US20200099697A1 - Secure group creation in proximity based service communication - Google Patents
Secure group creation in proximity based service communication Download PDFInfo
- Publication number
- US20200099697A1 US20200099697A1 US16/696,091 US201916696091A US2020099697A1 US 20200099697 A1 US20200099697 A1 US 20200099697A1 US 201916696091 A US201916696091 A US 201916696091A US 2020099697 A1 US2020099697 A1 US 2020099697A1
- Authority
- US
- United States
- Prior art keywords
- group
- prose
- ues
- requesting
- server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004891 communication Methods 0.000 title claims abstract description 96
- 238000000034 method Methods 0.000 claims abstract description 40
- 238000010295 mobile communication Methods 0.000 claims 3
- 238000012795 verification Methods 0.000 abstract description 8
- 238000013475 authorization Methods 0.000 description 42
- 230000006870 function Effects 0.000 description 16
- 238000004519 manufacturing process Methods 0.000 description 5
- NRNCYVBFPDDJNE-UHFFFAOYSA-N pemoline Chemical compound O1C(N)=NC(=O)C1C1=CC=CC=C1 NRNCYVBFPDDJNE-UHFFFAOYSA-N 0.000 description 4
- 230000011664 signaling Effects 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 3
- 238000009795 derivation Methods 0.000 description 3
- 230000003993 interaction Effects 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 239000007787 solid Substances 0.000 description 2
- 102100027715 4-hydroxy-2-oxoglutarate aldolase, mitochondrial Human genes 0.000 description 1
- 101001081225 Homo sapiens 4-hydroxy-2-oxoglutarate aldolase, mitochondrial Proteins 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 238000005266 casting Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000001228 spectrum Methods 0.000 description 1
- 238000003860 storage Methods 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
- H04W12/086—Access security using security domains
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/126—Applying verification of the received information the source of the received data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H04L67/16—
-
- H04L67/18—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/52—Network services specially adapted for the location of the user terminal
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
Definitions
- 3GPP 3rd Generation Partnership Project
- ProSe Proximity based Services
- 3GPP SA1 Services Working Group
- UE User Equipment
- ProSe represents a recent and enormous socio-technological trend.
- the principle of these applications is to discover instances of the applications running in devices that are within proximity of each other, and ultimately to also exchange application-related data.
- proximity-based discovery and communications in the public safety community.
- ProSe communication can provide services to the UEs in proximity via an eNB (Evolved Node B) or without the eNB.
- the SA1 requires that the ProSe service be provided to UEs with or without network coverage.
- the UEs can discover other nearby UEs or be discovered by other UEs, and they can communicate with each other. Some use cases can be found in NPL 1.
- the ProSe server is a network element as agreed in 3GPP SA2#97 to NPL 2.
- 3GPP SA3 offers no security solution.
- the present invention has been made to present an overall security solution for the above-mentioned security issues.
- ProSe service the method including requesting a service request to a ProSe server from the requesting device, the service request indicating a request to communicate with the receiving device from the requesting device, performing verification on the requesting and receiving devices by the ProSe server, sending a ProSe Service result to the requesting and receiving devices to inform to be allowed a group member, and starting a group security establishment of the group including the requesting and receiving devices.
- a secure system including a plurality of User Equipments (UEs) and a Proximity based Service (ProSe) server, including a requesting device which requests a communication; and a receiving device which receives a communication request from the requesting device.
- the requesting device and the receiving device have subscribed ProSe service.
- the requesting device requests a service request to the ProSe server, the service request indicating a request to communicate with the receiving device from the requesting device.
- the ProSe server performs verification on the requesting and receiving devices.
- the ProSe server sends a ProSe Service result to the requesting and receiving devices to inform to be allowed a group member.
- the requesting and receiving devices start a group security establishment of the group including the requesting and receiving devices.
- a secure system and a method of forming a secure group in Proximity based Service (ProSe) communication can present solutions for security issues.
- FIG. 1A is a schematic view showing the ProSe Communication scenario in NPL 1;
- FIG. 1B is a schematic view showing the ProSe Communication scenario in NPL 1,
- FIG. 2 is a schematic view showing an example of the systems which provide a method of making a secure communication according to an exemplary embodiment of the present invention
- FIG. 3 is a schematic view showing a secure system of an exemplary embodiment of the present invention.
- FIG. 4 is a sequence diagram explaining a method of making a secure communication of an exemplary embodiment of the invention.
- FIG. 5A is a schematic view showing a One-to-one session
- FIG. 5B is a schematic view showing a One-to-many session.
- FIG. 5C is a schematic view showing a Many-to-many session.
- FIG. 6 is a flow chart showing a method of performing the group management of a case 1C of an exemplary embodiment.
- a UE that supports ProSe requirements and associated procedures refers both to a non-public safety UE and a public safety UE.
- a ProSe-enabled UE that also supports ProSe procedures and capabilities specific to Public Safety.
- a UE that supports ProSe procedures but not capabilities specific to public safety.
- FIGS. 1A and 1B are schematic views showing the ProSe Communication scenarios in NPL 1.
- a system 100 a can decide to perform ProSe Communication using control information exchanged between the UEs 11 , 12 , eNB 19 and an EPC (Evolved Packet Core) 14 (e.g., session management, authorization, security) as shown by the solid arrows in FIG. 1A .
- EPC Evolved Packet Core
- the UEs 11 and 12 can in addition exchange control signaling via the ProSe Communication path as shown by the dashed arrow in FIG. 1A .
- a system 100 b can decide to perform ProSe Communication using control information exchanged between the UEs 11 , 12 , eNB 19 and the EPC 14 (e.g., session management, authorization, security) as shown by the solid arrows in FIG. 1B .
- the eNBs 19 and 20 may coordinate with each other through the EPC 14 or communicate directly for radio resource management as shown by the dashed arrow between the eNBs 19 and 20 in FIG. 1B .
- signaling modifications should be minimized with respect to the existing architecture.
- the UEs 11 and 12 can in addition exchange control signaling via the ProSe Communication path as shown by the dashed arrow between the UE 11 and the UE 12 in FIG. 1B .
- one or more Public Safety UEs may relay the radio resource management control information for other UEs that do not have network coverage.
- the control path can exist directly between Public Safety UEs.
- the Public Safety UEs can rely on pre-configured radio resources to establish and maintain the ProSe Communication.
- a Public Safety Radio Resource Management Function which can reside in a Public Safety UE, can manage the allocation of radio resources for Public Safety ProSe Communication.
- FIG. 2 is a schematic view showing an example of the systems which provide a method of making a secure communication according to an exemplary embodiment of the present invention.
- a system 10 includes the UE 11 , the UE 12 , an E-UTRAN 13 , the EPC 14 , a ProSe Function 15 , a ProSe APP Server 16 , a ProSe APP 17 , and a ProSe APP 18 .
- the UE 11 and the UE 12 can communicate through a PC 5 , the UE 11 and the E-UTRAN 13 communicate through LTE-Uu 1 , and the UE 12 can communicate with the E-UTRAN 13 and the ProSe Function 15 through LTE-Uu 2 and a PC 3 , respectively.
- the EPC 14 and the ProSe Function 15 can communicate through a PC 4
- the ProSe APP server 16 can communicate with the EPC 14 and the ProSe APP 18 through a SG 1 and a PC 1 , respectively
- the ProSe Function 15 can communicate by itself through a PC 6 .
- a new solution is needed for device-to-device direct discovery and communication; for example, a key can be sent from the network to communicating parties, a key can be created between communicating parties, or a similar algorithm for negotiation can be used directly or via the network. Further, a new solution is also needed for the security over the unlicensed spectrum.
- This mode of operation for ProSe Direct Communication does not require any network assistance to authorize the connection and communication is performed by using only functionality and information local to the UE. This mode is applicable only to pre-authorized ProSe-enabled Public Safety UEs, regardless of whether the UEs are served by E-UTRAN or not.
- Network authorized direct communication This mode of operation for ProSe Direct Communication always requires network assistance and may also be applicable when only one UE is “served by E-UTRAN” for Public safety UEs. For non-Public Safety UEs both UEs must be “served by E-UTRAN”.
- ProSe App Server 16 It is the reference point between the ProSe App Server 16 and the ProSe Function 15 . It is used to define the interaction between the ProSe App Server 16 and ProSe functionality provided by the 3GPP EPS via the ProSe Function 15 .
- One example of use of it may be for application data updates for a ProSe database in the ProSe Function 15 .
- Another example of use of it may be data for use by the ProSe App Server 16 in interworking between 3GPP functionality and application data, e.g. name translation.
- EPC 14 It is the reference point between the EPC 14 and the ProSe Function 15 . It is used to define the interaction between the EPC 14 and the ProSe Function 15 . Possible use cases of it may be when setting up a one-to-one communication path between UEs or when validating ProSe services (authorization) for session management or mobility management in real time.
- This reference point may be used for functions such as ProSe Discovery between users which are subscribed to different PLMNs.
- SGi In addition to the relevant functions defined in TS 29.061 [10] via SGi, it may be used for application data and application level control information exchange.
- FIG. 3 is a schematic view showing a secure system of an exemplary embodiment of the present invention.
- a secure system 1 of an exemplary embodiment of the present invention includes one or more requesting UEs L 01 , an operator network L 02 , and one or more receiving UEs L 03 .
- a method of performing a secure communication includes steps of a secure group management L1, a secure discovery L2, an initial authorization L3, an authentication L4, an authorization L5, a security association establishment L6, a secure communication L7, and a termination L8, which are performed between UEs (the requesting UE L 01 , the receiving UE L 03 ) with or without interacting with the operator network L 02 .
- broadcasting is presented as an example in this exemplary embodiment, but this exemplary embodiment also applies to multiple-casting and one-to-one communications as shown in FIGS. 1A, 1B, and 2 .
- steps L1-L4 can be in a different order depending on the service or application.
- Members can join securely, members can leave securely, and an authorization level of service and each of the members, and any other required information can be modified securely.
- discovery is not secured, a device may start communication with a wrong party or a rogue device, with the result that masquerading attacks can happen that in turn could lead to fraudulent charging.
- the discovery related communication must be secured, i.e., a UE authenticates identity of other UEs in proximity; integrity protection for discovery and a device should be able to authenticate the message.
- the initial authorization based on secure discovery will lead to the decision that the discovered device belongs to the group, and thus the next step can start.
- the next level of authorization will find out what services can be used between the devices which belong to the same group. For example, a UE is allowed to send and receive different types of messages or is only allowed to receive broadcasting messages.
- the UEs which belong to the same group should have keys to protect their communication such that other UEs which do not belong to the group or an attacker cannot eavesdrop or alter the messages.
- the communication between UEs in the same group can be protected by the security association, with integrity and/or confidentiality protection according to the subscription service type.
- the secure termination can provide security when UE(s) suspend or terminate the communication, or when the entire group communication is terminated.
- FIG. 4 is a sequence diagram explaining a method of making a secure communication between UE 100 and network 200 of an exemplary embodiment of the invention.
- a group can be any one of
- a group can be set up for different communication purposes, and group members can be changed.
- the operator network L 02 can check the requesting UE L 01 which requests the UE L 03 which it wants to communicate with, verify devices if they can communicate with each other, and inform the verified devices at both sides (the requesting UE L 01 and the receiving UE L 03 ) of the request and formation.
- a UE 100 requests ProSe subscription to a network 200 and creates a group (Step 1).
- the UE 100 needs to meet conditions, that is policy, e.g. interest, specific location etc.
- the network 200 needs to verify whether UE meets conditions, that is policy, e.g. proximity range, subscription, home network in case of roaming UE, WiFi or not, ProSe enabled, etc.
- the group is strictly formed, for example, the members of the group should be registered in a whitelist, or the group is dynamically formed on a request from the UE 100 , or by the network 200 if the network 200 knows all UE conditions.
- UEs 100 For creating a secure group, UEs 100 must agree to be a part of the group, and only “agreed” UEs 100 become group members.
- a group management includes adding group members, removing group members, ending the group, and adding temporary group members.
- Each UE 100 can see who is in proximity from e.g. a social network application, and requests for ProSe service, and the ProSe server needs to perform the authorization, but does not have to perform discovery.
- a UE (the requesting UE L 01 ) can discover other UEs (the receiving UEs L 03 ) in proximity: (1) Broadcast based, (2) Network based, and (3) Device service level information based. How secure discovery can be done will be described as follows.
- the broadcast message can contain a token that only the given UEs can have.
- the token should be used only once to prevent the receiving side from reusing it.
- the UEs can calculate a token each time on receiving the broadcast message, or the network can inform all the UEs of the token to be used next. This can be used for such a use case as an information notification kind of service, since the token can be reused by the receiving side.
- the broadcast message can be signed by a key that can be verified either by the receiving UEs or by the network for the receiving UEs. Signing can happen by different key management solutions or it can happen using the current keys for communicating with the infrastructure network (or derivation from current keys)—a new key hierarchy might be needed here.
- the broadcast message can have an ID that can be verified during the authentication and is used initially only for authorization.
- the broadcast message can contain a random value that can only be generated by the network and UE. Verification of the random value is done by the network on behalf of communicating UEs.
- Each UE has a specific key belonging to other devices, and thus it sends a potentially long broadcast or a new type of broadcast that is sent in pieces with encrypted/integrity protected parts for each UE in the group.
- the broadcast message can be signed with time-stamp and life-time. Note that this life-time can be a very short period or can last until the next broadcast.
- a network can provide information.
- the network can use the location information received from the UE (the requesting UE L 01 ), and the location information can be protected by the existing network security mechanism.
- the requesting UE L 01 can use location information provided by a social network or other services. Security can be ensured in an application layer.
- the UE 100 can set features and/or capabilities of Discovery/Discoverable in D2D (device-to-device communication) server.
- the UE 100 can request the ProSe server for the ProSe service, and the ProSe server can send out the request for the ProSe service and meanwhile get the other UEs location information.
- the ProSe server needs to perform the authorization but does not have to perform Discovery.
- the UEs 100 enable the ProSe and/or UEs 100 to be allowed to get given service/communication means.
- the UE 100 sends location information periodically protected by a unicast security context.
- the network 200 requests location information when needed or periodically.
- the request (step 3) can be broadcasted, and the broadcasted message requires security.
- the response (step 4) can be protected by the unicast security context.
- the Network stores the conditions for proximity, which can also be given by the requesting and receiving UE.
- the network 200 can broadcast to the receiving UEs in a neighborhood which are allowed to be discovered, and the UEs respond with protected messages.
- the UE 100 informs the network 200 of its conditions and capabilities at a first communication and/or registration or when any change happens.
- the broadcast based solutions by the network 200 or the UE 100 require one or more of the following requirements. That is, the receiving side should be able to verify the source, the broadcast message should not be re-used, the network 200 which receives the response should be able to verify it, or the response should be discarded if it is too long.
- the UE 100 can use one or more of solutions for performing secure discovery.
- the solutions include a token, a sign, a message, a message ID, a random value, keys, and stamps. Note that those solutions can be used in the step 5 (mutually authenticate, the authentication L4), in the step 6 (authorize, the authorization L5), and in the step 7 (generate keys and negotiate algorithm, the secure communication L7), as shown in FIG. 4 .
- the steps 5 to 7 can happen together, and might be related to broadcast security.
- the initial authorization varies according to the above discovery solution.
- Whether the requesting UE L 01 is allowed to communicate with the receiving UE L 03 can be checked by a network or by the receiving UE L 03 having a proof provided by the network.
- the requesting UE L 01 and the receiving UE L 03 can perform a mutual authentication over the direct wireless interface.
- the receiving UE L 03 checks a list maintained by the user or in a UE among the members of the group of devices for ProSe service purpose.
- authentication takes place. Authentication can be carried out locally or by interacting with the network.
- UE There should be different levels for access control to services that the requesting UE L 01 and the receiving UE L 03 (hereinafter also referred to as “UE”) can use within the group.
- UE is allowed to receive and/or send a broadcasting message.
- UE is allowed to receive and/or send multiple messages.
- UE is allowed to receive and/or send a message for one-to-one communications.
- UE authorization according to subscription information and the policy UE set for ProSe service.
- a network can set up and provide the policy to the group members including the requesting UE L 01 and the receiving UE L 03 according to UE capabilities and user subscriptions.
- the network 200 performs authorization for the UEs 100 want to join the group.
- the group member of UEs 100 verify whether other UEs are authorized by the network by using the session keys.
- Another method for performing validated authorization is done by (1) a network sending an authorization value to each UE 100 , and each UE 100 uses this value to perform authorization for each other, or (2)
- Yet another method for performing a validated authorization is done by sending an authorization value from a requesting UE to a receiving UE, and then the receiving UE requests the Network to validate this authorization value and receiving result.
- Kp is a key related to the group and also may related to a ProSe service. It has an indicator KSI_p related to it. Kp can be sent from ProSe Server to use.
- Kpc and Kpi are session keys that are derived from Kp at UEs.
- Kpc is a confidentiality key and Kpi is an integrity protection key.
- the session keys are used for UE to perform authorization for each other, and ProSe communication setup, and have the direct communication between them.
- the communicating devices including the requesting UE L 01 and the receiving UE L 03 can start sessions to communicate with each other.
- the requesting UE L 01 and the receiving UE L 03 should share communication keys.
- the keys can be a group key, and/or a unique key per communicating device as well as a session key per each session.
- the key can be managed by the network and sent over the secure communication channel with the network.
- the key can be managed by the requesting UE L 01 and sent to other devices including the receiving UE L 03 in the communication, over a secure unicast communication channel that can be secured by the network during authentication or verification.
- the key can also be issued by a third trusted party.
- FIGS. 5A to 5C are schematic views showing One-to-one, One-to-many, and Many-to-many sessions, respectively. As shown in FIGS. 5A to 5C , a UEa 21 and a UEa 31 indicate the requesting UE L 01 , and a UEb 22 , a UEb 32 , a UEc 33 and a UEn_ 33 n indicate the receiving UE L 03 .
- the requesting UE L 01 (UEa 21 , the UEa 31 ) and the receiving UE L 03 (UEb 22 , the UEb 32 , the UEc 33 , the UEn_ 33 n ) use two kinds of keys including session keys.
- Each group has a key Kp for each service (Kp is served as a service key) and a new session key is created for each session.
- Each group has the key Kp (Kp is served as a group key), and a new session key is created for each session.
- either the ProSe server or the requesting UE L 01 sends keys.
- the ProSe server sends the key Kp to the requesting UE L 01 and the receiving UE(s) L 03
- the requesting UE L 01 sends a session key to the receiving UE(s) L 03 every session.
- the ProSe server sends both of the key Kp and the session key to the requesting UE L 01 and the receiving UE(s) L 03
- the requesting UE L 01 sends both of the key Kp and the session key to the receiving UE(s) L 03 .
- the group changes if someone leaves or is added, when a session ends or a key times out, or when the ProSe server has made a decision, for example, the key Kp and/or the session key should be changed.
- UEs derive session keys from that for authorization and communication.
- UEs can be pre-configured with algorithms for key derivation, or the key Kp is related to a KSI (key set identifier) and a service. Because of them, the security problems during UEs' authentication and authorization or the security problems of a key for direct communication may be solved.
- KSI key set identifier
- the key set identifier is a number which is associated with the cipher and integrity keys derived during the authentication.
- the key set identifier can be allocated by the network and sent with the authentication request message to the mobile station where it is stored together with a calculated cipher key CK and an integrity key IK.
- the purpose of the key set identifier is to make it possible for the network to identify the cipher key CK and integrity key IK which are stored in the mobile station without invoking the authentication procedure. This is used to allow re-use of the cipher key CK and integrity key IK during subsequent connections (session).
- Secure communication can provide message transmission availability between group member UEs, as well as preventing a message from being eavesdropped on or altered by UEs that do not belong to the group. Also the secure communication can prevent UE from using an unauthorized service.
- the communication within the group should have integrity and/or confidentiality protection. All the communications can be protected by the session keys described above, after the security association is established.
- the security policy can be a negotiation and an agreement within the group with or without the support of the operator network L 02 . All the group members should follow the security policy.
- group and security management need to be updated for the remaining UEs in the group.
- group and security management need to be updated for the remaining UEs in the group, and a new group and security are needed for the traveler.
- the ProSe Server should get UE location information from GMLC (Gateway Mobile Location Center) periodically, to compare and compute the location differences of all UEs.
- GMLC Gateway Mobile Location Center
- devices When the communication is to be suspended, devices should remove the session key while keeping information of the authentication and authorization.
- the devices can keep history information, or the allocated token with a lifetime for the next use time to prevent signaling for authentication and authorization again.
- Smooth handover from an infrastructure to a direct mode will require creation of a key between communicating parties (the requesting UE L 01 and the receiving UE L 03 ) before a handover happens.
- a key should be allocated to WiFi AP and UEs.
- the WiFi AP and UEs should authorize and authenticate each other.
- the key should have a limited life-time.
- a network can recognize which WiFi AP the UE can communicate with.
- UEs can find that there is a WiFi AP nearby and the network verifies the WiFi AP.
- UEs authenticate with the ProSe Server when UEs connect to a WiFi AP.
- the ProSe Function can allocate keys for the UEs to communicate with a ProSe APP Server.
- the method of making a secure communication of an exemplary embodiment includes the following features:
- the operator network L 02 can determine the receiving UE(s) L 03 with which the requesting UE L 01 can communicate, and can ensure secure discovery by either providing security parameters to the requesting UE L 01 or receiving UE L 03 , and providing location information of the receiving UE L 03 to the requesting UE L 01 . Furthermore, the operator network L 02 can perform authentication and authorization for the requesting UE L 01 and receiving UE L 03 , and can support security association between UEs to secure ProSe communication.
- the ProSe server is a network element as agreed in 3GPP SA2#97 to NPL2.
- the subscription data of a user/UE indicates whether a UE is ProSe enabled, and if it is so, the subscription data also indicates the UE's ProSe capability which:
- the subscription data is stored in a ProSe server that interacts with other network elements such as HSS. According to an operator policy, the subscription data can also be retrieved from HSS.
- the UE can set a trigger event for being discovered and/or discovering and register its policy profile in the ProSe server.
- the ProSe server can indicate a UE or discard it accordingly, when there is a ProSe service request to the UE.
- the trigger events can be:
- the ProSe server Upon receiving a ProSe Service Request from a UE, the ProSe server should verify the following, before initiating the Discovery procedure.
- the ProSe server informs the requesting UE of the received request and pending.
- the ProSe server should perform Discovery described above.
- the ProSe server can request network support for those procedures.
- the ProSe server informs the result of Discovery, containing a list of accepted UEs, allowed services, allowed communication means, and any other necessary parameters.
- the requesting UE can automatically be the group manager if there is none and start to perform authentication, authorization, and security association establishment in the group.
- Case 1C The requesting UE wants to communicate with some UEs but does not know if they are nearby and/or available
- Case 2C The requesting UE using some application which shows that there are some UEs nearby selects some UEs to have ProSe with.
- FIG. 6 is a flow chart showing a method of performing the group management of a Case 1C of an exemplary embodiment.
- the system includes the UEa 21 serving as a requesting UE, the UEb 22 serving as a receiving UE, a ProSe server 24 , and an HSS 25 .
- the method includes the following nine steps SP 1 to SP 9 .
- SP 1 The ProSe server 24 stores subscription data of UEs.
- SP 2 The requesting UE 21 sends the ProSe Service Request to the ProSe server 24 , containing a requesting UE ID, a list of receiving UE IDs, a request service type, a request communication type, an optionally group ID if the group has been formed before or the requesting UE wishes to name the group ID, and an optionally range.
- SP 3 The ProSe server 24 can interact with the HSS 25 for authentication information of UE if needed.
- SP 4 The ProSe server 24 performs verification on the requesting and receiving UEs 21 and 22 .
- SP 5 The ProSe server 24 sends a ProSe Service ACK to the requesting UE 21 , containing a status of pending.
- SP 6 The ProSe server 24 performs Discovery procedure.
- SP 7 After the Discovery procedure, the ProSe server 24 sends the ProSe Service Result to the requesting UE 21 , with the group ID, the accepted UEs, the allowed service type, the allowed communication type, and the security parameters (optional).
- SP 8 The ProSe server 24 can also send the same ProSe Service Result to the receiving UEs 22 .
- SP 9 Once the requesting and receiving UEs 21 and 22 know the allowed group members, the group security establishment can be started. [[Case 2C]]: A UE recognizes that some other UEs are nearby.
- the method of performing a secure group management of an exemplary embodiment includes the following features:
- a network controls whether the requesting and receiving UEs can have ProSe service with each other.
- the requesting UE can select receiving UEs with which the requesting UE wants to have the ProSe service, and requests a network to perform authorization.
- the requesting and receiving UEs can set an event trigger for discovering and being discovered, such that it can have a customized setting.
- the non-transitory computer readable media includes various types of tangible storage media.
- Examples of the non-transitory computer readable media include a magnetic recording medium (such as a flexible disk, a magnetic tape, and a hard disk drive), a magneto-optic recording medium (such as a magneto-optic disk), a CD-ROM (Read Only Memory), a CD-R, and a CD-R/W, and a semiconductor memory (such as a mask ROM, a PROM (Programmable ROM), an EPROM (Erasable PROM), a flash ROM, and a RAM (Random Access Memory)).
- the program can be supplied to computers by using various types of transitory computer readable media.
- Examples of the transitory computer readable media include an electrical signal, an optical signal, and an electromagnetic wave.
- the transitory computer readable media can be used to supply programs to computer through a wire communication path such as an electrical wire and an optical fiber, or wireless communication path.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Mobile Radio Communication Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
Description
- The present application is a continuation of U.S. patent application Ser. No. 14/900,006 entitled “Secure Group Creation in Proximity Based Service Communication,” filed on Dec. 18, 2015, a national stage application of International Application No. PCT/JP2014/003166, filed on Jun. 13, 2014, which claims the benefit of priority from Japanese Patent Application No. JP2013-137291, filed on Jun. 28, 2013, the disclosures of each of which are incorporated herein in their entirety by reference thereto.
- This invention relates to a secure system and a method of forming a secure group, and more specifically, to a secure system that provides a method of forming a secure group in Proximity based Service (ProSe) communication.
- 3GPP (3rd Generation Partnership Project) has started to study Proximity based Services (ProSe) for both commercial and public safety uses. 3GPP SA1 (Services Working Group) has initiated some security requirements for secure communication, UE (User Equipment) identity, and privacy protection.
- ProSe represents a recent and enormous socio-technological trend. The principle of these applications is to discover instances of the applications running in devices that are within proximity of each other, and ultimately to also exchange application-related data. In parallel to this, there is interest in proximity-based discovery and communications in the public safety community.
- ProSe communication can provide services to the UEs in proximity via an eNB (Evolved Node B) or without the eNB. The SA1 requires that the ProSe service be provided to UEs with or without network coverage. The UEs can discover other nearby UEs or be discovered by other UEs, and they can communicate with each other. Some use cases can be found in
NPL 1. The ProSe server is a network element as agreed in 3GPP SA2#97 to NPL 2. - NFL 1: 3GPP TR 22.803 Feasibility study for Proximity Services ProSe), (Release 12)
- NFL 2: 3GPP TR 23.703 Study on architecture enhancements to support Proximity Services (ProSe) (Release 12)
- However, despite the security issues involving authorization as well as privacy issues, 3GPP SA3 offers no security solution.
- The present invention has been made to present an overall security solution for the above-mentioned security issues.
- In one embodiment, there is provided a method of forming a secure group in Proximity based Service (ProSe) communication by a requesting device which requests a communication and a receiving device which receives a communication request from the requesting device, wherein the requesting and receiving devices have subscribed. ProSe service, the method including requesting a service request to a ProSe server from the requesting device, the service request indicating a request to communicate with the receiving device from the requesting device, performing verification on the requesting and receiving devices by the ProSe server, sending a ProSe Service result to the requesting and receiving devices to inform to be allowed a group member, and starting a group security establishment of the group including the requesting and receiving devices.
- In another embodiment, there is provided a secure system including a plurality of User Equipments (UEs) and a Proximity based Service (ProSe) server, including a requesting device which requests a communication; and a receiving device which receives a communication request from the requesting device. The requesting device and the receiving device have subscribed ProSe service. The requesting device requests a service request to the ProSe server, the service request indicating a request to communicate with the receiving device from the requesting device. The ProSe server performs verification on the requesting and receiving devices. The ProSe server sends a ProSe Service result to the requesting and receiving devices to inform to be allowed a group member. The requesting and receiving devices start a group security establishment of the group including the requesting and receiving devices.
- A secure system and a method of forming a secure group in Proximity based Service (ProSe) communication can present solutions for security issues.
- The above and other objects, advantages and features of the present invention will be more apparent from the following description of certain preferred embodiments taken in conjunction with the accompanying drawings, in which:
-
FIG. 1A is a schematic view showing the ProSe Communication scenario inNPL 1; -
FIG. 1B is a schematic view showing the ProSe Communication scenario inNPL 1, -
FIG. 2 is a schematic view showing an example of the systems which provide a method of making a secure communication according to an exemplary embodiment of the present invention; -
FIG. 3 is a schematic view showing a secure system of an exemplary embodiment of the present invention; -
FIG. 4 is a sequence diagram explaining a method of making a secure communication of an exemplary embodiment of the invention; -
FIG. 5A is a schematic view showing a One-to-one session; -
FIG. 5B is a schematic view showing a One-to-many session; and -
FIG. 5C is a schematic view showing a Many-to-many session. -
FIG. 6 is a flow chart showing a method of performing the group management of a case 1C of an exemplary embodiment. - For purposes of the description hereinafter, the terms “upper”, “lower”, “right”, “left”, “vertical”, “horizontal”, “top”, “bottom”, “lateral”, “longitudinal”, and derivatives thereof shall relate to the invention as it is oriented in the drawing figures. However, it is to be understood that the invention may assume alternative variations and step sequences, except where expressly specified to the contrary. It is also to be understood that the specific devices and processes illustrated in the attached drawings, and described in the following specification, are simply exemplary embodiments of the invention. Hence, specific dimensions and other physical characteristics related to exemplary embodiments disclosed herein are not to be considered as limiting.
- In the exemplary embodiments, though the security solutions with a focus on specifically direct communication, discovery, and communication will be explained, the solutions can be applied to other communications as well.
- Firstly, definitions given in 3GPP TR 21.905: “Vocabulary for 3GPP Specifications” will be explained.
- A communication between two or more UEs in proximity that are ProSe-enabled, by means of user plane transmission using E-UTRAN technology via a path not traversing any network node.
- A UE that supports ProSe requirements and associated procedures. Unless explicitly stated otherwise, a ProSe-enabled UE refers both to a non-public safety UE and a public safety UE.
- A ProSe-enabled UE that also supports ProSe procedures and capabilities specific to Public Safety.
- A UE that supports ProSe procedures but not capabilities specific to public safety.
- A procedure employed by a ProSe-enabled UE to discover other ProSe-enabled UEs in its vicinity by using only the capabilities of the two UEs with rel. 12 E-UTRAN technology.
- a process by which the EPC determines the proximity of two ProSe-enabled UEs and informs them of their proximity.
-
FIGS. 1A and 1B are schematic views showing the ProSe Communication scenarios inNPL 1. When aUE 11 and aUE 12 which are involved in the ProSe Communication are served by the same eNB 19 and network coverage is available, asystem 100 a can decide to perform ProSe Communication using control information exchanged between theUEs eNB 19 and an EPC (Evolved Packet Core) 14 (e.g., session management, authorization, security) as shown by the solid arrows inFIG. 1A . For charging, modifications should be minimized with respect to the existing architecture. TheUEs FIG. 1A . - When the
UEs different eNBs system 100 b can decide to perform ProSe Communication using control information exchanged between theUEs eNB 19 and the EPC 14 (e.g., session management, authorization, security) as shown by the solid arrows inFIG. 1B . In this configuration, theeNBs EPC 14 or communicate directly for radio resource management as shown by the dashed arrow between the eNBs 19 and 20 inFIG. 1B . For charging, signaling modifications should be minimized with respect to the existing architecture. TheUEs UE 11 and theUE 12 inFIG. 1B . - If network coverage is available for a subset of the UEs, one or more Public Safety UEs may relay the radio resource management control information for other UEs that do not have network coverage.
- If network coverage is not available, the control path can exist directly between Public Safety UEs. In this configuration, the Public Safety UEs can rely on pre-configured radio resources to establish and maintain the ProSe Communication. Alternatively, a Public Safety Radio Resource Management Function, which can reside in a Public Safety UE, can manage the allocation of radio resources for Public Safety ProSe Communication.
-
FIG. 2 is a schematic view showing an example of the systems which provide a method of making a secure communication according to an exemplary embodiment of the present invention. As shown inFIG. 2 , asystem 10 includes theUE 11, theUE 12, an E-UTRAN 13, theEPC 14, aProSe Function 15, aProSe APP Server 16, aProSe APP 17, and aProSe APP 18. - The
UE 11 and theUE 12 can communicate through a PC5, theUE 11 and the E-UTRAN 13 communicate through LTE-Uu1, and theUE 12 can communicate with the E-UTRAN 13 and theProSe Function 15 through LTE-Uu2 and a PC3, respectively. TheEPC 14 and theProSe Function 15 can communicate through a PC4, theProSe APP server 16 can communicate with theEPC 14 and theProSe APP 18 through a SG1 and a PC1, respectively, and theProSe Function 15 can communicate by itself through a PC6. - As described above, existing keys can be used when using an infrastructure, i.e., via eNodeB. However, a new solution is needed for device-to-device direct discovery and communication; for example, a key can be sent from the network to communicating parties, a key can be created between communicating parties, or a similar algorithm for negotiation can be used directly or via the network. Further, a new solution is also needed for the security over the unlicensed spectrum.
- Two different modes for ProSe Direct Communication one-to-one are supported
- Network independent direct communication: This mode of operation for ProSe Direct Communication does not require any network assistance to authorize the connection and communication is performed by using only functionality and information local to the UE. This mode is applicable only to pre-authorized ProSe-enabled Public Safety UEs, regardless of whether the UEs are served by E-UTRAN or not.
- Network authorized direct communication: This mode of operation for ProSe Direct Communication always requires network assistance and may also be applicable when only one UE is “served by E-UTRAN” for Public safety UEs. For non-Public Safety UEs both UEs must be “served by E-UTRAN”.
- It is the reference point between the
ProSe application 18 in theUE 12 and in theProSe App Server 16. It is used to define application level requirements. - It is the reference point between the
ProSe App Server 16 and theProSe Function 15. It is used to define the interaction between theProSe App Server 16 and ProSe functionality provided by the 3GPP EPS via theProSe Function 15. One example of use of it may be for application data updates for a ProSe database in theProSe Function 15. Another example of use of it may be data for use by theProSe App Server 16 in interworking between 3GPP functionality and application data, e.g. name translation. - It is the reference point between the
UE 12 and theProSe Function 15. It is used to define the interaction between theUE 12 and theProSe Function 15. An example of use of it is for configuration for ProSe discovery and communication. - It is the reference point between the
EPC 14 and theProSe Function 15. It is used to define the interaction between theEPC 14 and theProSe Function 15. Possible use cases of it may be when setting up a one-to-one communication path between UEs or when validating ProSe services (authorization) for session management or mobility management in real time. - It is the reference point between the
UE 11 to theUE 12 used for control and user plane for discovery and communication, for relay and one-to-one communication (between UEs directly and between UEs over LTE-Uu). - This reference point may be used for functions such as ProSe Discovery between users which are subscribed to different PLMNs.
- In addition to the relevant functions defined in TS 29.061 [10] via SGi, it may be used for application data and application level control information exchange.
-
FIG. 3 is a schematic view showing a secure system of an exemplary embodiment of the present invention. As shown inFIG. 3 , asecure system 1 of an exemplary embodiment of the present invention includes one or more requesting UEs L01, an operator network L02, and one or more receiving UEs L03. A method of performing a secure communication includes steps of a secure group management L1, a secure discovery L2, an initial authorization L3, an authentication L4, an authorization L5, a security association establishment L6, a secure communication L7, and a termination L8, which are performed between UEs (the requesting UE L01, the receiving UE L03) with or without interacting with the operator network L02. - Assuming that the network coverage is available for UEs, broadcasting is presented as an example in this exemplary embodiment, but this exemplary embodiment also applies to multiple-casting and one-to-one communications as shown in
FIGS. 1A, 1B, and 2 . - From setting up of a group till communication termination, security is needed in each step as described below. Note that steps L1-L4 can be in a different order depending on the service or application.
- Members can join securely, members can leave securely, and an authorization level of service and each of the members, and any other required information can be modified securely.
- If discovery is not secured, a device may start communication with a wrong party or a rogue device, with the result that masquerading attacks can happen that in turn could lead to fraudulent charging. For this purpose, the discovery related communication must be secured, i.e., a UE authenticates identity of other UEs in proximity; integrity protection for discovery and a device should be able to authenticate the message.
- The initial authorization based on secure discovery will lead to the decision that the discovered device belongs to the group, and thus the next step can start.
- Once the device is discovered and authorized as a part of the group, there should be a mutual authentication; otherwise there is still a scope of attacks.
- The next level of authorization will find out what services can be used between the devices which belong to the same group. For example, a UE is allowed to send and receive different types of messages or is only allowed to receive broadcasting messages.
- The UEs which belong to the same group should have keys to protect their communication such that other UEs which do not belong to the group or an attacker cannot eavesdrop or alter the messages.
- The communication between UEs in the same group can be protected by the security association, with integrity and/or confidentiality protection according to the subscription service type.
- The secure termination can provide security when UE(s) suspend or terminate the communication, or when the entire group communication is terminated.
- The detailed method of performing a secure communication of an exemplary embodiment of the invention that fulfills the security requirements will be explained in the following sections.
FIG. 4 is a sequence diagram explaining a method of making a secure communication betweenUE 100 andnetwork 200 of an exemplary embodiment of the invention. - A group can be
- (1) two devices communicating with each other (one-to-one), or
- (2) more than two devices (one-to-many) where one UE can communicate with the other devices.
- (3) more than two devices (many-to-many) that can communicate with each other.
- [0051]
- A group can be set up for different communication purposes, and group members can be changed. To form a group, the operator network L02 can check the requesting UE L01 which requests the UE L03 which it wants to communicate with, verify devices if they can communicate with each other, and inform the verified devices at both sides (the requesting UE L01 and the receiving UE L03) of the request and formation.
- Hereinafter one example of creating a group will be explained. As shown in
FIG. 4 , aUE 100 requests ProSe subscription to anetwork 200 and creates a group (Step 1). Instep 1, theUE 100 needs to meet conditions, that is policy, e.g. interest, specific location etc. Also thenetwork 200 needs to verify whether UE meets conditions, that is policy, e.g. proximity range, subscription, home network in case of roaming UE, WiFi or not, ProSe enabled, etc. The group is strictly formed, for example, the members of the group should be registered in a whitelist, or the group is dynamically formed on a request from theUE 100, or by thenetwork 200 if thenetwork 200 knows all UE conditions. - For creating a secure group,
UEs 100 must agree to be a part of the group, and only “agreed”UEs 100 become group members. A group management includes adding group members, removing group members, ending the group, and adding temporary group members. EachUE 100 can see who is in proximity from e.g. a social network application, and requests for ProSe service, and the ProSe server needs to perform the authorization, but does not have to perform discovery. - Discovery and group creation in [1] can happen at the same time or be independent procedure.
- There can be following three means that a UE (the requesting UE L01) can discover other UEs (the receiving UEs L03) in proximity: (1) Broadcast based, (2) Network based, and (3) Device service level information based. How secure discovery can be done will be described as follows.
- There are six ways (s1-s6) in Broadcast based solution:
- The broadcast message can contain a token that only the given UEs can have. The token should be used only once to prevent the receiving side from reusing it. In order to reach that, the UEs can calculate a token each time on receiving the broadcast message, or the network can inform all the UEs of the token to be used next. This can be used for such a use case as an information notification kind of service, since the token can be reused by the receiving side.
- The broadcast message can be signed by a key that can be verified either by the receiving UEs or by the network for the receiving UEs. Signing can happen by different key management solutions or it can happen using the current keys for communicating with the infrastructure network (or derivation from current keys)—a new key hierarchy might be needed here.
- The broadcast message can have an ID that can be verified during the authentication and is used initially only for authorization.
- The broadcast message can contain a random value that can only be generated by the network and UE. Verification of the random value is done by the network on behalf of communicating UEs.
- Each UE has a specific key belonging to other devices, and thus it sends a potentially long broadcast or a new type of broadcast that is sent in pieces with encrypted/integrity protected parts for each UE in the group.
- The broadcast message can be signed with time-stamp and life-time. Note that this life-time can be a very short period or can last until the next broadcast.
- A network can provide information. For this purpose, the network can use the location information received from the UE (the requesting UE L01), and the location information can be protected by the existing network security mechanism.
- The requesting UE L01 can use location information provided by a social network or other services. Security can be ensured in an application layer.
- Detailed examples of the discovery will be explained. The
UE 100 can set features and/or capabilities of Discovery/Discoverable in D2D (device-to-device communication) server. - If the
UE 100 does not know whether the other UEs are in proximity, theUE 100 can request the ProSe server for the ProSe service, and the ProSe server can send out the request for the ProSe service and meanwhile get the other UEs location information. - If the
UE 100 can see who is in proximity from e.g. a social network application, and asks for service, the ProSe server needs to perform the authorization but does not have to perform Discovery. - If the ProSe server performs the authorization, the
UEs 100 enable the ProSe and/orUEs 100 to be allowed to get given service/communication means. - If the discovery is done based on the proximity of
UEs 100, theUE 100 sends location information periodically protected by a unicast security context. Thenetwork 200 requests location information when needed or periodically. The request (step 3) can be broadcasted, and the broadcasted message requires security. The response (step 4) can be protected by the unicast security context. - The Network stores the conditions for proximity, which can also be given by the requesting and receiving UE. The
network 200 can broadcast to the receiving UEs in a neighborhood which are allowed to be discovered, and the UEs respond with protected messages. TheUE 100 informs thenetwork 200 of its conditions and capabilities at a first communication and/or registration or when any change happens. - The broadcast based solutions by the
network 200 or theUE 100 require one or more of the following requirements. That is, the receiving side should be able to verify the source, the broadcast message should not be re-used, thenetwork 200 which receives the response should be able to verify it, or the response should be discarded if it is too long. TheUE 100 can use one or more of solutions for performing secure discovery. The solutions include a token, a sign, a message, a message ID, a random value, keys, and stamps. Note that those solutions can be used in the step 5 (mutually authenticate, the authentication L4), in the step 6 (authorize, the authorization L5), and in the step 7 (generate keys and negotiate algorithm, the secure communication L7), as shown inFIG. 4 . Thesteps 5 to 7 can happen together, and might be related to broadcast security. - The initial authorization varies according to the above discovery solution.
- Whether the requesting UE L01 is allowed to communicate with the receiving UE L03 can be checked by a network or by the receiving UE L03 having a proof provided by the network.
- The requesting UE L01 and the receiving UE L03 can perform a mutual authentication over the direct wireless interface.
- The receiving UE L03 checks a list maintained by the user or in a UE among the members of the group of devices for ProSe service purpose.
- Once the requesting UE L01 is identified as belonging to the same group, then authentication takes place. Authentication can be carried out locally or by interacting with the network.
- This can be performed by successful identification of the requesting UE L01 by a network or a UE with a proof from a network.
- This can be performed by
- [4-2-i] using a key shared between the requesting UE L01 and the receiving UE L03
[4-2-ii] using current network security keys or new keys
[4-2-iii] a network which informs the requesting UE L01 of the incoming authentication request from the receiving UE L03. - There should be different levels for access control to services that the requesting UE L01 and the receiving UE L03 (hereinafter also referred to as “UE”) can use within the group.
- [5-1] UE is allowed to receive and/or send a broadcasting message.
[5-2] UE is allowed to receive and/or send multiple messages.
[5-3] UE is allowed to receive and/or send a message for one-to-one communications.
[5-4] UE authorization according to subscription information and the policy UE set for ProSe service. - A network can set up and provide the policy to the group members including the requesting UE L01 and the receiving UE L03 according to UE capabilities and user subscriptions.
- The
network 200 performs authorization for theUEs 100 want to join the group. The group member ofUEs 100 verify whether other UEs are authorized by the network by using the session keys. Another method for performing validated authorization is done by (1) a network sending an authorization value to eachUE 100, and eachUE 100 uses this value to perform authorization for each other, or (2) Yet another method for performing a validated authorization is done by sending an authorization value from a requesting UE to a receiving UE, and then the receiving UE requests the Network to validate this authorization value and receiving result. - A new key hierarchy is presented in this exemplary embodiment of the invention. Key Kp is a key related to the group and also may related to a ProSe service. It has an indicator KSI_p related to it. Kp can be sent from ProSe Server to use.
- Keys, Kpc and Kpi are session keys that are derived from Kp at UEs. Kpc is a confidentiality key and Kpi is an integrity protection key. The session keys are used for UE to perform authorization for each other, and ProSe communication setup, and have the direct communication between them.
- After authorization and authentication, the communicating devices including the requesting UE L01 and the receiving UE L03 can start sessions to communicate with each other. When the requesting UE L01 and the receiving UE L03 communicate with each other, they should share communication keys. The keys can be a group key, and/or a unique key per communicating device as well as a session key per each session.
- The key can be managed by the network and sent over the secure communication channel with the network. Alternatively, the key can be managed by the requesting UE L01 and sent to other devices including the receiving UE L03 in the communication, over a secure unicast communication channel that can be secured by the network during authentication or verification. The key can also be issued by a third trusted party.
- The
UEs 100 authenticate each other at the beginning of a session (S5). The authentication is linked to authorization (S6).FIGS. 5A to 5C are schematic views showing One-to-one, One-to-many, and Many-to-many sessions, respectively. As shown inFIGS. 5A to 5C , aUEa 21 and aUEa 31 indicate the requesting UE L01, and aUEb 22, aUEb 32, aUEc 33 and a UEn_33 n indicate the receiving UE L03. - When the session is started, firstly session keys are generated. In this exemplary embodiment, the requesting UE L01 (
UEa 21, the UEa 31) and the receiving UE L03 (UEb 22, theUEb 32, theUEc 33, the UEn_33 n) use two kinds of keys including session keys. - Each group has a key Kp for each service (Kp is served as a service key) and a new session key is created for each session.
- Each group has the key Kp (Kp is served as a group key), and a new session key is created for each session.
- In each case, either the ProSe server or the requesting UE L01 sends keys. For example, the ProSe server sends the key Kp to the requesting UE L01 and the receiving UE(s) L03, and the requesting UE L01 sends a session key to the receiving UE(s) L03 every session. Alternatively, the ProSe server sends both of the key Kp and the session key to the requesting UE L01 and the receiving UE(s) L03, or the requesting UE L01 sends both of the key Kp and the session key to the receiving UE(s) L03.
- Further, when the group changes if someone leaves or is added, when a session ends or a key times out, or when the ProSe server has made a decision, for example, the key Kp and/or the session key should be changed.
- If the ProSe Server allocates the key Kp to UEs, UEs derive session keys from that for authorization and communication. UEs can be pre-configured with algorithms for key derivation, or the key Kp is related to a KSI (key set identifier) and a service. Because of them, the security problems during UEs' authentication and authorization or the security problems of a key for direct communication may be solved.
- Note that the key set identifier (KSI) is a number which is associated with the cipher and integrity keys derived during the authentication. The key set identifier can be allocated by the network and sent with the authentication request message to the mobile station where it is stored together with a calculated cipher key CK and an integrity key IK. The purpose of the key set identifier is to make it possible for the network to identify the cipher key CK and integrity key IK which are stored in the mobile station without invoking the authentication procedure. This is used to allow re-use of the cipher key CK and integrity key IK during subsequent connections (session).
- Secure communication can provide message transmission availability between group member UEs, as well as preventing a message from being eavesdropped on or altered by UEs that do not belong to the group. Also the secure communication can prevent UE from using an unauthorized service.
- The communication within the group should have integrity and/or confidentiality protection. All the communications can be protected by the session keys described above, after the security association is established.
- The security policy can be a negotiation and an agreement within the group with or without the support of the operator network L02. All the group members should follow the security policy.
- Next, the security in the case where UEs' location change happens will be explained. If none of UEs has a location change, there is no security issue. Further, if all of the UEs have a changed location, but stayed in proximity to each other, then there is still no security issue.
- If a part of UEs (one or more UEs) have moved out of proximity from other UEs and they do not use the ProSe service, group and security management need to be updated for the remaining UEs in the group. Alternatively, if one or more UEs have moved out of proximity from the UEs and they want to keep the ProSe service with each other, group and security management need to be updated for the remaining UEs in the group, and a new group and security are needed for the traveler.
- Note that the ProSe Server should get UE location information from GMLC (Gateway Mobile Location Center) periodically, to compare and compute the location differences of all UEs.
- When the communication is to be suspended, devices should remove the session key while keeping information of the authentication and authorization.
- When the communication is to be terminated, the devices can keep history information, or the allocated token with a lifetime for the next use time to prevent signaling for authentication and authorization again.
- Smooth handover from an infrastructure to a direct mode will require creation of a key between communicating parties (the requesting UE L01 and the receiving UE L03) before a handover happens. For example, if communicating parties are using WiFi, a key should be allocated to WiFi AP and UEs. The WiFi AP and UEs should authorize and authenticate each other. The key should have a limited life-time. A network can recognize which WiFi AP the UE can communicate with. UEs can find that there is a WiFi AP nearby and the network verifies the WiFi AP. UEs authenticate with the ProSe Server when UEs connect to a WiFi AP. One option is that the ProSe Function can allocate keys for the UEs to communicate with a ProSe APP Server.
- To summarize the above description, the method of making a secure communication of an exemplary embodiment includes the following features:
- (1) The operator network L02 determines whether the requesting UE L01 can communicate with the receiving UE L03 requested by the requesting UE L01.
- (2) Security in discovery of UEs in proximity can be provided by using a token, a key, and signing provided by the network.
- (3) Security in discovery of UEs in proximity can be provided by using a location provided by the operator network L02.
- (4) Security in discovery of UEs in proximity can be provided by using location information provided by social network services, with security provided in an application layer.
- (5) Authorization of the devices can be performed by the network or by devices direct verification.
- (6) Mutual authentication between the requesting UE L01 and the receiving UEs that agreed to be in the group L03 can be carried out by the network and also both UEs can be informed with the result.
- (7) Mutual authentication between the requesting UE L01 and the receiving UEs L03 can be carried out by both ends with a key shared there between.
- (8) New keys for securing the ProSe communication which are a group key and a unique session key can be used.
- (9) Security policy in a group for secure communication is negotiated and set.
- (10) Termination management can be performed to prevent the same keys from being used and set up a security context for other communication.
- According to the secure system of an exemplary embodiment, the operator network L02 can determine the receiving UE(s) L03 with which the requesting UE L01 can communicate, and can ensure secure discovery by either providing security parameters to the requesting UE L01 or receiving UE L03, and providing location information of the receiving UE L03 to the requesting UE L01. Furthermore, the operator network L02 can perform authentication and authorization for the requesting UE L01 and receiving UE L03, and can support security association between UEs to secure ProSe communication.
- Next, a more detailed method of performing the group management L1 will be explained. As described above, the ProSe server is a network element as agreed in 3GPP SA2#97 to NPL2. In Proximity-based services, the subscription data of a user/UE indicates whether a UE is ProSe enabled, and if it is so, the subscription data also indicates the UE's ProSe capability which:
-
- 1) can discover other UEs;
- 2) can be discovered by other UEs; or
- 3) satisfies both of 1) and 2).
- The subscription data is stored in a ProSe server that interacts with other network elements such as HSS. According to an operator policy, the subscription data can also be retrieved from HSS.
- The UE can set a trigger event for being discovered and/or discovering and register its policy profile in the ProSe server. The ProSe server can indicate a UE or discard it accordingly, when there is a ProSe service request to the UE. The trigger events can be:
-
- 1) On location: when it goes somewhere to receive information, such as, coupons.
- 2) VIP member: when the given UE is nearby; and
- 3) Time etc.
- Upon receiving a ProSe Service Request from a UE, the ProSe server should verify the following, before initiating the Discovery procedure.
-
- 1) Whether the requesting UE and the receiving UE are both ProSe enabled UEs, and they have subscribed ProSe service,
- 2) Whether the requesting UE is allowed for discovering service,
- 3) Whether the receiving UEs are ProSe enabled UEs and allowed to be discovered, or
- 4) Whether the UEs are allowed to have the requested service and communication.
- After the verification, the ProSe server informs the requesting UE of the received request and pending. The ProSe server should perform Discovery described above. The ProSe server can request network support for those procedures. The ProSe server informs the result of Discovery, containing a list of accepted UEs, allowed services, allowed communication means, and any other necessary parameters.
- The requesting UE can automatically be the group manager if there is none and start to perform authentication, authorization, and security association establishment in the group.
- There are two cases:
Case 1C: The requesting UE wants to communicate with some UEs but does not know if they are nearby and/or available,
Case 2C: The requesting UE using some application which shows that there are some UEs nearby selects some UEs to have ProSe with. - Here, details of the procedure in each case will be described as follows. Note that the UEs can be subscribed to the same ProSe server or different ones.
- [[Case 1C]]: A UE does not have knowledge whether the receiving UEs are in proximity.
-
FIG. 6 is a flow chart showing a method of performing the group management of a Case 1C of an exemplary embodiment. As shown inFIG. 6 , the system includes theUEa 21 serving as a requesting UE, theUEb 22 serving as a receiving UE, a ProSe server 24, and anHSS 25. The method includes the following nine steps SP1 to SP9. - SP1: The ProSe server 24 stores subscription data of UEs.
SP2: The requestingUE 21 sends the ProSe Service Request to the ProSe server 24, containing a requesting UE ID, a list of receiving UE IDs, a request service type, a request communication type, an optionally group ID if the group has been formed before or the requesting UE wishes to name the group ID, and an optionally range.
SP3: The ProSe server 24 can interact with theHSS 25 for authentication information of UE if needed.
SP4: The ProSe server 24 performs verification on the requesting and receivingUEs
SP5: The ProSe server 24 sends a ProSe Service ACK to the requestingUE 21, containing a status of pending.
SP6: The ProSe server 24 performs Discovery procedure.
SP7: After the Discovery procedure, the ProSe server 24 sends the ProSe Service Result to the requestingUE 21, with the group ID, the accepted UEs, the allowed service type, the allowed communication type, and the security parameters (optional).
SP8: The ProSe server 24 can also send the same ProSe Service Result to the receivingUEs 22.
SP9: Once the requesting and receivingUEs
[[Case 2C]]: A UE recognizes that some other UEs are nearby. - In this case 2C, assuming that a subscriber runs an application that shows which UEs are in proximity. The subscriber can choose with which UEs it wants to have the ProSe service. Thus, the Discovery procedure is not needed. The ProSe server 24 will verify whether the requesting
UE 21 can have the ProSe service with the receivingUEs 22 in the same way described in Case 1C. - To summarize the above description, the method of performing a secure group management of an exemplary embodiment includes the following features:
- (1) The ProSe server is configured with subscription data of UEs, containing UE capability of ProSe service, information of UEs which can have the ProSe service, and the policy set by the UEs;
- (2) The ProSe server performs authorization on the requesting UE, to verify: whether it can have requested the ProSe service with the communication type, and whether the requesting UE can have the ProSe service with the given receiving UEs;
- (3) The ProSe server performs authorization on the receiving UEs, to verify whether they can have the ProSe service with the requesting UE;
- (4) A UE can set the event trigger for discovering and being discovered with network authorization;
- (5) The ProSe server sends a ProSe Service Ack to the requesting UE with a status of pending; and
- (6) The ProSe server sends the ProSe Service Result to the requesting UE and also the receiving UE, with a group ID, accepted UEs, an allowed service type and a communication type, and security parameters (option).
- According to the secure system of an exemplary embodiment of the invention, a network controls whether the requesting and receiving UEs can have ProSe service with each other. The requesting UE can select receiving UEs with which the requesting UE wants to have the ProSe service, and requests a network to perform authorization. Furthermore, the requesting and receiving UEs can set an event trigger for discovering and being discovered, such that it can have a customized setting.
- This software can be stored in various types of non-transitory computer readable media and thereby supplied to computers. The non-transitory computer readable media includes various types of tangible storage media. Examples of the non-transitory computer readable media include a magnetic recording medium (such as a flexible disk, a magnetic tape, and a hard disk drive), a magneto-optic recording medium (such as a magneto-optic disk), a CD-ROM (Read Only Memory), a CD-R, and a CD-R/W, and a semiconductor memory (such as a mask ROM, a PROM (Programmable ROM), an EPROM (Erasable PROM), a flash ROM, and a RAM (Random Access Memory)). Further, the program can be supplied to computers by using various types of transitory computer readable media. Examples of the transitory computer readable media include an electrical signal, an optical signal, and an electromagnetic wave. The transitory computer readable media can be used to supply programs to computer through a wire communication path such as an electrical wire and an optical fiber, or wireless communication path.
- This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2013137291, filed on Jun. 28, 2013, the disclosure of which is incorporated herein in its entirety by reference.
-
- 1 secure system
- 10 system
- 11 UE
- 12 UE
- 13 E-UTRAN
- 14 EPC
- 15 ProSe Function
- 16 ProSe APP Server
- 17 ProSe APP
- 18 ProSe APP
- 19 eNB
- 20 eNB
- 21 UEa
- 22 UEb
- 24 ProSe Server
- 25 HSS
- 31 UEa
- 32 UEb
- 33 UEc
- 33 n UEn
- 100 UE
- 100 a system
- 100 b system
- 200 network
- L01 requesting UE
- L02 operator network
- L03 receiving UE
- L1 secure group management
- L2 secure discovery
- L3 initial authorization
- L4 authentication
- L5 authorization
- L6 security association establishment
- L7 secure communication
- L8 termination
Claims (17)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/696,091 US20200099697A1 (en) | 2013-06-28 | 2019-11-26 | Secure group creation in proximity based service communication |
US18/603,289 US20240224036A1 (en) | 2013-06-28 | 2024-03-13 | Secure group creation in proximity based service communication |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2013137291 | 2013-06-28 | ||
JP2013-137291 | 2013-06-28 | ||
PCT/JP2014/003166 WO2014208034A1 (en) | 2013-06-28 | 2014-06-13 | Secure group creation in proximity based service communication |
US201514900006A | 2015-12-18 | 2015-12-18 | |
US15/655,179 US20170324754A1 (en) | 2013-06-28 | 2017-07-20 | Secure group creation in proximity based service communication |
US16/696,091 US20200099697A1 (en) | 2013-06-28 | 2019-11-26 | Secure group creation in proximity based service communication |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/655,179 Continuation US20170324754A1 (en) | 2013-06-28 | 2017-07-20 | Secure group creation in proximity based service communication |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US18/603,289 Continuation US20240224036A1 (en) | 2013-06-28 | 2024-03-13 | Secure group creation in proximity based service communication |
Publications (1)
Publication Number | Publication Date |
---|---|
US20200099697A1 true US20200099697A1 (en) | 2020-03-26 |
Family
ID=51162871
Family Applications (5)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/900,006 Abandoned US20160149928A1 (en) | 2013-06-28 | 2014-06-13 | Secure group creation in proximity based service communication |
US15/655,179 Abandoned US20170324754A1 (en) | 2013-06-28 | 2017-07-20 | Secure group creation in proximity based service communication |
US16/696,091 Pending US20200099697A1 (en) | 2013-06-28 | 2019-11-26 | Secure group creation in proximity based service communication |
US16/830,970 Abandoned US20200228543A1 (en) | 2013-06-28 | 2020-03-26 | Secure group creation in proximity based service communication |
US18/603,289 Pending US20240224036A1 (en) | 2013-06-28 | 2024-03-13 | Secure group creation in proximity based service communication |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/900,006 Abandoned US20160149928A1 (en) | 2013-06-28 | 2014-06-13 | Secure group creation in proximity based service communication |
US15/655,179 Abandoned US20170324754A1 (en) | 2013-06-28 | 2017-07-20 | Secure group creation in proximity based service communication |
Family Applications After (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/830,970 Abandoned US20200228543A1 (en) | 2013-06-28 | 2020-03-26 | Secure group creation in proximity based service communication |
US18/603,289 Pending US20240224036A1 (en) | 2013-06-28 | 2024-03-13 | Secure group creation in proximity based service communication |
Country Status (5)
Country | Link |
---|---|
US (5) | US20160149928A1 (en) |
EP (1) | EP3014916A1 (en) |
JP (1) | JP6512111B2 (en) |
CN (2) | CN105340310A (en) |
WO (1) | WO2014208034A1 (en) |
Families Citing this family (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9648487B2 (en) | 2015-01-06 | 2017-05-09 | Acer Incorporated | Method and device for grouping user equipments in proximity services restricted discovery |
TWI558250B (en) * | 2015-01-06 | 2016-11-11 | 宏碁股份有限公司 | Method and communication system for grouping in proximity services restricted discovery |
US10080185B2 (en) * | 2015-04-10 | 2018-09-18 | Qualcomm Incorporated | Method and apparatus for securing structured proximity service codes for restricted discovery |
JP6432739B2 (en) * | 2015-04-13 | 2018-12-05 | パナソニックIpマネジメント株式会社 | Communication system, terminal, base station, and communication control method |
CN111294740B (en) * | 2015-06-05 | 2021-07-09 | 华为技术有限公司 | Group communication method, device and equipment |
RU2694814C1 (en) | 2015-06-23 | 2019-07-17 | Интердиджитал Пейтент Холдингз, Инк. | Processing priorities in a communication system prose |
EP3494720A4 (en) | 2016-08-05 | 2020-01-08 | Nokia Technologies Oy | Privacy preserving authentication and key agreement protocol for apparatus-to-apparatus communication |
KR102255901B1 (en) * | 2017-11-15 | 2021-05-26 | 노키아 테크놀로지스 오와이 | Authorization of applications for direct discovery |
ES2908267T3 (en) * | 2018-05-02 | 2022-04-28 | Nokia Technologies Oy | Direct user equipment to user equipment without data network access identifier |
US11310114B2 (en) * | 2019-08-14 | 2022-04-19 | Cisco Technology, Inc. | Industrial machine configuration using private wireless networking |
US11184736B2 (en) * | 2019-10-08 | 2021-11-23 | International Business Machines Corporation | Digital person and digital persona verification |
CN114697945B (en) * | 2022-04-02 | 2023-10-24 | 中国电信股份有限公司 | Method and device for generating discovery response message and method for processing discovery message |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020128030A1 (en) * | 2000-12-27 | 2002-09-12 | Niko Eiden | Group creation for wireless communication terminal |
US20060009249A1 (en) * | 2004-07-07 | 2006-01-12 | Research In Motion Limited | Method and apparatus for creating a communication group using an address book |
EP1976220A1 (en) * | 2007-03-30 | 2008-10-01 | British Telecommunications Public Limited Company | Computer network |
US20120202428A1 (en) * | 2011-02-04 | 2012-08-09 | Takwak GmBh | Systems and Methods for Defining Group of Users with Mobile Devices |
US9820335B2 (en) * | 2011-04-01 | 2017-11-14 | Interdigital Patent Holdings, Inc. | System and method for sharing a common PDP context |
Family Cites Families (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7069016B2 (en) * | 2003-06-23 | 2006-06-27 | Motorola, Inc. | Dynamically determining a community of entities in a communication system |
WO2005050463A1 (en) * | 2003-11-19 | 2005-06-02 | Nimcat Networks Inc. | Time and data synchronization between network devices |
US7818020B1 (en) * | 2007-02-15 | 2010-10-19 | Nextel Communications Company L.P. | System and method for joining communication groups |
US8522019B2 (en) * | 2007-02-23 | 2013-08-27 | Qualcomm Incorporated | Method and apparatus to create trust domains based on proximity |
US8577405B2 (en) * | 2009-06-12 | 2013-11-05 | Qualcomm Incorporated | Systems, methods, and machine-readable media providing location-enabled group management |
US8769285B2 (en) * | 2009-08-13 | 2014-07-01 | Qualcomm Incorporated | Methods and apparatus for deriving, communicating and/or verifying ownership of expressions |
US8818433B2 (en) * | 2009-08-21 | 2014-08-26 | Blackberry Limited | System and method for mobile network inter-device communications |
US8619783B2 (en) * | 2009-12-18 | 2013-12-31 | Electronics And Telecommunications Research Institute | System and method for coupling communication terminals |
US8625787B2 (en) * | 2010-01-14 | 2014-01-07 | Alcatel Lucent | Hierarchical key management for secure communications in multimedia communication system |
WO2011099904A1 (en) * | 2010-02-12 | 2011-08-18 | Telefonaktiebolaget L M Ericsson (Publ) | Trust discovery in a communications network |
US8812657B2 (en) * | 2010-04-15 | 2014-08-19 | Qualcomm Incorporated | Network-assisted peer discovery |
US8831568B2 (en) * | 2011-09-27 | 2014-09-09 | Qualcomm Incorporated | Automatic configuration of a wireless device |
KR20140110853A (en) * | 2011-12-13 | 2014-09-17 | 엘지전자 주식회사 | Method and device for providing a proximity service in a wireless communication system |
US9648653B2 (en) * | 2011-12-20 | 2017-05-09 | Lg Electronics Inc. | User equipment-initiated control method and apparatus for providing proximity service |
EP2810492B1 (en) * | 2012-02-02 | 2020-09-09 | Sierra Wireless, Inc. | Subscription and charging control for wireless communications between proximate devices |
WO2013163595A2 (en) * | 2012-04-27 | 2013-10-31 | Interdigital Patent Holdings, Inc. | Method and apparatus for optimizing proximity data path setup |
WO2013163599A2 (en) * | 2012-04-27 | 2013-10-31 | Interdigital Patent Holdings, Inc. | Method and apparatus for supporting proximity discovery procedures |
US9240881B2 (en) * | 2012-04-30 | 2016-01-19 | Alcatel Lucent | Secure communications for computing devices utilizing proximity services |
CN103458354B (en) * | 2012-05-21 | 2017-03-15 | 腾讯科技(深圳)有限公司 | A kind of location-based group's generation method, apparatus and system |
EP2865154B1 (en) * | 2012-06-21 | 2019-09-18 | Nokia Solutions and Networks Oy | Network assisted proximity service session management |
US20140112270A1 (en) * | 2012-10-22 | 2014-04-24 | Innovative Sonic Corporation | Method and apparatus for direct device to device communication in a wireless communication system |
US20140153509A1 (en) * | 2012-11-30 | 2014-06-05 | Innovative Sonic Corporation | Method and apparatus for establishing proximity service communication in a wireless communication system |
US8855645B2 (en) * | 2013-02-28 | 2014-10-07 | Intel Mobile Communications GmbH | Radio communication devices and cellular wide area radio base station |
WO2014162175A1 (en) * | 2013-04-02 | 2014-10-09 | Broadcom Corporation | Method and apparatus for discovering devices and application users |
US9647735B2 (en) * | 2013-05-31 | 2017-05-09 | Intel IP Corporation | Hybrid digital and analog beamforming for large antenna arrays |
-
2014
- 2014-06-13 WO PCT/JP2014/003166 patent/WO2014208034A1/en active Application Filing
- 2014-06-13 US US14/900,006 patent/US20160149928A1/en not_active Abandoned
- 2014-06-13 EP EP14737017.5A patent/EP3014916A1/en not_active Withdrawn
- 2014-06-13 JP JP2015561794A patent/JP6512111B2/en active Active
- 2014-06-13 CN CN201480036527.8A patent/CN105340310A/en active Pending
- 2014-06-13 CN CN201810723700.1A patent/CN108990063A/en active Pending
-
2017
- 2017-07-20 US US15/655,179 patent/US20170324754A1/en not_active Abandoned
-
2019
- 2019-11-26 US US16/696,091 patent/US20200099697A1/en active Pending
-
2020
- 2020-03-26 US US16/830,970 patent/US20200228543A1/en not_active Abandoned
-
2024
- 2024-03-13 US US18/603,289 patent/US20240224036A1/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020128030A1 (en) * | 2000-12-27 | 2002-09-12 | Niko Eiden | Group creation for wireless communication terminal |
US20060009249A1 (en) * | 2004-07-07 | 2006-01-12 | Research In Motion Limited | Method and apparatus for creating a communication group using an address book |
EP1976220A1 (en) * | 2007-03-30 | 2008-10-01 | British Telecommunications Public Limited Company | Computer network |
US20120202428A1 (en) * | 2011-02-04 | 2012-08-09 | Takwak GmBh | Systems and Methods for Defining Group of Users with Mobile Devices |
US9820335B2 (en) * | 2011-04-01 | 2017-11-14 | Interdigital Patent Holdings, Inc. | System and method for sharing a common PDP context |
Also Published As
Publication number | Publication date |
---|---|
US20170324754A1 (en) | 2017-11-09 |
WO2014208034A1 (en) | 2014-12-31 |
US20200228543A1 (en) | 2020-07-16 |
US20240224036A1 (en) | 2024-07-04 |
JP2016530732A (en) | 2016-09-29 |
JP6512111B2 (en) | 2019-05-15 |
CN105340310A (en) | 2016-02-17 |
US20160149928A1 (en) | 2016-05-26 |
EP3014916A1 (en) | 2016-05-04 |
CN108990063A (en) | 2018-12-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20220029975A1 (en) | Authentication and authorization in proximity based service communication using a group key | |
US20200228543A1 (en) | Secure group creation in proximity based service communication | |
US20160381543A1 (en) | Secure discovery for proximity based service communication | |
US20160164875A1 (en) | Secure system and method of making secure communication | |
CN105706390B (en) | Method and apparatus for performing device-to-device communication in a wireless communication network | |
US7961684B2 (en) | Fast transitioning resource negotiation | |
WO2018079690A1 (en) | Communication system, network device, authentication method, communication terminal and security device | |
KR20150051568A (en) | Security supporting method and system for proximity based service device to device discovery and communication in mobile telecommunication system environment | |
KR102209289B1 (en) | Security and information supporting method and system for proximity based service in mobile telecommunication system environment | |
CN114650532A (en) | Protocol data unit session establishment method and device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |