WO2023240575A1 - 一种中继通信方法、通信装置及通信设备 - Google Patents

一种中继通信方法、通信装置及通信设备 Download PDF

Info

Publication number
WO2023240575A1
WO2023240575A1 PCT/CN2022/099287 CN2022099287W WO2023240575A1 WO 2023240575 A1 WO2023240575 A1 WO 2023240575A1 CN 2022099287 W CN2022099287 W CN 2022099287W WO 2023240575 A1 WO2023240575 A1 WO 2023240575A1
Authority
WO
WIPO (PCT)
Prior art keywords
relay
terminal
long
remote terminal
direct communication
Prior art date
Application number
PCT/CN2022/099287
Other languages
English (en)
French (fr)
Inventor
商正仪
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202280002242.7A priority Critical patent/CN117597963A/zh
Priority to PCT/CN2022/099287 priority patent/WO2023240575A1/zh
Publication of WO2023240575A1 publication Critical patent/WO2023240575A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present disclosure relates to the field of wireless communication technology, and in particular, to a relay communication method, communication device and communication equipment.
  • 5G ProSe UE-to-UE Relay 5th generation mobile networks
  • This technology can be called terminal-to-terminal relay (5G ProSe UE-to-UE Relay). This means that if the source terminal cannot reach the target terminal directly, the source terminal will try to discover a relay terminal to reach the target terminal, which may also trigger the relay to discover the target terminal. In fact, relay terminals acting as untrusted nodes may be compromised, thereby compromising the security (i.e. integrity and confidentiality) of information between peer terminals.
  • the present disclosure provides a relay communication method, communication device and communication equipment to provide terminal-to-terminal secure relay communication.
  • a relay communication method which method can be applied to a relay terminal in a communication system.
  • the method may include: the relay terminal receiving a first direct communication request message sent from the first remote terminal; the relay terminal establishing a secure first direct communication link with the first remote terminal based on the first long-term certificate, and A long-term certificate is sent to the relay terminal when the network device passes the authentication of the relay terminal; wherein the first direct communication link is used to transmit transmission information between the first remote terminal and the second remote terminal.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the method further includes: the relay terminal sends a first request message to the network device, where the first request message carries a first long-term credential identifier; the relay terminal receives a first response message from the network device, A response message carries the first long-term certificate.
  • the first direct communication request message carries an identifier for the first shared key; the method further includes: the relay terminal determines the first shared key according to the first shared key identifier, and the first The shared key is used for secure communication between the relay terminal and the first remote terminal.
  • the method includes: the relay terminal determines that the first shared key is valid.
  • the method further includes: the relay terminal sends a second direct connection communication request message to the second remote terminal; and the relay terminal establishes a secure second direct connection with the second remote terminal based on the first long-term credential. Communication link; wherein, the second directly connected communication link is used to transmit transmission information.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the method further includes: the relay terminal determines that a second shared key exists, and the second shared key is used for secure communication between the relay terminal and the second remote terminal; the relay terminal uses the second shared key.
  • the shared key identifier is carried in the second direct communication request message for sending, and the second shared key identifier is used to identify the second shared key.
  • the relay terminal determining that the second shared key exists includes: the relay terminal determining that a valid second shared key exists.
  • the method further includes: the relay terminal receiving a second direct communication acceptance message from the second remote terminal; and the relay terminal sending a first direct communication acceptance message to the first remote terminal.
  • the identity of the relay terminal is one of the following: the proximity service application identity of the relay terminal; the terminal identity of the relay terminal.
  • a relay communication method which method can be applied to a first remote terminal in a communication system.
  • the method includes: a first remote terminal sends a first direct communication request message to a relay terminal, the relay terminal has a first long-term certificate, and the first long-term certificate is sent to the relay terminal when the network device passes the authentication of the relay terminal. Sent; the first remote terminal and the relay terminal establish a secure first direct communication link, and the first direct communication link is used to transmit transmission information between the first remote terminal and the second remote terminal.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the method further includes: the first remote terminal discovers the second remote terminal, and selects the relay terminal.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the method further includes: the first remote terminal determines that a first shared key exists, and the first shared key is used for secure communication between the relay terminal and the first remote terminal; the relay terminal The first shared key identifier is carried in the first direct communication request message for sending, and the first shared key identifier is used to identify the first shared key.
  • the first remote terminal determining that a first shared key exists includes: the relay terminal determines that a valid first shared key exists.
  • the method further includes: the first remote terminal receiving the first direct communication acceptance message sent by the relay terminal.
  • a relay communication method which method can be applied to a network device in a communication system.
  • the method includes: the second remote terminal receives a second direct communication request message sent by the relay terminal, the relay terminal has a first long-term certificate, and the first long-term certificate is sent to the relay terminal when the network device passes the authentication of the relay terminal. Sent; the second remote terminal establishes a secure second direct communication link with the relay terminal, and the second direct communication link is used to transmit transmission information between the second remote terminal and the first remote terminal.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the method further includes: the second remote terminal discovers the first remote terminal and selects the relay terminal.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the second direct communication request message carries an identifier for the second shared key; the method further includes: the second remote terminal determines the second shared key according to the second shared key identifier, and The second shared key is used for secure communication between the second remote terminal and the relay terminal.
  • the method further includes: the second remote terminal determines that the second shared key is valid.
  • the method further includes: the second remote terminal sending a second direct connection communication acceptance message to the relay terminal.
  • a relay communication method which method can be applied to a network device in a communication system.
  • the method includes: the network device receives a first request message, and the first request message is used to request a first long-term certificate; the network device authenticates the relay terminal; when the authentication passes, the network device sends a third request message to the relay terminal.
  • a long-term certificate wherein, the first long-term certificate is used to establish a secure direct communication link between the relay terminal and the peer first remote terminal and the second remote terminal, and the direct communication link is used to relay the first remote terminal. Transmission information to and from the second remote terminal.
  • the method further includes: the network device sets a first long-term credential for the first remote terminal and the second remote terminal; the network device sends the first long-term credential identification to the first remote terminal and the second remote terminal respectively; The first long-term certificate, the first long-term certificate identifier is used to identify the first long-term certificate.
  • the network device authenticates the relay terminal, including: the network device determines whether the relay terminal is authorized to provide relay services based on neighbor service subscription data.
  • the network device determines whether the relay terminal is authorized to provide relay services based on neighbor service subscription data, including: the network device requests the unified data management function (unified data management, UDM) entity of the relay terminal The contract information of the relay terminal.
  • the contract information is used to indicate whether the relay terminal is authorized to provide relay services; the network device receives the contract information sent by the UDM entity; the network device determines whether the relay terminal is authorized to provide relay services based on the contract information. .
  • the network device determines whether the relay terminal is authorized to provide relay services based on neighbor service subscription data, including: the network device determines whether authorization information of the relay terminal is stored locally, and the authorization information is used in the representation Relay terminals are authorized to provide relay services.
  • the method further includes: the network device obtains the first long-term credential from the proximity service application server, or the network device obtains and locally stores the first long-term credential.
  • a communication device can be a relay terminal in a communication system or a chip or system-on-chip of a relay terminal. It can also be a relay terminal used to implement the above-mentioned embodiments. function module of the method described above.
  • the communication device can realize the functions performed by the relay terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the device may include: a receiving module configured to receive a first direct communication request message sent from the first remote terminal; a processing module configured to establish a secure first direct communication with the first remote terminal based on the first long-term credential.
  • the first direct communication link is used to transmit the first long-term certificate to the relay terminal when the network device passes the authentication of the relay terminal.
  • the first direct communication link is used to transmit the connection between the first remote terminal and the second remote terminal. information transmitted between.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the apparatus further includes: a sending module configured to send a first request message to the network device, where the first request message carries a first long-term credential identifier; a receiving module configured to receive a first request message from the network device.
  • the first response message carries the first long-term certificate.
  • the first direct communication request message carries an identifier for the first shared key; the processing module is configured to determine the first shared key according to the first shared key identifier. The key is used for secure communication between the relay terminal and the first remote terminal.
  • the processing module is configured to determine that the first shared key is valid.
  • the apparatus further includes: a sending module configured to send a second direct communication request message to the second remote terminal; and a processing module configured to establish a connection with the second remote terminal based on the first long-term credential.
  • a sending module configured to send a second direct communication request message to the second remote terminal
  • a processing module configured to establish a connection with the second remote terminal based on the first long-term credential.
  • a secure second direct communication link wherein the second direct communication link is used to transmit transmission information.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the processing module is configured to determine that a second shared key exists, and the second shared key is used for secure communication between the relay terminal and the second remote terminal; the sending module is configured to send The second shared key identifier is carried in the second direct communication request message for sending, and the second shared key identifier is used to identify the second shared key.
  • the processing module is configured to determine that a valid second shared key exists.
  • the device further includes: a sending module; a receiving module configured to receive a second direct communication acceptance message from the second remote terminal; and a sending module configured to send the first direct communication acceptance message to the first remote terminal.
  • the connection accepts messages.
  • the identity of the relay terminal is one of the following: the proximity service application identity of the relay terminal; the terminal identity of the relay terminal.
  • a communication device may be a first remote terminal in a communication system or a chip or system-on-chip of the first remote terminal. It may also be a first remote terminal used to implement each of the above.
  • the communication device can realize the functions performed by the first remote terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the device may include: a sending module configured to send a first direct communication request message to a relay terminal, where the relay terminal has a first long-term credential, and the first long-term credential is sent by the network device when the relay terminal is authenticated. Sent by the relay terminal; the processing module is configured to establish a secure first direct communication link with the relay terminal, and the first direct communication link is used to transmit transmission between the first remote terminal and the second remote terminal. information.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the processing module is further configured to discover the second remote terminal and select the relay terminal.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the apparatus further includes: a processing module configured to determine that a first shared key exists, and the first shared key is used for secure communication between the relay terminal and the first remote terminal; a sending module, It is configured to carry the first shared key identifier in the first direct communication request message for sending, and the first shared key identifier is used to identify the first shared key.
  • the processing module is configured to determine that a valid first shared key exists.
  • the apparatus further includes: a receiving module configured to receive the first direct communication acceptance message sent by the relay terminal.
  • a communication device may be a second remote terminal in a communication system or a chip or system-on-chip of the second remote terminal. It may also be a second remote terminal used to implement each of the above.
  • the communication device can realize the functions performed by the second remote terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the device may include: a receiving module configured to receive a second direct communication request message sent by the relay terminal, the relay terminal having a first long-term credential, and the first long-term credential is sent to the relay terminal when the network device passes the authentication. Sent by the relay terminal; the processing module is configured to establish a secure second direct communication link with the relay terminal, and the second direct communication link is used to transmit transmission between the second remote terminal and the first remote terminal. information.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the processing module is further configured to discover the first remote terminal and select the relay terminal.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the second direct communication request message carries an identifier for the second shared key; the processing module is also configured to determine the second shared key according to the second shared key identifier.
  • the shared key is used for secure communication between the second remote terminal and the relay terminal.
  • the processing module is further configured to determine that the second shared key is valid.
  • the apparatus further includes: a sending module configured to send a second direct connection communication acceptance message to the relay terminal.
  • a communication device can be a network device in a communication system or a chip or system-on-chip of a network device. It can also be used in a network device to implement the methods described in the above embodiments. function module.
  • the communication device can realize the functions performed by the network equipment in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the device may include: a receiving module configured to receive a first request message, the first request message being used to request a first long-term credential; a processing module configured as a network device to authenticate the relay terminal; a sending module configured When the authentication is passed, the network device sends the first long-term credential to the relay terminal; wherein the first long-term credential is used for the relay terminal to establish a secure direct connection with the peer first remote terminal and the second remote terminal. Communication link, the direct communication link is used to relay transmission information between the first remote terminal and the second remote terminal;
  • the processing module is configured to set a first long-term credential for the first remote terminal and the second remote terminal; the sending module is configured to send the first long-term credential to the first remote terminal and the second remote terminal respectively.
  • the long-term voucher identifier and the first long-term voucher, the first long-term voucher identifier is used to identify the first long-term voucher.
  • the processing module is configured to determine whether the relay terminal is authorized to provide relay services based on neighbor service subscription data.
  • the sending module is configured to request the relay terminal's UDM entity for subscription information of the relay terminal.
  • the subscription information is used to indicate whether the relay terminal is authorized to provide relay services;
  • the receiving module is configured To receive the subscription information sent by the UDM entity;
  • the processing module is configured to determine whether the relay terminal is authorized to provide relay services based on the subscription information.
  • the processing module is configured to determine whether authorization information of the relay terminal is stored locally, and the authorization information is used to indicate that the relay terminal is authorized to provide relay services.
  • the processing module is configured to obtain the first long-term credential from the proximity service application server, or obtain the first long-term credential from local storage.
  • a communication device such as a relay terminal, including: a memory and a processor; the processor is connected to the memory and is configured to execute computer-executable instructions stored on the memory to implement the above The relay communication method described in the first aspect and any possible implementation manner thereof.
  • a communication device such as a first remote terminal, including: a memory and a processor; the processor is connected to the memory and is configured to execute computer-executable instructions stored on the memory to implement the following: The relay communication method described in the above second aspect and any possible implementation manner thereof.
  • a communication device such as a second remote terminal, including: a memory and a processor; the processor is connected to the memory and is configured to execute computer-executable instructions stored on the memory to implement The relay communication method as described in the above third aspect and any possible implementation manner thereof.
  • a communication device such as a network device, including: a memory and a processor; the processor is connected to the memory and is configured to execute computer-executable instructions stored on the memory to implement the above The relay communication method described in the fourth aspect and any possible implementation manner thereof.
  • a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium; when the instructions are run on a computer, they are used to perform the above-mentioned first to fourth aspects and any of the possibilities thereof.
  • a computer program or computer program product is provided.
  • the computer program product When the computer program product is executed on a computer, the computer implements the above described first to fourth aspects and any possible implementation manner thereof. Relay communication method.
  • the relay UE establishes a secure layer 3 (L3) U2U link between UE1 and UE2 by establishing secure direct communication links with peer UEs respectively to achieve 5G ProSe U2U Relay.
  • L3 secure layer 3
  • Figure 1 is a schematic diagram of a communication system in an embodiment of the present disclosure
  • Figure 2 is a schematic diagram of the key hierarchy of a direct unicast link in an embodiment of the present disclosure
  • Figure 3 is a schematic flowchart of the implementation of the first relay communication method in an embodiment of the present disclosure
  • Figure 4 is a schematic flowchart of an implementation process for establishing a secure direct communication link between a relay UE and UE1 in an embodiment of the present disclosure
  • Figure 5 is a schematic flowchart of an implementation process for establishing a secure direct communication link between a relay UE and UE2 in an embodiment of the present disclosure
  • Figure 6 is a schematic flowchart of an implementation process for a relay UE to request long-term credentials from a network device in an embodiment of the present disclosure
  • Figure 7 is a schematic flowchart of the implementation of the second relay communication method in the embodiment of the present disclosure.
  • Figure 8 is a schematic flowchart of the implementation of the relay communication method on the relay UE side in an embodiment of the present disclosure
  • Figure 9 is a schematic flowchart of the implementation of the relay communication method on the UE1 side in an embodiment of the present disclosure
  • Figure 10 is a schematic flowchart of the implementation of the relay communication method on the UE2 side in an embodiment of the present disclosure
  • Figure 11 is a schematic flowchart of the implementation of the relay communication method on the network device side in an embodiment of the present disclosure
  • Figure 12 is a schematic structural diagram of a communication device in an embodiment of the present disclosure.
  • Figure 13 is a schematic structural diagram of a communication device in an embodiment of the present disclosure.
  • Figure 14 is a schematic structural diagram of a terminal device in an embodiment of the present disclosure.
  • Figure 15 is a schematic structural diagram of a network device in an embodiment of the present disclosure.
  • first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the embodiments of the present disclosure, “first information” may also be called “second information”, and similarly, “second information” may also be called “first information”. Depending on the context, the word “if” as used herein may be interpreted as “when” or “when” or “in response to determining.”
  • 5G ProSe terminal-to-UE relay 5G ProSe UE-to-UE Relay, referred to as 5G ProSe U2U Relay
  • the relay terminal provides relay functions to support 5G ProSe Connections between remote terminals.
  • the remote terminal is a peer terminal
  • the network configures the same long-term certificate and long-term certificate identification for the peer terminal.
  • Embodiments of the present disclosure provide a communication system.
  • the communication system may be a communication system based on cellular mobile communication technology, such as a 5G (fifth generation mobile communication technology) system.
  • Figure 1 is a schematic diagram of a communication system in an embodiment of the present disclosure.
  • the communication system 100 may include: a first remote terminal 101, a terminal-to-terminal relay (UE-to-UE Relay, referred to as It is a U2U Relay 102 and a second remote terminal 103.
  • the terminal-to-UE relay (UE-to-UE Relay) 102 can be implemented using a relay terminal.
  • a PC5 interface exists between the first remote terminal 101, the UE-to-UE Relay 102 and the second remote terminal 103.
  • the above-mentioned remote UE and relay UE can be a terminal with wireless communication function, which can be deployed on land, including indoor or outdoor, handheld, wearable or vehicle-mounted; it can also be deployed on water (such as ships, etc.); It can also be deployed in the air (such as on airplanes, balloons, satellites, etc.).
  • the above-mentioned terminals can be mobile phones, tablets (Pad), computers with wireless transceiver functions, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, industrial control (industrial control) ), wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the terminal may also be a handheld device with wireless communication capabilities, a vehicle-mounted device, a wearable device, a computing device, or other processing device connected to a wireless modem, etc.
  • Terminal devices can be called different names in different networks, for example: terminal device, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, terminal, wireless communication Equipment, user agent or user device, cellular phone, cordless phone, session initiation protocol (SIP) phone, wireless local loop (WLL) station, personal digital assistant (PDA), 5G Network or terminals in future evolution networks, etc.
  • the terminal may be called user equipment (UE).
  • UE user equipment
  • the above communication system may also include a network device 104.
  • the network device 104 may perform security configuration, such as configuring keys, for the remote UE and the relay UE.
  • the network device 104 may include one of the following: a policy control function (PCF) entity, a 5G direct discovery name management function (DDNMF) entity, a 5G neighbor service key management function ( ProSe key management function, PKMF) entity, ProSe application server (Prose Application Server).
  • PCF policy control function
  • DDNMF 5G direct discovery name management function
  • PKMF 5G neighbor service key management function
  • ProSe application server ProSe Application Server
  • 5GC 5G core network
  • the network device 104 may also include various evolved versions of the above functional entities, as well as other functional entities capable of realizing the above functions, which are not specifically limited in this embodiment of the disclosure.
  • each communication device mentioned above is only exemplary, and not all functions of each network device are necessary when applied in the embodiments of the present disclosure. All or part of the equipment of the core network may be physical equipment or virtualized equipment, which is not limited here. Of course, the communication system in the embodiment of the present disclosure may also include other devices not shown in Figure 1, which are not limited here.
  • ProSe enables peer terminals (ie peer UEs) to communicate with each other through 5G ProSe UE-to-UE Relay.
  • the source terminal i.e., source UE
  • the target terminal i.e., target UE
  • the source UE will try to discover a relay terminal (i.e., relay UE) to reach the target UE, which also triggers the relay UE to discover the target UE.
  • relay UEs that are untrusted nodes may be compromised such that the security (i.e., integrity and confidentiality) of information between peer UEs is compromised. So, how to provide secure 5G ProSe UE-to-UE Relay is a technical problem that needs to be solved urgently.
  • embodiments of the present disclosure provide a relay communication method, which can be applied to the above communication system.
  • the first remote terminal and the second remote terminal are peer UEs, which can be recorded as UE1 and UE2.
  • UE1 is the source UE and UE2 is the target UE.
  • the network device can be a relay UE, a PKMF entity of UE1 or UE2, a 5G DDNMF entity, etc.
  • the 5G DDNMF entity may include the DDNMF entity of the relay UE, the DDNMF entity of UE1, or the DDNMF entity of UE2.
  • the network device (such as the 5G DDNMF entity or the PKMF entity) can pre-configure the same long term credential (long term credential) and the long term credential identifier (long term credential) used to represent the long term credential for the peer UE1 and UE2. term credential ID).
  • the long-term credentials are the root keys of UE1 and UE2 and are used to generate subsequent keys in the secure communication mechanism.
  • the DDNMF entity of UE1 configures the long-term certificate identity a and the corresponding long-term certificate A for UE1.
  • the DDNMF entity of UE2 configures the long-term certificate identity a and the corresponding long-term certificate A for UE2.
  • “long-term certificate” can also be described as "long-term certificate", "long-term key”, etc.
  • UE1 and UE2 may be preset with the same long-term credential and the long-term credential identification at the factory.
  • FIG. 2 is a schematic diagram of the key hierarchy of a direct unicast link in an embodiment of the present disclosure. Referring to Figure 2, the different key hierarchies are as follows:
  • the long-term certificate is the root certificate provided to the UE and constitutes the secure communication mechanism of the direct unicast link.
  • This long-term credential can include a symmetric key or a public/private key pair.
  • Authentication signaling is exchanged between UEs to derive K NRP .
  • K NRP is a 256-bit root key (also called a shared key, direct key, etc.) between two entities (such as peer UEs) communicating using a direct unicast link. shared between. K NRP can be updated by re-running authentication signaling using long-term credentials. Random numbers are exchanged between UEs and used with K NRP to generate K NRP-sess (i.e. next layer key). K NRP may be preserved even when there is no active unicast communication session between UEs. K NRP has a 32-bit identifier (K NRP ID), that is, K NRP ID is used to identify K NRP .
  • K NRP ID 32-bit identifier
  • K NRP-sess is a 256-bit key derived from K NRP by the UE, which can also be called a session key and is used to protect data transmission between UEs.
  • K NRP-sess is derived from unicast links. While there is an active unicast communication session between UEs, K NRP-sess can be updated by running a key update procedure. The actual keys used in the confidentiality and integrity algorithms come directly from K NRP-sess .
  • K NRP-sess has a 16-bit identifier (K NRP-sess ID), that is, the K NRP-sess ID is used to identify K NRP-sess .
  • NRPEK and NRPIK are used in the selected confidentiality and integrity algorithms respectively to protect PC5 -S signaling, PC5 radio resource control (RRC) signaling, PC5 user plane data, etc.
  • NRPEK and NRPIK are derived from K NRP-sess and are automatically refreshed every time K NRP-sess is changed.
  • UE1 and UE2 and the relay UE first use discovery parameters and discovery security materials to perform discovery and relay selection processes, and then perform the process of establishing a direct communication link. Assume that UE1 and UE2 have discovered each other and selected the same U2U Relay after the discovery and relay selection process, that is, UE1 and UE2 select the same relay UE. Then, a U2U Relay link is established between UE1 and UE2.
  • FIG 3 is a schematic flowchart of the implementation of the first relay communication method in an embodiment of the present disclosure.
  • the communication method may include:
  • UE 1 sends the first direct connection communication request message (such as Direct Connection Request 1) to the relay UE.
  • first direct connection communication request message such as Direct Connection Request 1
  • the first direct communication request message may carry a first long-term voucher identifier (such as long-term voucher identifier a).
  • the long-term voucher identifier a is used to identify the long-term voucher A.
  • the long-term voucher A can be provided to the relay UE, UE1 and UE2. Used for secure communication shared keys, such as K NRP .
  • UE1 when UE1 needs to send transmission information to UE2, UE1 can send a first direct communication request message to the relay UE to request a direct communication link with the relay UE, thereby triggering direct communication with UE2. .
  • the first direct communication request message may also include at least one of the following: UE1's security capabilities information (security capabilities), relay service code (relay service code, RSC), neighbor service code ( ProSe code) and random number 1 (that is, the first random number, which can be recorded as nonce 1).
  • security capabilities information security capabilities
  • relay service code relay service code
  • ProSe code neighbor service code
  • random number 1 that is, the first random number, which can be recorded as nonce 1).
  • the security capability information of UE1 is used to indicate the security algorithm supported by UE1.
  • the relay UE can determine the selected security algorithm based on the security capability information of UE1 and its own security policy for subsequent verification of integrity and/or confidentiality of signaling between the relay UE and UE1.
  • the relay UE establishes a secure direct communication link with UE1 based on the long-term certificate A.
  • the relay UE After the relay UE receives the long-term voucher identifier a through S301, it can obtain the long-term voucher A. Then, the relay UE establishes a secure direct communication link with UE1 based on the long-term voucher A (that is, the first direct communication link, which can also be recorded as direct communication link A), and establishes a secure direct communication link with UE2 based on the long-term voucher A. Secure direct communication link (that is, the second direct communication link, which can also be recorded as direct communication link B).
  • the above method further includes S303 to S304.
  • the relay UE sends a second direct connection communication request message (such as Direct Connection Request 2) to UE2.
  • a second direct connection communication request message such as Direct Connection Request 2
  • the second direct communication request message may carry the long-term credential identifier a.
  • the second direct communication request message may also include at least one of the following: security capability information of the relay UE, RSC, ProSe Code, random number 3 (i.e., the second random number, which may be recorded as nonce 3 ).
  • the security capability information of the relay UE is used to indicate the security algorithm supported by the relay UE.
  • UE2 can determine the selected security algorithm based on the security capability information of the relay UE and its own security policy for subsequent verification of integrity and/or confidentiality of signaling between the relay UE and UE2.
  • S304 UE2 establishes a secure direct communication link with the relay UE based on the long-term certificate A.
  • the relay UE After the relay UE establishes direct communication link A with UE1, it sends a second direct communication request message to UE2 to trigger the process of establishing direct communication link B between the relay UE and UE2.
  • UE2 obtains the long-term certificate A based on the long-term certificate identification a, and then establishes a secure direct communication link B with the relay UE.
  • the long-term credential A may be sent to the relay UE when the network device (such as DDNMF or PKMF of the relay UE) passes the authentication of the relay UE.
  • the relay UE has established a direct communication link of the same service type before S301.
  • the direct communication link uses the same long-term certificate A as in S301.
  • the direct communication link was established last time.
  • the relay UE can obtain the long-term certificate A sent by the network device after passing the authentication of the relay UE, and save it.
  • the relay UE can establish secure direct communication links with UE1 and UE2 respectively according to the long-term certificate A.
  • the relay UE requests the long-term credential A from the network device, and obtains the long-term credential A sent by the network device after passing the authentication of the relay UE.
  • the relay UE can establish secure direct communication links with UE1 and UE2 respectively according to the long-term certificate A.
  • the relay UE, UE1 and UE2 use the long-term certificate A to derive the shared keys K (ie, the first shared key) and K' (ie, the second shared key) for secure communication.
  • the shared key K is used for secure communication between UE1 and the relay UE
  • the shared key K' is used for secure communication between UE2 and the relay UE.
  • the shared key K may be K NRP
  • the shared key K' may be K' NRP
  • the relay UE and UE1 may further derive K NRP- sess , NRPEK and NRPIK according to K NRP
  • the relay UE and UE2 may further derive K' NRP-sess , NRPEK' and NRPIK' according to K' NRP .
  • the shared key K and the shared key K' may be the same or different.
  • FIG. 4 is a schematic flowchart of an implementation process for establishing a secure direct communication link between a relay UE and UE1 in an embodiment of the present disclosure.
  • the above S302 may include S401 to S403.
  • the relay UE sends the first direct security mode command message (such as Direct Security Mode Command message 1) to UE1.
  • the first direct security mode command message such as Direct Security Mode Command message 1
  • the first direct-connect security mode command message carries the selective security algorithm (Chosen_algs) and the random number 2 (can be recorded as nonce 2).
  • Chosen_algs is determined by the relay UE based on the security capabilities of UE1 and the directly connected communication link security policy of the relay UE.
  • the directly connected communication link security policy may be one of the following: a control plane confidentiality security policy for the directly connected communication link, a control plane integrity security policy for the directly connected communication link, or a user plane confidentiality policy for the directly connected communication link. sexual security policy or user plane integrity security policy for directly connected communication links.
  • the above security policy can be divided into three types: required, not needed, and preferred. “required” means that security needs to be turned on, “not needed” means that security does not need to be turned on, and “preferred” means that security can be turned on or not, which means security can be turned on but security can not be turned on. This is explained here and will not be repeated below. .
  • control plane confidentiality security policy of the directly connected communication link includes: control plane confidentiality protection of the directly connected communication link is turned on (required), The control plane confidentiality protection of the directly connected communication link is not turned on (not needed), or the control plane confidentiality protection of the directly connected communication link is optional (preferred).
  • control plane integrity security policy of a directly connected communication link the user plane confidentiality security policy of a directly connected communication link, and the user plane integrity security policy of a directly connected communication link, please refer to Control Plane of a Directly Connected Communication Link Examples of confidentiality protection strategies will not be repeated here.
  • S402 UE1 performs integrity verification on the first direct security mode command message based on the selected security policy.
  • UE1 responds to the first direct-connect security mode command message, conducts integrity verification on the first direct-connect security mode command message according to the selected security algorithm (Chosen_algs) and random number 2, and if the verification passes , execute S403.
  • UE1 sends the first Direct Security Mode Complete message (such as Direct Security Mode Complete message 1) to the relay UE.
  • first Direct Security Mode Complete message such as Direct Security Mode Complete message 1
  • the relay UE does not send a response message to the first direct communication request message, such as the first direct communication acceptance message, to UE1, but directly initiates the establishment of a direct communication link with UE2. B process.
  • Figure 5 is a schematic flowchart of an implementation process for establishing a secure direct communication link between a relay UE and UE2 in an embodiment of the present disclosure. See Figure 5 and the above-mentioned S304. May include S501 to S503.
  • UE2 sends a second direct security mode command message (such as Direct Security Mode Command message 2) to the relay UE.
  • a second direct security mode command message such as Direct Security Mode Command message 2
  • the second direct connection security mode command message carries the selective security algorithm (Chosen_algs') and the random number 4 (can be recorded as nonce 4).
  • Chosen_algs' is determined by UE2 based on the security capabilities of the relay UE and the security policy of the direct communication link of UE2.
  • S502 The relay UE performs integrity verification on the second direct connection security mode command message based on the selected security policy.
  • UE2 performs integrity verification on the second direct connection security mode command message according to the selected security algorithm (Chosen_algs') and the random number 4, and if the verification passes Next, execute S503.
  • the relay UE sends the second direct security mode completion message (such as Direct Security Mode Complete message 2) to UE2.
  • the second direct security mode completion message such as Direct Security Mode Complete message 2
  • UE2 may send the first direct communication acceptance message (such as Direct Communication Accept message 1) to the relay UE to indicate to the relay UE that the direct communication link B is established, Then, in response to the first Direct Communication Accept message, the relay UE sends a second Direct Communication Accept message (such as Direct Communication Accept message 2) to UE1 to indicate to the relay UE that the direct communication link A is established.
  • first direct communication acceptance message such as Direct Communication Accept message 1
  • second Direct Communication Accept message such as Direct Communication Accept message 2
  • the direct communication link between UE1 and UE2 is established, and UE1 and UE2 can communicate with 5G ProSe U2U Relay.
  • the relay UE may also perform S305.
  • S305 The relay UE relays the transmission information between UE1 and UE2 through direct communication link A and direct communication link B.
  • the relay UE can provide U2U Relay service for UE1 and UE2 to relay the transmission information between UE1 and UE2 ( Also called traffic, or described as transport traffic).
  • UE1 may first send the transmission information sent to UE2 to the relay UE, and the relay UE will relay it to UE2; similarly, UE2 may also send the transmission information sent to UE1 first to the relay UE, and then the relay UE will relay the transmission information to UE2.
  • the relay UE relays to UE1.
  • UE1 and UE2 can communicate with 5G ProSe U2U Relay.
  • the first direct communication request message may also carry a shared key identifier k (i.e., the first direct communication request message) a shared key identifier).
  • the relay UE can directly determine the corresponding shared key K according to the shared key identifier k, and then generate K NRP-sess without the need to generate K NRP from the long-term certificate A.
  • UE1 may first confirm that it has the shared key K of the relay UE. Then, UE1 carries the shared key identifier k in the first direct communication request message and sends it to the relay UE, so that the relay UE can determine the shared key K based on the shared key identifier k.
  • the second direct communication request message may also carry the shared key identifier k' (i.e., the third 2 shared key identification).
  • the shared key identifier k' i.e., the third 2 shared key identification.
  • UE2 can directly determine the corresponding shared key K' according to the shared key identifier k', and then generate K' NRP-sess without the need to generate K' NRP from the long-term certificate A.
  • the relay UE may first confirm that it has the shared key K' of UE2. Then, the relay UE carries the shared key identifier k' in the second direct communication request message and sends it to UE2, so that UE2 can determine the shared key K' according to the shared key identifier k'.
  • the sender identified by the shared key needs to confirm that the shared key is valid before sending it to the receiver.
  • the recipient of the shared key needs to confirm whether the shared key is valid after receiving the shared key, and only use the shared key if it is valid.
  • the shared key being valid can also be described as the shared key being valid and being allowed to be used by the security policy.
  • the above method in response to the above long-term credential A being sent to the relay UE when the network device passes the authentication of the relay UE, then, after S301, the above method may also include the relay UE sending the message to the network.
  • S302 to S305 can be executed.
  • Figure 6 is a schematic flowchart of an implementation process for a relay UE to request long-term credentials from a network device in an embodiment of the present disclosure. Referring to Figure 6, after S301 and before S302, the above method may also include: S601 to S603.
  • the relay UE sends a first request message (such as ProSe key request) to the network device (such as the 5G DDNMF entity of the relay UE).
  • a first request message such as ProSe key request
  • the network device such as the 5G DDNMF entity of the relay UE.
  • the first request message is used to request long-term certificate A from the network device.
  • the first request message can also be described as a key request message (key request), a long term key request message (long term key request), a long term credential request message (long term confidential request), etc.
  • the first request message may carry at least one of the following: relay UE identity (such as Relay UE ID), long-term credential identity a, RSC or ProSe code.
  • relay UE identity such as Relay UE ID
  • long-term credential identity a long-term credential identity a
  • RSC ProSe code
  • the relay UE identification can be set to the U2U Relay ProSe application identification (application ID), the user concealed identifier (subscription conceaaled identifier, SUCI) of the relay UE, etc.
  • application ID U2U Relay ProSe application identification
  • user concealed identifier subscription conceaaled identifier, SUCI
  • the network device authenticates the relay UE.
  • the network device determines whether the relay UE is authorized to provide Prose relay services under this service type based on the relay UE identity, long-term certificate identity a, RSC or ProSe code.
  • the relay UE is authorized to provide Prose relay service under this service type
  • the relay UE is authorized to provide Prose relay service under this service type based on ProSe subscription data.
  • the network device may first search whether the authorization information of the relay UE is stored locally based on the relay UE identity, long-term certificate identity a, RSC or ProSecode to determine whether the relay UE is authorized to provide the Prose relay service under business type. If yes, it means that the relay UE is authorized to provide the Prose relay service under this service type; if not, it means that the relay UE is not authorized to provide the Prose relay service under this service type.
  • the network device may request the relay UE's subscription information from the unified data management function (unified data management, UDM) entity of the relay UE. If the subscription information of the relay UE is stored in the UDM, the UDM feeds back the subscription information of the relay UE to the network device. If the relay UE subscription information fed back by the UDM entity to the network device contains Prose authorization information under this service type, it means that the relay UE is authorized to provide Prose relay services under this service type. Otherwise, it means that the relay UE is not authorized to provide Prose relay services under this service type. Authorized to provide Prose relay services under this business type.
  • UDM unified data management function
  • the network device may also first check whether the authorization information of the relay UE exists locally. If the network device does not locally store the authorization information of the relay UE, the network device then requests the UDM entity of the relay UE for the subscription information of the relay UE.
  • the network device can also authenticate the relay UE through other methods, which are not specifically limited in the embodiments of the present disclosure.
  • the network device sends a first response message (such as ProSe key response) to the relay UE.
  • a first response message such as ProSe key response
  • the first response message may carry the long-term certificate A and the long-term certificate identification a.
  • the first request message can also be described as a key response message (key response), a long term key response message (long term key response), a long term credential request message (long term confidential response), etc.
  • the network device can obtain the long-term credential A locally and provide it to the relay UE.
  • the long-term certificate A is stored in the proximity service application (ProSe Application) server (sever)
  • the network device can obtain the long-term certificate A from the ProSe Application server and then provide it to the relay UE.
  • the network device can also obtain the long-term certificate A through other methods, and this is not specifically limited in the embodiments of the present disclosure.
  • the 5G DDNMF entity may include the DDNMF entity of the relay UE, the DDNMF entity of UE1, and the DDNMF entity of UE2.
  • FIG. 7 is a schematic flowchart of the implementation of the second relay communication method in the embodiment of the present disclosure.
  • the relay communication process may include:
  • the 5G DDNMF entity provides discovery and relay security materials, such as long-term certificate identification a and long-term certificate A, to UE1 and UE2 respectively.
  • UE1 and UE2 use discovery parameters and discovery security materials to perform discovery and relay selection processes, and UE1 and UE2 select the same relay UE.
  • Direct Connection Request 1 can include long-term credential identification a and shared key identification k. Further, Direct Connection Request 1 can also include: UE1's security capability information, RSC, ProSe code, and nonce 1.
  • the relay UE sends a ProSe key request to the 5G DDNMF entity.
  • the ProSe key request includes: relay UE identification, long-term certificate identification a, RSC or ProSe code.
  • the 5G DDNMF entity determines that the relay UE is authorized to provide Prose relay services under this service type.
  • the 5G DDNMF entity sends ProSe key response to the relay UE.
  • ProSe key response carries long-term certificate identification a and long-term certificate A.
  • the relay UE sends Direct Security Mode Command message 1 to UE1.
  • Direct Security Mode Command message 1 carries Chosen_algs and nonce 2.
  • the relay UE sends Direct Connection Request 2 to UE2.
  • Direct Connection Request 2 can include long-term credential identification a and shared key identification k'. Further, Direct Connection Request 2 can also include: security capability information of the relay UE, RSC, ProSe code, and nonce 4.
  • UE2 sends Direct Security Mode Command message 2 to the relay UE.
  • Direct Security Mode Command message 2 carries Chosen_algs' and nonce 2.
  • the relay UE sends Direct Security Mode Complete message 2 to UE2.
  • UE2 sends Direct Connection Request 2 to the relay UE.
  • the relay UE sends Direct Connection Request 1 to UE1.
  • S714 The relay UE relays the transmission information (traffic) between UE1 and UE2.
  • the relay UE establishes a secure L3U2U link between UE1 and UE2 by establishing secure direct communication links with peer UEs respectively to implement 5G ProSe U2U Relay. Furthermore, through the security protection of the direct communication link between the relay UE and UE1 and UE2, the integrity and confidentiality of the transmission information on the 5G ProSe U2U Relay is ensured. Further, through long-term credentials, it is ensured that the remote UE can identify malicious attackers acting as relay UEs. Further, ensure that 5G PKMF can safely provide security parameters to Remote UE and U2U Relay UE.
  • embodiments of the present disclosure also provide a relay communication method, which can be applied to the relay UE side in the communication system.
  • Figure 8 is a schematic flowchart of the implementation of the relay communication method on the relay UE side in an embodiment of the present disclosure. Refer to the solid line in Figure 8. The method may include:
  • the relay UE receives the first direct communication request message sent from UE1;
  • the relay UE establishes a secure first direct communication link with UE1 based on the first long-term certificate.
  • the first long-term certificate is sent to the relay UE when the network device passes the authentication of the relay UE; wherein, the first long-term certificate is sent to the relay UE.
  • the always-connected communication link is used to transmit transmission information between UE1 and UE2.
  • the above method further includes:
  • the relay UE sends a second direct communication request message to UE2;
  • the relay UE establishes a secure second direct communication link with UE2 based on the first long-term certificate; wherein the second direct communication link is used to transmit transmission information.
  • UE1 and UE2 are peer terminals configured with first long-term credentials.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of UE1.
  • the security capability information of UE1 is used to indicate the security algorithm supported by UE1; RSC; ProSe Code; first random number.
  • the above method further includes: the relay UE sends a first request message to the network device, where the first request message carries the first long-term credential identifier; the relay UE receives the first response message from the network device, The first response message carries the first long-term certificate.
  • the first direct communication request message carries a first shared key identifier; the method further includes: the relay UE determines the first shared key according to the first shared key identifier, and the first The shared key is used to relay secure communications between UE and UE1.
  • the above method further includes: the relay UE determines that the first shared key is valid.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay UE, and the security capability information of the relay UE is used to indicate the security algorithm supported by the relay UE.
  • the second direct communication request message also includes at least one of the following: RSC; ProSe Code; and a second random number.
  • the above method further includes: the relay UE determines that a second shared key exists, and the second shared key is used for secure communication between the relay UE and UE2; the relay UE transfers the second shared key to The key identifier is carried in the second direct communication request message for sending, and the second shared key identifier is used to identify the second shared key.
  • the relay UE determines that the second shared key exists, including: the relay UE determines that a valid second shared key exists.
  • the above method further includes: the relay UE receives the second direct communication acceptance message of UE2; and the relay UE sends the first direct communication acceptance message to UE1.
  • the identity of the relay UE is one of the following: the proximity service application identity of the relay UE; the terminal identity of the relay UE.
  • embodiments of the present disclosure also provide a relay communication method, which can be applied to the relay UE1 side in the communication system.
  • Figure 9 is a schematic flowchart of the implementation of the relay communication method on the UEl side in an embodiment of the present disclosure.
  • the method may include:
  • UE1 sends a first direct communication request message to the relay UE.
  • the relay UE has a first long-term certificate.
  • the first long-term certificate is sent to the relay UE when the network device passes the authentication of the relay UE;
  • S902 UE1 establishes a secure first direct communication link with the relay UE.
  • the first direct communication link is used to transmit transmission information between UE1 and UE2.
  • UE1 and UE2 are peer terminals configured with first long-term credentials.
  • the above method further includes: UE1 discovers UE2 and selects the relay UE.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of UE1.
  • the security capability information of UE1 is used to indicate the security algorithm supported by UE1; RSC; ProSe Code; first random number.
  • the above method further includes: the first remote terminal determines that there is a first shared key, and the first shared key is used for secure communication between the relay UE and UE1; the relay UE uses the first shared key.
  • the shared key identifier is carried in the first direct communication request message for sending, and the first shared key identifier is used to identify the first shared key.
  • the first remote terminal determining that a first shared key exists includes: the relay UE determines that a valid first shared key exists.
  • the above method further includes: UEl receiving the first direct communication acceptance message sent by the relay UE.
  • embodiments of the present disclosure also provide a relay communication method, which can be applied to the relay UE2 side in the communication system.
  • Figure 10 is a schematic flowchart of the implementation of the relay communication method on the UE2 side in an embodiment of the present disclosure. Referring to Figure 10, the method may include:
  • UE2 receives the second direct communication request message sent by the relay UE.
  • the relay UE has a first long-term certificate.
  • the first long-term certificate is sent to the relay UE when the network device passes the authentication of the relay UE;
  • UE2 establishes a secure second direct communication link with the relay UE.
  • the second direct communication link is used to transmit transmission information between UE2 and UE1.
  • UE1 and UE2 are peer terminals configured with first long-term credentials.
  • the above method further includes: UE2 discovers UE1 and selects the relay UE.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay UE, and the security capability information of the relay UE is used to indicate the security algorithm supported by the relay UE.
  • the second direct communication request message also includes at least one of the following: RSC; ProSe Code; and a second random number.
  • the second direct communication request message carries an identifier for the second shared key; the method further includes: UE2 determines the second shared key according to the second shared key identifier. The key is used for secure communication between UE2 and the relay UE.
  • the above method further includes: UE2 determining that the second shared key is valid.
  • the above method further includes: UE2 sending a second direct connection communication acceptance message to the relay UE.
  • embodiments of the present disclosure also provide a relay communication method, which can be applied to the relay network device side in the communication system.
  • Figure 11 is a schematic flowchart of the implementation of the relay communication method on the network device side in an embodiment of the present disclosure. Referring to Figure 11, the method may include:
  • the network device receives a first request message, and the first request message is used to request a first long-term credential;
  • the network device authenticates the relay UE
  • the network device sends the first long-term credential to the relay UE.
  • the first long-term credential is used to establish a secure direct communication link between the relay UE and the peer UE1 and UE2.
  • the communication link is used to relay transmission information between UE1 and UE2.
  • the above method also includes: the network device sets a first long-term credential for UE1 and UE2; the network device sends a first long-term credential identifier and a first long-term credential to UE1 and UE2 respectively, and the first long-term credential identifier is Identifies the first long-term certificate.
  • the network device authenticates the relay UE, including: the network device determines whether the relay UE is authorized to provide relay services based on neighbor service subscription data.
  • the network device determines whether the relay UE is authorized to provide relay services based on neighbor service subscription data, including: the network device requests the UDM entity of the relay UE for the subscription information of the relay UE, and the subscription information is Indicates whether the relay UE is authorized to provide relay services; the network device receives the subscription information sent by the UDM entity; the network device determines whether the relay UE is authorized to provide relay services based on the subscription information.
  • the network device determines whether the relay UE is authorized to provide relay services based on neighbor service subscription data, including: the network device determines whether authorization information of the relay UE is stored locally, and the authorization information is used in the representation The subsequent UE is authorized to provide relay services.
  • the above method further includes: the network device obtains the first long-term credential from the proximity service application server, or the network device obtains and locally stores the first long-term credential.
  • Figure 12 is a schematic structural diagram of a communication device in an embodiment of the present disclosure.
  • the communication device 1200 may include: a processing module 1201; The receiving module 1202 and the sending module 1203.
  • the communication device may be a relay terminal in the communication system or a chip or system-on-chip of the relay terminal, or may be a function of the relay terminal used to implement the methods described in the above embodiments. module.
  • the communication device can realize the functions performed by the relay terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the receiving module 1203 is configured to receive the first direct communication request message sent from the first remote terminal; the processing module 1201 is configured to establish a secure first direct communication with the first remote terminal based on the first long-term credential.
  • the first direct communication link is used to transmit the first long-term certificate to the relay terminal when the network device passes the authentication of the relay terminal.
  • the first direct communication link is used to transmit the connection between the first remote terminal and the second remote terminal. information transmitted between.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the device further includes: a sending module 1203, configured to send a first request message to the network device, where the first request message carries a first long-term credential identifier; a receiving module 1203, configured to receive a message from the network device.
  • the first response message of the device carries the first long-term certificate.
  • the first direct communication request message carries an identifier for the first shared key; the processing module 1201 is configured to determine the first shared key according to the first shared key identifier.
  • the shared key is used for secure communication between the relay terminal and the first remote terminal.
  • the processing module 1201 is configured to determine that the first shared key is valid.
  • the device further includes: a sending module 1203 configured to send a second direct communication request message to the second remote terminal; a processing module 1201 configured to communicate with the second remote terminal based on the first long-term credential.
  • the terminal establishes a secure second direct communication link; wherein the second direct communication link is used to transmit transmission information.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the processing module 1201 is configured to determine that a second shared key exists, and the second shared key is used for secure communication between the relay terminal and the second remote terminal; the sending module 1203 is configured In order to carry the second shared key identifier in the second direct communication request message for sending, the second shared key identifier is used to identify the second shared key.
  • the processing module 1201 is configured to determine that a valid second shared key exists.
  • the device further includes: a sending module; a receiving module 1203 configured to receive a second direct communication acceptance message from the second remote terminal; and a sending module 1203 configured to send a third direct communication acceptance message to the first remote terminal.
  • a sending module configured to send a third direct communication acceptance message to the first remote terminal.
  • the identity of the relay terminal is one of the following: the proximity service application identity of the relay terminal; the terminal identity of the relay terminal.
  • the communication device may be the first remote terminal in the communication system or the chip or system-on-chip of the first remote terminal. It may also be used in the first remote terminal to implement the methods described in the above embodiments.
  • the communication device can realize the functions performed by the first remote terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the sending module 1203 is configured to send the first direct communication request message to the relay terminal.
  • the relay terminal has a first long-term certificate.
  • the first long-term certificate is sent to the relay terminal when the network device passes the authentication.
  • Sent by the relay terminal; the processing module 1201 is configured to establish a secure first direct communication link with the relay terminal, and the first direct communication link is used to transmit transmission between the first remote terminal and the second remote terminal. information.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the processing module 1201 is also configured to discover the second remote terminal and select the relay terminal.
  • the first direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the first direct communication request message also includes at least one of the following: security capability information of the first remote terminal, and the security capability information of the first remote terminal is used to indicate the security supported by the first remote terminal.
  • security capability information of the first remote terminal Algorithm; relay service code; neighbor service code; first random number.
  • the device further includes: a processing module 1201 configured to determine that a first shared key exists, and the first shared key is used for secure communication between the relay terminal and the first remote terminal; a sending module 1203. Configured to carry the first shared key identifier in the first direct communication request message for sending, where the first shared key identifier is used to identify the first shared key.
  • the processing module 1201 is configured to determine that a valid first shared key exists.
  • the device further includes: a receiving module 1203 configured to receive the first direct communication acceptance message sent by the relay terminal.
  • the communication device may be a second remote terminal in the communication system or a chip or system-on-chip of the second remote terminal, or may be a device used in the second remote terminal to implement the methods described in the above embodiments.
  • the communication device can realize the functions performed by the second remote terminal in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • the receiving module 1203 is configured to receive the second direct communication request message sent by the relay terminal.
  • the relay terminal has a first long-term certificate.
  • the first long-term certificate is sent to the relay terminal when the network device passes the authentication.
  • Sent by the relay terminal; the processing module 1201 is configured to establish a secure second direct communication link with the relay terminal, and the second direct communication link is used to transmit transmission between the second remote terminal and the first remote terminal. information.
  • the first remote terminal and the second remote terminal are peer terminals configured with a first long-term credential.
  • the processing module 1201 is also configured to discover the first remote terminal and select the relay terminal.
  • the second direct communication request message carries a first long-term credential identifier, and the first long-term credential identifier is used to identify the first long-term credential.
  • the second direct communication request message carries security capability information of the relay terminal, and the security capability information of the relay terminal is used to indicate the security algorithm supported by the relay terminal.
  • the second direct communication request message further includes at least one of the following: a relay service code; a neighbor service code; and a second random number.
  • the second direct communication request message carries an identifier for the second shared key; the processing module 1201 is also configured to determine the second shared key according to the second shared key identifier.
  • the second shared key is used for secure communication between the second remote terminal and the relay terminal.
  • the processing module 1201 is also configured to determine that the second shared key is valid.
  • the device further includes: a sending module 1203 configured to send a second direct connection communication acceptance message to the relay terminal.
  • the communication device may be a network device in the communication system or a chip or system-on-chip of the network device, or may be a functional module in the network device used to implement the methods described in the above embodiments.
  • the communication device can realize the functions performed by the network equipment in the above embodiments, and these functions can be realized by hardware executing corresponding software.
  • These hardware or software include one or more modules corresponding to the above functions.
  • the receiving module 1203 is configured to receive the first request message, which is used to request the first long-term certificate;
  • the processing module 1201 is configured as the network device to authenticate the relay terminal;
  • the sending module 1203 is It is configured that when the authentication is passed, the network device sends a first long-term credential to the relay terminal; wherein the first long-term credential is used for the relay terminal to establish a secure direct connection with the peer first remote terminal and the second remote terminal.
  • a connected communication link, the direct connected communication link is used to relay transmission information between the first remote terminal and the second remote terminal;
  • the processing module 1201 is configured to set a first long-term credential for the first remote terminal and the second remote terminal; the sending module 1203 is configured to send the first long-term credential to the first remote terminal and the second remote terminal respectively.
  • the first long-term voucher identifier and the first long-term voucher, the first long-term voucher identifier is used to identify the first long-term voucher.
  • the processing module 1201 is configured to determine whether the relay terminal is authorized to provide relay services based on neighbor service subscription data.
  • the sending module 1203 is configured to request the relay terminal's UDM entity for the subscription information of the relay terminal.
  • the subscription information is used to indicate whether the relay terminal is authorized to provide relay services;
  • the receiving module 1203 The processing module 1201 is configured to receive the subscription information sent by the UDM entity;
  • the processing module 1201 is configured to determine whether the relay terminal is authorized to provide relay services based on the subscription information.
  • the processing module 1201 is configured to determine whether the authorization information of the relay terminal is stored locally, and the authorization information is used to indicate that the relay terminal is authorized to provide relay services.
  • the processing module 1201 is configured to obtain the first long-term credential from the proximity service application server, or obtain the first long-term credential stored locally.
  • the receiving module 1202 mentioned in the embodiment of the present disclosure may be a receiving interface, a receiving circuit or a receiver, etc.; the sending module 1203 may be a sending interface, a sending circuit or a transmitter, etc.; and the processing module 1201 may be one or more processors.
  • FIG. 13 is a schematic structural diagram of a communication device in an embodiment of the present disclosure.
  • the communication device 1300 uses general computer hardware, including a processor 1301, a memory 1302, a bus 1303, an input device 1304 and an output Device 1305.
  • memory 1302 may include computer storage media in the form of volatile and/or non-volatile memory, such as read-only memory and/or random access memory.
  • Memory 1302 may store an operating system, application programs, other program modules, executable code, program data, user data, and the like.
  • Input device 1304 may be used to enter commands and information to a communication device, such as a keyboard or a pointing device such as a mouse, trackball, touch pad, microphone, joystick, game pad, satellite television dish, scanner, or similar device. These input devices may be connected to processor 1301 via bus 1303.
  • a communication device such as a keyboard or a pointing device such as a mouse, trackball, touch pad, microphone, joystick, game pad, satellite television dish, scanner, or similar device.
  • the output device 1305 can be used for communication devices to output information.
  • the output device 1305 can also be other peripheral output devices, such as speakers and/or printing devices. These output devices can also be connected to the processor 1301 through the bus 1303. .
  • the communication device may be connected to a network through the antenna 1306, such as a local area network (LAN).
  • LAN local area network
  • the computer execution instructions stored in the control device can be stored in a remote storage device and are not limited to local storage.
  • the communication device executes the relay communication method on the UE side or the network device side in the above embodiments.
  • the specific execution process refer to the above embodiments. , which will not be described in detail here.
  • the above-mentioned memory 1302 stores computer execution instructions for realizing the functions of the processing module 1201, the receiving module 1202, and the sending module 1203 in FIG. 12 .
  • the functions/implementation processes of the processing module 1201, the receiving module 1202 and the sending module 1203 in Figure 12 can all be implemented by the processor 1301 in Figure 13 calling the computer execution instructions stored in the memory 1302.
  • the processor 1301 in Figure 13 calling the computer execution instructions stored in the memory 1302.
  • a terminal device such as a relay terminal, a first remote terminal or a second remote terminal, which is consistent with the relay UE, UE1 and UE2 in one or more of the above embodiments.
  • the terminal device can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.
  • Figure 14 is a schematic structural diagram of a terminal device in an embodiment of the present disclosure.
  • the terminal device 1400 may include one or more of the following components: a processing component 1401, a memory 1402, a power supply component 1403, a multimedia component 1404, Audio component 1405, input/output (I/O) interface 1406, sensor component 1407, and communication component 1408.
  • the processing component 1401 generally controls the overall operations of the terminal device 1400, such as operations associated with display, phone calls, data communications, camera operations, and recording operations.
  • the processing component 1401 may include one or more processors 910 to execute instructions to complete all or part of the steps of the above method. Additionally, processing component 1401 may include one or more modules that facilitate interaction between processing component 1401 and other components. For example, processing component 1401 may include a multimedia module to facilitate interaction between multimedia component 1404 and processing component 1401.
  • the memory 1402 is configured to store various types of data to support operations at the terminal device 1400 . Examples of such data include instructions for any application or method operating on the terminal device 1400, contact data, phonebook data, messages, pictures, videos, etc.
  • Memory 1402 may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EEPROM), Programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EEPROM erasable programmable read-only memory
  • EPROM Programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory flash memory
  • flash memory magnetic or optical disk.
  • the power supply component 1403 provides power to various components of the terminal device 1400.
  • Power supply components 1403 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to end device 1400.
  • Multimedia component 1404 includes a screen that provides an output interface between terminal device 1400 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. A touch sensor can not only sense the boundaries of a touch or swipe action, but also detect the duration and pressure associated with the touch or swipe action.
  • multimedia component 1404 includes a front-facing camera and/or a rear-facing camera.
  • the front camera and/or the rear camera may receive external multimedia data.
  • Each front-facing camera and rear-facing camera can be a fixed optical lens system or have a focal length and optical zoom capabilities.
  • Audio component 1405 is configured to output and/or input audio signals.
  • the audio component 1405 includes a microphone (MIC) configured to receive external audio signals when the terminal device 1400 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode.
  • the received audio signals may be further stored in memory 1402 or sent via communications component 1408 .
  • audio component 1405 also includes a speaker for outputting audio signals.
  • the I/O interface 1406 provides an interface between the processing component 1401 and a peripheral interface module.
  • the peripheral interface module may be a keyboard, a click wheel, a button, etc. These buttons may include, but are not limited to: Home button, Volume buttons, Start button, and Lock button.
  • Sensor component 1407 includes one or more sensors for providing various aspects of status assessment for terminal device 1400 .
  • the sensor component 1407 can detect the open/closed state of the terminal device 1400 and the relative positioning of components, such as the display and keypad of the terminal device 1400.
  • the sensor component 1407 can also detect the position of the terminal device 1400 or a component of the terminal device 1400. Position changes, presence or absence of user contact with the terminal device 1400 , orientation or acceleration/deceleration of the terminal device 1400 and temperature changes of the terminal device 1400 .
  • Sensor component 1407 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • Sensor assembly 1407 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor component 1407 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
  • the communication component 1408 is configured to facilitate wired or wireless communication between the terminal device 1400 and other devices.
  • the terminal device 1400 can access a wireless network based on a communication standard, such as Wi-Fi, 2G or 3G, or a combination thereof.
  • the communication component 1408 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • communications component 1408 also includes a near field communications (NFC) module to facilitate short-range communications.
  • NFC near field communications
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • the terminal device 1400 may be configured by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation is used to perform the above method.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A programmable gate array
  • controller microcontroller, microprocessor or other electronic component implementation is used to perform the above method.
  • embodiments of the present disclosure provide a network device, such as a 5G DDNMF entity, a PKMF entity, etc., which is consistent with the network device in one or more of the above embodiments.
  • Figure 15 is a schematic structural diagram of a network device in an embodiment of the present disclosure.
  • the network device 1500 may include a processing component 1501, which further includes one or more processors, and a memory represented by a memory 1502.
  • An application stored in memory 1502 may include one or more modules, each of which corresponds to a set of instructions.
  • the processing component 1501 is configured to execute instructions to perform any of the foregoing methods applied to the network device.
  • Network device 1500 may also include a power supply component 1503 configured to perform power management of network device 1500, a wired or wireless network interface 1504 configured to connect network device 1500 to a network, and an input-output (I/O) interface 1505 .
  • Network device 1500 may operate based on an operating system stored in memory 1502, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, or the like.
  • embodiments of the present disclosure also provide a computer-readable storage medium. Instructions are stored in the computer-readable storage medium; when the instructions are run on the computer, they are used to execute the terminal in one or more of the above embodiments. Relay communication method on the device side or network device side.
  • embodiments of the present disclosure also provide a computer program or computer program product.
  • the computer program product When the computer program product is executed on a computer, the computer implements the terminal device side or the network device side in one or more of the above embodiments. relay communication method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开实施例提供了一种中继通信方法、通信装置及通信设备。该通信方法可以应用5G终端到网络中继(UE-to-UE Relay)技术中。该方法可以包括：中继终端接收来自第一远程终端发送的第一直连通信请求消息；中继终端根据第一长期凭证，与第一远程终端建立安全的第一直连通信链路，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；其中，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。在本公开中，中继UE通过分别与对等UEs建立安全的直连通信链路，在UE1和UE2之间建立安全的层3(L3)U2U链路，以实现5G ProSe U2U Relay。

Description

一种中继通信方法、通信装置及通信设备 技术领域
本公开涉及无线通信技术领域，尤其涉及一种中继通信方法、通信装置及通信设备。
背景技术
在第五代移动网络(5th generation mobile networks，5G)技术中，近邻服务(proximity based services，ProSe)使对等终端能够通过终端到终端中继相互通信。这种技术可以称为终端到终端中继(5G ProSe UE-to-UE Relay)。这意味着，如果源终端不能直接到达目标终端，源终端将尝试发现一个中继终端以到达目标终端，这也可能触发中继发现目标终端。事实上，作为不受信任节点的中继终端可能会受到损害，从而使对等终端之间的信息的安全性(即完整性和机密性)受到损害。
那么，如何提供终端到终端的安全中继通信是一个亟待解决的技术问题。
发明内容
本公开提供了一种中继通信方法、通信装置及通信设备，以提供终端到终端的安全中继通信。
根据本公开的第一方面提供一种中继通信方法，该方法可以应用于通信系统中的中继终端。该方法可以包括：中继终端接收来自第一远程终端发送的第一直连通信请求消息；中继终端根据第一长期凭证，与第一远程终端建立安全的第一直连通信链路，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；其中，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，方法还包括：中继终端向网络设备发送第一请求消息，第一请求消息携带有第一长期凭证标识；中继终端接收来自网络设备的第一响应消息，第一响应消息携带有第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中携带有用于第一共享密钥标识；方法还包括：中继终端根据第一共享密钥标识，确定第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信。
在一些可能的实施方式中，方法包括：中继终端确定第一共享密钥有效。
在一些可能的实施方式中，方法还包括：中继终端向第二远程终端发送第二直连通信请求消息；中 继终端根据第一长期凭证，与第二远程终端建立安全的第二直连通信链路；其中，第二直连通信链路用于传输传输信息。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，方法还包括：中继终端确定存在第二共享密钥，第二共享密钥用于中继终端与第二远程终端之间的安全通信；中继终端将第二共享密钥标识承载于第二直连通信请求消息进行发送，第二共享密钥标识用于标识第二共享密钥。
在一些可能的实施方式中，中继终端确定存在第二共享密钥，包括：中继终端确定存在有效的第二共享密钥。
在一些可能的实施方式中，方法还包括：中继终端接收第二远程终端的第二直连通信接受消息；中继终端向第一远程终端发送第一直连通信接受消息。
在一些可能的实施方式中，中继终端的标识为以下之一：中继终端的近邻服务应用标识；中继终端的终端标识。
根据本公开的第二方面提供一种中继通信方法，该方法可以应用于该方法可以应用于通信系统中的第一远程终端。该方法包括：第一远程终端向中继终端发送第一直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；第一远程终端与中继终端建立安全的第一直连通信链路，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，方法还包括：第一远程终端发现第二远程终端，并选择中继终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，方法还包括：第一远端终端确定存在第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信；中继终端将第一共享密钥标识承载于第一直连通信请求消息进行发送，第一共享密钥标识用于标识第一共享密钥。
在一些可能的实施方式中，第一远端终端确定存在第一共享密钥，包括：中继终端确定存在有效的第一共享密钥。
在一些可能的实施方式中，方法还包括：第一远程终端接收中继终端发送的第一直连通信接受消 息。
根据本公开的第三方面提供一种中继通信方法，该方法可以应用于该方法可以应用于通信系统中的网络设备。该方法包括：第二远程终端接收中继终端发送第二直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；第二远程终端与中继终端建立安全的第二直连通信链路，第二直连通信链路用于传输第二远程终端与第一远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，方法还包括：第二远程终端发现第一远程终端，并选择中继终端。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，第二直连通信请求消息中携带有用于第二共享密钥标识；方法还包括：第二远程终端根据第二共享密钥标识，确定第二共享密钥，第二共享密钥用于第二远程终端与中继终端之间的安全通信。
在一些可能的实施方式中，方法还包括：第二远程终端确定第二共享密钥有效。
在一些可能的实施方式中，方法还包括：第二远程终端向中继终端发送第二直连通信接受消息。
根据本公开的第四方面提供一种中继通信方法，该方法可以应用于该方法可以应用于通信系统中的网络设备。该方法包括：网络设备接收第一请求消息，第一请求消息用于请求第一长期凭证；网络设备对中继终端进行鉴权；在鉴权通过的情况下，网络设备向中继终端发送第一长期凭证；其中，第一长期凭证用于中继终端与对等的第一远程终端和第二远程终端建立安全的直连通信链路，直连通信链路用于中继第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，方法还包括：网络设备为第一远程终端和第二远程终端设置第一长期凭证；网络设备分别向第一远程终端和第二远程终端发送第一长期凭证标识以及第一长期凭证，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，网络设备对中继终端进行鉴权，包括：网络设备确定中继终端是否被授权提供基于近邻服务订阅数据的中继服务。
在一些可能的实施方式中，网络设备确定中继终端是否被授权提供基于近邻服务订阅数据的中继服务，包括：网络设备向中继终端的统一数据管理功能(unified data management，UDM)实体请求中继终端的签约信息，签约信息用于表示中继终端是否被授权提供中继服务；网络设备接收UDM实体发送的签约信息；网络设备根据签约信息，确定中继终端是否被授权提供中继服务。
在一些可能的实施方式中，网络设备确定中继终端是否被授权提供基于近邻服务订阅数据的中继服务，包括：网络设备确定本地是否存储有中继终端的授权信息，授权信息用于表示中继终端被授权提 供中继服务。
在一些可能的实施方式中，方法还包括：网络设备由近邻服务应用服务器获得第一长期凭证，或网络设备获得本地存储第一长期凭证。
根据本公开的第五方面提供一种通信装置，该通信装置可以为通信系统中的中继终端或者中继终端的芯片或者片上系统，还可以为中继终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中中继终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。该装置可以包括：接收模块，被配置为接收来自第一远程终端发送的第一直连通信请求消息；处理模块，被配置为根据第一长期凭证，与第一远程终端建立安全的第一直连通信链路，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；其中，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，装置还包括：发送模块，被配置为向网络设备发送第一请求消息，第一请求消息携带有第一长期凭证标识；接收模块，被配置为接收来自网络设备的第一响应消息，第一响应消息携带有第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中携带有用于第一共享密钥标识；处理模块，被配置为根据第一共享密钥标识，确定第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信。
在一些可能的实施方式中，处理模块，被配置为确定第一共享密钥有效。
在一些可能的实施方式中，装置还包括：发送模块，被配置为向第二远程终端发送第二直连通信请求消息；处理模块，被配置为根据第一长期凭证，与第二远程终端建立安全的第二直连通信链路；其中，第二直连通信链路用于传输传输信息。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，处理模块，被配置为确定存在第二共享密钥，第二共享密钥用于中继终端与第二远程终端之间的安全通信；发送模块，被配置为将第二共享密钥标识承载于第二直连通信请求消息进行发送，第二共享密钥标识用于标识第二共享密钥。
在一些可能的实施方式中，处理模块，被配置为确定存在有效的第二共享密钥。
在一些可能的实施方式中，装置还包括：发送模块；接收模块，被配置为接收第二远程终端的第二直连通信接受消息；发送模块，被配置为向第一远程终端发送第一直连通信接受消息。
在一些可能的实施方式中，中继终端的标识为以下之一：中继终端的近邻服务应用标识；中继终端的终端标识。
根据本公开的第六方面提供一种通信装置，该通信装置可以为通信系统中的第一远程终端或者第一远程终端的芯片或者片上系统，还可以为第一远程终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中第一远程终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。该装置可以包括：发送模块，被配置为向中继终端发送第一直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；处理模块，被配置为与中继终端建立安全的第一直连通信链路，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，处理模块，还被配置为发现第二远程终端，并选择中继终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，装置还包括：处理模块，被配置为确定存在第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信；发送模块，被配置为将第一共享密钥标识承载于第一直连通信请求消息进行发送，第一共享密钥标识用于标识第一共享密钥。
在一些可能的实施方式中，处理模块，被配置为确定存在有效的第一共享密钥。
在一些可能的实施方式中，装置还包括：接收模块，被配置为接收中继终端发送的第一直连通信接受消息。
根据本公开的第七方面提供一种通信装置，该通信装置可以为通信系统中的第二远程终端或者第二远程终端的芯片或者片上系统，还可以为第二远程终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中第二远程终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。该装置可以包括：接收模块，被配置为接收中继终端发送第二直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；处理模块，被配置为与中继终端建立安全的第二直连通信链路，第二直连通信链路用于传输第二远程终端与第一远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，处理模块，还被配置为发现第一远程终端，并选择中继终端。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用 于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，第二直连通信请求消息中携带有用于第二共享密钥标识；处理模块，还被配置为根据第二共享密钥标识，确定第二共享密钥，第二共享密钥用于第二远程终端与中继终端之间的安全通信。
在一些可能的实施方式中，处理模块，还被配置为确定第二共享密钥有效。
在一些可能的实施方式中，装置还包括：发送模块，被配置为向中继终端发送第二直连通信接受消息。
根据本公开的第八方面提供一种通信装置，该通信装置可以为通信系统中的网络设备或者网络设备的芯片或者片上系统，还可以为网络设备中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中网络设备所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。该装置可以包括：接收模块，被配置为接收第一请求消息，第一请求消息用于请求第一长期凭证；处理模块，被配置为网络设备对中继终端进行鉴权；发送模块，被配置为在鉴权通过的情况下，网络设备向中继终端发送第一长期凭证；其中，第一长期凭证用于中继终端与对等的第一远程终端和第二远程终端建立安全的直连通信链路，直连通信链路用于中继第一远程终端与第二远程终端之间的传输信息；
在一些可能的实施方式中，处理模块，被配置为为第一远程终端和第二远程终端设置第一长期凭证；发送模块，被配置为分别向第一远程终端和第二远程终端发送第一长期凭证标识以及第一长期凭证，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，处理模块，被配置为确定中继终端是否被授权提供基于近邻服务订阅数据的中继服务。
在一些可能的实施方式中，发送模块，被配置为向中继终端的UDM实体请求中继终端的签约信息，签约信息用于表示中继终端是否被授权提供中继服务；接收模块，被配置为接收UDM实体发送的签约信息；处理模块，被配置为根据签约信息，确定中继终端是否被授权提供中继服务。
在一些可能的实施方式中，处理模块，被配置为确定本地是否存储有中继终端的授权信息，授权信息用于表示中继终端被授权提供中继服务。
在一些可能的实施方式中，处理模块，被配置为由近邻服务应用服务器获得第一长期凭证，或获得本地存储第一长期凭证。
根据本公开的第九方面提供一种通信设备，如中继终端，包括：存储器和处理器；处理器与存储器连接，被配置为通执行存储在存储器上的计算机可执行指令，以实现如上述第一方面及其任一可能的实施方式所述的中继通信方法。
根据本公开的第十方面提供一种通信设备，如第一远程终端，包括：存储器和处理器；处理器与 存储器连接，被配置为通执行存储在存储器上的计算机可执行指令，以实现如上述第二方面及其任一可能的实施方式所述的中继通信方法。
根据本公开的第十一方面提供一种通信设备，如第二远程终端，包括：存储器和处理器；处理器与存储器连接，被配置为通执行存储在存储器上的计算机可执行指令，以实现如上述第三方面及其任一可能的实施方式所述的中继通信方法。
根据本公开的第十二方面提供一种通信设备，如网络设备，包括：存储器和处理器；处理器与存储器连接，被配置为通执行存储在存储器上的计算机可执行指令，以实现如上述第四方面及其任一可能的实施方式所述的中继通信方法。
根据本公开的第十三方面提供一种计算机可读存储介质，计算机可读存储介质中存储有指令；当指令在计算机上运行时，用于执行如上述第一至四方面及其任一可能的实施方式所述的中继通信方法。
根据本公开的第十四方面提供一种计算机程序或计算机程序产品，当计算机程序产品在计算机上被执行时，使得计算机实现如上述第一至四方面及其任一可能的实施方式所述的中继通信方法。
在本公开中，中继UE通过分别与对等UEs建立安全的直连通信链路，在UE1和UE2之间建立安全的层3(L3)U2U链路，以实现5G ProSe U2U Relay。
应当理解的是，本公开的第五至十四方面与本公开的第一至四方面的技术方案一致，各方面及对应的可行实施方式所取得的有益效果相似，不再赘述。
附图说明
图1为本公开实施例中的一种通信系统的示意图；
图2为本公开实施例中的直连单播链路的密钥层次结构示意图；
图3为本公开实施例中的第一种中继通信方法的实施流程示意图；
图4为本公开实施例中的一种中继UE与UE1建立安全的直连通信链路的实施流程示意图；
图5为本公开实施例中的一种中继UE与UE2建立安全的直连通信链路的实施流程示意图；
图6为本公开实施例中的一种中继UE向网络设备请求长期凭证的实施流程示意图；
图7为本公开实施例中的第二种中继通信方法的实施流程示意图；
图8为本公开实施例中的中继UE侧的中继通信方法的实施流程示意图；
图9为本公开实施例中的UE1侧的中继通信方法的实施流程示意图；
图10为本公开实施例中的UE2侧的中继通信方法的实施流程示意图；
图11为本公开实施例中的网络设备侧的中继通信方法的实施流程示意图；
图12为本公开实施例中的一种通信装置的结构示意图；
图13为本公开实施例中的一种通信设备的结构示意图；
图14为本公开实施例中的一种终端设备的结构示意图；
图15为本公开实施例中的一种网络设备的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例和所附权利要求书中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系。例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本公开的描述中，“多个”是指两个或多于两个。
应当理解，尽管在本公开实施例可能采用术语“第一”、“第二”、“第三”等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，“第一信息”也可以被称为“第二信息”，类似地，“第二信息”也可以被称为“第一信息”。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
5G(第五代移动通信技术)网络中定义了5G ProSe终端到终端中继(5G ProSe UE-to-UE Relay，简称为5G ProSe U2U Relay)技术，中继终端提供中继功能以支持5G ProSe远程终端之间的连接。
在本公开实施例中，远程终端为对等终端，网络为对等终端配置相同的长期凭证以及长期凭证标识。
本公开实施例提供一种通信系统。该通信系统可以为基于蜂窝移动通信技术的通信系统，如5G(第五代移动通信技术)系统。图1为本公开实施例中的一种通信系统的示意图，参见图1，该通信系统100可以包括：第一远程(remote)终端101、终端到终端中继(UE-to-UE Relay，简称为U2U Relay)102、第二远程(remote)终端103。这里，终端到终端中继(UE-to-UE Relay)102可以采用中继(relay)终端实现的。可选的，第一远程终端101、UE-to-UE Relay 102以及第二远程终端103之间存在PC5接口。
其中，上述远程UE和中继UE可以为一种具有无线通信功能的终端，可以部署在陆地上，包括室内或室外、手持、可穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。上述终端可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端装置、增强现实(augmented reality，AR)终端装置、工业控制(industrial control)中的无线终端、无人驾驶(self-driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。终端也可以是具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备等。在不同的网络中终端装置可以叫做不同的名称，例如：终端装置、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置、蜂窝电话、无绳电话、会话启动协议(sessioninitiation protocol，SIP)电话、无线本地环路(wireless local loop， WLL)站、个人数字处理(personal digital assistant，PDA)、5G网络或未来演进网络中的终端等。在本公开实施例中，终端可以称为用户设备(user equipment，UE)。
进一步地，上述通信系统还可以包括网络设备104，网络设备104可以为远程UE以及中继UE进行安全性配置，如配置密钥等。这里，网络设备104可以为包括以下之一：策略控制功能(policy control function，PCF)实体、5G直连发现名称管理功能(direct discovery name management function，DDNMF)实体、5G近邻服务密钥管理功能(ProSe key management function，PKMF)实体、ProSe应用服务器(Prose Application Server)。可以理解的，上述网络设备104可以设置于5G核心网(5GC)中。当然，网络设备104还可以包括上述功能实体的各种演进版本，以及能够实现上述功能的其他功能实体，本公开实施例对此不做具体限定。
需要说明的是，上述各通信设备的功能以及接口仅为示例性的，各个网络设备在应用于本公开实施例中时，并非全部功能都是必需的。核心网的全部或者部分设备可以是物理上的设备，也可以是虚拟化的设备，在此不做限定。当然，本公开实施例中的通信系统还可以包括未在图1中示出的其他设备，在此不做限定。
目前，在上述通信系统中，ProSe使对等终端(即peer UEs)能够通过5G ProSe UE-to-UE Relay相互通信。这意味着，如果源终端(即source UE)不能直接到达目标终端(即target UE)，source UE将尝试发现一个中继终端(relay UE)以到达target UE，这也触发relay UE发现target UE。但是，作为不受信任节点的relay UE可能会受到损害，从而使peer UEs之间的信息的安全性(即完整性和机密性)受到损害。那么，如何提供安全的5G ProSe UE-to-UE Relay是一个亟待解决的技术问题。
为了解决上述问题，本公开实施例提供一种中继通信方法，该通信方法可以应用于上述通信系统。
在本公开实施例中，第一远程终端和第二远程终端为peer UEs，可以记为UE1和UE2。其中，UE1为source UE，UE2为target UE。网络设备可以为中继UE、UE1或UE2的PKMF实体、5G DDNMF实体等。其中，5G DDNMF实体可以包括中继UE的DDNMF实体、UE1的DDNMF实体或者UE2的DDNMF实体。
在一些可能的实施方式中，网络设备(如5G DDNMF实体或PKMF实体)可以预先为对等的UE1和UE2配置相同的长期凭证(long term credential)以及用于表示长期凭证的长期凭证标识(long term credential ID)。长期凭证为UE1和UE2的根密钥，用于生成安全通信机制中的后续密钥。例如，UE1的DDNMF实体为UE1配置长期凭证标识a以及对应的长期凭证A，同样的，UE2的DDNMF实体为UE2配置长期凭证标识a以及对应的长期凭证A。这里，“长期凭证”也可以描述为“长期证书”、“长期密钥”等。
在另一些可能的实施方式中，UE1和UE2可以在出厂时预置相同的上述长期凭证以及上述长期凭证标识。
图2为本公开实施例中的直连单播链路的密钥层次结构示意图，参见图2，不同的密钥层次如下：
长期凭证，是提供给UE并构成直连单播链路安全通信机制的根凭证。该长期凭证可以包括对称密钥或公钥/私钥对。认证信令(authentication signalling)在UEs之间交换以导出K NRP。
K NRP，是一个256位(bits)的根密钥(也可以称为共享密钥、直接密钥等)，在使用直连单播链路 进行通信的两个实体(如对等UEs)之间共享。K NRP可以通过使用长期凭证重新运行认证信令来进行更新。随机数在UE之间交换并与K NRP一起使用以生成K NRP-sess(即下一层密钥)。即使在UE之间不存在活动的单播通信会话时，也可以保留K NRP。K NRP具有32位(bits)的标识(K NRP ID)，即K NRP ID用于标识K NRP。
K NRP-sess，是由UE从K NRP派生的256位密钥，也可以称为会话密钥，用于保护UE之间的数据传输。K NRP-sess是按单播链路派生的。在UE之间存在激活的单播通信会话期间，可以通过运行密钥更新过程来更新K NRP-sess。机密性和完整性算法中使用的实际密钥直接来自K NRP-sess。K NRP-sess具有16位(bits)的标识(K NRP-sess ID)，即K NRP-sess ID用于标识K NRP-sess。
NRPEK和NRPIK，是直连单播通信的加密性密钥(NRPEK)和直连单播通信的完整性密钥(NRPIK)，分别用于选择的机密性和完整性算法中，用于保护PC5-S信令、PC5无线资源控制(radio resource control，RRC)信令、PC5用户平面数据等。NRPEK和NRPIK派生自K NRP-sess，每次更改K NRP-sess时NRPEK和NRPIK都会自动刷新。
下面结合上述通信系统对本公开实施例提供的中继通信方法进行说明。
需要说明的是，UE1和UE2与中继UE首先使用发现参数和发现安全材料执行发现(discovery)和中继选择(relay selection)过程，然后，再执行建立直连通信链路的过程。假设，UE1和UE2在发现和中继选择过程后，已发现对方并选择了同一个U2U Relay，即UE1和UE2选择同一中继UE。然后，UE1和UE2之间建立U2U Relay链路。
图3为本公开实施例中的第一种中继通信方法的实施流程示意图，参见图3中实线，该通信方法可以包括：
S301，UE 1向中继UE发送第一直连通信请求消息(如Direct Connection Request 1)。
其中，第一直连通信请求消息中可以携带有第一长期凭证标识(如长期凭证标识a)，长期凭证标识a用于标识长期凭证A，长期凭证A能够为中继UE、UE1以及UE2提供用于安全通信共享密钥，如K NRP。
应理解的，UE1在需要向UE2发送传输信息时，UE1可以向中继UE发送第一直连通信请求消息，以请求与中继UE请求直连通信链路，进而触发与UE2进行直连通信。
在一些可能的实施方式中，第一直连通信请求消息中还可以包括以下至少之一：UE1的安全能力信息(security capabilities)、中继服务代码(relay service code，RSC)、近邻服务代码(ProSe code)以及随机数1(即第一随机数，可以记为nonce 1)。其中，UE1的安全能力信息用于指示UE1支持的安全算法。中继UE能够根据UE1的安全能力信息和自身的安全策略，确定选择的安全算法，以供后续对中继UE与UE1之间的信令进行完整性和/或机密性的验证。
S302，中继UE根据长期凭证A，与UE1建立安全的直连通信链路。
应理解的，中继UE通过S301接受到长期凭证标识a后，可以获得长期凭证A。然后，中继UE根据长期凭证A分别与UE1建立安全的直连通信链路(即第一直连通信链路，也可以记为直连通信链路A)，以及根据长期凭证A与UE2建立安全直连通信链路(即第二直连通信链路，也可以记为直连通信链路B)。
在一实施例中，参见图3中虚线，在S302之后，上述方法还包括S303至S304。
S303，中继UE向UE2发送第二直连通信请求消息(如Direct Connection Request 2)。
应理解的，与第一直连通信请求消息类似，第二直连通信请求消息可以携带有长期凭证标识a。
在一实施例中，第二直连通信请求消息中还可以包括以下至少之一：中继UE的安全能力信息、RSC、ProSe Code、随机数3(即第二随机数，可以记为nonce 3)。其中，中继UE的安全能力信息用于指示中继UE支持的安全算法。UE2能够根据中继UE的安全能力信息和自身的安全策略，确定选择的安全算法，以供后续对中继UE与UE2之间的信令进行完整性和/或机密性的验证。
S304，UE2根据长期凭证A，与中继UE建立安全的直连通信链路。
应理解的，中继UE在与UE1建立直连通信链路A之后，向UE2发送第二直连通信请求消息，以触发中继UE与UE2建立直连通信链路B的过程。UE2根据长期凭证标识a，获得长期凭证A，进而与中继UE建立安全的直连通信链路B。
在一些可能的实施方式中，上述长期凭证A可以是由网络设备(如中继UE的DDNMF或PKMF)对中继UE鉴权通过时向中继UE发送的。示例性的，中继UE在S301之前建立过同业务类型的直连通信链路，该直连通信链路使用与S301中相同的长期凭证A，那么，在上次建立直连通信链路的过程中，中继UE可以获得网络设备在对中继UE鉴权通过后发送的长期凭证A，并保存。那么，在S301之后，中继UE可以根据长期凭证A分别与UE1和UE2建立安全的直连通信链路。或者，中继UE在S301之后，向网络设备请求长期凭证A，并获得网络设备在对中继UE鉴权通过后发送的长期凭证A。接下来，中继UE可以根据长期凭证A分别与UE1和UE2建立安全的直连通信链路。
在上述S302和S304中，中继UE、UE1以及UE2采用长期凭证A派生(derive)用于安全通信的共享密钥K(即第一共享密钥)和K'(即第二共享密钥)。其中，共享密钥K用于UE1与中继UE之间的安全通信，共享密钥K'用于UE2与中继UE之间的安全通信。示例性的，共享密钥K可以为K NRP，共享密钥K'可以为K' NRP。在一实施例中，中继UE和UE1可以根据K NRP进一步地派生K NRP- sess、NRPEK和NRPIK。中继UE和UE2可以根据K' NRP进一步地派生K' NRP-sess、NRPEK'和NRPIK'。
需要说明的是，由于UE1和UE2的安全能力不同、支持的安全策略不同等因素，共享密钥K与共享密钥K'可以相同，也可以不同。
在一些可能的实施方式中，图4为本公开实施例中的一种中继UE与UE1建立安全的直连通信链路的实施流程示意图，参见图4，上述S302可以包括S401至S403。
S401，中继UE向UE1发送第一直连安全模式命令消息(如Direct Security Mode Command message 1)。
其中，第一直连安全模式命令消息携带有选择的安全算法(Chosen_algs)以及随机数2(可以记为nonce 2)。这里，Chosen_algs是中继UE根据UE1的安全能力以及中继UE的直连通信链路安全策略确定的。
这里，直连通信链路安全策略可以为以下之一：直连通信链路的控制面机密性安全策略、直连通信链路的控制面完整性安全策略、直连通信链路的用户面机密性安全策略或者直连通信链路的用户面 完整性安全策略。
在一实施例中，上述安全策略可以分为开启(required)、不开启(not needed)和可选(preferred)三种。“required”为需要开启安全，“not needed”为不需要开启安全，“preferred”偏好开启或者称为可选开启，即可以开启安全但也可以不开启安全，在此统一说明，以下不再赘述。
示例性的，以直连通信链路的控制面机密性安全策略为例，直连通信链路的控制面机密性安全策略包括：直连通信链路的控制面机密性保护开启(required)、直连通信链路的控制面机密性保护不开启(not needed)、或者直连通信链路的控制面机密性保护可选(preferred)。直连通信链路的控制面完整性安全策略、直连通信链路的用户面机密性安全策略以及直连通信链路的用户面完整性安全策略的示例可参考直连通信链路的控制面机密性保护策略的示例，在此不再赘述。
S402，UE1基于选择的安全策略，对第一直连安全模式命令消息进行完整性验证。
应理解的，UE1响应第一直连安全模式命令消息，根据选择的安全算法(Chosen_algs)以及随机数2，对第一直连安全模式命令消息进行进行完整性验证，并在验证通过的情况下，执行S403。
S403，UE1向中继UE发送第一直连安全模式完成消息(如Direct Security Mode Complete message 1)。
需要说明的是，在上述S403之后，中继UE并不向UE1发送第一直连通信请求消息的响应消息，如第一直连通信接受消息，而是直接发起与UE2建立直连通信链路B的过程。
在一些可能的实施方式中，与上述S401至S403类似，图5为本公开实施例中的一种中继UE与UE2建立安全的直连通信链路的实施流程示意图，参见图5，上述S304可以包括S501至S503。
S501，UE2向中继UE发送第二直连安全模式命令消息(如Direct Security Mode Command message 2)。
其中，第二直连安全模式命令消息携带有选择的安全算法(Chosen_algs')以及随机数4(可以记为nonce 4)。这里，Chosen_algs'是UE2根据中继UE的安全能力以及UE2的直连通信链路安全策略确定的。
S502，中继UE基于选择的安全策略，对第二直连安全模式命令消息进行完整性验证。
应理解的，UE2响应第二直连安全模式命令消息，根据选择的安全算法(Chosen_algs')以及随机数4，对第二直连安全模式命令消息进行进行完整性验证，并在验证通过的情况下，执行S503。
S503，中继UE向UE2发送第二直连安全模式完成消息(如Direct Security Mode Complete message 2)。
需要说明的是，上述S302和S304中建立直连通信链路A和B的过程，可以参见3GPP TS 33.536中记载的内容，在此不做赘述。
在一些可能的实施例中，在S503之后，UE2可以向中继UE发送第一直连通信接受消息(如Direct Communication Accept message 1)，以向中继UE指示直连通信链路B建立完成，然后，中继UE响应于第一直连通信接受消息，向UE1发送第二直连通信接受消息(如Direct Communication Accept message 2)，以向中继UE指示直连通信链路A建立完成。
通过上述步骤，UE1与UE2之间直连通信链路建立完成，UE1与UE2可以进行5G ProSe U2U  Relay通信。
在一可能的实施例中，仍参见图3中虚线，在S304之后，中继UE还可以执行S305。
S305，中继UE通过直连通信链路A和直连通信链路B中继UE1和UE2之间的传输信息。
应理解的，中继UE在通过S302和S304建立直连通信链路A和直连通信链路B之后，可以为UE1和UE2提供U2U Relay服务，以中继UE1与UE2之间的传输信息(也可以称为traffic，或者描述为传输流量)。示例性的，UE1可以将发送给UE2的传输信息先发送给中继UE，由中继UE中继给UE2；类似的，UE2也可以将发送给UE1的传输信息先发送给中继UE，由中继UE中继给UE1。
至此，实现了UE1与UE2可以进行5G ProSe U2U Relay通信。
在一些可能的实施例中，如果UE1具有与中继UE尝试通信的共享密钥K(即现有K NRP)，第一直连通信请求消息中还可以携带有共享密钥标识k(即第一共享密钥标识)。如此，中继UE可以直接根据共享密钥标识k确定对应的共享密钥K，进而生成K NRP-sess，而无需由长期凭证A生成K NRP。
可选的，UE1在S301中发送第一直连通信请求消息之前，可以先确认自身存在中继UE的共享密钥K。然后，UE1将共享密钥标识k携带于第一直连通信请求消息发送给中继UE，使得中继UE能够根据共享密钥标识k，确定共享密钥K。
相应的，如果中继UE具有与UE2尝试通信的现有共享密钥K'(即现有K' NRP)，第二直连通信请求消息中还可以携带有共享密钥标识k'(即第二共享密钥标识)。如此，UE2可以直接根据共享密钥标识k'确定对应的共享密钥K'，进而生成K' NRP-sess，而无需由长期凭证A生成K' NRP。
可选的，中继UE在S303中发送第二直连通信请求消息之前，可以先确认自身存在UE2的共享密钥K'。然后，中继UE将共享密钥标识k'携带于第二直连通信请求消息发送给UE2，使得UE2能够根据共享密钥标识k'，确定共享密钥K'。
需要说明的是，共享密钥标识的发送方需要先确认共享密钥是有效的，再向接收方发送。或者共享密钥的接收方在收到共享密钥后，需要确认共享密钥是否有效，仅在有效时，使用该共享密钥。这里，共享密钥有效也可以描述为共享密钥处于有效期且被安全策略允许使用。
在一些可能的实施方式中，响应于上述长期凭证A可以是由网络设备对中继UE鉴权通过时向中继UE发送的，那么，在S301之后，上述方法还可以包括中继UE向网络设备请求长期凭证A的过程。当中继UE请求到长期凭证A后，可以执行S302至S305。
图6为本公开实施例中的一种中继UE向网络设备请求长期凭证的实施流程示意图，参见图6，在S301之后和S302之前，上述方法还可以包括：S601至S603。
S601，中继UE向网络设备(如中继UE的5G DDNMF实体)发送第一请求消息(如ProSe key request)。
其中，第一请求消息用于向网络设备请求长期凭证A。
在实际应用中，第一请求消息也可以描述为密钥请求消息(key request)、长期密钥请求消息(long term key request)、长期凭证请求消息(long term confidential request)等。
在一些可能的实施方式中，第一请求消息中可以携带有以下至少之一：中继UE标识(如Relay UE ID)、长期凭证标识a、RSC或ProSe code。
示例性的，中继UE标识可以设置为U2U Relay ProSe应用标识(application ID)、中继UE的用户隐藏标识符(subscription concealed identifier，SUCI)等。
S602，网络设备对中继UE进行鉴权。
应理解的，网络设备在收到中继UE的请求之后，根据中继UE标识、长期凭证标识a、RSC或ProSe code，确定中继UE是否被授权提供该业务类型下的Prose中继服务。这里，“中继UE被授权提供该业务类型下的Prose中继服务”也可以描述为“中继UE被授权提供基于ProSe订阅数据的该业务类型下的Prose中继服务”。
在一些可能的实施方式中，网络设备可以根据中继UE标识、长期凭证标识a、RSC或ProSecode，可以先查找本地是否保存有中继UE的授权信息，以确定中继UE是否被授权提供该业务类型下的Prose中继服务。若有，则表示中继UE被授权提供该业务类型下的Prose中继服务；若没有，则表示中继UE未被授权提供该业务类型下的Prose中继服务。
在一些可能的实施方式中，网络设备可以向中继UE的统一数据管理功能(unified data management，UDM)实体请求中继UE的签约信息。如果UDM中保存有中继UE的签约信息，则UDM向网络设备反馈中继UE的签约信息。如果UDM实体向网络设备反馈的中继UE签约信息中有该业务类型下的Prose授权信息，则表示中继UE被授权提供该业务类型下的Prose中继服务，反之，则表示中继UE不被授权提供该业务类型下的Prose中继服务。
在一些可能的实施方式中，网络设备还可以先查看本地是否存在中继UE的授权信息。如果网络设备本地没有保存中继UE的授权信息，网络设备再向中继UE的UDM实体请求中继UE的签约信息。
当然，网络设备还可以通过其他方式对中继UE进行鉴权，本公开实施例对此不作具体限定。
S603，网络设备向中继UE发送第一响应消息(如ProSe key response)。
其中，第一响应消息中可以携带有长期凭证A和长期凭证标识a。
在实际应用中，第一请求消息也可以描述为密钥响应消息(key response)、长期密钥响应消息(long term key response)、长期凭证请求消息(long term confidential response)等。
在一些可能的实施方式中，在上述S601至S603中，如果网络设备本地存储有长期凭证A，网络设备可以从本地获取长期凭证A，并提供给中继UE。或者，如果长期凭证A存储在近邻服务应用(ProSe Application)服务器(sever)中，网络设备可以从ProSe Application server获取长期凭证A，再提供给中继UE。当然，网络设备还可以通过其他方式获得长期凭证A，本公开实施例对此不足具体限定。
至此，实现5G UE-to-UE Relay。
下面以具体示例对上述中继通信方法进行说明。
假设，通信系统中存在中继UE、UE1、UE2以及5G DDNMF实体。5G DDNMF实体可以包括中继UE的DDNMF实体、UE1的DDNMF实体和UE2的DDNMF实体。
图7为本公开实施例中的第二种中继通信方法的实施流程示意图，参见图7所示，该中继通信过程可以包括：
S701，5G DDNMF实体分别向UE1和UE2提供发现和中继安全材料，如长期凭证标识a和长期凭证A。
S702，UE1和UE2使用发现参数和发现安全材料执行发现和中继选择过程，UE1和UE2选择同一中继UE。
S703，UE1向中继UE发送Direct Connection Request 1。
其中，Direct Connection Request 1可以包括长期凭证标识a和共享密钥标识k。进一步地，Direct Connection Request 1还可以包括：UE1的安全能力信息、RSC、ProSe code、nonce 1。
S704，中继UE向5G DDNMF实体发送ProSe key request。
其中，ProSe key request中包括：中继UE标识、长期凭证标识a、RSC或ProSe code。
S705，5G DDNMF实体确定中继UE被授权提供该业务类型下的Prose中继服务。
S706，5G DDNMF实体向中继UE发送ProSe key response。
其中，ProSe key response携带有长期凭证标识a和长期凭证A。
S707，中继UE向UE1发送Direct Security Mode Command message 1。
其中，Direct Security Mode Command message 1携带有Chosen_algs和nonce 2。
S708，UE1向中继UE发送Direct Security Mode Complete message 1。
S709，中继UE向UE2发送Direct Connection Request 2。
其中，Direct Connection Request 2可以包括长期凭证标识a和共享密钥标识k'。进一步地，Direct Connection Request 2还可以包括：中继UE的安全能力信息、RSC、ProSe code、nonce 4。
S710，UE2向中继UE发送Direct Security Mode Command message 2。
其中，Direct Security Mode Command message 2携带有Chosen_algs'和nonce 2。
S711，中继UE向UE2发送Direct Security Mode Complete message 2。
S712，UE2向中继UE发送Direct Connection Request 2。
S713，中继UE向UE1发送Direct Connection Request 1。
S714，中继UE中继UE1和UE2之间的传输信息(traffic)。
在本公开实施例中，中继UE通过分别与对等UEs建立安全的直连通信链路，在UE1和UE2之间建立安全的L3U2U链路，以实现5G ProSe U2U Relay。进一步地，通过对中继UE与UE1和UE2之间的直连通信链路的安全保护，保证5G ProSe U2U Relay上的传输信息的完整性和机密性。进一步地，通过长期凭证，确保远程UE可以识别充当中继UE的恶意攻击者。进一步地，确保5G PKMF可以安全地向Remote UE和U2U Relay UE提供安全参数。
在一些可能的实施方式中，本公开实施例还提供一种中继通信方法，可以应用于通信系统中的中继UE侧。
图8为本公开实施例中的中继UE侧的中继通信方法的实施流程示意图，参见图8中实线，该方法可以包括：
S801，中继UE接收来自UE1发送的第一直连通信请求消息；
S802，中继UE根据第一长期凭证，与UE1建立安全的第一直连通信链路，第一长期凭证是由网 络设备对中继UE鉴权通过时向中继UE发送的；其中，第一直连通信链路用于传输UE1与UE2之间的传输信息。
在一些可能的实施方式中，参见图8中虚线，上述方法还包括：
S803，中继UE向UE2发送第二直连通信请求消息；
S804，中继UE根据第一长期凭证，与UE2建立安全的第二直连通信链路；其中，第二直连通信链路用于传输传输信息。
在一些可能的实施方式中，UE1和UE2为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：UE1的安全能力信息，UE1的安全能力信息用于指示UE1支持的安全算法；RSC；ProSe Code；第一随机数。
在一些可能的实施方式中，上述方法还包括：中继UE向网络设备发送第一请求消息，第一请求消息携带有第一长期凭证标识；中继UE接收来自网络设备的第一响应消息，第一响应消息携带有第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中携带有用于第一共享密钥标识；方法还包括：中继UE根据第一共享密钥标识，确定第一共享密钥，第一共享密钥用于中继UE与UE1之间的安全通信。
在一些可能的实施方式中，上述方法还包括：中继UE确定第一共享密钥有效。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继UE的安全能力信息，中继UE的安全能力信息用于指示中继UE支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：RSC；ProSe Code；第二随机数。
在一些可能的实施方式中，上述方法还包括：中继UE确定存在第二共享密钥，第二共享密钥用于中继UE与UE2之间的安全通信；中继UE将第二共享密钥标识承载于第二直连通信请求消息进行发送，第二共享密钥标识用于标识第二共享密钥。
在一些可能的实施方式中，中继UE确定存在第二共享密钥，包括：中继UE确定存在有效的第二共享密钥。
在一些可能的实施方式中，上述方法还包括：中继UE接收UE2的第二直连通信接受消息；中继UE向UE1发送第一直连通信接受消息。
在一些可能的实施方式中，中继UE的标识为以下之一：中继UE的近邻服务应用标识；中继UE的终端标识。
在一些可能的实施方式中，本公开实施例还提供一种中继通信方法，可以应用于通信系统中的中继UE1侧。
需要说明的是，上述S801至S804的实施过程可以参见图3至7实施例中中继UE侧的具体描述，为了说明书简洁，在此不再赘述。
图9为本公开实施例中的UE1侧的中继通信方法的实施流程示意图，参见图9，该方法可以包括：
S901，UE1向中继UE发送第一直连通信请求消息，中继UE具有第一长期凭证，第一长期凭证是由网络设备对中继UE鉴权通过时向中继UE发送的；
S902，UE1与中继UE建立安全的第一直连通信链路，第一直连通信链路用于传输UE1与UE2之间的传输信息。
在一些可能的实施方式中，UE1和UE2为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，上述方法还包括：UE1发现UE2，并选择中继UE。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：UE1的安全能力信息，UE1的安全能力信息用于指示UE1支持的安全算法；RSC；ProSe Code；第一随机数。
在一些可能的实施方式中，上述方法还包括：第一远端终端确定存在第一共享密钥，第一共享密钥用于中继UE与UE1之间的安全通信；中继UE将第一共享密钥标识承载于第一直连通信请求消息进行发送，第一共享密钥标识用于标识第一共享密钥。
在一些可能的实施方式中，第一远端终端确定存在第一共享密钥，包括：中继UE确定存在有效的第一共享密钥。
在一些可能的实施方式中，上述方法还包括：UE1接收中继UE发送的第一直连通信接受消息。
在一些可能的实施方式中，本公开实施例还提供一种中继通信方法，可以应用于通信系统中的中继UE2侧。
需要说明的是，上述S901至S902的实施过程可以参见图3至7实施例中UE1侧的具体描述，为了说明书简洁，在此不再赘述。
图10为本公开实施例中的UE2侧的中继通信方法的实施流程示意图，参见图10，该方法可以包括：
S1001，UE2接收中继UE发送第二直连通信请求消息，中继UE具有第一长期凭证，第一长期凭证是由网络设备对中继UE鉴权通过时向中继UE发送的；
S1002，UE2与中继UE建立安全的第二直连通信链路，第二直连通信链路用于传输UE2与UE1之间的传输信息。
在一些可能的实施方式中，UE1和UE2为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，上述方法还包括：UE2发现UE1，并选择中继UE。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继UE的安全能力信息，中继UE的安全能力信息用于指示中继UE支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：RSC；ProSe Code；第二随机数。
在一些可能的实施方式中，第二直连通信请求消息中携带有用于第二共享密钥标识；方法还包括：UE2根据第二共享密钥标识，确定第二共享密钥，第二共享密钥用于UE2与中继UE之间的安全通信。
在一些可能的实施方式中，上述方法还包括：UE2确定第二共享密钥有效。
在一些可能的实施方式中，上述方法还包括：UE2向中继UE发送第二直连通信接受消息。
在一些可能的实施方式中，本公开实施例还提供一种中继通信方法，可以应用于通信系统中的中继网络设备侧。
需要说明的是，上述S1001至S1002的实施过程可以参见图3至7实施例中UE2侧的具体描述，为了说明书简洁，在此不再赘述。
图11为本公开实施例中的网络设备侧的中继通信方法的实施流程示意图，参见图11，该方法可以包括：
S1101，网络设备接收第一请求消息，第一请求消息用于请求第一长期凭证；
S1102，网络设备对中继UE进行鉴权；
S1103，在鉴权通过的情况下，网络设备向中继UE发送第一长期凭证；其中，第一长期凭证用于中继UE与对等的UE1和UE2建立安全的直连通信链路，直连通信链路用于中继UE1与UE2之间的传输信息。
在一些可能的实施方式中，上述方法还包括：网络设备为UE1和UE2设置第一长期凭证；网络设备分别向UE1和UE2发送第一长期凭证标识以及第一长期凭证，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，网络设备对中继UE进行鉴权，包括：网络设备确定中继UE是否被授权提供基于近邻服务订阅数据的中继服务。
在一些可能的实施方式中，网络设备确定中继UE是否被授权提供基于近邻服务订阅数据的中继服务，包括：网络设备向中继UE的UDM实体请求中继UE的签约信息，签约信息用于表示中继UE是否被授权提供中继服务；网络设备接收UDM实体发送的签约信息；网络设备根据签约信息，确定中继UE是否被授权提供中继服务。
在一些可能的实施方式中，网络设备确定中继UE是否被授权提供基于近邻服务订阅数据的中继服务，包括：网络设备确定本地是否存储有中继UE的授权信息，授权信息用于表示中继UE被授权提供中继服务。
在一些可能的实施方式中，上述方法还包括：网络设备由近邻服务应用服务器获得第一长期凭证，或网络设备获得本地存储第一长期凭证。
需要说明的是，上述S1101至S1103的实施过程可以参见图3至7实施例中网络设备侧的具体描述，为了说明书简洁，在此不再赘述。
基于相同的发明构思，本公开实施例提供一种通信装置，图12为本公开实施例中的一种通信装置的结构示意图，参见图12所示，该通信装置1200可以包括：处理模块1201、接收模块1202以及发 送模块1203。
在一些可能的实施例中，该通信装置可以为通信系统中的中继终端或者中继终端的芯片或者片上系统，还可以为中继终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中中继终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。
相应的，接收模块1203，被配置为接收来自第一远程终端发送的第一直连通信请求消息；处理模块1201，被配置为根据第一长期凭证，与第一远程终端建立安全的第一直连通信链路，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；其中，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，装置还包括：发送模块1203，被配置为向网络设备发送第一请求消息，第一请求消息携带有第一长期凭证标识；接收模块1203，被配置为接收来自网络设备的第一响应消息，第一响应消息携带有第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中携带有用于第一共享密钥标识；处理模块1201，被配置为根据第一共享密钥标识，确定第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信。
在一些可能的实施方式中，处理模块1201，被配置为确定第一共享密钥有效。
在一些可能的实施方式中，装置还包括：发送模块1203，被配置为向第二远程终端发送第二直连通信请求消息；处理模块1201，被配置为根据第一长期凭证，与第二远程终端建立安全的第二直连通信链路；其中，第二直连通信链路用于传输传输信息。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，处理模块1201，被配置为确定存在第二共享密钥，第二共享密钥用于中继终端与第二远程终端之间的安全通信；发送模块1203，被配置为将第二共享密钥标识承载于第二直连通信请求消息进行发送，第二共享密钥标识用于标识第二共享密钥。
在一些可能的实施方式中，处理模块1201，被配置为确定存在有效的第二共享密钥。
在一些可能的实施方式中，装置还包括：发送模块；接收模块1203，被配置为接收第二远程终端的第二直连通信接受消息；发送模块1203，被配置为向第一远程终端发送第一直连通信接受消息。
在一些可能的实施方式中，中继终端的标识为以下之一：中继终端的近邻服务应用标识；中继终端的终端标识。
在一些可能的实施方式中，该通信装置可以为通信系统中的第一远程终端或者第一远程终端的芯片或者片上系统，还可以为第一远程终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中第一远程终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。
相应的，发送模块1203，被配置为向中继终端发送第一直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；处理模块1201，被配置为与中继终端建立安全的第一直连通信链路，第一直连通信链路用于传输第一远程终端与第二远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，处理模块1201，还被配置为发现第二远程终端，并选择中继终端。
在一些可能的实施方式中，第一直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第一直连通信请求消息中还包括以下至少之一：第一远程终端的安全能力信息，第一远程终端的安全能力信息用于指示第一远程终端支持的安全算法；中继服务代码；近邻服务代码；第一随机数。
在一些可能的实施方式中，装置还包括：处理模块1201，被配置为确定存在第一共享密钥，第一共享密钥用于中继终端与第一远程终端之间的安全通信；发送模块1203，被配置为将第一共享密钥标识承载于第一直连通信请求消息进行发送，第一共享密钥标识用于标识第一共享密钥。
在一些可能的实施方式中，处理模块1201，被配置为确定存在有效的第一共享密钥。
在一些可能的实施方式中，装置还包括：接收模块1203，被配置为接收中继终端发送的第一直连通信接受消息。
在一些可能的实施方式中，该通信装置可以为通信系统中的第二远程终端或者第二远程终端的芯片或者片上系统，还可以为第二远程终端中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中第二远程终端所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。
相应的，接收模块1203，被配置为接收中继终端发送第二直连通信请求消息，中继终端具有第一长期凭证，第一长期凭证是由网络设备对中继终端鉴权通过时向中继终端发送的；处理模块1201，被配置为与中继终端建立安全的第二直连通信链路，第二直连通信链路用于传输第二远程终端与第一远程终端之间的传输信息。
在一些可能的实施方式中，第一远程终端和第二远程终端为配置有第一长期凭证的对等终端。
在一些可能的实施方式中，处理模块1201，还被配置为发现第一远程终端，并选择中继终端。
在一些可能的实施方式中，第二直连通信请求消息携带有第一长期凭证标识，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，第二直连通信请求消息中携带有中继终端的安全能力信息，中继终端的安全能力信息用于指示中继终端支持的安全算法。
在一些可能的实施方式中，第二直连通信请求消息中还包括以下至少之一：中继服务代码；近邻服务代码；第二随机数。
在一些可能的实施方式中，第二直连通信请求消息中携带有用于第二共享密钥标识；处理模块1201，还被配置为根据第二共享密钥标识，确定第二共享密钥，第二共享密钥用于第二远程终端与中继终端之间的安全通信。
在一些可能的实施方式中，处理模块1201，还被配置为确定第二共享密钥有效。
在一些可能的实施方式中，装置还包括：发送模块1203，被配置为向中继终端发送第二直连通信接受消息。
在一些可能的实施方式中，该通信装置可以为通信系统中的网络设备或者网络设备的芯片或者片上系统，还可以为网络设备中用于实现上述各个实施例所述的方法的功能模块。该通信装置可以实现上述各实施例中网络设备所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。
相应的，接收模块1203，被配置为接收第一请求消息，第一请求消息用于请求第一长期凭证；处理模块1201，被配置为网络设备对中继终端进行鉴权；发送模块1203，被配置为在鉴权通过的情况下，网络设备向中继终端发送第一长期凭证；其中，第一长期凭证用于中继终端与对等的第一远程终端和第二远程终端建立安全的直连通信链路，直连通信链路用于中继第一远程终端与第二远程终端之间的传输信息；
在一些可能的实施方式中，处理模块1201，被配置为为第一远程终端和第二远程终端设置第一长期凭证；发送模块1203，被配置为分别向第一远程终端和第二远程终端发送第一长期凭证标识以及第一长期凭证，第一长期凭证标识用于标识第一长期凭证。
在一些可能的实施方式中，处理模块1201，被配置为确定中继终端是否被授权提供基于近邻服务订阅数据的中继服务。
在一些可能的实施方式中，发送模块1203，被配置为向中继终端的UDM实体请求中继终端的签约信息，签约信息用于表示中继终端是否被授权提供中继服务；接收模块1203，被配置为接收UDM实体发送的签约信息；处理模块1201，被配置为根据签约信息，确定中继终端是否被授权提供中继服务。
在一些可能的实施方式中，处理模块1201，被配置为确定本地是否存储有中继终端的授权信息，授权信息用于表示中继终端被授权提供中继服务。
在一些可能的实施方式中，处理模块1201，被配置为由近邻服务应用服务器获得第一长期凭证，或获得本地存储第一长期凭证。
需要说明的是，处理模块1201、接收模块1202以及发送模块1203的具体实现过程可参考图3至图7实施例的详细描述，为了说明书的简洁，这里不再赘述。
本公开实施例中提到的接收模块1202可以为接收接口、接收电路或者接收器等；发送模块1203可以为发送接口、发送电路或者发送器等；处理模块1201可以为一个或者多个处理器。
基于相同的发明构思，本公开实施例提供一种通信设备，该通信设备可以为上述一个或者多个实施例中所述的中继终端、第一远程终端、第二远程终端或者网络设备。图13为本公开实施例中的一种通信设备的结构示意图，参见图13所示，通信设备1300，采用了通用的计算机硬件，包括处理器1301、存储器1302、总线1303、输入设备1304和输出设备1305。
在一些可能的实施方式中，存储器1302可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器1302可以存储操作系统、应用程序、其他程序模块、可执行代码、程序数据、用户数据等。
输入设备1304可以用于向通信设备输入命令和信息，输入设备1304如键盘或指向设备，如鼠标、轨迹球、触摸板、麦克风、操纵杆、游戏垫、卫星电视天线、扫描仪或类似设备。这些输入设备可以通过总线1303连接至处理器1301。
输出设备1305可以用于通信设备输出信息，除了监视器之外，输出设备1305还可以为其他外围输出设各，如扬声器和/或打印设备，这些输出设备也可以通过总线1303连接到处理器1301。
通信设备可以通过天线1306连接到网络中，例如连接到局域网(local area network，LAN)。在联网环境下，控制备中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当通信设备中的处理器1301执行存储器1302中存储的可执行代码或应用程序时，通信设备以执行以上实施例中的UE侧或者网络设备侧的中继通信方法，具体执行过程参见上述实施例，在此不再赘述。
此外，上述存储器1302中存储有用于实现图12中的处理模块1201、接收模块1202以及发送模块1203的功能的计算机执行指令。图12中的处理模块1201、接收模块1202以及发送模块1203的功能/实现过程均可以通过图13中的处理器1301调用存储器1302中存储的计算机执行指令来实现，具体实现过程和功能参考上述相关实施例。
基于相同的发明构思，本公开实施例提供一种终端设备，如中继终端、第一远程终端或第二远程终端，与上述一个或者多个实施例中的中继UE、UE1及UE2一致。可选的，终端设备可以为移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
图14为本公开实施例中的一种终端设备的结构示意图，参见图14所示，终端设备1400可以包括以下一个或多个组件：处理组件1401、存储器1402、电源组件1403、多媒体组件1404、音频组件1405、输入/输出(I/O)的接口1406、传感器组件1407以及通信组件1408。
处理组件1401通常控制终端设备1400的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理组件1401可以包括一个或多个处理器910来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件1401可以包括一个或多个模块，便于处理组件1401和其他组件之间的交互。例如，处理组件1401可以包括多媒体模块，以方便多媒体组件1404和处理组件1401之间的交互。
存储器1402被配置为存储各种类型的数据以支持在终端设备1400的操作。这些数据的示例包括用于在终端设备1400上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器1402可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电源组件1403为终端设备1400的各种组件提供电力。电源组件1403可以包括电源管理系统，一个或多个电源，及其他与为终端设备1400生成、管理和分配电力相关联的组件。
多媒体组件1404包括在终端设备1400和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件1404包括一个前置摄像头和/或后置摄像头。当终端设备1400处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件1405被配置为输出和/或输入音频信号。例如，音频组件1405包括一个麦克风(MIC)，当终端设备1400处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器1402或经由通信组件1408发送。在一些实施例中，音频组件1405还包括一个扬声器，用于输出音频信号。
I/O接口1406为处理组件1401和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件1407包括一个或多个传感器，用于为终端设备1400提供各个方面的状态评估。例如，传感器组件1407可以检测到终端设备1400的打开/关闭状态，组件的相对定位，例如组件为终端设备1400的显示器和小键盘，传感器组件1407还可以检测终端设备1400或终端设备1400一个组件的位置改变，用户与终端设备1400接触的存在或不存在，终端设备1400方位或加速/减速和终端设备1400的温度变化。传感器组件1407可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件1407还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件1407还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件1408被配置为便于终端设备1400和其他设备之间有线或无线方式的通信。终端设备1400可以接入基于通信标准的无线网络，如Wi-Fi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件1408经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件1408还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，终端设备1400可以被一个或多个应用专用集成电路(ASIC)、数字信号处理 器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
基于相同的发明构思，本公开实施例提供一种网络设备，如5G DDNMF实体、PKMF实体等，与上述一个或者多个实施例中的网络设备一致。
图15为本公开实施例中的一种网络设备的结构示意图，参见图15所示，网络设备1500可以包括处理组件1501，其进一步包括一个或多个处理器，以及由存储器1502所代表的存储器资源，用于存储可由处理组件1501的执行的指令，例如应用程序。存储器1502中存储的应用程序可以包括一个或一个以上的每一个对应于一组指令的模块。此外，处理组件1501被配置为执行指令，以执行上述方法前述应用在所述网络设备的任一方法。
网络设备1500还可以包括一个电源组件1503被配置为执行网络设备1500的电源管理，一个有线或无线网络接口1504被配置为将网络设备1500连接到网络，和一个输入输出(I/O)接口1505。网络设备1500可以操作基于存储在存储器1502的操作系统，例如Windows Server TM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM或类似。
基于相同的发明构思，本公开实施例还提供一种计算机可读存储介质，计算机可读存储介质中存储有指令；当指令在计算机上运行时，用于执行上述一个或者多个实施例中终端设备侧或者网络设备侧的中继通信方法。
基于相同的发明构思，本公开实施例还提供一种计算机程序或计算机程序产品，当计算机程序产品在计算机上被执行时，使得计算机实现上述一个或者多个实施例中终端设备侧或者网络设备侧的中继通信方法。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明的其它实施方案。本公开旨在涵盖本发明的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明的真正范围和精神由下面的权利要求指出。
应当理解的是，本发明并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明的范围仅由所附的权利要求来限制。

Claims (41)

  1. 一种中继通信方法，其中，包括：
    中继终端接收来自第一远程终端发送的第一直连通信请求消息；
    所述中继终端根据第一长期凭证，与所述第一远程终端建立安全的第一直连通信链路，所述第一长期凭证是由网络设备对所述中继终端鉴权通过时向所述中继终端发送的。
  2. 根据权利要求1所述的方法，其中，所述第一直连通信请求消息携带有所述第一长期凭证标识，所述第一长期凭证标识用于标识所述第一长期凭证。
  3. 根据权利要求2所述的方法，其中，所述第一直连通信请求消息中还包括以下至少之一：
    所述第一远程终端的安全能力信息，所述第一远程终端的安全能力信息用于指示所述第一远程终端支持的安全算法；
    中继服务代码；
    近邻服务代码；
    第一随机数。
  4. 根据权利要求1所述的方法，其中，所述方法还包括：
    所述中继终端向网络设备发送第一请求消息，所述第一请求消息携带有所述第一长期凭证标识；
    所述中继终端接收来自所述网络设备的第一响应消息，所述第一响应消息携带有所述第一长期凭证。
  5. 根据权利要求1所述的方法，其中，所述第一直连通信请求消息中携带有用于第一共享密钥标识；
    所述方法还包括：
    所述中继终端根据所述第一共享密钥标识，确定第一共享密钥，所述第一共享密钥用于所述中继终端与所述第一远程终端之间的安全通信。
  6. 根据权利要求5所述的方法，其中，所述方法包括：
    所述中继终端确定所述第一共享密钥有效。
  7. 根据权利要求1所述的方法，其中，所述方法还包括：
    所述中继终端向第二远程终端发送第二直连通信请求消息；
    所述中继终端根据所述第一长期凭证，与所述第二远程终端建立安全的第二直连通信链路；
    其中，所述第一直连通信链路和所述第二直连通信链路用于传输所述第一远程终端和所述第二远程终端之间的传输信息。
  8. 根据权利要求7所述的方法，其中，所述第一远程终端和所述第二远程终端为配置有所述第一长期凭证的对等终端。
  9. 根据权利要求7所述的方法，其中，所述第二直连通信请求消息携带有第一长期凭证标识，所述第一长期凭证标识用于标识所述第一长期凭证。
  10. 根据权利要求7所述的方法，其中，所述第二直连通信请求消息中携带有所述中继终端的安全能力信息，所述中继终端的安全能力信息用于指示所述中继终端支持的安全算法。
  11. 根据权利要求9所述的方法，其中，所述第二直连通信请求消息中还包括以下至少之一：
    中继服务代码；
    近邻服务代码；
    第二随机数。
  12. 根据权利要求7所述的方法，其中，所述方法还包括：
    所述中继终端确定存在第二共享密钥，所述第二共享密钥用于所述中继终端与所述第二远程终端之间的安全通信；
    所述中继终端将第二共享密钥标识承载于所述第二直连通信请求消息进行发送，所述第二共享密钥标识用于标识所述第二共享密钥。
  13. 根据权利要求12所述的方法，其中，所述中继终端确定存在第二共享密钥，包括：
    所述中继终端确定存在有效的第二共享密钥。
  14. 根据权利要求1所述的方法，其中，所述方法还包括：
    所述中继终端接收第二远程终端的第二直连通信接受消息；
    所述中继终端向所述第一远程终端发送第一直连通信接受消息。
  15. 根据权利要求1所述的方法，其中，所述中继终端的标识为以下之一：
    中继终端的近邻服务应用标识；
    中继终端的终端标识。
  16. 一种中继通信方法，其中，包括：
    第一远程终端向中继终端发送第一直连通信请求消息，所述中继终端具有第一长期凭证，所述第一长期凭证是由网络设备对所述中继终端鉴权通过时向所述中继终端发送的；
    所述第一远程终端与所述中继终端建立安全的第一直连通信链路。
  17. 根据权利要求16所述的方法，其中，所述第一远程终端为第二远程终端的对等终端，所述第一远程终端和所述第二远程终端为配置有第一长期凭证的对等终端。
  18. 根据权利要求16所述的方法，其中，所述方法还包括：
    所述第一远程终端发现第二远程终端，并选择所述中继终端。
  19. 根据权利要求16所述的方法，其中，所述第一直连通信请求消息携带有第一长期凭证标识，所述第一长期凭证标识用于标识所述第一长期凭证。
  20. 根据权利要求19所述的方法，其中，所述第一直连通信请求消息中还包括以下至少之一：
    所述第一远程终端的安全能力信息，所述第一远程终端的安全能力信息用于指示所述第一远程终端支持的安全算法；
    中继服务代码；
    近邻服务代码；
    第一随机数。
  21. 根据权利要求16所述的方法，其中，所述方法还包括：
    所述第一远端终端确定存在第一共享密钥，所述第一共享密钥用于所述中继终端与所述第一远程 终端之间的安全通信；
    所述中继终端将第一共享密钥标识承载于所述第一直连通信请求消息进行发送，所述第一共享密钥标识用于标识所述第一共享密钥。
  22. 根据权利要求21所述的方法，其中，所述第一远端终端确定存在第一共享密钥，包括：
    所述中继终端确定存在有效的第一共享密钥。
  23. 根据权利要求16所述的方法，其中，所述方法还包括：
    所述第一远程终端接收所述中继终端发送的第一直连通信接受消息。
  24. 一种中继通信方法，其中，包括：
    第二远程终端接收中继终端发送第二直连通信请求消息，所述中继终端具有第一长期凭证，所述第一长期凭证是由网络设备对所述中继终端鉴权通过时向所述中继终端发送的；
    所述第二远程终端与所述中继终端建立安全的第二直连通信链路，所述第二直连通信链路用于传输所述第二远程终端与第一远程终端之间的传输信息。
  25. 根据权利要求24所述的方法，其中，所述第一远程终端和所述第二远程终端为配置有第一长期凭证的对等终端。
  26. 根据权利要求24所述的方法，其中，所述方法还包括：
    所述第二远程终端发现所述第一远程终端，并选择所述中继终端。
  27. 根据权利要求24所述的方法，其中，所述第二直连通信请求消息携带有第一长期凭证标识，所述第一长期凭证标识用于标识所述第一长期凭证。
  28. 根据权利要求27所述的方法，其中，所述第二直连通信请求消息中携带有所述中继终端的安全能力信息，所述中继终端的安全能力信息用于指示所述中继终端支持的安全算法。
  29. 根据权利要求27所述的方法，其中，所述第二直连通信请求消息中还包括以下至少之一：
    中继服务代码；
    近邻服务代码；
    第二随机数。
  30. 根据权利要求24所述的方法，其中，所述第二直连通信请求消息中携带有用于第二共享密钥标识；
    所述方法还包括：
    所述第二远程终端根据所述第二共享密钥标识，确定第二共享密钥，所述第二共享密钥用于所述第二远程终端与所述中继终端之间的安全通信。
  31. 根据权利要求30所述的方法，其中，所述方法还包括：
    所述第二远程终端确定所述第二共享密钥有效。
  32. 根据权利要求24所述的方法，其中，所述方法还包括：
    所述第二远程终端向所述中继终端发送第二直连通信接受消息。
  33. 一种中继通信方法，其中，包括：
    网络设备接收第一请求消息，所述第一请求消息用于请求第一长期凭证；
    所述网络设备对中继终端进行鉴权；
    在鉴权通过的情况下，所述网络设备向所述中继终端发送第一长期凭证；
    其中，所述第一长期凭证用于所述中继终端与对等的第一远程终端和第二远程终端建立安全的直连通信链路，所述直连通信链路用于中继所述第一远程终端与所述第二远程终端之间的传输信息。
  34. 根据权利要求33所述的方法，其中，所述方法还包括：
    所述网络设备为所述第一远程终端和所述第二远程终端设置所述第一长期凭证；
    所述网络设备分别向所述第一远程终端和所述第二远程终端发送第一长期凭证标识以及所述第一长期凭证，所述第一长期凭证标识用于标识所述第一长期凭证。
  35. 根据权利要求33所述的方法，其中，所述网络设备对中继终端进行鉴权，包括：
    所述网络设备确定所述中继终端是否被授权提供基于近邻服务订阅数据的中继服务。
  36. 根据权利要求35所述的方法，其中，所述网络设备确定所述中继终端是否被授权提供基于近邻服务订阅数据的中继服务，包括：
    所述网络设备向所述中继终端的统一数据管理功能UDM实体请求所述中继终端的签约信息，所述签约信息用于表示所述中继终端是否被授权提供所述中继服务；
    所述网络设备接收所述UDM实体发送的所述签约信息；
    所述网络设备根据所述签约信息，确定所述中继终端是否被授权提供所述中继服务。
  37. 根据权利要求35所述的方法，其中，所述网络设备确定所述中继终端是否被授权提供基于近邻服务订阅数据的中继服务，包括：
    所述网络设备确定本地是否存储有所述中继终端的授权信息，所述授权信息用于表示所述中继终端被授权提供所述中继服务。
  38. 根据权利要求33所述的方法，其中，所述方法还包括：
    所述网络设备由近邻服务应用服务器获得所述第一长期凭证，或
    所述网络设备获得本地存储所述第一长期凭证。
  39. 一种中继通信装置，其中，包括：
    接收模块，被配置为接收来自第一远程终端发送的第一直连通信请求消息；
    处理模块，被配置为根据第一长期凭证，与所述第一远程终端建立安全的第一直连通信链路，所述第一长期凭证是由网络设备对所述中继终端鉴权通过时向所述中继终端发送的。
  40. 一种通信装置，其特征在于，包括：存储器和处理器；所述处理器与所述存储器连接，被配置为通执行存储在所述存储器上的计算机可执行指令，以实现如权利要求1至38任一项所述的中继通信方法。
  41. 一种计算机存储介质，存储有计算机可执行指令，其特征在于，所述计算机可执行指令被处理器执行后能够实现如权利要求1至38任一项所述的中继通信方法。
PCT/CN2022/099287 2022-06-16 2022-06-16 一种中继通信方法、通信装置及通信设备 WO2023240575A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280002242.7A CN117597963A (zh) 2022-06-16 2022-06-16 一种中继通信方法、通信装置及通信设备
PCT/CN2022/099287 WO2023240575A1 (zh) 2022-06-16 2022-06-16 一种中继通信方法、通信装置及通信设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/099287 WO2023240575A1 (zh) 2022-06-16 2022-06-16 一种中继通信方法、通信装置及通信设备

Publications (1)

Publication Number Publication Date
WO2023240575A1 true WO2023240575A1 (zh) 2023-12-21

Family

ID=89192816

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/099287 WO2023240575A1 (zh) 2022-06-16 2022-06-16 一种中继通信方法、通信装置及通信设备

Country Status (2)

Country Link
CN (1) CN117597963A (zh)
WO (1) WO2023240575A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103297961A (zh) * 2012-03-05 2013-09-11 上海贝尔股份有限公司 一种用于设备间安全通信的设备与系统
CN106211188A (zh) * 2015-04-10 2016-12-07 中兴通讯股份有限公司 更换中继节点的方法及系统、d2d用户设备及控制节点
WO2017000140A1 (zh) * 2015-06-29 2017-01-05 华为技术有限公司 一种对用户设备的鉴权方法及装置
US20200127988A1 (en) * 2018-10-19 2020-04-23 Apple Inc. Media intercom over a secure device to device communication channel

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103297961A (zh) * 2012-03-05 2013-09-11 上海贝尔股份有限公司 一种用于设备间安全通信的设备与系统
CN106211188A (zh) * 2015-04-10 2016-12-07 中兴通讯股份有限公司 更换中继节点的方法及系统、d2d用户设备及控制节点
WO2017000140A1 (zh) * 2015-06-29 2017-01-05 华为技术有限公司 一种对用户设备的鉴权方法及装置
US20200127988A1 (en) * 2018-10-19 2020-04-23 Apple Inc. Media intercom over a secure device to device communication channel

Also Published As

Publication number Publication date
CN117597963A (zh) 2024-02-23

Similar Documents

Publication Publication Date Title
US11792886B2 (en) Method for accessing network by network node, and electronic equipment
US10673611B2 (en) Data transmission method, device, and system
WO2023184561A1 (zh) 中继通信方法、装置、通信设备及存储介质
CN116325664A (zh) 一种智能设备配网的方法和装置
CN112383532A (zh) 设备联网方法及装置、电子设备、存储介质
WO2023240575A1 (zh) 一种中继通信方法、通信装置及通信设备
WO2024000123A1 (zh) 密钥生成方法及装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
WO2023004655A1 (zh) 一种通信方法、装置、用户设备、基站、核心网设备及存储介质
WO2023240574A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2024020868A1 (zh) 密钥生成方法及装置、通信设备及存储介质
WO2023000137A1 (zh) 一种通信方法、装置及设备
WO2024031523A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023212934A1 (zh) 一种中继通信方法、接入方法、装置及设备
WO2023201551A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023245354A1 (zh) 安全保护方法、装置、通信设备及存储介质
WO2024031711A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2024031640A1 (zh) 一种信息传输方法、装置、通信设备及存储介质
WO2024031549A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023206504A1 (zh) 系统消息处理方法及装置、通信设备及存储介质
WO2023226051A1 (zh) 为个人物联网设备选择认证机制的方法及装置、ue、网络功能及存储介质
WO2023201454A1 (zh) 中继通信方法、装置、通信设备及存储介质
WO2023000139A1 (zh) 传输凭证的方法、装置、通信设备及存储介质
WO2023184548A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023240657A1 (zh) 认证与授权方法、装置、通信设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280002242.7

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22946264

Country of ref document: EP

Kind code of ref document: A1