WO2024031725A1 - 中继通信的安全机制校验方法和装置、设备及存储介质 - Google Patents

中继通信的安全机制校验方法和装置、设备及存储介质 Download PDF

Info

Publication number
WO2024031725A1
WO2024031725A1 PCT/CN2022/112327 CN2022112327W WO2024031725A1 WO 2024031725 A1 WO2024031725 A1 WO 2024031725A1 CN 2022112327 W CN2022112327 W CN 2022112327W WO 2024031725 A1 WO2024031725 A1 WO 2024031725A1
Authority
WO
WIPO (PCT)
Prior art keywords
security mechanism
relay
message
network function
information
Prior art date
Application number
PCT/CN2022/112327
Other languages
English (en)
French (fr)
Inventor
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202280003147.9A priority Critical patent/CN117882410A/zh
Priority to PCT/CN2022/112327 priority patent/WO2024031725A1/zh
Publication of WO2024031725A1 publication Critical patent/WO2024031725A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols

Definitions

  • the present disclosure relates to the field of wireless communication technology, and in particular, to a security mechanism verification method and device, equipment and storage medium for relay communication.
  • a user plane-based security mechanism or a control plane-based security mechanism can be used to establish a PC5 interface between the terminal device and the relay device ( That is, the discovery of direct communication interface) and the security of communication.
  • This relay device is also called a U2N (user-to-network, user to network) relay device.
  • the terminal device can choose between a user plane-based security mechanism and a control plane-based security mechanism.
  • the terminal device and the relay device are configured to use a control plane-based security mechanism
  • the terminal device may still continue to use a user plane-based security mechanism to send direct connection communication requests, or the relay device may continue to use a direct connection communication request after receiving a direct connection request.
  • User plane-based security mechanisms may still be used after communication requests. For these situations, there is no corresponding solution proposed in the relevant technology.
  • the present disclosure provides a method and device, equipment and storage medium for verifying the security mechanism of relay communication, so as to realize the verification of the security mechanism of relay communication.
  • the present disclosure provides a security mechanism verification method for relay communications.
  • This method can be applied to relay devices.
  • the above method includes: receiving a first request message sent by the terminal device, the first request message carrying first information, the first information being used to indicate the first security mechanism corresponding to the relay service of the terminal device; determining the relay of the relay device The second security mechanism corresponding to the service; determine whether the first security mechanism matches the second security mechanism; and send the second message according to the matching situation.
  • the first information may include a relay service code (RSC) of the relay service and a key parameter corresponding to the first security mechanism.
  • RSC relay service code
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the second security mechanism may be a user-plane-based security mechanism
  • the operation of determining the second security mechanism corresponding to the relay service of the relay device may include: receiving second information sent by the core network function associated with the relay device, and the second information is used to indicate that the relay service and corresponding security mechanism; determine the second security mechanism based on the second information.
  • the operation of sending the second message according to the matching situation may include: when it is determined that the first security mechanism does not match the second security mechanism, sending a second message to the terminal device, and the second message is used to Indicates rejection of the first request message.
  • the operation of sending the second message according to the matching situation may include: when it is determined that the first security mechanism matches the second security mechanism, sending the second message to the network function associated with the relay device.
  • the second message carries third information, and the third information is used to indicate the second security mechanism corresponding to the relay service of the relay device.
  • the third information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism.
  • the above method may further include: receiving a third message sent by the network function associated with the relay device, where the third message is used to indicate that the relay device is associated
  • the third security mechanism corresponding to the relay service of the core network function does not match the second security mechanism; according to the third message, a second message is sent to the terminal device, and the second message is used to indicate rejection of the first request message.
  • the present disclosure provides a security mechanism verification method for relay communications.
  • This method can be applied to network functions.
  • the above method includes: receiving a third request message, the third request message carries fourth information, and the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the second security mechanism corresponding to the relay service of the relay device. security mechanism; according to the fourth information, send a fourth request message to the core network function, the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function; receive the fifth message sent by the core network function, The fifth message is used to indicate the third security mechanism; determine whether the first security mechanism or the second security mechanism matches the third security mechanism.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism, or the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism. .
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the above method may further include: when it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism, sending a sixth message, where the sixth message is used to indicate the first security mechanism.
  • the mechanism or secondary security mechanism does not match the tertiary security mechanism.
  • the network function can be a ProSe key management function (PKMF) associated with the relay device, and the core network function can be a policy control function (policy control function) associated with the relay device. , PCF).
  • PKMF ProSe key management function
  • policy control function policy control function
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the present disclosure provides a security mechanism verification method for relay communications.
  • This approach can be applied to core network functions.
  • the above method includes: receiving a fourth request message sent by the network function, the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function; in response to the fourth request message, sending a fifth message to the network function, The fifth message is used to indicate the third security mechanism.
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the network function can be the PKMF associated with the relay device, and the core network function can be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the present disclosure provides a security mechanism verification device for relay communications.
  • This device can be installed in the relay equipment.
  • the above device includes: a receiving module configured to receive a first request message sent by the terminal device, the first request message carries first information, and the first information is used to indicate the first security mechanism corresponding to the relay service of the terminal device; a processing module , configured to determine the second security mechanism corresponding to the relay service of the relay device, and determine whether the first security mechanism matches the second security mechanism; the sending module is configured to send the second message according to the matching situation.
  • the first information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the second security mechanism may be a user-plane-based security mechanism
  • the receiving module may be configured to: receive the second information sent by the core network function associated with the relay device, where the second information is used to indicate the relay service and the corresponding security mechanism; the processing module may be configured as: According to the second information, the second security mechanism is determined.
  • the sending module may be configured to: when it is determined that the first security mechanism does not match the second security mechanism, send a second message to the terminal device, where the second message is used to indicate rejection of the first request message. .
  • the sending module may be configured to: when it is determined that the first security mechanism matches the second security mechanism, send a second message to the network function associated with the relay device, where the second message carries the third Information, the third information is used to indicate the second security mechanism corresponding to the relay service of the relay device.
  • the third information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism.
  • the receiving module may also be configured to: receive a third message sent by the network function associated with the relay device, where the third message is used to indicate the third message corresponding to the relay service of the core network function associated with the relay device.
  • the third security mechanism does not match the second security mechanism;
  • the sending module may also be configured to: send a second message to the terminal device according to the third message, and the second message is used to indicate rejection of the first request message.
  • the present disclosure provides a security mechanism verification device for relay communications.
  • the device can be configured for network functionality.
  • the above device includes: a receiving module configured to receive a third request message, the third request message carries fourth information, and the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the relay of the relay device.
  • the second security mechanism corresponding to the service the sending module is configured to send a fourth request message to the core network function according to the fourth information, and the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function.
  • the receiving module is further configured to: receive a fifth message sent by the core network function, where the fifth message is used to indicate the third security mechanism.
  • the above device also includes: a processing module configured to determine whether the first security mechanism or the second security mechanism matches the third security mechanism.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism, or the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism. .
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the sending module may also be configured to: when it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism, send a sixth message, where the sixth message is used to indicate the first The security mechanism or secondary security mechanism does not match the tertiary security mechanism.
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the present disclosure provides a security mechanism verification device for relay communications.
  • This device can be configured for core network functions.
  • the above device includes: a receiving module configured to receive a fourth request message sent by the network function, where the fourth request message is used to request a third security mechanism corresponding to the relay service of the core network function; a sending module configured to respond to the fourth request message, sending a fifth message to the network function, where the fifth message is used to indicate the third security mechanism.
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the present disclosure provides a communication system, including network functions and core network functions.
  • the network function is configured to: send a fourth request message to the core network function according to the fourth information, where the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the second security mechanism corresponding to the relay service of the relay device.
  • Security mechanism the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function; determine whether the first security mechanism or the second security mechanism matches the third security mechanism.
  • the core network function is configured to: send a fifth message to the network function according to the fourth request message, where the fifth message is used to indicate the third security mechanism.
  • the network function may be further configured to: receive a third request message, where the third request message carries fourth information.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism, or the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism. .
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the network function may also be configured to: when it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism, send a sixth message, where the sixth message is used to indicate the first The security mechanism or secondary security mechanism does not match the tertiary security mechanism.
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the present disclosure provides an electronic device, including: a memory; a processor connected to the memory and configured to execute computer-executable instructions stored on the memory to implement the first to third aspects and their possibilities The security mechanism verification method for relay communication according to any one of the embodiments.
  • the present disclosure provides a computer storage medium.
  • the computer storage medium stores computer-executable instructions. After the computer-executable instructions are executed by a processor, the computer-executable instructions can implement any of the first to third aspects and their possible implementations.
  • the security mechanism corresponding to the relay service of the terminal device is verified, and on the other hand, the security mechanism corresponding to the relay service of the relay device is verified, thereby realizing the verification of the security mechanism of the relay communication. , ensuring that the terminal equipment and relay equipment for relay communication adopt correctly configured security mechanisms.
  • Figure 1 is a schematic structural diagram of a communication system in an embodiment of the present disclosure
  • Figure 2 is a schematic flow chart of a security mechanism verification method for relay communication in an embodiment of the present disclosure
  • Figure 3 is a schematic flow chart of another security mechanism verification method for relay communication in an embodiment of the present disclosure.
  • Figure 4 is a schematic flow chart of yet another security mechanism verification method for relay communication in an embodiment of the present disclosure
  • Figure 5 is a schematic flowchart of the implementation of the verification process of the security mechanism of the relay service in an embodiment of the present disclosure
  • Figure 6 is a schematic structural diagram of a security mechanism verification device for relay communication in an embodiment of the present disclosure
  • Figure 7 is a schematic structural diagram of another security mechanism verification device for relay communication in an embodiment of the present disclosure.
  • Figure 8 is a schematic structural diagram of an electronic device in an embodiment of the present disclosure.
  • Figure 9 is a schematic structural diagram of a terminal device in an embodiment of the present disclosure.
  • first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the embodiments of the present disclosure, “first information” may also be called “second information”, and similarly, “second information” may also be called “first information”. Depending on the context, the word “if” as used herein may be interpreted as “when” or “when” or “in response to determining.”
  • FIG. 1 is a schematic structural diagram of a communication system in an embodiment of the present disclosure.
  • the above-mentioned communication system 100 may include a 5G access network (AN) and a 5G core network (5GC).
  • the 5G access network may include the next generation radio access network (NG-RAN) 101.
  • the NG-RAN 101 communicates with the UE (user equipment) through the Uu interface.
  • the UE may include relay device 102A and terminal device 102B.
  • the 5G core network 103 may include: access and mobility management function (AMF) 1031, user plane function (UPF) 1032, session management function (SMF) 1033, policy Control function (policy control function, PCF) 1034, 5G ProSe key management function (5G PKMF) 1036, etc.
  • AMF access and mobility management function
  • UPF user plane function
  • SMF session management function
  • PCF policy Control function
  • 5G PKMF 5G ProSe key management function
  • the above communication system may also include other network elements, which is not specifically limited in the embodiment of the present disclosure.
  • terminal equipment can access the 5G core network through the third generation partnership project (3GPP) technology. Specifically, terminal equipment can access the 5G core network through 3GPP access network equipment.
  • 3GPP third generation partnership project
  • PCF 1034 has a policy control function and is mainly responsible for policy decisions related to session and business flow billing strategies, quality of service (QoS) bandwidth guarantees and policies, etc.
  • QoS quality of service
  • SMF 1033 has a session management function, which mainly performs session management, execution of control policies issued by PCF, selection of user plane function (UPF), UE Internet Protocol (internet protocol, IP) address allocation and other functions.
  • PCF user plane function
  • UPF user plane function
  • IP Internet Protocol
  • AMF 1031 has access and mobility management functions, mainly performing mobility management, access authentication/authorization and other functions. In addition, it is also responsible for transmitting user policies between UE and PCF.
  • UPF 1032 is the user plane functional entity, which serves as the interface with the data network and completes functions such as user plane (UP) data forwarding, session/flow level-based billing statistics, bandwidth limitation, etc.
  • UP user plane
  • 5G PKMF 1036 is a user plane functional entity, used to implement functions such as ProSe security management.
  • 5G PKMF may also be called PKMF.
  • N7 The interface between PCF 1034 and SMF 1033, used to issue control policies for packet data unit (packet data unit, PDU) session granularity and business data flow granularity.
  • packet data unit packet data unit, PDU
  • N3 Communication interface between UPF 1032 and NG-RAN 101.
  • N15 The interface between PCF 1034 and AMF 1031, used to deliver UE policies and access control related policies.
  • N4 The interface between SMF 1033 and UPF 1032. It is used to transfer information between the control plane and UP, including controlling the distribution of forwarding rules, QoS control rules, traffic statistics rules, etc. for UP and reporting of UP information.
  • N11 The interface between SMF 1033 and AMF 1031, used to transfer PDU session tunnel information between NG-RAN 101 and UPF 1034, transfer control messages sent to UE, and transfer radio resource control information sent to NG-RAN 101 wait.
  • N2 The interface between AMF 1031 and NG-RAN 101, used to transmit wireless bearer control information from the core network side to NG-RAN 101, etc.
  • N8 The interface between AMF 1031 and UDM 1035. It is used for AMF 1031 to obtain subscription data and authentication data related to access and mobility management from UDM 1035, and for AMF 1031 to register UE current mobility management related information with UDM 1035.
  • N10 The interface between SMF 1033 and UDM 1035. It is used for SMF 1033 to obtain session management-related contract data from UDM 1035, and for SMF 1033 to register UE current session-related information with UDM 1035.
  • Nx The interface between 5G PKMF 1036 and PCF 1034.
  • the above-mentioned user equipment may be a device with a wireless communication function.
  • UE can be deployed on land, including indoor or outdoor, handheld, wearable or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as aircraft, balloons, satellites, etc.).
  • the above-mentioned UE can be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver functions, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, or an industrial control (industrial control) ), wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the UE may also be a handheld device with wireless communication capabilities, a vehicle-mounted device, a wearable device, a computing device, or other processing device connected to a wireless modem, etc.
  • the UE can also be called by different names in different networks, such as: terminal device, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, Terminal, wireless communication equipment, user agent or user device, cellular phone, cordless phone, session initiation protocol (SIP) phone, wireless local loop (WLL) station, personal digital assistant (personal digital assistant) , PDA), terminal equipment in 5G networks or future evolution networks, etc.
  • networks such as: terminal device, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, Terminal, wireless communication equipment, user agent or user device, cellular phone, cordless phone, session initiation protocol (SIP) phone, wireless local loop (WLL) station, personal digital assistant (personal digital assistant) , PDA), terminal equipment in 5G networks or future evolution networks, etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the above-mentioned access network equipment may be equipment used by the access network side to support terminal access to the wireless communication system.
  • it can be the next generation base station (next generation NodeB, gNB), transmission reception point (TRP), relay node (relay node), access point (AP) in the 5G access technology communication system )wait.
  • next generation base station next generation NodeB, gNB
  • TRP transmission reception point
  • relay node relay node
  • AP access point
  • each device is only exemplary, and not all functions of each device are necessary when used in embodiments of the present disclosure. All or part of the equipment of the core network may be physical equipment or virtualized equipment, which is not limited here. Of course, the communication system in the embodiment of the present disclosure may also include other devices not shown in Figure 1, which are not limited here.
  • control plane security indicator is included in the ProSe U2N relay discovery (ProSe U2N relay discovery) parameters provided by the PCF to the terminal equipment (for example, remote UE) and the relay equipment (for example, relay UE) respectively. ). If the control plane security indicator is for an RSC, the control plane security indicator indicates that a control plane-based security mechanism (or security process) is used.
  • the end device and the relay device are provided with a control plane security indicator for RSC, and the end device and the relay device discover each other for the RSC associated with the control plane security indicator, the end device may still use user plane-based security mechanism to send a direct communication request through the PC5 interface, or the relay device that receives the direct communication request may still use a user plane-based security mechanism to establish a PC5 communication security line for the relay service.
  • the terminal device or relay device operates incorrectly because the security mechanism adopted is incorrect.
  • There is no corresponding solution proposed in the related art that can verify whether the terminal device and the relay device correctly adopt the security mechanism allocated for the requested relay service.
  • embodiments of the present disclosure provide a security mechanism verification method for relay communication.
  • FIG 2 is a schematic flowchart of a security mechanism verification method for relay communication in an embodiment of the present disclosure. This method can be applied to relay devices. As shown in Figure 2, the above method includes S201 to S204.
  • the first request message carries first information, and the first information is used to indicate the first security mechanism corresponding to the relay service of the terminal device.
  • the first request message may be a direct communication request (direct communication request, DCR) message.
  • the first information may include the RSC and key parameters corresponding to the first security mechanism.
  • RSC is the relay service code, which can be used to identify relay services.
  • the key parameter corresponding to the first security mechanism may be K NRP freshness parameter 1.
  • the RSC may be obtained by the terminal device from the core network function (for example, PCF) associated with the terminal device during the service authentication and information provision process.
  • the terminal device can also obtain the control plane security indicator from the core network function.
  • the control plane security indicator may be provided for a specific RSC to indicate that the relay service corresponding to the RSC adopts a control plane-based security mechanism.
  • the first information may also include proximity service remote user key (ProSe remote user key, PRUK) identification information, for example, PRUK ID.
  • PRUK identification information is used to identify the proximity service remote user key. It can be understood that the PRUK identification information can be obtained by the terminal device from a network function (for example, PKMF) associated with the terminal device. In addition, the terminal device can also obtain the PRUK identified by the PRUK identification information from the network function.
  • PRUK proximity service remote user key
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism.
  • the first security mechanism in the case where the terminal device obtains the control plane security indicator (that is, the control plane security indicator is provided for the RSC), the first security mechanism may be a control plane-based security mechanism. In an example, in the case where the terminal device does not obtain the control plane security indicator (that is, the control plane security indicator is not provided for the RSC), the first security mechanism may be a user plane-based security mechanism.
  • the first information may be used to indicate the first security mechanism corresponding to the relay service of the terminal device.
  • the key parameter corresponding to the first security mechanism in the first information may be used alone to indicate that the first security mechanism is a user plane-based security mechanism.
  • the PRUK identification information in the first information may be used alone to indicate that the first security mechanism is a user plane-based security mechanism.
  • the key parameter corresponding to the first security mechanism and the PRUK identification information in the first information may be jointly used to indicate that the first security mechanism is a user plane-based security mechanism.
  • the second security mechanism may be a user plane-based security mechanism. Specifically, determining the second security mechanism corresponding to the relay service of the terminal device in S202 may include the following two steps.
  • the second information is used to indicate the relay service and the corresponding security mechanism.
  • the relay device can obtain the second information from the core network function (for example, PCF) associated with the relay device during the service authentication and information provision process.
  • the second information may include RSC.
  • the terminal device while the terminal device obtains the RSC from the core network function, it can also obtain the control plane security indicator from the core network function.
  • a second security mechanism is determined based on the second information.
  • the second security mechanism can be understood as a security mechanism adopted by the relay device for the relay service, or as a security mechanism configured by the network for the relay service.
  • the network configures the security mechanism corresponding to the relay service to the relay device, which often means that the relay device will adopt the security mechanism configured by the network for the relay service.
  • the second information received by the relay device does not include the control plane security indicator, and the relay device determines that the second security mechanism corresponding to the RSC is a user plane-based security mechanism.
  • the second information received by the relay device includes a control plane security indicator, but the relay device may still determine that the second security mechanism corresponding to the RSC is a user plane-based security mechanism.
  • the first security mechanism is determined in S201, and the second security mechanism is determined in S202. Afterwards, the first security mechanism and the second security mechanism can be matched.
  • the first security mechanism may be a security mechanism based on the control plane
  • the second security mechanism may be a security mechanism based on the user plane. Then it may be determined that the first security mechanism and the second security mechanism do not match.
  • the first security mechanism may be a user-plane-based security mechanism
  • the second security mechanism may be a user-plane-based security mechanism. Then it may be determined that the first security mechanism and the second security mechanism match. Through the above matching, the matching situation between the first security mechanism and the second security mechanism can be obtained.
  • the second message may be different, and the sender of the second message may also be different.
  • the relay device may send the second message to the terminal device.
  • the second message may be used to indicate rejection of the first request message.
  • the second message may be a direct communication reject message.
  • the relay device may send the second message to the network function.
  • the second message carries third information.
  • the third information is used to indicate the second security mechanism corresponding to the relay service of the relay device.
  • the second message may be a key request message.
  • the third information may include all or part of the first information.
  • the third information may include the RSC and the key parameters corresponding to the first security mechanism.
  • the third information may also include PRUK identification information. It can be understood that because the relay device has determined that the first security mechanism matches the second security mechanism, although the key parameter (and possible PRUK identification information) corresponding to the first security mechanism in the third information indicates It is the first security mechanism, but it also indirectly indicates the second security mechanism corresponding to the relay service of the relay device.
  • the third information may include the RSC and key parameters corresponding to the second security mechanism.
  • the above method may further include: receiving a third message sent by the network function associated with the relay device. , the third message is used to indicate that the third security mechanism corresponding to the relay service of the core network function associated with the relay device does not match the second security mechanism; according to the third message, a second message is sent to the terminal device, and the second message is to indicate rejecting the first request message.
  • the third message can be received from the network function.
  • the third message may indicate that the third security mechanism does not match the second security mechanism.
  • the third message may also carry a failure cause that causes the third security mechanism to not match the second security mechanism.
  • the failure reason may be a mismatch between the second security mechanism and the third security mechanism, or may be other more specific reasons.
  • FIG. 3 is a schematic flowchart of another security mechanism verification method for relay communication in an embodiment of the present disclosure. This method can be applied to network functions. As shown in Figure 3, the above method includes S301 to S304.
  • the third request message carries fourth information, and the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the second security mechanism corresponding to the relay service of the relay device.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism. In an embodiment, the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism.
  • the third request message may be a key request message.
  • the network function can be PKMF.
  • the network function may be relay device associated PKMF.
  • the network function may be PKMF associated with the terminal device.
  • the network function may be a core network function located within the core network or a non-core network function located outside the core network. The embodiments of the present disclosure do not specifically limit this.
  • the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function.
  • the core network function may be PCF or other core network functions.
  • the third security mechanism corresponding to the relay service of the core network function is the security mechanism configured on the network side for the relay service.
  • the third security mechanism is the security mechanism corresponding to the RSC of the relay service.
  • the third security mechanism may be a security mechanism based on the user plane or a security mechanism based on the control plane.
  • the fifth message is used to indicate the third security mechanism.
  • the network function may receive the fifth message from the core network function.
  • the network device may determine whether the first security mechanism or the second security mechanism matches the third security mechanism according to the fifth message.
  • the network function may send a sixth message if it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism.
  • the sixth message is used to indicate that the first security mechanism or the second security mechanism does not match the third security mechanism.
  • the network function can continue with subsequent processes, for example, sending a message, or performing the next step of processing.
  • network functions may be associated with terminal devices or relay devices; correspondingly, core network functions may be associated with terminal devices or relay devices.
  • the network function may be PKMF associated with the relay device, and the core network function may be PCF associated with the relay device.
  • S301 to S303 will be described in detail.
  • PKMF may receive the third request message sent by the relay device.
  • the fourth information in the third request message may be used to indicate the second security mechanism corresponding to the relay service of the relay device. It can be understood that, in this case, the third request message may be the above-mentioned second message sent by the relay device.
  • PKMF may send a fourth request message to PCF.
  • the fourth request message is used to request the third security mechanism corresponding to the relay service of the PCF.
  • PKMF can receive the fifth message sent by PCF.
  • the fifth message may indicate the third security mechanism.
  • PKMF may determine whether the second security mechanism matches the third security mechanism.
  • the PKMF may send a sixth message to the relay device.
  • the sixth message is used to indicate that the second security mechanism does not match the third security mechanism.
  • the sixth message may be a key response message.
  • the sixth message may also carry a failure reason.
  • the failure reason may be a mismatch between the second security mechanism and the third security mechanism, or may be other more specific reasons.
  • the network function may be PKMF associated with the terminal device, and the core network function may be PCF associated with the relay device.
  • S301 to S303 will be described in detail.
  • the PKMF may receive the third request message sent by the PKMF associated with the relay device.
  • the fourth information in the third request message may be used to indicate the first security mechanism corresponding to the relay service of the terminal device.
  • the third request message may be the above-mentioned request message sent by the PKMF associated with the relay device, for example, a key request message.
  • PKMF may send a fourth request message to PCF.
  • the fourth request message is used to request the third security mechanism corresponding to the relay service of the PCF.
  • PKMF can receive the fifth message sent by PCF.
  • the fifth message may indicate the third security mechanism.
  • PKMF may determine whether the first security mechanism matches the third security mechanism.
  • the PKMF may send a sixth message to the PKMF associated with the terminal device.
  • the sixth message is used to indicate that the first security mechanism does not match the third security mechanism.
  • the sixth message may be a key response message.
  • the sixth message may also carry a failure reason.
  • the failure reason may be a mismatch between the first security mechanism and the third security mechanism, or may be other more specific reasons.
  • FIG. 4 is a schematic flowchart of yet another security mechanism verification method for relay communication in an embodiment of the present disclosure. This approach can be applied to core network functions. As shown in Figure 4, the above method includes S401 to S402.
  • the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function.
  • the core network function may be PCF. In one embodiment, the core network function may be a PCF associated with the relay device. In one embodiment, the core network function may be a PCF associated with the relay device. It should be noted that the core network function may also be other core network functions, which are not specifically limited in this embodiment of the disclosure.
  • the network function can be PKMF.
  • the network function may be relay device associated PKMF.
  • the network function may be relay device associated PKMF. It should be noted that the network function can also be other network functions, which are not specifically limited in the embodiments of the present disclosure.
  • a fifth message is sent to the network function.
  • the fifth message is used to indicate the third security mechanism.
  • the core network function in response to the fourth request message, carries the matching situation in the fifth message and sends it to the network function.
  • the core network function determines whether the first security mechanism or the second security mechanism matches the third security mechanism corresponding to the relay service of the core network function.
  • the core network function may also determine whether the first security mechanism or the second security mechanism matches the third security mechanism corresponding to the relay service of the core network function, but only sends the third security mechanism to the network through the fifth message. Function for the network function to determine whether the first security mechanism or the second security mechanism matches the third security mechanism corresponding to the relay service of the core network function.
  • the security mechanism corresponding to the relay service of the terminal device is verified, and on the other hand, the security mechanism corresponding to the relay service of the relay device is verified, thereby realizing the security mechanism of the relay communication.
  • the verification ensures that the terminal equipment and relay equipment for relay communication adopt correctly configured security mechanisms.
  • Figure 5 is a schematic flowchart of the implementation of the verification process of the security mechanism of the relay service in the embodiment of the present disclosure.
  • the security mechanism verification method of relay communication in the embodiment of the present disclosure is applicable to the relay service process.
  • the terminal device may be a remote UE
  • the relay device may be a U2N relay
  • the network function associated with the relay device may be the first PKMF
  • the core network function associated with the relay device It may be the first PCF
  • the network function associated with the terminal device may be the second PKMF
  • the core network function associated with the terminal device may be the second PCF.
  • the relay service process may include S501 to S516.
  • the remote UE obtains discovery security information.
  • the remote UE can establish a secure connection through the second PKMF of the PC8 interface (or PC8 reference point).
  • the remote UE can obtain the address of the second PKMF and the discovery parameters from the second PCF during the service authentication and information provision process.
  • Discovery parameters may include RSC and may also include control plane security indicators.
  • control plane security indicator may be configured by the second PCF for the relay service, and is used to indicate that a control plane-based security mechanism is adopted for the relay service.
  • the remote UE may also obtain discovery security materials (discovery security materials) from the second PKMF.
  • discovery security materials discovery security materials
  • the U2N relay obtains discovery security information.
  • the U2N relay can establish a secure connection through the first PKMF of the PC8 interface (or PC8 reference point).
  • the U2N relay can obtain the address of the first PKMF and the discovery parameters from the first PCF during the service authentication and information provision process.
  • Discovery parameters may include RSC and may also include control plane security indicators.
  • control plane security indicator may be configured by the first PCF for the relay service, and is used to indicate that a control plane-based security mechanism is adopted for the relay service.
  • the remote UE sends a PRUK request message to the second PKMF.
  • the PRUK request message is used to request PRUK from the second PKMF.
  • the PRUK request message may carry the PRUK ID of the PRUK.
  • the remote UE receives the PRUK response message sent by the second PKMF.
  • the second PKMF verifies whether the remote UE is authorized to receive the U2N relay service. When it is determined that the remote UE is authorized, the second PKMF sends a PRUK response message to the remote UE.
  • the PRUK response message carries PRUK and PRUK ID.
  • the remote UE performs a discovery process with the U2N relay.
  • the remote UE and the U2N relay can perform the discovery process based on the discovery parameters and discovery security information.
  • the remote UE sends a DCR message to the U2N relay.
  • the DCR message (which may also be called the first request message) is used to request to provide direct communication.
  • the DCR message may carry the key parameter (ie, K NRP freshness parameter 1) of the security mechanism (which may also be called the first security mechanism) of the RSC and the relay service of the remote UE.
  • K NRP freshness parameter 1 the key parameter of the security mechanism (which may also be called the first security mechanism) of the RSC and the relay service of the remote UE.
  • the DCR message may also carry PRUK ID. In one embodiment, the DCR message may also carry SUCI (subscription conceaaled identifier, subscription privacy identifier).
  • the U2N relay verifies the security mechanism.
  • the U2N relay matches the security mechanism adopted by the remote UE for the relay service with the security mechanism (also called the second security mechanism) adopted by the U2N relay for the relay service, thereby realizing verification of the security mechanism.
  • the U2N relay determines the security mechanism it adopts for the relay service.
  • the security mechanism is a control plane based security mechanism.
  • the security mechanism is a user plane-based security mechanism.
  • the U2N relay determines the security mechanism adopted by the remote UE for the relay service.
  • the security mechanism may be a security mechanism based on the control plane or a security mechanism based on the user plane.
  • the U2N relay may determine that the remote UE initiates the DCR through the user plane-based security process. .
  • the U2N relay can determine that the security mechanism adopted by the remote UE for the relay service is a user plane-based security mechanism. Otherwise, the U2N relay may determine that the security mechanism adopted by the remote UE for the relay service is a control plane-based security mechanism.
  • the U2N relay matches the security mechanism adopted by the remote UE for the relay service with the security mechanism adopted by the U2N relay for the relay service.
  • U2N relay in S507 is not necessary for the verification of the security mechanism. In some cases, after S506, U2N may not perform security mechanism verification, but directly execute S508.
  • the U2N relay sends a key request message to the first PKMF.
  • the U2N relay may send a key request message (which may also be called a second message or a third request message) to the first PKMF.
  • the key request message is used to request key parameters corresponding to the security mechanism.
  • the key request message may carry PRUK ID or key parameters of SUCI, RSC, and the security mechanism of the relay service of the remote UE.
  • the U2N relay sends a direct communication rejection message to the remote UE.
  • the U2N relay may send a direct communication rejection message (which may also be called a second message) to the remote UE.
  • the Direct Connect Communication Reject message is used to indicate the rejection of the DCR message.
  • the first PKMF and the first PCF verify the security mechanism.
  • the first PKMF can interact with the first PCF to implement verification of the security mechanism. It can be understood that the first PCF locally stores the security mechanism corresponding to the RSC of the relay service.
  • the verification security mechanism between the first PKMF and the first PCF can be implemented in the following manner: the first PKMF can send a request message (which can also be called a fourth request message) to the first PCF.
  • the request message is used to request the security mechanism corresponding to the relay service of the first PCF (which may also be called the third security mechanism).
  • the first PCF may send the security mechanism corresponding to the relay service of the U2N relay to the first PKMF through a response message (which may also be called a fifth message).
  • the first PKMF After receiving the response message, the first PKMF matches the security mechanism carried in the response message with the security mechanism corresponding to the relay service of the U2N relay. In this way, the first PKMF can confirm the matching between the security mechanism corresponding to the relay service of the U2N relay and the security mechanism corresponding to the relay service of the first PCF.
  • the request message sent by the first PKMF to the first PCF may carry the RSC of the relay service, so that the first PCF can locally determine the security mechanism corresponding to the RSC of the relay service (that is, allocate the RSC to the RSC). safety mechanism).
  • the first PKMF sends a key request message to the second PKMF.
  • the first PKMF sends a key request message to the second PKMF.
  • the key request message may carry PRUK ID or key parameters of SUCI, RSC, and the security mechanism of the relay service of the remote UE.
  • the first PKMF sends a key response message to the U2N relay.
  • the first PKMF sends a key response message (which may also be called a sixth message) to the U2N relay.
  • the key response message is used to indicate rejection of the key request message from the U2N relay.
  • the key request message may carry a failure reason.
  • the U2N relay sends a direct communication rejection message to the remote UE.
  • the U2N relay After receiving the key response message in S512, the U2N relay sends a direct communication rejection message (which may also be called the second message) to the remote UE according to the key response message.
  • a direct communication rejection message (which may also be called the second message)
  • the second PKMF and the second PCF verify the security mechanism.
  • the second PKMF can interact with the second PCF to implement verification of the security mechanism. It can be understood that the second PCF locally stores the security mechanism corresponding to the RSC of the relay service.
  • the verification security mechanism between the second PKMF and the second PCF can be implemented in the following manner: the second PKMF can send a request message (which can also be called a fourth request message) to the second PCF.
  • the request message is used to request the security mechanism corresponding to the relay service of the second PCF (which may also be called the third security mechanism).
  • the second PCF may send the security mechanism corresponding to the relay service of the remote UE to the second PKMF through a response message (which may also be called a fifth message).
  • the second PKMF After receiving the response message, the second PKMF matches the security mechanism carried in the response message with the security mechanism corresponding to the relay service of the remote UE. In this way, the first PKMF can confirm the matching between the security mechanism corresponding to the relay service of the remote UE and the security mechanism corresponding to the relay service of the second PCF.
  • the request message sent by the second PKMF to the second PCF may carry the RSC of the relay service, so that the second PCF can locally determine the security mechanism corresponding to the RSC of the relay service (that is, allocate the RSC to the RSC). safety mechanism).
  • the second PKMF sends a key response message to the first PKMF.
  • the second PKMF sends a key response message (which may also be called a sixth message) to the first PKMF.
  • the key response message is used to indicate rejection of the key request message from the U2N relay.
  • the key request message may carry a failure reason.
  • the first PKMF sends a key response message to the U2N relay.
  • the first PKMF after receiving the key response message from the second PKMF in S517, the first PKMF sends the key response message to the U2N relay.
  • the key response message is used to indicate rejection of the key request message from the U2N relay.
  • the key request message may carry a failure reason.
  • the U2N relay sends a direct communication rejection message to the remote UE.
  • the U2N relay After receiving the key response message in S512, the U2N relay sends a direct communication rejection message (which may also be called the second message) to the remote UE according to the key response message.
  • a direct communication rejection message (which may also be called the second message)
  • S514 to S517 are optional. In other words, in some cases, after receiving the key request message from the first PKMF in S511, S518 can be directly executed without the need for the second PKMF to verify the security mechanism.
  • the second PKMF sends a key response message to the first PKMF.
  • the second PKMF sends a key response message to the first PKMF.
  • the key response message may carry key parameters.
  • the key parameters may include K NRP and/or K NRP freshness parameter 2.
  • the first PKMF sends a key response message to the U2N relay.
  • the first PKMF after receiving the key response message from the second PKMF in S518, the first PKMF sends the key response message to the U2N relay.
  • the key response message may carry key parameters.
  • the key parameters may include K NRP and/or K NRP freshness parameter 2.
  • the U2N relay sends a direct connection security mechanism command to the remote UE.
  • the direct connection security mechanism command carries K NRP freshness parameter 2.
  • the remote UE authenticates the U2N relay.
  • the remote UE after receiving the direct security mode command (direct security mode command) in S520, the remote UE is at least based on the local PRUK, RSC, K NRP freshness parameter 1 and the K NRP freshness parameter obtained from the direct security mode command. 1. Verify the direct connection security mechanism command to ensure that the U2N relay is authorized to provide relay services.
  • the remote UE sends a direct connection security mechanism completion message to the U2N relay.
  • the remote UE in response to the received direct security mechanism command, sends a direct security mechanism completion message (direct security mode complete) to the U2N relay.
  • the U2N relay authenticates the remote UE.
  • the U2N relay After receiving the direct connection security mechanism completion message in S522, the U2N relay verifies the direct connection security mechanism completion message to ensure that the remote UE is authorized to use the relay service.
  • the U2N relay sends a direct communication acceptance message to the remote UE.
  • U2N After completing the verification in S523, U2N confirms that the remote UE is authorized to use the relay service, and sends a direct communication accept message to the remote UE.
  • embodiments of the present disclosure also provide a security mechanism verification device for relay communications.
  • the device may be provided on the above-mentioned relay device side or network function side, or a chip or system-on-chip therein, or may be a functional module used to implement the methods described in the above embodiments.
  • This device can realize the functions performed by the relay device or network function in the above embodiments, and these functions can be realized by hardware executing corresponding software.
  • These hardware or software include one or more modules corresponding to the above functions.
  • Figure 6 is a schematic structural diagram of a security mechanism verification device for relay communication in an embodiment of the present disclosure. As shown in FIG. 6 , the device 600 may include: a receiving device 610 , a processing device 620 , and a sending device 630 .
  • the security mechanism verification device for relay communication shown in Figure 6 may be provided on the relay device.
  • the receiving device 610 is configured to receive a first request message sent by the terminal device, where the first request message carries first information, and the first information is used to indicate the first security mechanism corresponding to the relay service of the terminal device.
  • the processing device 620 is configured to determine a second security mechanism corresponding to the relay service of the relay device, and determine whether the first security mechanism matches the second security mechanism.
  • the sending device 630 is configured to send the second message according to the matching situation.
  • the first information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the second security mechanism may be a user-plane-based security mechanism
  • the receiving module 610 can be configured to: receive the second information sent by the core network function associated with the relay device, where the second information is used to indicate the relay service and the corresponding security mechanism; the processing module 620 can be configured To: determine the second security mechanism based on the second information.
  • the sending module 630 may be configured to: when it is determined that the first security mechanism does not match the second security mechanism, send a second message to the terminal device, where the second message is used to indicate rejection of the first request. information.
  • the sending module 630 may be configured to: when it is determined that the first security mechanism matches the second security mechanism, send a second message to the network function associated with the relay device, where the second message carries the third Third information, the third information is used to indicate the second security mechanism corresponding to the relay service of the relay device.
  • the third information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism.
  • the receiving module 610 may also be configured to: receive a third message sent by the network function associated with the relay device, where the third message is used to indicate the relay service corresponding to the core network function associated with the relay device.
  • the third security mechanism does not match the second security mechanism;
  • the sending module 630 may also be configured to: send a second message to the terminal device according to the third message, where the second message is used to indicate rejection of the first request message.
  • the security mechanism verification device for relay communication shown in Figure 6 can be provided in the network function.
  • the receiving module 610 is configured to receive a third request message, the third request message carries fourth information, and the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the third security mechanism corresponding to the relay service of the relay device. 2. Safety mechanism.
  • the sending module 630 is configured to send a fourth request message to the core network function according to the fourth information, where the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function.
  • the receiving module 610 is further configured to: receive a fifth message sent by the core network function, where the fifth message is used to indicate the third security mechanism.
  • the processing module 620 is configured to determine whether the first security mechanism or the second security mechanism matches the third security mechanism.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism, or the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism. .
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the sending module 620 may also be configured to: when it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism, send a sixth message, where the sixth message is used to indicate the third security mechanism. The first safety mechanism or the second safety mechanism does not match the third safety mechanism.
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • embodiments of the present disclosure also provide a security mechanism verification device for relay communications.
  • the device may be provided in the above-mentioned core network function, or in a chip or system-on-chip therein, or may be a functional module used to implement the methods described in the above embodiments.
  • the device can realize the functions performed by the core network functions in the above embodiments, and these functions can be realized by hardware executing corresponding software. These hardware or software include one or more modules corresponding to the above functions.
  • Figure 7 is a schematic structural diagram of a security mechanism verification device for relay communication in an embodiment of the present disclosure. As shown in FIG. 7 , the device may include: a receiving device 710 and a sending device 720 .
  • the security mechanism verification device for relay communication shown in Figure 7 can be provided in the core network function.
  • the receiving device 710 is configured to receive a fourth request message sent by the network function.
  • the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function.
  • the sending device 620 is configured to send a fifth message to the network function in response to the fourth request message, where the fifth message is used to indicate the third security mechanism.
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • the receiving module mentioned in the embodiment of the present disclosure may be a receiving interface, a receiving circuit or a receiver, etc.; the sending module may be a sending interface, a sending circuit or a transmitter, etc.; and the processing module may be one or more processors.
  • inventions of the present disclosure also provide a communication system.
  • the communication system includes network functions and core network functions.
  • the network function is configured to: send a fourth request message to the core network function according to the fourth information, where the fourth information is used to indicate the first security mechanism corresponding to the relay service of the terminal device or the second security mechanism corresponding to the relay service of the relay device.
  • Security mechanism the fourth request message is used to request the third security mechanism corresponding to the relay service of the core network function; determine whether the first security mechanism or the second security mechanism matches the third security mechanism.
  • the core network function is configured to: send a fifth message to the network function according to the fourth request message, and the fifth message is used to indicate the third security mechanism.
  • the network function may be further configured to: receive a third request message, where the third request message carries fourth information.
  • the fourth information may include the RSC of the relay service and the key parameters corresponding to the first security mechanism, or the fourth information may include the RSC of the relay service and the key parameters corresponding to the second security mechanism. .
  • the fourth request message may carry the RSC of the relay service.
  • the first security mechanism may be a control plane-based security mechanism or a user plane-based security mechanism
  • the third security mechanism may be a user-plane-based security mechanism
  • the network function may also be configured to: when it is determined that the first security mechanism or the second security mechanism does not match the third security mechanism, send a sixth message, where the sixth message is used to indicate the first The security mechanism or secondary security mechanism does not match the tertiary security mechanism.
  • the network function may be the PKMF associated with the relay device, and the core network function may be the PCF associated with the relay device.
  • the network function may be the PKMF associated with the terminal device, and the core network function may be the PCF associated with the terminal device.
  • FIG. 8 is a schematic structural diagram of an electronic device in an embodiment of the present disclosure.
  • the electronic device 800 uses general computer hardware, including a processor 801, a memory 802, a bus 803, an input device 804 and an output device 805.
  • memory 802 may include computer storage media in the form of volatile and/or non-volatile memory, such as read-only memory and/or random access memory.
  • Memory 802 may store an operating system, application programs, other program modules, executable code, program data, user data, and the like.
  • Input device 804 may be used to enter commands and information into an electronic device, such as a keyboard or a pointing device such as a mouse, trackball, touch pad, microphone, joystick, game pad, satellite television antenna, scanner, or similar device. These input devices may be connected to processor 801 via bus 803 .
  • the output device 805 can be used for electronic devices to output information.
  • the output device 805 can also be other peripheral output devices, such as speakers and/or printing devices. These output devices can also be connected to the processor 801 through the bus 803. .
  • the electronic device can be connected to a network through the antenna 806, such as a local area network (LAN).
  • LAN local area network
  • the computer execution instructions stored in the control device can be stored in a remote storage device and are not limited to local storage.
  • the electronic device 800 executes the executable code or application program stored in the memory 802
  • the electronic device executes the relay communication on the relay device side, the network function side, or the core network function side in the above embodiments.
  • the security mechanism verification method for the specific execution process, please refer to the above embodiments and will not be described again here.
  • the above-mentioned memory 802 stores computer execution instructions for implementing the functions of the receiving module 610, the processing module 620 and the sending module 630 in FIG. 6 .
  • the functions/implementation processes of the receiving module 610, the processing module 620 and the sending module 630 in Figure 6 can all be implemented by the processor 801 in Figure 8 calling the computer execution instructions stored in the memory 802.
  • the processor 801 in Figure 8 calling the computer execution instructions stored in the memory 802.
  • the above-mentioned memory 802 stores computer execution instructions for implementing the functions of the receiving module 710 and the sending module 720 in FIG. 7 .
  • the functions/implementation processes of the receiving module 710 and the sending module 720 in Figure 7 can be implemented by the processor 801 in Figure 8 calling the computer execution instructions stored in the memory 802.
  • the processor 801 in Figure 8 calling the computer execution instructions stored in the memory 802.
  • the terminal device can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.
  • Figure 9 is a schematic structural diagram of a terminal device in an embodiment of the present disclosure.
  • the terminal device 900 may include one or more of the following components: a processing component 901, a memory 902, a power supply component 903, a multimedia component 904, an audio component 905, an input/output (I/O) interface 906, and a sensor. component 907 and communication component 908.
  • the processing component 901 generally controls the overall operations of the terminal device 900, such as operations associated with display, phone calls, data communications, camera operations, and recording operations.
  • the processing component 901 may include one or more processors 910 to execute instructions to complete all or part of the steps of the above method.
  • processing component 901 may include one or more modules that facilitate interaction between processing component 901 and other components.
  • processing component 901 may include a multimedia module to facilitate interaction between multimedia component 904 and processing component 901.
  • Memory 902 is configured to store various types of data to support operations at device 900 . Examples of such data include instructions for any application or method operating on the terminal device 900, contact data, phonebook data, messages, pictures, videos, etc.
  • Memory 902 may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EEPROM), Programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EEPROM erasable programmable read-only memory
  • EPROM Programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory flash memory, magnetic or optical disk.
  • the power supply component 903 provides power to various components of the terminal device 900 .
  • Power supply component 903 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to end device 900 .
  • Multimedia component 904 includes a screen that provides an output interface between terminal device 900 and the user.
  • the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. A touch sensor can not only sense the boundaries of a touch or swipe action, but also detect the duration and pressure associated with the touch or swipe action.
  • multimedia component 904 includes a front-facing camera and/or a rear-facing camera.
  • the front camera and/or the rear camera may receive external multimedia data.
  • Each front-facing camera and rear-facing camera can be a fixed optical lens system or have a focal length and optical zoom capabilities.
  • Audio component 905 is configured to output and/or input audio signals.
  • the audio component 905 includes a microphone (MIC) configured to receive external audio signals when the terminal device 900 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode.
  • the received audio signals may be further stored in memory 902 or sent via communications component 908 .
  • audio component 905 also includes a speaker for outputting audio signals.
  • the I/O interface 906 provides an interface between the processing component 901 and a peripheral interface module.
  • the peripheral interface module may be a keyboard, a click wheel, a button, etc. These buttons may include, but are not limited to: Home button, Volume buttons, Start button, and Lock button.
  • the sensor component 907 includes one or more sensors for providing various aspects of status assessment for the terminal device 900 .
  • the sensor component 907 can detect the open/closed state of the device 900 and the relative positioning of components, such as the display and keypad of the terminal device 900.
  • the sensor component 907 can also detect the position of the terminal device 900 or a component of the terminal device 900. changes, the presence or absence of user contact with the terminal device 900 , the orientation or acceleration/deceleration of the terminal device 900 and the temperature change of the terminal device 900 .
  • Sensor assembly 907 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact.
  • Sensor assembly 907 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications.
  • the sensor component 907 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
  • the communication component 908 is configured to facilitate wired or wireless communication between the terminal device 900 and other devices.
  • the terminal device 900 can access a wireless network based on communication standards, such as Wi-Fi, 2G or 3G or 4G or 5G or future evolved versions, or a combination thereof.
  • the communication component 908 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • communications component 908 also includes a near field communications (NFC) module to facilitate short-range communications.
  • NFC near field communications
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • the terminal device 900 may be configured by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable A programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component implementation is used to perform the above method.
  • ASICs application specific integrated circuits
  • DSPs digital signal processors
  • DSPDs digital signal processing devices
  • PLDs programmable logic devices
  • FPGA field programmable A programmable gate array
  • controller microcontroller, microprocessor or other electronic component implementation is used to perform the above method.
  • embodiments of the present disclosure also provide a computer-readable storage medium. Instructions are stored in the computer-readable storage medium; when the instructions are run on the computer, they are used to execute one or more of the above embodiments. Security mechanism verification method for relay communication on the relay equipment side, network function side or core network function side.
  • embodiments of the present disclosure also provide a computer program or computer program product.
  • the computer program product When the computer program product is executed on a computer, it causes the computer to implement the relay device side and network in one or more of the above embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种中继通信的安全机制校验方法和装置、设备及存储介质。上述方法包括：接收终端设备发送的第一请求消息，第一请求消息携带有第一信息，第一信息用于指示终端设备的中继服务对应的第一安全机制；确定中继设备的中继服务对应的第二安全机制；确定第一安全机制与第二安全机制是否匹配；根据匹配情况，发送第二消息。以此方式，本公开可以实现对中继通信的安全机制的验证。

Description

中继通信的安全机制校验方法和装置、设备及存储介质 技术领域
本公开涉及无线通信技术领域，尤其涉及一种中继通信的安全机制校验方法和装置、设备及存储介质。
背景技术
当前，对于基于邻近服务(proximity based services，ProSe)中继通信中的安全性，可以采用基于用户面的安全机制或者基于控制面的安全机制在终端设备和中继设备之间建立针对PC5接口(即直连通信接口)的发现和通信的安全性。该中继设备也被称为U2N(user-to-network，用户到网络)中继设备。针对ProSe U2N中继服务，终端设备可以在基于用户面的安全机制和基于控制面的安全机制之间择一实施。
然而，在终端设备和中继设备被配置采用基于控制面的安全机制的情况下，终端设备仍可能继续采用基于用户面的安全机制来发送直连通信请求，或者中继设备在接收到直连通信请求之后仍然可能采用基于用户面的安全机制。对于这些情形，相关技术中并没有提出对应的解决方案。
那么，如何避免中继通信相关的终端设备和中继设备采用不合适的安全机制是一个亟待解决的问题。
发明内容
本公开提供了一种中继通信的安全机制校验方法和装置、设备及存储介质，以实现对中继通信的安全机制的验证。
在第一方面，本公开提供一种中继通信的安全机制校验方法。该方法可以应用于中继设备。上述方法包括：接收终端设备发送的第一请求消息，第一请求消息携带有第一信息，第一信息用于指示终端设备的中继服务对应的第一安全机制；确定中继设备的中继服务对应的第二安全机制；确定第一安全机制与第二安全机制是否匹配；根据匹配情况，发送第二消息。
在一些可能的实施方式中，第一信息可以包括中继服务的中继服务代码(relay service code，RSC)以及第一安全机制对应的密钥参数。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第二安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，确定中继设备的中继服务对应的第二安全机制的操作可以包括：接收中继设备关联的核心网功能发送的第二信息，第二信息用于指示中继服务和对应的安全机制；根据第二信息，确定第二安全机制。
在一些可能的实施方式中，根据匹配情况发送第二消息的操作可以包括：在确定第一安全机制与第 二安全机制不匹配的情况下，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在一些可能的实施方式中，根据匹配情况发送第二消息的操作可以包括：在确定第一安全机制与第二安全机制匹配的情况下，向中继设备关联的网络功能发送第二消息，第二消息携带有第三信息，第三信息用于指示中继设备的中继服务对应的第二安全机制。
在一些可能的实施方式中，第三信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，在向第一网络功能发送第二消息之后，上述方法还可以包括：接收中继设备关联的网络功能发送的第三消息，第三消息用于指示中继设备关联的核心网功能的中继服务对应的第三安全机制与第二安全机制不匹配；根据第三消息，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在第二方面，本公开提供一种中继通信的安全机制校验方法。该方法可以应用于网络功能。上述方法包括：接收第三请求消息，第三请求消息携带有第四信息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制；根据第四信息，向核心网功能发送第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制；接收核心网功能发送的第五消息，第五消息用于指示第三安全机制；确定第一安全机制或第二安全机制与第三安全机制是否匹配。
在一些可能的实施方式中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数，或第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，上述方法还可以包括：在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，发送第六消息，第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一些可能的实施方式中，网络功能可以为中继设备关联的基于邻近服务密钥管理功能(ProSe key management function，PKMF)，核心网功能可以为中继设备关联的策略控制功能(policy control function，PCF)。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
在第三方面，本公开提供一种中继通信的安全机制校验方法。该方法可以应用于核心网功能。上述方法包括：接收网络功能发送的第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制；响应于第四请求消息，向网络功能发送第五消息，第五消息用于指示第三安全机制。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关 联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
在第四方面，本公开提供一种中继通信的安全机制校验装置。该装置可以设置于中继设备。上述装置包括：接收模块，配置为接收终端设备发送的第一请求消息，第一请求消息携带有第一信息，第一信息用于指示终端设备的中继服务对应的第一安全机制；处理模块，配置为确定中继设备的中继服务对应的第二安全机制，以及确定第一安全机制与第二安全机制是否匹配；发送模块，配置为根据匹配情况，发送第二消息。
在一些可能的实施方式中，第一信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第二安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，接收模块可以配置为：接收中继设备关联的核心网功能发送的第二信息，第二信息用于指示中继服务和对应的安全机制；处理模块可以配置为：根据第二信息，确定第二安全机制。
在一些可能的实施方式中，发送模块可以配置为：在确定第一安全机制与第二安全机制不匹配的情况下，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在一些可能的实施方式中，发送模块可以配置为：在确定第一安全机制与第二安全机制匹配的情况下，向中继设备关联的网络功能发送第二消息，第二消息携带有第三信息，第三信息用于指示中继设备的中继服务对应的第二安全机制。
在一些可能的实施方式中，第三信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，接收模块还可以配置为：接收中继设备关联的网络功能发送的第三消息，第三消息用于指示中继设备关联的核心网功能的中继服务对应的第三安全机制与第二安全机制不匹配；发送模块还可以配置为：根据第三消息，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在第五方面，本公开提供一种中继通信的安全机制校验装置。该装置可以设置于网络功能。上述装置包括：接收模块，配置为接收第三请求消息，第三请求消息携带有第四信息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制；发送模块，配置为根据第四信息，向核心网功能发送第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制。接收模块还配置为：接收核心网功能发送的第五消息，第五消息用于指示第三安全机制。上述装置还包括：处理模块，配置为确定第一安全机制或第二安全机制与第三安全机制是否匹配。
在一些可能的实施方式中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数，或第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，发送模块还可以配置为：在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，发送第六消息，第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
在第六方面，本公开提供一种中继通信的安全机制校验装置。该装置可以设置于核心网功能。上述装置包括：接收模块，配置为接收网络功能发送的第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制；发送模块，配置为响应于第四请求消息，向网络功能发送第五消息，第五消息用于指示第三安全机制。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
第七方面，本公开提供一种通信***，包括网络功能和核心网功能。网络功能配置为：根据第四信息，向核心网功能发送第四请求消息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制；确定第一安全机制或第二安全机制与第三安全机制是否匹配。核心网功能配置为：根据第四请求消息，向网络功能发送第五消息，第五消息用于指示第三安全机制。
在一些可能的实施方式中，网络功能还可以配置为：接收第三请求消息，第三请求消息携带有第四信息。
在一些可能的实施方式中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数，或第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，网络功能还可以配置为：在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，发送第六消息，第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
第八方面，本公开提供一种电子设备，包括：存储器；处理器，与存储器连接，被配置为执行存储在存储器上的计算机可执行指令，以实现如第一方面至第三方面及其可能的实施方式中任一项所述的中继通信的安全机制校验方法。
第九方面，本公开提供一种计算机存储介质，计算机存储介质存储有计算机可执行指令，计算机可执行指令被处理器执行后能够实现如第一方面至第三方面及其可能的实施方式中任一项所述的中继通信的安全机制校验方法。
在本公开中，一方面对终端设备的中继服务对应的安全机制进行验证，另一方面对中继设备的中继服务对应的安全机制进行验证，从而实现对中继通信的安全机制的验证，确保了进行中继通信的终端设备和中继设备采用正确配置的安全机制。
应当理解的是，本公开的第四方面至第九方面与本公开的第一方面至第三方面的技术方案一致，各方面及对应的可行实施方式所取得的有益效果相似，不再赘述。
附图说明
图1为本公开实施例中的通信***的结构示意图；
图2为本公开实施例中的一种中继通信的安全机制校验方法的流程示意图；
图3为本公开实施例中的另一种中继通信的安全机制校验方法的流程示意图；
图4为本公开实施例中的又一种中继通信的安全机制校验方法的流程示意图；
图5为本公开实施例中的中继服务的安全机制的校验流程的实施流程示意图；
图6为本公开实施例中的一种中继通信的安全机制校验装置的结构示意图；
图7为本公开实施例中的另一种中继通信的安全机制校验装置的结构示意图；
图8为本公开实施例中的一种电子设备的结构示意图；
图9为本公开实施例中的一种终端设备的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开实施例相一致的所有实施方式。相反，它们仅是本公开实施例的一些方面相一致的装置和方法的例子。
在本公开实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开实施例。在本公开实施例中所使用的单数形式的“一种”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开实施例可能采用术语“第一”、“第二”、“第三”等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开实施例范围的情况下，“第一信息”也可以被称为“第二信息”，类似地，“第二信息”也可以被称为“第一信息”。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
进一步地，在本公开实施例的描述中，“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系。例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，在本公开实施例的描述中，“多个”可以指两个或多于两个。
图1为本公开实施例中的通信***的结构示意图。如图1所示，上述通信***100可以包括5G接入网(AN)和5G核心网(5GC)。其中，5G接入网可以包括下一代无线接入网(next generation radio access network，NG-RAN)101，NG-RAN 101通过Uu接口与UE(user equipment，用户设备)通信。UE可以包括中继设备102A和终端设备102B。5G核心网103可以包括：接入和移动性管理功能(access and mobility management function，AMF)1031，用户面功能(user plane function，UPF)1032，会话管理功能(session management function，SMF)1033，策略控制功能(policy control function，PCF)1034，5G邻近服务密钥管理功能(5G ProSe key management function，5G PKMF)1036等。
在本公开实施例中，上述通信***还可以包括其他网元，本公开实施例对此不作具体限定。
其中，在上述通信***中，终端设备可以通过第三代伙伴计划(3rd generation partnership project，3GPP)技术接入5G核心网。具体的，终端设备可以通过3GPP接入网设备接入5G核心网。
在上述通信***中，PCF 1034具有策略控制功能，主要负责针对会话、业务流的计费策略、服务质量(quality of service，QoS)带宽保障及策略等相关的策略决策。
SMF 1033具有会话管理功能，主要进行会话管理、PCF下发控制策略的执行、用户面功能(user plane function，UPF)的选择、UE的互联网协议(internet protocol，IP)地址分配等功能。
AMF 1031具有接入和移动性管理功能，主要进行移动性管理、接入鉴权/授权等功能。此外，还负责在UE与PCF间传递用户策略。
UPF 1032为用户面功能实体，作为和数据网络的接口，完成用户面(UP)数据转发、基于会话/流级的计费统计，带宽限制等功能。
5G PKMF 1036为用户面功能实体，用于实现ProSe安全性管理等功能。在本公开实施例中，5G PKMF也可以被称为PKMF。
其中各接口功能描述如下：
N7：PCF 1034与SMF 1033之间的接口，用于下发分组数据单元(packet data unit，PDU)会话粒度以及业务数据流粒度的控制策略。
N3：UPF 1032与NG-RAN 101之间的通信接口。
N15：PCF 1034与AMF 1031之间的接口，用于下发UE策略及接入控制相关策略。
N4：SMF 1033与UPF 1032之间的接口，用于控制面与UP之间传递信息，包括控制面向UP的转发规则、QoS控制规则、流量统计规则等的下发以及UP的信息上报。
N11：SMF 1033与AMF 1031之间的接口，用于传递NG-RAN 101和UPF 1034之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给NG-RAN 101的无线资源控制信息等。
N2：AMF 1031与NG-RAN 101之间的接口，用于传递核心网侧至NG-RAN 101的无线承载控制信息等。
N8：AMF 1031与UDM 1035间的接口，用于AMF 1031向UDM 1035获取接入与移动性管理相关签约数据与鉴权数据，以及AMF 1031向UDM 1035注册UE当前移动性管理相关信息等。
N10：SMF 1033与UDM 1035间的接口，用于SMF 1033向UDM 1035获取会话管理相关签约数据，以及SMF 1033向UDM 1035注册UE当前会话相关信息等。
Nx：5G PKMF 1036与PCF 1034之间的接口。
上述用户设备可以是具有无线通信功能的设备。UE可以部署在陆地上，包括室内或室外、手持、可穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。上述UE可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端装置、增强现实(augmented reality，AR)终端装置、工业控制(industrial control)中的无线终端、无人驾驶(self-driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。UE也可以是具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备等。可选的，在不同的网络中UE还可以叫做不同的名称，例如：终端装置、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、5G网络或未来演进网络中的终端设备等。
上述接入网设备可以为接入网侧用于支持终端接入无线通信***的设备。例如，可以是5G接入技术通信***中的下一代基站(next generation NodeB，gNB)、发送接收点(transmission reception point，TRP)、中继节点(relay node)、接入点(access point，AP)等。
需要说明的是，在图1所示的通信***中，各设备的功能以及接口仅为示例性的，各个设备在应用于本公开实施例中时，并非全部功能都是必需的。核心网的全部或者部分设备可以是物理上的实体设备，也可以是虚拟化的设备，在此不做限定。当然，本公开实施例中的通信***还可以包括未在图1中示出的其他设备，在此不做限定。
当前，对于ProSe中继通信中的安全性，可以采用基于用户面的安全机制或者基于控制面的安全机制在终端设备和中继设备之间建立针对PC5接口的发现和通信的安全性。针对ProSe U2N中继服务，终端设备可以在基于用户面的安全机制和基于控制面的安全机制之间择一实施。在由PCF向终端设备(例如，remote UE)和中继设备(例如，relay UE)分别提供的ProSe U2N中继发现(ProSe U2N relay discovery)参数中包括了控制面安全指示符(control plane security indicator)。若控制面安全指示符针对一RSC，则该控制面安全指示符指示采用基于控制面的安全机制(或称为安全流程)。
在向终端设备和中继设备提供针对RSC的控制面安全指示符、并且终端设备和中继设备针对于控 制面安全指示符关联的RSC彼此发现的情况下，终端设备可能依然使用基于用户面的安全机制来通过PC5接口发送直接通信请求，或者接收到该直接通信请求的中继设备可能依然使用基于用户面的安全机制来建立针对中继服务的PC5通信安全行。在上述情况下，终端设备或者中继设备因为采用的安全机制不正确而进行错误操作。在相关技术中并没有提出对应的解决方案，能够验证终端设备和中继设备是否正确采用了为所请求的中继服务分配的安全机制。
为此，如何避免中继通信相关的终端设备和中继设备采用不合适的安全机制是一个亟待解决的问题。
为了解决上述问题，本公开实施例提供一种中继通信的安全机制校验方法。
图2为本公开实施例中的一种中继通信的安全机制校验方法的流程示意图。该方法可以应用于中继设备。如图2所示，上述方法包括S201至S204。
在S201，接收终端设备发送的第一请求消息。
其中，第一请求消息携带有第一信息，并且第一信息用于指示终端设备的中继服务对应的第一安全机制。
在一实施例中，第一请求消息可以是直连通信请求(direct communication request，DCR)消息。
在一实施例中，第一信息可以包括RSC以及第一安全机制对应的密钥参数。RSC是中继服务码，可以用于标识中继服务。第一安全机制对应的密钥参数可以是K NRP freshness parameter 1。
可以理解的是，RSC可以是终端设备在服务认证和信息提供流程中从终端设备关联的核心网功能(例如，PCF)获取的。在一示例中，在终端设备从核心网功能获取RSC的同时，还可以从核心网功能获取控制面安全指示符。控制面安全指示符可以是针对特定的RSC提供的，用于指示RSC对应的中继服务采用基于控制面的安全机制。
在一实施例中，第一信息还可以包括基于邻近服务远端用户密钥(ProSe remote user key，PRUK)标识信息，例如，PRUK ID。PRUK标识信息用于对邻近服务远端用户密钥进行标识。可以理解的是，PRUK标识信息可以由终端设备从终端设备关联的网络功能(例如，PKMF)获得。此外，终端设备还可以从网络功能获得PRUK标识信息所标识的PRUK。
在一实施例中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制。在一示例中，在终端设备获取到控制面安全指示符(即针对RSC提供有控制面安全指示符)的情况下，第一安全机制可以是基于控制面的安全机制。在一示例中，在终端设备没有获取到控制面安全指示符(即针对RSC并未提供控制面安全指示符)的情况下，第一安全机制可以是基于用户面的安全机制。
在实际应用中，第一信息中的至少部分信息可以用于指示终端设备的中继服务对应的第一安全机制。在一示例中，第一信息中第一安全机制对应的密钥参数可以单独用于指示第一安全机制为基于用户面的安全机制。在一示例中，第一信息中PRUK标识信息可以单独用于指示第一安全机制为基于用户面的安全机制。在一示例中，第一信息中第一安全机制对应的密钥参数以及PRUK标识信息可以共同用于指示第一安全机制为基于用户面的安全机制。
在S202，确定终端设备的中继服务对应的第二安全机制。
在一实施例中，第二安全机制可以为基于用户面的安全机制。具体地，S202中确定终端设备的中继服务对应的第二安全机制可以包括以下两个步骤。
在第一步骤中，接收中继设备关联的核心网功能发送的第二信息。
其中，第二信息用于指示中继服务和对应的安全机制。
可以理解的是，中继设备可以在服务认证和信息提供流程中从中继设备关联的核心网功能(例如，PCF)获取到第二信息。第二信息可以包括RSC。在一示例中，在终端设备从核心网功能获取RSC的同时，还可以从核心网功能获取控制面安全指示符。
在第二步骤中，根据第二信息，确定第二安全机制。
需要说明的是，第二安全机制可以理解为是中继设备针对中继服务采用的安全机制，也可以理解为是网络为中继服务配置的安全机制。网络向中继设备配置针对中继服务对应的安全机制，往往意味着中继设备针对中继服务会采用网络配置的安全机制。
在一实施例中，中继设备接收到的第二信息中并未包含控制面安全指示符，则中继设备确定RSC对应的第二安全机制为基于用户面的安全机制。在一示例中，中继设备接收到的第二信息包含有控制面安全指示符，但是中继设备可能依然确定RSC对应的第二安全机制为基于用户面的安全机制。
在S203，确定第一安全机制与第二安全机制是否匹配。
如上所述，在S201中确定了第一安全机制，并且在S202中确定的第二安全机制。之后，可以对第一安全机制和第二安全机制进行匹配。在一示例中，第一安全机制可以是基于控制面的安全机制，第二安全机制可以是基于用户面的安全机制，则可以确定第一安全机制和第二安全机制是不匹配的。在一示例中，第一安全机制可以是基于用户面的安全机制，第二安全机制可以是基于用户面的安全机制，则可以确定第一安全机制和第二安全机制是匹配的。通过以上匹配，能够得到第一安全机制与第二安全机制之间的匹配情况。
在S204，根据匹配情况，发送第二消息。
可以理解的是，根据匹配情况的不同，第二消息可以是不同的，并且第二消息的发送对象也可以是不同的。
在一示例中，在匹配情况为第一安全机制与第二安全机制不匹配的情况下，中继设备可以向终端设备发送第二消息。此时，第二消息可以用于指示拒绝第一请求消息。例如，第二消息可以是直连通信拒绝(direct communication reject)消息。
在一示例中，在匹配情况为第一安全机制与第二安全机制匹配的情况下，中继设备可以向网络功能发送第二消息。第二消息携带有第三信息。第三信息用于指示中继设备的中继服务对应的第二安全机制。例如，第二消息可以是密钥请求(key request)消息。
在实际应用中，第三信息可以包括第一信息中的全部或部分内容。例如，第三信息可以包括RSC以及第一安全机制对应的密钥参数。又例如，第三信息还可以包括PRUK标识信息。可以理解的是，因为中继设备已经确定第一安全机制与第二安全机制是匹配的，所以第三信息中的第一安全机制对应的密钥参数(以及可能的PRUK标识信息)虽然表示的是第一安全机制，但也间接地指示了中继设备的中继服务对应的第二安全机制。此外，在一实施例中，第三信息可以包括RSC以及第二安全机制对应的密钥参数。
在一实施例中，在确定第一安全机制与第二安全机制匹配并且中继设备向网络功能发送第二消息之 后，上述方法还可以包括：接收中继设备关联的网络功能发送的第三消息，第三消息用于指示中继设备关联的核心网功能的中继服务对应的第三安全机制与第二安全机制不匹配；根据第三消息，向终端设备发送第二消息，第二消息用于指示拒绝所述第一请求消息。
可以理解的是，在中继设备向网络功能发送第二消息之后，可以从网络功能接收到第三消息。第三消息可以指示第三安全机制与第二安全机制不匹配。在一示例中，第三消息还可以携带有导致第三安全机制与第二安全机制不匹配的失败原因(failure cause)。例如，失败原因可以是第二安全机制与第三安全机制不匹配，或者可以是其他更加具体的原因。
图3为本公开实施例中的另一种中继通信的安全机制校验方法的流程示意图。该方法可以应用于网络功能。如图3所示，上述方法包括S301至S304。
在S301，接收第三请求消息。
其中，第三请求消息携带有第四信息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制。
在一实施例中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数。在一实施例中，第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一实施例中，第三请求消息可以是密钥请求消息。
此外，网络功能可以是PKMF。在一实施例中，网络功能可以是中继设备关联的PKMF。在一实施例中，网络功能可以是终端设备关联的PKMF。另外，网络功能可以是位于核心网内的核心网功能，也可以是位于核心网外的非核心网功能。本公开实施例对此不做具体限定。
在S302，根据第四信息，向核心网功能发送第四请求消息。
其中，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制。
可以理解的是，核心网功能可以是PCF或者其他核心网功能。核心网功能的中继服务对应的第三安全机制是网络侧针对中继服务配置的安全机制。换言之，第三安全机制即为中继服务的RSC对应的安全机制。第三安全机制可以是基于用户面的安全机制，也可以是基于控制面的安全机制。
在S303，接收核心网功能发送的第五消息。
其中，第五消息用于指示第三安全机制。
网络功能在向核心网功能发送第四请求消息之后，可以接收到来自核心网功能的第五消息。
在S304，确定第一安全机制或第二安全机制与第三安全机制是否匹配。
网络设备可以根据第五消息，确定第一安全机制或第二安全机制与第三安全机制是否匹配。
在一实施例中，在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，网络功能可以发送第六消息。第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一实施例中，在确定第一安全机制或第二安全机制与第三安全机制匹配的情况下，网络功能可以继续后续的流程，例如，发送消息，或者进行下一步处理。
在实际应用中，网络功能可以是与终端设备关联的，也可以是与中继设备关联的；对应地，核心网功能可以是与终端设备关联的，也可以是与中继设备关联的。
在一实施例中，网络功能可以是与中继设备关联的PKMF，核心网功能可以是与中继设备关联的 PCF。在此情况下，对S301至S303进行具体说明。
对于S301，PKMF可以接收中继设备发送的第三请求消息。第三请求消息中的第四信息可以用于指示中继设备的中继服务对应的第二安全机制。可以理解的是，在此情况下，第三请求消息可以是上述由中继设备发送的第二消息。
对于S302，PKMF可以向PCF发送第四请求消息。第四请求消息用于请求PCF的中继服务对应的第三安全机制。
对于S303，PKMF可以接收PCF发送的第五消息。具体地，第五消息可以指示第三安全机制。
对于S304，PKMF可以确定第二安全机制与第三安全机制是否匹配。
此外，在第二安全机制与第三安全机制不匹配的情况下，PKMF可以向中继设备发送第六消息。第六消息用于指示第二安全机制与第三安全机制不匹配。在一实施例中，第六消息可以是密钥响应(key response)消息。在一实施例中，第六消息还可以携带有失败原因。例如，失败原因可以是第二安全机制与第三安全机制不匹配，或者可以是其他更加具体的原因。
在一实施例中，网络功能可以是与终端设备关联的PKMF，核心网功能可以是与中继设备关联的PCF。在此情况下，对S301至S303进行具体说明。
对于S301，PKMF可以接收中继设备关联的PKMF发送的第三请求消息。第三请求消息中的第四信息可以用于指示终端设备的中继服务对应的第一安全机制。可以理解的是，在此情况下，第三请求消息可以是上述由中继设备关联的PKMF发送的请求消息，例如，密钥请求消息。
对于S302，PKMF可以向PCF发送第四请求消息。第四请求消息用于请求PCF的中继服务对应的第三安全机制。
对于S303，PKMF可以接收PCF发送的第五消息。具体地，第五消息可以指示第三安全机制。
对于S304，PKMF可以确定第一安全机制与第三安全机制是否匹配。
此外，在第一安全机制与第三安全机制不匹配的情况下，PKMF可以向与终端设备关联的PKMF发送第六消息。第六消息用于指示第一安全机制与第三安全机制不匹配。在一实施例中，第六消息可以是密钥响应消息。在一实施例中，第六消息还可以携带有失败原因。例如，失败原因可以是第一安全机制与第三安全机制不匹配，或者可以是其他更加具体的原因。
图4为本公开实施例中的又一种中继通信的安全机制校验方法的流程示意图。该方法可以应用于核心网功能。如图4所示，上述方法包括S401至S402。
在S401，接收网络功能发送的第四请求消息。
其中，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制。
需要说明的是，核心网功能可以是PCF。在一实施例中，核心网功能可以是中继设备关联的PCF。在一实施例中，核心网功能可以是中继设备关联的PCF。需要说明的是，核心网功能还可以是其他核心网功能，本公开实施例对此不做具体限定。
此外，网络功能可以是PKMF。在一实施例中，网络功能可以是中继设备关联的PKMF。在一实施例中，网络功能可以是中继设备关联的PKMF。需要说明的是，网络功能还可以是其他网络功能，本公开实施例对此不做具体限定。
在S402，响应于第四请求消息，向网络功能发送第五消息。
其中，第五消息用于指示第三安全机制。
具体地，响应于第四请求消息，核心网功能将匹配情况携带在第五消息中发送给网络功能。
需要说明的是，在S401至S403中，由核心网功能确定第一安全机制或第二安全机制与核心网功能的中继服务对应的第三安全机制是否匹配。然而，核心网功能也可以不确定第一安全机制或第二安全机制与核心网功能的中继服务对应的第三安全机制是否匹配，而是仅仅将第三安全机制通过第五消息发送给网络功能，以供网络功能确定第一安全机制或第二安全机制与核心网功能的中继服务对应的第三安全机制是否匹配。
在本公开实施例中，一方面对终端设备的中继服务对应的安全机制进行验证，另一方面对中继设备的中继服务对应的安全机制进行验证，从而实现对中继通信的安全机制的验证，确保了进行中继通信的终端设备和中继设备采用正确配置的安全机制。
为了促进对本公开实施例中的技术方案的理解，以下结合具体实施例对中继通信的安全机制校验方法进行说明。图5为本公开实施例中的中继服务的安全机制的校验流程的实施流程示意图。本公开实施例中的中继通信的安全机制校验方法适用在该中继服务流程中。
在图5所示的实施例中，终端设备可以是远端UE，中继设备可以是U2N中继，与中继设备关联的网络功能可以是第一PKMF，与中继设备关联的核心网功能可以是第一PCF，与终端设备关联的网络功能可以是第二PKMF，并且与终端设备关联的核心网功能可以是第二PCF。
如图5所示，中继服务流程可以包括S501至S516。
在S501，远端UE获取发现安全资料。
其中，远端UE可以通过PC8接口(或称为PC8参考点)第二PKMF建立安全连接。
可以理解的是，为了建立安全连接，远端UE可以在服务认证和信息提供流程中从第二PCF获取第二PKMF的地址、以及发现参数。发现参数可以包括RSC，并且还可以包括控制面安全指示符。
在一实施例中，控制面安全指示符可以是第二PCF为中继服务配置的，并且用于指示针对中继服务采用基于控制面的安全机制。
在一实施例中，远端UE还可以从第二PKMF获取发现安全资料(discovery security materials)。
在S502，U2N中继获取发现安全资料。
其中，U2N中继可以通过PC8接口(或称为PC8参考点)第一PKMF建立安全连接。
可以理解的是，为了建立安全连接，U2N中继可以在服务认证和信息提供流程中从第一PCF获取第一PKMF的地址、以及发现参数。发现参数可以包括RSC，并且还可以包括控制面安全指示符。
在一实施例中，控制面安全指示符可以是第一PCF为中继服务配置的，并且用于指示针对中继服务采用基于控制面的安全机制。
在S503，远端UE向第二PKMF发送PRUK请求消息。
其中，PRUK请求消息用于向第二PKMF请求PRUK。
在一实施例中，在远端UE已经具有来自第二PKMF的PRUK的情况下，PRUK请求消息可以携带有该PRUK的PRUK ID。
在S504，远端UE接收第二PKMF发送的PRUK响应消息。
其中，第二PKMF校验远端UE是否被授权接收U2N中继服务。在确定远端UE得到授权的情况下，第二PKMF向远端UE发送PRUK响应消息。PRUK响应消息中携带有PRUK和PRUK ID。
在S505，远端UE与U2N中继进行发现流程。
其中，远端UE与U2N中继可以基于发现参数和发现安全资料进行发现流程。
在S506中，远端UE向U2N中继发送DCR消息。
其中，DCR消息(也可以称为第一请求消息)用于请求提供直接通信。
在一实施例中，DCR消息可以携带有RSC以及远端UE的中继服务的安全机制(也可以称为第一安全机制)的密钥参数(即K NRP freshness parameter 1)。
在一实施例中，DCR消息还可以携带有PRUK ID。在一实施例中，DCR消息还可以携带有SUCI(subscription concealed identifier，订阅隐私标识符)。
在S507，U2N中继校验安全机制。
其中，U2N中继对远端UE对中继服务采用的安全机制与U2N中继对中继服务采用的安全机制(也可以称为第二安全机制)进行匹配，从而实现安全机制的校验。
可以理解的是，在一方面，U2N中继确定自身对中继服务采用的安全机制。在一实施例中，在U2N中继确定与接收到的RSC关联的控制面安全指示符并基于该控制面安全指示符配置的情况下，该安全机制是基于控制面的安全机制。在一实施例中，在U2N中继并未接收到与RSC关联的控制面安全指示符的情况下，该安全机制是基于用户面的安全机制。
在另一方面，U2N中继确定远端UE对中继服务采用的安全机制。该安全机制可以是基于控制面的安全机制或者基于用户面的安全机制。在一实施例中，在S506中U2N中继接收到DCR消息之后，在DCR包括PRUK ID和/或密钥参数的情况下，U2N中继可以确定远端UE通过基于用户面的安全流程发起DCR。在此情况下，U2N中继可以确定远端UE对中继服务采用的安全机制为基于用户面的安全机制。否则，U2N中继可以确定远端UE对中继服务采用的安全机制为基于控制面的安全机制。
之后，U2N中继将远端UE对中继服务采用的安全机制与U2N中继对中继服务采用的安全机制进行匹配。
需要说明的是，S507中U2N中继对于安全机制的校验并不是必需的。在一些情况下，在S506之后，U2N可以不进行安全机制的校验，而是直接执行S508。
在S508，U2N中继向第一PKMF发送密钥请求消息。
其中，在S507中确定匹配情况为匹配的情况下，U2N中继可以向第一PKMF发送密钥请求消息(也可以称为第二消息，或第三请求消息)。密钥请求消息用于请求与安全机制对应的密钥参数。
在一实施例中，密钥请求消息可以携带有PRUK ID或SUCI、RSC、远端UE的中继服务的安全机制的密钥参数。
在S509，U2N中继向远端UE发送直连通信拒绝消息。
其中，在S507中确定匹配情况为不匹配的情况下，U2N中继可以向远端UE发送直连通信拒绝消息(也可以称为第二消息)。直连通信拒绝消息用于指示拒绝DCR消息。
在S510，第一PKMF与第一PCF校验安全机制。
其中，第一PKMF可以与第一PCF进行交互，以实现对安全机制的校验。可以理解的是，第一PCF本地存储有中继服务的RSC对应的安全机制。在一实施例中，第一PKMF与第一PCF校验安全机制可以通过以下方式实现：第一PKMF可以向第一PCF发送请求消息(也可以称为第四请求消息)。该请求消息用于请求第一PCF的中继服务对应的安全机制(也可以称为第三安全机制)。第一PCF在接收到该请求消息之后，可以将U2N中继的中继服务对应的安全机制通过响应消息(也可以称为第五消息)发送给第一PKMF。第一PKMF在接收到响应消息之后，将其中携带的安全机制与U2N中继的中继服务对应的安全机制进行匹配。如此，第一PKMF能够确认U2N中继的中继服务对应的安全机制与第一PCF的中继服务对应的安全机制之间的匹配情况。
在一实施例中，第一PKMF向第一PCF发送的请求消息可以携带有中继服务的RSC，以便于第一PCF在本地确定该中继服务的RSC对应的安全机制(即为该RSC分配的安全机制)。
在S511，第一PKMF向第二PKMF发送密钥请求消息。
其中，在S510中的匹配情况为匹配的情况下，第一PKMF向第二PKMF发送密钥请求消息。
在一实施例中，密钥请求消息可以携带有PRUK ID或SUCI、RSC、远端UE的中继服务的安全机制的密钥参数。
在S512，第一PKMF向U2N中继发送密钥响应消息。
其中，在S510中的匹配情况为不匹配的情况下，第一PKMF向U2N中继发送密钥响应消息(也可以称为第六消息)。密钥响应消息用于指示拒绝来自U2N中继的密钥请求消息。
在一实施例中，密钥请求消息可以携带有失败原因。
在S513，U2N中继向远端UE发送直连通信拒绝消息。
其中，在S512中接收到密钥响应消息之后，U2N中继根据密钥响应消息向远端UE发送直连通信拒绝消息(也可以称为第二消息)。
在S514，第二PKMF与第二PCF校验安全机制。
其中，第二PKMF可以与第二PCF进行交互，以实现对安全机制的校验。可以理解的是，第二PCF本地存储有中继服务的RSC对应的安全机制。在一实施例中，第二PKMF与第二PCF校验安全机制可以通过以下方式实现：第二PKMF可以向第二PCF发送请求消息(也可以称为第四请求消息)。该请求消息用于请求第二PCF的中继服务对应的安全机制(也可以称为第三安全机制)。第二PCF在接收到该请求消息之后，可以将远端UE的中继服务对应的安全机制通过响应消息(也可以称为第五消息)发送给第二PKMF。第二PKMF在接收到响应消息之后，将其中携带的安全机制与远端UE的中继服务对应的安全机制进行匹配。如此，第一PKMF能够确认远端UE的中继服务对应的安全机制与第二PCF的中继服务对应的安全机制之间的匹配情况。
在一实施例中，第二PKMF向第二PCF发送的请求消息可以携带有中继服务的RSC，以便于第二PCF在本地确定该中继服务的RSC对应的安全机制(即为该RSC分配的安全机制)。
在S515，第二PKMF向第一PKMF发送密钥响应消息。
其中，在S514中的匹配情况为不匹配的情况下，第二PKMF向第一PKMF发送密钥响应消息(也 可以称为第六消息)。密钥响应消息用于指示拒绝来自U2N中继的密钥请求消息。
在一实施例中，密钥请求消息可以携带有失败原因。
在S516，第一PKMF向U2N中继发送密钥响应消息。
其中，在S517中接收到来自第二PKMF的密钥响应消息之后，第一PKMF向U2N中继发送密钥响应消息。密钥响应消息用于指示拒绝来自U2N中继的密钥请求消息。
在一实施例中，密钥请求消息可以携带有失败原因。
在S517，U2N中继向远端UE发送直连通信拒绝消息。
其中，在S512中接收到密钥响应消息之后，U2N中继根据密钥响应消息向远端UE发送直连通信拒绝消息(也可以称为第二消息)。
需要说明的是，S514至S517是可以选的。换言之，在一些情况下，在S511中从第一PKMF接收到密钥请求消息之后，可以直接执行S518，而不需要第二PKMF进行安全机制的验证。
在S518，第二PKMF向第一PKMF发送密钥响应消息。
其中，在S510中的匹配情况为匹配的情况下，第二PKMF向第一PKMF发送密钥响应消息。
在一实施例中，密钥响应消息可以携带有密钥参数。例如，密钥参数可以包括K NRP和/或K NRP freshness parameter 2。
在S519，第一PKMF向U2N中继发送密钥响应消息。
其中，在S518中接收到来自第二PKMF的密钥响应消息之后，第一PKMF向U2N中继发送密钥响应消息。
在一实施例中，密钥响应消息可以携带有密钥参数。例如，密钥参数可以包括K NRP和/或K NRP freshness parameter 2。
在S520，U2N中继向远端UE发送直连安全机制命令。
其中，直连安全机制命令中携带有K NRP freshness parameter 2。
在S521，远端UE对U2N中继进行验证。
其中，在S520中接收到直连安全机制命令(direct security mode command)之后，远端UE至少基于本地的PRUK、RSC、K NRP freshness parameter 1以及从直连安全机制命令中获得的K NRP freshness parameter 1，对直连安全机制命令进行验证，从而确保U2N中继被授权用于提供中继服务。
在S522，远端UE向U2N中继发送直连安全机制完成消息。
其中，针对接收到的直连安全机制命令，远端UE向U2N中继发送直连安全机制完成消息(direct security mode complete)。
在S523，U2N中继对远端UE进行验证。
其中，在S522中接收到直连安全机制完成消息之后，U2N中继对直连安全机制完成消息进行验证，以确保远端UE被授权使用中继服务。
在S524，U2N中继向远端UE发送直连通信接受消息。
其中，在S523中完成验证之后，U2N确认远端UE被授权使用中继服务，并向远端UE发送直连通信接受(direct communication accept)消息。
至此，图5所示的中继服务的安全机制的校验流程完成。
基于相同的发明构思，本公开实施例还提供一种中继通信的安全机制校验装置。该装置可以设置在以上所述的中继设备侧或网络功能侧，或者其中的芯片或者片上***，还可以为其中用于实现上述各个实施例所述的方法的功能模块。该装置可以实现上述各实施例中的中继设备或者网络功能功能所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。图6为本公开实施例中的一种中继通信的安全机制校验装置的结构示意图。如图6所示，该装置600可以包括：接收装置610、处理装置620、以及发送装置630。
在一实施例中，图6所示的中继通信的安全机制校验装置可以设置在中继设备。接收装置610配置为接收终端设备发送的第一请求消息，第一请求消息携带有第一信息，第一信息用于指示终端设备的中继服务对应的第一安全机制。处理装置620配置为确定中继设备的中继服务对应的第二安全机制，以及确定第一安全机制与第二安全机制是否匹配。发送装置630配置为根据匹配情况，发送第二消息。
在一些可能的实施方式中，第一信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第二安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，接收模块610可以配置为：接收中继设备关联的核心网功能发送的第二信息，第二信息用于指示中继服务和对应的安全机制；处理模块620可以配置为：根据第二信息，确定第二安全机制。
在一些可能的实施方式中，发送模块630可以配置为：在确定第一安全机制与第二安全机制不匹配的情况下，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在一些可能的实施方式中，发送模块630可以配置为：在确定第一安全机制与第二安全机制匹配的情况下，向中继设备关联的网络功能发送第二消息，第二消息携带有第三信息，第三信息用于指示中继设备的中继服务对应的第二安全机制。
在一些可能的实施方式中，第三信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，接收模块610还可以配置为：接收中继设备关联的网络功能发送的第三消息，第三消息用于指示中继设备关联的核心网功能的中继服务对应的第三安全机制与第二安全机制不匹配；发送模块630还可以配置为：根据第三消息，向终端设备发送第二消息，第二消息用于指示拒绝第一请求消息。
在一实施例中，图6所示的中继通信的安全机制校验装置可以设置在网络功能。接收模块610配置为接收第三请求消息，第三请求消息携带有第四信息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制。发送模块630配置为根据第四信息，向核心网功能发送第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制。接收模块610还配置为：接收核心网功能发送的第五消息，第五消息用于指示第三安全机制。处理模块620配置为确定第一安全机制或第二安全机制与第三安全机制是否匹配。
在一些可能的实施方式中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数，或第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，发送模块620还可以配置为：在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，发送第六消息，第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
基于相同的发明构思，本公开实施例还提供一种中继通信的安全机制校验装置。该装置可以设置在以上所述的核心网功能，或者其中的芯片或者片上***，还可以为其中用于实现上述各个实施例所述的方法的功能模块。该装置可以实现上述各实施例中核心网功能所执行的功能，这些功能可以通过硬件执行相应的软件实现。这些硬件或软件包括一个或多个上述功能相应的模块。图7为本公开实施例中的一种中继通信的安全机制校验装置的结构示意图。如图7所示，该装置可以包括：接收装置710、以及发送装置720。
在一实施例中，图7所示的中继通信的安全机制校验装置可以设置在核心网功能。接收装置710配置为接收网络功能发送的第四请求消息，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制。发送装置620配置为响应于第四请求消息，向网络功能发送第五消息，第五消息用于指示第三安全机制。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
需要说明的是，接收模块、处理模块和发送模块的具体实现过程可参考图2至图6对应实施例的详细描述，为了说明书的简洁，这里不再赘述。
本公开实施例中提到的接收模块可以为接收接口、接收电路或者接收器等；发送模块可以为发送接口、发送电路或者发送器等；处理模块可以为一个或者多个处理器。
基于相同的发明构思，本公开实施例还提供一种通信***。该通信***包括网络功能和核心网功能。网络功能配置为：根据第四信息，向核心网功能发送第四请求消息，第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的中继服务对应的第二安全机制，第四请求消息用于请求核心网功能的中继服务对应的第三安全机制；确定第一安全机制或第二安全机制与第三安全机制是否匹配。核心 网功能配置为：根据第四请求消息，向网络功能发送第五消息，第五消息用于指示第三安全机制。
在一些可能的实施方式中，网络功能还可以配置为：接收第三请求消息，第三请求消息携带有第四信息。
在一些可能的实施方式中，第四信息可以包括中继服务的RSC以及第一安全机制对应的密钥参数，或第四信息可以包括中继服务的RSC以及第二安全机制对应的密钥参数。
在一些可能的实施方式中，第四请求消息可以携带有中继服务的RSC。
在一些可能的实施方式中，第一安全机制可以为基于控制面的安全机制或基于用户面的安全机制，第三安全机制可以为基于用户面的安全机制。
在一些可能的实施方式中，网络功能还可以配置为：在确定第一安全机制或第二安全机制与第三安全机制不匹配的情况下，发送第六消息，第六消息用于指示第一安全机制或第二安全机制与第三安全机制不匹配。
在一些可能的实施方式中，网络功能可以为中继设备关联的PKMF，核心网功能可以为中继设备关联的PCF。
在一些可能的实施方式中，网络功能可以为终端设备关联的PKMF，核心网功能可以为终端设备关联的PCF。
基于相同的发明构思，本公开实施例提供一种电子设备，该电子设备可以为上述一个或者多个实施例中所述的中继设备、网络功能、或者核心网功能。图8为本公开实施例中的一种电子设备的结构示意图。如图8所示，电子设备800，采用了通用的计算机硬件，包括处理器801、存储器802、总线803、输入设备804和输出设备805。
在一些可能的实施方式中，存储器802可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器802可以存储操作***、应用程序、其他程序模块、可执行代码、程序数据、用户数据等。
输入设备804可以用于向电子设备输入命令和信息，输入设备804如键盘或指向设备，如鼠标、轨迹球、触摸板、麦克风、操纵杆、游戏垫、***天线、扫描仪或类似设备。这些输入设备可以通过总线803连接至处理器801。
输出设备805可以用于电子设备输出信息，除了监视器之外，输出设备805还可以为其他***输出设各，如扬声器和/或打印设备，这些输出设备也可以通过总线803连接到处理器801。
电子设备可以通过天线806连接到网络中，例如连接到局域网(local area network，LAN)。在联网环境下，控制备中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当电子设备800中的处理器801执行存储器802中存储的可执行代码或应用程序时，电子设备以执行以上实施例中的中继设备侧、网络功能侧、或者核心网功能侧的中继通信的安全机制校验方法，具体执行过程参见上述实施例，在此不再赘述。
此外，上述存储器802中存储有用于实现图6中的接收模块610、处理模块620和发送模块630的功能的计算机执行指令。图6中的接收模块610、处理模块620和发送模块630的功能/实现过程均可以通过图8中的处理器801调用存储器802中存储的计算机执行指令来实现，具体实现过程和功能参考上 述相关实施例。
此外，上述存储器802中存储有用于实现图7中的接收模块710和发送模块720的功能的计算机执行指令。图7中的接收模块710和发送模块720的功能/实现过程均可以通过图8中的处理器801调用存储器802中存储的计算机执行指令来实现，具体实现过程和功能参考上述相关实施例。
基于相同的发明构思，本公开实施例提供一种终端设备，该终端设备与上述一个或者多个实施例中的终端设备一致。可选的，终端设备可以为移动电话，计算机，数字广播终端，消息收发设备，游戏控制台，平板设备，医疗设备，健身设备，个人数字助理等。
图9为本公开实施例中的一种终端设备的结构示意图。如图9所示，终端设备900可以包括以下一个或多个组件：处理组件901、存储器902、电源组件903、多媒体组件904、音频组件905、输入/输出(I/O)的接口906、传感器组件907以及通信组件908。
处理组件901通常控制终端设备900的整体操作，诸如与显示，电话呼叫，数据通信，相机操作和记录操作相关联的操作。处理组件901可以包括一个或多个处理器910来执行指令，以完成上述的方法的全部或部分步骤。此外，处理组件901可以包括一个或多个模块，便于处理组件901和其他组件之间的交互。例如，处理组件901可以包括多媒体模块，以方便多媒体组件904和处理组件901之间的交互。
存储器902被配置为存储各种类型的数据以支持在设备900的操作。这些数据的示例包括用于在终端设备900上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器902可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
电源组件903为终端设备900的各种组件提供电力。电源组件903可以包括电源管理***，一个或多个电源，及其他与为终端设备900生成、管理和分配电力相关联的组件。
多媒体组件904包括在终端设备900和用户之间的提供一个输出接口的屏幕。在一些实施例中，屏幕可以包括液晶显示器(LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与触摸或滑动操作相关的持续时间和压力。在一些实施例中，多媒体组件904包括一个前置摄像头和/或后置摄像头。当设备900处于操作模式，如拍摄模式或视频模式时，前置摄像头和/或后置摄像头可以接收外部的多媒体数据。每个前置摄像头和后置摄像头可以是一个固定的光学透镜***或具有焦距和光学变焦能力。
音频组件905被配置为输出和/或输入音频信号。例如，音频组件905包括一个麦克风(MIC)，当终端设备900处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器902或经由通信组件908发送。在一些实施例中，音频组件905还包括一个扬声器，用于输出音频信号。
I/O接口906为处理组件901和***接口模块之间提供接口，上述***接口模块可以是键盘，点击轮，按钮等。这些按钮可包括但不限于：主页按钮、音量按钮、启动按钮和锁定按钮。
传感器组件907包括一个或多个传感器，用于为终端设备900提供各个方面的状态评估。例如，传 感器组件907可以检测到设备900的打开/关闭状态，组件的相对定位，例如组件为终端设备900的显示器和小键盘，传感器组件907还可以检测终端设备900或终端设备900一个组件的位置改变，用户与终端设备900接触的存在或不存在，终端设备900方位或加速/减速和终端设备900的温度变化。传感器组件907可以包括接近传感器，被配置用来在没有任何的物理接触时检测附近物体的存在。传感器组件907还可以包括光传感器，如CMOS或CCD图像传感器，用于在成像应用中使用。在一些实施例中，该传感器组件907还可以包括加速度传感器，陀螺仪传感器，磁传感器，压力传感器或温度传感器。
通信组件908被配置为便于终端设备900和其他设备之间有线或无线方式的通信。终端设备900可以接入基于通信标准的无线网络，如Wi-Fi，2G或3G或4G或5G或未来演进版本，或它们的组合。在一个示例性实施例中，通信组件908经由广播信道接收来自外部广播管理***的广播信号或广播相关信息。在一个示例性实施例中，通信组件908还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在示例性实施例中，终端设备900可以被一个或多个应用专用集成电路(ASIC)、数字信号处理器(DSP)、数字信号处理设备(DSPD)、可编程逻辑器件(PLD)、现场可编程门阵列(FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述方法。
基于相同的发明构思，本公开实施例还提供一种计算机可读存储介质，计算机可读存储介质中存储有指令；当指令在计算机上运行时，用于执行上述一个或者多个实施例中的中继设备侧、网络功能侧或者核心网功能侧的中继通信的安全机制校验方法。
基于相同的发明构思，本公开实施例还提供一种计算机程序或计算机程序产品，当计算机程序产品在计算机上被执行时，使得计算机实现上述一个或者多个实施例中的中继设备侧、网络功能侧或者核心网功能侧的中继通信的安全机制校验方法。
本领域技术人员在考虑说明书及实践本公开后，将容易想到本公开的其它实施方案。本公开旨在涵盖本发明的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开中未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (26)

  1. 一种中继通信的安全机制校验方法，应用于中继设备，并且包括：
    接收终端设备发送的第一请求消息，所述第一请求消息携带有第一信息，所述第一信息用于指示所述终端设备的中继服务对应的第一安全机制；
    确定与所述中继设备的所述中继服务对应的第二安全机制；
    确定所述第一安全机制与所述第二安全机制是否匹配；
    根据匹配情况，发送第二消息。
  2. 根据权利要求1所述的方法，其中，所述第一信息包括所述中继服务的中继服务代码RSC以及所述第一安全机制对应的密钥参数。
  3. 根据权利要求1所述的方法，其中，所述第一安全机制为基于控制面的安全机制或基于用户面的安全机制，所述第二安全机制为基于用户面的安全机制。
  4. 根据权利要求1所述的方法，其中，所述确定所述中继设备的所述中继服务对应的第二安全机制，包括：
    接收所述中继设备关联的核心网功能发送的第二信息，所述第二信息用于指示所述中继服务和对应的安全机制；
    根据所述第二信息，确定所述第二安全机制。
  5. 根据权利要求1所述的方法，其中，所述根据匹配情况，发送第二消息，包括：
    在确定所述第一安全机制与所述第二安全机制不匹配的情况下，向所述终端设备发送所述第二消息，所述第二消息用于指示拒绝所述第一请求消息。
  6. 根据权利要求1所述的方法，其中，所述根据所述匹配情况，发送第二消息包括：
    在确定所述第一安全机制与所述第二安全机制匹配的情况下，向所述中继设备关联的网络功能发送所述第二消息，所述第二消息携带有第三信息，所述第三信息用于指示所述中继设备的所述中继服务对应的第二安全机制。
  7. 根据权利要求6所述的方法，其中，所述第三信息包括所述中继服务的中继服务代码RSC以及所述第二安全机制对应的密钥参数。
  8. 根据权利要求6所述的方法，其中，在所述向第一网络功能发送第二消息之后，所述方法还包括：
    接收所述中继设备关联的网络功能发送的第三消息，所述第三消息用于指示所述中继设备关联的核心网功能中所述中继服务对应的第三安全机制与所述第二安全机制不匹配；
    根据所述第三消息，向所述终端设备发送所述第二消息，所述第二消息用于指示拒绝所述第一请求消息。
  9. 一种中继通信的安全机制校验方法，应用于网络功能，并且包括：
    接收第三请求消息，所述第三请求消息携带有第四信息，所述第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的所述中继服务对应的第二安全机制；
    根据所述第四信息，向核心网功能发送第四请求消息，所述第四请求消息用于请求所述核心网功能 中所述中继服务对应的第三安全机制；
    接收所述核心网功能发送的第五消息，所述第五消息用于指示所述第三安全机制；
    确定所述第一安全机制或所述第二安全机制与所述第三安全机制是否匹配。
  10. 根据权利要求9所述的方法，其中，所述第四信息包括所述中继服务的中继服务代码RSC以及所述第一安全机制对应的密钥参数，或所述第四信息包括所述中继服务的RSC以及所述第二安全机制对应的密钥参数。
  11. 根据权利要求9所述的方法，其中，所述第四请求消息携带有所述中继服务的RSC。
  12. 根据权利要求9所述的方法，其中，所述第一安全机制为基于控制面的安全机制或基于用户面的安全机制，所述第三安全机制为基于用户面的安全机制。
  13. 根据权利要求9所述的方法，其中，所述方法还包括：
    在确定所述第一安全机制或所述第二安全机制与所述第三安全机制不匹配的情况下，发送第六消息，所述第六消息用于指示所述第一安全机制或所述第二安全机制与所述第三安全机制不匹配。
  14. 根据权利要求9所述的方法，其中，所述网络功能为所述中继设备关联的基于邻近服务密钥管理功能PKMF，所述核心网功能为所述中继设备关联的策略控制功能PCF。
  15. 根据权利要求9所述的方法，其中，所述网络功能为所述终端设备关联的PKMF，所述核心网功能为所述终端设备关联的PCF。
  16. 一种中继通信的安全机制校验方法，应用于核心网功能，并且包括：
    接收网络功能发送的第四请求消息，所述第四请求消息用于请求所述核心网功能的中继服务对应的第三安全机制；
    响应于所述第四请求消息，向所述网络功能发送第五消息，所述第五消息用于指示所述第三安全机制。
  17. 根据权利要求16所述的方法，其中，所述第四请求消息携带有所述中继服务的中继服务代码RSC。
  18. 根据权利要求16所述的方法，其中，所述第三安全机制为基于用户面的安全机制。
  19. 根据权利要求16所述的方法，其中，所述网络功能为所述中继设备关联的PKMF，所述核心网功能为所述中继设备关联的PCF。
  20. 根据权利要求16所述的方法，其中，所述网络功能为所述终端设备关联的PKMF，所述核心网功能为所述终端设备关联的PCF。
  21. 一种中继通信的安全机制校验装置，设置于中继设备，并且包括：
    接收模块，配置为接收终端设备发送的第一请求消息，所述第一请求消息携带有第一信息，所述第一信息用于指示所述终端设备的中继服务对应的第一安全机制；
    处理模块，配置为确定所述中继设备的所述中继服务对应的第二安全机制，确定所述第一安全机制与所述第二安全机制是否匹配；
    发送模块，配置为根据匹配情况，发送第二消息。
  22. 一种中继通信的安全机制校验装置，设置于网络功能，并且包括：
    接收模块，配置为接收第三请求消息，所述第三请求消息携带有第四信息，所述第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的所述中继服务对应的第二安全机制；
    发送模块，配置为根据所述第四信息，向核心网功能发送第四请求消息，所述第四请求消息用于请求所述核心网功能中所述中继服务对应的第三安全机制；
    其中，所述接收模块还配置为：接收所述核心网功能发送的第五消息，所述第五消息用于指示所述第三安全机制；
    处理模块，配置为确定所述第一安全机制或所述第二安全机制与所述第三安全机制是否匹配。
  23. 一种中继通信的安全机制校验装置，设置于核心网功能，并且包括：
    接收模块，配置为接收网络功能发送的第四请求消息，所述第四请求消息用于请求所述核心网功能的中继服务对应的第三安全机制；
    发送模块，配置为向所述网络功能发送第五消息，所述第五消息用于指示所述第三安全机制。
  24. 一种通信***，包括：
    网络功能，配置为：
    根据第四信息，向核心网功能发送第四请求消息，所述第四信息用于指示终端设备的中继服务对应的第一安全机制或中继设备的所述中继服务对应的第二安全机制，所述第四请求消息用于请求所述核心网功能中所述中继服务对应的第三安全机制；
    确定所述第一安全机制或所述第二安全机制与所述第三安全机制是否匹配；
    核心网功能，配置为：
    响应于所述第四请求消息，向所述网络功能发送第五消息，所述第五消息用于指示所述第三安全机制。
  25. 一种终端设备，包括：存储器；处理器，与所述存储器连接，被配置为执行存储在所述存储器上的计算机可执行指令，以实现如权利要求1至20中任一项所述的方法。
  26. 一种计算机存储介质，其中，所述计算机存储介质存储有计算机可执行指令，所述计算机可执行指令被处理器执行后能够实现如权利要求1至20中任一项所述的方法。
PCT/CN2022/112327 2022-08-12 2022-08-12 中继通信的安全机制校验方法和装置、设备及存储介质 WO2024031725A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280003147.9A CN117882410A (zh) 2022-08-12 2022-08-12 中继通信的安全机制校验方法和装置、设备及存储介质
PCT/CN2022/112327 WO2024031725A1 (zh) 2022-08-12 2022-08-12 中继通信的安全机制校验方法和装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/112327 WO2024031725A1 (zh) 2022-08-12 2022-08-12 中继通信的安全机制校验方法和装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2024031725A1 true WO2024031725A1 (zh) 2024-02-15

Family

ID=89850341

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/112327 WO2024031725A1 (zh) 2022-08-12 2022-08-12 中继通信的安全机制校验方法和装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN117882410A (zh)
WO (1) WO2024031725A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113133085A (zh) * 2019-12-30 2021-07-16 华为技术有限公司 建立连接和获取中继服务代码的方法和通信装置
US20210345104A1 (en) * 2020-05-01 2021-11-04 Qualcomm Incorporated Relay sidelink communications for secure link establishment
WO2022038292A1 (en) * 2020-08-21 2022-02-24 Koninklijke Philips N.V. Privacy of relay selection in cellular sliced networks
US20220109996A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113133085A (zh) * 2019-12-30 2021-07-16 华为技术有限公司 建立连接和获取中继服务代码的方法和通信装置
US20210345104A1 (en) * 2020-05-01 2021-11-04 Qualcomm Incorporated Relay sidelink communications for secure link establishment
WO2022038292A1 (en) * 2020-08-21 2022-02-24 Koninklijke Philips N.V. Privacy of relay selection in cellular sliced networks
US20220109996A1 (en) * 2020-10-01 2022-04-07 Qualcomm Incorporated Secure communication link establishment for a ue-to-ue relay

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
QUALCOMM INCORPORATED: "KI#3: New sol: Secure PC5 link establishment for L3 UE-to-NW relay", 3GPP DRAFT; S2-2007683, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. E (e-meeting); 20201012 - 20201023, 2 October 2020 (2020-10-02), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051938713 *

Also Published As

Publication number Publication date
CN117882410A (zh) 2024-04-12

Similar Documents

Publication Publication Date Title
WO2021026824A1 (zh) 非活动定时器的控制方法和装置
WO2023240573A1 (zh) 信道状态信息的处理方法、装置及通信设备
WO2024031704A1 (zh) 回传链路的波束指示方法、装置及存储介质
JP2022533071A (ja) モニタリング方法、シグナリング下り送信方法及び装置、通信機器及び記憶媒体
WO2021012281A1 (zh) 唤醒信号的变更处理、监听方法、通信设备及存储介质
WO2022120854A1 (zh) 信息传输方法、装置、通信设备和存储介质
WO2023272458A1 (zh) 基于终端间辅助机制的资源选择方法、装置及存储介质
US20140176658A1 (en) Communication method, communication terminal, supervisor terminal and related computer programmes
WO2024031725A1 (zh) 中继通信的安全机制校验方法和装置、设备及存储介质
WO2022110057A1 (zh) 无线传输的方法、装置、通信设备及存储介质
WO2022011541A1 (zh) 随机接入方法及装置、通信设备及存储介质
WO2022047804A1 (zh) 时间间隙请求方法和装置、时间间隙配置方法和装置
WO2022000203A1 (zh) 接入控制方法及装置、存储介质
WO2023206549A1 (zh) 一种中继通信方法、通信装置及通信设备
WO2023000137A1 (zh) 一种通信方法、装置及设备
WO2023240575A1 (zh) 一种中继通信方法、通信装置及通信设备
WO2023225863A1 (zh) 一种提供感知服务的方法、装置、设备以及存储介质
WO2024031458A1 (zh) 资源配置方法、装置、存储介质以及终端
WO2023216257A1 (zh) 信号覆盖信息确定方法、装置、通信设备和存储介质
WO2024055317A1 (zh) 一种侧链路通信方法、装置及通信设备
WO2024026689A1 (zh) 提供无线感知服务的方法和装置、电子设备和存储介质
WO2023004655A1 (zh) 一种通信方法、装置、用户设备、基站、核心网设备及存储介质
WO2024031399A1 (zh) Ue加入pin的方法及装置、通信设备及存储介质
WO2023070685A1 (zh) 中继通信的方法、装置、通信设备及存储介质
WO2024020755A1 (zh) 无线通信方法、装置、通信设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280003147.9

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22954675

Country of ref document: EP

Kind code of ref document: A1