WO2022147846A1 - 一种生成设备间通信的密钥的方法、系统和装置 - Google Patents

一种生成设备间通信的密钥的方法、系统和装置 Download PDF

Info

Publication number
WO2022147846A1
WO2022147846A1 PCT/CN2021/071149 CN2021071149W WO2022147846A1 WO 2022147846 A1 WO2022147846 A1 WO 2022147846A1 CN 2021071149 W CN2021071149 W CN 2021071149W WO 2022147846 A1 WO2022147846 A1 WO 2022147846A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
user equipment
network element
identifier
network
Prior art date
Application number
PCT/CN2021/071149
Other languages
English (en)
French (fr)
Inventor
吴义壮
雷骜
孙陶然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21916899.4A priority Critical patent/EP4271012A4/en
Priority to CA3204772A priority patent/CA3204772A1/en
Priority to CN202180089811.1A priority patent/CN116762470A/zh
Priority to PCT/CN2021/071149 priority patent/WO2022147846A1/zh
Priority to AU2021416579A priority patent/AU2021416579B2/en
Publication of WO2022147846A1 publication Critical patent/WO2022147846A1/zh
Priority to US18/349,587 priority patent/US20230354028A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/04—Terminal devices adapted for relaying to or from another terminal or user

Definitions

  • the present application relates to the field of communications, and more particularly, to a method, system and apparatus for generating a key for communication between a remote device and a relay device.
  • ProSe device-to-device proximity-based service
  • UE user equipment
  • a communication connection is established directly between devices.
  • One of the communication models is that one UE accesses the operator's network through the assistance of another UE, so as to perform service interaction with the data network.
  • the remote user equipment obtains services through the relay user equipment (UE-to-Network Relay)
  • UE-to-Network Relay in order to ensure communication security, a secure connection needs to be established between the Remote UE and the UE-to-Network Relay.
  • the establishment of communication connections through UE-to-Network Relay is dynamically established on demand, and shared security information cannot be pre-configured between Remote UE and UE-to-Network Relay, and Remote UE and UE- Secure connections between to-Network Relays. Therefore, there is an urgent need for a method to dynamically establish a secure connection between the Remote UE and the UE-to-Network Relay.
  • the present application provides a method, system and apparatus for generating a key for inter-device communication, so that a secure communication connection is dynamically established between user equipment and user equipment.
  • a first aspect provides a method for generating a key for inter-device communication, the method comprising: a first user equipment generates a first temporary identifier based on the first key; the first user equipment sends a message to the second user equipment a first request, where the first request is used to establish a communication connection between the first user equipment and the second user equipment; wherein the first request includes the first temporary identifier and a relay service code ; the first user equipment generates a shared key based on the second key and the relay service code; wherein the shared key is used to protect the connection between the first user equipment and the second user equipment
  • the second key and the first key are the keys generated in the authentication process or the keys derived based on the intermediate key generated in the authentication process.
  • the shared key is used to protect the communication connection between the first user equipment and the second user equipment.
  • a possible implementation includes that the first user equipment and the second user equipment deduce an intermediate key or session key based on the generated shared key, respectively, and further, deduce the first user equipment based on the intermediate key or the session key.
  • encryption key and/or integrity protection key for messages or data between the device and the second user equipment.
  • the encryption key and/or the integrity protection key are used to protect the communication connection between the first user equipment and the second user equipment.
  • Another possible implementation includes that the first user equipment and the second user equipment deduce the encryption key and/or complete protection of the message or data between the first user equipment and the second user equipment based on the generated shared key, respectively key.
  • the encryption key and/or the integrity protection key are used to protect the communication connection between the first user equipment and the second user equipment.
  • the first user equipment Based on the above solution, the first user equipment generates a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, so that a secure secure connection is dynamically established between the user equipment and the user equipment communication connection.
  • the second key is the same as the first key, and the second key and the first key are the authentication The key Kausf generated in the process or the key derived based on the Kausf.
  • the second key is different from the first key, and the first key is the key Kausf generated in the authentication process ;
  • the second key is a key derived based on the Kausf.
  • the second key is different from the first key, and the second key is the key Kausf generated in the authentication process ;
  • the first key is a key derived based on the Kausf.
  • the generating, by the first user equipment, the first temporary identifier based on the first key includes: the first user equipment is based on the first key, The network identifier and routing information of the first user equipment to generate the first temporary identifier; wherein, the network identifier of the first user equipment is used for the network side to identify the information of the first user equipment, and the routing information is used for for determining the information of the core network element related to the first user equipment.
  • the core network elements related to the first user equipment may specifically be core network elements involved in the authentication process of the first user equipment, such as data management network elements and short-range service security function network elements.
  • the first user equipment generates a first temporary identifier based on the first key, the network identifier of the first user equipment, and routing information, and sends the first temporary identifier to the second user equipment.
  • the second user equipment sends the first temporary identifier to the network side, so that the core network element related to the user of the first user equipment can obtain the second key according to the first temporary identifier, and further the core network element can obtain the second key according to the first temporary identifier.
  • the second key determines the shared key and sends it to the second user equipment, so that the first user equipment and the second user equipment obtain the same shared key. Based on the shared key, the first user equipment and the second user equipment can dynamically establish a secure communication connection.
  • the first user equipment generates the first temporary identifier based on the first key, the network identifier of the first user equipment, and routing information , comprising: obtaining, by the first user equipment, a second temporary identifier based on the first key and the network identifier of the first user equipment as input parameters of the first preset algorithm; combining the second temporary identifier and the The routing information is spliced to obtain the first temporary identifier.
  • the network identifier of the first user equipment is the user permanent identifier SUPI or the International Mobile Subscriber Identity IMSI or the Universal Public Subscription Identifier GPSI; the routing information is routing instructions.
  • the method further includes: the first user equipment sends a non-access stratum NAS message to a mobility management network element, where the NAS message includes capability information, the The capability information is used to indicate that the first user equipment supports as a remote user equipment.
  • the first user equipment sends a NAS message including capability information to the network side, so as to serve as a basis for the network side to determine whether the first user equipment has the capability to support the remote user equipment, thereby helping the first user equipment
  • the device generates a shared key to dynamically establish a secure communication connection between the user equipment and the user equipment.
  • the first user equipment Based on the above technical solution, the first user equipment generates the shared key based on the second key, the relay service code, and the first freshness parameter, to ensure that the second key is the same and the relay service is the same.
  • the codes are the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, so that the secure communication connection established between the user equipment and the user equipment is more reliable.
  • the method further includes: the first user equipment receiving a security mode command from the second user equipment, the security mode command including a second freshness parameters; the first user equipment generates the shared key based on the second key and the relay service code, including: the first user equipment generates the shared key based on the second key, the relay A service code and the second freshness parameter to generate the shared key.
  • the first user equipment Based on the above technical solution, the first user equipment generates the shared key based on the second key, the relay service code, and the second freshness parameter, to ensure that the second key is the same and the relay service
  • the codes are the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, so that the secure communication connection established between the user equipment and the user equipment is more reliable.
  • the first request further includes a first freshness parameter; the method further includes: the first user equipment receives a security message from the second user equipment mode command, the security mode command includes a second freshness parameter; the first user equipment generates the shared key based on the second key and the relay service code, including: the first user The device generates the shared key based on the second key, the relay service code, the first freshness parameter, and the second freshness parameter.
  • the first user equipment Based on the above technical solution, the first user equipment generates the shared key based on the second key, the relay service code, the first freshness parameter, and the second freshness parameter, to ensure that the The second key is the same and the relay service code is the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, so that the secure communication connection established between the user equipment and the user equipment is more reliable.
  • the security mode command further includes a security algorithm; the method further includes: the first user equipment, based on the shared key and the security algorithm, obtains a communication key; the communication key is used to protect the communication connection between the first user equipment and the second user equipment. Specifically, the first user equipment obtains the communication key based on the shared key and the security algorithm, and further includes: the first user equipment generates an intermediate key/session key based on the shared key, Based on the intermediate key/session key and the communication key of the security algorithm.
  • the first user equipment obtains the communication key based on the shared key and the security algorithm, so that the secure communication connection established between the user equipment and the user equipment is protected and thus more reliable.
  • a method for generating a key for inter-device communication includes: a first network element generates a first temporary identifier based on the first key; the first network element receives data from a second network element
  • the key acquisition message includes the identification of the first user equipment and the relay service code, wherein the identification of the first user equipment includes the first temporary identification or the identification of the first user equipment.
  • Network identifier, the network identifier of the first user equipment is used for the network side to identify the information of the first user equipment; the first network element is based on the identifier of the first user equipment, the relay service code and the second password.
  • the shared key is used to protect the communication connection between the first user equipment and the second user equipment, and the second key and the first key are the The key generated in the authentication process of the first user equipment or the key derived from the intermediate key generated in the authentication process of the first user equipment; the first network element reports to the second network element sends the shared key. Further, the second network element sends the shared key to the second user equipment.
  • the first network element generates a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, and sends it to the second user equipment, so that the second user equipment A secure communication connection may be dynamically established with the first user equipment based on the shared key.
  • the first network element generates a shared key according to the identifier of the first user equipment, the relay service code and the second key, including : the first network element obtains the second key according to the identifier of the first user equipment, and the first network element generates the shared secret according to the second key and the relay service code key.
  • the first network element obtains the second key according to the identifier of the first user equipment, so that the first network element can generate a
  • the shared key for protecting the communication connection between the devices enables a secure communication connection between the user equipment and the user equipment to be dynamically established.
  • the second key is the same as the first key, and the second key and the first key are the authentication The key Kausf generated in the process or the key derived based on the Kausf.
  • the second key is different from the first key, and the first key is the key Kausf generated in the authentication process ;
  • the second key is a key derived based on the Kausf.
  • the second key is different from the first key, and the second key is the key Kausf generated in the authentication process ;
  • the first key is a key derived based on the Kausf.
  • the first network element generates the first temporary identifier based on the first key, including: the first network element is based on the first key, The network identifier and routing information of the first user equipment to generate the first temporary identifier; wherein, the network identifier of the first user equipment is used for the network side to identify the information of the first user equipment, and the routing information is the information used to determine the core network element related to the first user equipment.
  • the first network element generates the first temporary identifier based on the first key, the network identifier of the first user equipment, and routing information, including: The first network element obtains a second temporary identifier based on the first key and the network identifier of the first user equipment as input parameters of the first preset algorithm; the second temporary identifier and the routing information Splicing is performed to obtain the first temporary identification.
  • the network identifier of the first user equipment is the user permanent identifier SUPI or the International Mobile Subscriber Identity IMSI or the Universal Public Subscription Identifier GPSI; the routing information is routing instructions.
  • the method further includes: in the process of authenticating the first user equipment, the first network element receives indication information from a third network element ; in response to the indication information, the first network element generates the first temporary identifier based on the first key.
  • the first network element Based on the above technical solution, the first network element generates the first temporary identifier in response to the indication information sent by the third network element. Then the first network element stores the generated first temporary identifier in association with the second key. Subsequently, when the first network element receives a key acquisition message carrying the first temporary identifier from the second network element, the first network element can acquire the above-mentioned second key according to the first temporary identifier, which is beneficial to the first The network element determines the shared key according to the second key and sends it to the second user equipment via one or more intermediate network elements, so that a secure communication connection is dynamically established between the first user equipment and the second user equipment based on the shared key . .
  • the first network element in the process of authenticating the first user equipment, receives indication information from a third network element; in response to the indicating information, the first network element generating the first temporary identifier based on the first key includes: in the process of authenticating the first user equipment, the first network element receives a message from the first user equipment. Capability information of four network elements, where the capability information is used to indicate that the first user equipment supports the capability of a remote UE; in response to the indication information and the capability information, the first network element is based on the first key to generate the first temporary identifier.
  • the first network element Based on the above technical solution, the first network element generates the first temporary identifier in response to the indication information sent by the third network element and the capability information sent by the fourth network element. Then the first network element stores the generated first temporary identifier in association with the second key. Subsequently, when the first network element receives a key acquisition message carrying the first temporary identifier from the second network element, the first network element can acquire the above-mentioned second key according to the first temporary identifier, which is beneficial to the first The network element determines the shared key according to the second key and sends it to the second user equipment via one or more intermediate network elements, so that a secure communication is dynamically established between the first user equipment and the second user equipment based on the shared key connect.
  • the method further includes: the first network element sending the first temporary identifier to a third network element.
  • the first network element sends the first temporary identifier to a third network element, and the third network element stores the first temporary identifier and the identifier of the first network element in the first user in the context information of the device.
  • the subsequent second network element may acquire the identifier of the first network element and the network identifier of the first user equipment from the third network element according to the first temporary identifier.
  • the second network element can obtain the above-mentioned shared key from the first network element based on the network identifier of the first user equipment and send it to the second user equipment, so that the relationship between the first user equipment and the second user equipment can be based on the
  • the shared key dynamically establishes a secure communication connection.
  • the key acquisition message further includes a first freshness parameter; the first network element according to the identifier of the first user equipment, the relay Service code and second key, and generating a shared key, including: the first network element according to the identifier of the first user equipment, the relay service code, the second key and the first freshness parameter , to generate a shared key.
  • the first network element generates a shared key according to the identifier of the first user equipment, the relay service code, the second key, and the first freshness parameter, to ensure that the second key is The same and the same relay service code, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the method further includes: generating, by the first network element, a second freshness parameter; Generating the shared key by the relay service code and the second key includes: the first network element according to the identifier of the first user equipment, the relay service code, the second key and the shared key.
  • the second freshness parameter is used to generate a shared key.
  • the first network element generates a shared key according to the identifier of the first user equipment, the relay service code, the second key, and the second freshness parameter, to ensure that the second key is The same and the same relay service code, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the key acquisition message further includes a first freshness parameter; the method further includes: the first network element generates a second freshness parameter; the The first network element generates a shared key according to the identifier of the first user equipment, the relay service code and the second key, including: the first network element is based on the identifier of the first user equipment , the relay service code, the second key, the first freshness parameter and the second freshness parameter to generate a shared key.
  • the first network element generates a shared secret according to the identifier of the first user equipment, the relay service code, the second key, the first freshness parameter and the second freshness parameter ensure that the second key is the same and the relay service code is the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipment, so that the security established between the user equipment and the user equipment The communication connection is more reliable.
  • the first network element is an authentication function network element.
  • the second network element is a mobility management network element, an authentication function network element, or a short-range service security function network element.
  • the third network element is a data management network element.
  • the fourth network element is a mobility management network element.
  • a method for generating a key for inter-device communication includes: a fifth network element obtains a first temporary identifier and a third key, where the third key is generated based on an authentication process The key obtained by deriving the intermediate key from the second network element; the fifth network element receives a key acquisition message from the sixth network element, and the key acquisition message includes the first temporary identifier and the relay service code; Five network elements generate a shared key according to the first temporary identifier, the relay service code and the third key; wherein the shared key is used to protect the communication between the first user equipment and the second user equipment The fifth network element sends the shared key to the sixth network element.
  • the fifth network element generates a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, so that the security is dynamically established between the user equipment and the user equipment communication connection.
  • the fifth network element generates a shared key according to the first temporary identifier, the relay service code and the third key, including: The fifth network element generates a shared key according to the first temporary identifier, the relay service code and the third key; including: the fifth network element obtains the third temporary identifier according to the first temporary identifier key, the fifth network element generates a shared key according to the third key and the relay service code.
  • the fifth network element obtains the third key according to the first temporary identifier, so that the fifth network element can generate a device for protecting the device according to the third key and the relay service code the shared key of the communication connection between the two, the fifth network element sends the shared key to the second user equipment via one or more intermediate network elements, ensuring that the shared key is dynamically established between the first user equipment and the second user equipment , based on the shared key, a secure communication connection is dynamically established between the user equipment and the user equipment.
  • acquiring the first temporary identifier by the fifth network element includes: the fifth network element receiving the first temporary identifier from the first network element, and the The first temporary identifier is generated based on a first intermediate key, and the first intermediate key is an intermediate key generated in the process of authenticating the first user equipment or based on the intermediate key generated in the process of authentication.
  • the key obtained by key derivation; or, the fifth network generates the first temporary identifier based on the third intermediate key.
  • the fifth network element obtains the first temporary identifier, so that the fifth network element can obtain the third key according to the first temporary identifier, so that the fifth network element can obtain the third key according to the third
  • the key and the relay service code are used to generate a shared key for protecting the communication connection between devices, and the fifth network element sends the shared key to the second user equipment via one or more intermediate network elements, ensuring that the first A shared key is dynamically established between the user equipment and the second user equipment, and based on the shared key, a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the third key is a key deduced based on the key Kausf generated in the authentication process.
  • the first temporary identifier is generated based on the first key, including: the first temporary identifier is based on the first key, The network identification and routing information of the first user equipment are generated; wherein, the network identification of the first user equipment is used for the network side to identify the information of the first user equipment, and the routing information is used to determine the information about the core network element related to the first user equipment.
  • the first temporary identifier is generated based on the first key, the network identifier of the first user equipment, and routing information, including: the The second temporary identifier is obtained based on the first key and the network identifier of the first user equipment as input parameters of the first preset algorithm; the first temporary identifier is obtained by combining the second temporary identifier and the obtained by splicing the routing information.
  • the network identifier of the first user equipment is the user permanent identifier SUPI or the International Mobile Subscriber Identity IMSI or the Universal Public Subscription Identifier GPSI; the routing information is routing instructions.
  • the key acquisition message further includes a first freshness parameter; the fifth network element according to the first temporary identifier, the relay service code and a third key, generating a shared key, comprising: the fifth network element generating a shared key according to the first temporary identifier, the relay service code, the third key and the first freshness parameter key.
  • the fifth network element generates a shared key according to the first temporary identifier, the relay service code, the second key and the first freshness parameter, to ensure that the second key is the same,
  • the relay service codes are the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the method further includes: the fifth network element generates a second freshness parameter; the fifth network element generates a second freshness parameter according to the first temporary identifier, the Relay service code and third key to generate a shared key, including: the fifth network element according to the first temporary identifier, the relay service code, the third key and the third key Two freshness parameters to generate a shared key.
  • the fifth network element generates a shared key according to the first temporary identifier, the relay service code, the second key, and the second freshness parameter, to ensure that the second key is the same,
  • the relay service codes are the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the key acquisition message further includes a first freshness parameter; the method further includes: the fifth network element generating the shared key according to the relay service code and the third key, comprising: the fifth network element according to the first temporary identifier, the relay service code, the third key, the The first freshness parameter and the second freshness parameter generate a shared key.
  • the fifth network element generates a shared key according to the first temporary identifier, the relay service code, the second key, the first temporary identifier and the second freshness parameter, to ensure that the The second key is the same and the relay service code is the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the fifth network element is the first short-range service security function network element.
  • the fifth network element is the first short-range service security function network element.
  • the sixth network element is a second short-range service security function network element.
  • a system for generating a key for inter-device communication comprising: a first network element for generating a first temporary identifier based on the first key; The network element sends a key acquisition message, where the key acquisition message includes the identification of the first user equipment and the relay service code, wherein the identification of the first user equipment includes the first temporary identification or the first user
  • the network identifier of the device where the network identifier of the first user equipment is used for the network side to identify the information of the first user equipment; the first network element is also used to code and a second key to generate a shared key; wherein the shared key is used to protect the communication connection between the first user equipment and the second user equipment, and the second key and the first user equipment
  • the key is a key generated in the authentication process of the first user equipment or a key derived based on an intermediate key generated in the authentication process of the first user equipment; the first network element sends The second network element sends the shared key.
  • the first network element generates a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, so that the security is dynamically established between the user equipment and the user equipment communication connection.
  • the first network element is further configured to generate a shared secret according to the identifier of the first user equipment, the relay service code and the second key key, including: the first network element is further configured to obtain the second key according to the identifier of the first user equipment, and the first network element is further configured to obtain the second key according to the second key and the middle Following the service code, the shared key is generated.
  • the first network element obtains the second key according to the identifier of the first user equipment, so that the first network element can generate a
  • the shared key for protecting the communication connection between the devices enables a secure communication connection between the user equipment and the user equipment to be dynamically established.
  • the second key is the same as the first key, and the second key and the first key are the authentication The key Kausf generated in the process or the key derived based on the Kausf.
  • the second key is different from the first key, and the first key is the key Kausf generated in the authentication process ;
  • the second key is a key derived based on the Kausf.
  • the second key is different from the first key, and the second key is the key Kausf generated in the authentication process ;
  • the first key is a key derived based on the Kausf.
  • the first network element configured to generate the first temporary identifier based on the first key, includes: the first network element is further configured to, based on the first key, the network identifier and routing information of the first user equipment, to generate the first temporary identifier; wherein the network identifier of the first user equipment is used for the network side to identify the first user equipment information, where the routing information is information used to determine the core network element related to the first user equipment.
  • the first network element Based on the above technical solution, the first network element generates the first temporary identifier based on the first key, the network identifier of the first user equipment, and routing information, so that the core network element related to the first user equipment can obtain the first temporary identifier according to the first temporary identifier.
  • the above-mentioned second key is further determined according to the second key and sent to the second user equipment to ensure that the first user equipment and the second user equipment obtain the same shared key. Based on the shared key, a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the first network element is further configured to, based on the first key, the network identifier of the first user equipment, and routing information, generate the The first temporary identification includes: the first network element is further configured to obtain a second temporary identification based on the first key and the network identification of the first user equipment as input parameters of the first preset algorithm; The second temporary identifier and the routing information are spliced to obtain the first temporary identifier.
  • the first network element Based on the above technical solution, the first network element generates the first temporary identifier based on the first key, the network identifier of the first user equipment, and routing information, so that the core network element related to the first user equipment can obtain the first temporary identifier according to the first temporary identifier.
  • the above-mentioned second key is helpful for the first network element to determine the shared key according to the second key and send it to the second user equipment via one or more intermediate network elements, so that a dynamic relationship between the user equipment and the user equipment is established. Secure communication connection.
  • the network identifier of the first user equipment is the user permanent identifier SUPI or the international mobile subscriber identity IMSI or the general public subscription identifier GPSI; the routing information is routing instructions.
  • the system further includes: a third network element, and in the process of authenticating the first user equipment, the third network element is configured to send a request to the third network element.
  • the first network element sends first indication information; in response to the first indication information, the first network element is configured to, based on the first key, generate the first temporary identifier.
  • the first network element Based on the above technical solution, the first network element generates a first temporary identifier in response to the indication information sent by the third network element, so that the first network element can obtain the above-mentioned second key according to the first temporary identifier, which is beneficial to the first
  • the network element determines the shared key according to the second key and sends it to the second user equipment via one or more intermediate network elements, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the system further includes: a fourth network element, and in the process of authenticating the first user equipment, the fourth network element is used to send the The first network element sends capability information, where the capability information is used to indicate the capability of the first user equipment to support the remote UE; in response to the first indication information and the capability information, the first network element uses and generating the first temporary identifier based on the first key.
  • the first network element Based on the above technical solution, the first network element generates a first temporary identifier in response to the indication information sent by the third network element and the capability information sent by the fourth network element, so that the first network element can obtain the above-mentioned first temporary identifier according to the first temporary identifier.
  • the second key is helpful for the first network element to determine the shared key according to the second key and send it to the second user equipment via one or more intermediate network elements, so that the user equipment and the user equipment are dynamically established. communication connection.
  • the first network element is further configured to send the first temporary identifier to the third network element.
  • the first network element sends the first temporary identifier to the third network element, and the third network element stores the first temporary identifier in the context information of the first user equipment, so as to facilitate all
  • the third network element determines the identifier of the first network element from the context of the first user equipment according to the first temporary identifier, and then enables the first network element to obtain the second key according to the first temporary identifier , so that the first network element determines the shared key according to the second key and sends it to the second user equipment via one or more intermediate network elements, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the second network element is further configured to send the first temporary identifier to the third network element; the third network element is further configured to , sending the identifier of the first network element to the second network element.
  • the second network element sends the first temporary identifier (the first temporary identifier sent by the first user equipment to the second network element via one or more intermediate network elements) to the third network element for use in
  • the third network element determines the identifier of the first network element from the context of the first device according to the first temporary identifier, and then enables the first network element to obtain the above-mentioned second key according to the first temporary identifier, thereby
  • the first network element determines the shared key according to the second key and sends it to the second user equipment via one or more intermediate network elements, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the third network element is further configured to send the identifier of the first network element and the network identifier of the first user equipment to the second network element .
  • the third network element sends the identifier of the first network element and the network identifier of the first user equipment to the second network element, so that the second network element finds the first network element according to the identifier of the first network element, so that the The first network element can obtain the above-mentioned second key according to the first temporary identification or the network identification of the first user equipment, so that the first network element determines the shared key according to the second key and sends it via one or more intermediate network elements
  • a secure communication connection is dynamically established between the user equipment and the user equipment.
  • the key acquisition message further includes a first freshness parameter; the first network element is used to: generating the shared key by using the relay service code and the second key, including: the first network element being used for, according to the identifier of the first user equipment, the relay service code, the second key and the The first freshness parameter is described, and a shared key is generated.
  • the first network element generates a shared key according to the identifier of the first user equipment, the relay service code, the second key, and the first freshness parameter, to ensure that the second key is The same and the same relay service code, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the first network element is further configured to generate a second freshness parameter; the first network element is configured to, according to the first user equipment's The identification, the relay service code, and the second key, and generating a shared key, including: the first network element being used for, according to the identification of the first user equipment, the relay service code, the first The second key and the second freshness parameter generate a shared key.
  • the first network element generates a shared key according to the identifier of the first user equipment, the relay service code, the second key, and the second freshness parameter, to ensure that the second key is The same and the same relay service code, but the first user equipment generates different shared keys when establishing direct communication with different user equipments, thereby making the secure communication connection established between the user equipment and the user equipment more reliable.
  • the key acquisition message further includes a first freshness parameter; the first network element is further configured to generate a second freshness parameter; the first A network element is used for generating a shared key according to the identifier of the first user equipment, the relay service code and the second key, including: the first network element is used for, according to the first network element The identifier of a user equipment, the relay service code, the second key, the first freshness parameter and the second freshness parameter are used to generate a shared key.
  • the first network element generates a shared secret according to the identifier of the first user equipment, the relay service code, the second key, the first freshness parameter and the second freshness parameter ensure that the second key is the same and the relay service code is the same, but the first user equipment generates different shared keys when establishing direct communication with different user equipment, so that the security established between the user equipment and the user equipment The communication connection is more reliable.
  • the system further includes: a first user equipment and a second user equipment.
  • the first network element is an authentication function network element.
  • the second network element is a mobility management network element, an authentication function network element, or a short-range service security function network element.
  • the third network element is a data management network element.
  • the fourth network element is a mobility management network element.
  • an apparatus for generating a key for communication between devices comprising: a memory for storing computer instructions; a processor for executing the computer instructions stored in the memory, so that the apparatus executes The method described in the first aspect or any one of the possible implementations of the first aspect.
  • the apparatus for generating a key for inter-device communication executes the method described in the first aspect or any possible implementation manner of the first aspect, so that the apparatus generates a key that can be used to protect the A shared key for the communication connection between the first user equipment and the second user equipment, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • an apparatus for generating a key for inter-device communication comprising: a memory for storing computer instructions; a processor for executing the computer instructions stored in the memory, so that the apparatus executes The method described in the second aspect or any one possible implementation manner of the second aspect.
  • the apparatus for generating a key for inter-device communication executes the method described in the second aspect or any possible implementation manner of the second aspect, so that the apparatus generates a key that can be used to protect the A shared key for the communication connection between the first user equipment and the second user equipment, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • an apparatus for generating a key for communication between devices comprising: a memory for storing computer instructions; a processor for executing the computer instructions stored in the memory, so that the apparatus executes The method described in the third aspect or any one possible implementation manner of the third aspect.
  • the apparatus for generating a key for inter-device communication executes the method described in the third aspect or any possible implementation manner of the third aspect, so that the apparatus generates a key that can be used to protect the A shared key for the communication connection between the first user equipment and the second user equipment, so that a secure communication connection is dynamically established between the user equipment and the user equipment.
  • a readable computer storage medium on which a computer program is stored, and when the computer program is executed by a communication device, the communication device can execute the first aspect or any one of the possible first aspects. Implement the method described in the method.
  • a computer program is stored on the readable computer storage medium, and when the computer program is executed by an apparatus for generating a key for inter-device communication, the computer program is executed by executing the first aspect or any one of the possible options in the first aspect.
  • the method described in the implementation manner enables the apparatus to generate a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, thereby enabling dynamic communication between the user equipment and the user equipment.
  • a secure communication connection is established.
  • a readable computer storage medium on which a computer program is stored, and when the computer program is executed by a communication device, the communication device can execute the second aspect or any one of the possible possibilities of the second aspect. Implement the method described in the method.
  • a computer program is stored on the readable computer storage medium, and when the computer program is executed by an apparatus for generating a key for inter-device communication, by executing the second aspect or any one of the possible possibilities of the second aspect
  • the method described in the implementation manner enables the apparatus to generate a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, thereby enabling dynamic communication between the user equipment and the user equipment.
  • a secure communication connection is established.
  • a readable computer storage medium on which a computer program is stored, and when the computer program is executed by a communication device, causes the communication device to execute the third aspect or any one of the possible possibilities of the third aspect. Implement the method described in the method.
  • a computer program is stored on the readable computer storage medium, and when the computer program is executed by the apparatus for generating a key for inter-device communication, by executing the third aspect or any one of the possible possibilities of the third aspect
  • the method described in the implementation manner enables the apparatus to generate a shared key that can be used to protect the communication connection between the first user equipment and the second user equipment, thereby enabling dynamic communication between the user equipment and the user equipment.
  • a secure communication connection is established.
  • a chip system in an eleventh aspect, includes a processor for calling and running a computer program from a memory, so that a device installed with the chip system executes the first aspect or any one of the first aspects A communication method described in a possible implementation.
  • system-on-a-chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory or other instructions.
  • the processor is configured to implement the method of the first aspect or any possible implementations thereof.
  • system-on-a-chip can be integrated on user equipment.
  • a twelfth aspect provides a chip system, the chip system includes a processor for calling and running a computer program from a memory, so that a device installed with the chip system executes the second aspect or any of the second aspects A communication method described in a possible implementation.
  • system-on-a-chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory or other instructions.
  • the processor is adapted to implement the method of the second aspect above or any possible implementation thereof.
  • system-on-a-chip can be integrated on a network device.
  • a thirteenth aspect provides a chip system, the chip system includes a processor for calling and running a computer program from a memory, so that a device installed with the chip system executes the third aspect or any of the third aspects A communication method described in a possible implementation.
  • system-on-a-chip may further include a memory in which instructions are stored, and the processor is configured to execute the instructions stored in the memory or other instructions.
  • the processor is configured to implement the method of the above third aspect or any possible implementations thereof.
  • system-on-a-chip can be integrated on a network device.
  • a secure communication connection is dynamically established between the user equipment and the user equipment.
  • FIG. 1 is a schematic diagram of a scenario applied to an embodiment of the present application
  • FIG. 2 is a schematic diagram of a network architecture applied to an embodiment of the present application
  • FIG. 3 is a schematic interaction flowchart of an example of a method for deriving a temporary identity of a remote user equipment on the network side provided by an embodiment of the present application
  • FIG. 4 is a schematic interaction flowchart of an example of a method for a remote user equipment to access a network through a relay user equipment provided by an embodiment of the present application
  • FIG. 5 is a schematic interaction flowchart of another example of a method for deriving a temporary identity of a remote user equipment on the network side provided by an embodiment of the present application
  • FIG. 6 is a schematic interaction flowchart of another example of a method for a remote user equipment to access a network through a relay user equipment provided by an embodiment of the present application
  • FIG. 7 is a schematic interaction flowchart of another example of a method for deriving a temporary identity of a remote user equipment on the network side provided by an embodiment of the present application
  • FIG. 8 is a schematic interaction flowchart of another example of a method for a remote user equipment to access a network through a relay user equipment provided by an embodiment of the present application
  • FIG. 9 is a schematic block diagram of an example of a communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic block diagram of another example of a communication device provided by an embodiment of the present application.
  • the wireless communication systems mentioned in the embodiments of the present application include but are not limited to: a global system of mobile communication (GSM) system, a long term evolution (long term evolution, LTE) frequency division duplex (frequency division duplex, FDD) system , LTE time division duplex (time division duplex, TDD), wideband code division multiple access (wideband code division multiple access, WCDMA) system, code division multiple access (code division multiple access, CDMA) system, time division synchronous code division multiple access ( time division-synchronous code division multiple access, TD-SCDMA), general packet radio service (GPRS), LTE system, advanced long-term evolution (LTE-Advanced, LTE-A) system, general mobile communication system (universal mobile telecommunication system, UMTS), worldwide interoperability for microwave access (WiMAX) communication system, next-generation communication system (for example, 5G communication system), fusion system of multiple access systems, or evolution system , Three major application scenarios of the next-generation 5G mobile communication system: enhanced mobile broadband (eMBB), ultra
  • V2V Vehicle to Vehicle
  • V2I Vehicle to Infrastructure
  • V2P Vehicle to Pedestrian
  • V2N Vehicle to Network
  • the terminal devices involved in the embodiments of this application may include various access terminals, mobile devices, user terminals, or user equipments with wireless communication functions.
  • user equipment UE
  • handheld terminal notebook computer
  • subscriber unit cellular phone
  • smart phone wireless data card
  • personal digital assistant, PDA personal digital assistant
  • tablet computer tablet computer
  • wireless modem modem
  • handheld device handheld
  • laptop computer laptop computer
  • cordless phone cordless phone
  • wireless local loop wireless local loop
  • WLL wireless local loop
  • MTC machine A machine type communication
  • a certain air interface technology is used to communicate with each other between the terminal equipment and the access network equipment.
  • the embodiments of the present application do not limit application scenarios.
  • FIG. 1 shows a schematic diagram of a scenario applied to an embodiment of the present application.
  • the Remote UE accesses the operator network through the UE-to-Network Relay to perform service interaction with the data network.
  • FIG. 1 is only for ease of understanding, and is an example of a schematic diagram of an application scenario of the embodiment of the present application, which is not limited by the embodiment of the present application, and the network elements involved in the schematic diagram are described below.
  • Remote UE A UE with short-range communication that can communicate with a data network (DN) through a relay device.
  • DN data network
  • UE may be a UE capable of accessing and accessing the network through another UE.
  • UE-to-Network Relay It can be a UE capable of providing access to another UE and providing the UE with the function of accessing the network.
  • RAN equipment is mainly 3GPP network wireless network equipment
  • AN can be a non-3GPP-defined access network equipment, which is mainly responsible for radio resource management, quality of service (QoS) management, data compression and encryption on the air interface side.
  • the access network equipment may include various forms of base stations, such as: a macro base station, a micro base station (also referred to as a small cell), a relay station, an access point, and the like.
  • the names of devices with base station functions may be different, for example, in the 5th generation (5G) system, it is called RAN or gNB (5G NodeB); In an LTE system, it is called an evolved NodeB (evolved NodeB, eNB or eNodeB); in a 3rd generation (3rd generation, 3G) system, it is called a Node B (Node B) and so on.
  • 5G 5th generation
  • RAN 5th generation
  • gNB 5G NodeB
  • eNB evolved NodeB
  • 3rd generation (3rd generation, 3G) system it is called a Node B (Node B) and so on.
  • Gateway mainly responsible for external connection to the data network and data packet routing and forwarding on the user plane, packet filtering, and performing service quality control related functions.
  • User data can be received from the data network and transmitted to the terminal device through the access network device, and user data can also be received from the terminal device through the access network device and forwarded to the data network.
  • the user plane network element may be a user plane function (UPF) network element.
  • the user plane network element may still be the UPF network element, or may have other names, which are not limited in this application.
  • FIG. 2 shows a schematic diagram of a 5G network architecture applied to an embodiment of the present application.
  • the embodiments of the present application may be applied to a network architecture of a 5G communication system, and each network element that may be involved in the network architecture will be described below.
  • Authentication server function (AUSF) network element supports the authentication function during access.
  • the AUSF network element is used to implement authentication when the UE accesses the network, to generate a key, and can also be used to determine the authorization of the Remote UE.
  • Unified data management (UDM) network element used to generate authentication credentials, user identification processing (such as storing and managing user permanent identities, etc.), access authorization control and contract data management, etc.
  • UDM Unified data management
  • the UDM is used to perform authorization determination on the Remote UE, and store user information.
  • PCF Policy control function
  • Network exposure function (NEF) network element used to securely open services and capabilities provided by 3GPP network functions to the outside.
  • Application function network element used to provide services, or perform data routing affected by applications, access network open function network elements, or exchange service data with PCF network elements for policy control, etc.
  • the network repository function (NRF) network element is used for a network function (NF) network element in the network to discover the network elements of another NF, such as network function entities such as AMF, SMF, PCF, and UDM. Both are called NF network elements.
  • the NRF is used to find the routing information of the AUSF according to the instance ID (Instance ID) of the AUSF, and send it to the PSF.
  • Unified data storage network element that is, used to store user subscription data, service policy data, unstructured data, etc.
  • Mobility management function network element access and mobility management function, AMF
  • AMF access and mobility management function
  • MME mobility management entity
  • Other functions other than that, such as terminal mobility management, terminal authentication and de-authentication, terminal session access, terminal allowed slice access selection, legal interception or access authorization (or authentication) and other functions.
  • Session management function session management function, SMF
  • SMF Session management function
  • IP Internet Protocol
  • User plane function network element can be used for packet routing and forwarding, or quality of service (quality of service, QoS) parameter processing of user plane data, etc.
  • User data can be transmitted to the data network (DN) through this network element.
  • DN data network
  • PC5 The reference point between UEs with NFC capability, used for ProSe Direct Discovery, ProSe Direct Communication and UE-to-Network Relay control plane connection and User plane connection.
  • UE A can directly access the network through the Uu interface, or can first establish a connection with UE C through the PC5 interface, and then access the network through UE C.
  • UE B first establishes a connection with UE A through the PC5 interface, and then accesses the network through UE A;
  • UE C can access the network through the Uu interface, or first establish a connection with UE A through the PC5 interface, and then access the network through UE A.
  • both UE A and UE C can directly access the network through the Uu interface.
  • UE A can also establish a connection with UE C through the PC5 interface first, and then access the network through UE C (at this time, UE A is called Remote UE, and UE C is called UE-to-Network Relay); UE C can also pass The PC5 interface establishes a connection with UE A, and then accesses the network through UE A (at this time, UE C is called Remote UE, and UE A is called UE-to-Network Relay).
  • UE B first establishes a connection with UE A through the PC5 interface, and then accesses the network through UE A (at this time, UE B is called Remote UE, and UE A is called UE-to-Network Relay).
  • UE A and UE C can be regarded as either a UE-to-Network Relay that provides a network connection function for another Remote UE, or a UE-to-Network Relay capable of accessing and accessing the network through another UE-to-Network Relay.
  • Remote UE UE-to-Network Relay that provides a network connection function for another Remote UE
  • UE-to-Network Relay capable of accessing and accessing the network through another UE-to-Network Relay.
  • UE B can be considered as a Remote UE with the ability to access and access the network through another UE-to-Network Relay, and access the network through UE-to-Network Relay A.
  • FIG. 3 shows a schematic flowchart of the network side deriving the temporary identity of Remote UE#1 during or after the authentication process of UE#1 (that is, an example of the first user equipment) according to the embodiment of the present application, including the following steps:
  • UDM generates indication information and sends it to AUSF#1.
  • AUSF#1 the following implementations can be listed:
  • UE#1 reports capability information to AMF#1, where the capability information is used to indicate whether the UE#1 supports the capability of being a Remote UE.
  • the capability information reported by the UE side to the network side may be carried in a non-access stratum NAS message (eg, a registration request message) sent by UE#1 to AMF#1 (ie, an example of the fourth network element).
  • NAS message eg, a registration request message
  • AMF#1 sends capability information of UE#1 to AUSF#1.
  • the capability information of UE#1 sent by AMF#1 to AUSF#1 may be carried in the authentication request message (eg, Nausf_UEAuthentication_Authenticate Request) sent by AMF#1 to AUSF#1.
  • the authentication request message eg, Nausf_UEAuthentication_Authenticate Request
  • AUSF#1 receives the capability information sent by S410, and sends the capability information to the UDM (ie, an example of the third network element).
  • AUSF#1 may send an authentication request message (eg, Nudm_UEAuthentication Request message) containing capability information of UE#1 to UDM.
  • an authentication request message eg, Nudm_UEAuthentication Request message
  • the UDM generates indication information #1 according to the capability information and the subscription data of UE#1, where the indication information #1 is used to indicate whether to generate information for short-range communication of UE#1, for example, the information is used to identify UE#1;
  • the UDM may acquire the subscription information of UE#1 according to the authentication request message carrying the capability information, and determine the indication information #1 according to the subscription data of UE#1 and the capability information of UE#1.
  • the UDM determines the indication information #1 according to the capability information of UE#1 and the subscription data of UE#1, including:
  • the UDM indicates AUSF# 1 Generate indication information #1. If any one of the conditions is not satisfied, the UDM does not send the indication information #1 to the AUSF or the indication information #1 indicates that the AUSF #1 does not generate the temporary identifier #1.
  • S440a The UDM sends indication information #1 to AUSF #1.
  • the indication information #1 may be carried in the authentication response message sent by the UDM to the AUSF #1 during the authentication process (for example, Nudm_UEAuthentication response), or may be sent after the authentication request process.
  • S400b to S410b are the same as the above-mentioned S400a to S410a, and are not repeated here for brevity.
  • AUSF#1 sends an authentication request message to the UDM, wherein the authentication request message is the same as or similar to the prior art;
  • UDM obtains UE#1 subscription data according to the authentication request message, and generates indication information #2, which is used to indicate whether UE#1 is authorized as a Remote UE;
  • the UDM sends indication information #2 to AUSF #1.
  • the indication information #2 may be carried in the authentication response message sent by the UDM to the AUSF #1 during the authentication process (for example, Nudm_UEAuthentication response), or may be sent after the authentication process.
  • UE#1 sends a registration request message to AMF#1, wherein the registration request message is the same as or similar to the prior art;
  • AMF#1 sends an authentication request message to AUSF#1, wherein the authentication request message is the same as or similar to the prior art;
  • S420c-S440c are the same as the above-mentioned S420b-S440b, and are not repeated here.
  • AUSF#1 determines to generate a temporary identifier #1 according to any one of the following three situations:
  • Case 1 Corresponding to the above-mentioned mode 1, AUSF#1 receives indication information #1, and the indication information #1 instructs the generation of temporary identifier #1.
  • Case 2 Corresponding to the above method 2, AUSF#1 receives the capability information and indication information #2, and both the capability information and indication information #2 indicate that UE#1 can act as a Remote UE.
  • Case 3 Corresponding to the above-mentioned mode 3, AUSF#1 receives indication information #2, and indication information #2 indicates that UE#1 is authorized as a Remote UE.
  • the process of generating the temporary identification #1 can generate the temporary identification #1 according to the key #1 (that is, an example of the first key) and the network identification of the Remote UE #1, for example, the following implementations can be listed:
  • AUSF#1 generates temporary identifier #1 according to the network identifier of Remote UE#1 sent by AMF#1 in the authentication process and the key #1 generated by AUSF#1 in the authentication process,
  • the algorithm used in the generation process may be the same as or similar to the prior art, and is not described in detail in order to avoid redundant description.
  • the AUSF#1 obtains the temporary identifier #1' (that is, another example of the first temporary identifier) according to the temporary identifier #1 (that is, an example of the second temporary identifier) and the routing information of the UDM.
  • the network identifier of the Remote UE can be listed as follows: user permanent identifier (subscription permanent identifier, SUPI) or international mobile subscriber identity (international mobile subscriber identity, IMSI) or (generic public subscription identifier, GPSI)
  • SUPI subscription permanent identifier
  • IMSI international mobile subscriber identity
  • GPSI generator public subscription identifier
  • Routing indicator The routing information can be listed as follows: Routing indicator.
  • AUSF#1 may store temporary identifier #1 and its corresponding relationship with key #1; it may also not store temporary identifier #1, but store the network identifier and key of Remote UE#1 Correspondence of #1.
  • the key #1 may be a key generated in the authentication process for UE #1 or a key derived based on an intermediate key generated in the authentication process.
  • the key #1 may be based on the key Kausf#1 generated during the authentication process, or may be the key Kpru#1 deduced based on Kausf#1.
  • AUSF#1 obtains temporary identifier #1' according to the splicing of temporary identifier #1 and the routing information of UDM, including the following implementations:
  • the temporary identifier #1 can be represented by X bits, where the upper Y bits are used to represent the routing information; the remaining low (X-Y) bits are used to represent the temporary identifier #1', where X and Y are positive integers;
  • the temporary identifier #1 can be represented by X bits, where the lower Y bits are used to represent the routing information; the remaining high (X-Y) bits are used to represent the temporary identifier #1', where X and Y are positive integers.
  • AUSF#1 may also generate a key derived from the intermediate key generated in the authentication process, such as Kpru#1, after generating the temporary identifier #1. This embodiment of the present application does not make any limitation on this.
  • the AUSF sends the temporary identifier #1 to the UDM.
  • the AUSF#1 sends the temporary identifier #1 and the network identifier of the Remote UE#1 to the UDM, and the UDM stores the temporary identifier #1 in the context information of the Remote UE#1 according to the network identifier of the Remote UE#1.
  • the context of the UE further includes the identifier of the AUSF.
  • FIG. 4 shows a schematic flowchart of the stage of Remote UE#1 accessing the network through UE-to-Network Relay#1 (that is, an example of the second user equipment) according to the embodiment of the present application, including the following steps:
  • Remote UE#1 discovers one or more UE-to-Network Relays, and selects one UE-to-Network Relay (counted as UE-to-Network Relay#1, that is, an example of the second user equipment) to communicate with , the manner in which the Remote UE#1 selects the UE-to-Network Relay#1 is the same as or similar to the prior art, which is not limited in this embodiment of the present application.
  • Remote UE#1 generates a temporary identifier #1' (that is, an example of the first temporary identifier).
  • the way that the Remote UE#1 generates the temporary identifier #1' is the same as the way that the AUSF generates the temporary identifier #1' in S450, that is, the Remote UE#1 obtains the temporary identifier #1' by splicing the temporary identifier #1 and the routing information of the UDM, which is To avoid repetition, detailed description is omitted here.
  • Remote UE#1 sends a request message #1 (ie, an example of the first request) to UE-to-Network Relay#1, where request message #1 is used to request the establishment of the Remote UE#1 and UE-to-Network Relay#1 A communication connection between Network Relay#1, such as a direct communication request (DCR) message.
  • the request message #1 includes the temporary identification #1' and the Relay service code.
  • the Relay service code may be pre-configured by the UE side, or may be sent to the UE by the network side, such as the UE Configuration Update process defined in TS23.502.
  • the Relay service code is used to identify the connection service provided by the UE-to-Network Relay that supports the ProSe service, and the authorized user of the UE-to-Network Relay that supports the ProSe service to provide the service, and can select the relevant security policy or information .
  • the request message #1 may further include a freshness parameter #1 (ie, an example of the first freshness parameter).
  • the request message #1 may further include an integrity message authentication code (message authentication code for integrity, MAC-I) (counted as MAC-I#1).
  • integrity message authentication code messages authentication code for integrity, MAC-I
  • Remote UE#1 takes the Relay service code as an input parameter, and generates key #A according to a specific algorithm based on key #1.
  • Remote UE#1 uses key #A to encrypt temporary identifier #1' and Relay service code after , and generate MAC-I#1, which is used to verify the integrity protection of the request message #1 and prevent the request message #1 from being tampered with by an attacker.
  • the network element #2 (ie, the second network element) may be PSF#1, AMF#2, or AUSF#2.
  • AMF#2 may be the same AMF as AMF#1, or may be an AMF different from AMF#1.
  • AMF#1 may be the AMF serving remote UE#
  • AMF#2 may be the AMF serving UE-to-Network Relay#1.
  • AUSF#2 may be the same AUSF as AUSF#1, or may be a different AUSF from AUSF#1.
  • AUSF#1 may be the AUSF serving remote UE#
  • AUSF#2 may be the AUSF serving UE-to-Network Relay#1.
  • AMF#2 may be the same AMF as AMF#1, or may be an AMF different from AMF#1.
  • AMF#1 may be the AMF serving remote UE#
  • AMF#2 may be the AMF serving UE-to-Network Relay#1.
  • UE-to-Network Relay#1 sends temporary identifier 1' and Relay service code to network element #2.
  • the information acquired by the network element #2 may further include the freshness parameter #1.
  • the information acquired by network element #2 may further include MAC-I #1.
  • the network element #2 determines the corresponding UDM according to the routing information in the temporary identifier #1'.
  • the network element #2 sends the temporary identifier #1' to the UDM.
  • the UDM determines the temporary identifier #1 according to the temporary identifier #1', obtains the network identifier of the Remote UE#1 from the corresponding relationship between the temporary identifier #1 and the network identifier of the Remote UE#1 saved by the UDM in the above S460, and then according to the Remote UE#1
  • the network identity of #1 obtains the identity of AUSF#1 from the context information of Remote UE#1, and sends the identity of AUSF#1 to network element #2.
  • the information sent to the network element #2 may further include the network identifier of the Remote UE#1.
  • UDM obtains the identity of AUSF#1 from the context information of Remote UE#1, including:
  • UDM searches the Instance ID of AUSF#1 from the context information of Remote UE#1, and network element #2 finds AUSF#1 accordingly.
  • the PSF performs an authorization check on the Remote UE#1.
  • the PSF stores authorization information corresponding to each UE to perform authorization checking.
  • the PSF checks whether Remote UE#1 is authorized as a Remote UE according to the network identifier of Remote UE#1, so as to obtain the connection service corresponding to the Relay service code through UE-to-Network Relay#1. If the authorization check passes, continue to perform the following steps; if the authorization check fails, the PSF sends a failure response message to AUSF#2, the response message includes the reason value of the authorization failure (for example, the authorization check fails, lack of necessary parameters, etc.).
  • network element #2 sends a key acquisition message to AUSF #1.
  • the key acquisition message includes the temporary identifier #1' (that is, an example of the identifier of the first user equipment) and the Relay service code.
  • the network element #2 acquires the network identifier of the Remote UE#1 sent by the UDM (that is, an example of the identifier of the first user equipment), the key acquisition message includes the Remote UE#1 Network ID and Relay service code for #1.
  • the key acquisition message may further include a freshness parameter #1.
  • the key acquisition message may further include MAC-I#1.
  • AUSF#1 determines the shared key between Remote UE#1 and UE-to-Network Relay#1 according to key#2 (ie, an example of the second key), Relay service code, and at least one freshness parameter (eg Kr).
  • key#2 ie, an example of the second key
  • Relay service code ie, an example of the second key
  • freshness parameter eg Kr
  • AUSF#1 obtains the temporary identifier #1' sent by the network element #2 in S4150, and AUSF#1 stores the correspondence between the temporary identifier #1 and the key #1 in S450, then AUSF#1 The temporary identifier #1 is determined according to the temporary identifier #1', and the key #1 is found according to the correspondence between the temporary identifier #1 and the key.
  • AUSF#1 obtains the network identifier of Remote UE#1 sent by network element #2 in S4150, and in S450, AUSF#1 stores the network identifier of Remote UE#1 and the network identifier of key #1. corresponding relationship, then AUSF#1 finds key #1 according to the network identifier of Remote UE#1 and the corresponding relationship.
  • the key #2 is the key generated in the authentication process or the key derived from the intermediate key generated in the authentication process.
  • the following three situations can be listed:
  • Case 1 The key #2 is the same as the key #1, and the key #2 and the key #1 are the key Kausf generated in the authentication process or the key derived based on the Kausf.
  • Case 2 The key #2 is different from the key #1, and the key #1 is the key Kausf generated in the authentication process; the key #1 is the key derived based on the Kausf .
  • Case 3 The key #2 is different from the key #1, and the key #2 is the key Kausf generated in the authentication process; the key #1 is the key derived based on the Kausf .
  • Kpru#1 is generated and used in S450
  • key #2 is Kpru#1 in this step
  • Kpru#1 is not generated or used in S450
  • key #2 can be Kausf in this step #1, or Kpru#1 that was generated and used in this step.
  • At least one freshness parameter can be listed in the following embodiments:
  • the at least one freshness parameter may be the freshness parameter #1 sent by S4150 (that is, the freshness parameter #1 generated by the Remote UE);
  • the at least one freshness parameter may be the freshness parameter #2 (that is, an example of the second freshness parameter) generated by the AUSF#1;
  • the at least one freshness parameter may be the freshness parameter #1 generated by the Remote UE#1 and the freshness parameter #2 generated by the AUSF#1 itself.
  • the embodiment of the present application does not limit the quantity of the freshness parameter.
  • AUSF#1 verifies the integrity of the message according to MAC-I#1, Relay service code and temporary identifier #1, which is the same as Remote UE# in S480. 1
  • the method of generating MAC-I#1 is the same.
  • AUSF#1 takes the Relay service code as an input parameter, and generates key#A according to a specific algorithm based on key#1.
  • Remote UE#1 uses key#A to encrypt temporary After identifying #1 and Relay service code, MAC-I#1' is generated. If MAC-I#1 is inconsistent with MAC-I#1', it means that the information content is lost or attacked during transmission. If MAC-I#1 Consistent with MAC-I#1', the shared key is deduced.
  • the input parameter of the above-mentioned generation key #A may further include a freshness parameter #1.
  • AUSF#1 sends the shared key to network element #2, and network element #2 sends the shared key to UE-to-Network Relay#1.
  • the network element #2 sends the shared key to the UE-to-Network Relay#1 in the following ways:
  • the network element #2 sends the UE-to-Network Relay#1 through the user;
  • network element #2 sends to UE-to-Network Relay#1 through signaling.
  • the shared key may be forwarded to UE-to-Network Relay#1 through one or more other network elements.
  • AUSF#1 sends freshness parameter #2 to UE-to-Network Relay#1.
  • UE-to-Network Relay#1 sends a security mode command to Remote UE#1.
  • the security mode command includes a security algorithm
  • the security algorithm may include an encryption algorithm and/or an integrity protection algorithm.
  • the safe mode command may further include a freshness parameter #2.
  • the Remote UE#1 generates the shared key in this step by using the same method as the AUSF#1 in S4160 to generate the shared key based on the key, the Relay service code, and at least one freshness parameter.
  • Remote UE#1 and UE-to-network Relay#1 obtain the communication key based on the shared key and the security algorithm.
  • obtaining the communication key may include the following implementations:
  • Remote UE#1 and UE-to-network Relay#1 deduce an intermediate key or session key based on the generated shared key, and further, derive Remote based on the intermediate key or session key Encryption key (for example, NR PC5Encryption Key, NRPEK) and/or integrity protection key (for example, NR PC5Integrity Key, NRPIK) of the signaling plane and user plane between UE#1 and UE-to-network Relay#1.
  • Encryption key for example, NR PC5Encryption Key, NRPEK
  • integrity protection key for example, NR PC5Integrity Key, NRPIK
  • Remote UE#1 and UE-to-network Relay#1 deduce the message or data between Remote UE#1 and UE-to-network Relay#1 based on the generated shared key, respectively. Encryption key and/or full protection key.
  • the specific generation method of the communication key is the same as or similar to the prior art, for example, the key generation method in TS23.303 and TS33.536.
  • UE-to-Network Relay#1 sends a response message #1 to Remote UE#1 to respond to the security mode command in S4180, and the response message #1 indicates that communication security has been established.
  • UE-to-Network Relay#1 sends a response message #2 to Remote UE#1, which is used to respond to the request message #1 in S490, and the response message #2 indicates that the direct connection communication has been established.
  • FIG. 5 shows a schematic flowchart of the stage of authorizing UE#1 as Remote UE#1 (that is, an example of the first user equipment) by the network side in the authentication process of UE#1 according to the embodiment of the present application, including the following steps:
  • S500a-S540a in Mode 1 are similar to the above-mentioned methods in S400a-S440a
  • S500b-S540b in Mode 2 are similar to the above-mentioned methods in S400b-S440b
  • S500c-S540c in Mode 3 are similar to the above-mentioned methods in S400c-S440c The method is similar and will not be repeated here.
  • the PSF obtains the key #3 (that is, an example of the third key) and the temporary identifier #1, and the following implementations can be listed:
  • AUSF#1 generates a temporary identifier #1 and a key #3.
  • the AUSF#1 sends the temporary identifier #1 and the key #3 to the PSF, and the PSF stores the temporary identifier #1 and the corresponding relationship between the temporary identifier #1 and the key #3.
  • the key #3 may be a key derived based on the intermediate key generated in the authentication process.
  • the key #3 may be the key Kpru#1 derived from the key Kausf#1 generated in the authentication process.
  • the key #1 is a key derived based on the intermediate key generated in the authentication process (for example, Kpru#1)
  • the key #1 and the key #3 are the same.
  • the AUSF#1 determines to generate the key #3 according to the three situations described in the above S450, and at the same time determines that the temporary identifier #1 is generated by the PSF.
  • the AUSF#1 sends the network identifier of the Remote UE#1 and the sending key #3 to the PSF, which can be used to indicate that the temporary identifier #1 is generated by the PSF.
  • the PSF generates the temporary identifier #1 according to the network identifier of the Remote UE#1 and the key #3, which can be implemented in the following ways:
  • the PSF generates a temporary identification #1 (ie, an example of the first temporary identification) according to the network identification of Remote UE #1 and the key #3.
  • the PSF obtains the temporary identifier #1' (that is, an example of the second temporary identifier) according to the splicing of the temporary identifier #1 and the routing information of the UDM.
  • the PSF stores the temporary identifier #1 and its corresponding relationship with the key #3.
  • FIG. 6 shows a schematic flowchart of the stage of Remote UE#1 accessing the network through UE-to-Network Relay in the embodiment of the present application, including the following steps:
  • S570 is the same as or similar to the method of S470 above.
  • Remote UE#1 discovers one or more UE-to-Network Relays, and selects one UE-to-Network Relay (counted as UE-to-Network Relay#1, that is, the first UE-to-Network Relay). An example of two user equipments) to communicate.
  • S580 is the same as or similar to the method of S480 above, and the Remote UE#1 generates a temporary identifier #1'.
  • the manner in which the Remote UE#1 generates the temporary identifier #1' is the same as the manner in which the AUSF#1 generates the temporary identifier #1' in S540.
  • AUSF#1 obtains temporary identifier #1' according to the splicing of temporary identifier #1 and the routing information of PSF, including the following implementations:
  • the temporary identifier #1 can be represented by X bits, where the upper Y bits are used to represent the routing information; the remaining low (X-Y) bits are used to represent the temporary identifier #1', where X and Y are positive integers;
  • the temporary identifier #1 can be represented by X bits, where the lower Y bits are used to represent the routing information; the remaining high (X-Y) bits are used to represent the temporary identifier #1', where X and Y are positive integers.
  • the specific algorithm is the same as or similar to the prior art, such as the basic key derivation method specified in the standard.
  • the Remote UE#1 sends a request message #1 (that is, an example of the first request) to the UE-to-Network Relay#1, and the request message #1 is used to request the UE-to-Network Relay#1 to-Network Relay#1 accesses the network, such as a direct communication request (DCR) message.
  • Request message #1 carries information #2, and request message #1 includes temporary identifier #1' and Relay service code.
  • the Relay service code may be pre-configured by the UE side, or may be sent to the UE by the network side, such as the UE Configuration Update process defined in TS23.502.
  • the Relay service code is used to identify the connection service provided by the UE-to-Network Relay that supports the ProSe service, and the authorized user of the UE-to-Network Relay that supports the ProSe service to provide the service, and can select the relevant security policy or information .
  • the request message #1 may further include a freshness parameter #1.
  • the request message #1 may further include the MAC-I #2.
  • Remote UE#1 takes the Relay service code as an input parameter, and generates key #A according to a specific algorithm based on key #3.
  • Remote UE#1 uses key #A to encrypt temporary identifier #1' and Relay service code after , and generate an integrity message authentication code (message authentication code for integrity, MAC-I) (counted as MAC-I#2), which is used to verify the integrity protection of the request message #1 and prevent the request message #1 from being tampered with by an attacker.
  • MAC-I message authentication code for integrity
  • UE-to-Network Relay#1 sends temporary identifier #1' and Relay service code to the PSF on the network side.
  • the information obtained by the PSF from the UE-to-Network Relay#1 may further include the freshness parameter #1.
  • the information obtained by the PSF from UE-to-Network Relay#1 may further include MAC-I#2.
  • the UE-to-Network Relay#1 can send the temporary identifier 1' and the Relay service code to the PSF through one or more other network elements.
  • the method is the same as or similar to that of S4140, and the PSF performs authorization check on Remote UE#1.
  • the PSF stores authorization information corresponding to each UE to perform authorization checking.
  • the PSF checks whether Remote UE#1 is authorized as a Remote UE according to the temporary identifier #1', so as to obtain the connection service corresponding to the Relay service code through UE-to-Network Relay#1. If the authorization check passes, continue to perform the following steps; if the authorization check fails, the PSF sends a failure response message to AUSF#2, the response message includes the reason value of the authorization failure (for example, the authorization check fails, lack of necessary parameters, etc.).
  • the PSF determines the shared key (eg Kr) between Remote UE#1 and UE-to-Network Relay#1 according to key#3, Relay service code, and at least one fresh parameter .
  • Kr shared key
  • the PSF determines the temporary identifier #1 according to the temporary identifier #1', the corresponding relationship between the temporary identifier #1 and the key #3 stored in S560a in the above-mentioned method A, or
  • the key #3 is searched from the corresponding relationship between the temporary identifier #1 and the key #3 stored in S565b in the above method B.
  • the key #3 may be a key derived based on the intermediate key generated in the authentication process.
  • the key #3 may be the key Kpru#1 derived from the key Kausf#1 generated in the authentication process.
  • the generation method of at least one freshness parameter can be listed as follows:
  • At least one freshness parameter may be the freshness parameter #1 sent by S590 (that is, the freshness parameter #1 generated by the Remote UE);
  • the at least one freshness parameter may be the freshness parameter #2 generated by the PSF;
  • the at least one freshness parameter may be the freshness parameter #1 generated by the Remote UE and the freshness parameter #2 generated by the PSF itself.
  • the embodiment of the present application does not limit the quantity of the freshness parameter.
  • the information obtained by the PSF can also include MAC-I#2, then AUSF#1 verifies the integrity of the message according to MAC-I#2, Relay service code and temporary identifier #1, and the verification method is the same as that in S580.
  • the method is the same or similar, AUSF#1 takes the Relay service code as an input parameter, generates key #A according to a specific algorithm based on key #3, and Remote UE#1 uses key #A to encrypt temporary ID #1 and Relay service code After that, MAC-I#2' is generated. If MAC-I#2 and MAC-I#2' are inconsistent, it means that the information content is lost or attacked during the transmission process. If MAC-I#2 and MAC-I#2' If they are consistent, the shared key is deduced.
  • the input parameter of the above-mentioned generation key #A may further include a freshness parameter #1.
  • the PSF sends the shared key to UE-to-Network Relay#1.
  • the PSF is sent through the user-oriented UE-to-Network Relay#1;
  • PSF is sent to UE-to-Network Relay#1 through signaling.
  • the shared key may be forwarded to UE-to-Network Relay#1 through one or more other network elements.
  • AUSF-2 sends freshness parameter #2 to UE-to-Network Relay #1.
  • UE-to-Network Relay#1 sends a security mode command to Remote UE#1.
  • the security mode command includes a security algorithm
  • the security algorithm may include an encryption algorithm and/or an integrity protection algorithm.
  • the safe mode command may further include a freshness parameter #2.
  • the Remote UE#1 uses the same method as S5120 to generate a shared key based on the key #3, the Relay service code, and at least one fresh parameter.
  • the Remote UE#1 obtains the communication key based on the shared key and the security algorithm.
  • obtaining the communication key may include the following implementations:
  • Remote UE#1 and UE-to-network Relay#1 deduce an intermediate key or session key based on the generated shared key, and further, derive Remote based on the intermediate key or session key Encryption key (for example, NR PC5Encryption Key, NRPEK) and/or integrity protection key (for example, NR PC5Integrity Key, NRPIK) of the signaling plane and user plane between UE#1 and UE-to-network Relay#1.
  • Encryption key for example, NR PC5Encryption Key, NRPEK
  • integrity protection key for example, NR PC5Integrity Key, NRPIK
  • Remote UE#1 and UE-to-network Relay#1 deduce the message or data between Remote UE#1 and UE-to-network Relay#1 based on the generated shared key, respectively. Encryption key and/or full protection key.
  • the specific generation method of the communication key is the same as or similar to the prior art, for example, the key generation method in TS23.303 and TS33.536. .
  • UE-to-Network Relay#1 sends a response message #1 to Remote UE#1 for responding to the security mode command in S5160, and the response message #1 indicates that communication security has been established Finish.
  • UE-to-Network Relay#1 sends a response message #2 to Remote UE#1, which is used to respond to the request message #1 in S590, and the response message #2 indicates direct connection communication Completed.
  • FIG. 7 shows a schematic flowchart of the stage of authentication and authorization of UE#1 as Remote UE#1 (that is, an example of the second user equipment) according to the embodiment of the present application, including the following steps:
  • S600a-S640a in Mode 1 are similar to the above-mentioned methods in S500a-S540a
  • S600b-S640b in Mode 2 are similar to the above-mentioned methods in S500b-S540b
  • S600c-S640c in Mode 3 are similar to the above-mentioned methods in S500c-S540c
  • S650a-S660a in mode A are similar to the methods in the above S550a-S560a
  • S650b-S665b in the mode B are similar to the methods in the above-mentioned S550b-S565b
  • S670-S690 are similar to the methods in the above-mentioned S570-S590, It will not be repeated here.
  • PSF#1 (that is, an example of the fifth network element) may be a Remote PSF
  • PSF#2 (that is, an example of the sixth network element) may be a serving UE-to-Network Relay# 1 PSF.
  • UE-to-Network Relay#1 sends temporary identifier #1' and Relay Service Code to PSF#2.
  • the UE-to-Network Relay#1 can send the temporary identifier 1' and the Relay service code to the PSF through one or more other network elements.
  • the information obtained by PSF#2 from UE-to-Network Relay#1 may further include freshness parameter #1.
  • the information obtained by PSF#2 from UE-to-Network Relay#1 may further include MAC-I#1.
  • PSF#2 determines the corresponding PSF#1 according to the routing information in the temporary identifier #1' (that is, an example of the first temporary identifier).
  • PSF#1 obtains temporary identifier #1' and Relay service code.
  • the information acquired by PSF#1 may further include freshness parameter #1.
  • the information acquired by PSF#1 may further include MAC-I#1.
  • the method is the same as or similar to the method of S5110 above, and PSF#1 performs authorization check on Remote UE#1.
  • PSF#1 checks whether Remote UE#1 is authorized as a Remote UE according to temporary identifier #1', so as to obtain the connection service corresponding to the Relay service code through UE-to-Network Relay#1. If the authorization check passes, continue to perform the following steps; if the authorization check fails, PSF#1 sends a failure response message to AUSF#2, the response message includes the reason value of the authorization failure (for example, authorization check fails, lack of necessary parameters, etc.) .
  • the PSF#1 determines the shared key (for example, Kr ). In order to avoid redundant description, detailed description is omitted here.
  • the information obtained by PSF#1 also includes MAC-I#1
  • AUSF#1 is based on MAC-I#1, Relay service code and temporary identifier #1 (that is, an example of the first temporary identifier ) to verify the integrity of the message, and the verification method is the same as or similar to the method of S5120, and will not be repeated here.
  • PSF#1 sends the shared key to PSF#2.
  • PSF#1 is sent through the user-oriented UE-to-Network Relay#1;
  • PSF#1 is sent to UE-to-Network Relay#1 through signaling.
  • the shared key may be forwarded to UE-to-Network Relay#1 through one or more other network elements.
  • the PSF#2 sends the shared key to the UE-to-Network Relay#1.
  • the PSF#2 receives the freshness parameter #2, the PSF#2 sends the freshness parameter #2 to the UE-to-Network Relay#1.
  • UE-to-Network Relay#1 sends a security mode command to Remote UE#1.
  • the security mode command includes a security algorithm
  • the security algorithm may include an encryption algorithm and/or an integrity protection algorithm.
  • the safe mode command may further include a freshness parameter #2.
  • the Remote UE#1 uses the same method as S6150 to generate a shared key based on key #3, Relay service code, and at least one fresh parameter.
  • the Remote UE#1 obtains the communication key based on the shared key and the security algorithm.
  • obtaining the communication key may include the following implementations:
  • Remote UE#1 and UE-to-network Relay#1 deduce an intermediate key or session key based on the generated shared key, and further, derive Remote based on the intermediate key or session key Encryption key (for example, NR PC5Encryption Key, NRPEK) and/or integrity protection key (for example, NR PC5Integrity Key, NRPIK) of the signaling plane and user plane between UE#1 and UE-to-network Relay#1.
  • Encryption key for example, NR PC5Encryption Key, NRPEK
  • integrity protection key for example, NR PC5Integrity Key, NRPIK
  • Remote UE#1 and UE-to-network Relay#1 deduce the message or data between Remote UE#1 and UE-to-network Relay#1 based on the generated shared key, respectively. Encryption key and/or full protection key.
  • the specific generation method of the communication key is the same as or similar to the prior art, for example, the key generation method in TS23.303 and TS33.536.
  • UE-to-Network Relay#1 sends a response message #1 to Remote UE#1 for responding to the security mode command in S6190, and the response message #1 indicates that communication security has been established Finish.
  • UE-to-Network Relay#1 sends response message #2 to Remote UE#1, which is used to respond to request message #1 in S690 (that is, an example of the first request), This response message #2 indicates that the direct communication has been established.
  • the identifier of the first user equipment (that is, including the network identifier of the Remote UE and the network identifier of the first user equipment) is used to identify the information of the first user equipment.
  • the identifier of a user equipment is not limited in any way, and those skilled in the art can flexibly define the identifier according to the specific situation in order to achieve the purpose of identifying the first user equipment.
  • the size of the sequence numbers of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. .
  • Remote UE and UE-to-Network Relay access the network respectively, and obtain authorization and configuration information from the network. Among them, the authorization and configuration information are used to establish a ProSe communication connection.
  • Remote UE discovers one or more UE-to-Network Relays, selects one UE-to-Network Relay among them, and accepts the connection service information provided by it.
  • the Remote UE establishes a one-to-one direct communication connection with the selected UE-to-Network Relay.
  • the UE-to-Network Relay reports the Remote UE Report (Remote UE Report) of the relay-related protocol data unit (PDU) session to the session management network element, for example (Remote User ID ), remote user information (Remote UE info)).
  • PDU relay-related protocol data unit
  • the Remote UE obtains services through the UE-to-Network Relay
  • a secure connection needs to be established between the Remote UE and the UE-to-Network Relay.
  • the communication connection established by the Remote UE through the UE-to-Network Relay is established dynamically on demand, for example, during the discovery process of the Remote UE, the discovered UE-to-Network Relay is not fixed.
  • the first discovered may be UE-to-Network Relay#1
  • the second discovered may be UE-to-Network Relay#1.
  • the UE-to-Network Relay discovered by the Remote UE may be different and unpredictable at different times and places. Therefore, it is not possible to pre-configure shared security parameters (eg, shared keys) between the Remote UE and the UE-to-Network Relay for secure communication between the Remote UE and the UE-to-Network Relay.
  • the embodiments of the present application generate a key for inter-device communication, so that a secure communication connection is dynamically established between the user equipment and the user equipment, which is substantially different from the above-mentioned prior art , which solves the problems existing in the above-mentioned prior art.
  • each network element includes corresponding hardware structures and/or software modules for performing each function.
  • each network element includes corresponding hardware structures and/or software modules for performing each function.
  • the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
  • the transmitting-end device or the receiving-end device may be divided into functional modules according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. middle.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation. The following description will be given by taking as an example that each function module is divided corresponding to each function.
  • FIG. 9 is a schematic block diagram of a communication apparatus 100 provided by an embodiment of the present application.
  • the communication apparatus 100 may include: a transceiver unit 110 and a processing unit 120 .
  • the communication apparatus 100 may be the remote user equipment in the above method embodiments, or may be a chip for implementing the functions of the remote user equipment in the above method embodiments.
  • the communication apparatus 100 may correspond to the remote user equipment in the method 400, the method 500, the method 600, the method 700, the method 800, and the method 900 according to the embodiments of the present application, and the communication apparatus 100 may include a method for executing the Method 400 in Figure 3, Method 500 in Figure 4, Method 600 in Figure 5, Method 700 in Figure 6, Method 800 in Figure 7, Method 900 in Figure 8, Method 700 in Figure 6, Figure 7 Elements of the method performed by the remote user equipment in the method 800 in FIG. 8 and the method 900 in FIG. 8 .
  • each unit in the communication device 100 and the above-mentioned other operations and/or functions are for implementing the method 400 in FIG. 3 , the method 500 in FIG. 4 , the method 600 in FIG.
  • the communication apparatus 100 may be the authentication function network element in the above method embodiment, or may be a chip for implementing the authentication function network element in the above method embodiment.
  • the communication device 100 may correspond to the authentication function network element in the method 400 and the method 500 according to the embodiment of the present application, and the communication device 100 may include a method for executing the method 400 in FIG. 3 and the method 500 in FIG. 4 .
  • each unit in the communication device 100 and the above-mentioned other operations and/or functions are respectively to implement the corresponding processes of the method 400 in FIG. 3 and the method 500 in FIG. 4 .
  • the specific process of each unit performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and for the sake of brevity, it will not be repeated here.
  • the communication apparatus 100 may be the short-range service security function network element in the above method embodiment, or may be a network element for implementing the short-range service security function in the above method embodiment functional chip.
  • the communication device 100 may correspond to the short-range service security function network element in the method 600, the method 700, the method 800 and the method 900 according to the embodiments of the present application, and the communication device 100 may include a method for executing the method in FIG. 5 . 600 , the method 700 in FIG. 6 , the method 800 in FIG. 7 , and the method unit 900 of the method 900 in FIG. 8 performed by the short-range service security function network element.
  • each unit in the communication device 100 and the above-mentioned other operations and/or functions are respectively to implement the corresponding methods of the method 600 in FIG. 5 , the method 700 in FIG. 6 , the method 800 in FIG. 7 and the method 900 in FIG. 8 . process. It should be understood that the specific process of each unit performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and for the sake of brevity, it will not be repeated here.
  • transceiver unit in the communication apparatus 100 may correspond to the transceiver 210 in the communication apparatus 200 shown in FIG. 10
  • processing unit 120 in the communication apparatus 100 may correspond to the communication apparatus shown in FIG. 10
  • Transceiver 220 in 200 may correspond to the transceiver 210 in the communication apparatus 200 shown in FIG. 10 .
  • the chip when the communication device 100 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the transceiving unit 110 is configured to implement a signal transceiving operation of the communication device 100
  • the processing unit 120 is configured to implement a signal processing operation of the communication device 100 .
  • the communication apparatus 100 further includes a storage unit 130, and the storage unit 130 is used for storing instructions.
  • FIG. 10 is a schematic block diagram of a communication device 200 provided by an embodiment of the present application.
  • the communication device 200 includes: at least one processor 210 and a transceiver 220 .
  • the processor 210 is coupled to the memory for executing instructions stored in the memory to control the transceiver 220 to transmit and/or receive signals.
  • the communication device 200 further includes a memory 230 for storing instructions.
  • processor 210 and the memory 230 may be combined into a processing device, and the processor 210 is configured to execute the program codes stored in the memory 230 to realize the above-mentioned functions.
  • the memory 230 may also be integrated in the processor 210 or independent of the processor 210 .
  • transceiver 220 may include a receiver (or, receiver) and a transmitter (or, transmitter).
  • the transceiver may further include antennas, and the number of the antennas may be one or more.
  • the transceiver 220 may be a communication interface or an interface circuit.
  • the communication device 200 may be the remote user equipment in the above method embodiments, or may be a chip for implementing the functions of the remote user equipment in the above method embodiments.
  • the communication device 200 may correspond to the remote user equipment in the method 400, the method 500, the method 600, the method 700, the method 800, and the method 900 according to the embodiments of the present application, and the communication device 200 may include a method for executing the diagram The method 400 in FIG. 3, the method 500 in FIG. 4, the method 600 in FIG. 5, the method 700 in FIG. 6, the method 800 in FIG. 7, and the method 900 in FIG. unit.
  • each unit in the communication device 200 and the above-mentioned other operations and/or functions are for implementing the method 400 in FIG. 3 , the method 500 in FIG. 4 , the method 600 in FIG. 5 , the method 700 in FIG.
  • the corresponding flow of the method 800 in FIG. 7 and the method 900 in FIG. 8 It should be understood that the specific process of each unit performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and for the sake of brevity, it will not be repeated here.
  • the communication device 200 may be the short-range service security function network element in the above method embodiment, or may be used to implement the function of the short-range service security function network element in the above method embodiment chip.
  • the communication device 200 may correspond to the short-range service security function network element in the method 400 and the method 500 according to the embodiments of the present application, and the communication device 200 may include a method for executing the method 400 in FIG. Elements of the method performed by the short-range service security function network element in the method 500 .
  • each unit in the communication device 200 and the above-mentioned other operations and/or functions are respectively to implement the corresponding processes of the method 400 in FIG. 3 and the method 500 in FIG. 4 . It should be understood that the specific process of each unit performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and for the sake of brevity, it will not be repeated here.
  • the communication device 200 may be the authentication function network element in the above method embodiment, or may be a chip for implementing the function of the authentication function network element in the above method embodiment.
  • the communication device 200 may correspond to the authentication function network element in the method 600 , the method 700 , the method 800 and the method 900 according to the embodiments of the present application, and the communication device 200 may include a method for executing the method 600 in FIG. 5 . , the unit of the method performed by the authentication function network element in the method 700 in FIG. 6 , the method 800 in FIG. 7 and the method 900 in FIG. 8 .
  • each unit in the communication device 200 and the above-mentioned other operations and/or functions are respectively to implement the corresponding methods of the method 600 in FIG. 5 , the method 700 in FIG. 6 , the method 800 in FIG. 7 and the method 900 in FIG. 8 process. It should be understood that the specific process of each unit performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and for the sake of brevity, it will not be repeated here.
  • the chip When the communication device 200 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the embodiment of the present application also provides a processing apparatus, including a processor and an interface.
  • the processor may be used to execute the methods in the foregoing method embodiments. It should be understood that the foregoing processing device may be a chip.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a It is a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (microcontroller unit). , MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • MCU microcontroller unit
  • MCU programmable logic device
  • PLD programmable logic device
  • each step of the above-mentioned method can be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.
  • the processor in this embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above method embodiments may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the aforementioned processors may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable gate arrays
  • the methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in this embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct ram-bus RAM direct ram-bus RAM
  • the present application also provides a computer program product, the computer program product includes: computer program code, when the computer program code is run on a computer, the computer is made to execute FIG. 3 or FIG. 4 or The method of any one of the embodiments shown in FIG. 5 .
  • the present application further provides a computer-readable medium, where program codes are stored in the computer-readable medium, and when the program codes are executed on a computer, the computer is made to execute FIG. 3 or FIG. 4 or The method of any one of the embodiments shown in FIG. 5 .
  • the present application further provides a system, which includes the foregoing apparatus or equipment.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state discs, SSD)) etc.
  • the network-side equipment in each of the above apparatus embodiments corresponds to the terminal equipment and the network-side equipment or terminal equipment in the method embodiments, and corresponding steps are performed by corresponding modules or units. Or the step of sending, other steps except sending and receiving may be performed by a processing unit (processor). For functions of specific units, reference may be made to corresponding method embodiments.
  • the number of processors may be one or more.
  • a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device may be components.
  • One or more components may reside within a process and/or thread of execution, and a component may be localized on one computer and/or distributed between 2 or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more data packets (eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals) Communicate through local and/or remote processes.
  • data packets eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种生成设备间通信的密钥的方法、系统和装置。该方法包括：第一用户设备基于第一密钥，生成第一临时标识；所述第一用户设备向第二用户设备发送第一请求，所述第一请求用于建立所述第一用户设备和所述第二用户设备之间的通信连接；其中，所述第一请求包括所述第一临时标识和中继服务码；所述第一用户设备基于第二密钥和所述中继服务码，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。本申请实施例应用于生成设备间通信的密钥的方法、系统和装置，通过生成设备间的通信密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。

Description

一种生成设备间通信的密钥的方法、系统和装置 技术领域
本申请涉及通信领域，并且更具体地，涉及一种生成远端设备和中继设备之间通信的密钥的方法、系统和装置。
背景技术
随着移动通信的高速发展，为了满足不同业务不同场景下的通信需求，提出了设备到设备的近距离业务(proximity-bases services，ProSe)通信模型，允许用户设备(user equipment，UE)与用户设备之间直接建立通信连接。其中一种通信模型是，一个UE通过另一个UE的辅助接入到运营商网络，从而与数据网络进行业务交互。
例如，远端用户设备(Remote UE)通过中继用户设备(UE-to-Network Relay)获取业务的流程中，为了保证通信安全，Remote UE和UE-to-Network Relay之间需要建立安全连接。然而通过UE-to-Network Relay建立通信连接是按需动态建立的，Remote UE和UE-to-Network Relay之间无法预配置共享的安全信息并基于预配置的共享安全信息建立Remote UE和UE-to-Network Relay之间的安全连接。因此亟需一种方法动态建立Remote UE和UE-to-Network Relay之间的安全连接。
发明内容
本申请提供一种生成设备间通信的密钥的方法、系统和装置，使得用户设备与用户设备之间动态地建立了安全的通信连接。
第一方面，提供了一种生成设备间通信的密钥的方法，该方法包括：第一用户设备基于第一密钥，生成第一临时标识；所述第一用户设备向第二用户设备发送第一请求，所述第一请求用于建立所述第一用户设备和所述第二用户设备之间的通信连接；其中，所述第一请求包括所述第一临时标识和中继服务码；所述第一用户设备基于第二密钥和所述中继服务码，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接，所述第二密钥与所述第一密钥为鉴权流程中生成的密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥。
其中，所述共享密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。一种可能的实现方式包含，第一用户设备和第二用户设备分别基于生成的共享密钥推演一个中间密钥或会话密钥，进一步的，基于中间密钥或会话密钥推演第一用户设备和第二用户设备之间的消息或数据的加密密钥和/或完整保护密钥。所述加密密钥和/或完整保护密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。另一种可能的实现方式包含，第一用户设备和第二用户设备分别基于生成的共享密钥推演第一用户设备和第二用户设备之间的消息或数据的加密密钥和/或完整保护密钥。所述加密密钥和/或完整保护密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。
基于上述方案，第一用户设备生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第一方面，在第一方面的某些实现方式中，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
结合第一方面，在第一方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
结合第一方面，在第一方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
结合第一方面，在第一方面的某些实现方式中，所述第一用户设备基于第一密钥，生成第一临时标识，包括：所述第一用户设备基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
其中，与所述第一用户设备相关的核心网网元具体可以是第一用户设备鉴权流程中涉及的核心网网元，例如数据管理网元和近距离业务安全功能网元。
基于上述技术方案，第一用户设备基于第一密钥、第一用户设备的网络标识和路由信息生成第一临时标识，并将所述第一临时标识发给所述第二用户设备。第二用户设备向网络侧发送所述第一临时标识，使得与第一用户设备用户相关的核心网网元能够根据第一临时标识获取上述第二密钥，进一步的该核心网网元根据第二密钥确定共享密钥并发送给所述第二用户设备，从而使得第一用户设备和第二用户设备获取相同的共享密钥。基于该共享密钥，第一用户设备和第二用户设备能够动态建立安全的通信连接。
结合第一方面，在第一方面的某些实现方式中，所述第一用户设备基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识，包括：所述第一用户设备基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
结合第一方面，在第一方面的某些实现方式中，所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：所述第一用户设备向移动管理网元发送非接入层NAS消息，所述NAS消息包括能力信息，所述能力信息用于指示所述第一用户设备支持作为远端用户设备。
基于上述技术方案，第一用户设备通过向网络侧发送包括能力信息的NAS消息，以便作为网络侧确定第一用户设备是否具有支持作为远端用户设备的能力的依据，从而有助于第一用户设备生成共享密钥，使得用户设备与用户设备之间动态地建立安全的通信连接。
结合第一方面，在第一方面的某些实现方式中，所述第一请求还包括第一新鲜性参数；所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码和所述第一新鲜性参数，生成所述共享密钥。
基于上述技术方案，第一用户设备基于所述第二密钥、所述中继服务码和所述第一新鲜性参数，生成所述共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：所述第一用户设备接收来自所述第二用户设备的安全模式命令，所述安全模式命令包括第二新鲜性参数；所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码和所述第二新鲜性参数，生成所述共享密钥。
基于上述技术方案，第一用户设备基于所述第二密钥、所述中继服务码和所述第二新鲜性参数，生成所述共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第一方面，在第一方面的某些实现方式中，所述第一请求还包括第一新鲜性参数；该方法还包括：所述第一用户设备接收来自所述第二用户设备的安全模式命令，所述安全模式命令包括第二新鲜性参数；所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码、所述第一新鲜性参数和所述第二新鲜性参数，生成所述共享密钥。
基于上述技术方案，第一用户设备基于所述第二密钥、所述中继服务码、所述第一新鲜性参数和所述第二新鲜性参数，生成所述共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第一方面，在第一方面的某些实现方式中，所述安全模式命令还包括安全算法；该方法还包括：所述第一用户设备基于所述共享密钥和所述安全算法，得到通信密钥；所述通信密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。具体的，所述第一用户设备基于所述共享密钥和所述安全算法，得到通信密钥，还包括：所述第一用户设备基于所述共享密钥生成中间密钥/会话密钥，基于中间密钥/会话密钥和所述安全算法的到通信密钥。
基于上述技术方案，所述第一用户设备基于所述共享密钥和所述安全算法，得到通信密钥，使得用户设备与用户设备之间建立的安全通信连接得到保护，从而更加可靠。
第二方面，提供了一种生成设备间通信的密钥的方法，该方法包括：第一网元基于第一密钥，生成第一临时标识；所述第一网元接收来自第二网元的密钥获取消息，所述密钥获取消息包括第一用户设备的标识和中继服务码，其中，所述第一用户设备的标识包括所述第一临时标识或者所述第一用户设备的网络标识，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息；所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第 二用户设备之间的通信连接，所述第二密钥与所述第一密钥为所述第一用户设备的鉴权流程中生成的密钥或者是基于所述第一用户设备的鉴权流程中生成的中间密钥推演得到的密钥；所述第一网元向所述第二网元发送所述共享密钥。进一步地，第二网元将所述共享密钥发送给第二用户设备。
基于上述技术方案，第一网元生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，并发送给第二用户设备，使得第二用户设备与第一用户设备之间可以基于所述共享密钥动态地建立了安全的通信连接。
结合第二方面，在第二方面的某些实现方式中，所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元根据所述第一用户设备的标识获取所述第二密钥，所述第一网元根据所述第二密钥和所述中继服务码，生成所述共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识获取所述第二密钥，使得第一网元可以根据所述第二密钥和所述中继服务码，生成用于保护设备间通信连接的共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第二方面，在第二方面的某些实现方式中，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
结合第二方面，在第二方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
结合第二方面，在第二方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
结合第二方面，在第二方面的某些实现方式中，所述第一网元基于第一密钥，生成第一临时标识，包括：所述第一网元基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
结合第二方面，在第二方面的某些实现方式中，所述第一网元基于第一密钥、所述第一用户设备的网络标识和路由信息，生成第一临时标识，包括：所述第一网元基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
结合第二方面，在第二方面的某些实现方式中，所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第三网元的指示信息；响应于所述指示信息，所述第一网元基于所述第一密钥，生成所述第一临时标识。
基于上述技术方案，第一网元响应于第三网元发送的指示信息，从而生成第一临时标 识。然后第一网元将所述生成的第一临时标识与所述第二密钥关联存储起来。后续当第一网元接收来来自第二网元的携带第一临时标识的密钥获取消息时，第一网元能够根据所述第一临时标识获取上述第二密钥，从而有利于第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得第一用户设备与第二用户设备之间基于共享密钥动态地建立安全的通信连接。。
结合第二方面，在第二方面的某些实现方式中，在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第三网元的指示信息；响应于所述指示信息，所述第一网元基于所述第一密钥，生成所述第一临时标识，包括：在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第四网元的能力信息，所述能力信息用于指示所述第一用户设备支持远端UE的能力；响应于所述指示信息和所述能力信息，所述第一网元基于所述第一密钥，生成所述第一临时标识。
基于上述技术方案，第一网元响应于第三网元发送的指示信息和第四网元发送的能力信息，从而生成第一临时标识。然后第一网元将所述生成的第一临时标识与所述第二密钥关联存储起来。后续当第一网元接收来来自第二网元的携带第一临时标识的密钥获取消息时，第一网元能够根据所述第一临时标识获取上述第二密钥，从而有利于第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得第一用户设备与第二用户设备之间基于共享密钥动态地建立了安全的通信连接。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：所述第一网元将所述第一临时标识发送给第三网元。
基于上述技术方案，第一网元将所述第一临时标识发送给第三网元，第三网元将所述第一临时标识和所述第一网元的标识存储在所述第一用户设备的上下文信息中。后续第二网元可以根据所述第一临时标识从第三网元获取所述第一网元的标识和所述第一用户设备的网络标识。继而第二网元能够基于所述第一用户设备的网络标识从所述第一网元获取上述共享密钥并发送给第二用户设备，使得第一用户设备与第二用户设备之间可以基于所述共享密钥动态地建立安全的通信连接。
结合第二方面，在第二方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：所述第一网元生成第二新鲜性参数；所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同， 但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第二方面，在第二方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；该方法还包括：所述第一网元生成第二新鲜性参数；所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元根据所述第一用户设备的标识、所述中继服务码、所述第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第二方面，在第二方面的某些实现方式中，所述第一网元为鉴权功能网元。
结合第二方面，在第二方面的某些实现方式中，所述第二网元为移动管理网元、鉴权功能网元或近距离业务安全功能网元。
结合第二方面，在第二方面的某些实现方式中，所述第三网元为数据管理网元。
结合第二方面，在第二方面的某些实现方式中，所述第四网元为移动管理网元。
第三方面，提供了一种生成设备间通信的密钥的方法，该方法包括：第五网元获取第一临时标识和第三密钥，所述第三密钥为基于鉴权流程中生成的中间密钥推演得到的密钥；所述第五网元接收来自第六网元的密钥获取消息，所述密钥获取消息包括所述第一临时标识和中继服务码；所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第二用户设备之间的通信连接；所述第五网元向所述第六网元发送所述共享密钥。
基于上述技术方案，第五网元生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第三方面，在第三方面的某些实现方式中，所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥；包括：所述第五网元根据所述第一临时标识获取所述第三密钥，所述第五网元根据所述第三密钥和中继服务码生成共享密钥。
基于上述技术方案，第五网元根据所述第一临时标识获取所述第三密钥，使得第五网元可以根据所述第三密钥和所述中继服务码，生成用于保护设备间通信连接的共享密钥，第五网元将共享密钥经由一或多个中间网元发送给第二用户设备，保证了第一用户设备和第二用户设备之间动态建立了共享密钥，基于共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第三方面，在第三方面的某些实现方式中，第五网元获取第一临时标识，包括：第五网元从所述第一网元接收到所述第一临时标识，所述第一临时标识是基于第一中间密钥生成的，所述第一中间密钥为对所述第一用户设备进行鉴权流程中生成的中间密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥；或者，第五网络基于第三中间密钥生成所述第一临时标识。
基于上述技术方案，第五网元获取所述第一临时标识，从而使得第五网元可以根据所述第一临时标识获取所述第三密钥，使得第五网元可以根据所述第三密钥和所述中继服务码，生成用于保护设备间通信连接的共享密钥，第五网元将共享密钥经由一或多个中间网元发送给第二用户设备，保证了第一用户设备和第二用户设备之间动态建立了共享密钥，基于共享密钥，继而使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第三方面，在第三方面的某些实现方式中，所述第三密钥为基于所述鉴权流程中生成的密钥Kausf推演得到的密钥。
结合第三方面，在第三方面的某些实现方式中，所述第一临时标识是基于所述第一密钥生成的，包括：所述第一临时标识是基于所述第一密钥、所述第一用户设备的网络标识和路由信息生成的；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
结合第三方面，在第三方面的某些实现方式中，所述第一临时标识是基于所述第一密钥、所述第一用户设备的网络标识和路由信息生成的，包括：所述第二临时标识是基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数得到的；所述第一临时标识是将所述第二临时标识和所述路由信息进行拼接得到的。
结合第三方面，在第三方面的某些实现方式中，所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
结合第三方面，在第三方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥和所述第一新鲜性参数，生成共享密钥。
基于上述技术方案，第五网元根据所述第一临时标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第三方面，在第三方面的某些实现方式中，该方法还包括：所述第五网元生成第二新鲜性参数；所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述所述所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第五网元根据所述第一临时标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第三方面，在第三方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；该方法还包括：所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述所述所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第五网元根据所述第一临时标识、所述中继服务码、第二密钥、 第一临时标识和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第三方面，在第三方面的某些实现方式中，所述第五网元为第一近距离业务安全功能网元。
结合第三方面，在第三方面的某些实现方式中，所述第五网元为第一近距离业务安全功能网元。
结合第三方面，在第三方面的某些实现方式中，所述第六网元为第二近距离业务安全功能网元。
第四方面，提供了一种生成设备间通信的密钥的系统，该系统包括：第一网元，用于基于第一密钥生成第一临时标识；第二网元，用于向第一网元发送密钥获取消息，所述密钥获取消息包括第一用户设备的标识和中继服务码，其中，所述第一用户设备的标识包括所述第一临时标识或者所述第一用户设备的网络标识，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息；所述第一网元还用于根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第二用户设备之间的通信连接，所述第二密钥与所述第一密钥为所述第一用户设备的鉴权流程中生成的密钥或者是基于所述第一用户设备的鉴权流程中生成的中间密钥推演得到的密钥；所述第一网元向所述第二网元发送所述共享密钥。
基于上述技术方案，第一网元生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第一网元还用于根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元还用于根据所述第一用户设备的标识获取所述第二密钥，所述第一网元还用于根据所述第二密钥和所述中继服务码，生成所述共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识获取所述第二密钥，使得第一网元可以根据所述第二密钥和所述中继服务码，生成用于保护设备间通信连接的共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
结合第四方面，在第四方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
结合第四方面，在第四方面的某些实现方式中，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
结合第四方面，在第四方面的某些实现方式中，所述第一网元，用于基于第一密钥，生成第一临时标识，包括：所述第一网元还用于，基于所述第一密钥、所述第一用户设备 的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
基于上述技术方案，第一网元基于第一密钥、第一用户设备的网络标识和路由信息生成第一临时标识，使得与第一用户设备相关的核心网网元能够根据第一临时标识获取上述第二密钥，进一步地根据第二密钥确定共享密钥并发送给第二用户设备，保证第一用户设备和第二用户设备获取相同的共享密钥。基于该共享密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第一网元还用于，基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识，包括：所述第一网元还用于，基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
基于上述技术方案，第一网元基于第一密钥、第一用户设备的网络标识和路由信息生成第一临时标识，使得与第一用户设备相关的核心网网元能够根据第一临时标识获取上述第二密钥，从而有利于第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
结合第四方面，在第四方面的某些实现方式中，该系统还包括：第三网元，在对所述第一用户设备进行鉴权流程中，所述第三网元用于向所述第一网元发送第一指示信息；响应于所述第一指示信息，所述第一网元用于，基于所述第一密钥，生成所述第一临时标识。
基于上述技术方案，第一网元响应于第三网元发送的指示信息，从而生成第一临时标识，使得第一网元能够根据第一临时标识获取上述第二密钥，从而有利于第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，该系统还包括：第四网元，在对所述第一用户设备进行鉴权流程中，所述第四网元用于向所述第一网元发送能力信息，所述能力信息用于指示所述第一用户设备支持远端UE的能力；响应于所述第一指示信息和所述能力信息，所述第一网元用于，基于所述第一密钥，生成所述第一临时标识。
基于上述技术方案，第一网元响应于第三网元发送的指示信息和第四网元发送的能力信息，从而生成第一临时标识，使得第一网元能够根据第一临时标识获取上述第二密钥，从而有利于第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第一网元还用于将所述第一临时标识发送给所述第三网元。
基于上述技术方案，第一网元将所述第一临时标识发送给第三网元，第三网元将所述第一临时标识存储在所述第一用户设备的上下文信息中，以便于所述第三网元根据所述第 一临时标识从所述第一用户设备的上下文中确定所述第一网元的标识，继而使得第一网元能够根据第一临时标识获取上述第二密钥，从而使得第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第二网元还用于，向所述第三网元发送所述第一临时标识；所述第三网元还用于，向所述第二网元发送所述第一网元的标识。
基于上述技术方案，第二网元向第三网元发送所述第一临时标识(由第一用户设备经由一或多个中间网元发送给第二网元的第一临时标识)，用于第三网元根据第一临时标识从所述第一用于设备的上下文中确定所述第一网元的标识，继而使得第一网元能够根据第一临时标识获取上述第二密钥，从而使得第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述第三网元还用于，向所述第二网元发送所述第一网元的标识和第一用户设备的网络标识。
基于上述技术方案，第三网元向第二网元发送第一网元的标识和第一用户设备的网络标识，使得第二网元根据第一网元的标识找到第一网元，从而使得第一网元能够根据第一临时标识或第一用户设备的网络标识获取上述第二密钥，从而使得第一网元根据第二密钥确定共享密钥并经由一或多个中间网元发送给第二用户设备，使得用户设备与用户设备之间动态地建立了安全的通信连接。
结合第四方面，在第四方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第四方面，在第四方面的某些实现方式中，所述第一网元还用于，生成第二新鲜性参数；所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第四方面，在第四方面的某些实现方式中，所述密钥获取消息还包括第一新鲜性参数；所述第一网元还用于，生成第二新鲜性参数；所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元 用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
基于上述技术方案，第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥，保证针对第二密钥相同、中继服务码相同，但第一用户设备在与不同的用户设备建立直接通信时生成不同的共享密钥，从而使得用户设备与用户设备之间建立的安全通信连接更可靠。
结合第四方面，在第四方面的某些实现方式中，该系统还包括：第一用户设备和第二用户设备。
结合第四方面，在第四方面的某些实现方式中，所述第一网元为鉴权功能网元。
结合第四方面，在第四方面的某些实现方式中，所述第二网元为移动管理网元、鉴权功能网元或近距离业务安全功能网元。
结合第四方面，在第四方面的某些实现方式中，所述第三网元为数据管理网元。
结合第四方面，在第四方面的某些实现方式中，所述第四网元为移动管理网元。
第五方面，提供了一种生成设备间通信的密钥的装置，该装置包括：存储器，用于存储计算机指令；处理器，用于执行所述存储器中存储的计算机指令，使得所述装置执行第一方面或第一方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述生成设备间通信的密钥的装置通过执行第一方面或第一方面中任意一种可能的实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第六方面，提供了一种生成设备间通信的密钥的装置，该装置包括：存储器，用于存储计算机指令；处理器，用于执行所述存储器中存储的计算机指令，使得所述装置执行第二方面或第二方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述生成设备间通信的密钥的装置通过执行第二方面或第二方面中任意一种可能的实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第七方面，提供了一种生成设备间通信的密钥的装置，该装置包括：存储器，用于存储计算机指令；处理器，用于执行所述存储器中存储的计算机指令，使得所述装置执行第三方面或第三方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述生成设备间通信的密钥的装置通过执行第三方面或第三方面中任意一种可能的实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第八方面，提供了一种可读计算机存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行第一方面或第一方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述可读计算机存储介质上存储有计算机程序，所述计算机程序被生成设备间通信的密钥的装置执行时，通过执行第一方面或第一方面中任意一种可能的 实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第九方面，提供了一种可读计算机存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行第二方面或第二方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述可读计算机存储介质上存储有计算机程序，所述计算机程序被生成设备间通信的密钥的装置执行时，通过执行第二方面或第二方面中任意一种可能的实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第十方面，提供了一种可读计算机存储介质，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行第三方面或第三方面中任意一种可能的实现方式中所述的方法。
基于上述技术方案，所述可读计算机存储介质上存储有计算机程序，所述计算机程序被生成设备间通信的密钥的装置执行时，通过执行第三方面或第三方面中任意一种可能的实现方式中所述的方法，使得所述装置生成了可用于保护所述第一用户设备和所述第二用户设备之间的通信连接的共享密钥，从而使得用户设备与用户设备之间动态地建立了安全的通信连接。
第十一方面，提供了一种芯片系统，所述芯片系统包括处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的设备执行第一方面或第一方面中任意一种可能的实现方式中所述的通信方法。
可选地，该芯片系统还可以包括存储器，该存储器中存储有指令，处理器用于执行存储器中存储的指令或源于其他的指令。当该指令被执行时，处理器用于实现上述第一方面或其任意可能的实现方式中的方法。
可选地，该芯片系统可以集成在用户设备上。
第十二方面，提供了一种芯片系统，所述芯片系统包括处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的设备执行第二方面或第二方面中任意一种可能的实现方式中所述的通信方法。
可选地，该芯片系统还可以包括存储器，该存储器中存储有指令，处理器用于执行存储器中存储的指令或源于其他的指令。当该指令被执行时，处理器用于实现上述第二方面或其任意可能的实现方式中的方法。
可选地，该芯片系统可以集成在网络设备上。
第十三方面，提供了一种芯片系统，所述芯片系统包括处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的设备执行第三方面或第三方面中任意一种可能的实现方式中所述的通信方法。
可选地，该芯片系统还可以包括存储器，该存储器中存储有指令，处理器用于执行存储器中存储的指令或源于其他的指令。当该指令被执行时，处理器用于实现上述第三方面或其任意可能的实现方式中的方法。
可选地，该芯片系统可以集成在网络设备上。
综上所述，基于上述技术方案，通过生成设备间的通信密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接。
附图说明
图1是应用于本申请实施例的场景示意图
图2是应用于本申请实施例的网络架构示意图
图3是本申请实施例提供的一例的网络侧推演远端用户设备的临时标识的方法的示意性交互流程图
图4是本申请实施例提供的一例的远端用户设备通过中继用户设备接入网络的方法的示意性交互流程图
图5是本申请实施例提供的另一例的网络侧推演远端用户设备的临时标识的方法的示意性交互流程图
图6是本申请实施例提供的另一例的远端用户设备通过中继用户设备接入网络的方法的示意性交互流程图
图7是本申请实施例提供的另一例的网络侧推演远端用户设备的临时标识的方法的示意性交互流程图
图8是本申请实施例提供的另一例的远端用户设备通过中继用户设备接入网络的方法的示意性交互流程图
图9是本申请实施例提供的一例的通信装置的示意性框图
图10是本申请实施例提供的另一例的通信设备的示意性框图
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例提及的无线通信系统包括但不限于：全球移动通信(global system of mobile communication，GSM)系统、长期演进(long term evolution，LTE)频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、宽带码分多址(wideband code division multiple access，WCDMA)系统、码分多址(code division multiple access，CDMA)系统、时分同步码分多址(time division-synchronous code division multiple access，TD-SCDMA)、通用分集合无线业务(general packet radio service，GPRS)、LTE系统、先进的长期演进(LTE-Advanced，LTE-A)系统、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、下一代通信系统(例如，5G通信系统)、多种接入系统的融合系统，或演进系统、下一代5G移动通信系统的三大应用场景：增强移动宽带(enhanced mobile broadband，eMBB)，极可靠低时延通信(ultra-reliable and low latency communication，URLLC),和增强型机器类型通信(enhanced machine-type communication，eMTC)或者将来出现的新的通信系统。
通常来说，传统的通信系统支持的连接数有限，也易于实现，然而，随着通信技术的发展，移动通信系统将不仅支持传统的通信，还将支持例如，设备到设备(Device to Device， D2D)通信，机器到机器(Machine to Machine，M2M)通信，机器类型通信(Machine Type Communication，MTC)，车联网(Vehicle To Everything，V2X)通信，例如，车到车(Vehicle to Vehicle，V2V)通信、车到基础设施(Vehicle to Infrastructure，V2I)通信，车到行人(Vehicle to Pedestrian，V2P)通信，车道网络(Vehicle to Network，V2N)通信。
本申请实施例中所涉及到的终端设备可以包括各种具有无线通信功能的接入终端、移动设备、用户终端、或用户装置。例如，用户设备(user equipment，UE)、手持终端、笔记本电脑、用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端或是其他可以接入网络的设备。终端设备与接入网设备之间采用某种空口技术相互通信。本申请的实施例对应用场景不做限定。
图1示出了应用于本申请实施例的场景示意图，如图1所述，Remote UE通过UE-to-Network Relay接入到运营商网络从而与数据网络进行业务交互。
应理解，图1仅是为了便于理解，对本申请实施例的应用场景的示意图的示例，本申请实施例对此并不作任何限定，以下对该示意图中涉及到的网元进行说明。
Remote UE：一个具备近距离通信的UE，能通过中继设备与数据网络(data network，DN)通信。例如可以是具备通过另一个UE接入并访问网络的能力的UE。
UE-to-Network Relay：可以是具备为另一UE提供接入，并为该UE提供访问网络功能的UE。
(无线)接入网络(radio access network，(R)AN)网元：为终端设备提供接入的设备，包含RAN设备和AN设备。RAN设备主要是3GPP网络无线网络设备，AN可以是non-3GPP定义的接入网设备，主要负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。所述接入网设备可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如，在第五代(5th generation，5G)系统中，称为RAN或者gNB(5G NodeB)；在LTE系统中，称为演进的节点B(evolved NodeB，eNB或者eNodeB)；在第三代(3rd generation，3G)系统中，称为节点B(Node B)等。
网关：主要负责对外连接到数据网络以及用户面的数据包路由转发、报文过滤、执行服务质量控制相关功能等。可以从数据网络接收用户数据，通过接入网设备传输给终端设备，还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
图2示出了应用于本申请实施例的5G网络架构示意图。作为示例而非限定，本申请实施例可应用于5G通信系统的网络架构，以下对该网络架构中可能涉及的各个网元分别进行说明。
鉴权服务功能(authentication server function，AUSF)网元：支持接入时的鉴权功能。在本申请实施例中，AUSF网元用于实现UE接入网络时的鉴权，用于生成密钥，还可以用于对Remote UE的授权判定。
统一数据管理(unified data management，UDM)网元：用于生成认证信任状，用户标识处理(如存储和管理用户永久身份等)，接入授权控制和签约数据管理等。在本申请实施例中，UDM用于对Remote UE进行授权判定，存储用户信息等。
策略控制功能(policy control function，PCF)网元：支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略决策相关的用户签约信息。
网络开放功能(network exposure function，NEF)网元：用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
应用功能网元(application function，AF)：用于提供业务，或者进行应用影响的数据路由，接入网络开放功能网元，或，与PCF网元交互业务数据进行策略控制等。
网络鉴权功能(network repository function，NRF)网元，用于网络中一个网络功能(Network Function，NF)网元发现另一个NF的网元，例如，AMF、SMF、PCF以及UDM等网络功能实体都称为NF网元。在本申请实施例中，NRF用于根据AUSF的实例标识(Instance ID)找到其路由信息，并发送给PSF。
统一数据存储网元(unified data repository，UDR)：即，用于存储用户签约数据、业务策略数据、非结构化数据等。
移动性管理功能网元(access and mobility management function，AMF)网元：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，终端移动性管理、终端鉴权与去鉴权、终端会话接入、终端的允许的切片接入选择、合法监听或接入授权(或鉴权)等功能。
会话管理功能网元(session management function，SMF)网元：主要用于会话管理、终端设备的网际互连协议(internet protocol，IP)地址分配和管理、选择和管理用户平面功能、策略控制、收费功能接口的终结点或下行数据通知等。
用户面功能网元(user plane function，UPF)：可用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)参数处理等。用户数据可通过该网元传输到数据网络(data network，DN)。
PC5：具备近距离通信能力的UE之间的参考点，用于近距离通信直接发现(ProSe Direct Discovery)、近距离通信直接通信(ProSe Direct Communication)和UE-to-Network Relay的控制面连接和用户面连接。
图2中，UE A可以直接通过Uu接口接入网络，也可以先通过PC5接口与UE C建立连接，再通过UE C接入网络。UE B先通过PC5接口与UE A建立连接，再通过UE A接入网络；UE C可以通过Uu接口接入网络，也可以先通过PC5接口与UE A建立连接，再通过UE A接入网络。
示例性的，图2中，UE A和UE C都可以通过Uu接口直接接入网络。UE A还可以先通过PC5接口与UE C建立连接，再通过UE C接入网络(此时，UE A称为Remote UE，UE C称为UE-to-Network Relay)；UE C也可以先通过PC5接口与UE A建立连接，再通过UE A接入网络(此时，UE C称为Remote UE，UE A称为UE-to-Network Relay)。UE B先通过PC5接口与UE A建立连接，再通过UE A接入网络(此时，UE B称为Remote UE，UE A称为UE-to-Network Relay)。
其中，UE A和UE C既可以认为是具有为另一个Remote UE提供网络连接功能的UE-to-Network Relay，也可以认为是具有通过另一个UE-to-Network Relay接入并访问网络能力的Remote UE。
UE B可以认为是具有通过另一个UE-to-Network Relay接入并访问网络能力的Remote UE，通过UE-to-Network Relay A接入网络。
图3示出了本申请实施例UE#1(即，第一用户设备的一例)鉴权过程中或之后，网络侧推演Remote UE#1的临时标识的示意性流程图，包括以下步骤：
在该流程中，UDM生成指示信息，并向AUSF#1发送，例如可以列举以下实现方式：
方式1，如下述S400a～S440a：
S400a，UE#1向AMF#1上报能力信息，该能力信息用于指示该UE#1是否支持作为Remote UE的能力。
例如，UE侧向网络侧上报能力信息可以在UE#1向AMF#1(即，第四网元的一例)发送非接入层NAS消息(例如，是注册请求消息)中携带。
S410a，AMF#1向AUSF#1发送UE#1的能力信息。
例如，AMF#1向AUSF#1发送UE#1的能力信息，可以在AMF#1向AUSF#1发送的鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中携带。
S420a，AUSF#1接收到S410发送的能力信息，并向UDM(即，第三网元的一例)发送该能力信息。
例如，AUSF#1可以向UDM发送包含UE#1的能力信息的鉴权请求消息(例如Nudm_UEAuthentication Request消息)。
S430a，UDM根据所述能力信息和UE#1的签约数据生成指示信息#1，所述指示信息#1用于指示是否生成UE#1的用于近距离通信的信息，例如该信息用于标识UE#1；
应理解，为了便于描述，以下实施例以临时标识#1(即，第一临时标识的一例)作为UE#1的用于近距离通信的信息为例进行阐述，但本申请实施例对此不做任何限定。
作为实施例而非限定，UDM可以根据携带能力信息的鉴权请求消息获取UE#1的签约信息，根据UE#1的签约数据和UE#1的能力信息确定指示信息#1。
其中，UDM根据UE#1的能力信息和UE#1的签约数据确定指示信息#1包括：
若UE#1的签约数据指示UE#1被授权作为Remote UE通过中继用户设备与数据网络进行通信，且UE#1的能力信息表示UE#1具备作为Remote UE的能力，则UDM指示AUSF#1生成指示信息#1。若其中任一条件不满足，则UDM不向AUSF发送指示信息#1或指示信息#1指示AUSF#1不生成临时标识#1。
S440a：UDM向AUSF#1发送指示信息#1。
例如，所述指示信息#1可以在鉴权过程中UDM向AUSF#1发送的鉴权响应消息中携带(例如，Nudm_UEAuthentication response)，也可以在鉴权请求过程后发送。
方式2，如下述S400b～S440b：
S400b～S410b与上述S400a～S410a相同，为简洁此处不再赘述。
S420b，AUSF#1向UDM发送鉴权请求消息，其中鉴权请求消息与现有技术相同或类似；
S430b，UDM根据鉴权请求消息获取UE#1签约数据，生成指示信息#2，所述指示信 息#2用于指示UE#1是否被授权作为Remote UE；
S440b，UDM向AUSF#1发送指示信息#2。
例如，所述指示信息#2可以在鉴权过程中UDM向AUSF#1发送的鉴权响应消息中携带(例如，Nudm_UEAuthentication response)，也可以在鉴权过程后发送。
方式3，如下述S400c～S440c：
S400c，UE#1向AMF#1发送注册请求消息，其中注册请求消息与现有技术相同或类似；
S410c，AMF#1向AUSF#1发送鉴权请求消息，其中鉴权请求消息与现有技术相同或类似；
S420c～S440c与上述S420b～S440b相同，此处不再赘述。
S450，AUSF#1根据以下三种情况中的任一种确定生成临时标识#1：
情况1：与上述方式1相对应，AUSF#1接收到指示信息#1，且所述指示信息#1指示生成临时标识#1。
情况2：与上述方式2相对应，AUSF#1接收到所述能力信息和指示信息#2，所述能力信息和指示信息#2都指示UE#1可以作为Remote UE。
情况3：与上述方式3相对应，AUSF#1接收到指示信息#2，且指示信息#2指示UE#1被授权作为Remote UE。
其中，生成临时标识#1的过程可以根据密钥#1(即，第一密钥的一例)和Remote UE#1的网络标识生成临时标识#1，例如可以列举以下实现方式：
在一种实现方式中，AUSF#1根据AMF#1在鉴权流程中发送的Remote UE#1的网络标识和AUSF#1在鉴权流程中生成的密钥#1，生成临时标识#1，生成过程所使用的算法可以与现有技术相同或相似，为了避免赘述未详细说明。
在另一种实现方式中，AUSF#1根据临时标识#1(即，第二临时标识的一例)和UDM的路由信息拼接得到临时标识#1’(即，第一临时标识的另一例)
其中，Remote UE的网络标识可以列举如下：用户永久标识(subscription permanent identifier，SUPI)或者国际移动用户识别码(international mobile subscriber identity，IMSI)或者(generic public subscription identifier，GPSI)
其中，路由信息可以列举如下：路由指示(Routing indicator)。
应理解，在本申请实施例中，AUSF#1可以存储临时标识#1及其与密钥#1的对应关系；也可以不存储临时标识#1，存储Remote UE#1的网络标识和密钥#1的对应关系。
其中，密钥#1可以是对UE#1进行鉴权流程中生成的密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥。
例如，密钥#1可以是基于鉴权过程中生成的密钥Kausf#1，也可以是基于Kausf#1推演的密钥Kpru#1。
作为实施例而非限定，AUSF#1根据临时标识#1和UDM的路由信息拼接得到临时标识#1’，包括以下实现方式：
一种可能的实现方式：临时标识#1可以用X位来表示，其中，高Y位用于表示所述路由信息；剩余的低(X-Y)位用于表示所述临时标识#1’，其中X和Y为正整数；
另一种可能的实现方式：临时标识#1可以用X位来表示，其中，低Y位用于表示所 述路由信息；剩余的高(X-Y)位用于表示所述临时标识#1’，其中X和Y为正整数。
应理解，AUSF#1还可以在生成临时标识#1后，生成基于鉴权流程中生成的中间密钥推演得到的密钥，例如Kpru#1。本申请实施例对此不作任何限定。
S460，AUSF向UDM发送临时标识#1。
具体的，AUSF#1将临时标识#1和Remote UE#1的网络标识发送给UDM，UDM根据Remote UE#1的网络标识将临时标识#1存储在Remote UE#1的上下文信息中。
其中，UE的上下文中还包含AUSF的标识。
图4示出了本申请实施例Remote UE#1通过UE-to-Network Relay#1(即，第二用户设备的一例)接入网络阶段的示意性流程图，包括以下步骤：
S470，Remote UE#1发现一个或多个UE-to-Network Relay，并从中选择一个UE-to-Network Relay(计作UE-to-Network Relay#1，即第二用户设备的一例)进行通信，Remote UE#1选择UE-to-Network Relay#1的方式与现有技术相同或类似，本申请实施例对此不作任何限定。
S480，Remote UE#1生成临时标识#1’(即，第一临时标识的一例)。
Remote UE#1生成临时标识#1’的方式与S450中AUSF生成临时标识#1’的方式相同，即Remote UE#1根据临时标识#1和UDM的路由信息拼接得到临时标识#1’，为避免赘述，此处不再详细说明。
S490，Remote UE#1向UE-to-Network Relay#1发送请求消息#1(即，第一请求的一例)，该请求消息#1用于请求建立所述Remote UE#1和UE-to-Network Relay#1之间的通信连接，例如直连通信请求(direct communication request，DCR)消息。请求消息#1包括临时标识#1’和中继服务码Relay service code。
应理解，Relay service code可以是UE侧预配置的，还可以是网络侧发送给UE的，例如例如TS23.502中定义的UE Configuration Update流程。
其中，Relay service code用于标识支持ProSe服务的UE-to-Network Relay提供的连接服务，以及标识支持ProSe服务的UE-to-Network Relay提供服务的授权用户，并且可以选择相关的安全策略或信息。
在一种可能的实现方式中，请求消息#1还可以包括新鲜性参数#1(即，第一新鲜性参数的一例)。
在另一种可能的实现方式中，请求消息#1还可以包括完整性消息认证码(message authentication code for integrity，MAC-I)(计作MAC-I#1)。
具体地，Remote UE#1将Relay service code作为输入参数，基于密钥#1根据特定算法生成出密钥#A，Remote UE#1使用密钥#A加密临时标识#1’和Relay service code后，生成MAC-I#1，用于验证请求消息#1的完整性保护，防止请求消息#1被攻击者篡改。
作为实施例而非限定，以下S4100～S4130，S4150中，网元#2(即，第二网元)可以是PSF#1，可以是AMF#2，也可以是AUSF#2。
应理解，AMF#2可以是与AMF#1相同的AMF，也可以是与AMF#1不同的AMF。
其中，AMF#1可以为服务remote UE#1的AMF，AMF#2可以为服务UE-to-Network Relay#1的AMF。
应理解，AUSF#2可以是与AUSF#1相同的AUSF，也可以是与AUSF#1不同的AUSF。
其中，AUSF#1可以为服务remote UE#1的AUSF，AUSF#2可以为服务UE-to-Network Relay#1的AUSF。
应理解，AMF#2可以是与AMF#1相同的AMF，也可以是与AMF#1不同的AMF。
例如，AMF#1可以为服务remote UE#1的AMF，AMF#2可以为服务UE-to-Network Relay#1的AMF。
S4100，UE-to-Network Relay#1向网元#2发送临时标识1’和Relay service code。
在一种可能的实现方式中，网元#2获取的信息还可以包括新鲜性参数#1。
在另一种可能的实现方式中，网元#2获取的信息还可以包括MAC-I#1。
本申请实施例对此不作任何限定。
S4110，网元#2根据临时标识#1’中的路由信息确定对应的UDM。
S4120，网元#2向UDM发送临时标识#1’。
S4130，UDM根据临时标识#1’确定临时标识#1，从上述S460中UDM保存的临时标识#1和Remote UE#1的网络标识对应关系中获取Remote UE#1的网络标识，接着根据Remote UE#1的网络标识从Remote UE#1的上下文信息中获取AUSF#1的标识，并向网元#2发送AUSF#1的标识。
在一种可能的实现方式中，向网元#2发送的信息还可以包括Remote UE#1的网络标识。
具体地，在该步骤中，UDM从Remote UE#1的上下文信息中获取AUSF#1的标识包括：
UDM从Remote UE#1的上下文信息中查找AUSF#1的Instance ID，网元#2据此找到AUSF#1。
可选地，S4140，若网元#2是PSF，则PSF对Remote UE#1进行授权检查。
具体地，PSF存储有每个UE对应的授权信息执行授权检查。PSF根据Remote UE#1的网络标识检查Remote UE#1是否授权作为Remote UE，从而通过UE-to-Network Relay#1获取Relay service code对应的连接服务。若授权检查通过则继续执行下述步骤；若授权检查不通过，PSF向AUSF#2发送失败响应消息，该响应消息包括授权失败的原因值(例如授权检查不通过，缺乏必要参数等)。
S4150，网元#2向AUSF#1发送密钥获取消息。
一种可能的实现方式，密钥获取消息包括临时标识#1’(即，第一用户设备的标识的一例)和Relay service code。
另一种可能的实现方式，若在S4130中，网元#2获取了UDM发送的Remote UE#1的网络标识(即，第一用户设备的标识的一例)，则密钥获取消息包括Remote UE#1的网络标识和Relay service code。
在一种可能的实现方式中，密钥获取消息还可以包括新鲜性参数#1。
在另一种可能的实现方式中，密钥获取消息还可以包括MAC-I#1。
S4160，AUSF#1根据密钥#2(即，第二密钥的一例)、Relay service code、至少一个新鲜性参数确定Remote UE#1和UE-to-Network Relay#1之间的共享密钥(例如Kr)。
一种可能的实现方式，AUSF#1获取S4150中网元#2发送的临时标识#1’，且S450中AUSF#1存储了临时标识#1和密钥#1的对应关系，则AUSF#1根据临时标识#1’确定临时 标识#1，根据临时标识#1和密钥的对应关系找到密钥#1。
另一种可能的实现方式，AUSF#1获取S4150中网元#2发送的Remote UE#1的网络标识，且S450中，AUSF#1存储了Remote UE#1的网络标识和密钥#1的对应关系，则AUSF#1根据Remote UE#1的网络标识和该对应关系找到密钥#1。
其中，密钥#2为鉴权流程中生成的密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥，例如可以列举以下三种情况：
情况1：密钥#2与密钥#1相同，且密钥#2和密钥#1为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
情况2：密钥#2与密钥#1不同，且所述密钥#1为所述鉴权流程中生成的密钥Kausf；所述密钥#1为基于所述Kausf推演得到的密钥。
情况3：密钥#2与密钥#1不同，且所述密钥#2为所述鉴权流程中生成的密钥Kausf；所述密钥#1为基于所述Kausf推演得到的密钥。
应理解，如果S450中生成并使用了Kpru#1，则在该步骤密钥#2是Kpru#1；如果S450中没有生成或使用Kpru#1，则在该步骤中密钥#2可以是Kausf#1，也可以是在该步骤中生成并使用的Kpru#1。
其中，至少一个新鲜性参数可以列举如下实施方式：
一种可能的实现方式，至少一个新鲜参数可以是S4150发送的新鲜性参数#1(即，Remote UE生成的新鲜性参数#1)；
另一种可能的实现方式中，至少一个新鲜参数可以是AUSF#1自行生成的新鲜性参数#2(即，第二新鲜性参数的一例)；
另一种可能的实现方式中，至少一个新鲜参数可以是Remote UE#1生成的新鲜性参数#1和AUSF#1自行生成的新鲜性参数#2。
本申请实施例对新鲜性参数的数量不作任何限定。
应理解，若在S4150中，接收的信息中包括MAC-I#1，则AUSF#1根据MAC-I#1、Relay service code和临时标识#1验证消息的完整性，与S480中Remote UE#1生成MAC-I#1所示的方法一致，AUSF#1将Relay service code作为输入参数，基于密钥#1根据特定算法生成出密钥#A，Remote UE#1使用密钥#A加密临时标识#1和Relay service code后，生成MAC-I#1’，若MAC-I#1与MAC-I#1’不一致，则表示传输过程中信息内容丢失或被攻击，若MAC-I#1与MAC-I#1’一致，则推演共享密钥。
在一种可能的实现方式中，上述生成密钥#A的输入参数还可以包括新鲜性参数#1。
S4170，AUSF#1向网元#2发送共享密钥，网元#2向UE-to-Network Relay#1发送共享密钥。
其中，网元#2向UE-to-Network Relay#1发送共享密钥可以有以下实现方式：
一种可能的实现方式，网元#2通过用户面向UE-to-Network Relay#1发送；
另一种可能的实现方式，网元#2通过信令面向UE-to-Network Relay#1发送。
应理解，所述共享密钥可以经过一个或者多个其他网元转发到UE-to-Network Relay#1。
应理解，若S4160中，至少一个新鲜参数包括新鲜性参数#2，则在该步骤中，AUSF#1向UE-to-Network Relay#1发送新鲜性参数#2。
S4180，UE-to-Network Relay#1向Remote UE#1发送安全模式命令。
其中，所述安全模式命令包括安全算法，安全算法可以包括加密算法和/或完整性保护算法。
在一种可能的实现方式中，所述安全模式命令还可以包括新鲜性参数#2。
S4190，Remote UE#1基于密钥、Relay service code、至少一个新鲜性参数，采用与S4160中AUSF#1生成共享密钥同样的方法在该步骤中生成共享密钥。
S4200，Remote UE#1和UE-to-network Relay#1基于共享密钥，安全算法得到通信密钥。
其中，得到通信密钥可以包括以下实现方式：
一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1基于生成的共享密钥推演一个中间密钥或会话密钥，进一步的，基于中间密钥或会话密钥推演Remote UE#1和UE-to-network Relay#1间的信令面和用户面的加密密钥(例如，NR PC5Encryption Key，NRPEK)和/或完整性保护密钥(例如NR PC5Integrity Key，NRPIK)。
另一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1分别基于生成的共享密钥推演Remote UE#1和UE-to-network Relay#1之间的消息或数据的加密密钥和/或完整保护密钥。
通信密钥的具体生成方式与现有技术相同或类似，例如TS23.303和TS33.536中的密钥生成方式。
S4210，UE-to-Network Relay#1向Remote UE#1发送响应消息#1，用于响应S4180中的安全模式命令，该响应消息#1表示通信安全已经建立完成。
S4220，UE-to-Network Relay#1向Remote UE#1发送响应消息#2，用于响应S490中的请求消息#1，该响应消息#2表示直连通信已建立完成。
图5示出了本申请实施例UE#1鉴权过程中，网络侧授权UE#1作为Remote UE#1(即，第一用户设备的一例)阶段的示意性流程图，包括以下步骤：
其中，方式1中的S500a～S540a与上述S400a～S440a中的方法类似，方式2中的S500b～S540b与上述S400b～S440b中的方法类似，方式3中的S500c～S540c与上述S400c～S440c中的方法类似，此处不再赘述。
PSF获取密钥#3(即，第三密钥的一例)和临时标识#1可以列举以下实现方式：
方式A：
S550a，AUSF#1生成临时标识#1和密钥#3。
其中，生成临时标识#1的具体过程与上述S450相同，为避免赘述，此处不再详细说明。
S560a，AUSF#1向PSF发送临时标识#1和密钥#3，同时PSF存储临时标识#1及其与密钥#3的对应关系。
作为实施例而非限定，密钥#3可以为基于鉴权流程中生成的中间密钥推演得到的密钥。
例如，密钥#3可以是鉴权流程中生成的密钥Kausf#1推演得到的密钥Kpru#1。
应理解，当密钥#1是基于鉴权流程中生成的中间密钥推演得到的密钥(例如，Kpru#1)时，密钥#1和密钥#3相同。
方式B：
S550b，AUSF#1根据上述S450所述的三种情况确定生成密钥#3，同时确定由PSF生成临时标识#1。
S560b，AUSF#1向PSF发送Remote UE#1的网络标识和发送密钥#3，可用于指示由PSF生成临时标识#1。
S565b，PSF根据Remote UE#1的网络标识和密钥#3生成临时标识#1，可列举以下实现方式：
在一种实现方式中，PSF根据Remote UE#1的网络标识和密钥#3生成临时标识#1(即，第一临时标识的一例)。
另一种实现方式中，PSF根据临时标识#1和UDM的路由信息拼接得到临时标识#1’(即，第二临时标识的一例)。
应理解，在本申请实施例中，PSF存储临时标识#1及其与密钥#3的对应关系。
图6示出了本申请实施例Remote UE#1通过UE-to-Network Relay接入网络阶段的示意性流程图，包括以下步骤：
S570与上述S470的方法相同或类似，Remote UE#1发现一个或多个UE-to-Network Relay，并从中选择一个UE-to-Network Relay(计作UE-to-Network Relay#1，即第二用户设备的一例)进行通信。
S580与上述S480的方法相同或类似，Remote UE#1生成临时标识#1’。
Remote UE#1生成临时标识#1’的方式与S540中AUSF#1生成临时标识#1’的方式相同。
作为实施例而非限定，AUSF#1根据临时标识#1和PSF的路由信息拼接得到临时标识#1’，包括以下实现方式：
一种可能的实现方式：临时标识#1可以用X位来表示，其中，高Y位用于表示所述路由信息；剩余的低(X-Y)位用于表示所述临时标识#1’，其中X和Y为正整数；
另一种可能的实现方式：临时标识#1可以用X位来表示，其中，低Y位用于表示所述路由信息；剩余的高(X-Y)位用于表示所述临时标识#1’，其中X和Y为正整数。
其中，特定算法与现有技术相同或类似，例如标准中规定的基本密钥派生方法。
应理解，S560、S570和S580的序号大小顺序并不代表步骤执行的先后顺序，本申请实施例对步骤执行的先后顺序不作任何限定，本领域技术人员可根据需求灵活设定
S590，与上述S490的方法相同或类似，Remote UE#1向UE-to-Network Relay#1发送请求消息#1(即，第一请求的一例)，该请求消息#1用于请求通过UE-to-Network Relay#1接入网络，例如直连通信请求(direct communication request，DCR)消息。请求消息#1携带信息#2，请求消息#1包括临时标识#1’和Relay service code。
应理解，Relay service code可以是UE侧预配置的，还可以是网络侧发送给UE的，例如例如TS23.502中定义的UE Configuration Update流程。
其中，Relay service code用于标识支持ProSe服务的UE-to-Network Relay提供的连接服务，以及标识支持ProSe服务的UE-to-Network Relay提供服务的授权用户，并且可以选择相关的安全策略或信息。
在一种可能的实现方式中，请求消息#1还可以包括新鲜性参数#1。
在另一种可能的实现方式中，请求消息#1还可以包括MAC-I#2。
具体地，Remote UE#1将Relay service code作为输入参数，基于密钥#3根据特定算法生成出密钥#A，Remote UE#1使用密钥#A加密临时标识#1’和Relay service code后，生成完整性消息认证码(message authentication code for integrity，MAC-I)(计作MAC-I#2)，用于验证请求消息#1的完整性保护，防止请求消息#1被攻击者篡改。
S5100，UE-to-Network Relay#1向网络侧PSF发送临时标识#1’和Relay service code。
在一种可能的实现方式中，PSF从UE-to-Network Relay#1获取的信息还可以包括新鲜性参数#1。
在另一种可能的实现方式中，PSF从UE-to-Network Relay#1获取的信息还可以包括MAC-I#2。
应理解，UE-to-Network Relay#1可以经过一个或者多个其他网元向PSF发送临时标识1’和Relay service code。
可选地，S5110，与S4140的方法相同或类似，PSF对Remote UE#1进行授权检查。
具体地，PSF存储有每个UE对应的授权信息执行授权检查。PSF根据临时标识#1’检查Remote UE#1是否授权作为Remote UE，从而通过UE-to-Network Relay#1获取Relay service code对应的连接服务。若授权检查通过则继续执行下述步骤；若授权检查不通过，PSF向AUSF#2发送失败响应消息，该响应消息包括授权失败的原因值(例如授权检查不通过，缺乏必要参数等)。
S5120，与上述S4160的方法相同或类似，PSF根据密钥#3、Relay service code、至少一个新鲜参数确定Remote UE#1和UE-to-Network Relay#1之间的共享密钥(例如Kr)。
具体地，PSF根据临时标识#1’确定临时标识#1，由上述方式A中S560a存储的临时标识#1和密钥#3的对应关系，或者
由上述方式B中S565b存储的临时标识#1和密钥#3的对应关系查找密钥#3。
作为实施例而非限定，在该步骤中，密钥#3可以为基于鉴权流程中生成的中间密钥推演得到的密钥。
例如，密钥#3可以是鉴权流程中生成的密钥Kausf#1推演得到的密钥Kpru#1。
其中，至少一个新鲜性参数生成方式可以列举如下：
一种可能的实现方式，至少一个新鲜参数可以是S590发送的新鲜性参数#1(即，Remote UE生成的新鲜性参数#1)；
另一种可能的实现方式中，至少一个新鲜参数可以是PSF自行生成的新鲜性参数#2；
另一种可能的实现方式中，至少一个新鲜参数可以是Remote UE生成的新鲜性参数#1和PSF自行生成的新鲜性参数#2。
本申请实施例对新鲜性参数的数量不作任何限定。
应理解，若在S5100中，PSF获取的信息还可以包括MAC-I#2，则AUSF#1根据MAC-I#2、Relay service code和临时标识#1验证消息的完整性，验证方式与S580的方法相同或类似，AUSF#1将Relay service code作为输入参数，基于密钥#3根据特定算法生成出密钥#A，Remote UE#1使用密钥#A加密临时标识#1和Relay service code后，生成MAC-I#2’，若MAC-I#2与MAC-I#2’不一致，则表示传输过程中信息内容丢失或被攻击，若MAC-I#2与MAC-I#2’一致，则推演共享密钥。
在一种可能的实现方式中，上述生成密钥#A的输入参数还可以包括新鲜性参数#1。
S5130，PSF向UE-to-Network Relay#1发送共享密钥。
一种可能的实现方式，PSF通过用户面向UE-to-Network Relay#1发送；
另一种可能的实现方式，PSF通过信令面向UE-to-Network Relay#1发送。
应理解，所述共享密钥可以经过一个或者多个其他网元转发到UE-to-Network Relay#1。
应理解，若S5120中，至少一个新鲜参数包括新鲜性参数#2，则在该步骤中，AUSF-2向UE-to-Network Relay#1发送新鲜性参数#2。
S5140，与上述S4180的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送安全模式命令。
其中，所述安全模式命令包括安全算法，安全算法可以包括加密算法和/或完整性保护算法。
在一种可能的实现方式中，所述安全模式命令还可以包括新鲜性参数#2。
S5150，与上述S4190的方法相同或类似，Remote UE#1基于密钥#3、Relay service code、至少一个新鲜参数，采用与S5120同样的方法生成共享密钥。
S5160，与上述S4200的方法相同或类似，Remote UE#1基于共享密钥和安全算法得到通信密钥。
其中，得到通信密钥可以包括以下实现方式：
一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1基于生成的共享密钥推演一个中间密钥或会话密钥，进一步的，基于中间密钥或会话密钥推演Remote UE#1和UE-to-network Relay#1间的信令面和用户面的加密密钥(例如，NR PC5Encryption Key，NRPEK)和/或完整性保护密钥(例如NR PC5Integrity Key，NRPIK)。
另一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1分别基于生成的共享密钥推演Remote UE#1和UE-to-network Relay#1之间的消息或数据的加密密钥和/或完整保护密钥。
通信密钥的具体生成方式与现有技术相同或类似，例如TS23.303和TS33.536中的密钥生成方式。。
S5170，与上述S4210的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送响应消息#1，用于响应S5160中的安全模式命令，该响应消息#1表示通信安全已经建立完成。
S5180，与上述S4220的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送响应消息#2，用于响应S590中的请求消息#1，该响应消息#2表示直连通信已建立完成。
图7示出了本申请实施例UE#1认证授权作为Remote UE#1(即，第二用户设备的一例)阶段的示意性流程图，包括以下步骤：
其中，方式1中的S600a～S640a与上述S500a～S540a中的方法类似，方式2中的S600b～S640b与上述S500b～S540b中的方法类似，方式3中的S600c～S640c与上述S500c～S540c中的方法类似，方式A中的S650a～S660a与上述S550a～S560a中的方法类似，方式B中的S650b～S665b与上述S550b～S565b中的方法类似，S670～S690与上述S570～S590中的方法类似，此处不再赘述。
应理解，下述步骤中，PSF#1(即，第五网元的一例)可以是Remote PSF，PSF#2(即，第六网元的一例)可以是为服务UE-to-Network Relay#1的PSF。
S6100，UE-to-Network Relay#1向PSF#2发送临时标识#1’和Relay Service Code。
应理解，UE-to-Network Relay#1可以经过一个或者多个其他网元向PSF发送临时标识1’和Relay service code。
在一种可能的实现方式中，PSF#2从UE-to-Network Relay#1获取的信息还可以包括新鲜性参数#1。
在另一种可能的实现方式中，PSF#2从UE-to-Network Relay#1获取的信息还可以包括MAC-I#1。
S6110，PSF#2根据临时标识#1’(即，第一临时标识的一例)中的路由信息确定对应的PSF#1。
S6120，PSF#1获取临时标识#1’和Relay service code。
在一种可能的实现方式中，PSF#1获取的信息还可以包括新鲜性参数#1。
在一种可能的实现方式中，PSF#1获取的信息还可以包括MAC-I#1。
可选地，S6130，与上述S5110的方法相同或类似，PSF#1对Remote UE#1进行授权检查。
PSF#1根据临时标识#1’检查Remote UE#1是否授权作为Remote UE，从而通过UE-to-Network Relay#1获取Relay service code对应的连接服务。若授权检查通过则继续执行下述步骤；若授权检查不通过，PSF#1向AUSF#2发送失败响应消息，该响应消息包括授权失败的原因值(例如授权检查不通过，缺乏必要参数等)。
S6140，与上述S5120的方法类似，PSF#1根据密钥#3、Relay service code、至少一个新鲜参数确定Remote UE#1和UE-to-Network Relay#1之间通信的共享密钥(例如Kr)。为避免赘述，此处不再详细说明。
应理解，若在S6100中，PSF#1获取的信息还包括MAC-I#1，则AUSF#1根据MAC-I#1、Relay service code和临时标识#1(即，第一临时标识的一例)验证消息的完整性，验证方式与S5120的方法相同或类似，此处不再赘述。
S6150，PSF#1向PSF#2发送共享密钥。
一种可能的实现方式，PSF#1通过用户面向UE-to-Network Relay#1发送；
另一种可能的实现方式，PSF#1通过信令面向UE-to-Network Relay#1发送。
应理解，所述共享密钥可以经过一个或者多个其他网元转发到UE-to-Network Relay#1。
应理解，若在S6140中，至少一个新鲜参数包括新鲜性参数#2，则在该步骤中，PSF#1向PSF#2发送新鲜性参数#2。
S6160，与上述S5130的方法相同或类似，PSF#2向UE-to-Network Relay#1发送共享密钥。
应理解，若在S6150中，PSF#2接收到新鲜性参数#2，则PSF#2向UE-to-Network Relay#1发送新鲜性参数#2。
S6170，与上述S5140的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送安全模式命令。
其中，所述安全模式命令包括安全算法，安全算法可以包括加密算法和/或完整性保护算法。
在一种可能的实现方式中，所述安全模式命令还可以包括新鲜性参数#2。
S6180，与上述S5150的方法相同或类似，Remote UE#1基于密钥#3、Relay service code、至少一个新鲜参数，采用与S6150同样的方法生成共享密钥。
S6190，与上述S5160的方法相同或类似，Remote UE#1基于共享密钥和安全算法得到通信密钥。
其中，得到通信密钥可以包括以下实现方式：
一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1基于生成的共享密钥推演一个中间密钥或会话密钥，进一步的，基于中间密钥或会话密钥推演Remote UE#1和UE-to-network Relay#1间的信令面和用户面的加密密钥(例如，NR PC5Encryption Key，NRPEK)和/或完整性保护密钥(例如NR PC5Integrity Key，NRPIK)。
另一种可能的实现方式中，Remote UE#1和UE-to-network Relay#1分别基于生成的共享密钥推演Remote UE#1和UE-to-network Relay#1之间的消息或数据的加密密钥和/或完整保护密钥。
通信密钥的具体生成方式与现有技术相同或类似，例如TS23.303和TS33.536中的密钥生成方式。
S6200，与上述S5170的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送响应消息#1，用于响应S6190中的安全模式命令，该响应消息#1表示通信安全已经建立完成。
S6210，与上述S5180的方法相同或类似，UE-to-Network Relay#1向Remote UE#1发送响应消息#2，用于响应S690中的请求消息#1(即，第一请求的一例)，该响应消息#2表示直接通信已建立完成。
应理解，上述实施例中，第一用户设备的标识(即，包括Remote UE的网络标识和第一用户设备的网络标识)用于识别所述第一用户设备的信息，本申请实施例对第一用户设备的标识不做任何限定，本领域技术人员为了达到识别所述第一用户设备的目的，可根据具体情况灵活限定。
应理解，上述实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
现有技术中，Remote UE通过UE-to-Network Relay与网络建立会话的过程如下所述：
Remote UE和UE-to-Network Relay分别接入网络，并从网络获取授权和配置信息。其中，授权和配置信息用于建立ProSe通信连接。Remote UE发现一个或多个UE-to-Network Relay，并从中选择一个UE-to-Network Relay，接受其提供的连接服务信息。Remote UE与所选择的UE-to-Network Relay建立一对一直接通信的连接。UE-to-Network Relay向会话管理网元上报中继相关的协议数据单元(protocol data unit，PDU)会话的远端用户设备报告(Remote UE Report)，例如(远端用户标识远(Remote User ID)，远端用户信息(Remote UE info))。
在该Remote UE通过UE-to-Network Relay获取业务的过程中，为了保证通信安全，Remote UE和UE-to-Network Relay之间需要建立安全连接。然而，由于Remote UE通过 UE-to-Network Relay建立通信连接是按需动态建立的，例如，Remote UE在发现过程中，发现的UE-to-Network Relay不是固定的。比如第一发现的，可能是UE-to-Network Relay#1，第二发现的可能是UE-to-Network Relay#1。Remote UE在不同时候不同地点，发现的UE-to-Network Relay可能都不一样，且不可预知。因此无法在Remote UE和UE-to-Network Relay之间预配置共享的安全参数(例如，共享密钥)用于Remote UE和UE-to-Network Relay之间安全通信。
基于本申请实施例提供的上述技术方案，本申请实施例生成了设备间通信的密钥，使得用户设备与用户设备之间动态地建立了安全的通信连接，与上述现有技术中具有本质区别，解决了上述现有技术存在的问题。
以上，结合图3至图8详细说明了本申请实施例提供的方法。下面结合图9至图10介绍本申请实施例提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，各个网元，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对发射端设备或者接收端设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分各个功能模块为例进行说明。
图9是本申请实施例提供的通信装置100的示意性框图。如图所示，该通信装置100可以包括：收发单元110和处理单元120。
在一种可能的设计中，该通信装置100可以是上文方法实施例中的远端用户设备，也可以是用于实现上文方法实施例中远端用户设备的功能的芯片。
应理解，该通信装置100可对应于根据本申请实施例的方法400、方法500、方法600、方法700、方法800和方法900中的远端用户设备，该通信装置100可以包括用于执行图3中的方法400、图4中的方法500、图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900、图6中的方法700、图7中的方法800和图8中的方法900中的远端用户设备执行的方法的单元。并且，该通信装置100中的各单元和上述其他操作和/或功能分别为了实现图3中的方法400、图4中的方法500、图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900、图6中的方法700、图7中的方法800和图8中的方法900的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置100可以是上文方法实施例中的鉴权功能网元， 也可以是用于实现上文方法实施例中鉴权功能网元的芯片。
应理解，该通信装置100可对应于根据本申请实施例方法400、方法500中的鉴权功能网元，该通信装置100可以包括用于执行图3中的方法400、图4中的方法500中的鉴权功能网元执行的方法的单元。并且，该通信装置100中的各单元和上述其他操作和/或功能分别为了实现图3中的方法400、图4中的方法500的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置100可以是上文方法实施例中的近距离业务安全功能网元，也可以是用于实现上文方法实施例中近距离业务安全功能网元的功能的芯片。
应理解，该通信装置100可对应于根据本申请实施例方法600、方法700、方法800和方法900中的近距离业务安全功能网元，该通信装置100可以包括用于执行图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900中的近距离业务安全功能网元执行的方法的单元。并且，该通信装置100中的各单元和上述其他操作和/或功能分别为了实现图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该通信装置100中的收发单元可对应于图10中示出的通信设备200中的收发器210，该通信装置100中的处理单元120可对应于图10中示出的通信设备200中的收发器220。
还应理解，当该通信装置100为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
收发单元110用于实现通信装置100的信号的收发操作，处理单元120用于实现通信装置100的信号的处理操作。
可选地，该通信装置100还包括存储单元130，该存储单元130用于存储指令。
图10是本申请实施例提供的通信设备200的示意性框图。如图所示，该通信设备200包括：至少一个处理器210和收发器220。该处理器210与存储器耦合，用于执行存储器中存储的指令，以控制收发器220发送信号和/或接收信号。可选地，该通信设备200还包括存储器230，用于存储指令。
应理解，上述处理器210和存储器230可以合成一个处理装置，处理器210用于执行存储器230中存储的程序代码来实现上述功能。具体实现时，该存储器230也可以集成在处理器210中，或者独立于处理器210。
还应理解，收发器220可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器还可以进一步包括天线，天线的数量可以为一个或多个。收发器220有可以是通信接口或者接口电路。
在一种可能的设计中，该通信设备200可以是上文方法实施例中的远端用户设备，也可以是用于实现上文方法实施例中远端用户设备的功能的芯片。
具体地，该通信设备200可对应于根据本申请实施例的方法400、方法500、方法600、方法700、方法800和方法900中的远端用户设备，该通信设备200可以包括用于执行图3中的方法400、图4中的方法500、图5中的方法600、图6中的方法700、图7中的方 法800和图8中的方法900中的远端用户设备执行的方法的单元。并且，该通信设备200中的各单元和上述其他操作和/或功能分别为了实现图3中的方法400、图4中的方法500、图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在一种可能的设计中，该通信设备200可以是上文方法实施例中的近距离业务安全功能网元，也可以是用于实现上文方法实施例中近距离业务安全功能网元的功能的芯片。
具体地，该通信设备200可对应于根据本申请实施例的方法400、方法500中的近距离业务安全功能网元，该通信设备200可以包括用于执行图3中的方法400、图4中的方法500中的近距离业务安全功能网元执行的方法的单元。并且，该通信设备200中的各单元和上述其他操作和/或功能分别为了实现图3中的方法400、图4中的方法500的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在一种可能的设计中，该通信设备200可以是上文方法实施例中的鉴权功能网元，也可以是用于实现上文方法实施例中鉴权功能网元的功能的芯片。
具体地，该通信设备200可对应于根据本申请实施例的方法600、方法700、方法800和方法900中的鉴权功能网元，该通信设备200可以包括用于执行图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900中的鉴权功能网元执行的方法的单元。并且，该通信设备200中的各单元和上述其他操作和/或功能分别为了实现图5中的方法600、图6中的方法700、图7中的方法800和图8中的方法900的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
当该通信设备200为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。 在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch-link DRAM，SLDRAM)和直接内存总线随机存取存储器(direct ram-bus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图3或图4或图5所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图3或图4或图5所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的装置或设备。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等 数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络侧设备与终端设备和方法实施例中的网络侧设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所述领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而 前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (69)

  1. 一种生成设备间通信的密钥的方法，其特征在于，包括：
    第一用户设备基于第一密钥，生成第一临时标识；
    所述第一用户设备向第二用户设备发送第一请求，所述第一请求用于建立所述第一用户设备和所述第二用户设备之间的通信连接；其中，所述第一请求包括所述第一临时标识和中继服务码；
    所述第一用户设备基于第二密钥和所述中继服务码，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接，所述第二密钥与所述第一密钥为鉴权流程中生成的密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
  4. 根据权利要求1所述的方法，其特征在于，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
  5. 根据权利要求1-4中任一所述的方法，其特征在于，所述第一用户设备基于第一密钥，生成第一临时标识，包括：
    所述第一用户设备基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
  6. 根据权利要求5所述的方法，其特征在于，所述第一用户设备基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识，包括：
    所述第一用户设备基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；
    将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
  7. 根据权利要求5或6所述的方法，其特征在于，所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
  8. 根据权利要求1-7中任一所述的方法，其特征在于，所述方法还包括：
    所述第一用户设备向移动管理网元发送非接入层NAS消息，所述NAS消息包括能力信息，所述能力信息用于指示所述第一用户设备支持作为远端用户设备。
  9. 根据权利要求1-8中任一所述的方法，其特征在于，所述第一请求还包括第一新鲜性参数；
    所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码和所述第一新鲜性参数，生成所述共享密钥。
  10. 根据权利要求1-8中任一所述的方法，其特征在于，所述方法还包括：
    所述第一用户设备接收来自所述第二用户设备的安全模式命令，所述安全模式命令包括第二新鲜性参数；
    所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码和所述第二新鲜性参数，生成所述共享密钥。
  11. 根据权利要求1-8中任一所述的方法，其特征在于，所述第一请求还包括第一新鲜性参数；
    所述方法还包括：
    所述第一用户设备接收来自所述第二用户设备的安全模式命令，所述安全模式命令包括第二新鲜性参数；
    所述第一用户设备基于所述第二密钥和所述中继服务码，生成所述共享密钥，包括：所述第一用户设备基于所述第二密钥、所述中继服务码、所述第一新鲜性参数和所述第二新鲜性参数，生成所述共享密钥。
  12. 根据权利要求11所述的方法，其特征在于，所述安全模式命令还包括安全算法；
    所述方法还包括：
    所述第一用户设备基于所述共享密钥和所述安全算法，得到通信密钥；所述通信密钥用于保护所述第一用户设备和所述第二用户设备之间的通信连接。
  13. 一种生成设备间通信的密钥的方法，其特征在于，包括：
    第一网元基于第一密钥，生成第一临时标识；
    所述第一网元接收来自第二网元的密钥获取消息，所述密钥获取消息包括第一用户设备的标识和中继服务码，其中，所述第一用户设备的标识包括所述第一临时标识或者所述第一用户设备的网络标识，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息；
    所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第二用户设备之间的通信连接，所述第二密钥与所述第一密钥为所述第一用户设备的鉴权流程中生成的密钥或者是基于所述第一用户设备的鉴权流程中生成的中间密钥推演得到的密钥；
    所述第一网元向所述第二网元发送所述共享密钥。
  14. 根据权利要求13所述的方法，其特征在于，所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：
    所述第一网元根据所述第一用户设备的标识获取所述第二密钥，所述第一网元根据所述第二密钥和所述中继服务码，生成所述共享密钥。
  15. 根据权利要求13或14所述的方法，其特征在于，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
  16. 根据权利要求13或14所述的方法，其特征在于，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
  17. 根据权利要求13或14所述的方法，其特征在于，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
  18. 根据权利要求13-17中任一项所述的方法，其特征在于，所述第一网元基于第一密钥，生成第一临时标识，包括：
    所述第一网元基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
  19. 根据权利要求18所述的方法，其特征在于，所述第一网元基于第一密钥、所述第一用户设备的网络标识和路由信息，生成第一临时标识，包括：
    所述第一网元基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；
    将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
  20. 根据权利要求13-19中任一项所述的方法，其特征在于，
    所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
  21. 根据权利要求13-20中任一所述的方法，其特征在于，所述方法还包括：
    在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第三网元的指示信息；
    响应于所述指示信息，所述第一网元基于所述第一密钥，生成所述第一临时标识。
  22. 根据权利要求21所述的方法，其特征在于，
    在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第三网元的指示信息；
    响应于所述指示信息，所述第一网元基于所述第一密钥，生成所述第一临时标识，包括：
    在对所述第一用户设备进行鉴权流程中，所述第一网元接收来自第四网元的能力信息，所述能力信息用于指示所述第一用户设备支持远端UE的能力；
    响应于所述指示信息和所述能力信息，所述第一网元基于所述第一密钥，生成所述第一临时标识。
  23. 根据权利要求13-22中任一所述的方法，其特征在于，所述方法还包括：
    所述第一网元将所述第一临时标识发送给第三网元。
  24. 根据权利要求13-23中任一项所述的方法，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥。
  25. 根据权利要求13-23中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网元生成第二新鲜性参数；
    所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥。
  26. 根据权利要求13-23中任一项所的方法，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述方法还包括：
    所述第一网元生成第二新鲜性参数；
    所述第一网元根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元根据所述第一用户设备的标识、所述中继服务码、所述第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
  27. 根据权利要求13-26中任一项所述的方法，其特征在于，
    所述第一网元为鉴权功能网元。
  28. 根据权利要求13-27中任一项所述的方法，其特征在于，
    所述第二网元为移动管理网元、鉴权功能网元或近距离业务安全功能网元。
  29. 根据权利要求13-28中任一项所述的方法，其特征在于，
    所述第三网元为数据管理网元。
  30. 根据权利要求13-29中任一项所述的方法，其特征在于，
    所述第四网元为移动管理网元。
  31. 一种生成设备间通信的密钥的方法，其特征在于，包括：
    第五网元获取第一临时标识和第三密钥，所述第三密钥为基于鉴权流程中生成的中间密钥推演得到的密钥；
    所述第五网元接收来自第六网元的密钥获取消息，所述密钥获取消息包括所述第一临时标识和中继服务码；
    所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第二用户设备之间的通信连接；
    所述第五网元向所述第六网元发送所述共享密钥。
  32. 根据权利要求31所述的方法，其特征在于，所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：
    所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥；包含：
    所述第五网元根据所述第一临时标识获取所述第三密钥，所述第五网元根据所述第三密钥和中继服务码生成共享密钥。
  33. 根据权利要求31所述的方法，其特征在于，第五网元获取第一临时标识，包括：
    第五网元从所述第一网元接收到所述第一临时标识，所述第一临时标识是基于第一中间密钥生成的，所述第一中间密钥为对所述第一用户设备进行鉴权流程中生成的中间密钥或者是基于鉴权流程中生成的中间密钥推演得到的密钥；
    或者，第五网元基于第三中间密钥生成所述第一临时标识。
  34. 根据权利要求31-33中任一项所述的方法，其特征在于，所述第三密钥为基于所述鉴权流程中生成的密钥Kausf推演得到的密钥。
  35. 根据权利要求33所述的方法，其特征在于，所述第一临时标识是基于所述第一密钥生成的，包括：
    所述第一临时标识是基于所述第一密钥、所述第一用户设备的网络标识和路由信息生成的；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
  36. 根据权利要求35所述的方法，其特征在于，所述第一临时标识是基于所述第一密钥、所述第一用户设备的网络标识和路由信息生成的，包括：
    所述第二临时标识是基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数得到的；
    所述第一临时标识是将所述第二临时标识和所述路由信息进行拼接得到的。
  37. 根据权利要求31-36中任一项所述的方法，其特征在于，
    所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
  38. 根据权利要求31-37中任一项所述的方法，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥和所述第一新鲜性参数，生成共享密钥。
  39. 根据权利要求31-37中任一项所述的方法，其特征在于，所述方法还包括：
    所述第五网元生成第二新鲜性参数；
    所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述所述所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥和所述第二新鲜性参数，生成共享密钥。
  40. 根据权利要求31-37中任一项所述的方法，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述方法还包括：
    所述第五网元根据所述第一临时标识、所述中继服务码以及第三密钥，生成共享密钥，包括：所述所述所述第五网元根据所述第一临时标识、所述中继服务码、第三密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
  41. 根据权利要求31-40中任一项所述的方法，其特征在于，
    所述第五网元为第一近距离业务安全功能网元。
  42. 根据权利要求31-41中任一项所述的方法，其特征在于，
    所述第六网元为第二近距离业务安全功能网元。
  43. 一种生成设备间通信的密钥的系统，其特征在于，包括：
    第一网元，用于基于第一密钥生成第一临时标识；
    第二网元，用于向第一网元发送密钥获取消息，所述密钥获取消息包括第一用户设备的标识和中继服务码，其中，所述第一用户设备的标识包括所述第一临时标识或者所述第 一用户设备的网络标识，所述第一用户设备的网络标识用于网络侧识别第一用户设备的信息；
    所述第一网元还用于根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥；其中，所述共享密钥用于保护所述第一用户设备和第二用户设备之间的通信连接，所述第二密钥与所述第一密钥为所述第一用户设备的鉴权流程中生成的密钥或者是基于所述第一用户设备的鉴权流程中生成的中间密钥推演得到的密钥；
    所述第一网元向所述第二网元发送所述共享密钥。
  44. 根据权利要求43所述的系统，其特征在于，所述第一网元还用于根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：
    所述第一网元还用于根据所述第一用户设备的标识获取所述第二密钥，所述第一网元还用于根据所述第二密钥和所述中继服务码，生成所述共享密钥。
  45. 根据权利要求43或44所述的系统，其特征在于，所述第二密钥与所述第一密钥相同，且所述第二密钥和所述第一密钥为所述鉴权流程中生成的密钥Kausf或者基于所述Kausf推演得到的密钥。
  46. 根据权利要求43或44所述的系统，其特征在于，所述第二密钥与所述第一密钥不同，且所述第一密钥为所述鉴权流程中生成的密钥Kausf；所述第二密钥为基于所述Kausf推演得到的密钥。
  47. 根据权利要求43或44所述的系统，其特征在于，所述第二密钥与所述第一密钥不同，且所述第二密钥为所述鉴权流程中生成的密钥Kausf；所述第一密钥为基于所述Kausf推演得到的密钥。
  48. 根据权利要求43-47中任一项所述的系统，其特征在于，所述第一网元，用于基于第一密钥，生成第一临时标识，包括：
    所述第一网元还用于，基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识；其中，所述第一用户设备的网络标识用于网络侧识别所述第一用户设备的信息，所述路由信息为用于确定与所述第一用户设备相关的核心网网元的信息。
  49. 根据权利要求48所述的系统，其特征在于，所述第一网元还用于，基于所述第一密钥、所述第一用户设备的网络标识和路由信息，生成所述第一临时标识，包括：
    所述第一网元还用于，基于所述第一密钥和所述第一用户设备的网络标识作为第一预设算法的输入参数，得到第二临时标识；
    将所述第二临时标识和所述路由信息进行拼接，得到所述第一临时标识。
  50. 根据权利要求43-49中任一项所述的系统，其特征在于，
    所述第一用户设备的网络标识为用户永久标识SUPI或者国际移动用户识别码IMSI或者通用公共订阅标识符GPSI；所述路由信息为路由指示。
  51. 根据权利要求43-50中任一项所述的系统，其特征在于，所述系统还包括：
    第三网元，在对所述第一用户设备进行鉴权流程中，所述第三网元用于向所述第一网元发送第一指示信息；
    响应于所述第一指示信息，所述第一网元用于，基于所述第一密钥，生成所述第一临时标识。
  52. 根据权利要求51中任一项所述的系统，其特征在于，所述系统还包括：
    第四网元，在对所述第一用户设备进行鉴权流程中，所述第四网元用于向所述第一网元发送能力信息，所述能力信息用于指示所述第一用户设备支持远端UE的能力；
    响应于所述第一指示信息和所述能力信息，所述第一网元用于，基于所述第一密钥，生成所述第一临时标识。
  53. 根据权利要求43-52中任一项所述的系统，其特征在于，
    所述第一网元还用于将所述第一临时标识发送给所述第三网元。
  54. 根据权利要求43-53中任一项所述的系统，其特征在于，
    所述第二网元还用于，向所述第三网元发送所述第一临时标识；
    所述第三网元还用于，向所述第二网元发送所述第一网元的标识。
  55. 根据权利要求43-54中任一项所述的系统，其特征在于，
    所述第三网元还用于，向所述第二网元发送所述第一网元的标识和第一用户设备的网络标识。
  56. 根据权利要求43-55中任一项所述的系统，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第一新鲜性参数，生成共享密钥。
  57. 根据权利要求43-55中任一项所述的系统，其特征在于，
    所述第一网元还用于，生成第二新鲜性参数；
    所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥和所述第二新鲜性参数，生成共享密钥。
  58. 根据权利要求43-55中任一项所述的系统，其特征在于，所述密钥获取消息还包括第一新鲜性参数；
    所述第一网元还用于，生成第二新鲜性参数；
    所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码以及第二密钥，生成共享密钥，包括：所述所述第一网元用于，根据所述第一用户设备的标识、所述中继服务码、第二密钥、所述第一新鲜性参数和所述第二新鲜性参数，生成共享密钥。
  59. 根据权利要求43-58中任一项所述的系统，其特征在于，所述系统还包括：
    第一用户设备和第二用户设备。
  60. 根据权利要求43-59中任一项所述的系统，其特征在于，
    所述第一网元为鉴权功能网元。
  61. 根据权利要求43-60中任一项所述的系统，其特征在于，
    所述第二网元为移动管理网元、鉴权功能网元或近距离业务安全功能网元。
  62. 根据权利要求43-61中任一项所述的系统，其特征在于，
    所述第三网元为数据管理网元。
  63. 根据权利要求43-62中任一项所述的系统，其特征在于，
    所述第四网元为移动管理网元。
  64. 一种生成设备间通信的密钥的装置，其特征在于，包括：
    存储器，用于存储计算机指令；
    处理器，用于执行所述存储器中存储的计算机指令，使得所述通信装置执行如权利要求1至12中任一项所述的方法。
  65. 一种生成设备间通信的密钥的装置，其特征在于，包括：
    存储器，用于存储计算机指令；
    处理器，用于执行所述存储器中存储的计算机指令，使得所述装置执行如权利要求13至30中任一项所述的方法。
  66. 一种生成设备间通信的密钥的装置，其特征在于，包括：
    存储器，用于存储计算机指令；
    处理器，用于执行所述存储器中存储的计算机指令，使得所述通信装置执行如权利要求31至42中任一项所述的方法。
  67. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行如权利要求1至12中任一项所述的方法。
  68. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行如权利要求13至30中任一项所述的方法。
  69. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序被通信装置执行时，使得所述通信装置执行如权利要求31至42中任一项所述的方法。
PCT/CN2021/071149 2021-01-11 2021-01-11 一种生成设备间通信的密钥的方法、系统和装置 WO2022147846A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
EP21916899.4A EP4271012A4 (en) 2021-01-11 2021-01-11 METHOD, SYSTEM AND DEVICE FOR GENERATING A KEY FOR COMMUNICATION BETWEEN DEVICES
CA3204772A CA3204772A1 (en) 2021-01-11 2021-01-11 Method, system, and apparatus for generating key for inter-device communication
CN202180089811.1A CN116762470A (zh) 2021-01-11 2021-01-11 一种生成设备间通信的密钥的方法、系统和装置
PCT/CN2021/071149 WO2022147846A1 (zh) 2021-01-11 2021-01-11 一种生成设备间通信的密钥的方法、系统和装置
AU2021416579A AU2021416579B2 (en) 2021-01-11 Method, system, and apparatus for generating key for inter-device communication
US18/349,587 US20230354028A1 (en) 2021-01-11 2023-07-10 Method, system, and apparatus for generating key for inter-device communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/071149 WO2022147846A1 (zh) 2021-01-11 2021-01-11 一种生成设备间通信的密钥的方法、系统和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/349,587 Continuation US20230354028A1 (en) 2021-01-11 2023-07-10 Method, system, and apparatus for generating key for inter-device communication

Publications (1)

Publication Number Publication Date
WO2022147846A1 true WO2022147846A1 (zh) 2022-07-14

Family

ID=82357615

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/071149 WO2022147846A1 (zh) 2021-01-11 2021-01-11 一种生成设备间通信的密钥的方法、系统和装置

Country Status (5)

Country Link
US (1) US20230354028A1 (zh)
EP (1) EP4271012A4 (zh)
CN (1) CN116762470A (zh)
CA (1) CA3204772A1 (zh)
WO (1) WO2022147846A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170055149A1 (en) * 2015-08-17 2017-02-23 Telefonaktiebolaget L M Ericsson (Publ) Method and Apparatus for Direct Communication Key Establishment
WO2018126452A1 (zh) * 2017-01-06 2018-07-12 华为技术有限公司 授权验证方法和装置
CN111417092A (zh) * 2019-01-04 2020-07-14 华硕电脑股份有限公司 支持单个一对一侧链路通信链路车联网服务的方法和设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10897707B2 (en) * 2015-01-19 2021-01-19 Telefonaktiebolaget Lm Ericsson (Publ) Methods and apparatus for direct communication key establishment

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170055149A1 (en) * 2015-08-17 2017-02-23 Telefonaktiebolaget L M Ericsson (Publ) Method and Apparatus for Direct Communication Key Establishment
WO2018126452A1 (zh) * 2017-01-06 2018-07-12 华为技术有限公司 授权验证方法和装置
CN111417092A (zh) * 2019-01-04 2020-07-14 华硕电脑股份有限公司 支持单个一对一侧链路通信链路车联网服务的方法和设备

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Solution on key management in UE-to-network relay based on primary authentication", 3GPP DRAFT; S3-203432, vol. SA WG3, 16 November 2020 (2020-11-16), pages 1 - 3, XP051955237 *
SAMSUNG: "Updates to solution#1 in TR 33.847", 3GPP DRAFT; S3-202611, vol. SA WG3, 2 October 2020 (2020-10-02), pages 1 - 4, XP051937912 *
See also references of EP4271012A4 *
ZTE COPORATION: "Security of Relay Service Code", 3GPP DRAFT; S3-151897-SECURITY OF RELAY SERVICE CODE, vol. SA WG3, 17 August 2015 (2015-08-17), Tallinn Estonia, pages 1 - 3, XP050995296 *

Also Published As

Publication number Publication date
CA3204772A1 (en) 2022-07-14
CN116762470A (zh) 2023-09-15
AU2021416579A1 (en) 2023-08-10
US20230354028A1 (en) 2023-11-02
EP4271012A4 (en) 2024-01-24
EP4271012A1 (en) 2023-11-01

Similar Documents

Publication Publication Date Title
US11778459B2 (en) Secure session method and apparatus
US9184977B2 (en) System for controlling access to device-to-device communication services in wireless network
US11310843B2 (en) PDU session establishment method and apparatus
US20190253403A1 (en) Network Authentication Triggering Method and Related Device
EP2936876B1 (en) Methods and apparatus for differencitating security configurations in a radio local area network
CN108605225B (zh) 一种安全处理方法及相关设备
US20230087407A1 (en) Authentication and authorization method and apparatus
AU2021417645A1 (en) Secure communication method and device
WO2023011630A1 (zh) 授权验证的方法及装置
CN112492590A (zh) 一种通信方法及装置
CA3204536A1 (en) Key identifier generation method and related apparatus
CN114600487B (zh) 身份认证方法及通信装置
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
WO2024067619A1 (zh) 通信方法和通信装置
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2022147846A1 (zh) 一种生成设备间通信的密钥的方法、系统和装置
CN117296401A (zh) 建立到移动网络的附加注册
AU2021416579B2 (en) Method, system, and apparatus for generating key for inter-device communication
WO2023213191A1 (zh) 安全保护方法及通信装置
WO2022174729A1 (zh) 保护身份标识隐私的方法与通信装置
WO2023011263A1 (zh) 消息传输方法及通信装置
WO2021057456A1 (zh) 用于注册的方法和装置
US20240163670A1 (en) Wireless communication method and apparatus
WO2022067827A1 (zh) 一种密钥推衍方法及其装置、系统
WO2023160390A1 (zh) 通信方法与装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21916899

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202180089811.1

Country of ref document: CN

ENP Entry into the national phase

Ref document number: 3204772

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2021916899

Country of ref document: EP

Effective date: 20230724

ENP Entry into the national phase

Ref document number: 2021416579

Country of ref document: AU

Date of ref document: 20210111

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11202305275S

Country of ref document: SG