[go: up one dir, main page]

CN103297961A - Device and system used for device-to-device secure communication - Google Patents

Device and system used for device-to-device secure communication Download PDF

Info

Publication number
CN103297961A
CN103297961A CN2012100557711A CN201210055771A CN103297961A CN 103297961 A CN103297961 A CN 103297961A CN 2012100557711 A CN2012100557711 A CN 2012100557711A CN 201210055771 A CN201210055771 A CN 201210055771A CN 103297961 A CN103297961 A CN 103297961A
Authority
CN
China
Prior art keywords
subscriber equipment
equipment
message
security configuration
configuration message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN2012100557711A
Other languages
Chinese (zh)
Other versions
CN103297961B (en
Inventor
韩锋
郑武
沈钢
王伟
刘铮
庞继勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nokia Shanghai Bell Co Ltd
Original Assignee
Alcatel Lucent Shanghai Bell Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alcatel Lucent Shanghai Bell Co Ltd filed Critical Alcatel Lucent Shanghai Bell Co Ltd
Priority to CN201210055771.1A priority Critical patent/CN103297961B/en
Publication of CN103297961A publication Critical patent/CN103297961A/en
Application granted granted Critical
Publication of CN103297961B publication Critical patent/CN103297961B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Landscapes

  • Mobile Radio Communication Systems (AREA)

Abstract

The invention provides a device and system used for device-to-device secure communication. According to the device and system used for device-to-device secure communication, a first user device determines a second user device to directly communicate with the first user device, a first network device generates secure configuration information of device-to-device communication for the first user device and the second user device which plan to carry out direct communication, and sends the secure configuration information to the first user device and the second user device, and the first user device and the second user device establish direct communication according to the secure configuration information. Compared with the prior art, the device and system used for device-to-device secure communication put emphasis on the secure feature of D2D communication. Besides, due to the fact that device used for the D2D communication can simultaneously support communication via an access link and a D2D link, the secure design of the D2D link does not affect the security of the access link. By means of the secure scheme, the device and system used for device-to-device secure communication can protect data flows from being received by a third party, and enables a receiving party to detect inserting and replacement of data groups.

Description

A kind of equipment and system for safety communication between devices
Technical field
The present invention relates to wireless communication technology field, relate in particular to a kind of technology for safety communication between devices.
Background technology
(device-to-device communications, D2D), its target is can realize direct communication between two nearby device as the communication between devices of bottom architecture with the based mobile communication facility.The pattern of this equipment room direct communication has huge commercial promise.
In traditional cellular network, need set up the safety of the wave point between base station and the user, as connecting under the scenes such as foundation, residential quarter switching or connection reconstruction, safe key (security key) is generated by base station and subscriber equipment respectively.Yet, under the D2D communication pattern, carry out in communication process, needing to keep between the equipment of D2D communication the safety of D2D communication via wave point, and traditional cellular network does not need.Further, there is multiple D2D application scenarios in D2D communication, and this makes that the safety design of D2D communication is more complicated.
Therefore, for the D2D communication scenes of based mobile communication facility as bottom architecture, for designing effective security mechanism, it is very important.
Summary of the invention
The purpose of this invention is to provide a kind of equipment for safety communication between devices and system.
According to an aspect of the present invention, provide a kind of first subscriber equipment for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, wherein, this first subscriber equipment comprises:
Straight-through equipment is determined device, is used for determining to treat to carry out with it second subscriber equipment of direct communication;
The security message deriving means is for the first security configuration message of obtaining from the network equipment about direct communication between described first subscriber equipment and described second subscriber equipment;
The direct communication apparatus for establishing is used for according to the described first security configuration message, sets up direct communication with described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of trunking for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this trunking comprises:
Straight-through request retransmission unit is used for receiving the straight-through request of equipment that first subscriber equipment sends, and transmits the straight-through request of described equipment treats to carry out with it direct communication to described first subscriber equipment second subscriber equipment;
The user data retransmission unit is used for transmitting the user data that transmits between described first subscriber equipment and described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of first network equipment for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first network equipment comprises:
The security message generating apparatus is used for being respectively first subscriber equipment of plan direct communication and the first security configuration message and the second security configuration message that second subscriber equipment generates communication between devices;
The security message dispensing device is used for the described first security configuration message is sent to described first subscriber equipment, and the described second security configuration message is sent to described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of second network equipment for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second network equipment comprises:
Security message obtains device, be used for holding consultation with first network equipment, think the second security configuration message of intending obtaining with second subscriber equipment of the first subscriber equipment direct communication communication between devices, wherein, described first subscriber equipment is corresponding with described first network equipment;
The security message dispensing device is used for the described second security configuration message is sent to described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of first base station, wherein, this first base station comprises as described above first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility.
According to an aspect of the present invention, also provide a kind of second base station, wherein, this first base station comprises as described above second network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility.
According to an aspect of the present invention, a kind of system for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies also is provided, wherein, this system comprises as described above first subscriber equipment that is used for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, and first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility as described above.
Compared with prior art, the present invention focuses on the security feature of D2D communication.And, can support simultaneously via the communicating by letter of access link and D2D link, so the safety design of D2D link can not exerted an influence to the safety of access link owing to be used for the equipment of D2D communication.Safety approach among the present invention can not received by the third party by protected data stream, and makes the recipient can detect insertion and the replacement of packet.
Description of drawings
By reading the detailed description of doing with reference to the following drawings that non-limiting example is done, it is more obvious that other features, objects and advantages of the present invention will become:
Fig. 1 illustrates one group of exemplary D2D communications applications scene according to the present invention;
Fig. 2 illustrates the exemplary D2D communications applications scene of another group according to the present invention;
Fig. 3 illustrates D2D communication scheme in accordance with a preferred embodiment of the present invention;
Fig. 4 illustrates D2D communicating devices schematic diagram in accordance with a preferred embodiment of the present invention;
Fig. 5 illustrates the D2D communication scheme according to another preferred embodiment of the present invention;
Fig. 6 illustrates the D2D communicating devices schematic diagram according to another preferred embodiment of the present invention;
Fig. 7 illustrates the D2D communication scheme of another preferred embodiment according to the present invention;
Fig. 8 illustrates the D2D communicating devices schematic diagram of another preferred embodiment according to the present invention;
Fig. 9 illustrates the D2D communication scheme of another preferred embodiment according to the present invention;
Figure 10 illustrates the D2D communicating devices schematic diagram of another preferred embodiment according to the present invention.
Same or analogous Reference numeral represents same or analogous parts in the accompanying drawing.
Embodiment
Below in conjunction with accompanying drawing the present invention is described in further detail.
In order to support the safety function of D2D communication, introduce a kind of logic entity among the present invention, be secure entity (security entity), it is at the cordless communication network based on the based mobile communication facility, such as LTE (Long Term Evolution, Long Term Evolution) network, IMT-Advanced network, WiMAX (Worldwide Interoperability for Microwave Access, worldwide interoperability for microwave inserts) network etc. are carried out D2D communication security function.This secure entity is independent of security architecture and the operating process of traditional Access Network and core net, the former is as E-UTRAN (evolved universal terrestrial radio access network, the general continental rise wireless access network of evolution), EPC in the latter such as the LTE system (Evolved Packet Core, the block core of evolution).This secure entity can be installed on the base station, or other network equipments in the aforementioned cordless communication network, as addressable other network elements in base station in the LTE system.
Herein; for convenience; be installed on the base station elaboration of giving an example with secure entity; yet; those skilled in the art will be understood that; these only are example for example, should not be regarded as any restriction to protection scope of the present invention, and other equipment that can comprise this secure entity existing or that may occur in the future all belong to protection scope of the present invention.For example, when secure entity is installed in the LTE system addressable other network elements in base station, the base station is according to the D2D communication event between the equipment, send the request of D2D security configuration to this network element, this network element claimed apparatus secure entity wherein generates corresponding security configuration message, and be sent to the base station, be transmitted to the equipment of pending D2D communication by the base station.
Among the present invention, for the equipment that carries out D2D communication as bottom architecture with the based mobile communication facility, it should connect with the base station on the one hand, peer device (peer device) communication that should communicate by letter with pending D2D on the other hand.In this article, preceding a kind of communication link is called as access link, and a kind of communication link in back is called as the D2D link.In order to support between two equipment, even the safety of D2D link between a plurality of equipment, following principle will be suitable for.
1) equipment that is used for D2D communication should be supported communicating by letter via access link and D2D link simultaneously.Therefore, the safety design to the D2D link should not exert an influence to the safety of access link.
2) general two functions of realization that require of safety design: encrypt and integrity protection.Encryption is not received by the third party for the protection of data flow, and the integrity protection of control signaling makes the recipient can detect insertion and the replacement of packet.Direct transmitting data stream between the D2D communicating requirement neighbouring device (proximate devices) is so should primarily support encryption function in the D2D link.If the D2D link needs high-rise control signaling, to support encryption and the integrity protection of control signaling.
3) being used for the equipment of D2D communication can be simultaneously can carry out the peer device that D2D communicates by letter with a plurality of other and communicate.Safe design should have certain control signaling, communicates to connect to identify each D2D.
Below will specifically describe with the safety approach of based mobile communication facility as the D2D communication of bottom architecture.Particularly, determine intending carrying out when the base station between the subscriber equipment of D2D communication can direct communication, and this base station requires secure entity to generate the D2D safe key.Afterwards, this base station is carried out the subscriber equipment generation of D2D communication and is distributed corresponding security configuration message for intending.According to this security configuration message, these subscriber equipmenies can be carried out at the D2D link and encrypt and the integrity protection function.Safety approach of the present invention comprises the aspect of two keys: the distribution of the generation of security configuration message and security configuration message.
I. the generation of security configuration message
Based on mentioned above principle 1), for the safe key that the D2D link generates should be different with the safe key of access link.Otherwise an equipment just may receive other equipment via the access link data flow transmitted.The safe key of D2D link is generated by the secure entity of base station side.
Based on mentioned above principle 2), secure entity need generate different safe keys, to be respectively applied to encryption and integrity protection.For example, a safe key is used for the integrity protection of D2D control signaling, and a safe key is used for the encryption of D2D control signaling, and a safe key is used for the encryption of user data.Corresponding cryptographic algorithm and protection algorithm integrallty are also included within the security configuration message.
Based on mentioned above principle 3), also comprise the D2D identification information in the security configuration message, to be used in each the D2D communication of a plurality of D2D link signs.At this, the D2D identification information can have multiple implementation.For example, as a kind of simple implementation, can adopt the identification information of the peer device that carries out D2D communication as the identification information of its D2D communication.The identification information of peer device can obtain in the discovery stage of neighbouring device.
At this, basic security configuration message can comprise following content:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
For example, in the LTE/LTE-A system, RRC (Radio Resource Control, radio resource control) connects to reshuffle for adjusting RRC and connects.At this, RRC connects reconfiguration message and is expanded to comprise the security configuration message of communicating by letter for D2D.RRC after this expansion connects reconfiguration message, is sent to equipment by the base station, and it adopts this equipment to be encrypted and integrity protection at the safe key of access link.Below illustrate and be included in the example that RRC connects the security configuration message in the reconfiguration message.
Figure BDA0000140751760000061
Need to prove; those skilled in the art will be understood that; above-mentioned LTE/LTE-A system only is example; be used for explanation of the present invention one concrete applicable network; it should not be regarded as any restriction to protection scope of the present invention; as the WiMAX system etc., other existing or may occur in the future go for system of the present invention and/or network all belongs to protection scope of the present invention.
II. the distribution of security configuration message
Fig. 1 shows the application scenarios that multiple D2D communicates by letter with Fig. 2.As shown in Figure 1, the subscriber equipment 11 in same residential quarter and subscriber equipment 12 direct communication mutually are in subscriber equipment 13 and the also direct communication mutually of subscriber equipment 14 of two neighbor cells respectively.In addition, D2D communication also can be auxiliary via relaying, comprises the situation that single relaying is auxiliary and a plurality of relayings are auxiliary, and for example, as shown in Figure 2, subscriber equipment 17 is communicated by letter to carry out D2D via trunking 18 relayings with subscriber equipment 19.
Based on D2D communication scenes illustrated in figures 1 and 2, below will specifically describe the basic process of the security configuration message distribution of control Network Based.
As shown in Figure 1, being in subscriber equipment 11 and the subscriber equipment 12 of base station 21 coverages mutually can direct communication.Fig. 3 illustrates the direct communication process between an exemplary subscriber equipment 11 and the subscriber equipment 12.The D2D communication event of determining between subscriber equipment 11 and the subscriber equipment 12 when base station 21, as the notification message of base station 21 by the D2D communication this time of one of them user equipment to report, determine this D2D communication event, this base station 21 is sent to each subscriber equipment with D2D security configuration message.Afterwards, each subscriber equipment returns the security configuration response message to this base station 21.Set up direct communication between subscriber equipment 11 and the subscriber equipment 12.At this, the security configuration message 1 that is sent to subscriber equipment 11 can be identical with the security configuration message 2 that is sent to subscriber equipment 12, also can be different.For example, the encryption key in the security configuration message 1 that is sent to subscriber equipment 11 and the security configuration message 2 that is sent to subscriber equipment 12 and cryptographic algorithm, integrity protection key are identical with protection algorithm integrallty.
As shown in Figure 4, subscriber equipment 11 comprises that straight-through equipment determines device 111, security message deriving means 112, direct communication apparatus for establishing 113; Subscriber equipment 12 comprises that straight-through equipment determines device 121, security message deriving means 122 and direct communication apparatus for establishing 123; Base station 21 comprises security message generating apparatus 211 and security message dispensing device 212.
Particularly, by the D2D discovery procedure, send Beacon frame or Preamble frame as subscriber equipment 12, subscriber equipment 11 detects this Beacon frame or Preamble frame, the straight-through equipment of subscriber equipment 11 determines that device 111 determines to treat to carry out with it the subscriber equipment 12 of direct communication, and the straight-through equipment of subscriber equipment 12 determines that device 121 determines to treat to carry out with it the subscriber equipment 11 of direct communication.
Subsequently, the security message deriving means 112 of subscriber equipment 11 to the base station 21 notification messages that send about direct communication between subscriber equipment 11 and the subscriber equipment 12; The security message generating apparatus 211 of base station 21 is respectively the security configuration message 1 and security configuration message 2 of subscriber equipment 11 with the subscriber equipment 12 generation communication between devices of plan direct communication according to this notification message.
Then, the security message dispensing device 212 of base station 21 is sent to subscriber equipment 11 and subscriber equipment 12 respectively with security configuration message 1 and security configuration message 2; The security message deriving means 112 of subscriber equipment 11 receives its corresponding security configuration message 1, and the security message deriving means 122 of subscriber equipment 12 receives its corresponding security configuration message 2.
At this, the D2D security configuration message 1 that is sent to subscriber equipment 11 should adopt subscriber equipment 11 to be encrypted and integrity protection at the safe key of access link.Similarly, the D2D security configuration message 2 that is sent to subscriber equipment 12 also should adopt subscriber equipment 12 to be encrypted and integrity protection at the safe key of access link.
Subsequently, the direct communication apparatus for establishing 113 of subscriber equipment 11 and the direct communication apparatus for establishing 123 of subscriber equipment 12 be respectively according to the security configuration message that receives 1 and security configuration message 2, and method, apparatus set up direct communication.
Still consult Fig. 1, be in the subscriber equipment 13 of base station 21 coverages and be in the subscriber equipment 14 of base station 22 coverages can be mutually between direct communication.
Fig. 5 illustrates the direct communication process between an exemplary subscriber equipment 13 and the subscriber equipment 14.Can carry out direct communication in case subscriber equipment 13 and subscriber equipment 14 identify both by the D2D discovery procedure, the identification information of base stations 22 under subscriber equipment its peer user devices 14 of base station 21 reports under 13 to its is as cell ID.
Based on the report of subscriber equipment 13, the negotiations process of security configuration message is carried out with base station 22 in base station 21.Afterwards, base station 21 is sent to subscriber equipment 13 with security configuration message 3, comprises D2D identification information, encryption key and cryptographic algorithm, integrity protection key and protection algorithm integrallty in the security configuration message 3.At this, the D2D security configuration message 3 that is sent to subscriber equipment 13 should adopt subscriber equipment 13 to be encrypted and integrity protection at the safe key of access link.Similarly, the base station 22 D2D security configuration message 4 that is sent to subscriber equipment 14 also should adopt subscriber equipment 14 to be encrypted and integrity protection at the safe key of access link.
Based on the D2D security configuration message 3 and the security configuration message 4 that receive, subscriber equipment 13 is communicated by letter with the D2D that subscriber equipment 14 is set up safety respectively.
As shown in Figure 6, subscriber equipment 13 comprises that straight-through equipment determines device 131, security message deriving means 132 and direct communication apparatus for establishing 133; Subscriber equipment 14 comprises that straight-through equipment determines device 141, security message deriving means 142 and direct communication apparatus for establishing 143; Base station 21 comprises security message generating apparatus 211 and security message dispensing device 212; Base station 22 comprises that security message obtains device 221 and security message dispensing device 222.
Particularly, by the D2D discovery procedure, the straight-through equipment of subscriber equipment 13 determines that device 131 determines to treat to carry out with it the subscriber equipment 14 of direct communication, and the straight-through equipment of subscriber equipment 14 determines that device 141 determines to treat to carry out with it the subscriber equipment 13 of direct communication.
Subsequently, the security message deriving means 132 of subscriber equipment 13 is 21 notification messages that send about direct communication between subscriber equipment 13 and the subscriber equipment 14 to the base station, comprise the identification information of subscriber equipment 14 in this notification message; According to this notification message, the security message generating apparatus 211 of base station 21 determines that subscriber equipment 14 corresponding base stations are base station 22, and obtain device 221 with the security message of base station 22 and hold consultation, to be respectively security configuration message 3 and the security configuration message 4 of subscriber equipment 13 and subscriber equipment 14 generation communication between devices, and security configuration message 4 is sent to base station 22, after being handled by it, be sent to subscriber equipment 14.
Then, the security message dispensing device 212 of base station 21 is encrypted and integrity protection D2D security configuration message 3 according to the safe key of subscriber equipment 13 at access link, and the security configuration message 3 after handling is sent to subscriber equipment 13; Similarly, the security message dispensing device 222 of base station 22 is encrypted and integrity protection D2D security configuration message according to the safe key of subscriber equipment 14 at access link, and the security configuration message 4 after handling is sent to subscriber equipment 14.
Subsequently, the direct communication apparatus for establishing 133 of subscriber equipment 13 and the direct communication apparatus for establishing 143 of subscriber equipment 14 be respectively according to the security configuration message 3 that receives and security configuration message 4, and method, apparatus set up direct communication.
Fig. 2 illustrates the D2D communication that strengthens through relaying, and wherein subscriber equipment 15 temporarily is in outside the coverage of base station 23, and still can communicate with base station 23 via the relaying of subscriber equipment 16.
Fig. 7 shows the detailed process of the D2D communication that strengthens through relaying from the angle of subscriber equipment 15.At this, subscriber equipment 16 and base station 23 are labeled as K6 at the safe key that access link uses, subscriber equipment 15 and base station 23 are labeled as K5 at the safe key that access link uses.After base station 23 determines that subscriber equipmenies 15 and subscriber equipment 16 mutually can direct communications, for example, subscriber equipment 15 and subscriber equipment 16 identify both by the D2D discovery procedure can carry out direct communication, the notification message of subscriber equipment 16 this D2D communication of 23 transmissions to the base station, base station 23 is determined this D2D communication event accordingly, base station 23 is sent to subscriber equipment 16 with the security configuration message 5 of subscriber equipment 15, to be forwarded to subscriber equipment 15 by it.This security configuration message 5 adopts K5 to be encrypted and integrity protection earlier, adopts K6 to be encrypted again and integrity protection.This security configuration message 5 is shown in the back: K6{K5{D2D security configuration message 5}}.
When subscriber equipment 16 receives this security configuration message 5, it at first is decrypted and integrity detection according to its safe key K6 at access link.When successful, subscriber equipment 16 is sent to subscriber equipment 15 with D2D security configuration message 5 with the form of K5{D2D security configuration message 5}.
When subscriber equipment 15 receives this security configuration message 5 that subscriber equipment 16 is transmitted, it is at first according to being decrypted and integrity detection at the safe key K5 of access link.When successful, subscriber equipment 15 obtains D2D security configuration message, and sends the security configuration response message to subscriber equipment 16.Afterwards, subscriber equipment 16 23 sends the security configuration response messages to the base station.
Simultaneously, base station 23 also adopts subscriber equipment 16 at the safe key K6 of access link, sends D2D security configuration message 6 to subscriber equipment 16.Subscriber equipment 16 is decrypted and integrity detection according to its safe key K6 at access link.When successful, subscriber equipment 16 obtains D2D security configuration message, and 23 sends the security configuration response messages to the base station.Based on the D2D security configuration information that receives, subscriber equipment 15 is communicated by letter with the D2D that subscriber equipment 16 is set up safety.
As shown in Figure 8, subscriber equipment 15 comprises that straight-through equipment determines device 151, security message deriving means 152, direct communication apparatus for establishing 153; Subscriber equipment 16 comprises that straight-through equipment determines device 161, security message deriving means 162 and direct communication apparatus for establishing 163; Base station 23 comprises security message generating apparatus 231 and security message dispensing device 232.
Particularly, by the D2D discovery procedure, the straight-through equipment of subscriber equipment 15 determines that device 151 determines to treat to carry out with it the subscriber equipment 16 of direct communication, and the straight-through equipment of subscriber equipment 16 determines that device 161 determines to treat to carry out with it the subscriber equipment 15 of direct communication.
Subsequently, the security message deriving means 162 of subscriber equipment 16 to the base station 23 notification messages that send about direct communication between subscriber equipment 15 and the subscriber equipment 16; The security message generating apparatus 231 of base station 23 is respectively security configuration message 5 and security configuration message 6 that subscriber equipment 15 and subscriber equipment 15 generate communication between devices according to this notification message.
Then, security message dispensing device 232 orders of base station 23 are encrypted and integrity protection D2D security configuration message 5 at the safe key of access link according to subscriber equipment 15 and subscriber equipment 16, security configuration message 5 after handling is sent to subscriber equipment 16, via subscriber equipment 16 D2D security configuration message 5 is sent to subscriber equipment 15; And the security message dispensing device 232 of base station 23 is encrypted and integrity protection D2D security configuration message 6 according to the safe key of subscriber equipment 16 at access link, and the security configuration message 6 after handling is sent to subscriber equipment 16.
Subsequently, the direct communication apparatus for establishing 153 of subscriber equipment 15 and the direct communication apparatus for establishing 163 of subscriber equipment 16 be respectively according to the security configuration message 5 that receives and security configuration message 6, and method, apparatus set up direct communication.
Fig. 2 illustrates the D2D communication that strengthens through relaying, and wherein subscriber equipment 17 and subscriber equipment 19 all are in the coverage of base station 23, and communicates by letter to carry out D2D via trunking 18 relayings.At this, trunking includes but not limited to any applicable to of the present invention, can be the equipment that relaying is carried out in D2D communication, as subscriber equipment.
Fig. 9 shows the detailed process that D2D that subscriber equipment 17 and subscriber equipment 19 strengthen through relaying communicates by letter.Subscriber equipment 17 carries out the forwarding of the straight-through request of equipment via trunking 18, thereby finds to treat to carry out with it the subscriber equipment 19 of direct communication.This D2D communication event is determined by the notification message of one of them user equipment to report D2D communication this time in base station 23, and this base station 23 is sent to each subscriber equipment with D2D security configuration message.Afterwards, each subscriber equipment returns the security configuration response message to this base station 23.Set up direct communication between subscriber equipment 17 and the subscriber equipment 19, and transmit user data waiting for transmission via trunking 18 for it.
As shown in figure 10, subscriber equipment 17 comprises that straight-through equipment determines device 171, security message deriving means 172, direct communication apparatus for establishing 173 and subscriber data transmission apparatus 174; Subscriber equipment 19 comprises that straight-through equipment determines device 191, security message deriving means 192, direct communication apparatus for establishing 193 and subscriber data transmission apparatus 194; Trunking 18 comprises straight-through request retransmission unit 181 and user data retransmission unit 182; Base station 23 comprises security message generating apparatus 231 and security message dispensing device 232.
Particularly, the straight-through equipment of subscriber equipment 17 determines that device 171 is sent to trunking 18 with the straight-through request of equipment, to indicate to this trunking 18 the straight-through request of this equipment is forwarded to the subscriber equipment 19 that subscriber equipment 17 treats to carry out with it direct communication; The straight-through request retransmission unit 181 of trunking 18 receives the straight-through request of equipment that subscriber equipmenies 17 send, and transmits that this equipment is straight-through asks to subscriber equipment 19; The straight-through equipment of subscriber equipment 19 determines that device 191 determines to treat to carry out with it the subscriber equipment 17 of direct communication accordingly.
Subsequently, the security message deriving means 192 of subscriber equipment 19 to the base station 23 notification messages that send about direct communication between subscriber equipment 17 and the subscriber equipment 19; The security message generating apparatus 231 of base station 23 is respectively the security configuration message 7 and security configuration message 9 of subscriber equipment 17 with the subscriber equipment 19 generation communication between devices of plan direct communication.
Then, the security message dispensing device 232 of base station 23 is sent to subscriber equipment 17 and subscriber equipment 19 respectively with security configuration message 7 and security configuration message 9; The security message deriving means 172 of subscriber equipment 17 and the security message deriving means 192 of subscriber equipment 19 receive its corresponding security configuration message 7 and security configuration message 9 respectively.
At this, the D2D security configuration message 7 that is sent to subscriber equipment 17 should adopt subscriber equipment 17 to be encrypted and integrity protection at the safe key of access link.Similarly, the D2D security configuration message 9 that is sent to subscriber equipment 19 also should adopt subscriber equipment 19 to be encrypted and integrity protection at the safe key of access link.
Subsequently, the direct communication apparatus for establishing 173 of subscriber equipment 17 and the direct communication apparatus for establishing 193 of subscriber equipment 19 be respectively according to the security configuration message that receives, and method, apparatus set up direct communication.
Then, the subscriber data transmission apparatus 174 of subscriber equipment 17 is sent to trunking 18 with user data waiting for transmission, to indicate it this user data is forwarded to subscriber equipment 19; The user data retransmission unit 182 of trunking 18 is transmitted the user data of transmission between subscriber equipment 17 and the subscriber equipment 19; It is the user data that subscriber equipment 17 is transmitted that the subscriber data transmission apparatus 194 of subscriber equipment 19 receives trunking 18.
The straight-through request retransmission unit of above-mentioned trunking and user data retransmission unit can also can be integrated into a functional module for two functional modules independently.Similarly, the direct communication apparatus for establishing of above-mentioned subscriber equipment and subscriber data transmission apparatus can also can be integrated into a functional module for two functional modules independently.
Need to prove, more than only to show via a trunking be the scheme that relaying is carried out in D2D communication, those skilled in the art are based on foregoing, should be able to know a plurality of trunkings can be that relaying is carried out in D2D communication by cooperation mode equally.Therefore, the D2D secure communication scheme of these cooperating relay also belongs to protection scope of the present invention.
Among the present invention, after D2D communication stops, secure entity will be regained the D2D safe key.
In addition, under the scene of residential quarter switching and connection reconstruction, cryptographic algorithm and integral algorithm, and the safe key of communicating by letter for D2D may change.The D2D secure communication scheme of control Network Based among the present invention goes for aforementioned scene equally.The present invention can work under TDD (Time Division Duplexing, time division duplex) and FDD (Frequency Division Duplexing, the Frequency Division Duplexing (FDD)) pattern, and special-purpose frequency spectrum and shared frequency spectrum.
It should be noted that the present invention can be implemented in the assembly of software and/or software and hardware, for example, can adopt application-specific integrated circuit (ASIC) (ASIC), general purpose computer or any other similar hardware device to realize.Software program of the present invention can carry out to realize function mentioned above by processor.Similarly, software program of the present invention (comprising relevant data structure) can be stored in the computer readable recording medium storing program for performing, for example, and RAM memory, magnetic or CD-ROM driver or floppy disc and similar devices.In addition, functions more of the present invention can adopt hardware to realize, for example, thereby as cooperate the circuit of carrying out each function with processor.
In addition, a part of the present invention can be applied to computer program, and for example computer program instructions when it is carried out by computer, by the operation of this computer, can call or provide according to technical scheme of the present invention.And call the program command of technical scheme of the present invention, may be stored in fixing or movably in the recording medium, and/or be transmitted by the data flow in broadcasting or other signal bearing medias, and/or be stored in the working storage according to the computer equipment of described program command operation.At this, comprise a device according to one embodiment of present invention, this device comprises for the memory of storage computer program instructions and is used for the processor of execution of program instructions, wherein, when this computer program instructions is carried out by this processor, trigger this device operation based on aforementioned technical scheme according to a plurality of embodiment of the present invention.
To those skilled in the art, obviously the invention is not restricted to the details of above-mentioned one exemplary embodiment, and under the situation that does not deviate from spirit of the present invention or essential characteristic, can realize the present invention with other concrete form.Therefore, no matter from which point, all should regard embodiment as exemplary, and be nonrestrictive, scope of the present invention is limited by claims rather than above-mentioned explanation, therefore is intended to be included in the present invention dropping on the implication that is equal to important document of claim and all changes in the scope.Any Reference numeral in the claim should be considered as limit related claim.In addition, obviously other unit or step do not got rid of in " comprising " word, and odd number is not got rid of plural number.A plurality of unit of stating in equipment and/or the claim or device also can be realized by software or hardware by a unit or device.The first, the second word such as grade is used for representing title, and does not represent any specific order.

Claims (15)

1. first subscriber equipment that is used for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, wherein, this first subscriber equipment comprises:
Straight-through equipment is determined device, is used for determining to treat to carry out with it second subscriber equipment of direct communication;
The security message deriving means is for the first security configuration message of obtaining from the network equipment about direct communication between described first subscriber equipment and described second subscriber equipment;
The direct communication apparatus for establishing is used for according to the described first security configuration message, sets up direct communication with described second subscriber equipment.
2. first subscriber equipment according to claim 1, wherein, described security message deriving means is used for:
-to the notification message of described network equipment transmission about direct communication between described first subscriber equipment and described second subscriber equipment;
-receive the described network equipment based on the described first security configuration message of described notification message transmission.
3. first subscriber equipment according to claim 1, wherein, described security message deriving means also is used for:
-obtain the second security configuration message about direct communication between described first subscriber equipment and described second subscriber equipment from the described network equipment;
-the described second security configuration message is forwarded to described second subscriber equipment.
4. first subscriber equipment according to claim 1, wherein, described straight-through equipment determines that device is used for:
-the straight-through request of equipment is sent to trunking, to indicate to it straight-through request of described equipment is forwarded to described second subscriber equipment;
Wherein, this first subscriber equipment also comprises:
Subscriber data transmission apparatus, be used for described second subscriber equipment set up communicate by letter after, user data waiting for transmission is sent to described trunking, to indicate it described user data is forwarded to described second subscriber equipment.
5. according to each described first subscriber equipment in the claim 1 to 4, wherein, the described first security configuration message comprise following at least each:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
6. trunking that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this trunking comprises:
Straight-through request retransmission unit is used for receiving the straight-through request of equipment that first subscriber equipment sends, and transmits the straight-through request of described equipment treats to carry out with it direct communication to described first subscriber equipment second subscriber equipment;
The user data retransmission unit is used for transmitting the user data that transmits between described first subscriber equipment and described second subscriber equipment.
7. first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first network equipment comprises:
The security message generating apparatus is used for being respectively first subscriber equipment of plan direct communication and the first security configuration message and the second security configuration message that second subscriber equipment generates communication between devices;
The security message dispensing device is used for the described first security configuration message is sent to described first subscriber equipment, and the described second security configuration message is sent to described second subscriber equipment.
8. first network equipment according to claim 7, wherein, described security message generating apparatus is used for:
-second network equipment corresponding with described second subscriber equipment held consultation, to generate the described first security configuration message and the described second security configuration message;
Wherein, the performed operation that the described second security configuration message is sent to described second subscriber equipment of described security message dispensing device comprises:
-the described second security configuration message is sent to described second subscriber equipment via described second network equipment.
9. first network equipment according to claim 7, wherein, the performed operation that the described second security configuration message is sent to described second subscriber equipment of described security message dispensing device comprises:
-the described second security configuration message is sent to described second subscriber equipment via described first subscriber equipment.
10. according to each described first network equipment in the claim 7 to 9, wherein, described security message generating apparatus is used for:
-according to the notification message about direct communication between described first subscriber equipment and described second subscriber equipment that described first subscriber equipment sends, be respectively described first subscriber equipment and described second subscriber equipment and generate the described first security configuration message and the described second security configuration message.
11. according to each described first network equipment in the claim 7 to 10, wherein, the described first security configuration message and the described second security configuration message comprise respectively following at least each:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
12. second network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second network equipment comprises:
Security message obtains device, be used for holding consultation with first network equipment, think the second security configuration message of intending obtaining with second subscriber equipment of the first subscriber equipment direct communication communication between devices, wherein, described first subscriber equipment is corresponding with described first network equipment;
The security message dispensing device is used for the described second security configuration message is sent to described second subscriber equipment.
13. first base station that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first base station comprises as each described first network equipment in the claim 7 to 11.
14. second base station that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second base station comprises second network equipment as claimed in claim 12.
15. system that is used for direct communication between based on the cordless communication network subscriber equipment of based mobile communication facility, wherein, this system comprises as each described first subscriber equipment in the claim 1 to 5 with as each described first network equipment in the claim 7 to 11.
CN201210055771.1A 2012-03-05 2012-03-05 A kind of equipment and system for safety communication between devices Active CN103297961B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201210055771.1A CN103297961B (en) 2012-03-05 2012-03-05 A kind of equipment and system for safety communication between devices

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201210055771.1A CN103297961B (en) 2012-03-05 2012-03-05 A kind of equipment and system for safety communication between devices

Publications (2)

Publication Number Publication Date
CN103297961A true CN103297961A (en) 2013-09-11
CN103297961B CN103297961B (en) 2018-03-09

Family

ID=49098145

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201210055771.1A Active CN103297961B (en) 2012-03-05 2012-03-05 A kind of equipment and system for safety communication between devices

Country Status (1)

Country Link
CN (1) CN103297961B (en)

Cited By (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016045083A1 (en) * 2014-09-26 2016-03-31 华为技术有限公司 Communication method and user device
WO2016062075A1 (en) * 2014-10-23 2016-04-28 中兴通讯股份有限公司 Method and device for managing device-to-device (d2d) communication group
CN105794147A (en) * 2013-09-27 2016-07-20 三星电子株式会社 Method and apparatus for securing discovery information
WO2016145864A1 (en) * 2015-08-25 2016-09-22 中兴通讯股份有限公司 Data transmission method and device
WO2016155018A1 (en) * 2015-04-03 2016-10-06 华为技术有限公司 Data transmission method, user equipment and base station
WO2016161764A1 (en) * 2015-04-09 2016-10-13 中兴通讯股份有限公司 Relay bearer control method and apparatus, and computer storage medium
WO2016169232A1 (en) * 2015-04-23 2016-10-27 中兴通讯股份有限公司 Authentication method, apparatus and system for d2d service multicast
CN106576241A (en) * 2014-10-31 2017-04-19 宇龙计算机通信科技(深圳)有限公司 Mic verification method in d2d communications and d2d communications system
WO2017088771A1 (en) * 2015-11-24 2017-06-01 Huawei Technologies Co., Ltd. Security for proxied devices
WO2017132965A1 (en) * 2016-02-04 2017-08-10 华为技术有限公司 Data transmission system, method, and device
WO2017181374A1 (en) * 2016-04-20 2017-10-26 Telefonaktiebolaget Lm Ericsson (Publ) UE-UE Configuration Framework w/o NW Support
CN107666667A (en) * 2016-07-29 2018-02-06 电信科学技术研究院 A kind of data transmission method, the first equipment and the second equipment
WO2018076798A1 (en) * 2016-10-31 2018-05-03 华为技术有限公司 Method and apparatus for transmitting data
US10382953B2 (en) 2014-04-30 2019-08-13 Zte Corporation Configuration method, ProSe key management functional entity, terminal, system, and storage medium
CN110366181A (en) * 2019-07-29 2019-10-22 努比亚技术有限公司 Data transmission method, system and computer readable storage medium
CN110381475A (en) * 2014-05-09 2019-10-25 创新技术实验室株式会社 Method, eNB and Tx UE about the D2D communication supported between UE
CN111405379A (en) * 2014-03-11 2020-07-10 耐瑞唯信有限公司 Method and system and storage medium for establishing a secure communication channel between devices
CN111935851A (en) * 2020-07-17 2020-11-13 广东以诺通讯有限公司 Communication method, WiFi access point and D2D terminal
CN111954318A (en) * 2020-07-20 2020-11-17 广东工贸职业技术学院 Equipment interconnection method, device and system
WO2021027435A1 (en) * 2019-08-09 2021-02-18 华为技术有限公司 Method and apparatus for determining security protection mode
CN112449323A (en) * 2019-08-14 2021-03-05 华为技术有限公司 Communication method, device and system
WO2023240575A1 (en) * 2022-06-16 2023-12-21 北京小米移动软件有限公司 Relay communication method, communication apparatus, and communication device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005359A (en) * 2006-01-18 2007-07-25 华为技术有限公司 Method and device for realizing safety communication between terminal devices
CN101986763A (en) * 2010-10-22 2011-03-16 浙江大学 Double battle mobile game method
WO2011056878A1 (en) * 2009-11-04 2011-05-12 Qualcomm Incorporated Method and apparatus for peer discovery in a wireless communication network

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005359A (en) * 2006-01-18 2007-07-25 华为技术有限公司 Method and device for realizing safety communication between terminal devices
WO2011056878A1 (en) * 2009-11-04 2011-05-12 Qualcomm Incorporated Method and apparatus for peer discovery in a wireless communication network
CN101986763A (en) * 2010-10-22 2011-03-16 浙江大学 Double battle mobile game method

Cited By (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10455415B2 (en) 2013-09-27 2019-10-22 Samsung Electronics Co., Ltd. Method for securing discovery information and device therefor
CN105794147A (en) * 2013-09-27 2016-07-20 三星电子株式会社 Method and apparatus for securing discovery information
US11163868B2 (en) 2013-09-27 2021-11-02 Samsung Electronics Co., Ltd. Method for securing discovery information and device therefor
US10638312B2 (en) 2013-09-27 2020-04-28 Samsung Electronics Co., Ltd. Method for securing discovery information and device therefor
CN111405379A (en) * 2014-03-11 2020-07-10 耐瑞唯信有限公司 Method and system and storage medium for establishing a secure communication channel between devices
US10382953B2 (en) 2014-04-30 2019-08-13 Zte Corporation Configuration method, ProSe key management functional entity, terminal, system, and storage medium
CN110381475B (en) * 2014-05-09 2022-10-14 思科系统公司 Method for supporting D2D communication between UEs, eNB and Tx UE
US11736233B2 (en) 2014-05-09 2023-08-22 Cisco Technology, Inc. Method and apparatus of scheduling for device to device (D2D) communication
CN110381475A (en) * 2014-05-09 2019-10-25 创新技术实验室株式会社 Method, eNB and Tx UE about the D2D communication supported between UE
US12212415B2 (en) 2014-05-09 2025-01-28 Cisco Technology, Inc. Method and apparatus of scheduling for device to device (D2D) communication
CN105637961A (en) * 2014-09-26 2016-06-01 华为技术有限公司 Communication method and user device
WO2016045083A1 (en) * 2014-09-26 2016-03-31 华为技术有限公司 Communication method and user device
WO2016062075A1 (en) * 2014-10-23 2016-04-28 中兴通讯股份有限公司 Method and device for managing device-to-device (d2d) communication group
CN106576241B (en) * 2014-10-31 2020-05-19 宇龙计算机通信科技(深圳)有限公司 Method for checking MIC in D2D communication and D2D communication system
CN106576241A (en) * 2014-10-31 2017-04-19 宇龙计算机通信科技(深圳)有限公司 Mic verification method in d2d communications and d2d communications system
WO2016155018A1 (en) * 2015-04-03 2016-10-06 华为技术有限公司 Data transmission method, user equipment and base station
WO2016161764A1 (en) * 2015-04-09 2016-10-13 中兴通讯股份有限公司 Relay bearer control method and apparatus, and computer storage medium
CN106162618A (en) * 2015-04-23 2016-11-23 中兴通讯股份有限公司 Authentication method, device and the system of a kind of D2D business multicast
WO2016169232A1 (en) * 2015-04-23 2016-10-27 中兴通讯股份有限公司 Authentication method, apparatus and system for d2d service multicast
WO2016145864A1 (en) * 2015-08-25 2016-09-22 中兴通讯股份有限公司 Data transmission method and device
WO2017088771A1 (en) * 2015-11-24 2017-06-01 Huawei Technologies Co., Ltd. Security for proxied devices
US10567964B2 (en) 2015-11-24 2020-02-18 Futurewei Technologies, Inc. Security for proxied devices
WO2017132965A1 (en) * 2016-02-04 2017-08-10 华为技术有限公司 Data transmission system, method, and device
US10660008B2 (en) 2016-02-04 2020-05-19 Huawei Technologies Co., Ltd. Data transmission system, method, and apparatus
WO2017181374A1 (en) * 2016-04-20 2017-10-26 Telefonaktiebolaget Lm Ericsson (Publ) UE-UE Configuration Framework w/o NW Support
US10609553B2 (en) 2016-07-29 2020-03-31 China Academy Of Telecommunications Technology Data transmission method, first device, and second device
CN107666667B (en) * 2016-07-29 2019-09-17 电信科学技术研究院 A kind of data transmission method, the first equipment and the second equipment
CN107666667A (en) * 2016-07-29 2018-02-06 电信科学技术研究院 A kind of data transmission method, the first equipment and the second equipment
WO2018076798A1 (en) * 2016-10-31 2018-05-03 华为技术有限公司 Method and apparatus for transmitting data
CN110366181A (en) * 2019-07-29 2019-10-22 努比亚技术有限公司 Data transmission method, system and computer readable storage medium
CN110366181B (en) * 2019-07-29 2024-02-13 努比亚技术有限公司 Data transmission method, system and computer readable storage medium
WO2021027435A1 (en) * 2019-08-09 2021-02-18 华为技术有限公司 Method and apparatus for determining security protection mode
US12335319B2 (en) 2019-08-09 2025-06-17 Huawei Technologies Co., Ltd. Method and apparatus for determining security protection mode
CN112449323A (en) * 2019-08-14 2021-03-05 华为技术有限公司 Communication method, device and system
CN112449323B (en) * 2019-08-14 2022-04-05 华为技术有限公司 Communication method, device and system
CN111935851A (en) * 2020-07-17 2020-11-13 广东以诺通讯有限公司 Communication method, WiFi access point and D2D terminal
CN111954318A (en) * 2020-07-20 2020-11-17 广东工贸职业技术学院 Equipment interconnection method, device and system
WO2023240575A1 (en) * 2022-06-16 2023-12-21 北京小米移动软件有限公司 Relay communication method, communication apparatus, and communication device

Also Published As

Publication number Publication date
CN103297961B (en) 2018-03-09

Similar Documents

Publication Publication Date Title
CN103297961A (en) Device and system used for device-to-device secure communication
US10735956B2 (en) Method and device for managing security according to service in wireless communication system
US11265704B2 (en) Security key generation for communications between base station and terminal based on beam selection
EP2309698B1 (en) Exchange of key material
CN105916140B (en) Secure Communication Method and Device for Carrier Aggregation Between Base Stations
JP7127689B2 (en) CORE NETWORK DEVICE, COMMUNICATION TERMINAL, AND COMMUNICATION METHOD
RU2017111083A (en) INTERACTION AND INTEGRATION OF VARIOUS RADIO ACCESS NETWORKS
CN105191250A (en) Systems and methods for secure high-speed link maintenance via nfc
WO2013116976A1 (en) A fast-accessing method and apparatus
US11722890B2 (en) Methods and systems for deriving cu-up security keys for disaggregated gNB architecture
CN102958052A (en) Secure data transmission method and related device
KR20200002506A (en) Apparatus and method for data communication in wireless communication system
KR20190117136A (en) Apparatus and method for security of information in wireless communication
KR20240125046A (en) Communication method and communication device
EP3813481B1 (en) Information transmission methods and system
EP3939366B9 (en) Dynamic and semi-persistent scheduling mixed multi-panel uplink precoding
EP4044760B1 (en) Connection resume methods and apparatuses
CN103905389A (en) Relay equipment-based security association, data transmission method, device and system
US20160301673A1 (en) Method for Realizing Secure Communications among Machine Type Communication Devices and Network Entity
CN104521261A (en) Method for enabling lawful interception in a telecommunications network, user equipment, base transceiver station, program and computer program product
WO2022253298A1 (en) Method and apparatus for transmitting system information
US20240214902A1 (en) Method and apparatus for reassignment of access and mobility management function in communication system
WO2023155721A1 (en) Method for detecting false base station, and apparatus
CN104219662A (en) Beacon frame transmitting method and device
KR102658615B1 (en) Method for ssp device to interoperate between bundle donwload procedure and profile donwload procedure

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information
CB02 Change of applicant information

Address after: 201206 ningqiao Road, Shanghai free trade test area, No. 388

Applicant after: Shanghai NOKIA Baer Limited by Share Ltd

Address before: 201206 Pudong New Area Jinqiao Ning Road, Shanghai, No. 388

Applicant before: Shanghai Alcatel-Lucent Co., Ltd.

GR01 Patent grant
GR01 Patent grant