WO2024092735A1 - 通信控制方法、系统及装置、通信设备及存储介质 - Google Patents

通信控制方法、系统及装置、通信设备及存储介质 Download PDF

Info

Publication number
WO2024092735A1
WO2024092735A1 PCT/CN2022/129933 CN2022129933W WO2024092735A1 WO 2024092735 A1 WO2024092735 A1 WO 2024092735A1 CN 2022129933 W CN2022129933 W CN 2022129933W WO 2024092735 A1 WO2024092735 A1 WO 2024092735A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
message
relay terminal
information
network element
Prior art date
Application number
PCT/CN2022/129933
Other languages
English (en)
French (fr)
Inventor
商正仪
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to PCT/CN2022/129933 priority Critical patent/WO2024092735A1/zh
Publication of WO2024092735A1 publication Critical patent/WO2024092735A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present disclosure relates to the field of wireless communication technology but is not limited to the field of wireless communication technology, and in particular to a communication control method, system and apparatus, communication equipment and storage medium.
  • 5G Proximity Service can achieve communication through UE to UE relay terminal (UE to UE Relay, U2U Relay) when peer User Equipment (UE) cannot be directly connected.
  • UE User Equipment
  • UE Relay User Equipment
  • UE User Equipment
  • UE Relay User Equipment
  • UE User Equipment
  • UE Relay User Equipment
  • UE User Equipment
  • UE Relay User Equipment
  • UE User Equipment
  • UE Relay peer User Equipment
  • Embodiments of the present disclosure provide a communication control method, system and apparatus, communication equipment and storage medium.
  • a first aspect of an embodiment of the present disclosure provides a communication control method, which is performed by a first UE.
  • the method includes:
  • DCR Direct Communication Request
  • a communication connection is established with the second UE through the relay terminal that responds to the DCR message.
  • a second aspect of the present disclosure provides a communication control method, which is executed by a relay terminal.
  • the method includes:
  • a communication connection between the first UE and the second UE is established in response to the DCR message.
  • a third aspect of the present disclosure provides a communication control method, which is performed by a second UE.
  • the method includes:
  • a fourth aspect of the present disclosure provides a communication control method, which is performed by a first functional network element, and the method includes:
  • the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • a fifth aspect of the embodiments of the present disclosure provides a communication control method, which is performed by a second functional network element, and the method includes:
  • the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • a sixth aspect of the embodiments of the present disclosure provides a communication control system, the system comprising: a first UE, a relay terminal, a second UE, a first functional network element, and a second functional network element;
  • the first UE is used to broadcast a DCR message; the information carried by the DCR message is protected by security information; and a communication connection is established with the second UE through a relay terminal that responds to the DCR message;
  • the relay terminal is configured to obtain a DCR message broadcast by the first UE; information carried by the DCR message is protected by security information; and a communication connection is established between the first UE and the second UE in response to the DCR message;
  • the second UE is configured to establish a communication connection with the first UE through the relay terminal based on the security information when receiving a new DCR message broadcast by multiple relay terminals based on the DCR message of the first UE; the information carried by the DCR message is protected by the security information;
  • the first functional network element is used to provide security information to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal;
  • the second functional network element is used to provide security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • a seventh aspect of the present disclosure provides a communication control device, applied to a first UE, the device including:
  • a first establishing unit is configured to broadcast a DCR message; information carried by the DCR message is protected by security information;
  • the second establishing unit is configured to establish a communication connection with the second UE through the relay terminal that responds to the DCR message.
  • An eighth aspect of the present disclosure provides a communication control device, applied to a relay terminal, the device comprising:
  • a first processing unit is configured to obtain a DCR message broadcast by a first UE; information carried by the DCR message is protected by security information;
  • the second processing unit is configured to establish a communication connection between the first UE and the second UE in response to the DCR message.
  • a ninth aspect of the embodiments of the present disclosure provides a communication control device, applied to a second UE, the device including:
  • the connection unit is configured to establish a communication connection with the first UE through the relay terminal based on security information when receiving a new DCR message broadcast by multiple relay terminals based on the DCR message of the first UE; the information carried by the DCR message is protected by the security information.
  • a tenth aspect of the embodiments of the present disclosure provides a communication control device, applied to a first functional network element, the device including:
  • the execution unit is configured to provide security information to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • An eleventh aspect of the present disclosure provides a communication control device, applied to a second functional network element, the device including:
  • the operation unit is configured to provide security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • a twelfth aspect of an embodiment of the present disclosure provides a communication device, comprising a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes a communication control method provided in any of the foregoing embodiments when running the executable program.
  • a thirteenth aspect of an embodiment of the present disclosure provides a computer storage medium, wherein the computer storage medium stores an executable program; after the executable program is executed by a processor, the communication control method provided in any of the foregoing embodiments can be implemented.
  • the technical solution provided by the embodiment of the present disclosure is to broadcast a DCR message; the information carried by the DCR message is protected by security information; and a communication connection is established with the second UE through the relay terminal that responds to the DCR message.
  • the security of the communication link between the first UE and the second UE based on the relay terminal can be improved.
  • broadcasting the DCR message instead of sending the DCR message separately to the selected relay terminal the resource overhead generated by the first UE that currently needs to connect to the second UE selecting the relay terminal can be saved.
  • FIG1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment
  • FIG2 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG3 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG4 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG5 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG6 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG7 is a flow chart showing a communication control method according to an exemplary embodiment
  • FIG8 is a flow chart showing a communication control method according to an exemplary embodiment
  • FIG9 is a flow chart showing a communication control method according to an exemplary embodiment
  • FIG10 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG11 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG12 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG13 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG14 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG15 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG16 is a flow chart of a communication control method according to an exemplary embodiment
  • FIG17 is a schematic structural diagram of a communication control device according to an exemplary embodiment
  • FIG18 is a schematic structural diagram of a communication control device according to an exemplary embodiment
  • FIG19 is a schematic structural diagram of a communication control device according to an exemplary embodiment
  • FIG20 is a schematic structural diagram of a communication control device according to an exemplary embodiment
  • FIG21 is a schematic structural diagram of a communication control device according to an exemplary embodiment
  • FIG22 is a schematic diagram showing the structure of a terminal according to an exemplary embodiment
  • Fig. 23 is a schematic structural diagram of a communication device according to an exemplary embodiment.
  • first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • word "if” as used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • Figure 1 shows a schematic diagram of the structure of a wireless communication system provided by an embodiment of the present disclosure.
  • the wireless communication system is a communication system based on cellular mobile communication technology, and the wireless communication system may include: a plurality of terminals 11 and a plurality of access devices 12.
  • the terminal 11 can be a device that provides voice and/or data connectivity to the user.
  • the terminal 11 can communicate with one or more core networks via a radio access network (RAN).
  • RAN radio access network
  • the terminal 11 can be an Internet of Things terminal, such as a sensor device, a mobile phone (or a "cellular" phone), and a computer with an Internet of Things terminal.
  • it can be a fixed, portable, pocket-sized, handheld, computer-built-in or vehicle-mounted device.
  • a station STA
  • a subscriber unit a subscriber station, a mobile station, a mobile station, a mobile station, a remote station, an access point, a remote terminal, an access terminal, a user device, a user agent, a user device, or a user terminal (user equipment, terminal).
  • the terminal 11 can also be a device of an unmanned aerial vehicle.
  • the terminal 11 can also be a vehicle-mounted device, for example, it can be a driving computer with wireless communication function, or a wireless communication device connected to an external driving computer.
  • the terminal 11 may also be a roadside device, for example, a street lamp, a traffic light or other roadside device with a wireless communication function.
  • the access device 12 may be a network side device in a wireless communication system.
  • the wireless communication system may be a fourth generation mobile communication technology (4G) system, also known as a long term evolution (LTE) system; or, the wireless communication system may be a 5G system, also known as a new radio (NR) system or a 5G NR system.
  • 4G fourth generation mobile communication technology
  • 5G also known as a new radio (NR) system or a 5G NR system.
  • NR new radio
  • the wireless communication system may be a next generation system of the 5G system.
  • the access network in the 5G system may be called NG-RAN (New Generation-Radio Access Network).
  • an MTC system may be called NG-RAN (New Generation-Radio Access Network).
  • the access device 12 can be an evolved access device (eNB) adopted in a 4G system.
  • the access device 12 can also be an access device (gNB) adopting a centralized distributed architecture in a 5G system.
  • the access device 12 adopts a centralized distributed architecture it usually includes a centralized unit (central unit, CU) and at least two distributed units (distributed units, DU).
  • the centralized unit is provided with a packet data convergence protocol (Packet Data Convergence Protocol, PDCP) layer, a radio link layer control protocol (Radio Link Control, RLC) layer, and a media access control (Media Access Control, MAC) layer protocol stack;
  • the distributed unit is provided with a physical (Physical, PHY) layer protocol stack.
  • the embodiment of the present disclosure does not limit the specific implementation method of the access device 12.
  • a wireless connection can be established between the access device 12 and the terminal 11 through a wireless air interface.
  • the wireless air interface is a wireless air interface based on the fourth generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth generation mobile communication network technology (5G) standard, for example, the wireless air interface is a new air interface; or, the wireless air interface can also be a wireless air interface based on the next generation mobile communication network technology standard of 5G.
  • the wireless communication system may further include a network management device 13.
  • the network management device 13 may be a core network device in the wireless communication system, for example, the network management device 13 may be a mobility management entity (MME) in an evolved packet core (EPC).
  • MME mobility management entity
  • EPC evolved packet core
  • the network management device may also be other core network devices, such as a serving gateway (SGW), a public data network gateway (PGW), a policy and charging rules function (PCRF) or a home subscriber server (HSS).
  • SGW serving gateway
  • PGW public data network gateway
  • PCRF policy and charging rules function
  • HSS home subscriber server
  • the terminal 11 may be used to perform a communication connection, for example, the terminal 11 may include a first UE, i.e., a source UE, and may also include a second UE, i.e., a target UE, and may also include a relay terminal.
  • the access device 12 may include a first functional network element and/or a second functional network element, wherein the first functional network element may at least be used to provide services such as data processing to the first UE and/or the second UE, and the second functional network element may at least be used to provide services such as data processing to the relay terminal.
  • the first functional network element and the second functional network element may be the same functional network element or different functional network elements.
  • the first functional network element may be a direct discovery name management function (Direct Discovery Name Management Function, DDNMF) or a key management function (ProSe Key Management Function, PKMF), or may also be other functional network elements.
  • the second functional network element may be a DDNMF or a PKMF, or may also be other functional network elements.
  • the network management device 13 may include a ProSe application server, which establishes a communication connection with the first functional network element and/or the second functional network element to implement authentication and other processing requested by the first functional network element and/or the second functional network element.
  • the terminal 11 can also be used for ranging/sidelink positioning services.
  • the terminal 11 may include a first UE, i.e., a reference UE, and may also include a second UE, i.e., a target UE, and may also include a relay terminal as an auxiliary UE.
  • the access device 12 may include a first functional network element and/or a second functional network element.
  • the network management device 13 may include a ProSe application server, which establishes a communication connection with the first functional network element and/or the second functional network element to implement authentication and other processing requested by the first functional network element and/or the second functional network element.
  • the first UE is a UE that needs to establish a communication connection with other UEs, for example, it can be a source UE or a reference UE in a ranging or sidelink service.
  • the first UE includes but is not limited to a mobile phone, a wearable device, a vehicle-mounted terminal, a road side unit (RSU, Road Side Unit), a smart home terminal, an industrial sensor device and/or a medical device, etc.
  • the direct communication request DCR message is used to request to establish a direct communication connection with other UEs, such as establishing a unicast communication through a direct communication interface (PC5) of a relay terminal.
  • PC5 direct communication interface
  • the first UE and the second UE may be peer user equipment that need to establish a communication connection
  • the first UE may be a source UE that needs to initiate a connection
  • the second UE may be a target UE that the first UE needs to connect to
  • the relay terminal may be a terminal for providing relay services for the first UE and the second UE that cannot be directly connected
  • the relay terminal may also be a UE or other device.
  • the communication control method in the embodiment of the present disclosure may also be applied to ranging or sidelink positioning services, in which case the first UE may be a reference UE, the second UE may be a target UE to be ranged or positioned, and the relay terminal may be an auxiliary UE.
  • the relay terminal is a terminal that can provide U2U relay services, such as a relay UE, etc., or an auxiliary UE that provides ranging or sidelink positioning services.
  • the relay terminal can be any relay terminal that can obtain the DCR message broadcast by the first UE, such as a first relay terminal or a second relay terminal within the signal coverage range of the first UE.
  • an embodiment of the present disclosure provides a communication control method, which is executed by a first UE.
  • the method may include:
  • S110 Broadcast a DCR message; information carried in the DCR message is protected by security information.
  • a DCR message is broadcast; the information carried by the DCR message is protected by security information, wherein the information carried by the DCR message may include at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, a relay service code (RSC), a credential identifier (ID), and a first random number.
  • the identification information may be a user information ID (User Info ID) of the UE, a restricted ProSe application user ID (RPAUID) of the UE, a ProSe remote UE key ID (ProSe Remote User Key ID, PRUK ID) of the UE, a subscription concealed identifier (SUCI), or other identifiers.
  • the second UE is a UE that the first UE needs to establish a communication connection with, for example, it may be a target UE.
  • RSC is the RSC corresponding to the current relay service.
  • the credential ID may be a long-term credential ID configured in the first UE or provided to the first UE, such as a long-term credential ID provided by a network-side policy control function (PCF), a direct discovery name management function (DDNMF), a key management function (PKMF) or a ProSe application server.
  • PCF network-side policy control function
  • DDNMF direct discovery name management function
  • PKMF key management function
  • the information carried by the DCR message is protected by security information, which may include: part or all of the information carried by the DCR message is protected by security information.
  • security information may include: part or all of the information carried by the DCR message is protected by security information.
  • the identification information of the first UE and the identification information of the second UE carried by the DCR message are protected by security information.
  • a DCR message is broadcast; identification information of the first UE and identification information of the second UE carried in the DCR message are protected by security information used for discovery.
  • security information used for discovery For example, user information IDs of the first UE and the second UE may be protected by security parameters based on a security algorithm.
  • a DCR message is broadcast; the information carried by the DCR message is protected by security information, wherein the security information may include: security parameters and/or security algorithms.
  • the security parameters may be code security parameters (Code Security Parameters), code-sending security parameters (Code-Sending Security Parameters), code-receiving security parameters (Code-Receving Security Parameters) corresponding to RSC, etc.
  • the security algorithm may be a discovery encryption algorithm corresponding to RSC, etc.
  • the information carried by the DCR message is protected by security information used for discovery, for example, the information carried by the DCR message may be protected by security parameters based on a security algorithm, etc.
  • the identification information may include the UE's user information ID (User Information ID), the UE's restricted ProSe application user ID (Restricted ProSe Application User ID, RPAUID), the UE's ProSe remote UE key ID (ProSe Remote User Key ID, PRUK ID), the subscription concealed identifier (Subscription Concealed Identifier, SUCI) or other identifiers, and RSC is the code corresponding to the current relay service.
  • the credential ID may be a long-term credential ID configured in the first UE or provided to the first UE, such as a long-term credential ID provided by a network-side policy control function (Policy Control Function, PCF), DDNMF, PKMF or ProSe application server.
  • Policy Control Function Policy Control Function
  • a DCR message is broadcast; information carried by the DCR message is protected by security information, wherein the security information may include: security parameters and/or security algorithms.
  • security information may include: security parameters and/or security algorithms.
  • the information carried by the DCR message is protected by security information, and the information carried by the DCR message may be protected by security parameters based on security algorithms.
  • a DCR message is broadcast; information carried in the DCR message is protected by security information, wherein identification information of the first UE and identification information of the second UE carried in the DCR message may be protected by security information used for discovery.
  • the security information may include: security parameters and/or security algorithms, and identification information of the first UE and identification information of the second UE carried in the DCR message may be protected by security parameters based on security algorithms.
  • a DCR message is broadcasted within a preset range; information carried by the DCR message is protected by security information.
  • the preset range may be a signal coverage range of the first UE, and broadcasting the DCR message within the preset range may include: broadcasting the DCR message to all relay terminals within the signal coverage range.
  • the DCR message is used to request to establish a direct communication connection with the second UE, such as establishing PC5 unicast communication through the relay terminal.
  • the DCR message used to establish the communication link is protected by the security information used for discovery, thereby improving the security of the communication link between the first UE and the second UE based on the relay device.
  • the resource overhead generated by the first UE currently needing to connect to the second UE selecting the relay terminal can be saved.
  • the method may include: establishing a communication connection with the second UE through a relay terminal that responds to the DCR message.
  • an embodiment of the present disclosure provides a communication control method, which is executed by a first UE.
  • the method may include:
  • S111 broadcast a DCR message; the information carried in the DCR message is protected by security information;
  • S120 Establish a communication connection with the second UE through the relay terminal that responds to the DCR message.
  • a DCR message is broadcast; information carried by the DCR message is protected by security information; and a communication connection is established with the second UE through a relay terminal that responds to the DCR message, wherein the relay terminal that responds to the DCR message may be one or more relay terminals among the relay terminals that receive the broadcast DCR message, such as one or more relay terminals located within the signal coverage of the first UE.
  • a DCR message is broadcast; the information carried by the DCR message is protected by security information; after the direct authentication and key generation process initiated by a target relay terminal among multiple relay terminals that respond to the DCR message is completed, a security mode command message sent by the target relay terminal is received; the integrity of the security mode command message is verified, and a security mode completion message is returned to the target relay terminal after the verification is passed; when a direct communication acceptance message sent by the target relay terminal is received, a radio resource control layer (L3) PC5 communication link is established with the second UE through the target relay terminal.
  • L3 radio resource control layer
  • an embodiment of the present disclosure provides a communication control method, which is executed by a first UE.
  • the method may include:
  • S101 Request to obtain security information.
  • a request is made to a first functional network element associated with the first UE to obtain security information.
  • a preset message is sent to a first functional network element associated with the first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capability.
  • a request is made to obtain security information; and a message carrying the security information is received.
  • security information is requested; a message carrying security information is received; a DCR message is broadcast; and information carried in the DCR message is protected by security information.
  • step S101 may be combined with the aforementioned step S110 or S111, or may be combined with step S110 and step S120, or may be combined with step S110 and step S120.
  • S101 may also be combined with any specific implementation of step S110 or S111.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a first UE.
  • the method may include:
  • S102 Receive a message carrying security information.
  • the security information may be used to establish a communication connection between the first UE and the second UE through the relay terminal.
  • a message carrying security information sent by a first functional network element associated with a first UE is received.
  • a response message sent by a first functional network element associated with the first UE is received; the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • step S102 may be combined with the aforementioned step S101, or may be combined with any specific implementation of S101.
  • the method may include: requesting to obtain security information; receiving a message carrying security information.
  • the method may include: sending a preset message to a first functional network element associated with the first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capabilities; receiving a message carrying security information.
  • step S102 can be combined with the aforementioned step S110 or S111, or can be combined with step S110 and step S120, or can be combined with step S110 and S120.
  • S102 can also be combined with any specific implementation of step S110 or S111.
  • the present disclosure provides a communication control method, which is performed by a first UE.
  • the method may include:
  • a request is made to obtain security information; and a message carrying security information sent by a first functional network element associated with the first UE is received.
  • a request is made to obtain security information; a response message sent by a first functional network element associated with the first UE is received; and the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • a request is made to a first functional network element associated with the first UE to obtain security information; and a message carrying the security information sent by the first functional network element associated with the first UE is received.
  • a request is made to obtain security information from a first functional network element associated with the first UE; a response message sent by the first functional network element associated with the first UE is received; and the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • the security information carried by the response message and the security information protecting the information carried by the DCR message may be security information used for discovery, for example, including security parameters used for discovery and/or security algorithms used for discovery.
  • a preset message is sent to the DDNMF or PKMF associated with the first UE, and the preset message carries at least one of the following: RSC, identification information of the first UE, and security capability.
  • the preset message may be a discovery request message for requesting to obtain security information for discovery, and the RSC carried in the preset message may be a code corresponding to the current relay service.
  • a preset message is sent to a first functional network element associated with the first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capability; wherein the security capability is the security capability of the first UE, for example, it may be the first security capability corresponding to the first UE in the discovery phase.
  • the security algorithms supported by the first UE may be recorded in the first security capability, for example, it may be recorded in the form of a security algorithm list, etc.
  • a response message returned by the first functional network element is received, wherein the response message may be a discovery response message returned by the first functional network element based on the discovery request message.
  • the response message may carry security information for discovery obtained by the first functional network element and matching the RSC in the preset message, for example, the security information matching the RSC may include: security information for discovery determined by the relay terminal in the discovery request process and matching the RSC.
  • a response message returned by the first functional network element is received; the response message carries security information matching the RSC; wherein the security information matching the RSC may be security information matching the RSC and the security capability of the first UE.
  • the security algorithm in the security information matching the RSC may be a security algorithm in the security algorithm list in the security capability of the first UE.
  • a response message returned by the first functional network element is received; the response message carries security information matching the RSC; or, a rejection message returned by the first functional network element is also received, wherein the rejection message indicates that the first UE is not authorized to use the relay service corresponding to the RSC.
  • the present disclosure provides a communication control method, which is performed by a first UE.
  • the method may include:
  • the preset message carries at least one of the following: the RSC, identification information of the first UE, and security capability;
  • the response message carries security information matching the RSC
  • Broadcast DCR message the information carried by the DCR message is protected by security information.
  • a preset message is sent to a first functional network element associated with a first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capabilities; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; after receiving the response message returned by the first functional network element, the identification information of the first UE and the second UE in the DCR message is protected by security information, and the DCR message is broadcast; the information carried by the DCR message is protected by security information.
  • a preset message is sent to a first functional network element associated with a first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capabilities; identification information of at least one relay terminal is stored in an application container for the first functional network element to read; the identification information of the relay terminal is used for the first functional network element to obtain corresponding security parameters and/or security algorithms; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; a DCR message is broadcast; the information carried by the DCR message is protected by security information.
  • the second functional network element associated with the identification information of the relay terminal can be the same as the first functional network element associated with the first UE, or it can be different from the first functional network element. That is, the Public Land Mobile Network (PLMN) ID associated with the identification information of the relay terminal can be the same as the PLMN ID associated with the first UE, or it can be different.
  • PLMN Public Land Mobile Network
  • a preset message is sent to a first functional network element associated with a first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capabilities; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; a DCR message is broadcast; the information carried by the DCR message is protected by security information; and a communication connection is established with a second UE through a relay terminal that responds to the DCR message.
  • a preset message is sent to a first functional network element associated with a first UE; the preset message carries at least one of the following: RSC, identification information of the first UE, and security capabilities; identification information of at least one relay terminal is provided to the first functional network element; the identification information of the relay terminal is used for the first functional network element to obtain corresponding security parameters and/or security algorithms; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; a DCR message is broadcast; the information carried by the DCR message is protected by security information; a communication connection is established with the second UE through the relay terminal that responds to the DCR message.
  • the first functional network element can directly obtain the corresponding security parameters and/or security algorithms, thereby ensuring that the first UE obtains the same security information matching the RSC as the relay terminal.
  • establishing a communication connection with a second UE through a relay terminal that responds to a DCR message may include: after a direct authentication and key generation process initiated by a target relay terminal among multiple relay terminals that respond to the DCR message is completed, receiving a security mode command message sent by the target relay terminal; verifying the integrity of the security mode command message, and returning a security mode completion message to the target relay terminal after the verification is passed; upon receiving a direct communication acceptance message sent by the target relay terminal, establishing a communication connection with the second UE through the target relay terminal.
  • the direct authentication and key generation process initiated by the target relay terminal can be used to generate an intermediate key (Knrp).
  • the security mode command message received by the first UE may be a security mode command message protected by an integrity key generated based on the intermediate key.
  • establishing a communication connection with a second UE through a relay terminal that responds to a DCR message may include: after a direct authentication and key generation process initiated by a target relay terminal among multiple relay terminals that respond to the DCR message is completed, receiving a security mode command message sent by the target relay terminal; verifying the integrity of the security mode command message based on the integrity key and/or security algorithm generated by the intermediate key, and returning a security mode completion message to the target relay terminal after the verification is passed; upon receiving a direct communication acceptance message sent by the target relay terminal, establishing a communication connection with the second UE through the target relay terminal.
  • the security algorithm here may be a security algorithm for protecting communication, which may be different from the security algorithm in the security information for discovery obtained in the aforementioned embodiment, such as the PC5 security algorithm, etc., or may be the same as the security algorithm in the security information for discovery obtained in the aforementioned embodiment.
  • the security mode completion message returned by the first UE to the target relay terminal is used to indicate that the first UE responds to access the U2U relay communication.
  • establishing a communication connection with the second UE through the target relay terminal may include establishing a radio resource control layer (L3) PC5 communication link with the second UE through the target relay terminal.
  • L3 radio resource control layer
  • step S102 can be combined with steps S110, S101 and S120 to form a new technical solution, or can be combined with any one of steps S110, S111 and step S101 or any specific implementation method.
  • an embodiment of the present disclosure provides a communication control method, which is executed by a relay terminal.
  • the method may include:
  • a request is made to a second functional network element associated with the relay terminal to obtain security information.
  • a preset message is sent to a second functional network element associated with the relay terminal; the preset message carries at least one of the following: RSC, identification information of the relay terminal, and security capability.
  • a request is made to obtain security information; and a message carrying the security information is received.
  • security information is requested; a message carrying security information is received; a DCR message broadcast by the first UE is obtained; and information carried in the DCR message is protected by security information.
  • security information is requested; a message carrying security information is received; a DCR message broadcast by the first UE is obtained; information carried in the DCR message is protected by security information; and a communication connection between the first UE and the second UE is established based on the DCR message.
  • an embodiment of the present disclosure provides a communication control method, which is executed by a relay terminal.
  • the method may include:
  • step S202 may be combined with the aforementioned step S201, or may be combined with any specific implementation of S201.
  • the method may include: requesting to obtain security information; receiving a message carrying security information.
  • the method may include: sending a preset message to a second functional network element associated with the relay terminal; the preset message carries at least one of the following: RSC, identification information of the relay terminal, and security capability; receiving a message carrying security information.
  • step S202 can be combined with the aforementioned steps S101, S102, S110 and S120 to form a new technical solution, or can be combined with S201 and then combined with steps S101, S102, S110 and S120 to form a technical solution.
  • the security information may be used to establish a communication connection between the first UE and the second UE through the relay terminal.
  • a message carrying security information sent by a second functional network element associated with the relay terminal is received.
  • a response message sent by a second functional network element associated with the relay terminal is received; the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • the present disclosure provides a communication control method, which is performed by a relay terminal.
  • the method may include:
  • a request is made to obtain security information; and a message carrying the security information and sent by a second functional network element associated with the relay terminal is received.
  • a request is made to obtain security information; a response message sent by a second functional network element associated with the relay terminal is received; and the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • a request is made to a second functional network element associated with the relay terminal to obtain security information; and a message carrying the security information and sent by the second functional network element associated with the relay terminal is received.
  • a request is made to obtain security information from a second functional network element associated with the relay terminal; a response message sent by the second functional network element associated with the relay terminal is received; and the response message carries security information matching the RSC.
  • the RSC may be a code corresponding to the current relay service.
  • an embodiment of the present disclosure provides a communication control method, which is executed by a relay terminal.
  • the method may include:
  • S210 Acquire a DCR message broadcast by the first UE; information carried in the DCR message is protected by security information.
  • a DCR message broadcast by the first UE is obtained; information carried in the DCR message is protected by security information, wherein identification information of the first UE and identification information of the second UE carried in the DCR message may be protected by security information used for discovery.
  • the security information may include: security parameters and/or security algorithms, and the identification information of the first UE and identification information of the second UE carried in the DCR message may be protected by security parameters based on security algorithms.
  • a DCR message broadcasted by the first UE within a preset range is obtained; information carried in the DCR message is protected by security information.
  • the preset range may be a signal coverage range of the first UE, and broadcasting the DCR message within the preset range may include: broadcasting the DCR message to all relay terminals within the signal coverage range.
  • the DCR message is used to request to establish a direct communication connection with the second UE, such as establishing PC5 unicast communication through the relay terminal.
  • a DCR message broadcast by a first UE within a signal coverage area is obtained; information carried in the DCR message is protected by security information.
  • the DCR message is used to request to establish a communication connection between the first UE and the second UE, such as establishing PC5 communication through a relay terminal.
  • the DCR message used to establish the communication link is protected by the security information used for discovery, thereby improving the security of the communication link between the first UE and the second UE based on the relay device.
  • the resource overhead generated by the first UE currently needing to connect to the second UE selecting the relay terminal can be saved.
  • step S110 for the content and explanation of the DCR message and the security information, please refer to the explanation and description made in step S110, which will not be repeated here.
  • the present disclosure provides a communication control method, which is performed by a relay terminal.
  • the method may include:
  • a DCR message broadcast by the first UE is obtained; information carried by the DCR message is protected by security information.
  • a communication connection between the first UE and the second UE is established in response to the DCR message.
  • security information is obtained; a DCR message broadcast by the first UE is obtained; information carried by the DCR message is protected by the security information; and a communication connection between the first UE and the second UE is established in response to the DCR message.
  • security information for discovery is obtained; a DCR message broadcast by the first UE is obtained; information carried by the DCR message is protected by security information; and a communication connection between the first UE and the second UE is established in response to the DCR message.
  • it may be a discovery request process initiated to the second functional network element associated with the relay terminal.
  • the relay terminal determines security information in the discovery request process, which may include the relay terminal sending a discovery request message to the associated second functional network element and receiving security information returned by the second functional network element.
  • the second functional network element associated with the relay terminal may be a DDNMF or PKMF associated with the relay terminal.
  • the discovery request message may carry at least one of the following: an RSC supported by the relay terminal, identification information of the relay terminal, and security capabilities.
  • the security information for discovery may include: security parameters and/or security algorithms, wherein the security parameters may be code security parameters corresponding to the RSC, code sending security parameters, code receiving security parameters, etc., and the security algorithm may be a discovery encryption algorithm corresponding to the RSC, etc.
  • the information carried by the DCR message is protected by security information for discovery, for example, the information carried by the DCR message may be protected by security parameters based on a security algorithm, etc.
  • a preset message is sent to a second functional network element associated with a relay terminal; the preset message carries at least one of the following: identification information, RSC, and security capability of the relay terminal; security information returned by the second functional network element based on the preset message is received; a DCR message broadcast by the first UE is obtained; the information carried by the DCR message is protected by security information; a communication connection between the first UE and the second UE is established in response to the DCR message.
  • sending a preset message to the second functional network element associated with the relay terminal may be sending a preset message to a DDNMF or PKMF associated with the relay terminal, wherein the preset message may be a discovery request message for requesting security information.
  • the security capability is the security capability of the relay terminal, for example, it may be the first security capability corresponding to the relay terminal in the discovery phase.
  • the first security capability may be the PC5 security capability, in which the security algorithms supported by the relay terminal may be recorded, for example, in the form of a security algorithm list, etc.
  • the identification information may be a user information ID, for example, the user information ID may be in a network access identifier (NAI) format or a 64-bit string format.
  • the user information ID may indicate a corresponding PLMN, for example, the user information ID may include a home network identifier (HPLMN ID).
  • HPLMN ID home network identifier
  • a preset message is sent to a second functional network element associated with a relay terminal; the preset message carries at least one of the following: identification information, RSC, and security capability of the relay terminal; security information and preset parameters returned by the second functional network element based on the preset message are received; a DCR message broadcast by the first UE is obtained; information carried by the DCR message is protected by security information; a communication connection between the first UE and the second UE is established in response to the DCR message.
  • the preset parameters may indicate the current time and/or message offset, etc., and may include, for example, a CURRENT_TIME parameter and a MAX_OFFSET parameter.
  • the security information returned by the second functional network element based on the preset message received by the relay terminal may be security information that matches the RSC and security capabilities in the preset message sent by the relay terminal.
  • the security algorithm in the security information may match the RSC in the preset message sent by the relay terminal and belong to the list of security algorithms supported by the relay terminal recorded in the security capabilities of the relay terminal.
  • a DCR message broadcast by a first UE is obtained; information carried in the DCR message is protected by security information; after responding to the DCR message and being selected as a target relay terminal among multiple relay terminals that respond to the DCR message, a communication connection between the first UE and the second UE is established.
  • being selected as a target relay terminal among multiple relay terminals that respond to the DCR message may be being selected as a target relay terminal by the second UE among multiple relay terminals that respond to the DCR message.
  • a DCR message broadcast by the first UE is obtained; information carried in the DCR message is protected by security information; in response to the DCR message, a communication connection is established with the second UE after completing direct authentication and key generation processes with the first UE and the second UE.
  • a DCR message broadcast by a first UE is obtained; information carried by the DCR message is protected by security information; the DCR message is verified based on security parameters; if the verification is successful and the RSC carried by the DCR message is consistent with the RSC of the relay terminal, a new DCR message is broadcast; the new DCR message carries at least one of the following: identification information and security capability of the first UE, identification information of the second UE, identification information and RSC of the relay terminal, a credential ID, and a second random number; when a feedback message from the second UE receiving the new DCR message is detected, a communication connection between the first UE and the second UE is established.
  • a DCR message broadcast by a first UE is obtained; the information carried by the DCR message is protected by security information; the DCR message is verified based on security parameters, and based on the RSC, it is determined whether the relay terminal is authorized to provide the relay service corresponding to the RSC; if the verification is successful and the RSC carried by the DCR message is consistent with the RSC of the relay terminal, a new DCR message is broadcast; the new DCR message carries at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, identification information of the relay terminal and RSC, credential ID and a second random number; when a feedback message from the second UE receiving the new DCR message is detected, a communication connection between the first UE and the second UE is established. For example, ProSe is used to compare the RSC in the DCR message with the RSC supported by the relay terminal.
  • broadcasting a new DCR message may include: if the verification is successful and the relay terminal is authorized to provide the relay service, when the RSC carried in the DCR message is consistent with the RSC supported by the relay terminal, broadcasting a new DCR message.
  • the new DCR message may be a DCR message received by the relay terminal and broadcast by the first UE with identification information of the relay terminal added thereto.
  • the information carried by the new DCR message may be protected by security information used for discovery, for example, by security parameters based on a security algorithm.
  • the identification information of the first UE, the identification information of the second UE, and the identification information of the relay terminal in the new DCR message may be protected by security information used for discovery, for example, by security parameters based on a security algorithm.
  • a message of a second UE receiving a new DCR message is detected, and a relay terminal can be selected as a target relay terminal for providing a relay service for the second UE that detects the reception of the new DCR message.
  • a relay terminal can be selected as a target relay terminal for providing a relay service for the second UE that detects the reception of the new DCR message. For example, when there are a first relay terminal and a second relay terminal within the signal coverage of the first UE, after the first relay terminal and the second relay terminal broadcast a new DCR message, if the second UE selects the second relay terminal as the target relay terminal, the second relay terminal can receive the message of the second UE and be used to establish a communication connection between the first UE and the second UE.
  • a DCR message broadcast by a first UE is obtained; information carried in the DCR message is protected by security information; the DCR message is verified based on security parameters; if the verification is successful and the RSC carried in the DCR message is consistent with the RSC of the relay terminal, a new DCR message is broadcast; the new DCR message carries at least one of the following: identification information and security capability of the first UE, identification information of the second UE, identification information and RSC of the relay terminal, a credential ID and a second random number; when a feedback message of a second UE receiving the new DCR message is detected, after the direct authentication and key generation process with the second UE is completed, in response to the security mode command message of the second UE, a security mode completion message is returned to the second UE; in response to the direct communication acceptance message of the second UE, after the direct authentication and key generation process with the first UE is completed, a security mode command message is sent to the first UE; when the security mode completion message returned by the first UE
  • the security mode command message of the second UE may include a security algorithm selected by the second UE, where the security algorithm may be an algorithm for protecting the communication connection between the target relay device and the second UE, for example, a second security algorithm that is the same as or different from the first security algorithm in the security information of the UE discovery phase.
  • the second security algorithm may also be used to protect the security mode command message, for example, the second security algorithm may be a PC5 security algorithm, etc.
  • the direct authentication and key generation process between the target relay terminal and the second UE can be used to generate an intermediate key (Knrp).
  • the security mode command message of the second UE can be a security mode command message protected by an integrity key generated by the second UE based on the intermediate key.
  • a DCR message broadcast by a first UE is obtained; the information carried by the DCR message is protected by security information; the DCR message is verified based on security parameters; if the verification is successful and the RSC carried by the DCR message is consistent with the RSC of the relay terminal, a new DCR message is broadcast; the new DCR message carries at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, identification information of the relay terminal and RSC, credential ID and a second random number; when a feedback message of the second UE receiving the new DCR message is detected, after the direct authentication and key generation process with the second UE is completed, in response to the security mode command message of the second UE, the integrity of the security mode command message is verified; if the verification is successful, a security mode completion message is returned to the second UE; in response to the direct communication acceptance message of the second UE, after the direct authentication and key generation process with the first UE is completed, a security mode command message is sent to the
  • verifying the integrity of the security mode command message may include verifying the integrity of the security mode command message based on the integrity key and/or security algorithm corresponding to the intermediate key.
  • the security algorithm here may be a security algorithm for protecting communications, which may be different from the security algorithm in the security information used for discovery obtained in the aforementioned embodiment, for example, it may be a PC5 security algorithm, etc., or it may be the same as the security algorithm in the security information used for discovery obtained in the aforementioned embodiment.
  • the relay terminal in response to the direct communication acceptance message of the second UE, may initiate a direct authentication and key generation process with the first UE.
  • the direct authentication and key generation process between the target relay terminal and the first UE may be used to generate an intermediate key (Knrp).
  • the security mode command message sent to the first UE may be a security mode command message protected by an integrity key generated by the relay terminal based on the intermediate key.
  • establishing a communication connection between the first UE and the second UE may be establishing an L3PC5 communication link between the first UE and the second UE.
  • the communication security between the first UE and the second UE based on the U2U relay can be improved, and the overall security can be improved in the discovery and link establishment phase.
  • the resource overhead generated by the first UE currently needing to connect to the second UE selecting the relay terminal can be saved.
  • step S110 For obtaining the content of the DCR message broadcast by the first UE, please refer to the explanation and description made in step S210. No further details will be given here.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a second UE.
  • the method may include:
  • a request is made to a first functional network element associated with the second UE to obtain security information.
  • a preset message is sent to the first functional network element associated with the second UE; the preset message carries at least one of the following: RSC, identification information of the second UE, and security capability.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a second UE.
  • the method may include:
  • S302 Receive a message carrying security information.
  • the security information may be used to establish a communication connection between the second UE and the second UE through the relay terminal.
  • a message carrying security information sent by a first functional network element associated with a second UE is received.
  • a response message sent by a first functional network element associated with the second UE is received; the response message carries security information matching the RSC.
  • the RSC may be an RSC corresponding to a relay service provided by the second UE.
  • the present disclosure provides a communication control method, which is performed by a second UE.
  • the method may include:
  • a request is made to obtain security information; and a message carrying security information sent by a first functional network element associated with the second UE is received.
  • request to obtain security information receive a response message sent by the first functional network element associated with the second UE; the response message carries security information matching the RSC.
  • the RSC may be the RSC corresponding to the relay service provided by the second UE.
  • a request is made to a first functional network element associated with the second UE to obtain security information; and a message carrying the security information sent by the first functional network element associated with the second UE is received.
  • a request is made to the first functional network element associated with the second UE to obtain security information; a response message sent by the first functional network element associated with the second UE is received; the response message carries security information matching the RSC.
  • the RSC may be the RSC corresponding to the relay service provided by the second UE.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a second UE.
  • the method may include:
  • S310 receiving a new DCR message broadcasted by multiple relay terminals based on the DCR message of the first UE; information carried in the DCR message is protected by security information.
  • a preset message is sent to the first functional network element associated with the second UE; the preset message carries at least one of the following: RSC, identification information of the second UE, and security capabilities; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; the security information includes: security information determined by the relay terminal during the discovery request process; a new DCR message broadcast by multiple relay terminals based on the DCR message of the first UE is received; the information carried by the DCR message is protected by security information.
  • the first functional network element associated with the second UE may be a DDNMF or PKMF associated with the second UE, etc.
  • the preset message may carry at least one of the following: RSC, identification information of the second UE, and security capabilities.
  • sending a preset message to the first functional network element associated with the second UE may be sending a preset message to the DDNMF or PKMF associated with the second UE, wherein the preset message may be a discovery request message for obtaining security information, and the RSC carried in the preset message may be the RSC corresponding to the relay service supported by the second UE, and the RSC may be used to determine the relay terminal that meets the relay service specified or expected by the second UE.
  • the response message may be a discovery response message returned by the first functional network element based on the discovery request message.
  • the response message may carry security information obtained by the first functional network element that matches the RSC in the preset message.
  • Security information that matches the RSC may also match the RSC and the security capabilities of the second UE.
  • the security algorithm in the security information that matches the RSC may be a list of security algorithms supported by the second UE that belongs to the security capability record of the second UE.
  • the security capability is the security capability of the second UE, for example, it may be the first security capability corresponding to the second UE in the discovery phase.
  • the first security capability may be the PC5 security capability, and the security algorithms supported by the second UE may be recorded in the first security capability, for example, in the form of a security algorithm list.
  • the second UE receives a response message returned by the first functional network element, or the second UE may also receive a rejection message returned by the first functional network element, wherein the rejection message indicates that the second UE is not authorized to use the relay service corresponding to the RSC.
  • a preset message is sent to a first functional network element associated with a second UE; the preset message carries at least one of the following: RSC, identification information of the second UE, and security capability; identification information of at least one relay terminal is stored in an application container for the first functional network element to read; the identification information of the relay terminal is used for the first functional network element to obtain corresponding security parameters and/or security algorithms; a response message returned by the first functional network element is received; the response message carries security information matching the RSC; the security information includes: security information determined by the relay terminal during the discovery request process; a new DCR message broadcasted by multiple relay terminals based on the DCR message of the first UE is received; the information carried by the DCR message is protected by security information.
  • the second functional network element associated with the identification information of the relay terminal can be the same as the first functional network element associated with the first UE, or it can be different from the first functional network element. That is, the Public Land Mobile Network (PLMN) ID associated with the identification information of the relay terminal can be the same as the PLMN ID associated with the first UE, or it can be different.
  • PLMN Public Land Mobile Network
  • the communication security between the first UE and the second UE based on the U2U relay can be improved, and the overall security can be improved in the discovery and link establishment phase.
  • the resource overhead generated by the first UE currently needing to connect to the second UE selecting the relay terminal can be saved.
  • step S110 for the content and explanation of the DCR message and the security information, please refer to the explanation and description made in step S110, which will not be repeated here.
  • the present disclosure provides a communication control method, which is performed by a second UE.
  • the method may include:
  • the preset message carries at least one of the following: the RSC, identification information of the second UE, and security capability;
  • the security information includes: security information determined by the relay terminal during the discovery request process
  • a communication connection is established with the first UE through the relay terminal based on security information; the information carried by the DCR message is protected by security information.
  • a communication connection is established with the first UE through the relay terminal based on the security information; the information carried by the DCR message is protected by the security information.
  • the DCR message is used to request the establishment of a communication connection between the first UE and the second UE, for example, to establish PC5 communication through the relay terminal.
  • step S310 for the definition and description of the security information and the DCR message, please refer to the relevant description of step S310, which will not be repeated here.
  • the new DCR message is verified based on security parameters; if the verification is successful, a target relay terminal is determined among the multiple relay terminals based on the performance parameters of the multiple relay terminals; a communication connection is established with the first UE through the target relay terminal; and the information carried by the DCR message is protected by security information.
  • the multiple relay terminals may be multiple relay terminals that receive the DCR message of the first UE, or may be multiple relay terminals that broadcast new DCR messages.
  • the second UE selects a target relay terminal from the multiple relay terminals corresponding to the received new DCR message.
  • the performance parameters of the relay terminal may include quality of service (QoS), etc.
  • establishing a communication connection with the first UE through the target relay terminal may include: sending a feedback message to the determined target relay terminal, and establishing a communication connection with the first UE through the target relay terminal.
  • establishing a communication connection with the first UE through the target relay terminal includes: after the direct authentication and key generation process with the target relay terminal is completed, sending a security mode command message to the target relay terminal; when receiving the security mode completion message returned by the target relay terminal, sending a direct communication acceptance message; after the target relay terminal and the first UE complete the direct authentication and key generation process, establishing a communication connection with the first UE through the target relay terminal.
  • the direct authentication and key generation process with the target relay terminal can be initiated by the target relay terminal after sending a feedback message to the target relay terminal.
  • the second UE can obtain the root key.
  • the new DCR message is verified based on security parameters; if the verification is successful, a target relay terminal is determined among the multiple relay terminals; after the direct authentication and key generation process with the target relay terminal is completed, a confidentiality key (New Radio PC5Encryption Key, NRPEK) and an integrity key (New Radio PC5Integrity Key, NRPIK) are derived based on the root key; a security mode command message is generated based on NRPEK and NRPIK, and the security mode command message is sent to the target relay terminal; when the security mode completion message returned by the target relay terminal is received, a direct communication acceptance message is sent; after the target relay terminal completes the direct authentication and key generation process with the first UE, a communication connection is established with the first UE through the target relay terminal.
  • NRPEK New Radio PC5Encryption Key
  • NRPIK New Radio PC5Integrity Key
  • the security mode command message may include a security algorithm selected by the second UE.
  • the security algorithm here may be an algorithm used to protect the communication connection between the first UE and the second UE. For example, it may be a second security algorithm that is different from the first security algorithm in the security information in the UE discovery phase.
  • the second security algorithm may also be used to protect the security mode command message.
  • the second security algorithm may be a PC5 security algorithm, etc.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a first functional network element.
  • the method may include:
  • S410 Provide security information to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the first functional network element may be a function such as DDNMF or PKMF associated with the first UE and/or the second UE, and the first functional network element associated with the first UE may be the same as or different from the first functional network element associated with the second UE.
  • the security information may be used to protect the information in the DCR message broadcast by the first UE.
  • a response message is returned to the first UE and/or the second UE; the response message carries security information that matches the RSC and matches the security capabilities of the first UE and/or the second UE; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the security information may include: security parameters and security algorithms, wherein the security parameters may be code security parameters, code transmission security parameters, code reception security parameters, etc. corresponding to the RSC, and the security algorithm may be a discovery encryption algorithm corresponding to the RSC, etc.
  • security parameters may be code security parameters, code transmission security parameters, code reception security parameters, etc. corresponding to the RSC
  • the security algorithm may be a discovery encryption algorithm corresponding to the RSC, etc.
  • the information carried by the DCR message is protected by security information, for example, the information carried by the DCR message may be protected by security parameters based on a security algorithm, etc.
  • the security information may include: security information determined by the relay terminal during the discovery request process, and the security information may be obtained by the first functional network element from the second functional network element associated with the relay terminal. For example, if the first functional network element receives the identification information of the relay terminal during the discovery request process, it obtains the stored security information from the second functional network element associated with the identification information.
  • security information is provided to the first UE and/or the second UE; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a first functional network element.
  • the method may include:
  • S401 Receive a preset message of a first UE and/or a second UE associated with a first functional network element; the preset message carries at least one of the following: an RSC, identification information of the first UE and/or the second UE, and security capabilities.
  • step S401 can be combined with step S410 to form a method including: receiving a preset message of the first UE and/or the second UE associated with the first functional network element; the preset message carries at least one of the following: RSC, identification information of the first UE and/or the second UE, and security capabilities; providing security information to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the preset message may be a discovery request message for requesting access to the U2U relay service
  • the RSC carried in the preset message may be the RSC corresponding to the relay service supported by the first UE and/or the second UE, and the RSC may be used to determine the relay terminal that complies with the relay service supported by the first UE and/or the second UE.
  • the security capability is the security capability of the first UE, for example, it may be the first security capability corresponding to the first UE in the discovery phase.
  • the first security capability may be the security capability of the direct communication interface PC5, and the security algorithms supported by the first UE may be recorded in the first security capability, for example, it may be recorded in the form of a security algorithm list, etc.
  • the security information matching the RSC may include security parameters and/or security algorithms corresponding to the RSC.
  • the security information carried in the response message may be security information used for discovery determined by the relay terminal during the discovery request process.
  • a response message is returned to the first UE and/or the second UE; the response message carries security information matching the RSC; and the security information is used by the first UE and the second UE to establish a communication connection through the relay terminal.
  • a preset message of a first UE and/or a second UE associated with a first functional network element is received; the preset message carries at least one of the following: RSC, identification information of the first UE and/or the second UE, and security capability; a response message is returned to the first UE and/or the second UE; the response message carries security information that matches the RSC and matches the security capability of the first UE and/or the second UE; the security information is used for the first UE and the second UE to establish a communication connection through a relay terminal.
  • the security algorithm carried in the response message returned to the first UE belongs to the list of security algorithms indicated by the security capability of the first UE; the security algorithm carried in the response message returned to the second UE belongs to the list of security algorithms indicated by the security capability of the second UE.
  • a preset message of a first UE and/or a second UE associated with a first functional network element is received; the preset message carries at least one of the following: RSC, identification information of the first UE and/or the second UE, and security capability; a response message is returned to the first UE and/or the second UE; the response message carries security information matching the RSC; the security information is used for the first UE and the second UE to establish a communication connection through a relay terminal; if there is no security information matching the RSC in the preset message, a rejection message is returned to the first UE and/or the second UE. The rejection message is used to indicate that the first UE and/or the second UE is not authorized to use the relay service corresponding to the RSC.
  • an authentication request is sent to the ProSe application server; if an authentication pass message is received from the ProSe application server, security information is determined; security information is provided to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • an authentication request carrying identification information of the first UE and/or the second UE is sent to a ProSe application server; if an authentication pass message returned by the ProSe application server is received, security information is determined; security information is provided to the first UE and/or the second UE associated with the first functional network element; and the security information is used for the first UE and the second UE to establish a communication connection through a relay terminal.
  • the authentication request may carry user information IDs of the first UE and/or the second UE.
  • the authentication pass message returned by the ProSe application server may indicate that the first UE and/or the second UE has the authority to access the U2U relay service, and may then continue to determine the corresponding security information for the relay service.
  • an authentication request is sent to the ProSe application server; if an authentication pass message is received from the ProSe application server, the security information determined by the relay terminal during the discovery request process is obtained; the security information is provided to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • an authentication request is sent to the ProSe application server; if an authentication success message is received from the ProSe application server, the identification information of at least one relay terminal provided by the first UE and/or the second UE is obtained; when the PLMN indicated by the identification information of the relay terminal is different from the PLMN corresponding to the first functional network element, the security parameters and security algorithms determined by the relay terminal in the discovery request process are obtained from the second functional network element associated with the identification information of the relay terminal; when the PLMN indicated by the identification information of the relay terminal is the same as the PLMN corresponding to the first functional network element, the security parameters and security algorithms determined by the relay terminal in the discovery request process are queried in the local storage of the first functional network element.
  • security information is determined based on the security parameters, security algorithm, and RSC corresponding to the security algorithm; security information is provided to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a second functional network element.
  • the method may include:
  • S510 Provide security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • security information is provided to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the discovery request message may carry at least one of the following: an RSC corresponding to the relay terminal, identification information of the relay terminal, and security capabilities.
  • an embodiment of the present disclosure provides a communication control method, which is performed by a second functional network element.
  • the method may include:
  • S501 Receive a preset message of a relay terminal associated with a second functional network element; the preset message carries at least one of the following: identification information, RSC, and security capability of the relay terminal.
  • step S501 can be combined with step S510 to form a technical solution including: receiving a preset message from a relay terminal associated with a second functional network element; the preset message carries at least one of the following: identification information, RSC and security capabilities of the relay terminal; providing security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the authentication pass message returned by the ProSe application server may indicate that the relay terminal has the authority to provide U2U relay service, and may then continue to determine the corresponding security information to provide relay service.
  • a preset message of a relay terminal associated with a second functional network element is received; the preset message carries at least one of the following: identification information, RSC and security capability of the relay terminal; the security algorithm of the relay terminal is determined based on a list of algorithms supported by the relay terminal indicated by the security capability; an authentication request carrying the identification information of the relay terminal and the RSC is sent to a ProSe application server; if an authentication pass message is received from the ProSe application server, security information is determined based on the security algorithm, security parameters of the relay terminal and the RSC; and the security information and the RSC corresponding to the relay terminal are returned to the relay terminal.
  • a preset message of a relay terminal associated with a second functional network element is received; the preset message carries at least one of the following: identification information, RSC, and security capability of the relay terminal; a security algorithm of the relay terminal is determined based on a list of algorithms supported by the relay terminal indicated by the security capability; an authentication request carrying the identification information of the relay terminal and the RSC is sent to a ProSe application server; if an authentication pass message is received from the ProSe application server, security information is determined based on the security algorithm, security parameters of the relay terminal, and RSC; security information and the RSC corresponding to the relay terminal are returned to the relay terminal, and the security information is stored together with the RSC of the relay terminal.
  • the second functional network element can be stored locally in the form of a binding relationship or a mapping relationship.
  • the present disclosure provides a communication control method, which is executed by a ProSe application server.
  • the method includes:
  • the first functional network element When receiving the authentication request sent by the first functional network element, determining whether the first UE and/or the second UE has the authority to access the U2U relay service based on the identification information of the first UE and/or the second UE in the authentication request;
  • the relay terminal upon receiving an authentication request sent by the second functional network element, determining whether the relay terminal has the authority to provide the U2U relay service based on the identification information of the relay terminal in the authentication request and the RSC;
  • the present disclosure provides a communication control method, the method comprising:
  • the first function network element provides security information to the first UE and/or the second UE associated with the first function network element;
  • the second functional network element provides security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the first functional network element receives a preset message of the first UE and/or the second UE associated with the first functional network element; the preset message carries at least one of the following: RSC, identification information of the first UE and/or the second UE, and security capability; returns a response message to the first UE and/or the second UE; the response message carries security information matching the RSC;
  • the second functional network element receives a preset message of the relay terminal associated with the second functional network element; the preset message carries at least one of the following: identification information, RSC and security capability of the relay terminal; based on the list of algorithms supported by the relay terminal indicated by the security capability, the security algorithm of the relay terminal is determined; based on the identification information and RSC of the relay terminal, an authentication request is sent to the proximity service ProSe application server; if an authentication pass message is received from the ProSe application server, security information is determined based on the security algorithm, security parameters of the relay terminal and RSC; and security information is returned to the relay terminal.
  • step S410 for the actions performed by the first functional network element and related instructions, please refer to step S410 and its related steps, and for the actions performed by the second functional network element and related instructions, please refer to step S510 and its related steps.
  • the present disclosure provides a communication control method, the method comprising:
  • the relay terminal requests the second functional network element associated with the relay terminal to obtain security information
  • the second functional network element provides security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the relay terminal sends a preset message to the second functional network element associated with the relay terminal; the preset message carries at least one of the following: RSC, identification information of the relay terminal, and security capabilities; the second functional network element provides security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the relay terminal sends a preset message to the second functional network element associated with the relay terminal; the preset message carries at least one of the following: RSC, identification information of the relay terminal, and security capability; after the second functional network element performs authentication based on the preset message, it provides security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • a preset message of a relay terminal associated with a second functional network element is received; the preset message carries at least one of the following: identification information, RSC and security capability of the relay terminal; the security algorithm of the relay terminal is determined based on a list of algorithms supported by the relay terminal indicated by the security capability; an authentication request carrying the identification information of the relay terminal and the RSC is sent to a ProSe application server; if an authentication pass message is received from the ProSe application server, security information is determined based on the security algorithm, security parameters of the relay terminal and the RSC; the security information and the RSC corresponding to the relay terminal are returned to the relay terminal, and the security information is stored together with the RSC of the relay terminal.
  • the present disclosure provides a communication control method, the method comprising:
  • the first function network element sends an authentication request to the ProSe application server based on the identification information of the first UE and/or the second UE; if an authentication pass message returned by the ProSe application server is received, security information is provided to the first UE and/or the second UE associated with the first function network element;
  • the second functional network element sends an authentication request to the ProSe application server based on the identification information of the relay terminal and the RSC; if an authentication pass message is received from the ProSe application server, security information is returned to the relay terminal; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal;
  • the ProSe application server When the ProSe application server receives an authentication request sent by the first functional network element, it determines whether the first UE and/or the second UE has the authority to access the U2U relay service based on the identification information of the first UE and/or the second UE in the authentication request; if so, it returns an authentication pass message to the first functional network element; and/or, when it receives an authentication request sent by the second functional network element, it determines whether the relay terminal has the authority to provide the U2U relay service based on the identification information of the relay terminal in the authentication request and the RSC; if so, it returns an authentication pass message to the second functional network element.
  • the present disclosure provides a communication control method, the method comprising:
  • the first UE broadcasts a DCR message; the information carried by the DCR message is protected by security information; the security information includes: security parameters and/or security algorithms;
  • the first relay terminal and the second relay terminal obtain the DCR message broadcast by the first UE, and verify the DCR message based on the security parameter; if the verification is successful, a new DCR message is broadcast;
  • the second UE obtains a new DCR message broadcasted by the first relay terminal and the second relay terminal, and determines that the second relay terminal is a target relay terminal;
  • the second relay terminal establishes a communication connection between the first UE and the second UE.
  • the first UE broadcasts a DCR message; the information carried in the DCR message is protected by security information; after a direct authentication and key generation process initiated by a target relay terminal among multiple relay terminals that respond to the DCR message is completed, a security mode command message sent by the target relay terminal is received; the integrity of the security mode command message is verified based on the integrity key and/or security algorithm generated by the intermediate key, and a security mode completion message is returned to the target relay terminal after the verification is passed; when a direct communication acceptance message sent by the target relay terminal is received, a communication connection is established with the second UE through the target relay terminal;
  • the first relay terminal obtains the DCR message broadcast by the first UE; the information carried in the DCR message is protected by security information; the DCR message is verified based on the security parameter; if the verification is successful and the RSC carried in the DCR message is consistent with the RSC of the first relay terminal, a new DCR message is broadcast; the new DCR message carries at least one of the following: identification information and security capability of the first UE, identification information of the second UE, identification information and RSC of the relay terminal, credential ID and a second random number;
  • the second relay terminal obtains the DCR message broadcast by the first UE, and the information carried in the DCR message is protected by security information; the DCR message is verified based on the security parameter; if the verification is successful and the RSC carried by the DCR message is consistent with the RSC of the second relay terminal, a new DCR message is broadcast;
  • the second UE obtains a new DCR message broadcasted by the first relay terminal and the second relay terminal; verifies the new DCR message based on the security parameter; if the verification is successful, determines that the second relay terminal is a target relay terminal based on the performance parameters of the first relay terminal and the second relay terminal; and sends a feedback message to the target relay terminal;
  • the second relay terminal After receiving the feedback message, the second relay terminal establishes a communication connection between the first UE and the second UE.
  • step S110 and its related steps for the actions performed by the first UE and related instructions, please refer to step S110 and its related steps, for the actions performed by the first relay terminal and the second relay terminal and related instructions, please refer to step S210 and its related steps, and for the actions performed by the second UE and related instructions, please refer to step S310 and its related steps.
  • the embodiment of the present disclosure provides a communication control system, including: a first UE, a relay terminal, a second UE, a first functional network element and/or a second functional network element;
  • the first UE is used to broadcast a DCR message; the information carried by the DCR message is protected by security information; and a communication connection is established with the second UE through a relay terminal that responds to the DCR message;
  • a relay terminal configured to obtain a DCR message broadcast by a first UE; information carried in the DCR message is protected by security information; and a communication connection is established between the first UE and the second UE in response to the DCR message;
  • the second UE is configured to establish a communication connection with the first UE through the relay terminal based on the security information when receiving a new DCR message broadcast by multiple relay terminals based on the DCR message of the first UE; the information carried by the DCR message is protected by the security information;
  • the first functional network element is at least used to provide security information to a first UE and/or a second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal;
  • the second functional network element is at least used to provide security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the first functional network element and the second functional network element may be the same functional network element or different functional network elements.
  • the communication control system may include the first functional network element or the second functional network element, and at this time, the first functional network element or the second functional network element may be used to provide security information to the associated first UE and/or second UE and to provide security information to the relay terminal associated with the second functional network element; when the first functional network element and the second functional network element are different functional network elements, the communication control system may include the first functional network element and the second functional network element.
  • step S110 and its related steps for the actions performed by the first relay terminal and the second relay terminal and related instructions, please refer to step S210 and its related steps, for the actions performed by the second UE and related instructions, please refer to step S310 and its related steps, for the actions performed by the first functional network element and related instructions, please refer to step S410 and its related steps, and for the actions performed by the second functional network element and related instructions, please refer to step S510 and its related steps.
  • an embodiment of the present disclosure provides a communication control method, which can be applied to U2U relay communication and can also be used for ranging/sidelink positioning services.
  • the first UE i.e., the source UE
  • the second UE i.e., the target UE
  • the relay terminal can be used as an auxiliary UE.
  • the present disclosure provides a communication control method, including:
  • the relay terminal sends a discovery request message including its user information ID and relay service code (RSC) to the second function network element DDNMF or PKMF to obtain the associated security information.
  • RSC relay service code
  • the relay terminal includes PC5 security capabilities, which include a list of security algorithms supported by the relay terminal indicated in the discovery request message.
  • the user information ID is in the form of a NAI format or a 64-bit string. If the user information ID is in the NAI format, such as "username@realm", the "realm” part should include the home network identifier (i.e., HPLMN ID).
  • NAI format such as "username@realm”
  • HPLMN ID home network identifier
  • the present disclosure provides a communication control method, including:
  • the second function network element may interact with the ProSe application server based on the user information ID and the RSC to check the authorization of the relay terminal.
  • the present disclosure provides a communication control method, including:
  • the second function network element DDNMF in the HPLMN corresponding to the relay terminal returns the corresponding code security parameters and CURRENT_TIME and MAX_OFFSET parameters.
  • the code security parameters provide the relay terminal with the necessary information to protect the information in the DCR message and are stored together with the RSC.
  • the second function network element of the relay terminal shall include the selected first security algorithm in the discovery response message.
  • the second function network element determines the selected first security algorithm based on the RSC and the received security capabilities.
  • the relay terminal stores the selected first security algorithm together with the RSC.
  • the present disclosure provides a communication control method, including:
  • the source UE and/or the target UE sends a discovery request message including the RSC, the user information ID and its security capability to the associated first function network element DDNMF, so as to be allowed to use the U2U relay service.
  • the present disclosure provides a communication control method, including:
  • the first function network element DDNMF associated with the source UE and/or the target UE sends an authentication request to the ProSe application server. If the user information ID is allowed to access the U2U relay service based on the permission setting, the ProSe application server returns an authentication response, such as an authentication pass message.
  • the present disclosure provides a communication control method, including:
  • the first functional network element responds with a discovery response message including the RSC, corresponding code security parameters and the first security algorithm selected based on the stored information/keys.
  • the source UE and/or the target UE may provide the user information ID of the relay terminal in the application container. If the PLMN ID in the user information ID of the relay terminal indicates a PLMN different from the first functional network element, the first functional network element DDNMF associated with the source UE and/or the target UE contacts the second functional network element DDNMF corresponding to the PLMN indicated by the PLMN ID in the user information ID of the relay terminal (i.e., the 5G DDNMF in the HPLMN of the relay terminal) to obtain the corresponding code security parameters.
  • the present disclosure provides a communication control method, including:
  • the source UE needs to establish communication with the target UE via the relay terminal.
  • the source UE broadcasts a direct communication request DCR message, which includes the user information ID of the source UE and the information ID of the target UE, RSC, credential ID, a first random number 1 and its security capability.
  • the message will be received by the first relay terminal and the second relay terminal.
  • the user information ID of the source UE and/or the target UE is protected by code security parameters based on the selected first security algorithm.
  • the source UE and/or the target UE and the relay terminal may be provided or pre-configured with long-term credentials and long-term credential IDs.
  • the long-term credentials and long-term credential IDs may also be provided to the UE by the network (e.g., PCF/5G DDNMF/5G PKMF/ProSe server).
  • the present disclosure provides a communication control method, including:
  • the first relay terminal and the second relay terminal verify the DCR message using the code security parameters and check the RSC. If the RSC corresponding to the relay service they are authorized to provide includes the RSC in the DCR message, a new direct communication request message is broadcast in its vicinity.
  • the new direct communication request message broadcast by the relay terminal includes the user information ID of the source UE, the information ID of the target UE and the information ID of the relay terminal, the credential ID, the second random number 1' and its security capabilities.
  • the relay terminal stores the association between the identification information of the source UE (e.g., the user information ID of the source UE) and the new direct communication request.
  • the user information IDs of the source UE, the target UE and the relay terminal are protected by code security parameters based on the selected first security algorithm.
  • the present disclosure provides a communication control method, including:
  • the target UE receives a new direct communication request from the first relay terminal and the second relay terminal.
  • the target UE verifies the DCR message by using the code security parameter and selects the second relay terminal based on indicators such as QoS, and then the direct authentication and key establishment process between the target UE and the second relay terminal can be initiated to generate the first intermediate key Knrp.
  • the present disclosure provides a communication control method, including:
  • the target UE derives the session key (Knrp-SESS) from Knrp, and then derives the confidentiality key (NRPEK) and integrity key (NRPIK) according to the PC5 security policy.
  • Knrp-SESS session key
  • NRPEK confidentiality key
  • NRPIK integrity key
  • the target UE sends a direct security mode command message to the second relay terminal, which should include the selected second security algorithm and nonce 2' and be protected.
  • the present disclosure provides a communication control method, including:
  • the second relay terminal responds to the target UE with a direct security mode completion message.
  • the present disclosure provides a communication control method, including:
  • the target UE If a direct security mode completion message is received from the second relay terminal, the target UE sends a direct communication acceptance message to the second relay terminal.
  • the present disclosure provides a communication control method, including:
  • a direct authentication and key establishment process can be initiated with the source UE to obtain the second intermediate key Knrp’.
  • the present disclosure provides a communication control method, including:
  • the second relay terminal derives the session key (Knrp-SeSS’) from Knrp’, and then derives the confidentiality key (NRPEK’) and integrity key (NRPIK’) according to the PC5 security policy.
  • the second relay terminal sends a direct security mode command message to the source UE, which should include the selected PC5 security algorithm, random number 2, and be protected.
  • the present disclosure provides a communication control method, including:
  • the source UE responds to the second relay terminal with a direct security mode completion message.
  • the present disclosure provides a communication control method, including:
  • the second relay terminal sends a direct communication accept message to the source UE.
  • the present disclosure provides a communication control method, including:
  • a secure L3PC5 link is established between the source UE and the target UE through the second relay terminal.
  • the second relay terminal can relay services between peer ProSe UEs.
  • an embodiment of the present disclosure provides a communication control device, which is applied to a first UE, and the device includes:
  • the first establishing unit 110 is configured to broadcast a DCR message; the information carried by the DCR message is protected by security information;
  • the second establishing unit 120 is configured to establish a communication connection with the second UE through the relay terminal that responds to the DCR message.
  • the first establishing unit 110 is configured to:
  • the preset message carries at least one of the following: a relay service code RSC, identification information of the first UE, and security capabilities;
  • the security information includes: security information determined by the relay terminal during the discovery request process.
  • the security information includes: security parameters and/or security algorithms.
  • the apparatus further comprises:
  • the third establishing unit is configured to provide the first functional network element with identification information of at least one relay terminal; the identification information of the relay terminal is used for the first functional network element to obtain corresponding security parameters and/or security algorithms.
  • the information carried by the DCR message includes at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, RSC, credential ID, and a first random number.
  • the second establishing unit 120 is configured to:
  • the first functional network element includes: a direct discovery naming management function DDNMF or a key management function PKMF.
  • an embodiment of the present disclosure provides a communication control device, which is applied to a relay terminal.
  • the device includes:
  • the first processing unit 210 is configured to obtain a DCR message broadcast by the first UE; the information carried in the DCR message is protected by security information;
  • the second processing unit 220 is configured to establish a communication connection between the first UE and the second UE in response to the DCR message.
  • the first processing unit 210 is configured to:
  • the preset message carries at least one of the following: identification information, RSC, and security capability of the relay terminal;
  • the security information includes: security parameters and/or security algorithms.
  • the information carried by the DCR message includes at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, RSC, credential ID, and a first random number.
  • the second processing unit 220 is configured to:
  • a new DCR message is broadcast;
  • the new DCR message carries at least one of the following: identification information and security capabilities of the first UE, identification information of the second UE, identification information and RSC of the relay terminal, credential ID, and a second random number;
  • the second processing unit 220 is configured to:
  • a direct communication acceptance message is sent to the first UE, and a communication connection between the first UE and the second UE is established.
  • the second functional network element includes: DDNMF or PKMF.
  • an embodiment of the present disclosure provides a communication control device, which is applied to a second UE, and the device includes:
  • the connection unit 310 is configured to establish a communication connection with the first UE through the relay terminal based on security information when receiving a new DCR message broadcast by multiple relay terminals based on the DCR message of the first UE; the information carried by the DCR message is protected by security information.
  • connection unit 310 is further configured to:
  • the preset message carries at least one of the following: the RSC, identification information of the second UE, and security capability;
  • the security information includes: security information determined by the relay terminal during the discovery request process.
  • the security information includes: security parameters and/or security algorithms.
  • connection unit 310 is further configured to:
  • the identification information of at least one relay terminal is provided to the first functional network element; the identification information of the relay terminal is used for the first functional network element to obtain corresponding security parameters and/or security algorithms.
  • connection unit 310 is configured to:
  • a target relay terminal is determined among the multiple relay terminals
  • a communication connection is established with the first UE through the target relay terminal.
  • connection unit 310 is configured to:
  • the target relay terminal After the target relay terminal completes direct authentication with the first UE and the key generation process is completed, a communication connection is established with the first UE through the target relay terminal.
  • an embodiment of the present disclosure provides a communication control device, which is applied to a first functional network element, and the device includes:
  • the execution unit 410 is configured to provide security information to the first UE and/or the second UE associated with the first functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the execution unit 410 is configured to:
  • the preset message carries at least one of the following: the RSC, identification information of the first UE and/or the second UE, and security capabilities;
  • a response message is returned to the first UE and/or the second UE; the response message carries security information matching the RSC; the security information includes: security information determined by the relay terminal during the discovery request process.
  • the security information includes: security parameters and/or security algorithms.
  • the execution unit 410 is further configured to:
  • the security information is determined.
  • the execution unit 410 is configured to:
  • the security information is determined based on the security parameters, the security algorithm, and the RSC corresponding to the security algorithm.
  • an embodiment of the present disclosure provides a communication control device, which is applied to a second functional network element, and the device includes:
  • the operating unit 510 is configured to provide security information to the relay terminal associated with the second functional network element; the security information is used for the first UE and the second UE to establish a communication connection through the relay terminal.
  • the operation unit 510 is configured to:
  • the preset message carries at least: identification information, RSC, and security capability of the relay terminal;
  • security information is determined based on the security algorithm, security parameters of the relay terminal, and RSC;
  • the present disclosure provides a communication device, including:
  • a memory for storing processor-executable instructions
  • the processor is configured to execute the information processing method provided by any of the aforementioned technical solutions.
  • the processor may include various types of storage media, which are non-transitory computer storage media that can continue to remember information stored thereon after the communication device loses power.
  • the communication device includes: a terminal or a network element, and the network element can be any one of the first network element to the fourth network element mentioned above.
  • the processor may be connected to the memory via a bus or the like, and may be used to read an executable program stored in the memory, for example, at least one of the methods shown in FIG. 2 to FIG. 16 .
  • Fig. 22 is a block diagram of a terminal 800 according to an exemplary embodiment.
  • the terminal 800 may be a mobile phone, a computer, a digital broadcast user device, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.
  • the terminal 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input/output (I/O) interface 812 , a sensor component 814 , and a communication component 816 .
  • the processing component 802 generally controls the overall operation of the terminal 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations.
  • the processing component 802 may include one or more processors 820 to execute instructions to generate all or part of the steps of the above-mentioned method.
  • the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components.
  • the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.
  • the memory 804 is configured to store various types of data to support operations at the terminal 800. Examples of such data include instructions for any application or method operating on the terminal 800, contact data, phone book data, messages, pictures, videos, etc.
  • the memory 804 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory a magnetic memory
  • flash memory a flash memory
  • magnetic disk or an optical disk.
  • Power component 806 provides power to various components of terminal 800.
  • Power component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to terminal 800.
  • the multimedia component 808 includes a screen that provides an output interface between the terminal 800 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.
  • the multimedia component 808 includes a front camera and/or a rear camera. When the terminal 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and/or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.
  • the audio component 810 is configured to output and/or input audio signals.
  • the audio component 810 includes a microphone (MIC), and when the terminal 800 is in an operation mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal.
  • the received audio signal can be further stored in the memory 804 or sent via the communication component 816.
  • the audio component 810 also includes a speaker for outputting audio signals.
  • I/O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.
  • the sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the terminal 800.
  • the sensor assembly 814 can detect the open/closed state of the device 800, the relative positioning of the components, such as the display and keypad of the terminal 800, and the sensor assembly 814 can also detect the position change of the terminal 800 or a component of the terminal 800, the presence or absence of contact between the user and the terminal 800, the orientation or acceleration/deceleration of the terminal 800 and the temperature change of the terminal 800.
  • the sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • the sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor assembly 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.
  • the communication component 816 is configured to facilitate the communication between the terminal 800 and other devices in a wired or wireless manner.
  • the terminal 800 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof.
  • the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel.
  • the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication.
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • terminal 800 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above methods.
  • ASICs application-specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGAs field programmable gate arrays
  • controllers microcontrollers, microprocessors or other electronic components to perform the above methods.
  • a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of the terminal 800 to generate the above method.
  • the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.
  • an embodiment of the present disclosure shows a structure of a communication device 900.
  • the communication device 900 may be provided as a network side device.
  • the communication device 900 may be the aforementioned base station.
  • the communication device 900 includes a processing component 922, which further includes one or more processors, and a memory resource represented by a memory 932 for storing instructions executable by the processing component 922, such as an application.
  • the application stored in the memory 932 may include one or more modules each corresponding to a set of instructions.
  • the processing component 922 is configured to execute instructions to perform any method performed by the aforementioned application in the base station, for example, at least one of the methods shown in Figures 2 to 16.
  • the communication device 900 may also include a power supply component 926 configured to perform power management of the communication device 900, a wired or wireless network interface 950 configured to connect the communication device 900 to a network, and an input/output (I/O) interface 958.
  • the communication device 900 may operate based on an operating system stored in the memory 932, such as Windows Server TM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开实施例提供一种通信控制方法、系统及装置、通信设备及存储介质，其中，通信控制方法，由第一UE执行，所述方法包括：广播直接通信请求DCR消息；所述DCR消息携带的信息通过所述安全信息保护；通过响应所述DCR消息的中继终端与第二UE建立通信连接。

Description

通信控制方法、系统及装置、通信设备及存储介质 技术领域
本公开涉及无线通信技术领域但不限于无线通信技术领域，尤其涉及一种通信控制方法、系统及装置、通信设备及存储介质。
背景技术
5G邻近服务(Proximity Service，ProSe)可以在对等(peer)用户设备(User Equipment，UE)在无法直接连接时，通过UE到UE的中继终端(UE to UE Relay，U2U Relay)实现通信。示例性的，在测距或侧行链路定位服务(Ranging/Sidelink Positioning Service)中，当两个UE间无法直接测距或侧行链路定位时，可通过充当中继终端的辅助UE(Assistance UE)完成。相关技术中，U2U中继的安全性较低，U2U的中继终端往往作为不受信任节点建立通信连接，导致U2U中继通信存在一定安全风险，从而可能损害对等UE之间的信息传输安全性。
发明内容
本公开实施例提供一种通信控制方法、系统及装置、通信设备及存储介质。
本公开实施例第一方面提供一种通信控制方法，由第一UE执行，所述方法包括：
广播直接通信请求(Direct Communication Request，DCR)消息；所述DCR消息携带的信息通过安全信息保护；
通过响应所述DCR消息的中继终端与第二UE建立通信连接。
本公开实施例第二方面提供一种通信控制方法，由中继终端执行，所述方法包括：
获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；
响应于所述DCR消息建立所述第一UE与第二UE的通信连接。
本公开实施例第三方面提供一种通信控制方法，由第二UE执行，所述方法包括：
当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护。
本公开实施例第四方面提供一种通信控制方法，由第一功能网元执行，所述方法包括：
向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接。
本公开实施例第五方面提供一种通信控制方法，由第二功能网元执行，所述方法包括：
向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
本公开实施例第六方面提供一种通信控制系统，所述系统包括：第一UE、中继终端、第二UE、第一功能网元以及第二功能网元；
所述第一UE，用于广播DCR消息；所述DCR消息携带的信息通过安全信息保护；通过响应所述DCR消息的中继终端与第二UE建立通信连接；
所述中继终端，用于获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；响应于所述DCR消息建立所述第一UE与第二UE的通信连接；
所述第二UE，用于当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护；
所述第一功能网元，用于向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接；
所述第二功能网元，用于向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
本公开实施例第七方面提供一种通信控制装置，应用于第一UE，所述装置包括：
第一建立单元，被配置为广播DCR消息；所述DCR消息携带的信息通过安全信息保护；
第二建立单元，被配置为通过响应所述DCR消息的中继终端与第二UE建立通信连接。
本公开实施例第八方面提供一种通信控制装置，应用于中继终端，所述装置包括：
第一处理单元，被配置为获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；
第二处理单元，被配置为响应于所述DCR消息建立所述第一UE与第二UE的通信连接。
本公开实施例第九方面提供一种通信控制装置，应用于第二UE，所述装置包括：
连接单元，被配置为当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护。
本公开实施例第十方面提供一种通信控制装置，应用于第一功能网元，所述装置包括：
执行单元，被配置为向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接。
本公开实施例第十一方面提供一种通信控制装置，应用于第二功能网元，所述装置包括：
操作单元，被配置为向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
本公开实施例第十二方面提供一种通信设备，包括处理器、收发器、存储器及存储在存储器上并能够有所述处理器运行的可执行程序，其中，所述处理器运行所述可执行程序时执行如前述任意实施例提供的通信控制方法。
本公开实施例第十三方面提供一种计算机存储介质，所述计算机存储介质存储有可执行程序；所述可执行程序被处理器执行后，能够实现前述任意实施例提供的通信控制方法。
本公开实施例提供的技术方案，广播DCR消息；所述DCR消息携带的信息通过安全信息保护；通过响应所述DCR消息的中继终端与第二UE建立通信连接。如此，通过安全信息保护用于建立通信链路的DCR消息，可以提高基于中继终端的第一UE与第二UE间的通信链路安全性。在此基础上，通过广播DCR消息代替向选中的中继终端单独发送DCR消息，可以节省当前需要连接第二UE的第一UE选择中继终端产生的资源开销。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开实施例。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明实施例，并与说明书一起用于解释本发明实施例的原理。
图1是根据一示例性实施例示出的一种无线通信系统的结构示意图；
图2是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图3是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图4是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图5是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图6是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图7是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图8是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图9是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图10是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图11是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图12是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图13是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图14是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图15是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图16是根据一示例性实施例示出的一种通信控制方法的流程示意图；
图17是根据一示例性实施例示出的一种通信控制装置的结构示意图；
图18是根据一示例性实施例示出的一种通信控制装置的结构示意图；
图19是根据一示例性实施例示出的一种通信控制装置的结构示意图；
图20是根据一示例性实施例示出的一种通信控制装置的结构示意图；
图21是根据一示例性实施例示出的一种通信控制装置的结构示意图；
图22是根据一示例性实施例示出的一种终端的结构示意图；
图23是根据一示例性实施例示出的一种通信设备的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本发明实施例相一致的所有实施方式。相反，它们仅是本发明实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
请参考图1，其示出了本公开实施例提供的一种无线通信系统的结构示意图。如图1所示，无线通信系统是基于蜂窝移动通信技术的通信系统，该无线通信系统可以包括：若干个终端11以及若干个接入设备12。
其中，终端11可以是指向用户提供语音和/或数据连通性的设备。终端11可以经无线接入网(Radio Access Network，RAN)与一个或多个核心网进行通信，终端11可以是物联网终端，如传感器设备、移动电话(或称为“蜂窝”电话)和具有物联网终端的计算机，例如，可以是固定式、便携式、袖珍式、手持式、计算机内置的或者车载的装置。例如，站(Station，STA)、订户单元(subscriber unit)、订户站(subscriber station)、移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点、远程终端(remote terminal)、接入终端(access terminal)、用户装置(user terminal)、用户代理(user agent)、用户设备(user device)、或用户终端(user equipment，终端)。或者，终端11也可以是无人飞行器的设备。或者，终端11也可以是车载设备，比如，可以是具有无线通信功能的行车电脑，或者是外接行车电脑的无线通信设备。或者，终端11也可以是路边设备，比如，可以是具有无线通信功能的路灯、信号灯或者其它路边设备等。
接入设备12可以是无线通信系统中的网络侧设备。其中，该无线通信系统可以是第四代移动通信技术(the 4th generation mobile communication，4G)系统，又称长期演进(Long Term Evolution，LTE)系统；或者，该无线通信系统也可以是5G系统，又称新空口(new radio，NR)系统或5G NR系统。或者，该无线通信系统也可以是5G系统的再下一代系统。其中，5G系统中的接入网可以称为NG-RAN(New Generation-Radio Access Network，新一代无线接入网)。或者，MTC系统。
其中，接入设备12可以是4G系统中采用的演进型接入设备(eNB)。或者，接入设备12也可以是5G系统中采用集中分布式架构的接入设备(gNB)。当接入设备12采用集中分布式架构时，通常包括集中单元(central unit，CU)和至少两个分布单元(distributed unit，DU)。集中单元中设置有分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层、无线链路层控制协议(Radio Link Control，RLC)层、媒体访问控制(Media Access Control，MAC)层的协议栈；分布单元中设置有物理(Physical，PHY)层协议栈，本公开实施例对接入设备12的具体实现方式不加以限定。
接入设备12和终端11之间可以通过无线空口建立无线连接。在不同的实施方式中，该无线空口是基于第四代移动通信网络技术(4G)标准的无线空口；或者，该无线空口是基于第五代移动通 信网络技术(5G)标准的无线空口，比如该无线空口是新空口；或者，该无线空口也可以是基于5G的更下一代移动通信网络技术标准的无线空口。
可选的，上述无线通信系统还可以包含网络管理设备13。若干个接入设备12分别与网络管理设备13相连。其中，网络管理设备13可以是无线通信系统中的核心网设备，比如，该网络管理设备13可以是演进的数据分组核心网(Evolved Packet Core，EPC)中的移动性管理实体(Mobility Management Entity，MME)。或者，该网络管理设备也可以是其它的核心网设备，比如服务网关(Serving GateWay，SGW)、公用数据网网关(Public Data Network GateWay，PGW)、策略与计费规则功能单元(Policy and Charging Rules Function，PCRF)或者归属签约用户服务器(Home Subscriber Server，HSS)等。对于网络管理设备13的实现形态，本公开实施例不做限定。
示例性的，终端11可以用于执行通信连接，例如，终端11可包括第一UE即源UE，也可以包括第二UE即目标UE，还可以包括中继终端。接入设备12可以包括第一功能网元和/或第二功能网元，其中，第一功能网元可至少用于向第一UE和/或第二UE提供数据处理等服务，第二功能网元可至少用于向中继终端提供数据处理等服务。第一功能网元与第二功能网元可以是同一个功能网元，也可以是不同的功能网元。示例性的，第一功能网元可以是直接发现命名管理功能(Direct Discovery Name Management Function，DDNMF)或者密钥管理功能(ProSe Key Management Function，PKMF)，或者也可以是其他功能网元。第二功能网元可以是DDNMF或者PKMF，也可以是其他功能网元。网络管理设备13可以包括ProSe应用服务器，与第一功能网元和/或第二功能网元建立通信连接以实现第一功能网元和/或第二功能网元请求的鉴权等处理。
示例性的，终端11还可以用于测距/侧行链路定位服务，例如，终端11可以包括第一UE即参考UE，也可以包括第二UE即目标UE，还可以包括中继终端作为辅助UE。接入设备12可以包括第一功能网元和/或第二功能网元。网络管理设备13可以包括ProSe应用服务器，与第一功能网元和/或第二功能网元建立通信连接以实现第一功能网元和/或第二功能网元请求的鉴权等处理。
在本公开实施例中，第一UE为需要与其他UE建立通信连接的UE，例如可以为源UE或者测距或侧行链路服务中的参考UE。第一UE包括但不限于手机、可穿戴设备、车载终端、路侧单元(RSU，Road Side Unit)、智能家居终端、工业用传感设备和/或医疗设备等。直接通信请求DCR消息用于请求建立与其他UE的直接通信连接，例如建立通过中继终端的直连通信接口(PC5)单播通信等。
在本公开实施例中，第一UE与第二UE可以为需要建立通信连接的对等(peer)用户设备，例如，第一UE可以为需要发起连接的源UE，第二UE可以为第一UE需要连接的目标UE，中继终端可以为用于为无法直接连接的第一UE和第二UE提供中继服务的终端，例如中继终端也可以为UE或其他设备。这里，本公开实施例中的通信控制方法还可应用于测距或侧行链路定位服务中，此时第一UE可以为参考UE，第二UE可以为待测距或待定位的目标UE，中继终端可以为辅助UE。
在本公开实施例中，中继终端为可以提供U2U中继服务的终端，例如可以为中继UE等，也可以为提供测距或侧行链路定位服务的辅助UE。在本公开实施例中，中继终端可以为能够获取到第一UE广播的DCR消息的任一中继终端，例如处于第一UE的信号覆盖范围内的第一中继终端或第二中继终端。
如图2所示，本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
S110：广播DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护，其中，DCR消息携带的信息，可包括以下至少之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继业务代码(Relay Service Code，RSC)、凭证标识(Identity，ID)以及第一随机数。这里，标识信息可以为UE的用户信息ID(User Info ID)、UE的受限ProSe应用程序用户ID(Restricted ProSe Application User ID，RPAUID)、UE的ProSe远端UE密钥ID(ProSe Remote User Key ID，PRUK ID)、签约用户隐式标识(Subscription Concealed Identifier，SUCI)或者其他标识。第二UE为第一UE需要建立通信连接的UE，例如可以为目标UE。RSC为当前中继服务对应的RSC。凭证ID可以为在第一UE中配置或者向第一UE提供的长期凭证ID，例如由网络侧的策略控制功能(Policy Control Function，PCF)、直接发现命名管理功能(Direct Discovery Name Management Function， DDNMF)、密钥管理功能(ProSe Key Management Function，PKMF)或者ProSe应用服务器等提供的长期凭证ID。
在一个实施例中，DCR消息携带的信息通过安全信息保护，可包括：DCR消息携带的部分或全部信息通过安全信息保护。例如，DCR消息携带的第一UE的标识信息和第二UE的标识信息通过安全信息保护。
在一个实施例中，广播DCR消息；DCR消息携带的第一UE的标识信息以及第二UE的标识信息通过用于发现的安全信息保护，例如可以通过基于安全算法的安全参数对第一UE和第二UE的用户信息ID进行保护。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护，其中，安全信息可以包括：安全参数和/或安全算法。安全参数可以为RSC对应的代码安全参数(Code Security Parameters)、代码发送安全参数(Code-Sending Security Parameters)、代码接收安全参数(Code-Receving Security Parameters)等，安全算法可以为RSC对应的发现加密算法等。DCR消息携带的信息通过用于发现的安全信息保护，例如可以为DCR消息携带的信息通过基于安全算法的安全参数进行保护等。
这里，标识信息可以包括UE的用户信息ID(User Information ID)、UE的受限ProSe应用程序用户ID(Restricted ProSe Application User ID，RPAUID)、UE的ProSe远端UE密钥ID(ProSe Remote User Key ID，PRUK ID)、签约用户隐式标识(Subscription Concealed Identifier，SUCI)或者其他标识，RSC为当前中继服务对应的代码。凭证ID可以为在第一UE中配置或者向第一UE提供的长期凭证ID，例如由网络侧的策略控制功能(Policy Control Function，PCF)、DDNMF、PKMF或者ProSe应用服务器等提供的长期凭证ID。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护，其中，安全信息可以包括：安全参数和/或安全算法。DCR消息携带的信息通过安全信息保护，可以为DCR消息携带的信息通过基于安全算法的安全参数进行保护。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护，其中，DCR消息携带的第一UE的标识信息以及第二UE的标识信息可通过用于发现的安全信息保护。例如，安全信息可以包括：安全参数和/或安全算法，DCR消息携带的第一UE的标识信息以及第二UE的标识信息可以通过基于安全算法的安全参数进行保护。
在一个实施例中，在预设范围内广播DCR消息；DCR消息携带的信息通过安全信息保护。例如，预设范围可以为第一UE的信号覆盖范围，在预设范围内广播DCR消息可包括：向信号覆盖范围内的所有中继终端广播DCR消息。其中，DCR消息用于请求建立与第二UE的直接通信连接，例如建立通过中继终端的PC5单播通信。
如此，通过用于发现的安全信息保护用于建立通信链路的DCR消息，提高基于中继设备的第一UE与第二UE间的通信链路安全性。在此基础上，通过广播DCR消息代替向选中的中继终端单独发送DCR消息，可以节省当前需要连接第二UE的第一UE选择中继终端产生的资源开销。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
在一个实施例中，方法可包括：通过响应DCR消息的中继终端与第二UE建立通信连接。
如图3所示，本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
S111：广播DCR消息；DCR消息携带的信息通过安全信息保护；
S120：通过响应DCR消息的中继终端与第二UE建立通信连接。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护；通过响应DCR消息的中继终端与第二UE建立通信连接，其中，响应DCR消息的中继终端，可以为接收到广播的DCR消息的中继终端中的一个或多个中继终端，例如位于第一UE的信号覆盖范围内的一个或多个中继终端。
在一个实施例中，广播DCR消息；DCR消息携带的信息通过安全信息保护；在多个响应DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收目标中继终 端发送的安全模式命令消息；验证安全模式命令消息的完整性，并在验证通过后向目标中继终端返回安全模式完成消息；当接收到目标中继终端发送的直接通信接受消息，通过目标中继终端与第二UE建立无线资源控制层(L3)PC5通信链路。
需要说明的是，对于广播DCR消息部分内容的说明，请参考前述S110部分内容的说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图4所示，本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
S101：请求获取安全信息。
在一个实施例中，向第一UE关联的第一功能网元请求获取安全信息。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力。
在一个实施例中，请求获取安全信息；接收携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收携带安全信息的消息；广播DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，步骤S101可与前述的步骤S110或S111结合，或者可与步骤S110以及步骤S120结合，或者也可与步骤S110以及S120结合。可选地，S101也可与步骤S110或S111的任一具体实施方式结合。
如图5所示，本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
S102：接收携带安全信息的消息。
在本公开实施例中，安全信息可用于通过中继终端建立第一UE与第二UE的通信连接。
在一个实施例中，接收第一UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，接收第一UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
在一个实施例中，步骤S102可与前述步骤S101结合，或者，也可以与S101的任一具体实施方式结合。例如，方法可包括：请求获取安全信息；接收携带安全信息的消息。或者，方法可包括：向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；接收携带安全信息的消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。示例性的，步骤S102可与前述的步骤S110或S111结合，或者也可与步骤S110以及步骤S120结合，或者也可与步骤S110以及S120结合。可选地，S102也可与步骤S110或S111的任一具体实施方式结合。
本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
请求获取安全信息；
接收携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收第一UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收第一UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
在一个实施例中，向第一UE关联的第一功能网元请求获取安全信息；接收第一UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，向第一UE关联的第一功能网元请求获取安全信息；接收第一UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
在本公开实施例中，响应消息携带的安全信息以及保护DCR消息携带的信息的安全信息，可以为用于发现的安全信息，例如包括用于发现的安全参数和/或用于发现的安全算法等。
在一个实施例中，向第一UE关联的DDNMF或PKMF发送预设消息，预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力。其中，预设消息可以为用于请求获取用于发现的安全信息发现请求消息，预设消息中携带的RSC可以为当前中继服务对应的代码。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；其中，安全能力为第一UE的安全能力，例如可以为第一UE在发现阶段对应的第一安全能力。在第一安全能力中可以记录第一UE支持的安全算法，例如可以以安全算法列表的形式记录等。
在一个实施例中，接收第一功能网元返回的响应消息，其中，响应消息可以为第一功能网元基于发现请求消息返回的发现响应消息。在响应消息中可以携带第一功能网元获取的与预设消息中RSC匹配的用于发现的安全信息，例如，与RSC匹配的安全信息可以包括：中继终端在发现请求过程中确定的与RSC匹配的用于发现的安全信息。
在一个实施例中，接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；其中，与RSC匹配的安全信息，可以为与RSC以及第一UE的安全能力匹配的安全信息。例如，与RSC匹配的安全信息中的安全算法，可以为第一UE的安全能力中的安全算法列表中的一种安全算法。
在一个实施例中，接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；或者，还可以接收第一功能网元返回的拒绝消息，其中，拒绝消息指示第一UE没有被授权使用该RSC对应的中继服务。
本公开实施例提供一种通信控制方法，由第一UE执行，方法可包括：
向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；
接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；
广播DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；在接收到第一功能网元返回的响应消息后，通过安全信息保护DCR消息中的第一UE和第二UE的标识信息，并广播DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；将至少一个中继终端的标识信息存入应用容器(application container)供第一功能网元读取；中继终端的标识信息用于供第一功能网元获取对应的安全参数和/或安全算法；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；广播DCR消息；DCR消息携带的信息通过安全信息保护。其中，中继终端的标识信息关联的第二功能网元可以与第一UE关联的第一功能网元相同，也可以与第一功能网元不同。即，中继终端的标识信息关联的公共陆地移动网络(Public Land Mobile Network，PLMN)ID可以与第一UE关联的PLMN ID相同，也可以不同。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；广播DCR消息；DCR消息携带的信息通过安全信息保护；通过响应DCR消息的中继终端与第二UE建立通信连接。
在一个实施例中，向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第一UE的标识信息以及安全能力；向第一功能网元提供至少一个中继终端的标识信息；中继终端的标识信息用于供第一功能网元获取对应的安全参数和/或安全算法；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；广播DCR消息；DCR消息携带的信息通过安全信息保护；通过响应DCR消息的中继终端与第二UE建立通信连接。如此，通过直接提供中继终端的标识信息，可供第一功能网元直接获取对应的安全参数和/或安全算法，从而确保第一UE获取到和中继终端相同的与RSC匹配的安全信息。
在一个实施例中，通过响应DCR消息的中继终端与第二UE建立通信连接，可包括：在多个响应DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收目标中继终端发送的安全模式命令消息；验证安全模式命令消息的完整性，并在验证通过后向目标中继终端返回安全模式完成消息；当接收到目标中继终端发送的直接通信接受消息，通过目标中继终端与第二UE建立通信连接。其中，目标中继终端发起的直接认证以及密钥生成过程，可以用于生成中间密钥(Knrp)。第一UE接收的安全模式命令消息，可以为基于中间密钥生成的完整性密钥保护的安全模式命令消息。
在一个实施例中，通过响应DCR消息的中继终端与第二UE建立通信连接，可包括：在多个响应DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收目标中继终端发送的安全模式命令消息；基于中间密钥生成的完整性密钥和/或安全算法验证安全模式命令消息的完整性，并在验证通过后向目标中继终端返回安全模式完成消息；当接收到目标中继终端发送的直接通信接受消息，通过目标中继终端与第二UE建立通信连接。这里的安全算法可以为用于保护通信的安全算法，该安全算法可以为与前述实施例中获取的用于发现的安全信息中的安全算法不同，例如可以为PC5安全算法等，也可以为与前述实施例中获取的用于发现的安全信息中的安全算法相同。
在一个实施例中，第一UE向目标中继终端返回的安全模式完成消息，用于指示第一UE响应接入U2U中继通信。
在一个实施例中，通过目标中继终端与第二UE建立通信连接，可以为通过目标中继终端与第二UE建立无线资源控制层(L3)PC5通信链路等。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。示例性的，前述步骤S102可以与步骤S110、S101以及S120组合成新的技术方案，也可以与步骤S110、S111以及步骤S101中的任意一个步骤或者任意一个具体实施方式结合。
如图6所示，本公开实施例提供一种通信控制方法，由中继终端执行，方法可包括：
S201：请求获取安全信息。
在一个实施例中，向中继终端关联的第二功能网元请求获取安全信息。
在一个实施例中，向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：RSC、中继终端的标识信息以及安全能力。
在一个实施例中，请求获取安全信息；接收携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收携带安全信息的消息；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，请求获取安全信息；接收携带安全信息的消息；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于DCR消息建立第一UE与第二UE的通信连接。
如图7所示，本公开实施例提供一种通信控制方法，由中继终端执行，方法可包括：
S202：接收携带安全信息的消息。
在一个实施例中，步骤S202可与前述步骤S201结合，或者，也可以与S201的任一具体实施方式结合。例如，方法可包括：请求获取安全信息；接收携带安全信息的消息。或者，方法可包括：向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：RSC、中继终端的标识信息以及安全能力；接收携带安全信息的消息。
在一个实施例中，步骤S202可与前述的步骤S101、S102、S110及S120结合形成新的技术方案，也可以与S201结合后与步骤S101、S102、S110及S120结合组成技术方案。
在本公开实施例中，安全信息可用于通过中继终端建立第一UE与第二UE的通信连接。
在一个实施例中，接收中继终端关联的第二功能网元发送的携带安全信息的消息。
在一个实施例中，接收中继终端关联的第二功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
本公开实施例提供一种通信控制方法，由中继终端执行，方法可包括：
请求获取安全信息；
接收携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收中继终端关联的第二功能网元发送的携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收中继终端关联的第二功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
在一个实施例中，向中继终端关联的第二功能网元请求获取安全信息；接收中继终端关联的第二功能网元发送的携带安全信息的消息。
在一个实施例中，向中继终端关联的第二功能网元请求获取安全信息；接收中继终端关联的第二功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为当前中继服务对应的代码。
如图8所示，本公开实施例提供一种通信控制方法，由中继终端执行，方法可包括：
S210：获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护，其中，DCR消息携带的第一UE的标识信息以及第二UE的标识信息可通过用于发现的安全信息保护。例如，安全信息可以包括：安全参数和/或安全算法，DCR消息携带的第一UE的标识信息以及第二UE的标识信息可以通过基于安全算法的安全参数进行保护。
在一个实施例中，获取第一UE在预设范围内广播的DCR消息；DCR消息携带的信息通过安全信息保护。例如，预设范围可以为第一UE的信号覆盖范围，在预设范围内广播DCR消息可包括：向信号覆盖范围内的所有中继终端广播DCR消息。其中，DCR消息用于请求建立与第二UE的直接通信连接，例如建立通过中继终端的PC5单播通信。
在一个实施例中，获取信号覆盖范围内第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护。其中，DCR消息用于请求建立第一UE与第二UE的通信连接，例如建立通过中继终端的PC5通信。
如此，通过用于发现的安全信息保护用于建立通信链路的DCR消息，提高基于中继设备的第一UE与第二UE间的通信链路安全性。在此基础上，通过广播DCR消息代替向选中的中继终端单独发送DCR消息，可以节省当前需要连接第二UE的第一UE选择中继终端产生的资源开销。
需要说明的是，关于DCR消息以及安全信息的内容及解释请参考步骤S110部分作出的解释和说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。前述实施例中记载的技术特征在不矛盾的情况下可以任意排列组合以及交换顺序，可以任意组合成新的方法技术方案。示例性的，前述步骤中的S201和S202可与S101、S102组成技术方案，且S101和S102组成的子方案可以与S201和S202组成的子方案互换先后顺序等。
本公开实施例提供一种通信控制方法，由中继终端执行，方法可包括：
获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护。
响应于DCR消息建立第一UE与第二UE的通信连接。
在一个实施例中，获取安全信息；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息建立第一UE与第二UE的通信连接。
在一个实施例中，在中继终端的发现请求过程中获取用于发现的安全信息；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息建立第一UE与第二UE的通信连接。例如可以为向中继终端关联的第二功能网元发起的发现请求过程。例如，中继终端在发现请求过程中确定安全信息，可以包括中继终端向关联的第二功能网元发送用于请求发现请求消息，并接收第二功能网元返回的安全信息。其中，中继终端关联的第二功能网元可以为中继终端关联的DDNMF或者PKMF等。发现请求消息中可以携带以下至少之一：中继终端支持的RSC、中继终端的标识信息以及安全能力。这里，用于发现的安全信息可以包括：安全参数和/或安全算法，其 中，安全参数可以为RSC对应的代码安全参数、代码发送安全参数、代码接收安全参数等，安全算法可以为RSC对应的发现加密算法等。DCR消息携带的信息通过用于发现的安全信息保护，例如可以为DCR消息携带的信息通过基于安全算法的安全参数进行保护等。
在一个实施例中，向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；接收第二功能网元基于预设消息返回的安全信息；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息建立第一UE与第二UE的通信连接。这里，向中继终端关联的第二功能网元发送预设消息，可以为向中继终端关联的DDNMF或PKMF发送预设消息，其中，预设消息可以为用于请求提供安全信息的发现请求消息。安全能力为中继终端的安全能力，例如可以为中继终端在发现阶段对应的第一安全能力。第一安全能力可以为PC5安全能力，在第一安全能力中可以记录中继终端支持的安全算法，例如可以以安全算法列表的形式记录等。
在一个实施例中，标识信息可以为用户信息ID，例如用户信息ID可以为网络访问标识符(Network Access Identifier，NAI)格式或者64位字符串格式等。用户信息ID可以指示对应的PLMN，例如用户信息ID中可以包含归属网络标识符(Home Public Land Mobile Network ID，HPLMN ID)。当用户信息ID为NAI格式时，例如为“username@realm”，则“realm”部分可以包括HPLMN ID。
在一个实施例中，向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；接收第二功能网元基于预设消息返回的安全信息以及预设参数；获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息建立第一UE与第二UE的通信连接。其中，预设参数可以指示当前时刻和/或消息偏移量等，例如可包括CURRENT_TIME参数和MAX_OFFSET参数。
在一个实施例中，中继终端接收的第二功能网元基于预设消息返回的安全信息，可以为与中继终端发送的预设消息中的RSC和安全能力匹配的安全信息，例如，安全信息中的安全算法可以与中继终端发送的预设消息中的RSC匹配，且属于中继终端的安全能力记录的中继终端支持的安全算法列表。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息且在多个响应DCR消息的中继终端中被选中为目标中继终端后，建立第一UE与第二UE的通信连接。其中，在多个响应DCR消息的中继终端中被选中为目标中继终端，可以为在多个响应DCR消息的中继终端中被第二UE选中为目标中继终端。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息，在与第一UE和第二UE完成直接认证以及密钥生成过程后，与第二UE建立通信连接。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息；若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；当检测到接收新的DCR消息的第二UE的反馈消息，建立第一UE与第二UE的通信连接。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息，并基于RSC确定中继终端是否被授权提供该RSC对应的中继服务；若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；当检测到接收新的DCR消息的第二UE的反馈消息，建立第一UE与第二UE的通信连接。例如，ProSe用于将DCR消息中的RSC与中继终端支持的RSC相对比。
在一个实施例中，若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息，可以包括：若校验成功且中继终端被授权提供该中继服务，则当DCR消息携带的RSC与中继终端支持的RSC一致时，广播新的DCR消息。其中，新的DCR消息可以为中继终端在接收 到第一UE广播的DCR消息中加入了中继终端的标识信息。
在一个实施例中，新的DCR消息携带的信息可通过用于发现的安全信息保护，例如，可通过基于安全算法的安全参数保护。
在一个实施例中，新的DCR消息中第一UE的标识信息、第二UE的标识信息以及中继终端的标识信息可通过用于发现的安全信息保护，例如，可通过基于安全算法的安全参数保护。
在一个实施例中，检测到接收新的DCR消息的第二UE的消息，可以为检测到接收新的DCR消息的第二UE选择中继终端为用于提供中继服务的目标中继终端。例如，当第一UE信号覆盖范围内有第一中继终端和第二中继终端，第一中继终端和第二中继终端广播新的DCR消息后，若第二UE选择第二中继终端为目标中继终端，则第二中继终端可以接收到第二UE的消息，并用于建立第一UE和第二UE间的通信连接。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息；若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；当检测到接收新的DCR消息的第二UE的反馈消息，在与第二UE的直接认证以及密钥生成过程完成后，响应于第二UE的安全模式命令消息，向第二UE返回安全模式完成消息；响应于第二UE的直接通信接受消息，在与第一UE的直接认证以及密钥生成过程完成后，向第一UE发送安全模式命令消息；当接收到第一UE返回的安全模式完成消息，向第一UE发送直接通信接受消息，并建立第一UE与第二UE的通信连接。
这里，中继终端已确定为目标中继终端，目标中继终端与第二UE的直接认证以及密钥生成过程可以在与第一UE的直接认证以及密钥生成过程之前完成。第二UE的安全模式命令消息，可以包含第二UE选择的安全算法，这里的安全算法可以为用于保护目标中继设备与第二UE间通信连接的算法，例如可以为与UE发现阶段的安全信息中的第一安全算法相同或者不同的第二安全算法。第二安全算法也可以用于保护安全模式命令消息，例如第二安全算法可以为PC5安全算法等。
在一个实施例中，目标中继终端与第二UE的直接认证以及密钥生成过程，可以用于生成中间密钥(Knrp)。第二UE的安全模式命令消息，可以为第二UE基于中间密钥生成的完整性密钥保护的安全模式命令消息。
在一个实施例中，获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息；若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；当检测到接收新的DCR消息的第二UE的反馈消息，在与第二UE的直接认证以及密钥生成过程完成后，响应于第二UE的安全模式命令消息，验证安全模式命令消息的完整性；若验证通过则向第二UE返回安全模式完成消息；响应于第二UE的直接通信接受消息，在与第一UE的直接认证以及密钥生成过程完成后，向第一UE发送安全模式命令消息；当接收到第一UE返回的安全模式完成消息，向第一UE发送直接通信接受消息，并建立第一UE与第二UE的通信连接。这里，验证安全模式命令消息的完整性，可以包括基于中间密钥对应的完整性密钥和/或安全算法验证安全模式命令消息的完整性。这里的安全算法可以为用于保护通信的安全算法，该安全算法可以为与前述实施例中获取的用于发现的安全信息中的安全算法不同，例如可以为PC5安全算法等，也可以为与前述实施例中获取的用于发现的安全信息中的安全算法相同。
在一个实施例中，响应于第二UE的直接通信接受消息，中继终端可以发起与第一UE的直接认证以及密钥生成过程。目标中继终端与第一UE的直接认证以及密钥生成过程，可以用于生成中间密钥(Knrp)。向第一UE发送的安全模式命令消息，可以为中继终端基于中间密钥生成的完整性密钥保护的安全模式命令消息。
在一个实施例中，建立第一UE与第二UE的通信连接，可以为建立第一UE与第二UE的L3PC5通信链路等。
如此，通过用于发现的安全信息保护用于建立通信链路的DCR消息，可以提高基于U2U中继的第一UE与第二UE间的通信安全性，在发现及链路建立阶段提高整体的安全性。在此基础上，通过广播DCR消息代替向选中的中继终端单独发送DCR消息，可以节省当前需要连接第二UE的第一UE选择中继终端产生的资源开销。
需要说明的是，关于DCR消息以及安全信息的内容及解释请参考步骤S110部分作出的解释和说明，关于获取第一UE广播的DCR消息部分的内容请参考步骤S210部分作出的解释和说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图9所示，本公开实施例提供一种通信控制方法，由第二UE执行，方法可包括：
S301：请求获取安全信息。
在一个实施例中，向第二UE关联的第一功能网元请求获取安全信息。
在一个实施例中，向第二UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第二UE的标识信息以及安全能力。
如图10所示，本公开实施例提供一种通信控制方法，由第二UE执行，方法可包括：
S302：接收携带安全信息的消息。
在本公开实施例中，安全信息可用于通过中继终端建立第二UE与第二UE的通信连接。
在一个实施例中，接收第二UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，接收第二UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为第二UE提供的中继服务对应的RSC。
本公开实施例提供一种通信控制方法，由第二UE执行，方法可包括：
请求获取安全信息；
接收携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收第二UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，请求获取安全信息；接收第二UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为第二UE提供的中继服务对应的RSC。
在一个实施例中，向第二UE关联的第一功能网元请求获取安全信息；接收第二UE关联的第一功能网元发送的携带安全信息的消息。
在一个实施例中，向第二UE关联的第一功能网元请求获取安全信息；接收第二UE关联的第一功能网元发送的响应消息；响应消息携带与RSC匹配的安全信息。这里，RSC可以为第二UE提供的中继服务对应的RSC。
如图11所示，本公开实施例提供一种通信控制方法，由第二UE执行，方法可包括：
S310：接收多个中继终端基于第一UE的DCR消息广播的新的DCR消息；DCR消息携带的信息通过安全信息保护。
在一个实施例中，向第二UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第二UE的标识信息以及安全能力；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中继终端在发现请求过程中确定的安全信息；接收多个中继终端基于第一UE的DCR消息广播的新的DCR消息；DCR消息携带的信息通过安全信息保护。第二UE关联的第一功能网元可以为第二UE关联的DDNMF或者PKMF等。预设消息中可以携带以下至少之一：RSC、第二UE的标识信息以及安全能力。
这里，向第二UE关联的第一功能网元发送预设消息，可以为向第二UE关联的DDNMF或PKMF发送预设消息，其中，预设消息可以为用于获取安全信息的发现请求消息，预设消息中携带的RSC可以为第二UE支持的中继服务对应的RSC，该RSC可以用于确定符合第二UE指定或期望的中继服务的中继终端。响应消息可以为第一功能网元基于发现请求消息返回的发现响应消息。在响应消息中可以携带第一功能网元获取的与预设消息中RSC匹配的安全信息。与RSC匹配的安全信息， 还可以与RSC以及第二UE的安全能力匹配的安全信息。例如，与RSC匹配的安全信息中的安全算法，可以属于第二UE的安全能力记录的第二UE支持的安全算法列表。
在一个实施例中，安全能力为第二UE的安全能力，例如可以为第二UE在发现阶段对应的第一安全能力。第一安全能力可以为PC5安全能力，在第一安全能力中可以记录第二UE支持的安全算法，例如可以以安全算法列表的形式记录等。
在一个实施例中，第二UE接收第一功能网元返回的响应消息，或者，第二UE还可以接收第一功能网元返回的拒绝消息，其中，拒绝消息指示第二UE没有被授权使用该RSC对应的中继服务。
在一个实施例中，向第二UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第二UE的标识信息以及安全能力；将至少一个中继终端的标识信息存入应用容器(application container)供第一功能网元读取；中继终端的标识信息用于供第一功能网元获取对应的安全参数和/或安全算法；接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中继终端在发现请求过程中确定的安全信息；接收多个中继终端基于第一UE的DCR消息广播的新的DCR消息；DCR消息携带的信息通过安全信息保护。其中，中继终端的标识信息关联的第二功能网元可以与第一UE关联的第一功能网元相同，也可以与第一功能网元不同。即，中继终端的标识信息关联的公共陆地移动网络(Public Land Mobile Network，PLMN)ID可以与第一UE关联的PLMN ID相同，也可以不同。
如此，通过中继终端发现阶段的安全信息保护用于建立通信链路的DCR消息，可以提高基于U2U中继的第一UE与第二UE间的通信安全性，在发现及链路建立阶段提高整体的安全性。在此基础上，通过广播DCR消息代替向选中的中继终端单独发送DCR消息，可以节省当前需要连接第二UE的第一UE选择中继终端产生的资源开销。
需要说明的是，关于DCR消息以及安全信息的内容及解释请参考步骤S110部分作出的解释和说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，由第二UE执行，方法可包括：
向第二UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第二UE的标识信息以及安全能力；
接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中继终端在发现请求过程中确定的安全信息；
当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护。
在一个实施例中，当接收到信号覆盖范围内的多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护。
在本公开实施例中，当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护。其中，DCR消息用于请求建立第一UE与第二UE的通信连接，例如建立通过中继终端的PC5通信。
这里，关于安全信息以及DCR消息的限定以及说明请具体参见步骤S310部分的相关说明，在此不再赘述。
在一个实施例中，当接收到信号覆盖范围内的多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全参数验证新的DCR消息；若验证成功，则基于多个中继终端的性能参数，在多个中继终端中确定一个目标中继终端；通过目标中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护。这里，多个中继终端可以为多个接收到第一UE的DCR消息的中继终端，或者，也可以为多个广播新的DCR消息的中继终端。例如，第二UE在接收到的新的DCR消息对应的多个中继终端中，选择一个目标中继终端。其中，中继终端的性能参数可以包括服务质量(Quality of Service，QoS)等。
在一个实施例中，通过目标中继终端与第一UE建立通信连接，可以包括：向确定的目标中继终端发送反馈消息，并通过目标中继终端与第一UE建立通信连接。
在一个实施例中，通过目标中继终端与第一UE建立通信连接，包括：在与目标中继终端的直接认证以及密钥生成过程完成后，向目标中继终端发送安全模式命令消息；当接收到目标中继终端返回的安全模式完成消息，发送直接通信接受消息；在目标中继终端与第一UE完成直接认证以及密钥生成过程完成后，通过目标中继终端与第一UE建立通信连接。这里，与目标中继终端的直接认证以及密钥生成过程，可以为向目标中继终端发送反馈消息后目标中继终端发起的。在与目标中继终端的直接认证以及密钥生成过程完成后，第二UE可以获取根密钥。
在一个实施例中，当接收到信号覆盖范围内的多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全参数验证新的DCR消息；若验证成功，则在多个中继终端中确定一个目标中继终端；在与目标中继终端的直接认证以及密钥生成过程完成后，基于根密钥导出保密密钥(New Radio PC5Encryption Key，NRPEK)和完整性密钥(New Radio PC5Integrity Key，NRPIK)；基于NRPEK和NRPIK生成安全模式命令消息，并向目标中继终端发送安全模式命令消息；当接收到目标中继终端返回的安全模式完成消息，发送直接通信接受消息；在目标中继终端与第一UE完成直接认证以及密钥生成过程完成后，通过目标中继终端与第一UE建立通信连接。
在一个实施例中，安全模式命令消息可以包含第二UE选择的安全算法，这里的安全算法可以为用于保护第一UE与第二UE间通信连接的算法，例如可以为与UE发现阶段的安全信息中的第一安全算法不同的第二安全算法，第二安全算法也可以用于保护安全模式命令消息，例如第二安全算法可以为PC5安全算法等。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图12所示，本公开实施例提供一种通信控制方法，由第一功能网元执行，方法可包括：
S410：向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在本公开实施例中，第一功能网元可以为第一UE和/或第二UE关联的DDNMF或PKMF等功能，第一UE关联的第一功能网元可以与第二UE关联的第一功能网元相同，也可以不同。安全信息可以用于保护第一UE广播的DCR消息中的信息。
在一个实施例中，向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配且与第一UE和/或第二UE的安全能力匹配的安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，安全信息可以包括：安全参数以及安全算法，其中，安全参数可以为RSC对应的代码安全参数、代码发送安全参数、代码接收安全参数等，安全算法可以为RSC对应的发现加密算法等。DCR消息携带的信息通过安全信息保护，例如可以为DCR消息携带的信息通过基于安全算法的安全参数进行保护等。
在一个实施例中，安全信息可以包括：中继终端在发现请求过程中确定的安全信息，安全信息可以为第一功能网元向中继终端关联的第二功能网元获取的，例如第一功能网元在发现请求过程中接收到中继终端的标识信息，则向该标识信息关联的第二功能网元获取存储的安全信息。
在一个实施例中，在第一UE和/或第二UE的发现请求过程中，向第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
如图13所示，本公开实施例提供一种通信控制方法，由第一功能网元执行，方法可包括：
S401：接收第一功能网元关联的第一UE和/或第二UE的预设消息；预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力。
在一个实施例中，步骤S401可与步骤S410组合，形成的方法包括：接收第一功能网元关联的第一UE和/或第二UE的预设消息；预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力；向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
这里，预设消息可以为用于请求接入U2U中继服务的发现请求消息，预设消息中携带的RSC可以为第一UE和/或第二UE支持的中继服务对应的RSC，该RSC可以用于确定符合第一UE和/或第二UE支持的中继服务的中继终端。安全能力为第一UE的安全能力，例如可以为第一UE在发现阶段对应的第一安全能力。第一安全能力可以为直连通信接口PC5安全能力，在第一安全能力中可以记录第一UE支持的安全算法，例如可以以安全算法列表的形式记录等。与RSC匹配的安全信息，可以包括与RSC对应的安全参数和/或安全算法。
在一个实施例中，响应消息携带的安全信息可以为中继终端在发现请求过程中确定的用于发现的安全信息。
向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配的安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，接收第一功能网元关联的第一UE和/或第二UE的预设消息；预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力；向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配且与第一UE和/或第二UE的安全能力匹配的安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。例如，向第一UE返回的响应消息携带的安全算法，属于第一UE的安全能力指示的安全算法列表；向第二UE返回的响应消息携带的安全算法，属于第二UE的安全能力指示的安全算法列表。
在一个实施例中，接收第一功能网元关联的第一UE和/或第二UE的预设消息；预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力；向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配的安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接；若不存在与预设消息中的RSC匹配的安全信息，则向第一UE和/或第二UE返回拒绝消息。其中，拒绝消息用于指示第一UE和/或第二UE没有被授权使用该RSC对应的中继服务。
在一个实施例中，基于第一UE和/或第二UE的标识信息，向ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，则确定安全信息；向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，将携带第一UE和/或第二UE的标识信息的鉴权请求发送至ProSe应用服务器；若接收到ProSe应用服务器返回的鉴权通过消息，则确定安全信息；向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。例如，鉴权请求可以携带第一UE和/或第二UE的用户信息ID。
在一个实施例中，ProSe应用服务器返回的鉴权通过消息，可以指示第一UE和/或第二UE具备访问U2U中继服务的权限，则可以继续确定对应的安全信息进行中继服务。
在一个实施例中，基于第一UE和/或第二UE的标识信息，向ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，则获取中继终端在发现请求过程中确定的安全信息；向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，基于第一UE和/或第二UE的标识信息，向ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，则获取第一UE和/或第二UE提供的至少一个中继终端的标识信息；在中继终端的标识信息指示的PLMN与第一功能网元对应的PLMN不同时，向中继终端的标识信息关联的第二功能网元获取中继终端在发现请求过程中确定的安全参数以及安全算法；在中继终端的标识信息指示的PLMN与第一功能网元对应的PLMN相同时，在第一功能网元的本地存储中查询中继终端在发现请求过程中确定的安全参数以及安全算法。若向第二功能网元获取的安全算法与第一UE和/或第二UE的安全能力匹配，则基于安全参数、安全算法以及安全算法对应的RSC确定安全信息；向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
需要说明的是，关于DCR消息以及安全信息的内容及解释可参考步骤S110部分作出的解释和说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图14所示，本公开实施例提供一种通信控制方法，由第二功能网元执行，方法可包括：
S510：向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，基于第二功能网元关联的中继终端发送的发现请求消息，向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。其中，发现请求消息中可以携带以下至少之一：中继终端对应的RSC、中继终端的标识信息以及安全能力。
如图15所示，本公开实施例提供一种通信控制方法，由第二功能网元执行，方法可包括：
S501：接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力。
在一个实施例中，步骤S501可与步骤S510结合，形成的技术方案包括：接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，ProSe应用服务器返回的鉴权通过消息，可以指示中继终端具备提供U2U中继服务的权限，则可以继续确定对应的安全信息进行中继服务。
在一个实施例中，接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；基于安全能力指示的中继终端支持的算法列表，确定中继终端的安全算法；将携带中继终端的标识信息以及RSC的鉴权请求发送至ProSe应用服务器；若接收到ProSe应用服务器返回的鉴权通过消息，基于安全算法、中继终端的安全参数以及RSC确定安全信息；向中继终端返回安全信息以及中继终端对应的RSC。
在一个实施例中，接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；基于安全能力指示的中继终端支持的算法列表，确定中继终端的安全算法；将携带中继终端的标识信息以及RSC的鉴权请求发送至ProSe应用服务器；若接收到ProSe应用服务器返回的鉴权通过消息，基于安全算法、中继终端的安全参数以及RSC确定安全信息；向中继终端返回安全信息以及中继终端对应的RSC，并将安全信息与中继终端的RSC共同存储。例如，第二功能网元可以以绑定关系或映射关系等形式存储于本地。
需要说明的是，关于DCR消息以及安全信息的内容及解释可参考步骤S110部分作出的解释和说明，此处不再赘述。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，由ProSe应用服务器执行，方法包括：
当接收到第一功能网元发送的鉴权请求，基于鉴权请求中的第一UE和/或第二UE的标识信息，确定第一UE和/或第二UE是否具备访问U2U中继服务的权限；
若具备，则向第一功能网元返回鉴权通过消息；
和/或，当接收到第二功能网元发送的鉴权请求，基于鉴权请求中的中继终端的标识信息以及RSC，确定中继终端是否具备提供U2U中继服务的权限；
若具备，则向第二功能网元返回鉴权通过消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，方法包括：
第一功能网元向第一功能网元关联的第一UE和/或第二UE提供安全信息；
和/或，第二功能网元向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，第一功能网元接收第一功能网元关联的第一UE和/或第二UE的预设消息； 预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力；向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配的安全信息；
和/或，第二功能网元接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；基于安全能力指示的中继终端支持的算法列表，确定中继终端的安全算法；基于中继终端的标识信息以及RSC，向邻近服务ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，基于安全算法、中继终端的安全参数以及RSC确定安全信息；向中继终端返回安全信息。
需要说明的是，关于第一功能网元执行的动作和相关说明可参考步骤S410及其相关步骤，关于第二功能网元执行的动作和相关说明可参考步骤S510及其相关步骤。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，方法包括：
中继终端向中继终端关联的第二功能网元请求获取安全信息；
第二功能网元向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，中继终端向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：RSC、中继终端的标识信息以及安全能力；第二功能网元向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，中继终端向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：RSC、中继终端的标识信息以及安全能力；第二功能网元基于预设消息进行鉴权后，向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，接收第二功能网元关联的中继终端的预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；基于安全能力指示的中继终端支持的算法列表，确定中继终端的安全算法；将携带中继终端的标识信息以及RSC的鉴权请求发送至ProSe应用服务器；若接收到ProSe应用服务器返回的鉴权通过消息，基于安全算法、中继终端的安全参数以及RSC确定安全信息；向中继终端返回安全信息以及中继终端对应的RSC，并将安全信息与中继终端的RSC共同存储。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，方法包括：
第一功能网元基于第一UE和/或第二UE的标识信息，向ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，则向第一功能网元关联的第一UE和/或第二UE提供安全信息；
第二功能网元基于中继终端的标识信息以及RSC，向ProSe应用服务器发送鉴权请求；若接收到ProSe应用服务器返回的鉴权通过消息，向中继终端返回安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接；
ProSe应用服务器当接收到第一功能网元发送的鉴权请求，基于鉴权请求中的第一UE和/或第二UE的标识信息，确定第一UE和/或第二UE是否具备访问U2U中继服务的权限；若具备，则向第一功能网元返回鉴权通过消息；和/或，当接收到第二功能网元发送的鉴权请求，基于鉴权请求中的中继终端的标识信息以及RSC，确定中继终端是否具备提供U2U中继服务的权限；若具备，则向第二功能网元返回鉴权通过消息。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制方法，方法包括：
第一UE广播DCR消息；DCR消息携带的信息通过安全信息保护；安全信息包括：安全参数和 /或安全算法；
第一中继终端与第二中继终端获取第一UE广播的DCR消息，并基于安全参数校验DCR消息；若校验成功则广播新的DCR消息；
第二UE获取第一中继终端与第二中继终端广播的新的DCR消息，并确定第二中继终端为目标中继终端；
第二中继终端建立第一UE与第二UE的通信连接。
在一个实施例中，第一UE广播DCR消息；DCR消息携带的信息通过安全信息保护；在多个响应DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收目标中继终端发送的安全模式命令消息；基于中间密钥生成的完整性密钥和/或安全算法验证安全模式命令消息的完整性，并在验证通过后向目标中继终端返回安全模式完成消息；当接收到目标中继终端发送的直接通信接受消息，通过目标中继终端与第二UE建立通信连接；
第一中继终端获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息；若校验成功且DCR消息携带的RSC与第一中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；
第二中继终端获取第一UE广播的DCR消息，DCR消息携带的信息通过安全信息保护；基于安全参数校验DCR消息；若校验成功且DCR消息携带的RSC与第二中继终端的RSC一致，则广播新的DCR消息；
第二UE获取第一中继终端与第二中继终端广播的新的DCR消息；基于安全参数验证新的DCR消息；若验证成功，则基于第一中继终端与第二中继终端的性能参数，确定第二中继终端为目标中继终端；向目标中继终端发送反馈消息；
第二中继终端接收到反馈消息后建立第一UE与第二UE的通信连接。
需要说明的是，关于第一UE执行的动作和相关说明可参考步骤S110及其相关步骤，关于第一中继终端及第二中继终端执行的动作和相关说明可参考步骤S210及其相关步骤，关于第二UE执行的动作和相关说明可参考步骤S310及其相关步骤。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
本公开实施例提供一种通信控制系统，包括：第一UE、中继终端、第二UE、第一功能网元和/或第二功能网元；
第一UE，用于广播DCR消息；DCR消息携带的信息通过安全信息保护；通过响应DCR消息的中继终端与第二UE建立通信连接；
中继终端，用于获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；响应于DCR消息建立第一UE与第二UE的通信连接；
第二UE，用于当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护；
第一功能网元，至少用于向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接；
第二功能网元，至少用于向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一个实施例中，第一功能网元与第二功能网元可以为同一个功能网元，也可以为不同的功能网元。当第一功能网元与第二功能网元为同一个功能网元时，通信控制系统可以包含第一功能网元或第二功能网元，此时第一功能网元或第二功能网元均可用于向关联的第一UE和/或第二UE提供安全信息以及向第二功能网元关联的中继终端提供安全信息；当第一功能网元与第二功能网元为不同的功能网元时，通信控制系统可以包含第一功能网元和第二功能网元。
需要说明的是，关于第一UE执行的动作和相关说明可参考步骤S110及其相关步骤，关于第一 中继终端及第二中继终端执行的动作和相关说明可参考步骤S210及其相关步骤，关于第二UE执行的动作和相关说明可参考步骤S310及其相关步骤，关于第一功能网元执行的动作和相关说明可参考步骤S410及其相关步骤，关于第二功能网元执行的动作和相关说明可参考步骤S510及其相关步骤。
需要说明的是，前述实施例中记载的技术特征在不矛盾的情况下可以任意排列组合以及交换顺序，可以任意组合成新的方法技术方案。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图16所示，本公开实施例提供一种通信控制方法，可应用于U2U中继通信，也可用于测距/侧行链路定位服务。在测距/侧行链路定位服务中，第一UE即源UE可以作为参考UE，第二UE即目标UE可以作为目标用户设备，中继终端可以作为辅助UE。
本公开实施例提供一种通信控制方法，包括：
中继终端向第二功能网元DDNMF或PKMF发送包含其用户信息ID、中继服务代码(RSC)的发现请求消息，以便获得相关联的安全信息。此外，中继终端包括PC5安全能力，该安全能力包含发现请求消息中指示的中继终端支持的安全算法列表。
在一个实施例中，用户信息ID采用NAI格式或64位字符串的形式。如果用户信息ID为NAI格式，例如“username@realm”，则“realm”部分应包括归属网络标识符(即HPLMN ID)。
本公开实施例提供一种通信控制方法，包括：
第二功能网元可以基于用户信息ID和RSC与ProSe应用服务器交互以检查中继终端的授权。
本公开实施例提供一种通信控制方法，包括：
中继终端对应的HPLMN中的第二功能网元DDNMF返回相应的代码安全参数以及CURRENT_TIME和MAX_OFFSET参数。代码安全参数为中继终端提供必要的信息，以保护DCR消息中的信息，并与RSC一起存储。中继终端的第二功能网元应在发现响应消息中包括所选的第一安全算法。第二功能网元基于RSC和所接收的安全能力来确定所选择的第一安全算法。中继终端将所选择的第一安全算法与RSC一起存储。
本公开实施例提供一种通信控制方法，包括：
源UE和/或目标UE向关联的第一功能网元DDNMF发送包含RSC、用户信息ID及其安全能力的发现请求消息，以便被允许使用U2U中继服务。
本公开实施例提供一种通信控制方法，包括：
源UE和/或目标UE关联的第一功能网元DDNMF向ProSe应用服务器发送鉴权请求。如果基于权限设置，允许用户信息ID访问U2U中继服务，则ProSe应用服务器返回鉴权响应，例如鉴权通过消息。
本公开实施例提供一种通信控制方法，包括：
如果鉴权通过并且安全能力包括所选择的第一安全算法，则第一功能网元用发现响应消息进行响应，该发现响应消息包括RSC、相应的代码安全参数和基于存储的信息/密钥所选择的第一安全算法。
在一个实施例中，源UE和/或目标UE可以在应用容器中提供中继终端的用户信息ID。如果中继终端的用户信息ID中的PLMN ID指示与第一功能网元不同的PLMN，则源UE和/或目标UE关联的第一功能网元DDNMF联系中继终端的用户信息ID中的PLMN ID所指示的PLMN对应的第二功能网元DDNMF(即中继终端的HPLMN中的5G DDNMF)以获得相应的代码安全参数。
本公开实施例提供一种通信控制方法，包括：
源UE需要经由中继终端与目标UE建立通信。源UE广播直接通信请求DCR消息，该直接通信请求消息包含源UE的用户信息ID和目标UE的信息ID、RSC、凭证ID、第一随机数1及其安全能力。该消息将由第一中继终端和第二中继终端接收。源UE和/或目标UE的用户信息ID受基于所选的第一安全算法的代码安全参数保护。
在一个实施例中，在U2U发现和链路建立过程之前，源UE和/或目标UE和中继终端都可以被 提供或预配置有长期凭证和长期凭证ID。长期凭证和长期凭证ID也可以由网络(例如PCF/5G DDNMF/5G PKMF/ProSe服务器)提供给UE。
本公开实施例提供一种通信控制方法，包括：
第一中继终端和第二中继终端使用代码安全参数验证DCR消息，并检查RSC。如果他们被授权提供的中继服务对应的RSC包括DCR消息中的RSC，则在其附近广播新的直接通信请求消息。中继终端广播的新的直接通信请求消息，包括源UE的用户信息ID、目标UE的信息ID和中继终端的信息ID、凭证ID、第二随机数1’及其的安全能力。中继终端存储源UE的标识信息(例如，源UE的用户信息ID)与新的直接通信请求之间的关联。源UE、目标UE以及中继终端的用户信息ID由基于所选的第一安全算法的代码安全参数保护。
本公开实施例提供一种通信控制方法，包括：
目标UE接收来自第一中继终端和第二中继终端的新的直接通信请求。目标UE通过使用代码安全参数验证DCR消息，并基于QoS等指标选择第二中继终端，则可以启动目标UE与第二中继终端的直接认证和密钥建立过程，以生成第一中间密钥Knrp。
本公开实施例提供一种通信控制方法，包括：
目标UE从Knrp导出会话密钥(Knrp-SESS)，然后根据PC5安全策略导出保密密钥(NRPEK)和完整性密钥(NRPIK)。目标UE向第二中继终端发送直接安全模式命令消息，该消息应包括所选的第二安全算法以及nonce 2'，并进行保护。
本公开实施例提供一种通信控制方法，包括：
验证通过后，第二中继终端用直接安全模式完成消息向目标UE作出响应。
本公开实施例提供一种通信控制方法，包括：
若从第二中继终端接收到直接安全模式完成消息，目标UE将直接通信接受消息发送到第二中继终端。
本公开实施例提供一种通信控制方法，包括：
可以发起与源UE的直接认证和密钥建立过程，得到第二中间密钥Knrp’。
本公开实施例提供一种通信控制方法，包括：
第二中继终端从Knrp’导出会话密钥(Knrp-SeSS’)，然后根据PC5安全策略导出保密密钥(NRPEK’)和完整性密钥(NRPIK’)。第二中继终端向源UE发送直接安全模式命令消息，该消息应包括所选的PC5安全算法、随机数2，并进行保护。
本公开实施例提供一种通信控制方法，包括：
验证通过后源UE用直接安全模式完成消息来响应第二中继终端。
本公开实施例提供一种通信控制方法，包括：
第二中继终端向源UE发送直接通信接受消息。
本公开实施例提供一种通信控制方法，包括：
通过第二中继终端在源UE和目标UE之间建立安全L3PC5链路。第二中继终端可以在对等ProSe UE之间中继业务。
需要说明的是，前述实施例中记载的技术特征在不矛盾的情况下可以任意排列组合以及交换顺序，可以任意组合成新的方法技术方案。
需要说明的是，本领域内技术人员可以理解，本公开实施例提供的方法，可以被单独执行，也可以与本公开实施例中一些方法或相关技术中的一些方法一起被执行。
如图17所示，本公开实施例提供一种通信控制装置，应用于第一UE，装置包括：
第一建立单元110，被配置为广播DCR消息；DCR消息携带的信息通过安全信息保护；
第二建立单元120，被配置为通过响应DCR消息的中继终端与第二UE建立通信连接。
在一些实施例中，第一建立单元110被配置为：
向第一UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：中继服务代码RSC、第一UE的标识信息以及安全能力；
接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中 继终端在发现请求过程中确定的安全信息。
在一些实施例中，安全信息包括：安全参数和/或安全算法。
在一些实施例中，装置还包括：
第三建立单元，被配置为向第一功能网元提供至少一个中继终端的标识信息；中继终端的标识信息用于供第一功能网元获取对应的安全参数和/或安全算法。
在一些实施例中，DCR消息携带的信息包括以下至少之一：第一UE的标识信息以及安全能力、第二UE的标识信息、RSC、凭证ID以及第一随机数。
在一些实施例中，第二建立单元120，被配置为：
在多个响应DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收目标中继终端发送的安全模式命令消息；
验证安全模式命令消息的完整性，并在验证通过后向目标中继终端返回安全模式完成消息；
当接收到目标中继终端发送的直接通信接受消息，通过目标中继终端与第二UE建立通信连接。
在一些实施例中，第一功能网元包括：直接发现命名管理功能DDNMF或者密钥管理功能PKMF。
如图18所示，本公开实施例提供一种通信控制装置，应用于中继终端，装置包括：
第一处理单元210，被配置为获取第一UE广播的DCR消息；DCR消息携带的信息通过安全信息保护；
第二处理单元220，被配置为响应于DCR消息建立第一UE与第二UE的通信连接。
在一些实施例中，第一处理单元210，被配置为：
向中继终端关联的第二功能网元发送预设消息；预设消息至少携带以下之一：中继终端的标识信息、RSC以及安全能力；
接收第二功能网元基于预设消息返回的安全信息。
在一些实施例中，安全信息包括：安全参数和/或安全算法。
在一些实施例中，DCR消息携带的信息包括以下至少之一：第一UE的标识信息以及安全能力、第二UE的标识信息、RSC、凭证ID以及第一随机数。
在一些实施例中，第二处理单元220，被配置为：
基于安全参数校验DCR消息；
若校验成功且DCR消息携带的RSC与中继终端的RSC一致，则广播新的DCR消息；新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、中继终端的标识信息以及RSC、凭证ID以及第二随机数；
当检测到接收新的DCR消息的第二UE的反馈消息，建立第一UE与第二UE的通信连接。
在一些实施例中，第二处理单元220，被配置为：
在与第二UE的直接认证以及密钥生成过程完成后，响应于第二UE的安全模式命令消息，向第二UE返回安全模式完成消息；
响应于第二UE的直接通信接受消息，在与第一UE的直接认证以及密钥生成过程完成后，向第一UE发送安全模式命令消息；
当接收到第一UE返回的安全模式完成消息，向第一UE发送直接通信接受消息，并建立第一UE与第二UE的通信连接。
在一些实施例中，第二功能网元包括：DDNMF或者PKMF。
如图19所示，本公开实施例提供一种通信控制装置，应用于第二UE，装置包括：
连接单元310，被配置为当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过中继终端与第一UE建立通信连接；DCR消息携带的信息通过安全信息保护。
在一些实施例中，连接单元310，还被配置为：
向第二UE关联的第一功能网元发送预设消息；预设消息至少携带以下之一：RSC、第二UE的标识信息以及安全能力；
接收第一功能网元返回的响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中 继终端在发现请求过程中确定的安全信息。
在一些实施例中，安全信息包括：安全参数和/或安全算法。
在一些实施例中，连接单元310，还被配置为：
向第一功能网元提供至少一个中继终端的标识信息；中继终端的标识信息用于供第一功能网元获取对应的安全参数和/或安全算法。
在一些实施例中，连接单元310，被配置为：
基于安全参数验证新的DCR消息；
若验证成功，则在多个中继终端中确定一个目标中继终端；
通过目标中继终端与第一UE建立通信连接。
在一些实施例中，连接单元310，被配置为：
在与目标中继终端的直接认证以及密钥生成过程完成后，向目标中继终端发送安全模式命令消息；
当接收到目标中继终端返回的安全模式完成消息，发送直接通信接受消息；
在目标中继终端与第一UE完成直接认证以及密钥生成过程完成后，通过目标中继终端与第一UE建立通信连接。
如图20所示，本公开实施例提供一种通信控制装置，应用于第一功能网元，装置包括：
执行单元410，被配置为向第一功能网元关联的第一UE和/或第二UE提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一些实施例中，执行单元410，被配置为：
接收第一功能网元关联的第一UE和/或第二UE的预设消息；预设消息至少携带以下之一：RSC、第一UE和/或第二UE的标识信息以及安全能力；
向第一UE和/或第二UE返回响应消息；响应消息携带与RSC匹配的安全信息；安全信息包括：中继终端在发现请求过程中确定的安全信息。
在一些实施例中，安全信息包括：安全参数和/或安全算法。
在一些实施例中，执行单元410，还被配置为：
基于第一UE和/或第二UE的标识信息，向邻近服务ProSe应用服务器发送鉴权请求；
若接收到ProSe应用服务器返回的鉴权通过消息，则确定安全信息。
在一些实施例中，执行单元410，被配置为：
获取第一UE和/或第二UE提供的至少一个中继终端的标识信息；
向中继终端的标识信息关联的第二功能网元获取发现请求过程中确定的安全参数以及安全算法；
若向第二功能网元获取的安全算法与第一UE和/或第二UE的安全能力匹配，则基于安全参数、安全算法以及安全算法对应的RSC确定安全信息。
如图21所示，本公开实施例提供一种通信控制装置，应用于第二功能网元，装置包括：
操作单元510，被配置为向第二功能网元关联的中继终端提供安全信息；安全信息用于第一UE和第二UE通过中继终端建立通信连接。
在一些实施例中，操作单元510，被配置为：
接收第二功能网元关联的中继终端的预设消息；预设消息至少携带：中继终端的标识信息、RSC以及安全能力；
基于安全能力指示的中继终端支持的算法列表，确定中继终端的安全算法；
基于中继终端的标识信息以及RSC，向邻近服务ProSe应用服务器发送鉴权请求；
若接收到ProSe应用服务器返回的鉴权通过消息，基于安全算法、中继终端的安全参数以及RSC确定安全信息；
向中继终端返回安全信息。
本公开实施例提供一种通信设备，包括：
用于存储处理器可执行指令的存储器；
处理器，分别存储器连接；
其中，处理器被配置为执行前述任意技术方案提供的信息处理方法。
处理器可包括各种类型的存储介质，该存储介质为非临时性计算机存储介质，在通信设备掉电之后能够继续记忆存储其上的信息。
这里，通信设备包括：终端或者网元，该网元可为前述第一网元至第四网元中的任意一个。
处理器可以通过总线等与存储器连接，用于读取存储器上存储的可执行程序，例如，如图2至图16所示的方法的至少其中之一。
图22是根据一示例性实施例示出的一种终端800的框图。例如，终端800可以是移动电话，计算机，数字广播用户设备，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
参照图22，终端800可以包括以下一个或多个组件：处理组件802，存储器804，电源组件806，多媒体组件808，音频组件810，输入/输出(I/O)的接口812，传感器组件814，以及通信组件816。
处理组件802通常控制终端800的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理组件802可以包括一个或多个处理器820来执行指令，以生成上述的方法的全部或部分步骤。此外，处理组件802可以包括一个或多个模块，便于处理组件802和其他组件之间的交互。例如，处理组件802可以包括多媒体模块，以方便多媒体组件808和处理组件802之间的交互。
存储器804被配置为存储各种类型的数据以支持在终端800的操作。这些数据的示例包括用于在终端800上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器804可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电源组件806为终端800的各种组件提供电力。电源组件806可以包括电源管理系统，一个或多个电源，及其他与为终端800生成、管理和分配电力相关联的组件。
多媒体组件808包括在终端800和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件808包括一个前置摄像头和/或后置摄像头。当终端800处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜系统或具有焦距和光学变焦能力。
音频组件810被配置为输出和/或输入音频信号。例如，音频组件810包括一个麦克风(MIC)，当终端800处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器804或经由通信组件816发送。在一些实施例中，音频组件810还包括一个扬声器，用于输出音频信号。
I/O接口812为处理组件802和外围接口模块之间提供接口，上述外围接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件814包括一个或多个传感器，用于为终端800提供各个方面的状态评估。例如，传感器组件814可以检测到设备800的打开/关闭状态，组件的相对定位，例如组件为终端800的显示器和小键盘，传感器组件814还可以检测终端800或终端800一个组件的位置改变，用户与终端800接触的存在或不存在，终端800方位或加速/减速和终端800的温度变化。传感器组件814可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件814还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件814还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件816被配置为便于终端800和其他设备之间有线或无线方式的通信。终端800可以接 入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件816经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件816还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，终端800可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读存储介质，例如包括指令的存储器804，上述指令可由终端800的处理器820执行以生成上述方法。例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
如图23所示，本公开一实施例示出一种通信设备900的结构。例如，通信设备900可以被提供为一网络侧设备。该通信设备900可为前述基站。
参照图23，通信设备900包括处理组件922，其进一步包括一个或多个处理器，以及由存储器932所代表的存储器资源，用于存储可由处理组件922的执行的指令，例如应用程序。存储器932中存储的应用程序可以包括一个或一个以上的每一个对应于一组指令的模块。此外，处理组件922被配置为执行指令，以执行上述方法前述应用在基站执行的任意方法，例如，如图2至图16所示的方法的至少其中之一。
通信设备900还可以包括一个电源组件926被配置为执行通信设备900的电源管理，一个有线或无线网络接口950被配置为将通信设备900连接到网络，和一个输入输出(I/O)接口958。通信设备900可以操作基于存储在存储器932的操作系统，例如Windows Server TM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM或类似。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本发明的其它实施方案。本公开旨在涵盖本发明的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本发明的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本发明的真正范围和精神由所附的权利要求指出。
应当理解的是，本发明并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本发明的范围仅由所附的权利要求来限制。

Claims (35)

  1. 一种通信控制方法，其中，由第一UE执行，所述方法包括：
    广播直接通信请求DCR消息；所述DCR消息携带的信息通过安全信息保护；
    通过响应所述DCR消息的中继终端与第二UE建立通信连接。
  2. 根据权利要求1所述的方法，其中，所述方法还包括：
    向第一UE关联的第一功能网元发送预设消息；所述预设消息至少携带以下之一：中继服务代码RSC、所述第一UE的标识信息以及安全能力；
    接收所述第一功能网元返回的响应消息；所述响应消息携带与所述RSC匹配的安全信息；所述安全信息包括：中继终端在发现请求过程中确定的安全信息。
  3. 根据权利要求2所述的方法，其中，所述安全信息包括：安全参数和/或安全算法。
  4. 根据权利要求3所述的方法，其中，所述方法还包括：
    向所述第一功能网元提供至少一个中继终端的标识信息；所述中继终端的标识信息用于供所述第一功能网元获取对应的安全参数和/或安全算法。
  5. 根据权利要求2至4任一项所述的方法，其中，所述第一功能网元包括：直接发现命名管理功能DDNMF或者密钥管理功能PKMF。
  6. 根据权利要求1所述的方法，其中，所述DCR消息携带的信息包括以下至少之一：第一UE的标识信息以及安全能力、第二UE的标识信息、RSC、凭证ID以及第一随机数。
  7. 根据权利要求1所述的方法，其中，所述通过响应所述DCR消息的中继终端与第二UE建立通信连接，包括：
    在多个响应所述DCR消息的中继终端中的一个目标中继终端发起的直接认证以及密钥生成过程完成后，接收所述目标中继终端发送的安全模式命令消息；
    验证所述安全模式命令消息的完整性，并在验证通过后向所述目标中继终端返回安全模式完成消息；
    当接收到所述目标中继终端发送的直接通信接受消息，通过所述目标中继终端与第二UE建立通信连接。
  8. 一种通信控制方法，其中，由中继终端执行，所述方法包括：
    获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；
    响应于所述DCR消息建立所述第一UE与第二UE的通信连接。
  9. 根据权利要求8所述的方法，其中，所述方法还包括：
    向中继终端关联的第二功能网元发送预设消息；所述预设消息至少携带以下之一：所述中继终端的标识信息、RSC以及安全能力；
    接收所述第二功能网元基于所述预设消息返回的安全信息。
  10. 根据权利要求9所述的方法，其中，所述安全信息包括：安全参数和/或安全算法。
  11. 根据权利要求10所述的方法，其中，所述响应于所述DCR消息建立所述第一UE与第二UE的通信连接，包括：
    基于所述安全参数校验所述DCR消息；
    若校验成功且所述DCR消息携带的RSC与所述中继终端的RSC一致，则广播新的DCR消息；所述新的DCR消息至少携带以下之一：第一UE的标识信息以及安全能力、第二UE的标识信息、所述中继终端的标识信息以及RSC、凭证ID以及第二随机数；
    当检测到接收所述新的DCR消息的第二UE的反馈消息，建立所述第一UE与第二UE的通信连接。
  12. 根据权利要求11所述的方法，其中，所述建立所述第一UE与第二UE的通信连接，包括：
    在与第二UE的直接认证以及密钥生成过程完成后，响应于所述第二UE的安全模式命令消息，向所述第二UE返回安全模式完成消息；
    响应于所述第二UE的直接通信接受消息，在与第一UE的直接认证以及密钥生成过程完成后， 向所述第一UE发送安全模式命令消息；
    当接收到所述第一UE返回的安全模式完成消息，向所述第一UE发送直接通信接受消息，并建立所述第一UE与第二UE的通信连接。
  13. 根据权利要求9至12任一项所述的方法，其中，所述第二功能网元包括：DDNMF或者PKMF。
  14. 根据权利要求8所述的方法，其中，所述DCR消息携带的信息包括以下至少之一：第一UE的标识信息以及安全能力、第二UE的标识信息、RSC、凭证ID以及第一随机数。
  15. 一种通信控制方法，其中，由第二UE执行，所述方法包括：
    当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护。
  16. 根据权利要求15所述的方法，其中，所述方法还包括：
    向第二UE关联的第一功能网元发送预设消息；所述预设消息至少携带以下之一：RSC、所述第二UE的标识信息以及安全能力；
    接收所述第一功能网元返回的响应消息；所述响应消息携带与所述RSC匹配的安全信息；所述安全信息包括：中继终端在发现请求过程中确定的安全信息。
  17. 根据权利要求15或16所述的方法，其中，所述安全信息包括：安全参数和/或安全算法。
  18. 根据权利要求17所述的方法，其中，所述方法还包括：
    向所述第一功能网元提供至少一个中继终端的标识信息；所述中继终端的标识信息用于供所述第一功能网元获取对应的安全参数和/或安全算法。
  19. 根据权利要求17所述的方法，其中，所述基于安全信息通过所述中继终端与第一UE建立通信连接，包括：
    基于安全参数验证所述新的DCR消息；
    若验证成功，则在多个中继终端中确定一个目标中继终端；
    通过所述目标中继终端与第一UE建立通信连接。
  20. 根据权利要求19所述的方法，其中，所述通过所述目标中继终端与第一UE建立通信连接，包括：
    在与所述目标中继终端的直接认证以及密钥生成过程完成后，向所述目标中继终端发送安全模式命令消息；
    当接收到所述目标中继终端返回的安全模式完成消息，发送直接通信接受消息；
    在所述目标中继终端与第一UE完成直接认证以及密钥生成过程完成后，通过所述目标中继终端与第一UE建立通信连接。
  21. 一种通信控制方法，其中，由第一功能网元执行，所述方法包括：
    向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接。
  22. 根据权利要求21所述的方法，其中，所述向第一功能网元关联的第一UE和/或第二UE提供安全信息，包括：
    接收第一功能网元关联的第一UE和/或第二UE的预设消息；所述预设消息至少携带以下之一：RSC、所述第一UE和/或第二UE的标识信息以及安全能力；
    向所述第一UE和/或第二UE返回响应消息；所述响应消息携带与所述RSC匹配的安全信息；所述安全信息包括：中继终端在发现请求过程中确定的安全信息。
  23. 根据权利要求22所述的方法，其中，所述安全信息包括：安全参数和/或安全算法。
  24. 根据权利要求22所述的方法，其中，所述方法还包括：
    基于所述第一UE和/或第二UE的标识信息，向邻近服务ProSe应用服务器发送鉴权请求；
    若接收到所述ProSe应用服务器返回的鉴权通过消息，则确定安全信息。
  25. 根据权利要求24所述的方法，其中，所述确定安全信息，包括：
    获取所述第一UE和/或第二UE提供的至少一个中继终端的标识信息；
    向所述中继终端的标识信息关联的第二功能网元获取发现请求过程中确定的安全参数以及安全 算法；
    若向所述第二功能网元获取的安全算法与所述第一UE和/或第二UE的安全能力匹配，则基于所述安全参数、安全算法以及所述安全算法对应的RSC确定安全信息。
  26. 一种通信控制方法，其中，由第二功能网元执行，所述方法包括：
    向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
  27. 根据权利要求26所述的方法，其中，所述向第二功能网元关联的中继终端提供安全信息，包括：
    接收所述第二功能网元关联的中继终端的预设消息；所述预设消息至少携带以下之一：所述中继终端的标识信息、RSC以及安全能力；
    基于所述安全能力指示的所述中继终端支持的算法列表，确定所述中继终端的安全算法；
    基于所述中继终端的标识信息以及RSC，向邻近服务ProSe应用服务器发送鉴权请求；
    若接收到所述ProSe应用服务器返回的鉴权通过消息，基于所述安全算法、所述中继终端的安全参数以及所述RSC确定安全信息；
    向所述中继终端返回所述安全信息。
  28. 一种通信控制系统，其中，所述系统包括：第一UE、中继终端、第二UE、第一功能网元以及第二功能网元；
    所述第一UE，用于广播DCR消息；所述DCR消息携带的信息通过安全信息保护；通过响应所述DCR消息的中继终端与第二UE建立通信连接；
    所述中继终端，用于获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；响应于所述DCR消息建立所述第一UE与第二UE的通信连接；
    所述第二UE，用于当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护；
    所述第一功能网元，用于向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接；
    所述第二功能网元，用于向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
  29. 一种通信控制装置，其中，应用于第一UE，所述装置包括：
    第一建立单元，被配置为广播DCR消息；所述DCR消息携带的信息通过安全信息保护；
    第二建立单元，被配置为通过响应所述DCR消息的中继终端与第二UE建立通信连接。
  30. 一种通信控制装置，其中，应用于中继终端，所述装置包括：
    第一处理单元，被配置为获取第一UE广播的DCR消息；所述DCR消息携带的信息通过安全信息保护；
    第二处理单元，被配置为响应于所述DCR消息建立所述第一UE与第二UE的通信连接。
  31. 一种通信控制装置，其中，应用于第二UE，所述装置包括：
    连接单元，被配置为当接收到多个中继终端基于第一UE的DCR消息广播的新的DCR消息，基于安全信息通过所述中继终端与第一UE建立通信连接；所述DCR消息携带的信息通过所述安全信息保护。
  32. 一种通信控制装置，其中，应用于第一功能网元，所述装置包括：
    执行单元，被配置为向第一功能网元关联的第一UE和/或第二UE提供安全信息；所述安全信息用于第一UE和第二UE通过中继终端建立通信连接。
  33. 一种通信控制装置，其中，应用于第二功能网元，所述装置包括：
    操作单元，被配置为向第二功能网元关联的中继终端提供安全信息；所述安全信息用于第一UE和第二UE通过所述中继终端建立通信连接。
  34. 一种通信设备，包括处理器、存储器及存储在存储器上并能够由所述处理器运行的可执行 程序，其中，所述处理器运行所述可执行程序时执行如权利要求1至27中任一项提供的方法。
  35. 一种计算机存储介质，所述计算机存储介质存储有可执行程序；所述可执行程序被处理器执行后，能够实现如权利要求1至27中任一项提供的方法。
PCT/CN2022/129933 2022-11-04 2022-11-04 通信控制方法、系统及装置、通信设备及存储介质 WO2024092735A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/129933 WO2024092735A1 (zh) 2022-11-04 2022-11-04 通信控制方法、系统及装置、通信设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/129933 WO2024092735A1 (zh) 2022-11-04 2022-11-04 通信控制方法、系统及装置、通信设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024092735A1 true WO2024092735A1 (zh) 2024-05-10

Family

ID=90929423

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/129933 WO2024092735A1 (zh) 2022-11-04 2022-11-04 通信控制方法、系统及装置、通信设备及存储介质

Country Status (1)

Country Link
WO (1) WO2024092735A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107251591A (zh) * 2015-03-13 2017-10-13 英特尔Ip公司 用于安全的设备到设备发现和通信的系统、方法和设备
CN113825204A (zh) * 2020-06-18 2021-12-21 华硕电脑股份有限公司 无线通信系统中执行pc5单播链路建立过程的方法和设备
WO2022020033A1 (en) * 2020-07-23 2022-01-27 Apple Inc. Protection of communications through user equipment relay
WO2022072891A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay
WO2022067841A1 (zh) * 2020-10-01 2022-04-07 华为技术有限公司 一种安全通信方法、装置及系统
CN115190478A (zh) * 2022-08-29 2022-10-14 中国电信股份有限公司 密钥处理方法、系统以及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107251591A (zh) * 2015-03-13 2017-10-13 英特尔Ip公司 用于安全的设备到设备发现和通信的系统、方法和设备
CN113825204A (zh) * 2020-06-18 2021-12-21 华硕电脑股份有限公司 无线通信系统中执行pc5单播链路建立过程的方法和设备
WO2022020033A1 (en) * 2020-07-23 2022-01-27 Apple Inc. Protection of communications through user equipment relay
WO2022072891A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay
WO2022067841A1 (zh) * 2020-10-01 2022-04-07 华为技术有限公司 一种安全通信方法、装置及系统
CN115190478A (zh) * 2022-08-29 2022-10-14 中国电信股份有限公司 密钥处理方法、系统以及存储介质

Similar Documents

Publication Publication Date Title
WO2024092735A1 (zh) 通信控制方法、系统及装置、通信设备及存储介质
US20230305555A1 (en) Uav flight control method and apparatus, management and control strategy processing method and apparatus for uav, and device and medium
WO2024092467A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2023231018A1 (zh) 个人物联网pin基元凭证配置方法、装置、通信设备及存储介质
WO2024031549A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2024092801A1 (zh) 认证方法、装置、通信设备及存储介质
WO2024031399A1 (zh) Ue加入pin的方法及装置、通信设备及存储介质
WO2024031565A1 (zh) 信息处理方法以及装置、通信设备及存储介质
WO2024031523A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2023070560A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2024092800A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2024021142A1 (zh) 应用程序接口api认证方法、装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
CN111630883B (zh) 传输数据的方法、装置、通信设备及存储介质
WO2023240574A1 (zh) 信息处理方法及装置、通信设备及存储介质
WO2022236602A1 (zh) 能力指示信息的传输方法、装置、通信设备及存储介质
WO2023000139A1 (zh) 传输凭证的方法、装置、通信设备及存储介质
WO2023245354A1 (zh) 安全保护方法、装置、通信设备及存储介质
WO2023230924A1 (zh) 认证方法、装置、通信设备和存储介质
WO2024007325A1 (zh) Eap认证方法、装置、通信设备及存储介质
WO2024031392A1 (zh) 个人物联网信息更新方法、装置、通信设备及存储介质
WO2024031390A1 (zh) 个人物联网信息更新方法、装置、通信设备及存储介质
WO2023240657A1 (zh) 认证与授权方法、装置、通信设备及存储介质
WO2023184105A1 (zh) 获取终端位置的方法、装置、通信设备及存储介质
WO2024065312A1 (zh) 信息处理方法及装置、通信设备及存储介质