect, scheduling component 342 can optionally include a key configuring component 352 for configuring one or more UEs with an encryption key for sidelink channel communications and/or parameters for deriving the encryption key.

In an aspect, the processor (s) 312 may correspond to one or more of the processors described in connection with the base station in FIG. 6. Similarly, the memory 316 may correspond to the memory described in connection with the base station in FIG. 6.

FIGs. 4A and 4B illustrate flow charts of an example of a method 400 for securing group cast communications. In an example, a UE 104 can perform the functions described in method 400 using one or more of the components described in FIGS. 1-2.

In method 400, at Block 402, a group of devices can be associated with for sidelink communications among the devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can associate with the group of devices (e.g., other UEs) for sidelink communications among the devices. For example, the devices may include V2V devices or other V2X nodes that can communicate over a sidelink communication channel. In an example, key determining component 252 can determine an existence of an association among the devices based on receiving an indication of the association (e.g., from a base station 102 or other network node) , based on an ad-hoc establishment of the group via communications among the devices, based on issuing a request (and/or receiving a response) to join a group or establish a group (which may be transmitted to the network and/or to the other devices) , etc.

In any case, in an example, the devices can be associated in the group for transmitting certain V2V communications with one another. Such V2V communications may include activity-related information (e.g., steering, accelerating, braking, light signaling, lane changing, etc., associated with a vehicle) , group maintenance information (e.g., member devices in the group, distance between adjacent members, indications of members joining or leaving the group, etc. ) , communication-related information (e.g., transmission power control parameters) , and/or the like.

In method 400, at Block 404, an encryption key can be obtained for communicating with the group of devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can obtain the encryption key for communicating with the group of devices. Various mechanisms can be used to obtain the key, which may include receiving the key (e.g., from a base station or other group member device) , generating the key, and/or the like, described in the various examples herein.

In method 400, e.g., where the UE 104 is transmitting the sidelink communication, optionally at Block 406, the sidelink communication can be encrypted based on the encryption key. In an aspect, securing component 254, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can encrypt the sidelink communication based on the encryption key using symmetric encryption algorithm. For example, securing component 254 can apply, based on the encryption key, an encryption algorithm such as advanced encryption standard 128-bit (AES128) , SM4, etc., to the sidelink communication (e.g., to a payload of a data packet that is to be transmitted in the sidelink communication) to encrypt the communication.

In method 400, e.g., where the UE 104 is receiving the sidelink communication, optionally at Block 406, the sidelink communication can be decrypted based on the encryption key. In an aspect, securing component 254, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can decrypt the sidelink communication based on the encryption key. For example, securing component 254 can apply, based on the encryption key, a decryption algorithm to the sidelink communication (e.g., to a payload of a data packet that is to be transmitted in the sidelink communication) to decrypt the communication.

In a specific example, the network can assign the encryption key (or keys) to the group members for group communication (e.g., both group cast and unicast among members) . In this example, in obtaining the encryption key at Block 404, optionally at Block 410, a request for the encryption key can be transmitted (e.g., to a base station) . In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can transmit, e.g., to a base station (e.g., base station 102) , a request for the encryption key. For example, based on associating with, or otherwise establishing the group, key determining component 252 can request the encryption key. In one example, UE 104 can be configured as a group head of the group of devices or otherwise assigned the task of requesting the encryption key for remaining member devices in the group. Thus, in an example, key determining component 252 can request the encryption key based on determining that the UE 104 is the group head or assigned the task of requesting the group key. In one example, key determining component 252 can include an identification of the member devices (e.g., member UEs) in the group. In yet another example, each UE 104 in the group may be responsible for requesting the encryption key (e.g., as needed to encrypt and/or decrypt group communications) . In addition, for example, the request may indicate a group identifier for which the encryption key is requested.

In addition, in this example, in obtaining the encryption key at Block 404, optionally at Block 412, the encryption key can be received (e.g., from a base station or from another device in the group of devices) . In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, e.g., from the base station 102 or another device (e.g., another UE 104) in the group of devices, the encryption key. For example, key determining component 252 may receive the encryption key in response to the request or otherwise. As described further herein, the network can assign the keys to the group head or assigned requester (e.g., other than the group head) , and thus UE 104, as being the group head or assigned requester (or otherwise as being the device that transmits the request at Block 410) can receive the encryption key from the base station 102. Where each device requests the key (s) , key determining component 252 may receive the encryption key in response to the request.

In the former example where the group head or assigned requester requests the key(s) , in obtaining the encryption key at Block 404, optionally at Block 414, the encryption key can be transmitted to the group of devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can transmit the encryption key to the group of devices. For example, key determining component 252 can transmit the encryption key that is received from the base station 102 to each device (e.g., UE) that is associated in the group of devices, as described. In any case, the devices in the group can use the received encryption key to encrypt and/or decrypt group cast communications (e.g., sidelink channel communications) using a symmetric encryption algorithm such as AES128 and SM4, as described.

In addition, for example, receiving the encryption key at Block 412 and/or transmitting the encryption key at Block 414 can include receiving and/or transmitting additional properties related to the encryption key, such as an effective timer after which the encryption key may expire. Thus, based on receiving the encryption key at Block 412, for example, key determining component 252 can start a timer based on the effective timer property (or other time-related property that may be received) . Upon detecting expiration of the timer, for example, securing component 254 may refrain from using the encryption key to encrypt communications at Block 406 and/or decrypting the communications at Block 408. In another example, key determining component 252 can determine to transmit a request, to the base station 102, for an updated encryption key (e.g., as described in Block 410) .

In another specific example, a member device in the group can randomly generate a session encryption key from a group root key to transmit group cast messages, and key material to derive the session encryption key can be ciphered and group cast in the messages. In this example, in obtaining the encryption key at Block 404, optionally at Block 416, a request for a group root key can be transmitted to a base station. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can transmit, to the base station (e.g., base station 102) , the request for the group root key. In an example, as described above with respect to transmitting the request for the encryption key, key determining component 252 may transmit the request for the group root key based at least in part on determining that the UE 104 is the group head or otherwise assigned the task of requesting the group root key for the group of devices. In addition, in an example, key determining component 252 can include, in the request, an indication of the member devices in the group (e.g., an identifier of the member devices to allow the base station 102 to subsequently identify the UEs and/or to allow the base station 102 to transmit the group root key to the other member devices) .

In this example, in obtaining the encryption key at Block 404, optionally at Block 418, the group root key can be received from the base station or from another device in the group of devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station (e.g., base station 102) or from another device in the group of devices (e.g., another UE 104) , the group root key. For example, where the UE 104 is the group head or otherwise assigned to transmit the request for the group root key, key determining component 252 can receive the group root key in response to the request. Where the UE 104 is not the group head or not assigned to request the group root key, key determining component 252 can receive the group root key from the base station 102 in an unsolicited communication, which may be received over a secure link (e.g., Uu interface) between the base station 102 and UE 104, for example. As described further herein, for example, key determining component 252 can sign communications with a digital certificate of the UE 104, and the network can use the UE’s individual certificate to verify the member UE and encrypt the group root key response. In another example, the group head device can transmit the group root head, as received from the base station 102, to the other devices in the group.

In this example, in obtaining the encryption key at Block 404, optionally at Block 420, the encryption key can be generated. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can generate the encryption key. Key determining component 252 can generate the encryption key using various mechanisms as described herein. In this specific example, in generating the encryption key at Block 420, optionally at Block 422, the encryption key can be generated based on the group root key. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can generate the encryption key based on the group root key. For example, key determining component 252 can generate the encryption key using certain key derivation algorithm (e.g. secure hash algorithm 128-bit (SHA-128) , secure hash algorithm 256-bit (SHA-256) , SM3, etc. ) based on generating a random number and using the random number, the group root key, and/or other parameters to derive the session encryption key to use in securing sidelink channel communications, as described. In one example, key determining component 252 can determine to generate the key based at least in part on determining to send a sidelink channel communication, based on receiving a sidelink channel communication, and/or the like.

In this example, as described, in encrypting the sidelink communication at Block 406, securing component 254 can encrypt the sidelink communication using the generated encryption key with a symmetric encryption algorithm such as AES128 and SM4. In addition, in this and other examples, in method 400, optionally at Block 426, the sidelink communication can be signed based on a digital certificate. In an aspect, securing component 254, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can sign the sidelink communication (e.g., as encrypted) based on the digital certificate of the device (e.g., of UE 104) . Signing the sidelink communication can assist receiving devices in verifying the authenticity of sidelink communications received from the device.

In addition, in this and other examples, in method 400, optionally at Block 428, the encrypted sidelink communication can be transmitted to the group of devices. In an aspect, communicating component 242, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, etc., can transmit the encrypted sidelink communication to the group of devices (e.g., over the sidelink channel and using resources granted to the UE 104 for transmitting the sidelink communication) . Thus, the sidelink communication can be secured by encryption and by using the digital certificate to sign the communication.

Moreover, in this example as described above, the UE 104 can also transmit the key materials for deriving the encryption key to the other devices in the group. Thus, for example, in transmitting the encrypted sidelink communication at Block 428 (or as a separate step) , optionally at Block 430, key materials for deriving the encryption key can be transmitted. In an aspect, communicating component 242, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, etc., can transmit the key materials for deriving the encryption key, which may include the random number, the other parameters used in generating the key, etc.

In this example, in method 400, optionally at Block 432, the sidelink communication can be received from a device in the group of devices. In this example, for a different UE 104, communicating component 242, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, etc., can receive the sidelink communication from the device in the group of devices (e.g., from the transmitting UE 104 that can perform the

Blocks

406, 426, and/or 428, as described) . As described, for example, communicating component 242 can receive the sidelink communication over the sidelink channel, which the UE 104 can monitor for communications (e.g., D2D, V2V, V2x, etc., communications) from the group of devices and/or other devices.

In addition, in this example, in method 400, optionally at Block 434, the sidelink communication can be verified based on a digital certificate of the device within the group of devices. In this example, for the receiving device, securing component 254, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can verify the sidelink communication based on a digital certificate of the device within the group of devices (e.g., of the transmitting device/UE 104) . For example, securing component 254 can verify the sidelink communication before decrypting at Block 408, before generating the key at Block 422, and/or the like. In one example, securing component 254 can obtain a digital certificate of the transmitting device based on associating with the group of devices at Block 402 (e.g., as part of joining a group, requesting joining of a group, receiving a notification of association of the receiving UE with the group, etc. ) , which may also include receiving digital certificates for other UEs in the group. This can allow the receiving UE to verify authenticity of the sidelink communication, as described.

In one example, in obtaining the encryption key at Block 404 (or otherwise generating the encryption key) , optionally at Block 436, key materials can be received for deriving the encryption key. In an example, key determining component 252 of the receiving device, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive the key materials for deriving the encryption key. For example, as described, the key materials may include the random number, the other parameters used to generate the encryption key, etc. In an example, key determining component 252 may receive the key materials in the sidelink communication received at Block 432 or a separate communication from the transmitting device. In this example, in generating the encryption key based on the group root key at Block 420, key determining component 252 of the receiving UE can use the received key materials to derive the session encryption key, and can use this key, at Block 408 in decrypting the sidelink communications.

In another specific example, a member device in the group can randomly generate a session encryption key, which can be ciphered with a group public key and also transmitted in group cast in the messages. For example, the group public key and/or a group private key may remain unchanged during the lifetime of the group or dynamically changed per certain rules. In this example, in obtaining the encryption key at Block 404, optionally at Block 440 (in Fig. 4B) , a request for a group certificate can be transmitted to a base station. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can transmit, to the base station (e.g., base station 102) , the request for the group certificate. For example, based on associating with, or otherwise establishing the group, key determining component 252 can request the group certificate. In one example, UE 104 can be configured as a group head of the group of devices or otherwise assigned the task of requesting the group certificate for remaining member devices in the group. Thus, in an example, key determining component 252 can request the encryption key based on determining that the UE 104 is the group head or assigned the task of requesting the group certificate. In one example, key determining component 252 can include an identification of the member devices (e.g., member UEs) in the group. In any case, the base station 102 or other network component can generate and/or provide the group certificate for authenticating group cast communications, as described further herein.

In addition, in this example, in obtaining the encryption key at Block 404, optionally at Block 442, the group certificate can be received from a base station. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station (e.g., base station 102) , the group certificate. For example, key determining component 252 may receive the group certificate in response to the request or otherwise.

In addition, in this example, in obtaining the encryption key at Block 404, optionally at Block 444, the encryption key can be generated, and optionally at Block 446, can be generated as ciphered based on the group certificate using asymmetric encryption algorithm such as elliptic-curve cryptography (ECC) , SM2, Rivest-Shamir-Adleman (RSA) , etc. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can generate the encryption key, and may do so as ciphered based on the group certificate. In one example, key determining component 252 can generate a group private/public key pair for encrypting/decrypting sidelink communications, and this may be done before sending the request at Block 440 or may be performed by, and/or received from, the base station 102 when it generates the group certificate, as described further herein.

For example, key determining component 252 can generate the encryption key based on the group public key. Thus, for example, in method 400, optionally at Block 448, a public key associated with the group certificate can be obtained. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can obtain the public key associated with the group certificate. For example, this can be from the public/private key pair generated based on the group certificate by the UE 104 or the base station 102, as described above. In this example, key determining component 252 can then generate the encryption key based on generating a random number and using the random number, the group public key, and/or other parameters to derive the session encryption key to use in securing sidelink channel communications, as described. In one example, key determining component 252 can determine to generate the key based at least in part on determining to send a sidelink channel communication, based on receiving a sidelink channel communication, and/or the like.

In this example, as described, in encrypting the sidelink communication at Block 406, securing component 254 can encrypt the sidelink communication using the generated encryption key and a symmetric encryption algorithm such as AES128 and SM4, optionally at Block 426, sign the sidelink communication, optionally at Block 428, transmit the encrypted sidelink communication to the group of devices, optionally at Block 430, transmit the key materials for deriving the encryption key, etc., as described above. In addition, in this example, key determining component 252 may also include the group certificate or group identifier in the sidelink communication or other communication to allow the other devices to request the group certificate and/or group private key.

In this example, in method 400, optionally at Block 432, the sidelink communication can be received from a device in the group of devices. In this example, a different UE (e.g. other than the group head or UE assigned to request generation of the group certificate) can also request the group certificate and private key from the network (e.g., via base station 102) . In this example, in obtaining the encryption key at Block 404, optionally at Block 450, the group certificate can be received from the base station or another device in the group of devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station (e.g., base station 102) or another device in the group of devices, the group certificate. In one example, this may be based on a request for the group certificate transmitted at Block 440, within which key determining component 252 can include the group identifier. In addition, in this example, key determining component 252 may not only receive the group certificate in response to the request transmitted at Block 440, but may also, optionally at Block 452, receive, from the base station a group private key. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station, (e.g., base station 102) , the group private key. As described in further detail below, key determining component 252 can cipher the request using a digital certificate of the UE 104, and the base station 102 can use this to verify the request from the UE 104, and/or the further cipher the response that includes the group certificate and/or group private key. In any case, the key determining component 252 of the different device can use the group private key in generating the encryption key to decrypt the sidelink communications.

In this example, in obtaining the encryption key at Block 404 (or otherwise generating the encryption key) , optionally at Block 454, the encryption key can be derived using the group private key. In an example, key determining component 252 of the receiving device, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can derive the encryption key using the group private key. In one example, this may also be based on receiving the key materials for deriving the encryption key (e.g., as described in Block 436 of FIG. 4A) . For example, as described, the key materials may include the random number, the other parameters used to generate the encryption key, etc. In an example, key determining component 252 may generate the encryption key based on the group private key and the key materials, as described, and securing component 254 can use this key, at Block 408 in decrypting the sidelink communications. Additionally, in an example, securing component 254 can verify the sidelink communication based on the digital certificate of the transmitting device, as described above with respect to Block 434.

In another specific example, group cast messages can be ciphered with a group public key and can be decrypted with a corresponding group private key known to the group members. For example, the group public key and group private key may remain unchanged during the lifetime of the group or dynamically changed per certain rules. In this example, in obtaining the encryption key at Block 404, optionally at Block 440 (in Fig. 4B) , a request for a group certificate can be transmitted to a base station, as described above. The request may identify the member devices in the group, as described. In addition, the group private/public key pair for the group certificate may be generated by the group head before it sends the request or by the server when it generates the group certificate, as described.

In addition, in this example, in obtaining the encryption key at Block 404, optionally at Block 442, the group certificate can be received from a base station, as described. In addition, in this example, in obtaining the encryption key at Block 404, optionally at Block 444, the encryption key can be generated, and optionally at Block 446, can be generated as ciphered based on the group certificate, as described. For example, key determining component 252 can generate the encryption key based on the group public key, as described, and based on one asymmetric encryption algorithm such as ECC, SM2 or RSA to encrypt the message payload. In this example, as described, in encrypting the sidelink communication at Block 406, securing component 254 can encrypt the sidelink communication using the generated encryption key, optionally at Block 426, sign the sidelink communication, optionally at Block 428, transmit the encrypted sidelink communication to the group of devices, etc., as described above. In addition, in this example, key determining component 252 may also include the group certificate in the sidelink communication or other communication to the other devices in the group. In one example, in obtaining the encryption key at Block 414, optionally at Block 456, the group certificate can be transmitted to the group of devices. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can transmit the group certificate to the group of devices.

In this example, in method 400, optionally at Block 432, the sidelink communication can be received from a device in the group of devices. In this example, a different UE (e.g. other than the group head or UE assigned to request generation of the group certificate) can also request the group certificate and private key from the network (e.g., via base station 102) . In this example, in obtaining the encryption key at Block 404, optionally at Block 450, the group certificate can be received from the base station or another device in the group of devices, as described. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station (e.g., base station 102) or another device in the group of devices, the group certificate. In one example, this may be based on a request for the group certificate transmitted at Block 440, within which key determining component 252 can include the group identifier. In addition, in this example, key determining component 252 may not only receive the group certificate in response to the request transmitted at Block 440, but may also, optionally at Block 452, receive, from the base station a group private key, as described. In an aspect, key determining component 252, e.g., in conjunction with processor (s) 212, memory 216, transceiver 202, communicating component 242, etc., can receive, from the base station, (e.g., base station 102) , the group private key. As described in further detail below, key determining component 252 can cipher the request using a digital certificate of the UE 104, and the base station 102 can use this to verify the request from the UE 104, and/or further cipher the response that includes the group certificate and/or group private key. In any case, the key determining component 252 of the different device can use the group private key in generating the encryption key to decrypt the sidelink communications.

In this example, key determining component 252 may generate the encryption key as the group private key, as described, and securing component 254 can use this group private key, at Block 408 in decrypting the sidelink communications. Additionally, in an example, securing component 254 can verify the sidelink communication based on the digital certificate of the transmitting device, as described above with respect to Block 434.

In the examples described above, a group head UE can accordingly broadcast group information with cleartext, certificate, and digital signature. In addition, the UEs can encrypt all sidelink channel communications (e.g., control channel (e.g., PSCCH) and data channel (e.g., PSSCH) communications) or just control channel communications.

FIG. 5 illustrates a flow chart of an example of a method 500 for generating an encryption key for group cast communications. In an example, a base station 102 (e.g., which may include a gNB 180) or another network component (though generally referred to below as base station 102) can perform the functions described in method 500 using one or more of the components described in FIGS. 1 and 3.

In method 500, at Block 502, an association of a group of devices for transmitting sidelink communications with one another can be determined. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342, etc., can determine the association of the group of devices for transmitting the sidelink communications with one another. As described, for example, key configuring component 352 can associate the group based on a group configuration, a request from devices to join a group, an indication from one or more of the devices of existence of the group for sidelink communications, and/or the like. In an example, key configuring component 352 may receive an indication of a group identifier.

In method 500, at Block 504, an encryption key can be generated for the group of devices to use in securing sidelink communications. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342, etc., can generate the encryption key for the group of devices to use in securing sidelink communications. For example, in the examples described above, key configuring component 352 can assign a group encryption key to a group head device or device assigned to request the group encryption key (e.g., based on receiving a request for the encryption key) or can assign the group encryption key to each device in the group (e.g., based on individual requests from the devices, where the request may indicate the group identifier) . In addition, in an example, key configuring component 352 can configure other parameters related to the key, such as an effective timer, as described above. In other examples, key configuring component 352 can provide the encryption key to the devices over a secure link (e.g., Uu interface, as described) .

In method 500, optionally at Block 506, a request for the encryption key can be received from one or more devices. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342, etc., can receive the request for the encryption key from the one or more devices. As described, the request can be received from a group head device or other devices in the group.

In method 500, optionally at Block 508, the request can be verified based on a certificate of the one or more devices. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342 etc., can verify the request based on a certificate of the one or more devices. For example, the one or more devices can provide the signature based on establishing the group, and the base station 102 can accordingly use the certificate to verify requests for certificates from the devices, where the requests can be signed based on the corresponding certificate.

In method 500, optionally at Block 510, the encryption key can be ciphered based on the certificate of the one or more devices. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342, etc.., can cipher the encryption key based on the certificate of the one or more devices. For example (e.g., where the base station 102 does not otherwise send the encryption key over the secure link) , key configuring component 352 can sign the encryption key with the certificate of the device to allow the device to authenticate the encryption key received from the base station 102.

In method 500, at Block 512, the encryption key can be transmitted to one or more devices in the group of devices. In an aspect, scheduling component 342, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, etc., can transmit the encryption key to one or more devices in the group of devices. As described, for example, scheduling component 342 can transmit the encryption key to the one or more devices based on a received request, based on an identification of the member devices in the group, etc. In addition, scheduling component 342 can transmit a group public and/or private key to the one or more devices, as described above.

In method 500, optionally at Block 514, a group certificate can be ciphered based on a certificate of the one or more devices. In an aspect, key configuring component 352, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, scheduling component 342, etc., can cipher the group certificate based on the certificate of the one or more devices. In one example, key configuring component 352 can generate the group certificate for the group of devices based on a request (e.g., from a group head device) and can cipher the group certificate for transmitting to the one or more devices using a certificate of the devices. This allows the devices to receive the group certificate and verify the communication, as described.

In method 500, optionally at Block 516, a group certificate can be transmitted to one or more devices. In an aspect, scheduling component 342, e.g., in conjunction with processor (s) 312, memory 316, transceiver 302, etc., can transmit the group certificate to the one or more devices. This can enable the one or more devices to authenticate group communications, authenticate or derive encryption keys (e.g., and/or group public and/or private keys) , etc., as described above.

FIG. 6 is a block diagram of a MIMO communication system 600 including a base station 102 and a UE 104. The MIMO communication system 600 may illustrate aspects of the wireless communication access network 100 described with reference to FIG. 1. The base station 102 may be an example of aspects of the base station 102 described with reference to FIG. 1. The base station 102 may be equipped with

antennas

634 and 635, and the UE 104 may be equipped with

antennas

652 and 653. In the MIMO communication system 600, the base station 102 may be able to send data over multiple communication links at the same time. Each communication link may be called a “layer” and the “rank” of the communication link may indicate the number of layers used for communication. For example, in a 2x2 MIMO communication system where base station 102 transmits two “layers, ” the rank of the communication link between the base station 102 and the UE 104 is two.

At the base station 102, a transmit (Tx) processor 620 may receive data from a data source. The transmit processor 620 may process the data. The transmit processor 620 may also generate control symbols or reference symbols. A transmit MIMO processor 630 may perform spatial processing (e.g., precoding) on data symbols, control symbols, or reference symbols, if applicable, and may provide output symbol streams to the transmit modulator/

demodulators

632 and 633. Each modulator/demodulator 632 through 633 may process a respective output symbol stream (e.g., for OFDM, etc. ) to obtain an output sample stream. Each modulator/demodulator 632 through 633 may further process (e.g., convert to analog, amplify, filter, and upconvert) the output sample stream to obtain a DL signal. In one example, DL signals from modulator/

demodulators

632 and 633 may be transmitted via the

antennas

634 and 635, respectively.

The UE 104 may be an example of aspects of the UEs 104 described with reference to FIGS. 1-2. At the UE 104, the

UE antennas

652 and 653 may receive the DL signals from the base station 102 and may provide the received signals to the modulator/

demodulators

654 and 655, respectively. Each modulator/demodulator 654 through 655 may condition (e.g., filter, amplify, downconvert, and digitize) a respective received signal to obtain input samples. Each modulator/demodulator 654 through 655 may further process the input samples (e.g., for OFDM, etc. ) to obtain received symbols. A MIMO detector 656 may obtain received symbols from the modulator/

demodulators

654 and 655, perform MIMO detection on the received symbols, if applicable, and provide detected symbols. A receive (Rx) processor 658 may process (e.g., demodulate, deinterleave, and decode) the detected symbols, providing decoded data for the UE 104 to a data output, and provide decoded control information to a processor 680, or memory 682.

The processor 680 may in some cases execute stored instructions to instantiate a communicating component 242 (see e.g., FIGS. 1 and 2) .

On the uplink (UL) , at the UE 104, a transmit processor 664 may receive and process data from a data source. The transmit processor 664 may also generate reference symbols for a reference signal. The symbols from the transmit processor 664 may be precoded by a transmit MIMO processor 666 if applicable, further processed by the modulator/demodulators 654 and 655 (e.g., for SC-FDMA, etc. ) , and be transmitted to the base station 102 in accordance with the communication parameters received from the base station 102. At the base station 102, the UL signals from the UE 104 may be received by the

antennas

634 and 635, processed by the modulator/

demodulators

632 and 633, detected by a MIMO detector 636 if applicable, and further processed by a receive processor 638. The receive processor 638 may provide decoded data to a data output and to the processor 640 or memory 642.

The processor 640 may in some cases execute stored instructions to instantiate a scheduling component 342 (see e.g., FIGS. 1 and 3) .

The components of the UE 104 may, individually or collectively, be implemented with one or more ASICs adapted to perform some or all of the applicable functions in hardware. Each of the noted modules may be a means for performing one or more functions related to operation of the MIMO communication system 600. Similarly, the components of the base station 102 may, individually or collectively, be implemented with one or more ASICs adapted to perform some or all of the applicable functions in hardware. Each of the noted components may be a means for performing one or more functions related to operation of the MIMO communication system 600.

The above detailed description set forth above in connection with the appended drawings describes examples and does not represent the only examples that may be implemented or that are within the scope of the claims. The term “example, ” when used in this description, means “serving as an example, instance, or illustration, ” and not “preferred” or “advantageous over other examples. ” The detailed description includes specific details for the purpose of providing an understanding of the described techniques. These techniques, however, may be practiced without these specific details. In some instances, well-known structures and apparatuses are shown in block diagram form in order to avoid obscuring the concepts of the described examples.

Information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, computer-executable code or instructions stored on a computer-readable medium, or any combination thereof.

The various illustrative blocks and components described in connection with the disclosure herein may be implemented or performed with a specially-programmed device, such as but not limited to a processor, a digital signal processor (DSP) , an ASIC, a FPGA or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination thereof designed to perform the functions described herein. A specially-programmed processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A specially-programmed processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored on or transmitted over as one or more instructions or code on a non-transitory computer-readable medium. Other examples and implementations are within the scope and spirit of the disclosure and appended claims. For example, due to the nature of software, functions described above can be implemented using software executed by a specially programmed processor, hardware, firmware, hardwiring, or combinations of any of these. Features implementing functions may also be physically located at various positions, including being distributed such that portions of functions are implemented at different physical locations. Also, as used herein, including in the claims, “or” as used in a list of items prefaced by “at least one of” indicates a disjunctive list such that, for example, a list of “at least one of A, B, or C” means A or B or C or AB or AC or BC or ABC (i.e., A and B and C) .

Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage medium may be any available medium that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code means in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) , or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, include compact disc (CD) , laser disc, optical disc, digital versatile disc (DVD) , floppy disk and Blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.

The previous description of the disclosure is provided to enable a person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the common principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure. Furthermore, although elements of the described aspects and/or embodiments may be described or claimed in the singular, the plural is contemplated unless limitation to the singular is explicitly stated. Additionally, all or a portion of any aspect and/or embodiment may be utilized with all or a portion of any other aspect and/or embodiment, unless stated otherwise. Thus, the disclosure is not to be limited to the examples and designs described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

A method for wireless communication, comprising:

associating with a group of devices for sidelink communications among the devices;

obtaining an encryption key for communicating with the group of devices, wherein obtaining the encryption key comprises at least one of:

receiving the encryption key from a base station or from another device in the group of devices; or

generating the encryption key; and

encrypting or decrypting a sidelink communication based on the encryption key.
The method of claim 1, wherein obtaining the encryption key comprises receiving the encryption key from the base station, and further comprising transmitting the encryption key to the group of devices.
The method of claim 1, further comprising transmitting, to the base station, a request for the encryption key, wherein obtaining the encryption key comprises receiving the encryption key from the base station based on the request.
The method of claim 1, wherein obtaining the encryption key comprises receiving the encryption key from the base station along with a timer after which the encryption key expires.
The method of claim 1, further comprising:

transmitting, to the base station, a request for a group root key; and

receiving, from the base station, the group root key,

wherein obtaining the encryption key comprises generating the encryption key based on the group root key received from the base station.
The method of claim 5, wherein the request indicates the group of devices that are to additionally receive the group root key.
The method of claim 5, wherein obtaining the encryption key comprises generating a random number and deriving the encryption key based at least in part on the random number and the group root key, and further comprising transmitting key materials, for deriving the encryption key, with the sidelink communication.
The method of claim 1, further comprising receiving, from the base station or from another device in the group of devices, a group root key, wherein obtaining the encryption key comprises generating the encryption key based on the group root key received from the base station.
The method of claim 8, wherein obtaining the encryption key comprises generating a random number and deriving the encryption key based at least in part on the random number and the group root key, and further comprising transmitting key materials, for deriving the encryption key, with the sidelink communication.
The method of claim 1, further comprising receiving, with the sidelink communication, key materials for deriving the encryption key, wherein obtaining the encryption key includes deriving the encryption key based on the key materials.
The method of claim 1, further comprising:

transmitting, to the base station, a request for a group certificate; and

receiving, from the base station, the group certificate,

wherein obtaining the encryption key comprises generating the encryption key ciphered based on the group certificate received from the base station.
The method of claim 11, wherein the request indicates the group of devices that are to additionally receive the group certificate.
The method of claim 11, wherein obtaining the encryption key comprises generating a random number and deriving the encryption key based at least in part on the random number and a public key associated with the group certificate, and further comprising transmitting, with the sidelink communication, at least one of key materials for deriving the key or the group certificate.
The method of claim 11, wherein obtaining the encryption key comprises obtaining a public key associated with the group certificate, and wherein encrypting the sidelink communication comprises using the public key and an asymmetric encryption algorithm to encrypt the sidelink communication, and further comprising transmitting, with the sidelink communication, the group certificate.
The method of claim 1, further comprising:

receiving, from a device in the group of devices or the base station, a group certificate; and

receiving, with the sidelink communication from the group device, key materials for deriving the encryption key, wherein obtaining the encryption key includes at least one of generating the encryption key ciphered based on the group certificate or deriving the encryption key based on the key materials.
The method of claim 1, further comprising:

receiving, from the base station, a group certificate and a group private key; and

decrypting the sidelink communication based on the group private key.
The method of claim 16, wherein obtaining the encryption key comprises deriving the encryption key using the group private key, and wherein decrypting the sidelink communication using the encryption key.
The method of claim 1, wherein encrypting or decrypting includes encrypting the sidelink communication, and further comprising signing the sidelink communication, as encrypted, based on a digital certificate.
The method of claim 1, wherein encrypting or decrypting includes decrypting the sidelink communication, and further comprising verifying the sidelink communication before decrypting based on a digital certificate of a device in the group of devices.
The method of claim 1, wherein encrypting the sidelink communication comprises encrypting control channel sidelink communications, and further comprising transmitting data channel sidelink communications without encryption.
A method of wireless communication, comprising:

determining an association of a group of devices for transmitting sidelink communications with one another;

generating an encryption key for the group of devices to use in securing sidelink communications; and

transmitting the encryption key to one or more devices in the group of devices.
The method of claim 21, further comprising receiving a request for the encryption key from the one or more devices, wherein the request identifies the group of devices, and wherein generating the encryption key is based on the request.
The method of claim 22, wherein transmitting the encryption key comprises transmitting the encryption key to the group of devices.
The method of claim 22, further comprising verifying the request based on a certificate of the one or more devices, wherein generating the encryption key is based on successful verification of the request.
The method of claim 21, further comprising ciphering the encryption key based on a certificate associated with the one or more devices.
The method of claim 21, further comprising transmitting a group certificate to the one or more devices.
The method of claim 26, further comprising ciphering the group certificate based on a certificate associated with the one or more devices.
The method of claim 21, wherein transmitting the encryption key comprises transmitting the encryption key along with a timer after which the encryption key expires.
An apparatus for wireless communication, comprising:

a transceiver;

a memory configured to store instructions; and

one or more processors communicatively coupled with the transceiver and the memory, wherein the one or more processors are configured to:

associate with a group of devices for sidelink communications among the devices;

obtain an encryption key for communicating with the group of devices at least in part by at least one of:

receiving the encryption key from a base station or from another device in the group of devices; or

generating the encryption key; and

encrypt or decrypt a sidelink communication based on the encryption key.
The apparatus of claim 29, wherein the one or more processors are further configured to perform the operations of one or more methods in claims 2-20.
An apparatus for wireless communication, comprising:

a transceiver;

a memory configured to store instructions; and

one or more processors communicatively coupled with the transceiver and the memory, wherein the one or more processors are configured to:

determine an association of a group of devices for transmitting sidelink communications with one another;

generate an encryption key for the group of devices to use in securing sidelink communications; and

transmit the encryption key to one or more devices in the group of devices.
The apparatus of claim 31, wherein the one or more processors are further configured to perform the operations of one or more methods in claims 22-28.
An apparatus for wireless communication, comprising:

means for associating with a group of devices for sidelink communications among the devices;

means for obtaining an encryption key for communicating with the group of devices at least in part by at least one of:

receiving the encryption key from a base station or from another device in the group of devices; or

generating the encryption key; and

means for encrypting or decrypting a sidelink communication based on the encryption key.
The apparatus of claim 33, further comprising means for performing the operations of one or more methods in claims 2-20.
An apparatus for wireless communication, comprising:

means for determining an association of a group of devices for transmitting sidelink communications with one another;

means for generating an encryption key for the group of devices to use in securing sidelink communications; and

means for transmitting the encryption key to one or more devices in the group of devices.
The apparatus of claim 35, further comprising means for performing the operations of one or more methods in claims 22-28.
A computer-readable medium comprising code executable by a process for wireless communications, the code comprising:

code for associating with a group of devices for sidelink communications among the devices;

code for obtaining an encryption key for communicating with the group of devices at least in part by at least one of:

receiving the encryption key from a base station or from another device in the group of devices; or

generating the encryption key; and

code for encrypting or decrypting a sidelink communication based on the encryption key.
The computer-readable medium of claim 37, further comprising code for performing the operations of one or more methods in claims 2-20.
A computer-readable medium comprising code executable by a process for wireless communications, the code comprising:

code for determining an association of a group of devices for transmitting sidelink communications with one another;

code for generating an encryption key for the group of devices to use in securing sidelink communications; and

code for transmitting the encryption key to one or more devices in the group of devices.
The computer-readable medium of claim 39, further comprising code for performing the operations of one or more methods in claims 22-28.