CN103297961A - Device and system used for device-to-device secure communication - Google Patents
Device and system used for device-to-device secure communication Download PDFInfo
- Publication number
- CN103297961A CN103297961A CN2012100557711A CN201210055771A CN103297961A CN 103297961 A CN103297961 A CN 103297961A CN 2012100557711 A CN2012100557711 A CN 2012100557711A CN 201210055771 A CN201210055771 A CN 201210055771A CN 103297961 A CN103297961 A CN 103297961A
- Authority
- CN
- China
- Prior art keywords
- subscriber equipment
- equipment
- message
- security configuration
- configuration message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Mobile Radio Communication Systems (AREA)
Abstract
The invention provides a device and system used for device-to-device secure communication. According to the device and system used for device-to-device secure communication, a first user device determines a second user device to directly communicate with the first user device, a first network device generates secure configuration information of device-to-device communication for the first user device and the second user device which plan to carry out direct communication, and sends the secure configuration information to the first user device and the second user device, and the first user device and the second user device establish direct communication according to the secure configuration information. Compared with the prior art, the device and system used for device-to-device secure communication put emphasis on the secure feature of D2D communication. Besides, due to the fact that device used for the D2D communication can simultaneously support communication via an access link and a D2D link, the secure design of the D2D link does not affect the security of the access link. By means of the secure scheme, the device and system used for device-to-device secure communication can protect data flows from being received by a third party, and enables a receiving party to detect inserting and replacement of data groups.
Description
Technical field
The present invention relates to wireless communication technology field, relate in particular to a kind of technology for safety communication between devices.
Background technology
(device-to-device communications, D2D), its target is can realize direct communication between two nearby device as the communication between devices of bottom architecture with the based mobile communication facility.The pattern of this equipment room direct communication has huge commercial promise.
In traditional cellular network, need set up the safety of the wave point between base station and the user, as connecting under the scenes such as foundation, residential quarter switching or connection reconstruction, safe key (security key) is generated by base station and subscriber equipment respectively.Yet, under the D2D communication pattern, carry out in communication process, needing to keep between the equipment of D2D communication the safety of D2D communication via wave point, and traditional cellular network does not need.Further, there is multiple D2D application scenarios in D2D communication, and this makes that the safety design of D2D communication is more complicated.
Therefore, for the D2D communication scenes of based mobile communication facility as bottom architecture, for designing effective security mechanism, it is very important.
Summary of the invention
The purpose of this invention is to provide a kind of equipment for safety communication between devices and system.
According to an aspect of the present invention, provide a kind of first subscriber equipment for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, wherein, this first subscriber equipment comprises:
Straight-through equipment is determined device, is used for determining to treat to carry out with it second subscriber equipment of direct communication;
The security message deriving means is for the first security configuration message of obtaining from the network equipment about direct communication between described first subscriber equipment and described second subscriber equipment;
The direct communication apparatus for establishing is used for according to the described first security configuration message, sets up direct communication with described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of trunking for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this trunking comprises:
Straight-through request retransmission unit is used for receiving the straight-through request of equipment that first subscriber equipment sends, and transmits the straight-through request of described equipment treats to carry out with it direct communication to described first subscriber equipment second subscriber equipment;
The user data retransmission unit is used for transmitting the user data that transmits between described first subscriber equipment and described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of first network equipment for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first network equipment comprises:
The security message generating apparatus is used for being respectively first subscriber equipment of plan direct communication and the first security configuration message and the second security configuration message that second subscriber equipment generates communication between devices;
The security message dispensing device is used for the described first security configuration message is sent to described first subscriber equipment, and the described second security configuration message is sent to described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of second network equipment for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second network equipment comprises:
Security message obtains device, be used for holding consultation with first network equipment, think the second security configuration message of intending obtaining with second subscriber equipment of the first subscriber equipment direct communication communication between devices, wherein, described first subscriber equipment is corresponding with described first network equipment;
The security message dispensing device is used for the described second security configuration message is sent to described second subscriber equipment.
According to an aspect of the present invention, also provide a kind of first base station, wherein, this first base station comprises as described above first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility.
According to an aspect of the present invention, also provide a kind of second base station, wherein, this first base station comprises as described above second network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility.
According to an aspect of the present invention, a kind of system for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies also is provided, wherein, this system comprises as described above first subscriber equipment that is used for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, and first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility as described above.
Compared with prior art, the present invention focuses on the security feature of D2D communication.And, can support simultaneously via the communicating by letter of access link and D2D link, so the safety design of D2D link can not exerted an influence to the safety of access link owing to be used for the equipment of D2D communication.Safety approach among the present invention can not received by the third party by protected data stream, and makes the recipient can detect insertion and the replacement of packet.
Description of drawings
By reading the detailed description of doing with reference to the following drawings that non-limiting example is done, it is more obvious that other features, objects and advantages of the present invention will become:
Fig. 1 illustrates one group of exemplary D2D communications applications scene according to the present invention;
Fig. 2 illustrates the exemplary D2D communications applications scene of another group according to the present invention;
Fig. 3 illustrates D2D communication scheme in accordance with a preferred embodiment of the present invention;
Fig. 4 illustrates D2D communicating devices schematic diagram in accordance with a preferred embodiment of the present invention;
Fig. 5 illustrates the D2D communication scheme according to another preferred embodiment of the present invention;
Fig. 6 illustrates the D2D communicating devices schematic diagram according to another preferred embodiment of the present invention;
Fig. 7 illustrates the D2D communication scheme of another preferred embodiment according to the present invention;
Fig. 8 illustrates the D2D communicating devices schematic diagram of another preferred embodiment according to the present invention;
Fig. 9 illustrates the D2D communication scheme of another preferred embodiment according to the present invention;
Figure 10 illustrates the D2D communicating devices schematic diagram of another preferred embodiment according to the present invention.
Same or analogous Reference numeral represents same or analogous parts in the accompanying drawing.
Embodiment
Below in conjunction with accompanying drawing the present invention is described in further detail.
In order to support the safety function of D2D communication, introduce a kind of logic entity among the present invention, be secure entity (security entity), it is at the cordless communication network based on the based mobile communication facility, such as LTE (Long Term Evolution, Long Term Evolution) network, IMT-Advanced network, WiMAX (Worldwide Interoperability for Microwave Access, worldwide interoperability for microwave inserts) network etc. are carried out D2D communication security function.This secure entity is independent of security architecture and the operating process of traditional Access Network and core net, the former is as E-UTRAN (evolved universal terrestrial radio access network, the general continental rise wireless access network of evolution), EPC in the latter such as the LTE system (Evolved Packet Core, the block core of evolution).This secure entity can be installed on the base station, or other network equipments in the aforementioned cordless communication network, as addressable other network elements in base station in the LTE system.
Herein; for convenience; be installed on the base station elaboration of giving an example with secure entity; yet; those skilled in the art will be understood that; these only are example for example, should not be regarded as any restriction to protection scope of the present invention, and other equipment that can comprise this secure entity existing or that may occur in the future all belong to protection scope of the present invention.For example, when secure entity is installed in the LTE system addressable other network elements in base station, the base station is according to the D2D communication event between the equipment, send the request of D2D security configuration to this network element, this network element claimed apparatus secure entity wherein generates corresponding security configuration message, and be sent to the base station, be transmitted to the equipment of pending D2D communication by the base station.
Among the present invention, for the equipment that carries out D2D communication as bottom architecture with the based mobile communication facility, it should connect with the base station on the one hand, peer device (peer device) communication that should communicate by letter with pending D2D on the other hand.In this article, preceding a kind of communication link is called as access link, and a kind of communication link in back is called as the D2D link.In order to support between two equipment, even the safety of D2D link between a plurality of equipment, following principle will be suitable for.
1) equipment that is used for D2D communication should be supported communicating by letter via access link and D2D link simultaneously.Therefore, the safety design to the D2D link should not exert an influence to the safety of access link.
2) general two functions of realization that require of safety design: encrypt and integrity protection.Encryption is not received by the third party for the protection of data flow, and the integrity protection of control signaling makes the recipient can detect insertion and the replacement of packet.Direct transmitting data stream between the D2D communicating requirement neighbouring device (proximate devices) is so should primarily support encryption function in the D2D link.If the D2D link needs high-rise control signaling, to support encryption and the integrity protection of control signaling.
3) being used for the equipment of D2D communication can be simultaneously can carry out the peer device that D2D communicates by letter with a plurality of other and communicate.Safe design should have certain control signaling, communicates to connect to identify each D2D.
Below will specifically describe with the safety approach of based mobile communication facility as the D2D communication of bottom architecture.Particularly, determine intending carrying out when the base station between the subscriber equipment of D2D communication can direct communication, and this base station requires secure entity to generate the D2D safe key.Afterwards, this base station is carried out the subscriber equipment generation of D2D communication and is distributed corresponding security configuration message for intending.According to this security configuration message, these subscriber equipmenies can be carried out at the D2D link and encrypt and the integrity protection function.Safety approach of the present invention comprises the aspect of two keys: the distribution of the generation of security configuration message and security configuration message.
I. the generation of security configuration message
Based on mentioned above principle 1), for the safe key that the D2D link generates should be different with the safe key of access link.Otherwise an equipment just may receive other equipment via the access link data flow transmitted.The safe key of D2D link is generated by the secure entity of base station side.
Based on mentioned above principle 2), secure entity need generate different safe keys, to be respectively applied to encryption and integrity protection.For example, a safe key is used for the integrity protection of D2D control signaling, and a safe key is used for the encryption of D2D control signaling, and a safe key is used for the encryption of user data.Corresponding cryptographic algorithm and protection algorithm integrallty are also included within the security configuration message.
Based on mentioned above principle 3), also comprise the D2D identification information in the security configuration message, to be used in each the D2D communication of a plurality of D2D link signs.At this, the D2D identification information can have multiple implementation.For example, as a kind of simple implementation, can adopt the identification information of the peer device that carries out D2D communication as the identification information of its D2D communication.The identification information of peer device can obtain in the discovery stage of neighbouring device.
At this, basic security configuration message can comprise following content:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
For example, in the LTE/LTE-A system, RRC (Radio Resource Control, radio resource control) connects to reshuffle for adjusting RRC and connects.At this, RRC connects reconfiguration message and is expanded to comprise the security configuration message of communicating by letter for D2D.RRC after this expansion connects reconfiguration message, is sent to equipment by the base station, and it adopts this equipment to be encrypted and integrity protection at the safe key of access link.Below illustrate and be included in the example that RRC connects the security configuration message in the reconfiguration message.
Need to prove; those skilled in the art will be understood that; above-mentioned LTE/LTE-A system only is example; be used for explanation of the present invention one concrete applicable network; it should not be regarded as any restriction to protection scope of the present invention; as the WiMAX system etc., other existing or may occur in the future go for system of the present invention and/or network all belongs to protection scope of the present invention.
II. the distribution of security configuration message
Fig. 1 shows the application scenarios that multiple D2D communicates by letter with Fig. 2.As shown in Figure 1, the subscriber equipment 11 in same residential quarter and subscriber equipment 12 direct communication mutually are in subscriber equipment 13 and the also direct communication mutually of subscriber equipment 14 of two neighbor cells respectively.In addition, D2D communication also can be auxiliary via relaying, comprises the situation that single relaying is auxiliary and a plurality of relayings are auxiliary, and for example, as shown in Figure 2, subscriber equipment 17 is communicated by letter to carry out D2D via trunking 18 relayings with subscriber equipment 19.
Based on D2D communication scenes illustrated in figures 1 and 2, below will specifically describe the basic process of the security configuration message distribution of control Network Based.
As shown in Figure 1, being in subscriber equipment 11 and the subscriber equipment 12 of base station 21 coverages mutually can direct communication.Fig. 3 illustrates the direct communication process between an exemplary subscriber equipment 11 and the subscriber equipment 12.The D2D communication event of determining between subscriber equipment 11 and the subscriber equipment 12 when base station 21, as the notification message of base station 21 by the D2D communication this time of one of them user equipment to report, determine this D2D communication event, this base station 21 is sent to each subscriber equipment with D2D security configuration message.Afterwards, each subscriber equipment returns the security configuration response message to this base station 21.Set up direct communication between subscriber equipment 11 and the subscriber equipment 12.At this, the security configuration message 1 that is sent to subscriber equipment 11 can be identical with the security configuration message 2 that is sent to subscriber equipment 12, also can be different.For example, the encryption key in the security configuration message 1 that is sent to subscriber equipment 11 and the security configuration message 2 that is sent to subscriber equipment 12 and cryptographic algorithm, integrity protection key are identical with protection algorithm integrallty.
As shown in Figure 4, subscriber equipment 11 comprises that straight-through equipment determines device 111, security message deriving means 112, direct communication apparatus for establishing 113; Subscriber equipment 12 comprises that straight-through equipment determines device 121, security message deriving means 122 and direct communication apparatus for establishing 123; Base station 21 comprises security message generating apparatus 211 and security message dispensing device 212.
Particularly, by the D2D discovery procedure, send Beacon frame or Preamble frame as subscriber equipment 12, subscriber equipment 11 detects this Beacon frame or Preamble frame, the straight-through equipment of subscriber equipment 11 determines that device 111 determines to treat to carry out with it the subscriber equipment 12 of direct communication, and the straight-through equipment of subscriber equipment 12 determines that device 121 determines to treat to carry out with it the subscriber equipment 11 of direct communication.
Subsequently, the security message deriving means 112 of subscriber equipment 11 to the base station 21 notification messages that send about direct communication between subscriber equipment 11 and the subscriber equipment 12; The security message generating apparatus 211 of base station 21 is respectively the security configuration message 1 and security configuration message 2 of subscriber equipment 11 with the subscriber equipment 12 generation communication between devices of plan direct communication according to this notification message.
Then, the security message dispensing device 212 of base station 21 is sent to subscriber equipment 11 and subscriber equipment 12 respectively with security configuration message 1 and security configuration message 2; The security message deriving means 112 of subscriber equipment 11 receives its corresponding security configuration message 1, and the security message deriving means 122 of subscriber equipment 12 receives its corresponding security configuration message 2.
At this, the D2D security configuration message 1 that is sent to subscriber equipment 11 should adopt subscriber equipment 11 to be encrypted and integrity protection at the safe key of access link.Similarly, the D2D security configuration message 2 that is sent to subscriber equipment 12 also should adopt subscriber equipment 12 to be encrypted and integrity protection at the safe key of access link.
Subsequently, the direct communication apparatus for establishing 113 of subscriber equipment 11 and the direct communication apparatus for establishing 123 of subscriber equipment 12 be respectively according to the security configuration message that receives 1 and security configuration message 2, and method, apparatus set up direct communication.
Still consult Fig. 1, be in the subscriber equipment 13 of base station 21 coverages and be in the subscriber equipment 14 of base station 22 coverages can be mutually between direct communication.
Fig. 5 illustrates the direct communication process between an exemplary subscriber equipment 13 and the subscriber equipment 14.Can carry out direct communication in case subscriber equipment 13 and subscriber equipment 14 identify both by the D2D discovery procedure, the identification information of base stations 22 under subscriber equipment its peer user devices 14 of base station 21 reports under 13 to its is as cell ID.
Based on the report of subscriber equipment 13, the negotiations process of security configuration message is carried out with base station 22 in base station 21.Afterwards, base station 21 is sent to subscriber equipment 13 with security configuration message 3, comprises D2D identification information, encryption key and cryptographic algorithm, integrity protection key and protection algorithm integrallty in the security configuration message 3.At this, the D2D security configuration message 3 that is sent to subscriber equipment 13 should adopt subscriber equipment 13 to be encrypted and integrity protection at the safe key of access link.Similarly, the base station 22 D2D security configuration message 4 that is sent to subscriber equipment 14 also should adopt subscriber equipment 14 to be encrypted and integrity protection at the safe key of access link.
Based on the D2D security configuration message 3 and the security configuration message 4 that receive, subscriber equipment 13 is communicated by letter with the D2D that subscriber equipment 14 is set up safety respectively.
As shown in Figure 6, subscriber equipment 13 comprises that straight-through equipment determines device 131, security message deriving means 132 and direct communication apparatus for establishing 133; Subscriber equipment 14 comprises that straight-through equipment determines device 141, security message deriving means 142 and direct communication apparatus for establishing 143; Base station 21 comprises security message generating apparatus 211 and security message dispensing device 212; Base station 22 comprises that security message obtains device 221 and security message dispensing device 222.
Particularly, by the D2D discovery procedure, the straight-through equipment of subscriber equipment 13 determines that device 131 determines to treat to carry out with it the subscriber equipment 14 of direct communication, and the straight-through equipment of subscriber equipment 14 determines that device 141 determines to treat to carry out with it the subscriber equipment 13 of direct communication.
Subsequently, the security message deriving means 132 of subscriber equipment 13 is 21 notification messages that send about direct communication between subscriber equipment 13 and the subscriber equipment 14 to the base station, comprise the identification information of subscriber equipment 14 in this notification message; According to this notification message, the security message generating apparatus 211 of base station 21 determines that subscriber equipment 14 corresponding base stations are base station 22, and obtain device 221 with the security message of base station 22 and hold consultation, to be respectively security configuration message 3 and the security configuration message 4 of subscriber equipment 13 and subscriber equipment 14 generation communication between devices, and security configuration message 4 is sent to base station 22, after being handled by it, be sent to subscriber equipment 14.
Then, the security message dispensing device 212 of base station 21 is encrypted and integrity protection D2D security configuration message 3 according to the safe key of subscriber equipment 13 at access link, and the security configuration message 3 after handling is sent to subscriber equipment 13; Similarly, the security message dispensing device 222 of base station 22 is encrypted and integrity protection D2D security configuration message according to the safe key of subscriber equipment 14 at access link, and the security configuration message 4 after handling is sent to subscriber equipment 14.
Subsequently, the direct communication apparatus for establishing 133 of subscriber equipment 13 and the direct communication apparatus for establishing 143 of subscriber equipment 14 be respectively according to the security configuration message 3 that receives and security configuration message 4, and method, apparatus set up direct communication.
Fig. 2 illustrates the D2D communication that strengthens through relaying, and wherein subscriber equipment 15 temporarily is in outside the coverage of base station 23, and still can communicate with base station 23 via the relaying of subscriber equipment 16.
Fig. 7 shows the detailed process of the D2D communication that strengthens through relaying from the angle of subscriber equipment 15.At this, subscriber equipment 16 and base station 23 are labeled as K6 at the safe key that access link uses, subscriber equipment 15 and base station 23 are labeled as K5 at the safe key that access link uses.After base station 23 determines that subscriber equipmenies 15 and subscriber equipment 16 mutually can direct communications, for example, subscriber equipment 15 and subscriber equipment 16 identify both by the D2D discovery procedure can carry out direct communication, the notification message of subscriber equipment 16 this D2D communication of 23 transmissions to the base station, base station 23 is determined this D2D communication event accordingly, base station 23 is sent to subscriber equipment 16 with the security configuration message 5 of subscriber equipment 15, to be forwarded to subscriber equipment 15 by it.This security configuration message 5 adopts K5 to be encrypted and integrity protection earlier, adopts K6 to be encrypted again and integrity protection.This security configuration message 5 is shown in the back: K6{K5{D2D security configuration message 5}}.
When subscriber equipment 16 receives this security configuration message 5, it at first is decrypted and integrity detection according to its safe key K6 at access link.When successful, subscriber equipment 16 is sent to subscriber equipment 15 with D2D security configuration message 5 with the form of K5{D2D security configuration message 5}.
When subscriber equipment 15 receives this security configuration message 5 that subscriber equipment 16 is transmitted, it is at first according to being decrypted and integrity detection at the safe key K5 of access link.When successful, subscriber equipment 15 obtains D2D security configuration message, and sends the security configuration response message to subscriber equipment 16.Afterwards, subscriber equipment 16 23 sends the security configuration response messages to the base station.
Simultaneously, base station 23 also adopts subscriber equipment 16 at the safe key K6 of access link, sends D2D security configuration message 6 to subscriber equipment 16.Subscriber equipment 16 is decrypted and integrity detection according to its safe key K6 at access link.When successful, subscriber equipment 16 obtains D2D security configuration message, and 23 sends the security configuration response messages to the base station.Based on the D2D security configuration information that receives, subscriber equipment 15 is communicated by letter with the D2D that subscriber equipment 16 is set up safety.
As shown in Figure 8, subscriber equipment 15 comprises that straight-through equipment determines device 151, security message deriving means 152, direct communication apparatus for establishing 153; Subscriber equipment 16 comprises that straight-through equipment determines device 161, security message deriving means 162 and direct communication apparatus for establishing 163; Base station 23 comprises security message generating apparatus 231 and security message dispensing device 232.
Particularly, by the D2D discovery procedure, the straight-through equipment of subscriber equipment 15 determines that device 151 determines to treat to carry out with it the subscriber equipment 16 of direct communication, and the straight-through equipment of subscriber equipment 16 determines that device 161 determines to treat to carry out with it the subscriber equipment 15 of direct communication.
Subsequently, the security message deriving means 162 of subscriber equipment 16 to the base station 23 notification messages that send about direct communication between subscriber equipment 15 and the subscriber equipment 16; The security message generating apparatus 231 of base station 23 is respectively security configuration message 5 and security configuration message 6 that subscriber equipment 15 and subscriber equipment 15 generate communication between devices according to this notification message.
Then, security message dispensing device 232 orders of base station 23 are encrypted and integrity protection D2D security configuration message 5 at the safe key of access link according to subscriber equipment 15 and subscriber equipment 16, security configuration message 5 after handling is sent to subscriber equipment 16, via subscriber equipment 16 D2D security configuration message 5 is sent to subscriber equipment 15; And the security message dispensing device 232 of base station 23 is encrypted and integrity protection D2D security configuration message 6 according to the safe key of subscriber equipment 16 at access link, and the security configuration message 6 after handling is sent to subscriber equipment 16.
Subsequently, the direct communication apparatus for establishing 153 of subscriber equipment 15 and the direct communication apparatus for establishing 163 of subscriber equipment 16 be respectively according to the security configuration message 5 that receives and security configuration message 6, and method, apparatus set up direct communication.
Fig. 2 illustrates the D2D communication that strengthens through relaying, and wherein subscriber equipment 17 and subscriber equipment 19 all are in the coverage of base station 23, and communicates by letter to carry out D2D via trunking 18 relayings.At this, trunking includes but not limited to any applicable to of the present invention, can be the equipment that relaying is carried out in D2D communication, as subscriber equipment.
Fig. 9 shows the detailed process that D2D that subscriber equipment 17 and subscriber equipment 19 strengthen through relaying communicates by letter.Subscriber equipment 17 carries out the forwarding of the straight-through request of equipment via trunking 18, thereby finds to treat to carry out with it the subscriber equipment 19 of direct communication.This D2D communication event is determined by the notification message of one of them user equipment to report D2D communication this time in base station 23, and this base station 23 is sent to each subscriber equipment with D2D security configuration message.Afterwards, each subscriber equipment returns the security configuration response message to this base station 23.Set up direct communication between subscriber equipment 17 and the subscriber equipment 19, and transmit user data waiting for transmission via trunking 18 for it.
As shown in figure 10, subscriber equipment 17 comprises that straight-through equipment determines device 171, security message deriving means 172, direct communication apparatus for establishing 173 and subscriber data transmission apparatus 174; Subscriber equipment 19 comprises that straight-through equipment determines device 191, security message deriving means 192, direct communication apparatus for establishing 193 and subscriber data transmission apparatus 194; Trunking 18 comprises straight-through request retransmission unit 181 and user data retransmission unit 182; Base station 23 comprises security message generating apparatus 231 and security message dispensing device 232.
Particularly, the straight-through equipment of subscriber equipment 17 determines that device 171 is sent to trunking 18 with the straight-through request of equipment, to indicate to this trunking 18 the straight-through request of this equipment is forwarded to the subscriber equipment 19 that subscriber equipment 17 treats to carry out with it direct communication; The straight-through request retransmission unit 181 of trunking 18 receives the straight-through request of equipment that subscriber equipmenies 17 send, and transmits that this equipment is straight-through asks to subscriber equipment 19; The straight-through equipment of subscriber equipment 19 determines that device 191 determines to treat to carry out with it the subscriber equipment 17 of direct communication accordingly.
Subsequently, the security message deriving means 192 of subscriber equipment 19 to the base station 23 notification messages that send about direct communication between subscriber equipment 17 and the subscriber equipment 19; The security message generating apparatus 231 of base station 23 is respectively the security configuration message 7 and security configuration message 9 of subscriber equipment 17 with the subscriber equipment 19 generation communication between devices of plan direct communication.
Then, the security message dispensing device 232 of base station 23 is sent to subscriber equipment 17 and subscriber equipment 19 respectively with security configuration message 7 and security configuration message 9; The security message deriving means 172 of subscriber equipment 17 and the security message deriving means 192 of subscriber equipment 19 receive its corresponding security configuration message 7 and security configuration message 9 respectively.
At this, the D2D security configuration message 7 that is sent to subscriber equipment 17 should adopt subscriber equipment 17 to be encrypted and integrity protection at the safe key of access link.Similarly, the D2D security configuration message 9 that is sent to subscriber equipment 19 also should adopt subscriber equipment 19 to be encrypted and integrity protection at the safe key of access link.
Subsequently, the direct communication apparatus for establishing 173 of subscriber equipment 17 and the direct communication apparatus for establishing 193 of subscriber equipment 19 be respectively according to the security configuration message that receives, and method, apparatus set up direct communication.
Then, the subscriber data transmission apparatus 174 of subscriber equipment 17 is sent to trunking 18 with user data waiting for transmission, to indicate it this user data is forwarded to subscriber equipment 19; The user data retransmission unit 182 of trunking 18 is transmitted the user data of transmission between subscriber equipment 17 and the subscriber equipment 19; It is the user data that subscriber equipment 17 is transmitted that the subscriber data transmission apparatus 194 of subscriber equipment 19 receives trunking 18.
The straight-through request retransmission unit of above-mentioned trunking and user data retransmission unit can also can be integrated into a functional module for two functional modules independently.Similarly, the direct communication apparatus for establishing of above-mentioned subscriber equipment and subscriber data transmission apparatus can also can be integrated into a functional module for two functional modules independently.
Need to prove, more than only to show via a trunking be the scheme that relaying is carried out in D2D communication, those skilled in the art are based on foregoing, should be able to know a plurality of trunkings can be that relaying is carried out in D2D communication by cooperation mode equally.Therefore, the D2D secure communication scheme of these cooperating relay also belongs to protection scope of the present invention.
Among the present invention, after D2D communication stops, secure entity will be regained the D2D safe key.
In addition, under the scene of residential quarter switching and connection reconstruction, cryptographic algorithm and integral algorithm, and the safe key of communicating by letter for D2D may change.The D2D secure communication scheme of control Network Based among the present invention goes for aforementioned scene equally.The present invention can work under TDD (Time Division Duplexing, time division duplex) and FDD (Frequency Division Duplexing, the Frequency Division Duplexing (FDD)) pattern, and special-purpose frequency spectrum and shared frequency spectrum.
It should be noted that the present invention can be implemented in the assembly of software and/or software and hardware, for example, can adopt application-specific integrated circuit (ASIC) (ASIC), general purpose computer or any other similar hardware device to realize.Software program of the present invention can carry out to realize function mentioned above by processor.Similarly, software program of the present invention (comprising relevant data structure) can be stored in the computer readable recording medium storing program for performing, for example, and RAM memory, magnetic or CD-ROM driver or floppy disc and similar devices.In addition, functions more of the present invention can adopt hardware to realize, for example, thereby as cooperate the circuit of carrying out each function with processor.
In addition, a part of the present invention can be applied to computer program, and for example computer program instructions when it is carried out by computer, by the operation of this computer, can call or provide according to technical scheme of the present invention.And call the program command of technical scheme of the present invention, may be stored in fixing or movably in the recording medium, and/or be transmitted by the data flow in broadcasting or other signal bearing medias, and/or be stored in the working storage according to the computer equipment of described program command operation.At this, comprise a device according to one embodiment of present invention, this device comprises for the memory of storage computer program instructions and is used for the processor of execution of program instructions, wherein, when this computer program instructions is carried out by this processor, trigger this device operation based on aforementioned technical scheme according to a plurality of embodiment of the present invention.
To those skilled in the art, obviously the invention is not restricted to the details of above-mentioned one exemplary embodiment, and under the situation that does not deviate from spirit of the present invention or essential characteristic, can realize the present invention with other concrete form.Therefore, no matter from which point, all should regard embodiment as exemplary, and be nonrestrictive, scope of the present invention is limited by claims rather than above-mentioned explanation, therefore is intended to be included in the present invention dropping on the implication that is equal to important document of claim and all changes in the scope.Any Reference numeral in the claim should be considered as limit related claim.In addition, obviously other unit or step do not got rid of in " comprising " word, and odd number is not got rid of plural number.A plurality of unit of stating in equipment and/or the claim or device also can be realized by software or hardware by a unit or device.The first, the second word such as grade is used for representing title, and does not represent any specific order.
Claims (15)
1. first subscriber equipment that is used for direct communication between based on the cordless communication network of based mobile communication facility and other subscriber equipmenies, wherein, this first subscriber equipment comprises:
Straight-through equipment is determined device, is used for determining to treat to carry out with it second subscriber equipment of direct communication;
The security message deriving means is for the first security configuration message of obtaining from the network equipment about direct communication between described first subscriber equipment and described second subscriber equipment;
The direct communication apparatus for establishing is used for according to the described first security configuration message, sets up direct communication with described second subscriber equipment.
2. first subscriber equipment according to claim 1, wherein, described security message deriving means is used for:
-to the notification message of described network equipment transmission about direct communication between described first subscriber equipment and described second subscriber equipment;
-receive the described network equipment based on the described first security configuration message of described notification message transmission.
3. first subscriber equipment according to claim 1, wherein, described security message deriving means also is used for:
-obtain the second security configuration message about direct communication between described first subscriber equipment and described second subscriber equipment from the described network equipment;
-the described second security configuration message is forwarded to described second subscriber equipment.
4. first subscriber equipment according to claim 1, wherein, described straight-through equipment determines that device is used for:
-the straight-through request of equipment is sent to trunking, to indicate to it straight-through request of described equipment is forwarded to described second subscriber equipment;
Wherein, this first subscriber equipment also comprises:
Subscriber data transmission apparatus, be used for described second subscriber equipment set up communicate by letter after, user data waiting for transmission is sent to described trunking, to indicate it described user data is forwarded to described second subscriber equipment.
5. according to each described first subscriber equipment in the claim 1 to 4, wherein, the described first security configuration message comprise following at least each:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
6. trunking that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this trunking comprises:
Straight-through request retransmission unit is used for receiving the straight-through request of equipment that first subscriber equipment sends, and transmits the straight-through request of described equipment treats to carry out with it direct communication to described first subscriber equipment second subscriber equipment;
The user data retransmission unit is used for transmitting the user data that transmits between described first subscriber equipment and described second subscriber equipment.
7. first network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first network equipment comprises:
The security message generating apparatus is used for being respectively first subscriber equipment of plan direct communication and the first security configuration message and the second security configuration message that second subscriber equipment generates communication between devices;
The security message dispensing device is used for the described first security configuration message is sent to described first subscriber equipment, and the described second security configuration message is sent to described second subscriber equipment.
8. first network equipment according to claim 7, wherein, described security message generating apparatus is used for:
-second network equipment corresponding with described second subscriber equipment held consultation, to generate the described first security configuration message and the described second security configuration message;
Wherein, the performed operation that the described second security configuration message is sent to described second subscriber equipment of described security message dispensing device comprises:
-the described second security configuration message is sent to described second subscriber equipment via described second network equipment.
9. first network equipment according to claim 7, wherein, the performed operation that the described second security configuration message is sent to described second subscriber equipment of described security message dispensing device comprises:
-the described second security configuration message is sent to described second subscriber equipment via described first subscriber equipment.
10. according to each described first network equipment in the claim 7 to 9, wherein, described security message generating apparatus is used for:
-according to the notification message about direct communication between described first subscriber equipment and described second subscriber equipment that described first subscriber equipment sends, be respectively described first subscriber equipment and described second subscriber equipment and generate the described first security configuration message and the described second security configuration message.
11. according to each described first network equipment in the claim 7 to 10, wherein, the described first security configuration message and the described second security configuration message comprise respectively following at least each:
-D2D identification message;
-for safe key and the cryptographic algorithm of encrypting;
-be used for safe key and the protection algorithm integrallty of integrity protection.
12. second network equipment that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second network equipment comprises:
Security message obtains device, be used for holding consultation with first network equipment, think the second security configuration message of intending obtaining with second subscriber equipment of the first subscriber equipment direct communication communication between devices, wherein, described first subscriber equipment is corresponding with described first network equipment;
The security message dispensing device is used for the described second security configuration message is sent to described second subscriber equipment.
13. first base station that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this first base station comprises as each described first network equipment in the claim 7 to 11.
14. second base station that is used for direct communication between based on the cordless communication network assisting user equipment of based mobile communication facility, wherein, this second base station comprises second network equipment as claimed in claim 12.
15. system that is used for direct communication between based on the cordless communication network subscriber equipment of based mobile communication facility, wherein, this system comprises as each described first subscriber equipment in the claim 1 to 5 with as each described first network equipment in the claim 7 to 11.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201210055771.1A CN103297961B (en) | 2012-03-05 | 2012-03-05 | A kind of equipment and system for safety communication between devices |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201210055771.1A CN103297961B (en) | 2012-03-05 | 2012-03-05 | A kind of equipment and system for safety communication between devices |
Publications (2)
Publication Number | Publication Date |
---|---|
CN103297961A true CN103297961A (en) | 2013-09-11 |
CN103297961B CN103297961B (en) | 2018-03-09 |
Family
ID=49098145
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201210055771.1A Active CN103297961B (en) | 2012-03-05 | 2012-03-05 | A kind of equipment and system for safety communication between devices |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN103297961B (en) |
Cited By (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2016045083A1 (en) * | 2014-09-26 | 2016-03-31 | 华为技术有限公司 | Communication method and user device |
WO2016062075A1 (en) * | 2014-10-23 | 2016-04-28 | 中兴通讯股份有限公司 | Method and device for managing device-to-device (d2d) communication group |
CN105794147A (en) * | 2013-09-27 | 2016-07-20 | 三星电子株式会社 | Method and apparatus for securing discovery information |
WO2016145864A1 (en) * | 2015-08-25 | 2016-09-22 | 中兴通讯股份有限公司 | Data transmission method and device |
WO2016155018A1 (en) * | 2015-04-03 | 2016-10-06 | 华为技术有限公司 | Data transmission method, user equipment and base station |
WO2016161764A1 (en) * | 2015-04-09 | 2016-10-13 | 中兴通讯股份有限公司 | Relay bearer control method and apparatus, and computer storage medium |
WO2016169232A1 (en) * | 2015-04-23 | 2016-10-27 | 中兴通讯股份有限公司 | Authentication method, apparatus and system for d2d service multicast |
CN106576241A (en) * | 2014-10-31 | 2017-04-19 | 宇龙计算机通信科技(深圳)有限公司 | Mic verification method in d2d communications and d2d communications system |
WO2017088771A1 (en) * | 2015-11-24 | 2017-06-01 | Huawei Technologies Co., Ltd. | Security for proxied devices |
WO2017132965A1 (en) * | 2016-02-04 | 2017-08-10 | 华为技术有限公司 | Data transmission system, method, and device |
WO2017181374A1 (en) * | 2016-04-20 | 2017-10-26 | Telefonaktiebolaget Lm Ericsson (Publ) | UE-UE Configuration Framework w/o NW Support |
CN107666667A (en) * | 2016-07-29 | 2018-02-06 | 电信科学技术研究院 | A kind of data transmission method, the first equipment and the second equipment |
WO2018076798A1 (en) * | 2016-10-31 | 2018-05-03 | 华为技术有限公司 | Method and apparatus for transmitting data |
US10382953B2 (en) | 2014-04-30 | 2019-08-13 | Zte Corporation | Configuration method, ProSe key management functional entity, terminal, system, and storage medium |
CN110366181A (en) * | 2019-07-29 | 2019-10-22 | 努比亚技术有限公司 | Data transmission method, system and computer readable storage medium |
CN110381475A (en) * | 2014-05-09 | 2019-10-25 | 创新技术实验室株式会社 | Method, eNB and Tx UE about the D2D communication supported between UE |
CN111405379A (en) * | 2014-03-11 | 2020-07-10 | 耐瑞唯信有限公司 | Method and system and storage medium for establishing a secure communication channel between devices |
CN111935851A (en) * | 2020-07-17 | 2020-11-13 | 广东以诺通讯有限公司 | Communication method, WiFi access point and D2D terminal |
CN111954318A (en) * | 2020-07-20 | 2020-11-17 | 广东工贸职业技术学院 | Equipment interconnection method, device and system |
WO2021027435A1 (en) * | 2019-08-09 | 2021-02-18 | 华为技术有限公司 | Method and apparatus for determining security protection mode |
CN112449323A (en) * | 2019-08-14 | 2021-03-05 | 华为技术有限公司 | Communication method, device and system |
WO2023240575A1 (en) * | 2022-06-16 | 2023-12-21 | 北京小米移动软件有限公司 | Relay communication method, communication apparatus, and communication device |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
CN101986763A (en) * | 2010-10-22 | 2011-03-16 | 浙江大学 | Double battle mobile game method |
WO2011056878A1 (en) * | 2009-11-04 | 2011-05-12 | Qualcomm Incorporated | Method and apparatus for peer discovery in a wireless communication network |
-
2012
- 2012-03-05 CN CN201210055771.1A patent/CN103297961B/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
WO2011056878A1 (en) * | 2009-11-04 | 2011-05-12 | Qualcomm Incorporated | Method and apparatus for peer discovery in a wireless communication network |
CN101986763A (en) * | 2010-10-22 | 2011-03-16 | 浙江大学 | Double battle mobile game method |
Cited By (38)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10455415B2 (en) | 2013-09-27 | 2019-10-22 | Samsung Electronics Co., Ltd. | Method for securing discovery information and device therefor |
CN105794147A (en) * | 2013-09-27 | 2016-07-20 | 三星电子株式会社 | Method and apparatus for securing discovery information |
US11163868B2 (en) | 2013-09-27 | 2021-11-02 | Samsung Electronics Co., Ltd. | Method for securing discovery information and device therefor |
US10638312B2 (en) | 2013-09-27 | 2020-04-28 | Samsung Electronics Co., Ltd. | Method for securing discovery information and device therefor |
CN111405379A (en) * | 2014-03-11 | 2020-07-10 | 耐瑞唯信有限公司 | Method and system and storage medium for establishing a secure communication channel between devices |
US10382953B2 (en) | 2014-04-30 | 2019-08-13 | Zte Corporation | Configuration method, ProSe key management functional entity, terminal, system, and storage medium |
CN110381475B (en) * | 2014-05-09 | 2022-10-14 | 思科系统公司 | Method for supporting D2D communication between UEs, eNB and Tx UE |
US11736233B2 (en) | 2014-05-09 | 2023-08-22 | Cisco Technology, Inc. | Method and apparatus of scheduling for device to device (D2D) communication |
CN110381475A (en) * | 2014-05-09 | 2019-10-25 | 创新技术实验室株式会社 | Method, eNB and Tx UE about the D2D communication supported between UE |
US12212415B2 (en) | 2014-05-09 | 2025-01-28 | Cisco Technology, Inc. | Method and apparatus of scheduling for device to device (D2D) communication |
CN105637961A (en) * | 2014-09-26 | 2016-06-01 | 华为技术有限公司 | Communication method and user device |
WO2016045083A1 (en) * | 2014-09-26 | 2016-03-31 | 华为技术有限公司 | Communication method and user device |
WO2016062075A1 (en) * | 2014-10-23 | 2016-04-28 | 中兴通讯股份有限公司 | Method and device for managing device-to-device (d2d) communication group |
CN106576241B (en) * | 2014-10-31 | 2020-05-19 | 宇龙计算机通信科技(深圳)有限公司 | Method for checking MIC in D2D communication and D2D communication system |
CN106576241A (en) * | 2014-10-31 | 2017-04-19 | 宇龙计算机通信科技(深圳)有限公司 | Mic verification method in d2d communications and d2d communications system |
WO2016155018A1 (en) * | 2015-04-03 | 2016-10-06 | 华为技术有限公司 | Data transmission method, user equipment and base station |
WO2016161764A1 (en) * | 2015-04-09 | 2016-10-13 | 中兴通讯股份有限公司 | Relay bearer control method and apparatus, and computer storage medium |
CN106162618A (en) * | 2015-04-23 | 2016-11-23 | 中兴通讯股份有限公司 | Authentication method, device and the system of a kind of D2D business multicast |
WO2016169232A1 (en) * | 2015-04-23 | 2016-10-27 | 中兴通讯股份有限公司 | Authentication method, apparatus and system for d2d service multicast |
WO2016145864A1 (en) * | 2015-08-25 | 2016-09-22 | 中兴通讯股份有限公司 | Data transmission method and device |
WO2017088771A1 (en) * | 2015-11-24 | 2017-06-01 | Huawei Technologies Co., Ltd. | Security for proxied devices |
US10567964B2 (en) | 2015-11-24 | 2020-02-18 | Futurewei Technologies, Inc. | Security for proxied devices |
WO2017132965A1 (en) * | 2016-02-04 | 2017-08-10 | 华为技术有限公司 | Data transmission system, method, and device |
US10660008B2 (en) | 2016-02-04 | 2020-05-19 | Huawei Technologies Co., Ltd. | Data transmission system, method, and apparatus |
WO2017181374A1 (en) * | 2016-04-20 | 2017-10-26 | Telefonaktiebolaget Lm Ericsson (Publ) | UE-UE Configuration Framework w/o NW Support |
US10609553B2 (en) | 2016-07-29 | 2020-03-31 | China Academy Of Telecommunications Technology | Data transmission method, first device, and second device |
CN107666667B (en) * | 2016-07-29 | 2019-09-17 | 电信科学技术研究院 | A kind of data transmission method, the first equipment and the second equipment |
CN107666667A (en) * | 2016-07-29 | 2018-02-06 | 电信科学技术研究院 | A kind of data transmission method, the first equipment and the second equipment |
WO2018076798A1 (en) * | 2016-10-31 | 2018-05-03 | 华为技术有限公司 | Method and apparatus for transmitting data |
CN110366181A (en) * | 2019-07-29 | 2019-10-22 | 努比亚技术有限公司 | Data transmission method, system and computer readable storage medium |
CN110366181B (en) * | 2019-07-29 | 2024-02-13 | 努比亚技术有限公司 | Data transmission method, system and computer readable storage medium |
WO2021027435A1 (en) * | 2019-08-09 | 2021-02-18 | 华为技术有限公司 | Method and apparatus for determining security protection mode |
US12335319B2 (en) | 2019-08-09 | 2025-06-17 | Huawei Technologies Co., Ltd. | Method and apparatus for determining security protection mode |
CN112449323A (en) * | 2019-08-14 | 2021-03-05 | 华为技术有限公司 | Communication method, device and system |
CN112449323B (en) * | 2019-08-14 | 2022-04-05 | 华为技术有限公司 | Communication method, device and system |
CN111935851A (en) * | 2020-07-17 | 2020-11-13 | 广东以诺通讯有限公司 | Communication method, WiFi access point and D2D terminal |
CN111954318A (en) * | 2020-07-20 | 2020-11-17 | 广东工贸职业技术学院 | Equipment interconnection method, device and system |
WO2023240575A1 (en) * | 2022-06-16 | 2023-12-21 | 北京小米移动软件有限公司 | Relay communication method, communication apparatus, and communication device |
Also Published As
Publication number | Publication date |
---|---|
CN103297961B (en) | 2018-03-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN103297961A (en) | Device and system used for device-to-device secure communication | |
US10735956B2 (en) | Method and device for managing security according to service in wireless communication system | |
US11265704B2 (en) | Security key generation for communications between base station and terminal based on beam selection | |
EP2309698B1 (en) | Exchange of key material | |
CN105916140B (en) | Secure Communication Method and Device for Carrier Aggregation Between Base Stations | |
JP7127689B2 (en) | CORE NETWORK DEVICE, COMMUNICATION TERMINAL, AND COMMUNICATION METHOD | |
RU2017111083A (en) | INTERACTION AND INTEGRATION OF VARIOUS RADIO ACCESS NETWORKS | |
CN105191250A (en) | Systems and methods for secure high-speed link maintenance via nfc | |
WO2013116976A1 (en) | A fast-accessing method and apparatus | |
US11722890B2 (en) | Methods and systems for deriving cu-up security keys for disaggregated gNB architecture | |
CN102958052A (en) | Secure data transmission method and related device | |
KR20200002506A (en) | Apparatus and method for data communication in wireless communication system | |
KR20190117136A (en) | Apparatus and method for security of information in wireless communication | |
KR20240125046A (en) | Communication method and communication device | |
EP3813481B1 (en) | Information transmission methods and system | |
EP3939366B9 (en) | Dynamic and semi-persistent scheduling mixed multi-panel uplink precoding | |
EP4044760B1 (en) | Connection resume methods and apparatuses | |
CN103905389A (en) | Relay equipment-based security association, data transmission method, device and system | |
US20160301673A1 (en) | Method for Realizing Secure Communications among Machine Type Communication Devices and Network Entity | |
CN104521261A (en) | Method for enabling lawful interception in a telecommunications network, user equipment, base transceiver station, program and computer program product | |
WO2022253298A1 (en) | Method and apparatus for transmitting system information | |
US20240214902A1 (en) | Method and apparatus for reassignment of access and mobility management function in communication system | |
WO2023155721A1 (en) | Method for detecting false base station, and apparatus | |
CN104219662A (en) | Beacon frame transmitting method and device | |
KR102658615B1 (en) | Method for ssp device to interoperate between bundle donwload procedure and profile donwload procedure |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
CB02 | Change of applicant information | ||
CB02 | Change of applicant information |
Address after: 201206 ningqiao Road, Shanghai free trade test area, No. 388 Applicant after: Shanghai NOKIA Baer Limited by Share Ltd Address before: 201206 Pudong New Area Jinqiao Ning Road, Shanghai, No. 388 Applicant before: Shanghai Alcatel-Lucent Co., Ltd. |
|
GR01 | Patent grant | ||
GR01 | Patent grant |