WO2023143251A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2023143251A1
WO2023143251A1 PCT/CN2023/072627 CN2023072627W WO2023143251A1 WO 2023143251 A1 WO2023143251 A1 WO 2023143251A1 CN 2023072627 W CN2023072627 W CN 2023072627W WO 2023143251 A1 WO2023143251 A1 WO 2023143251A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
prose
network element
relay
communication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/072627
Other languages
English (en)
French (fr)
Inventor
吴义壮
雷骜
李�赫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP23746133.0A priority Critical patent/EP4422236A4/en
Priority to AU2023211342A priority patent/AU2023211342B2/en
Priority to CA3239348A priority patent/CA3239348A1/en
Publication of WO2023143251A1 publication Critical patent/WO2023143251A1/zh
Priority to US18/666,841 priority patent/US20240305983A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/14—Direct-mode setup

Definitions

  • the present application relates to the communication field, and in particular to a communication method and device.
  • UE1 can acquire services from the network side with the assistance of another UE (for example, UE2). For example, UE1 and UE2 establish a proximity service communication 5 (ProSe communication 5, PC5) interface connection on the air interface, so as to communicate with the network side through the PC5 connection.
  • ProSe communication 5, PC5 proximity service communication 5
  • UE1 may be regarded as a proximity based services (ProSe) remote (remote) UE, or simply referred to as a remote UE.
  • UE2 can be regarded as a relay (ProSe UE-to-network relay) from the adjacent service UE to the network, or simply referred to as the relay UE.
  • the communication between the remote UE and the network side through the relay UE can be regarded as ProSe relay communication.
  • ProSe relay communication has security risks and is easy to be attacked, resulting in leakage of user information.
  • the embodiments of the present application provide a communication method and device, which are used to ensure the security of ProSe relay communication, and to avoid leakage of user information caused by being attacked.
  • a communication method includes: an authentication service network element sends an authentication request message #1 to a data management network element, and receives an authentication response message #1 from the data management network element.
  • the authentication request message #1 is used to request authentication of the remote terminal
  • the authentication response message #1 includes: proximity service ProSe authentication information #1
  • the ProSe authentication information #1 includes at least one of the following: information for the remote terminal to authenticate the network, or Information used to authenticate the remote terminal.
  • the authentication service network element receives an authentication request message #2 from the access and mobility management network element, and the authentication request message #2 is used to request authentication of the remote terminal.
  • the authentication service network element when the authentication of the remote terminal passes, for example, the authentication service network element authenticates the remote terminal, or the authentication service network element and the access and mobility management network element both authenticate the remote terminal, the authentication service network element sends the access Send an authentication response message #2 with the mobility management network element.
  • the authentication request message #2 is used to request authentication of the remote terminal;
  • the authentication response message #2 includes: a ProSe key, and the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the remote terminal and the network can authenticate each other through the ProSe authentication information #1 provided by the data management network element.
  • the ProSe key for the communication between the remote UE and the relay UE can be generated, so as to deduce the communication of the PC5 connection (that is, the connection between the remote UE and the relay UE) based on the ProSe key Protect keys, such as encryption keys and integrity protection keys, to ensure the security of ProSe relay communication and avoid leakage of user information due to attacks.
  • the remote terminal and the relay terminal can deduce the communication protection key of the PC5 connection based on the ProSe key.
  • the remote terminal and the relay terminal can deduce a session key based on the ProSe key, and then the remote terminal and the The relay terminal further deduces a communication protection key (such as an encryption key and an integrity protection key) based on the session key, which is not limited in this application.
  • a communication protection key such as an encryption key and an integrity protection key
  • ProSe authentication information #1 may be at least one of the following: ProSe authentication vector #1 of authentication and key agreement AKA, or ProSe authentication vector of extended authentication protocol request EAP-AKA'. That is to say, the authentication between the remote UE and the network can be based on the enhancement of existing authentication methods, such as 5G AKA or EAP-AKA', to ensure ProSe relay communication without introducing new authentication methods Safety.
  • the ProSe authentication vector #1 of AKA or the ProSe authentication vector of EAP-AKA' may include at least one of the following: information for the remote terminal to authenticate the network, and information for the authentication service network element to authenticate the remote terminal , or information used to determine the ProSe key.
  • the authentication vector can not only be used for authentication between the remote UE and the network, but also be used for determining the ProSe key. So that when the AUSF network element determines that the authentication is passed, the ProSe key can be deduced according to the authentication vector without additional acquisition, so as to improve the authentication efficiency and key derivation efficiency.
  • the method described in the first aspect may further include: the authentication service network element receives the authentication request message from the access and mobility management network element #3.
  • the authentication service network element receives the authentication response message #1 from the data management network element
  • the authentication service network element receives the authentication request message #2 from the access and mobility management network element
  • the The method may further include: the authentication service network element sends an authentication response message #3 to the access and mobility management network element.
  • the authentication response message #3 may include: ProSe authentication information #2, and the ProSe authentication information #2 includes: information for the remote terminal to authenticate the network.
  • the ProSe authentication information #2 may also include: information for the network to authenticate the remote terminal. That is to say, the authentication of ProSe relay communication can be triggered by the access and mobility management network element, for example, when there is a business demand, so that the authentication service network element can perform authentication in a targeted manner to ensure the validity of the authentication.
  • ProSe authentication information #2 may be determined according to ProSe authentication information #1.
  • the ProSe authentication information #2 may be at least one of the following: AKA's ProSe authentication vector #2, or an EAP request message or an AKA' challenge message.
  • AKA's ProSe authentication vector #2 can be determined according to the AKA ProSe authentication vector #1, without introducing new functions, thereby reducing the complexity of network elements.
  • EAP request message or AKA' challenge message can be determined according to the ProSe authentication vector of EAP-AKA', without introducing new functions, thereby reducing the complexity of network elements.
  • the ProSe authentication vector #2 of the AKA may include: information used by the access and mobility management network element to authenticate the remote terminal.
  • AKA's ProSe authentication vector #2 can also be used for access and mobility management network elements to authenticate remote terminals from the perspective of the service network, thereby improving the comprehensiveness of authentication and further ensuring the security of ProSe relay communication.
  • the authentication request message #3 may be used to request authentication of the remote terminal.
  • requesting the authentication service network element to authenticate the remote terminal is used to trigger the authentication service network element to execute the authentication process of ProSe communication to ensure the reliability of authentication.
  • the authentication request message #3 may include at least one of the following: the remote terminal's concealed user identity SUCI, service network name, relay service code RSC, random value #1, or ProSe relay communication indication information.
  • the remote terminal's concealed user identity SUCI service network name
  • RSC relay service code
  • random value #1 random value #1
  • ProSe relay communication indication information any one of the service network name, RSC or ProSe relay communication indication information can be used to indicate that the authentication is the authentication of ProSe relay communication, so as to trigger the authentication process of the authentication service network element to perform ProSe communication, so as to ensure the accuracy and accuracy of the authentication. Reliability without impacting existing processes.
  • Any one of the service network name, RSC, or random value #1 can be used to determine the ProSe key, so that the AUSF network element can directly deduce the ProSe key based on these parameters without additional acquisition when it is determined that the authentication is passed. Improve the efficiency of key derivation.
  • the method described in the first aspect may further include: if the authentication request message #3 includes: RSC and random value #1 , the authentication service network element saves the RSC and the random value #1, so that they can be directly used in the subsequent key derivation without re-obtaining, so as to further improve the efficiency of key derivation.
  • the information used to determine the ProSe key includes: an intermediate key.
  • the method described in the first aspect may further include: when the authentication of the remote terminal passes, the authentication service network element according to at least one of the following Items: service network name, RSC, random value #1, random value #2 and intermediate key to determine the ProSe key. That is to say, the authentication service network element can select appropriate parameters to determine the ProSe key according to business scenarios and key isolation requirements, so as to adapt to more business scenarios. For example, the ProSe key is determined from the RSC, random value #1, random value #2 and the intermediate key. Alternatively, the ProSe key is determined according to the service network name, random value #1, random value #2 and the intermediate key. Wherein, the intermediate key may also be determined according to the ProSe authentication vector.
  • the authentication request message #2 may include at least one of the following: authentication response information determined by the remote terminal, RSC used to determine the ProSe key, or random value #1 used to determine the ProSe key .
  • the authentication response information is used to authenticate the remote terminal. That is to say, the access and mobility management network element can send parameters for deriving the ProSe key, such as RSC and/or random value #1, to the authentication service network element only after determining that the remote terminal has passed the authentication, so that Provide necessary parameters on demand, without pre-stored information, and prevent waste of resources.
  • the authentication response message #2 may include: random value #2.
  • the random value #2 is used to determine the ProSe key, so that the remote terminal can directly deduce the ProSe key according to the random value #2 when it is determined that the authentication is passed, so as to ensure that different keys are deduced for different ProSe communications of the remote UE. Implement key isolation.
  • the authentication response message #2 may further include at least one of the following items: a user hidden identity SUPI of the remote terminal, or an EAP success message.
  • the EAP success message may be used to indicate that the network authenticates the remote terminal successfully.
  • the SUPI of the remote terminal may be used to indicate that the relay terminal needs to report the information of the remote UE to the network.
  • the authentication service network element skips deriving the key used for communication between the remote terminal and the network, so as to prevent redundant information from being generated and waste of resources.
  • the authentication request message #1 may include at least one of the following: SUCI of the remote terminal, or ProSe relay communication indication information.
  • the ProSe relay communication indication information is used to indicate that the authentication is the authentication of the ProSe relay communication, so as to trigger the data management network element to send and select the authentication vector corresponding to the ProSe relay communication, so as to ensure the reliability of the ProSe relay communication authentication.
  • a communication method includes: an access and mobility management network element sends an authentication request message #3 to an authentication service network element, and receives an authentication response message #3 from the authentication service network element.
  • the authentication response message #3 includes: ProSe authentication information #2, and the ProSe authentication information #2 includes: information for the remote terminal to authenticate the network.
  • the ProSe authentication information #2 may also include: information for the network to authenticate the remote terminal.
  • the access and mobility management network element sends an authentication request message #2 to the authentication service network element, and receives an authentication request message #2 from the authentication service network element when the remote terminal is authenticated.
  • Authentication Response Message #2 to send the ProSe key to the relay terminal.
  • the authentication request message #2 is used to request authentication of the remote terminal.
  • the authentication response message #2 includes: a ProSe key, which is used for communication between the relay terminal and the remote terminal.
  • the ProSe authentication information #2 may be at least one of the following: AKA's ProSe authentication vector #2, or an EAP request message or an AKA' challenge message.
  • the ProSe authentication vector #2 of the AKA may include at least one of the following: information for the remote terminal to authenticate the network, or information for the access and mobility management network element to authenticate the remote terminal.
  • the EAP request message or the AKA' challenge message may include: information for the remote terminal to authenticate the network.
  • the method described in the second aspect may further include: the access and mobility management network element sending information for the remote terminal to authenticate the network to the relay terminal, receiving authentication response information determined by the remote terminal from the relay terminal, and authenticating The response information is used to authenticate the remote terminal.
  • the information used for the authentication network of the remote terminal may be used to instruct the relay terminal to forward the authentication data of the ProSe relay communication to the remote terminal, that is, the information used for the authentication network of the remote terminal, so as to prevent the relay terminal from performing other operations, For example, self-authentication ensures the reliability of ProSe relay communication authentication.
  • the access and mobility management network element before the access and mobility management network element sends the information for the remote terminal authentication network to the relay terminal, the access and mobility management network element skips obtaining the key set identifier and the anti-downgrade parameter . Or the access and mobility management network element skips generating the key set identifier and anti-downgrade parameters.
  • the ProSe authentication information #2 may include: the information used for the access and mobility management network element to authenticate the remote terminal, when the access and mobility management network element receives the remote terminal authentication from the relay terminal After the response message, before the access and mobility management network element sends the authentication request message #2 to the authentication service network element
  • the method according to the second aspect may further include: the access and mobility management network element determines the authentication response according to the remote terminal message, and the information used for the access and mobility management network element to authenticate the remote terminal, to determine that the remote terminal has passed the authentication.
  • the information used for the remote terminal to authenticate the network and the authentication response information determined by the remote terminal are information protected by a communication key
  • the communication key is used for communication between the relay terminal and the network, so as to ensure that the relay terminal communicates with the network. Communication between networks is secure.
  • the communication key is a non-access stratum security key established between the relay terminal and the access and mobility management network element, and the non-access stratum security key may include an encryption key and an integrity protection key.
  • the authentication request message #2 may include at least one of the following: an authentication response message determined by the remote terminal, an RSC used to determine the ProSe key, or a random value #1 used to determine the ProSe key.
  • the authentication response message is used to authenticate the remote terminal.
  • the authentication response message #2 may include: a random value #2, and the random value #2 is used to determine the ProSe key.
  • the authentication response message #2 may also include at least one of the following: SUPI of the remote terminal, or an EAP success message.
  • the method described in the second aspect may further include: the access and mobility management network element sends a random value to the relay terminal #2. That is to say, the access and mobility management network element can send the parameter for deriving the ProSe key to the remote terminal after the remote terminal passes the network authentication, that is, the random value #2, so as to provide the necessary parameters, no pre-stored information is required to prevent resource waste.
  • the method described in the second aspect may further include: the access and mobility management network element determines that the The remote terminal has performed authentication or there is no key for deriving the ProSe key (such as KAUSF).
  • the access and mobility management network element determines that the The remote terminal has performed authentication or there is no key for deriving the ProSe key (such as KAUSF).
  • the existing key such as KAUSF
  • the existing key such as KAUSF
  • the access and mobility management network element determines that no authentication has been performed on the remote terminal or there is no key for deriving the ProSe key, which may include: the access and mobility management network element receives the remote terminal from the relay terminal terminal indication information, and the remote terminal indication information is used to indicate that the remote terminal has not performed authentication or there is no key for deriving the ProSe key.
  • the access and mobility management network element determines that ProSe relay communication authentication has not been performed on the remote terminal according to the indication information of the remote terminal.
  • the access and mobility management network element determines that no authentication has been performed on the remote terminal or there is no key for deriving the ProSe key, which may include: the access and mobility management network element sends the authentication to the data management network element
  • the service network element obtains the request message, and receives the authentication service network element obtains the response message from the data management network element.
  • the request message obtained by the authentication service network element is used to request the identification of the authentication service network element, and the authentication service network element is used for ProSe relay communication authentication of the remote terminal.
  • the response message obtained by the authentication service network element does not carry the identification of the authentication service network element, which is used to indicate that no authentication has been performed on the remote terminal or that there is no key for deriving the ProSe key.
  • the access and mobility management network element obtains a response message from the authentication service network element, and determines that no authentication has been performed on the remote terminal or there is no key used to derive the ProSe key.
  • the access and mobility management network element can use the instruction information of the remote terminal instead of communicating with Interaction with other network elements can determine whether to perform authentication of ProSe relay communication. Or, the remote terminal may not indicate whether it has performed the authentication of ProSe relay communication, and the access and mobility management network element determines it according to the information fed back by the data management network element, so that the communication between the remote terminal and the access and mobility management network can be reduced. Communication overhead between elements, improve communication efficiency.
  • a communication method includes: the data management network element receives the authentication request message #1 from the authentication service network element, and sends the authentication response message #1 to the authentication service network element.
  • the authentication response message #1 includes: ProSe authentication information #1.
  • the ProSe authentication information #1 includes at least one of the following items: information for the remote terminal to authenticate the network, or information for authenticating the remote terminal.
  • the ProSe authentication information #1 may be at least one of the following: ProSe authentication vector #1 of AKA, or ProSe authentication vector of EAP-AKA'.
  • the ProSe authentication vector #1 of AKA or the ProSe authentication vector of EAP-AKA' may include at least one of the following: information for the remote terminal to authenticate the network, information for the authentication service network element to authenticate the remote terminal information, or information used to determine the ProSe key.
  • the method described in the third aspect may further include: the data management network element receives the authentication service from the access and mobility management network element The network element obtains the request message, and sends the authentication service network element obtains a response message to the access and mobility management network element.
  • the request message obtained by the authentication service network element is used to request the identification of the authentication service network element, and the authentication service network element is used for ProSe relay communication authentication of the remote terminal.
  • the response message obtained by the authentication service network element does not carry the identification of the authentication service network element, which is used to indicate that the remote terminal has not been authenticated for the ProSe relay communication.
  • the method described in the third aspect may further include: the data management network element determines that the remote terminal is authorized to obtain the relay service . That is to say, ProSe relay communication authentication is performed on the remote terminal only after it is determined that it has the authority to relay communication, so as to avoid invalid authentication.
  • the method described in the third aspect may further include: the data management network element determines the ProSe Authentication information #1.
  • the method described in the third aspect may further include: the data management network element determines that no authentication has been performed on the remote terminal , or it is determined that there is no key for deriving the ProSe key, or it is determined that there is no AUSF network element serving the remote terminal.
  • the data management network element determines that no authentication has been performed on the remote terminal , or it is determined that there is no key for deriving the ProSe key, or it is determined that there is no AUSF network element serving the remote terminal.
  • the data management network element can request the authentication service network element to use the existing key (such as KAUSF) to deduce the ProSe key, without performing the ProSe relay communication authentication again.
  • a communication method includes: the relay terminal receives the information for the remote terminal authentication network from the access and mobility management network element, and sends the authentication response information determined by the remote terminal to the access and mobility management network element.
  • the authentication response information determined by the remote terminal is used to authenticate the remote terminal.
  • the relay terminal receives the ProSe key from the access and mobility management network element, and the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the information for the remote terminal to authenticate the network and the authentication response information determined by the remote terminal are messages protected by a communication key, and the communication key is used for communication between the relay terminal and the network.
  • the communication key is a non-access stratum security key established between the relay terminal and the access and mobility management network, and the non-access stratum security key may include an encryption key and an integrity protection key.
  • the relay terminal after the relay terminal receives the information for the remote terminal authentication network from the access and mobility management network element, the relay terminal sends the remote terminal confirmation to the access and mobility management network element.
  • the method described in the fourth aspect may further include: the relay terminal sends information for the remote terminal to authenticate the network to the remote terminal, and receives the authentication response information determined by the remote terminal from the remote terminal . That is to say, the relay terminal can actively interact with the remote terminal to ensure that the remote terminal can authenticate the network, and feed back its own authentication response message to the network to ensure that the network can also authenticate the remote terminal.
  • the information for the remote terminal to authenticate the network is carried in a message, and the name of the message or the indication information carried may indicate that the remote terminal needs to perform the authentication process of the ProSe relay communication or indicate that the authentication of the remote UE is requested .
  • the relay terminal sending the information for the remote terminal authentication network to the remote terminal may include: the relay terminal sends the information for the remote terminal authentication network to the remote terminal according to the message, so as to ensure ProSe relay communication Certified reliability.
  • the relay terminal sends information for the remote terminal to authenticate the network to the remote terminal according to the name of the message or the indication information contained in the message.
  • the method described in the fourth aspect may further include: the relay terminal receives the message from the access and mobility management network element. Random value #2 of the network element, and send random value #2 to the remote terminal. Random value #2 is used to determine the ProSe key.
  • a communication method includes: the remote terminal receives information for the remote terminal to authenticate the network from the relay terminal. In this way, when the remote terminal determines that the authentication network passes, the remote terminal sends the authentication response information determined by the remote terminal to the relay terminal, where the authentication response information is used to authenticate the remote terminal.
  • the method further includes: the remote terminal receives the random value #2 from the relay terminal, and performs the following at least one Items: service network name, RSC, random value #1, random value #2 and intermediate key to determine the ProSe key, which is used for the communication between the relay terminal and the remote terminal.
  • the method further includes: the remote terminal skips deriving the key used for communication between the remote terminal and the network, such as Skip the KSEAF deduction.
  • a communication device in a sixth aspect, includes: modules for executing the communication method described in the first aspect, such as a receiving module and a sending module.
  • the sending module and the receiving module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the sending function and the receiving function of the communication device described in the sixth aspect.
  • the communication device described in the sixth aspect may further include a processing module.
  • the processing module is used to realize the processing function of the communication device.
  • the communication device described in the sixth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device can execute the communication method described in the first aspect.
  • the communication device described in the sixth aspect may be a network device, such as an authentication service network element, or a chip (system) or other components or components that can be set in the network device, or it may include a network device device, which is not limited in this application.
  • a communication device in a seventh aspect, includes: for performing the communication described in the second aspect Method modules, such as Receive and Send modules.
  • the sending module and the receiving module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the sending function and the receiving function of the communication device described in the seventh aspect.
  • the communication device described in the seventh aspect may further include a processing module.
  • the processing module is used to realize the processing function of the communication device.
  • the communication device described in the seventh aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device can execute the communication method described in the second aspect.
  • the communication device described in the seventh aspect may be a network device, such as an access and mobility management network element, or a chip (system) or other components or components that can be set in the network device, or a A device including network equipment is not limited in this application.
  • a communication device includes: modules for executing the communication method described in the third aspect, such as a receiving module and a sending module.
  • the sending module and the receiving module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the sending function and the receiving function of the communication device described in the eighth aspect.
  • the communication device described in the eighth aspect may further include a processing module.
  • the processing module is used to realize the processing function of the communication device.
  • the communication device described in the eighth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device can execute the communication method described in the third aspect.
  • the communication device described in the eighth aspect may be a network device, such as a data management network element, or a chip (system) or other components or components that can be set in the network device, or it may include a network device device, which is not limited in this application.
  • a communication device includes: modules for executing the communication method described in the fourth aspect, such as a receiving module and a sending module.
  • the sending module and the receiving module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to implement the sending function and receiving function of the communication device described in the ninth aspect.
  • the communication device described in the ninth aspect may further include a processing module.
  • the processing module is used to realize the processing function of the communication device.
  • the communication device described in the ninth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device can execute the communication method described in the fourth aspect.
  • the communication device described in the ninth aspect may be a terminal, such as a relay terminal, or a chip (system) or other components or components that can be set in the terminal, or a device that includes a terminal. Applications are not limited to this.
  • a communication device in a tenth aspect, includes: modules for implementing the communication method described in the fifth aspect, such as a receiving module and a sending module.
  • the sending module and the receiving module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the sending function and the receiving function of the communication device described in the tenth aspect.
  • the communication device described in the tenth aspect may further include a processing module.
  • the processing module is used to realize the processing function of the communication device.
  • the communication device described in the tenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device can execute the communication method described in the fifth aspect.
  • the communication device described in the tenth aspect may be a terminal, such as a remote terminal, or a chip (system) or other components or components that can be set in the terminal, or a device that includes a terminal. Applications are not limited to this.
  • a communication device in an eleventh aspect, includes: a processor, configured to execute the communication method described in any one possible implementation manner of the first aspect to the fifth aspect.
  • the communication device described in the eleventh aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the communication device described in the eleventh aspect to communicate with other communication devices.
  • the communication device described in the eleventh aspect may further include a memory.
  • the memory can be integrated with the processor or set separately.
  • the memory may be used to store computer programs and/or data involved in the communication method described in any one of the first to fifth aspects.
  • the communication device described in the eleventh aspect may be the network device in the first aspect, the second aspect, or the third aspect, or the terminal in the fourth aspect or the fifth aspect, or may be set in the terminal Or a chip (system) or other components or components in a network device, or a device that includes the terminal or network device.
  • a communication device in a twelfth aspect, includes: a processor, the processor is coupled with the memory, and the processor is used to execute the computer program stored in the memory, so that the communication device executes any one of the possible implementation manners in the first aspect to the fifth aspect. communication method.
  • the communication device described in the twelfth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the communication device described in the eighth aspect to communicate with other communication devices.
  • the communication device described in the twelfth aspect may be the network device in the first aspect, the second aspect, or the third aspect, or the terminal in the fourth aspect or the fifth aspect, or may be set in the terminal Or a chip (system) or other components or components in a network device, or a device that includes the terminal or network device.
  • the technical effect of the communication device described in the twelfth aspect can refer to any of the first to fifth aspects
  • the technical effect of the communication method described in an implementation manner is intended, which will not be repeated here.
  • a thirteenth aspect provides a communication device, including: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the communication device executes the first aspect to the fifth aspect
  • the communication device may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the communication device described in the thirteenth aspect to communicate with other communication devices.
  • the communication device described in the thirteenth aspect may be the network device in the first aspect, the second aspect, or the third aspect, or the terminal in the fourth aspect or the fifth aspect, or may be set in the terminal Or a chip (system) or other components or components in a network device, or a device that includes the terminal or network device.
  • a communication device including: a processor; the processor is configured to be coupled with a memory, and after reading the computer program in the memory, execute according to the computer program as in the first aspect to the fifth aspect Any one of the communication methods described in the implementation manner.
  • the communication device according to the fourteenth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the communication device described in the fourteenth aspect to communicate with other communication devices.
  • the communication device described in the fourteenth aspect may be the network device in the first aspect, the second aspect, or the third aspect, or the terminal in the fourth aspect or the fifth aspect, or may be set in the terminal Or a chip (system) or other components or components in a network device, or a device that includes the terminal or network device.
  • a communication system includes: one or more terminal devices described in the fourth aspect or the fifth aspect, such as relay terminals and remote terminals, and one or more network devices described in the first aspect, the second aspect or the third aspect , such as authentication service network, access and mobility management network element and data management network element.
  • a computer-readable storage medium including: a computer program or instruction; when the computer program or instruction is run on a computer, it causes the computer to execute any one of the possible methods in the first aspect to the fifth aspect. Implement the communication method described in the manner.
  • a computer program product including computer programs or instructions.
  • the computer program or instructions When the computer program or instructions are run on a computer, the computer is made to execute any one of the possible implementations of the first aspect to the fifth aspect. the communication method described above.
  • Figure 1 is a schematic diagram of the architecture of 5G
  • FIG. 2 is a schematic diagram of a Layer 3 relay architecture
  • FIG. 3 is a schematic diagram of a Layer 2 relay architecture
  • FIG. 4 is a schematic flow diagram of establishing a secure connection for ProSe communication
  • Figure 5 is a schematic flow diagram of the main authentication process
  • Figure 6 is the second schematic flow diagram of the main authentication process
  • FIG. 7 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 8 is a first schematic flow diagram of a communication method provided by an embodiment of the present application.
  • FIG. 9 is a second schematic flow diagram of the communication method provided by the embodiment of the present application.
  • FIG. 10 is a third schematic flow diagram of the communication method provided by the embodiment of the present application.
  • FIG. 11 is a fourth schematic flow diagram of the communication method provided by the embodiment of the present application.
  • FIG. 12 is a schematic flow diagram five of the communication method provided by the embodiment of the present application.
  • FIG. 13 is a sixth schematic flow diagram of the communication method provided by the embodiment of the present application.
  • FIG. 14 is a schematic flow diagram VII of the communication method provided by the embodiment of the present application.
  • FIG. 15 is a first structural schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG. 16 is a second structural schematic diagram of a communication device provided by an embodiment of the present application.
  • the fifth generation (5th generation, 5G) mobile communication system :
  • FIG. 1 is a schematic diagram of the architecture of the 5G system.
  • the 5G system includes: an access network (access network, AN) and a core network (core network, CN), and may also include: a terminal.
  • access network access network
  • core network core network
  • the above-mentioned terminal may be a terminal having a transceiver function, or a chip or a chip system that may be provided in the terminal.
  • the terminal may also be called user equipment (uesr equipment, UE), access terminal, subscriber unit (subscriber unit), subscriber station, mobile station (mobile station, MS), mobile station, remote station, remote terminal, mobile device, User terminal, terminal, wireless communication device, user agent or user device.
  • the terminal in the embodiment of the present application can be mobile phone (mobile phone), cellular phone (cellular phone), smart phone (smart phone), tablet computer (Pad), wireless data card, personal digital assistant computer (personal digital assistant, PDA) ), wireless modem (modem), handheld device (handset), laptop computer (laptop computer), machine type communication (machine type communication, MTC) terminal, computer with wireless transceiver function, virtual reality (virtual reality, VR) Terminals, augmented reality (augmented reality, AR) terminals, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, smart grid wireless terminal in grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, vehicle-mounted terminal, roadside unit with terminal function (road side unit, RSU) and so on.
  • the terminal of the present application may also be an on-vehicle module, on-vehicle module, on-vehicle component, on-vehicle chip, or on-vehicle unit built into the vehicle as one or more components or
  • the above-mentioned AN is used to implement access-related functions, and can provide network access functions for authorized users in a specific area, and can determine transmission links of different qualities to transmit user data according to user levels and service requirements.
  • the AN forwards control signals and user data between the terminal and the CN.
  • the AN may include: an access network device, which may also be called a radio access network (radio access network, RAN) device.
  • radio access network radio access network
  • the RAN device can be a device that provides access for terminals, and is mainly responsible for radio resource management and service on the air interface side. Service quality (quality of service, QoS) management, data compression and encryption and other functions.
  • the RAN equipment may include 5G, such as a gNB in a new radio (new radio, NR) system, or one or a group (including multiple antenna panels) antenna panels of a base station in 5G, or it may also be a gNB, a transmission Point (transmission and reception point, TRP or transmission point, TP) or transmission measurement function (transmission measurement function, TMF) network node, such as baseband unit (building base band unit, BBU), or centralized unit (centralized unit, CU ) or a distributed unit (DU), an RSU with a base station function, or a wired access gateway, or a 5G core network element.
  • 5G such as a gNB in a new radio (new radio, NR) system, or one or a group (including multiple antenna panels
  • the RAN device may also include an access point (access point, AP) in a wireless fidelity (wireless fidelity, WiFi) system, a wireless relay node, a wireless backhaul node, various forms of macro base stations, micro base stations (also known as small stations), relay stations, access points, wearable devices, vehicle-mounted devices, and more.
  • the RAN equipment may also include next-generation mobile communication systems, such as 6G access network equipment, such as 6G base stations, or in the next-generation mobile communication system, the network equipment may also have other naming methods, which are covered in this document Within the protection scope of the embodiments of the application, this application does not make any limitation thereto.
  • the CN is mainly responsible for maintaining the subscription data of the mobile network, and providing functions such as session management, mobility management, policy management, and security authentication for the terminal.
  • CN mainly includes the following network elements: user plane function (user plane function, UPF) network element, authentication server function (authentication server function, AUSF) network element, access and mobility management function (access and mobility management function, AMF) network Element, session management function (session management function, SMF) network element, network slice selection function (network slice selection function, NSSF) network element, network exposure function (network exposure function, NEF) network element, network function repository function (NF repository function (NRF) network elements, policy control function (policy control function, PCF) network elements, unified data management (unified data management, UDM) network elements, application function (application function, AF) network elements, and network slices and independent Public network (standalone non-public network, SNPN) authentication and authorization function (network slice-specific and SNPN authentication and authorization function, NSSAAF) network element.
  • UPF user
  • the UPF network element is mainly responsible for user data processing (forwarding, receiving, charging, etc.).
  • a UPF network element may receive user data from a data network (data network, DN), and forward the user data to a terminal through an access network device.
  • the UPF network element can also receive user data from the terminal through the access network equipment, and forward the user data to the DN.
  • a DN network element refers to an operator network that provides data transmission services for users. For example, internet protocol (internet protocol, IP) multimedia service (IP multi-media service, IMS), Internet (internet) and so on.
  • IP internet protocol
  • IMS Internet
  • the DN may be an external network of the operator, or a network controlled by the operator, and is used to provide business services to the terminal equipment.
  • AUSF network elements can be used to perform terminal security authentication.
  • the AMF network element is mainly responsible for the mobility management in the mobile network. For example, user location update, user registration network, user switching, etc.
  • the SMF network element is mainly responsible for session management in the mobile network. Such as session establishment, modification, release. Specific functions such as assigning Internet protocol (internet protocol, IP) addresses to users, selecting UPFs that provide message forwarding functions, and the like.
  • IP Internet protocol
  • the PCF network element mainly supports the provision of a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is responsible for obtaining user subscription information related to policy decisions.
  • PCF network elements can send to AMF network
  • the element and the SMF network element provide policies, such as a quality of service (quality of service, QoS) policy, a slice selection policy, and the like.
  • QoS quality of service
  • NSSF network elements can be used to select network slices for terminals.
  • NEF network elements can be used to support the opening of capabilities and events.
  • UDM network elements can be used to store user data, such as subscription data, authentication/authorization data, and so on.
  • the AF network element mainly supports interaction with the CN to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • NSSAAF network elements can be used to support slice authentication and authorization, and to support access to independent non-public networks using the credentials of the credential holder.
  • NSSAAF network elements can interact with authentication, authorization, and accounting server (authentication, authorization, and accounting server, AAA-S) through authentication, authorization, and accounting proxy (AAA-P).
  • AAA-S authentication, authorization, and accounting server
  • AAA-P authentication, authorization, and accounting proxy
  • SCP Service Communication Proxy
  • SCP Service Communication Proxy
  • D2D device-to-device
  • D2D communication allows direct communication between UEs, for example, through a PC5 interface, to realize information transmission on the data plane and the control plane. In this way, the user can share spectrum resources with other cell users under the control of the cell network, effectively improving the utilization rate of spectrum resources.
  • D2D communication includes: one to many communication (one to many communication), and one to one communication (one to one communication).
  • One-to-many communication generally corresponds to multicast and broadcast communication, and one-to-many communication generally corresponds to unicast communication. In one-to-one communication, if the sender UE and the receiver UE are within a short distance, they can communicate directly after mutual discovery.
  • Proximity based services (ProSe) communication
  • ProSe communication also known as short-distance service communication, is a typical service scenario in D2D communication.
  • ProSe communication may include ProSe direct communication and ProSe UE-to-network relay communication.
  • ProSe relay communication For adjacent service UE-to-network relay communication (referred to as ProSe relay communication), when a certain UE (denoted as UE1) is out of network coverage, or the communication signal with RAN equipment is not good, or other UEs (denoted as UE1) are needed In the case of UE2) assisting in data transmission, UE1 can acquire services from the network with the assistance of UE2.
  • UE1 may be called a ProSe remote UE (ProSe remote UE), or a 5G ProSe remote UE (5G ProSe remote UE), or simply a remote UE (remote UE).
  • UE2 can be called ProSe UE-to-network relay (ProSe UE-to-network relay), or 5G ProSe UE-to-network relay (5G ProSe UE-to-network relay), or simply called relay UE (relay UE).
  • the relay UE can be used to provide the ProSe function that supports the connection of the remote UE to the network, so that the remote UE can communicate with the DN through the ProSe function provided by the relay UE, that is, ProSe relay communication.
  • the third generation partnership project (3rd generation partnership project, 3GPP) introduces a layer 3 relay architecture and a layer 2 relay architecture. Introduce respectively below.
  • FIG. 2 is a schematic diagram of a Layer 3 relay architecture.
  • the remote UE establishes PC5 with the relay UE Connection, the relay UE accesses the core network (5GC) through the RAN equipment.
  • the remote UE is connected through the PC5, and the core network that the relay UE accesses, obtains services from the DN, and realizes ProSe communication.
  • the relay UE can establish or modify a protocol data unit (protocol data unit, PDU) session for the remote UE, and notify the SMF network element to store the relevant information of the remote UE in the session management (session management, SM) context middle.
  • PDU protocol data unit
  • the remote UE can obtain services from the DN by relaying the PDU session of the UE, and realize ProSe communication.
  • the relay UE can also establish or modify a PDU session for the remote UE, so that the remote UE can perform a key exchange protocol (internet key exchange, IKE) process and a non-3GPP interworking function (non-3GPP) through the PDU session.
  • IKE Internet key exchange
  • non-3GPP non-3GPP interworking function
  • the interworking function (N3IWF) establishes a signaling Internet security protocol (internet protocol security, IPsec) tunnel, and executes a non-access stratum (non-access stratum, NAS) registration process.
  • the remote UE can establish the PDU session of the remote UE through the PDU session established by the relay UE and the N3IWF, and obtain services from the DN to realize ProSe relay communication.
  • the relay UE may be located in a home public land mobile network (public land mobile network, PLMN), or may be located in a visited PLMN, which is not specifically limited.
  • FIG. 3 is a schematic diagram of a Layer 2 relay architecture.
  • the remote UE establishes a PC5 connection with the relay UE, and the relay UE establishes a Uu interface connection with the RAN device.
  • the RAN device can be connected to the core network accessed by the remote UE, and can also be connected to the core network accessed by the relay UE.
  • the remote UE establishes a radio resource connection with the RAN through the established PC5 connection, and further establishes a non-stradum (NAS) connection with the core network.
  • NAS non-stradum
  • a PDU session can be established, services can be obtained from the DN, and ProSe relay communication can be realized.
  • the remote UE can access the network through the relay UE and establish or modify its own PDU session to obtain services from the DN through the PDU session to implement ProSe relay communication.
  • the core network accessed by the remote UE and the core network accessed by the relay UE may be the same PLMN or different PLMNs, which is not specifically limited.
  • the remote UE may be called a 5G ProSe layer 2 remote UE, a ProSe layer 2 remote UE, or a layer 2 remote UE.
  • the remote UE can be called a 5G ProSe layer 3 remote UE, a ProSe layer 3 remote UE, or a layer 3 remote UE.
  • the remote UE mentioned below can be understood as a remote UE in a layer 2 relay architecture or a layer 3 relay architecture, and its name can also be replaced accordingly.
  • the relay UE can be called a 5G ProSe layer 2 relay UE, a ProSe layer 2 relay UE, or a layer 2 relay UE.
  • a relay UE may be called a 5G ProSe layer 3 relay UE, a ProSe layer 3 relay UE, or a layer 3 relay UE.
  • the relay UE mentioned below can be understood as a relay UE in a layer 2 relay architecture or a layer 3 relay architecture, and its name can also be replaced accordingly.
  • FIG. 4 is a schematic diagram of the process of establishing a secure ProSe relay communication, as shown in Figure 4, the process includes the following steps:
  • the remote UE registers with the network, and performs authentication and authorization with the network.
  • the relay UE registers with the network, and performs authentication and authorization with the network.
  • the remote UE can register with the network through the AMF network element serving the remote UE (denoted as the remote AMF network element).
  • the relay UE can serve the AMF network element of the relay UE (denoted as the relay AMF network element yuan) to register with the network.
  • the remote AMF network element and the relay AMF network element may be the same network element or different network elements, which is not specifically limited.
  • the remote UE performs a relay discovery process.
  • the remote UE If the remote UE wants to use the ProSe relay to communicate, it will discover the relay UE by performing a relay discovery process.
  • the remote UE sends a direct communication request (direct communication request) message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the Direct Communication Request message may be used by the remote UE to request communication with the relay UE.
  • the direct communication request message may include the following parameters of the remote UE: security capability, security policy, subscription concealed identifier (SUCI), relay service code (relay service code, RSC), and Nonce_1.
  • security capability is used to indicate the encryption and/or integrity protection algorithm supported by the remote UE.
  • the security policy is used to indicate whether to enable security protection, where the security protection includes encryption protection and/or integrity protection. For example, a security policy may contain that encryption is required or recommended or not required; and/or integrity protection is required or recommended or not required.
  • the RSC is used to identify a connection service that the relay UE can provide to the remote UE.
  • Nonce_1 is a random number generated by the remote UE, and is used to derive the key K NR_ProSe for secure communication between the remote UE and the relay UE.
  • the remote UE and the relay UE generate security keys for communication based on K NR_ProSe , such as encryption keys and/or integrity keys.
  • the relay UE sends a relay key request (relay key request) message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request relay communication, or to request a key for ProSe communication.
  • the relay key request message may include: the identifier of the relay UE, the SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element verifies the relay UE according to the identifier of the relay UE, so as to determine that the relay UE is authorized to provide services as a relay.
  • the relay AMF network element sends a UE authentication request (Kausf_UEAuthentication_Authenticate Request) message to the remote AUSF network element.
  • the remote AUSF network element receives the UE authentication request message from the relay AMF network element.
  • the UE authentication request message may include: SUCI, RSC, and Nonce_1 of the remote UE.
  • the remote AUSF network element executes a UE authentication obtaining (Nudm_UEAuthentication_Get) process.
  • the remote AUSF network element can execute the UE authentication obtaining process according to the UE authentication request message, so as to obtain the authentication vector from the remote UDM network element.
  • the remote UDM network element may be a UDM network element serving the remote UE.
  • the remote AUSF network element executes a primary authentication process (Primary authentication of Remote UE) for the remote UE.
  • the remote UE determines the 5GPRUK and the 5GPRUK ID.
  • the remote UE After the remote UE authenticates the network through the main authentication process, it can determine the 5GPRUK and the 5GPRUK ID. For example, the remote UE can derive the 5GPRUK and the 5GPRUK ID according to the key derived in the main authentication process, such as K AUSF . 5GPRUK is used to deduce the key for secure communication between the remote UE and the relay UE. 5GPRUK ID is used to locate 5GPRUK.
  • the remote AUSF network element determines the 5GPRUK and the 5GPRUK ID.
  • the remote AUSF network element After the remote AUSF network element passes the main authentication process to authenticate the remote UE, it can also determine the 5GPRUK and 5GPRUK ID. For example, the remote AUSF network element can also derive the 5GPRUK and 5GPRUK ID according to the key deduced in the main authentication process, for example, the K AUSF .
  • the execution order of S411 and S410 is not limited.
  • the remote AUSF network element deduces K NR_ProSe .
  • K NR_ProSe can be deduced according to 5GPRUK, Nonce_1 and Nonce_2.
  • Nonce_2 is a random number generated by the remote AUSF network element.
  • the remote AUSF network element sends a UE authentication response (Nausf_UEAuthentication_Authenticate response) message to the relay AMF network element.
  • the relay AMF network element receives the UE authentication response message from the remote AUSF network element.
  • the UE authentication response message is a response message to the UE authentication request message, and is used to indicate that the ProSe communication authentication is passed.
  • the UE authentication response message may include: K NR_ProSe , 5GPRUK ID, and Nonce_2.
  • the relay AMF network element sends a relay key response (Relay Key Response) message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay key response message is mainly used to configure K NR_ProSe for the relay UE.
  • the relay key response message may include: K NR_ProSe , 5GPRUK ID, and Nonce_2.
  • the relay UE sends a direct security mode command (direct security mode recommend) message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • the direct security mode command message is used to instruct the remote UE to determine K NR_ProSe .
  • the direct security mode command message may include: 5GPRUK ID, and Nonce_2.
  • the remote UE deduces K NR_ProSe .
  • the remote UE After receiving the direct security mode command message, the remote UE can locate the 5GPRUK used to establish the PC5 connection according to the 5GPRUK ID, so as to deduce K NR_ProSe according to the 5GPRUK, Nonce_1 and Nonce_2.
  • the remote UE sends a direct security mode command complete (direct security mode recommend complete) message to the relay UE.
  • the remote UE receives the direct security mode command completion message from the relay UE.
  • 3GPP roughly defines the security process of ProSe communication, that is, ProSe communication needs to be authenticated through the main authentication process, and K NR_ProSe is deduced after the authentication is passed to ensure the security of ProSe communication.
  • the main authentication process is introduced below.
  • FIG. 5 is a flow diagram 1 of the main authentication process in 3GPP, as shown in Figure 5, the process includes the following steps:
  • the UE sends an N1 message to a security anchor function (security anchor function, SEAF).
  • SEAF security anchor function
  • the SEAF receives the N1 message from the UE.
  • the SEAF can be deployed on the AMF network element or any other possible network elements, or deployed independently, which is not specifically limited.
  • the N1 message may be a registration request (register request) message, which is used for the UE to request to register with the network.
  • the N1 message may include: the identity of the UE, for example, SUCI, or 5G-globally unique temporary UE identity (GUTI).
  • GUI 5G-globally unique temporary UE identity
  • the SEAF sends a UE authentication request (Nausf_UEAuthentication_Authenticate Request) message to the AUSF network element.
  • the AUSF network element receives UE Authentication Request message from SEAF.
  • the UE authentication request message is used to request the AUSF network element to perform the authentication process.
  • the UE authentication request message may include: SUCI or subscriber permanent identifier (subscription permanent identifier, SUPI), service network name (service network name, SN-name).
  • SEAF can determine that the 5G-GUTI is valid and needs to re-authenticate the UE. Then, SEAF should carry SUPI in the UE authentication request message, otherwise it should carry SUCI.
  • the AUSF network element sends a UE authentication obtaining request (Nudm_UEAuthentication_Get Request) message to the UDM network element.
  • the UDM network element receives the UE authentication obtaining request message from the AUSF network element.
  • the UE authentication obtaining request message is used to request the UDM network element to generate an authentication vector for subsequent authentication.
  • the UE authentication obtaining request message may include: SUCI or SUPI, service network name.
  • the AUSF network element may verify the service network name, for example, compare the service network name carried in the UE authentication request message with the expected service network name. If the serving network name carried in the UE authentication request message matches the expected serving network name, the AUSF network element determines that the SEAF has the right to use the serving network name, and sends a UE authentication obtaining request message to the UDM network element. If the service network name carried in the UE authentication request message does not match the expected service network name, the AUSF network element determines that SEAF is not authorized to use the service network name, the process ends, and sends a message to SEAF to indicate that the service network is not authorized. authorized.
  • the UDM network element selects an authentication mode.
  • the UDM network element can call the subscription identifier de-concealing function (SIDF) to parse the SUCI and obtain the SUPI.
  • SIDF subscription identifier de-concealing function
  • the UDM network element, or the UDM network element can call the authentication credential repository and processing function (authentication credential repository and processing function, ARPF) to select the authentication method supported in the subscriber data according to the SUPI.
  • ARPF authentication credential repository and processing function
  • the UDM network element/ARPF determines to select the 5G authentication and key agreement (authentication and key agreement, AKA) mechanism.
  • the UDM network element generates an authentication vector.
  • the UDM network element/ARPF can generate an authentication vector corresponding to the 5G AKA mechanism, such as a 5G home environment authentication vector (5G HE AV).
  • the authentication vector may include: random number (RAND), authentication token (authentication token, AUTN), XRES* and K AUSF .
  • RAND and AUTN are used for UE authentication network.
  • XRES* can be used for AUSF network element authentication UE.
  • K AUSF can be used to protect information sent to the UE, and can also be used for key derivation to obtain a key for subsequent communication, such as K AMF .
  • XRES* and K AUSF can be derived from the root key and RAND.
  • the UDM network element/ARPF can generate some parameters, including: Message Authentication Code (MAC), Expected Response (XRES), Encryption Key (CK), Integrity Key (IK), and Anonymity Key (AK ).
  • MAC is calculated by f1 algorithm from serial number (SQN), RAND, AMF and root key.
  • XRES is calculated by RAND and root key through algorithm f2.
  • CK is calculated from the root key and RAND by f3 algorithm.
  • IK is calculated from the root key and RAND by the f4 algorithm.
  • AK is calculated from the root key and RAND by the f5 algorithm.
  • UDM network element/ARPF can obtain AUTN, AUTN includes: AK and SQN XOR (SQN XOR AK) and AMF and MAC in series
  • the UDM network element/ARPF can deduce XRES* based on XRES and RAND, and the following parameters are also used in the deduction process, such as the service network name, the length of the service network name, and the length of RAND.
  • the UDM network element/ARPF can also deduce K AUSF according to IK and CK. So far, the parameters contained in the authentication vector have been deduced, that is, the authentication vector is generated.
  • the UDM network element sends a UE authentication obtaining response (Nudm_UEAuthentication_Get Response) message to the AUSF network element.
  • the AUSF network element receives the UE authentication obtaining response message from the UDM network element.
  • the UE authentication obtaining response message is a response message of the above UE authentication obtaining request message.
  • the UE authentication obtaining response message may include: an authentication vector and indication information, where the indication information is used to indicate that the authentication vector is used for 5G AKA.
  • the UE authentication obtaining response message may further include: SUPI.
  • AUSF network element stores XRES*, deduces HXRES* and K SEAF .
  • the AUSF network element can store XRES*, or XRES* and SUPI for subsequent authentication.
  • AUSF network elements can deduce HXRES* based on XRES*, and the HXRES* can be used for SEAF authentication UE.
  • the AUSF network element can also deduce K SEAF according to K AUSF , and the K SEAF can be used for SEAF key derivation to obtain K AMF .
  • the AUSF network element sends a UE authentication response (Nausf_UEAuthentication_Authenticate Response) message to the SEAF.
  • the SEAF receives the UE authentication response message from the AUSF network element.
  • the UE authentication response message is a response message to the above UE authentication request message.
  • the UE authentication response message may include: an authentication vector, such as a 5G serving environment authentication vector (5G serving environment authentication vector, 5G SE AV).
  • Authentication vectors may include: RAND, AUTN, and HXRES*. That is to say, the AUSF network element replaces XRES* in the authentication vector with HXRES*, and removes KAUSF in the authentication vector to obtain the authentication vector.
  • the SEAF sends an authentication request (authenticate request) message to the UE.
  • the UE receives the authentication request message from the SEAF.
  • the authentication request message may be a NAS message, used to request the UE to authenticate the network.
  • the authentication request message may include: RAND, AUTN, 5G key set identifier (key set identifier in 5G, ngKSI), and anti-bidding down between architectures (ABBA) parameters between different architectures.
  • ngKSI can be determined by SEAF, and is used for UE and AMF network elements to identify KAMF and some native security contexts.
  • ABBA parameters can be determined by SEAF and used to deduce K AMF .
  • RES* is used to authenticate UE.
  • the UE may include: a mobile equipment (mobile equipment, ME) and a universal subscriber identity module (universal subscriber identity module, USIM).
  • the USIM can verify the AUTN according to the RAND and its own root key. If the USIM fails to verify the AUTN, it means that the UE fails to authenticate the network, and the process ends. If the USIM passes the verification of the AUTN, it means that the UE has passed the authentication of the network.
  • USIM can use the root key and RAND to deduce RES, CK and IK, and send RES, CK and IK to ME.
  • ME can deduce K AUSF according to CK and IK, and then deduce K AUSF according to K AUSF Play K SEAF .
  • the ME may also deduce RES* according to RES, and then perform S511.
  • the UE sends an authentication response (authenticate response) message to the SEAF.
  • the SEAF receives the authentication response message from the UE.
  • the authentication response message may be a NAS message, which is used to respond to the above authentication request message.
  • the authentication response message may include: RES*.
  • the SEAF authenticates the UE.
  • SEAF can deduce HRES* based on RES* to compare HRES* with the previously obtained HXRES*. If the HRES* and HXRES* do not match, it means that the UE fails to be authenticated, and the authentication process ends. If the HRES* matches the HXRES*, it means that the authentication of the UE is passed, or in other words, from the perspective of the service network, it is considered that the authentication is passed, and then S513 is executed.
  • the SEAF sends a UE authentication request message to the AUSF network element.
  • the AUSF network element receives the UE authentication request message from the SEAF.
  • the UE Authentication Request message is used to request authentication of the UE.
  • the UE authentication request message may include: RES*.
  • the AUSF network element authenticates the UE.
  • the AUSF network element can compare RES* with the previously saved XRES*. If RES* and XRES* do not match, it means that the UE fails to be authenticated, and the procedure ends. If the RES* matches the XRES*, it means that the UE has passed the authentication, or in other words, from the perspective of the home network, it is considered that the authentication is passed, and then S515 is executed.
  • the AUSF network element may also determine to store K AUSF according to the policy of the local network operator.
  • the AUSF network element sends a UE authentication response message to the SEAF.
  • the SEAF receives the UE authentication response message from the AUSF network element.
  • the UE authentication response message is a response message to the UE authentication request message, and is used to indicate that the UE passes the authentication.
  • the UE authentication response message may include: K SEAF .
  • the UE authentication response message may further include: SUPI.
  • SEAF can deduce K AMF according to K SEAF , ABBA parameters, and SUPI, and send ngKSI and K AMF to the AMF network element.
  • SEAF should provide ngKSI and K AMF to the AMF network element after receiving the UE authentication response message, that is, the UE authentication response message containing SUPI, So that before this, the service network will not provide communication services for the UE.
  • the UE may also deduce K AMF by itself according to K SEAF , ABBA parameters, and SUPI after determining that the authentication is passed. So far, both the UE and the AMF network element have obtained the same key, that is, K AMF , and both parties can use this key to further deduce the encryption key and/or the integrity protection key, and use the deduced key to pair the UE and the AMF Information between network elements is protected to ensure communication security.
  • Fig. 6 is the second schematic flow diagram of the main authentication flow in 3GPP. As shown in Fig. 6, the flow includes the following steps:
  • UE sends N1 message to SEAF.
  • the SEAF receives the N1 message from the UE.
  • the SEAF sends a UE authentication request message to the AUSF network element.
  • the AUSF network element receives the UE authentication request message from the SEAF.
  • the AUSF network element sends a UE authentication obtaining request message to the UDM network element.
  • the UDM network element receives the UE authentication obtaining request message from the AUSF network element.
  • the UDM network element selects an authentication mode.
  • the UDM network element can invoke the SIDF to parse the SUCI and obtain the SUPI.
  • the UDM network element, or the UDM network element can call the ARPF to select the authentication method supported in the subscriber data according to the SUPI.
  • the UDM network element/ARPF determines to select the extensible authentication protocol (extensible authentication protocol, EAP)-AKA' mechanism.
  • the UDM network element generates an authentication vector.
  • the UDM network element/ARPF can generate the authentication vector corresponding to the EAP-AKA' mechanism, such as the transformed authentication vector AV' (transformed authentication vector).
  • Authentication vectors may include: RAND, AUTN, XRES, and CK' and IK'.
  • RAND, AUTN and XRES can refer to the relevant introduction in the above S505, and will not be repeated here.
  • CK' and IK' can be derived from the root key and RAND.
  • the UDM network element/ARPF deduces CK and IK, and then deduces CK' and IK' based on CK and IK.
  • CK and IK reference may be made to relevant introductions in S505 above, and details will not be repeated here.
  • the UDM network element sends a UE authentication obtaining response message to the AUSF network element.
  • the AUSF network element receives the UE authentication obtaining response message from the UDM network element.
  • the UE authentication obtaining response message is used to respond to the above UE authentication obtaining request message.
  • the UE authentication obtaining response message may include: an authentication vector and indication information, where the indication information is used to indicate that the authentication vector is used for EAP-AKA'.
  • the UE authentication obtaining response message may further include: SUPI.
  • the AUSF network element sends a UE authentication response message to the SEAF.
  • the SEAF receives the UE authentication response message from the AUSF network element.
  • the UE authentication response message is used to respond to the above UE authentication request message.
  • the UE authentication response message may include: an EAP-Request (EAP-Request) message/AKA'-Challenge (AKA'-Challenge) message.
  • EAP request message/AKA'challenge message may be determined according to the UE authentication obtaining response message, and the message includes: RAND and AUTN.
  • the SEAF sends an authentication request message to the UE.
  • the UE receives the authentication request message from the SEAF.
  • the authentication request message may be a NAS message, used to request the UE to authenticate the network.
  • the authentication request message may include: EAP request message/AKA' challenge message. That is to say, after the SEAF receives the UE authentication response message, it can continue to encapsulate the EAP request message/AKA'challenge message in the UE authentication response message into the authentication request message, so as to transparently transmit the EAP request message/AKA'challenge message to the UE. information.
  • the authentication request message of SEAF may also include: ngKSI and ABBA parameters. The specific implementation principles of the ngKSI and ABBA parameters are similar to those in the above S509, which can be referred to for understanding and will not be repeated here.
  • the ngKSI value and ABBA parameters sent by SEAF to UE cannot be changed.
  • the UE deduces the RES.
  • RES is used to authenticate UE.
  • the UE may include: ME and USIM.
  • the USIM can verify the AUTN according to the RAND and its own root key. If the USIM fails to verify the AUTN, it means that the UE failed to authenticate the network. Failed, the authentication process ends. If the USIM passes the verification of the AUTN, it means that the UE has passed the authentication of the network. On this basis, USIM can use the root key and RAND to deduce RES, CK and IK, and send RES, CK and IK to ME. ME can deduce CK' and IK' according to CK and IK.
  • the UE sends an authentication response message to the SEAF.
  • the SEAF receives the authentication response message from the UE.
  • the authentication response message may be a NAS message, which is used to respond to the above authentication request message.
  • the authentication response message may include: an EAP response (EAP-response) message/AKA' challenge message.
  • the EAP response message/AKA' challenge message may include: RES.
  • the SEAF sends a UE authentication request message to the AUSF network element.
  • the AUSF network element receives the UE authentication request message from the SEAF.
  • the UE Authentication Request message is used to request authentication of the UE.
  • the UE authentication request message may include: EAP response message/AKA' challenge message. That is to say, after SEAF receives the authentication response message, it can continue to encapsulate the EAP response message/AKA' challenge message in the authentication response message into the UE authentication request message, so as to transparently transmit the EAP response message/AKA' to the AUSF network element Challenge message.
  • the AUSF network element authenticates the UE.
  • the AUSF network element After the AUSF network element receives the UE authentication request message, it can compare the RES in the EAP response message/AKA' challenge message with the locally saved XRES. If the RES and XRES do not match, it means that the UE fails to be authenticated, and the authentication process ends. If the RES and the XRES match, it means that the UE is authenticated, and then S614 is executed.
  • the AUSF network element sends a UE authentication response message to the SEAF.
  • the SEAF receives the UE authentication response message from the AUSF network element.
  • the UE authentication response message is a response message to the UE authentication request message.
  • the UE authentication response message may include: an EAP success (EAP success) message to indicate that the authentication is passed, and may also include: K SEAF .
  • EAP success EAP success
  • K SEAF K SEAF
  • the UE authentication response message may further include: SUPI.
  • the AUSF network element determines that the authentication is passed, it can deduce EMSK according to CK' and IK', and determine K SEAF according to EMSK. Specifically, the AUSF network element determines the first 256 bits of EMSK as K AUSF , and then deduces K SEAF according to K AUSF .
  • SEAF can deduce K AMF according to K SEAF , ABBA parameters, and SUPI, and send ngKSI and K AMF to the AMF network element.
  • SEAF should provide ngKSI to the AMF network element after receiving the UE authentication response message, that is, the UE authentication response message containing SUPI and K AMF , so that before this, the serving network will not provide communication services for the UE.
  • the SEAF sends an N1 message to the UE.
  • the UE receives the N1 message from the SEAF.
  • the N1 message may include: EAP success message, ngKSI and ABBA parameters.
  • EAP success message ngKSI
  • ABBA parameters ABBA parameters
  • SUPI SUPI
  • both the UE and the AMF network element have obtained the same key, that is, K AMF , and both parties can use this key to further deduce the encryption key and/or the integrity protection key, and use the deduced key to pair the UE and the AMF Information between network elements is protected to ensure communication security.
  • the main authentication process defined by the 3GPP is introduced above.
  • the main authentication process mainly defines how the UE and the network perform authentication and establish the same key, such as K AMF .
  • K AMF the same key
  • the AUSF network element uses the main authentication process to authenticate the remote UE in the ProSe relay communication scenario.
  • the AUSF network can store K AUSF for the remote UE during the authentication process, and deduce the K SEAF used for secure communication between the UE and the network.
  • the remote UE will not establish a non-access layer connection with the relay AMF network element, nor will it register with the network through the relay AMF network element, so there is no need to establish security between the UE and the network. context.
  • the secure communication between the remote UE and the relay UE that is, the key needs to be deduced for the relay UE.
  • the existing authentication process cannot support the AUSF network element to realize this function.
  • the authentication process between the remote UE and the network is performed through the relay UE and the relay AMF.
  • the relay UE receives an authentication request, according to the existing process, the relay UE will resolve the Authentication request, and network verification is performed. Since the authentication parameters are determined based on the root key of the remote UE, the relay UE will fail to verify the network, resulting in the end of the process and the failure to establish a communication connection.
  • the embodiment of the present application proposes the following technical solutions, so as to realize the establishment of secure ProSe relay communication.
  • the technical solution in this application will be described below with reference to the accompanying drawings.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless fidelity (WiFi) systems, vehicle-to-everything (V2X) communication systems, device-to-devie (D2D) Communication systems, IoV communication systems, 4th generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems,
  • 4G 4th generation mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems
  • the fifth generation (5th generation, 5G) mobile communication system such as the new air interface (new radio, NR) system
  • future communication systems such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. Additionally, combinations of these schemes can also be used.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • FIG. 7 is taken as an example to describe in detail the communication system applicable to the embodiment of the present application.
  • FIG. 7 is a communication method applicable to the communication method provided by the embodiment of the present application.
  • the communication system can be applied to the relay architecture (layer 2 relay architecture or layer 3 relay architecture) under the above-mentioned 5G architecture, mainly including: remote UE, relay UE, AMF network element, AUSF Network elements, and UDM network elements.
  • the relevant functions of the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element can refer to the above-mentioned 1, 5G mobile communication system, 2, short-distance communication, and 3, related to ProSe communication Introduction, no more details.
  • an AUSF network element may be triggered to authenticate the remote UE and establish secure communication.
  • FIG. 8 is a first schematic flowchart of a communication method provided by an embodiment of the present application.
  • the communication method is mainly applicable to the communication between the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF network element can be a remote AUSF network element.
  • the AUSF network element is determined according to the identity of the remote UE to support the authentication of the remote UE, or it can be any other possible form of AUSF network element. Be specific.
  • the UDM network element may be a remote UDM network element.
  • the UDM network element is determined according to the identity of the remote UE, and is used to generate an authentication vector for the remote UE, or it may be any other possible form of UDM network element.
  • UDM determines to establish secure ProSe relay communication based on 5G AKA according to the request from the AUSF network element (it can also be called the 5G AKA process of ProSe relay communication, 5G ProSe AKA for short).
  • 5G AKA process of ProSe relay communication 5G ProSe AKA for short.
  • AMF network elements, AUSF network elements and UDM network elements can interact by using existing service operations (ie service operation).
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the ProSe communication policy information is used to support one or more services in performing ProSe direct discovery, establishing ProSe direct communication, performing ProSe relay UE discovery, and establishing a relay communication connection by the UE.
  • S801 is an optional step, that is, before performing the relay communication process, the remote UE may perform S801 to obtain ProSe communication policy information, and perform relay discovery and establish a direct communication connection based on the ProSe communication policy information. Or, before performing the relay communication process, the remote UE does not access the network to obtain the ProSe communication policy information, then the remote UE performs relay discovery and establishes a direct communication connection based on the locally pre-configured ProSe communication policy information.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request a key for relay communication, or to request a key for ProSe relay communication, and the request includes: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay key request message may also include: the identifier of the relay UE, such as 5G GUTI.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element may determine whether the relay UE is authorized to provide services as a relay according to the subscription information of the relay UE from the UDM network element.
  • the relay AMF network element sends UE authentication request message #1 to the AUSF network element.
  • the AUSF network element receives the UE authentication request message #1 from the relay AMF network element.
  • the relay AMF network element can select the AUSF network element according to the SUCI of the remote UE, such as the relay AMF network element interacts with the NRF network element to determine the serving AUSF network element, or determines the serving AUSF network element according to the locally stored AUSF network element information . In this way, the relay AMF network element can determine to send the UE authentication request message #1 to the selected AUSF network element according to the relay key request message from the relay UE. For example, the relay AMF network element may determine to send the UE authentication request message #1 to the AUSF network element according to the message name.
  • UE authentication request message #1 may be a Kausf_UEAuthentication_Authenticate Request message.
  • the UE authentication request message #1 can be used to request to trigger the establishment of an authentication process for ProSe relay communication security (referred to as triggering ProSe authentication), so as to ensure that the AUSF deduces the key used to protect the relay communication security, and prevents the AUSF from performing a wrong process.
  • the ProSe authentication is used for the remote UE to perform mutual authentication with the network through the relay UE, and to establish a key for secure communication between the remote UE and the relay UE.
  • the UE authentication request message #1 includes the SUCI of the remote UE, the service network name, and may also include at least one of the following: RSC, Nonce_1 or ProSe relay communication indication information #1 (for example, ProSe ind).
  • RSC or Nonce_1 or ProSe relay communication indication information #1 or service network name can be used to indicate that ProSe authentication is requested, or indicate that authentication is used to authenticate the remote UE. That is to say, UE authentication request message #1 may indicate that ProSe authentication is requested to be triggered through the information element carried therein.
  • the information element may be a new information element or an existing information element, and the existing information element may be indicated by using a new value.
  • the UE authentication request message #1 may include: the SUCI of the remote UE, the service network name, and the ProSe relay communication indication information #1, so that the ProSe relay communication indication information #1 It is used to request or trigger ProSe authentication.
  • the relay AMF network element can send the RSC and Nonce_1 to the AUSF network element after confirming that the remote UE has passed the authentication, so that the AUSF network element can deduce the relay communication key, such as the ProSe key.
  • the UE authentication request message #1 may include: the SUCI, RSC, Nonce_1, and service network name of the remote UE, so as to indicate through the RSC and/or Nonce_1 that it is used to request ProSe authentication.
  • the UE authentication request message #1 may include: the SUCI of the remote UE, the service network name, RSC, Nonce_1, and ProSe relay communication indication information #1, so that the displayed ProSe ProSe authentication is requested following communication instruction message #1.
  • the service network name can be 5G:SN ID or 5G:ProSe or 5G:ProSe
  • the UE authentication request message #1 may include: the SUCI of the remote UE, the service network name, RSC, and Nonce_1.
  • the service network name is set to 5G:ProSe5G or ProSe
  • the UE authentication request message #1 may include: SUCI, service network name.
  • the service network name is set to 5G:ProSe or 5G:ProSe
  • the relay AMF network element sends the RSC and Nonce_1 to the AUSF network element, so that the AUSF network element can deduce the ProSe key.
  • the AUSF network element receives the RSC and Nonce_1 from the AMF network element, the AUSF saves the RSC and Nonce_1 for subsequent ProSe key derivation.
  • the AUSF network element sends a UE authentication obtaining request message to the UDM network element.
  • the UDM network element receives the UE authentication obtaining request message from the AUSF network element.
  • the AUSF network element may send a UE authentication obtaining request message to the UDM network element according to the UE authentication request message #1.
  • the UE authentication obtaining request message may be a Nudm_UEAuthentication_Request request message.
  • the UE Authentication Acquisition Request message may be used to request data for ProSe authentication.
  • the UE authentication obtaining request message may include: the SUCI of the remote UE and the name of the serving network.
  • the UE authentication acquisition request message may further include: the ProSe relay communication indication information #2.
  • the ProSe relay communication indication information #2 is used to request data for ProSe authentication, or in other words, indicates to obtain authentication data for authenticating the remote UE. That is, the UE authentication obtaining request message may carry displayed information elements, such as ProSe relay communication indication information #2, indicating data used to request ProSe authentication.
  • the AUSF network element may reuse the ProSe relay communication indication information #1, and encapsulate it into the UE authentication obtaining request message.
  • the ProSe relay communication indication information #1 and the ProSe relay communication indication information #2 may be the same indication information.
  • the AUSF network element may also generate the ProSe relay communication indication information #2 according to the ProSe relay communication indication information #1 in the UE authentication request message #1.
  • the ProSe relay communication indication information #1 and the ProSe relay communication indication information #2 may be different indication information.
  • the UE authentication acquisition request message may also include: RSC, Nonce_1, or ProSe relay communication indication information #2.
  • RSC, Nonce_1 or ProSe relay communication indication information #2 is used to obtain data for ProSe authentication, or to obtain authentication data for authenticating a remote UE.
  • the UE authentication request message #1 includes: SUCI of the remote UE, service network name, RSC, Nonce_1, and ProSe relay communication indication information #1
  • the UE authentication request message may also include: RSC, Nonce_1 or ProSe relay Communication instruction message #2.
  • the RSC, Nonce_1 or ProSe relay communication indication information #2 is used to obtain data for ProSe authentication, or to obtain authentication data for authenticating a remote UE.
  • the UE authentication request message #1 includes: the SUCI of the remote UE, the service network name, RSC, Nonce_1, and the service network name is set to 5G:ProSe or 5G:ProSe
  • the UE authentication obtaining request message may also include: RSC, Nonce_1.
  • the service network name is used to indicate the acquisition of ProSe authentication data, or is used to indicate the acquisition of authentication data for authenticating the remote UE.
  • the UE authentication request message #1 includes: the SUCI of the remote UE, the name of the serving network, and the name of the serving network Set to 5G:ProSe or 5G:ProSe
  • the UDM network element generates an authentication vector for ProSe relay communication.
  • the UDM network element may determine the data for obtaining ProSe authentication according to the ProSe relay communication indication information #2, or the RSC, or the service network name.
  • the UDM network element may call the SIDF, resolve the SIDF, resolve the SUCI, and obtain the SUPI.
  • the UDM network element can determine the authentication mechanism for ProSe relay communication according to the subscriber data and request message corresponding to SUPI, for example, determine the 5G AKA using ProSe relay communication, that is, 5G ProSe AKA.
  • the UDM network element can generate an authentication vector for ProSe relay communication, for example, authentication vector #1 of 5G ProSe AKA (5G ProSe AKA HE AV).
  • the authentication vector #1 of 5G ProSe AKA may include: RAND, AUTN, XRES*, and K AUSF .
  • RAND and AUTN can be determined by the UDM network element, and are used for remote UE authentication network.
  • XRES* can be deduced by UDM network elements or ARPF according to XRES, and is used for AUSF network elements to authenticate remote UEs.
  • XRES can be deduced by UDM network element or ARPF according to the root key (K) and RAND.
  • K AUSF is deduced by UDM network element or ARPF according to IK, CK and service network name, and is used to deduce ProSe key.
  • authentication vector #1 of the 5G ProSe AKA includes: RAND, AUTN, XRES, and K PROSE .
  • XRES can still be deduced by UDM network element or ARPF according to the root key and RAND.
  • K PROSE can be deduced by UDM network element or ARPF according to IK, CK, service network name and character string (PROSE), and is used to deduce ProSe key.
  • the UDM network element or the ARPF deduces the K AUSF first, and then deduces the K PROSE according to the K AUSF .
  • the specific derivation method is not limited.
  • the authentication vector #1 of 5G ProSe AKA includes: RAND, AUTN, XRES* and K PROSE .
  • the authentication mechanism for the UDM network element to determine the ProSe relay communication may also be: if the UE authentication acquisition request message carries a new information element (such as ProSe relay communication indication information #2 or RSC), the UDM network element Make sure to use 5G ProSeAKA. Or by carrying a new SN name, such as 5G:PROSE or 5G:ProSe
  • a new information element such as ProSe relay communication indication information #2 or RSC
  • the UDM network element make sure to use 5G ProSeAKA.
  • a new SN name such as 5G:PROSE or 5G:ProSe
  • the UDM network element may judge whether the user is authorized to use the relay communication according to the subscriber data corresponding to the SUPI. If it is determined that the user is authorized to use the relay communication, the authorization check passes and the flow continues. Otherwise, the UDM network element sends a response message for indicating authentication failure to the AUSF network element, and the process ends. It can be understood that the sequence between the UDM network element performing the process of judging whether the user is authorized to use the relay communication and the UDM network element performing the process of determining the authentication mechanism of the ProSe relay communication may not be limited.
  • the 5G AKA of ProSe relay communication is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as the AKA of 5G ProSe relay communication, or 5G ProSe AKA etc., without any limitation.
  • the ProSe authentication vector of 5G AKA #1 is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming method, such as 5G AKA ProSe authentication vector #1, 5G ProSe AKA authentication vector #1, or 5G Authentication vector #1 of ProSe AKA, etc., without any limitation.
  • the UDM network element sends a UE authentication obtaining response message to the AUSF network element.
  • the UDM network element receives the UE authentication obtaining response message from the AUSF network element.
  • the UE authentication obtaining response message may be used to respond to the above UE authentication obtaining request message.
  • the UE authentication obtaining response message may include: 5G ProSe AKA authentication vector #1, optionally, may also include: SUPI.
  • the UE authentication obtained response message may also indicate: the authentication vector #1 of the 5G ProSe AKA is the authentication vector used for ProSe relay communication.
  • the indication information can be added in the UE authentication acquisition response message to indicate that 5G AKA supports ProSe relay communication.
  • add indication information in the UE authentication obtaining response message to indicate that the authentication vector is used for 5G ProSe authentication and key management. That is, the authentication vector is used to perform two-way authentication between the remote UE and the network, and to establish a key for secure communication between the remote UE and the relay UE.
  • the AUSF network element stores XRES*, and deduces HXRES*.
  • the AUSF network element may store the XRES*, and optionally also store the SUPI.
  • the AUSF network element can deduce the HXRES* according to the XRES*, and the HXRES* can be used to authenticate the remote UE by the relay AMF network element.
  • the AUSF network element does not deduce K SEAF to prevent redundant information from being generated and waste of resources.
  • the AUSF network element may not deduce HXRES*, and the authentication vector sent to the relay AMF network element in S812 below may contain AUTN and RAND, but not HXRES*, so that the relay AMF The network element may not perform the authentication process of the service network subsequently.
  • the authentication vector sent to the relay AMF network element in the following S812 may also contain AUTN and RAND, excluding HXRES, so that the relay AMF network element may not execute The authentication process of the service network. There is no limit here.
  • the AUSF network element sends the UE authentication response message #1 to the relay AMF network element.
  • the relay AMF network element receives UE authentication response message #1 from the AUSF network element.
  • the UE authentication response message #1 is a response message to the above UE authentication request message #1.
  • the UE authentication response message #1 may include: 5G AKA ProSe authentication vector #2 (5G ProSe AKA SE AV).
  • ProSe authentication vector #1 of 5G AKA may include: RAND, AUTN, and HXRES*. That is to say, the AUSF network element can replace XRES* in ProSe authentication vector #1 of 5G AKA with HXRES*, and remove K AUSF in ProSe authentication vector #1 of 5G AKA, and obtain ProSe authentication vector # of 5G AKA 2.
  • ProSe authentication vector #2 of 5G AKA may include: RAND and AUTN, excluding: HXRES or HXRES*.
  • the UE authentication response message #1 may also include: indication information, used to indicate that the authentication vector is used to authenticate the remote UE.
  • ProSe authentication vector #2 of 5G AKA is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as 5G AKA ProSe authentication Vector #2, 5G ProSe AKA authentication vector #2, or 5G ProSe AKA authentication vector #2, etc., are not limited in any way.
  • the relay AMF network element sends a ProSe communication authentication request message to the relay UE.
  • the relay UE receives the ProSe communication authentication request message from the relay AMF network element.
  • the ProSe communication authentication request message can be used to instruct the remote UE to be authenticated, or to instruct the relay UE to send authentication data to the remote UE, so as to prevent the relay UE from performing authentication by itself after receiving the ProSe communication authentication request message, preventing the authentication from failing. Establish a communication connection.
  • the ProSe communication authentication request message may be indicated by its message type or the indication information it carries.
  • the ProSe communication authentication request message can include: RAND and AUTN (authentication data), that is, the relay AMF network element can obtain the RAND and AUTN from the authentication vector #2 of 5G ProSe AKA, and encapsulate it into the ProSe communication authentication request in the news.
  • RAND and AUTN are used for remote UE authentication network.
  • the relay AMF skips obtaining the ngKSI and ABBA parameters.
  • the relay AMF network element skips generating ngKSI and ABBA parameters.
  • the relay AMF network element does not send the ngKSI and ABBA parameters to the relay UE, that is, the ProSe communication authentication request message does not include the ngKSI and ABBA parameters.
  • ProSe communication authentication request message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as ProSe authentication request message, remote UE ProSe authentication request messages, or existing authentication requests, etc.
  • the specific implementation of S813 may also be to introduce a new container information element into the existing message, and the container contains RAND and AUTN. If the relay UE receives the message containing the container, S814 is executed.
  • the relay UE sends a remote UE authentication request message to the remote UE.
  • the remote UE receives the remote UE authentication request message from the relay UE.
  • the remote UE authentication request message can be used to instruct the remote UE to be authenticated, or to instruct the remote UE to perform ProSe authentication, to ensure that the remote UE and the network perform authentication and deduce the ProSe key, and to establish security between the remote UE and the relay UE communication.
  • the remote UE authentication request message may indicate the remote UE to perform ProSe authentication through its message type or the indication information carried therein.
  • the remote UE may also be instructed to authenticate the remote UE by carrying the instruction information in the existing message, or instruct the remote UE to perform ProSe authentication, which is not limited here.
  • the remote UE authentication request message may include: RAND and AUTN.
  • the relay UE can continue to encapsulate the RAND and AUTN carried in the ProSe communication authentication request message into the remote UE authentication request message, so as to be used for remote UE authentication.
  • the remote UE authentication request message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as the remote UE ProSe communication authentication request message, or Remote UE ProSe authentication request message and so on.
  • the relay UE receives the above container, the container is directly forwarded to the remote UE.
  • the remote UE deduces the RES*.
  • the RES* can be used to authenticate the remote UE.
  • the remote UE may include: ME and USIM.
  • the USIM can verify the AUTN according to the RAND and its own root key. If USIM fails to verify AUTN, It means that the UE fails to authenticate the network, and the process ends. If the USIM passes the verification of the AUTN, it means that the UE has passed the authentication of the network.
  • the USIM can use the root key and RAND to deduce RES, CK and IK, and send RES, CK and IK to ME.
  • the ME may deduce K AUSF according to CK and IK, and deduce RES* according to RES, and then perform S816. In ProSe authentication, ME may not deduce K SEAF to improve authentication efficiency.
  • the remote UE also uses the same method as the network side to perform key authentication. Derivation or authentication parameter derivation, and generation of other authentication data.
  • the remote UE sends a remote UE authentication response message to the relay UE.
  • the relay UE receives the remote UE authentication response message from the remote UE.
  • the remote UE authentication response message is a response message to the remote UE authentication request message.
  • the ProSe communication authentication response message may be used to indicate that it is an authentication response message of the remote UE, for example, it may be indicated by a type of the message or an information element included in the message and is an authentication response message of the remote UE.
  • the remote UE authentication response message may include: RES*.
  • the remote UE authentication response message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as the remote UE ProSe communication authentication response message, or Remote UE ProSe authentication response message and so on.
  • the relay UE sends a ProSe communication authentication response message to the relay AMF network element.
  • the relay AMF network element receives the ProSe communication authentication response message from the relay UE.
  • the ProSe communication authentication response message is a response message to the aforementioned ProSe communication authentication request message.
  • the ProSe communication authentication response message may include: RES*. That is to say, the relay UE can obtain the RES* from the remote UE authentication response message, and continue to encapsulate it into the ProSe communication authentication response message.
  • ProSe communication authentication response message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as ProSe authentication response message, or remote UE ProSe authentication Respond to messages and more.
  • the relay AMF network element authenticates the remote UE.
  • the relay AMF network element After the relay AMF network element receives the ProSe communication authentication response message, it can deduce the HRES* according to the received RES*, so as to compare the HRES* with the HXRES* obtained in S812. If the HRES* and HXRES* do not match, for example, the HRES* and HXRES* are not the same, it means that the remote UE fails to be authenticated, and the authentication process ends. If the HRES* matches the HXRES*, for example, the HRES* and the HXRES* are the same, it means that the UE has passed the authentication, or in other words, from the perspective of the service network, it is considered that the authentication is passed, and then S819 is executed.
  • the relay AMF network element does not need to derive the HRES*, nor does it need to execute the authentication of the service network.
  • the relay AMF network element sends UE authentication request message #2 to the AUSF network element.
  • the AUSF network element receives the UE authentication request message #2 from the relay AMF network element.
  • the UE authentication request message #2 may be used to request ProSe authentication for the remote UE.
  • the UE authentication request message #2 may use new indication information to indicate that the remote UE should be authenticated.
  • UE authentication request message #2 may include: RES*. That is to say, after the relay AMF network element passes the authentication of the remote UE, it can encapsulate the RES* into the UE authentication request message #2, and then send the UE authentication request message #2 to the AUSF network element.
  • UE authentication request message #2 may also include: RSC and Nonce_1, that is, the relay AMF network element may also encapsulate RSC and Nonce_1 into UE authentication request message# 2 in.
  • UE authentication request message #2 may still include: RSC and Nonce_1.
  • the RSC and Nonce_1 may also be used to indicate that the remote UE is authenticated.
  • the AUSF network element authenticates the remote UE.
  • the AUSF network element can compare RES* with the previously saved XRES*. If RES* and XRES* do not match, for example, RES* and XRES* are not the same, it means that the remote UE fails to be authenticated, and the procedure ends. If RES* and XRES* match, for example, RES* and XRES* are the same, it means that the authentication of the remote UE is passed, or from the perspective of the home network, it is considered that the authentication is passed.
  • the AUSF network element can generate Nonce_2, and deduce the ProSe key (K NR_ProSe ) according to the previously saved K AUSF , RSC, Nonce_1 and Nonce_2, which is used for communication between the remote UE and the relay UE.
  • the AUSF network element can first deduce an intermediate key according to K AUSF and RSC, and then deduce the ProSe key according to the intermediate key, Nonce_1 and Nonce_2.
  • the AUSF network element can directly derive the ProSe key according to K AUSF , RSC, Nonce_1 and Nonce_2.
  • the AUSF network element may also use any other possible ways to derive the ProSe key, which is not specifically limited.
  • the AUSF network element can determine to skip the process of sending the authentication result to the UDM network element according to the authentication being ProSe authentication, that is, the authentication result is not sent to the UDM network element, but the following S821 is described to send the UE authentication response message #2 to the relay AMF network element, so as to ensure that only necessary procedures are executed and waste of resources is prevented.
  • the AUSF network element when it is determined to authenticate the remote UE, performs the above-mentioned ProSe key derivation process.
  • ProSe key is only an exemplary naming manner in the embodiment of the present application, and it can also be replaced by any other possible naming manner, such as a ProSe communication key.
  • the key in the ProSe authentication vector #1 of the 5GAKA is K PROSE
  • the AUSF network element should use K PROSE to derive the ProSe key, that is, replace K AUSF with K PROSE .
  • the AUSF network element sends UE authentication response message #2 to the relay AMF network element.
  • the relay AMF network element receives UE authentication response message #2 from the AUSF network element.
  • the UE authentication response message #2 is a response message to the UE authentication request message #2, and may be used to indicate that the remote UE is passed the authentication.
  • UE authentication response message #2 may include: ProSe key and Nonce_2. That is to say, after the AUSF network element determines that the remote UE has passed the authentication, it can encapsulate the ProSe key and Nonce_2 into the UE authentication response message #2, and then send the UE authentication response message #2 to the relay AMF network element.
  • the UE authentication response message #2 may further include: the SUPI of the remote UE.
  • the SUPI of the remote UE may be used to instruct the relay UE to report the execution information of the remote UE to the network side.
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay key response message is a response message to the above relay key request message, and may include: the ProSe key and Nonce_2, and optionally, may also include: the SUPI of the remote UE. That is to say, after the relay AMF network element receives the UE authentication response message #2, it can obtain the ProSe key and Nonce_2. Optionally, the SUPI of the remote UE may also be obtained and encapsulated into a relay key response message, so as to send the relay key response message to the relay UE.
  • the relay UE can store the ProSe key, and optionally, can also store the SUPI of the remote UE.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • a direct security mode command message may be used to instruct PC5 security to be established.
  • the direct security mode command message may include: Nonce_2. That is to say, after receiving the relay key response message, the relay UE can obtain Nonce_2 from it, and then encapsulate it into the direct security mode command message, so as to send the direct security mode command message to the remote UE.
  • the remote UE deduces the ProSe key.
  • the remote UE can derive the ProSe key in the same way as the AUSF, that is, derive the ProSe key according to K AUSF , RSC , Nonce_1 and Nonce_2 derived previously.
  • the key deduced by the remote UE above is K PROSE
  • the remote UE should use K PROSE to derive the ProSe key, that is, replace K AUSF with K PROSE .
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • the direct security mode command complete message is a response message to the direct security mode command message, and is used to indicate that the remote UE has determined the ProSe key.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication.
  • the interaction between relay AMF network elements, AUSF network elements and UDM network elements can be realized by reusing existing service operations, the authentication between the remote UE and the network can be realized without introducing new service operations, and the generation of A key for secure communication between the relay UE and the remote UE.
  • FIG. 9 is a second schematic flowchart of the communication method provided by the embodiment of the present application.
  • the communication method is mainly applicable to the communication between the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF network element can be a remote AUSF network element.
  • the AUSF network element is determined according to the identity of the remote UE to support the authentication of the remote UE, or it can be any other possible form of AUSF network element. Be specific.
  • the UDM network element may be a remote UDM network element.
  • the UDM network element is determined according to the identity of the remote UE, and is used to generate an authentication vector for the remote UE, or it may be any other possible form of UDM network element. For this Not specifically limited.
  • it is determined to establish secure ProSe relay communication based on enhanced 5G AKA (also called the 5G AKA process of ProSe relay communication, 5G ProSe AKA for short).
  • enhanced 5G AKA also called the 5G AKA process of ProSe relay communication, 5G ProSe AKA for short.
  • AMF network elements, AUSF network elements and UDM network elements can interact through new service operations or new service names.
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request the relay communication, or to request the key of the ProSe relay communication, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay key request message may also include: the identifier of the relay UE, such as 5G GUTI.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element judges whether the relay UE is authorized to provide services as a relay according to the subscription information of the relay UE from the UDM network element.
  • the relay AMF network element sends a ProSe UE authentication request (Nausf_ProSeUEAuthentication_Authenticate Request or Nausf_UEAuthentication_ProSeAuthenticate Request) message #1 to the AUSF network element.
  • the AUSF network element receives the ProSe UE authentication request message #1 from the relay AMF network element.
  • the relay AMF network element can select the AUSF network element according to the SUCI of the remote UE, such as the relay AMF network element interacts with the NRF network element to determine the serving AUSF network element, or determines the serving AUSF network element according to the locally stored AUSF network element information . In this way, the relay AMF network element can determine to send the ProSe UE authentication request message #1 to the selected AUSF network element according to the relay key request message from the relay UE. For example, the relay AMF network element may determine to send the ProSe UE authentication request message #1 to the AUSF network element according to the message name.
  • the ProSe UE authentication request message #1 can be used to request the establishment of an authentication process for ProSe relay communication security (which can be referred to as triggering ProSe authentication), or to trigger ProSe authentication to ensure that the AUSF deduces the key used to protect the relay communication security, avoiding AUSF executes the wrong process.
  • the ProSe UE authentication request message #1 may indicate that it is used to request ProSe authentication through its own service type, service operation, or service name.
  • the ProSe authentication is used for the remote UE to perform mutual authentication with the network through the relay UE, and to establish a key for secure communication between the remote UE and the relay UE.
  • the ProSe UE authentication request message #1 may include at least one of the following: SUCI, RSC, Nonce_1, or service network name of the remote UE.
  • the ProSe UE authentication request message #1 may include: the SUCI of the remote UE and the name of the serving network.
  • the relay AMF network element can send the RSC and Nonce_1 to the AUSF network element after confirming that the remote UE has passed the authentication, so as to further provide parameters as needed. number.
  • the ProSe UE authentication request message #1 may include: the SUCI, RSC, Nonce_1, and service network name of the remote UE.
  • the service network name above can be 5G:SN ID or 5G:ProSe or 5G:ProSe
  • the name of the ProSe UE authentication request message indicating a new service name or service operation is only an example, and it can also be replaced by any other possible naming, such as 5G ProSe UE authentication request message, ProSe communication UE There is no limitation on the authentication request message, or the 5G ProSe communication UE authentication request message, etc.
  • the AUSF network element sends a ProSe UE authentication acquisition request to the UDM network element
  • the UDM network element receives the ProSe UE authentication obtaining request message from the AUSF network element.
  • the AUSF network element can send a ProSe UE authentication obtaining request message to the UDM network element according to the ProSe UE authentication request message #1.
  • the ProSe UE authentication acquisition request message can be used to request ProSe authentication (trigger ProSe authentication).
  • the ProSe UE authentication obtaining request message may indicate that it is used to request ProSe authentication through its own service type, service operation, or service name.
  • the ProSe UE authentication obtaining request message may include: the SUCI of the remote UE.
  • the above implementation manners of the ProSe UE authentication obtaining request message are only some examples, and are not intended as limitations.
  • the ProSe UE authentication obtaining request message may still carry the above-mentioned ProSe relay communication indication information #2, so as to indicate that it is used to request ProSe authentication through the ProSe relay communication indication information #2.
  • the ProSe relay communication indication information #2 For the specific implementation principle of the ProSe relay communication indication information #2, reference may be made to the relevant introduction in S808 above, and details will not be repeated here.
  • the name indicating a new service name or service operation through the ProSe UE authentication request message is only an example, and it can also be replaced by any other possible naming, such as 5G ProSe UE authentication acquisition request message, ProSe There is no limitation on the communication UE authentication acquisition request message, or the 5G ProSe communication UE authentication acquisition request message, etc.
  • the UDM network element generates an authentication vector for ProSe relay communication.
  • the UDM network element can obtain the request message according to the ProSe UE authentication, and determine to perform ProSe authentication. On this basis, the UDM network element, or the UDM network element can invoke the SIDF, resolve the SIDF, resolve the SUCI, and obtain the SUPI.
  • the UDM network element can determine the authentication mechanism for ProSe relay communication based on the subscriber data corresponding to SUPI, for example, determine the 5G AKA using ProSe relay communication, that is, 5G ProSe AKA. In this way, the UDM network element can generate the authentication vector of the ProSe relay communication, and the specific implementation principle can refer to the relevant introduction in the above S809, and will not be repeated here.
  • the UDM network element can judge whether the user is authorized to use relay communication according to the subscriber data corresponding to SUPI.
  • the specific implementation principle can also refer to the relevant introduction in S809 above, and will not be repeated .
  • the UDM network element sends a ProSe UE authentication obtaining response (Nudm_ProSeUEAuthentication_Get Response or Nudm_ProSeUEAuthentication_GetProSeAV Response) message to the AUSF network element.
  • a ProSe UE authentication obtaining response Nudm_ProSeUEAuthentication_Get Response or Nudm_ProSeUEAuthentication_GetProSeAV Response
  • the UDM network element receives the ProSe UE authentication obtaining response message from the AUSF network element.
  • the ProSe UE authentication obtaining response message is the response message of the above ProSe UE authentication obtaining request message.
  • the ProSe UE authentication obtaining response message may include: 5G ProSe AKA authentication vector #1, optionally, may also include: SUPI.
  • the ProSe UE authentication obtained response message may also indicate that the authentication vector #1 of the 5G ProSe AKA is a 5G AKA authentication vector supporting ProSe relay communication.
  • the ProSe UE authentication acquisition response message can indicate that the authentication vector is used for 5G AKA through its own message type, service operation, or service name, and 5G AKA supports ProSe relay communication.
  • the ProSe UE authentication acquisition response message may also use the carried indication information to indicate that the authentication vector is used for 5G AKA, and 5G AKA supports ProSe relay communication.
  • the name indicating the new service name or service operation through the ProSe UE authentication response message is only an example, and it can also be replaced by any other possible naming methods, such as 5G ProSe UE authentication response request message, There is no limitation on the ProSe communication UE authentication obtaining response message, or the 5G ProSe communication UE authentication obtaining response message, etc.
  • AUSF network element stores XRES*, deduces HXRES*.
  • the AUSF network element sends a ProSe UE authentication response (Nausf_ProSeUEAuthentication_Authenticate response or Nausf_UEAuthentication_ProSeAuthenticate response) message #1 to the relay AMF network element.
  • the relay AMF network element receives the ProSe UE authentication response message #1 from the AUSF network element.
  • the ProSe UE authentication response message #1 is a response message to the above ProSe UE authentication request message #1.
  • the ProSe UE authentication response message #1 may include: 5G ProSe AKA authentication vector #2.
  • the specific implementation principle can refer to the relevant introduction in the above S812, and will not be repeated here.
  • the ProSe UE authentication response message #1 may also indicate that the authentication vector #2 of the 5G ProSe AKA is a 5G AKA that supports ProSe relay communication.
  • ProSe UE authentication response message #1 can indicate that the authentication vector is used for 5G AKA through its own message type, service operation, or service name, and 5G AKA supports ProSe relay communication.
  • the ProSe UE authentication response message #1 may also indicate that the authentication vector is used for 5G AKA through the carried indication information, and 5G AKA supports ProSe relay communication.
  • the name of the ProSe UE authentication response message to indicate a new service name or service operation is only an example, and it can also be replaced by any other possible naming methods, such as 5G ProSe UE authentication response message, ProSe communication There is no limitation on UE authentication response message, or 5G ProSe communication UE authentication response message, etc.
  • the relay AMF network element sends a ProSe communication authentication request message to the relay UE.
  • the relay UE receives the ProSe communication authentication request message from the relay AMF network element.
  • the relay UE sends a remote UE authentication request message to the remote UE.
  • the remote UE receives the remote UE authentication request message from the relay UE.
  • the remote UE deduces the RES*.
  • the remote UE sends a remote UE authentication response message to the relay UE.
  • the remote UE receives the remote UE authentication response message from the relay UE.
  • the relay UE sends a ProSe communication authentication response message to the relay AMF network element.
  • the relay AMF network element receives the ProSe communication authentication response message from the relay UE.
  • the relay AMF network element authenticates the remote UE.
  • the relay AMF network element sends the ProSe UE authentication request message #2 to the AUSF network element.
  • the AUSF network element receives the ProSe UE authentication request message #2 from the relay AMF network element.
  • the ProSe UE authentication request message #2 can be used to request ProSe authentication for the remote UE, including: RES*. That is to say, after the relay AMF network element passes the authentication of the remote UE, it can encapsulate the RES* into the ProSe UE authentication request message #2, and then send the ProSe UE authentication request message #2 to the AUSF network element.
  • the ProSe UE authentication request message #2 may also include: RSC and Nonce_1, that is, the relay AMF network element may also encapsulate RSC and Nonce_1 to ProSe UE Authentication Request message #2.
  • ProSe UE authentication request message #1 in S907 carries RSC and Nonce_1
  • ProSe UE authentication request message #2 may still include: RSC and Nonce_1.
  • the AUSF network element authenticates the remote UE.
  • the AUSF network element sends a ProSe UE authentication response message #2 to the relay AMF network element.
  • the relay AMF network element receives the ProSe UE authentication response message #2 from the AUSF network element.
  • the ProSe UE authentication response message #2 is a response message to the ProSe UE authentication request message #2, and can be used to indicate that the remote UE has passed the authentication.
  • ProSe UE authentication response message #2 may include: ProSe key and Nonce_2.
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • the remote UE deduces the ProSe key.
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • S921-S925 are similar to those of S821-S825, which can be referred to for understanding and will not be repeated here.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication. Since the interaction between the relay AMF network element, the AUSF network element and the UDM network element can be realized through new signaling, it can be decoupled from the existing authentication process and avoid the impact of the authentication process on ProSe authentication.
  • FIG. 10 is a third schematic flowchart of the communication method provided by the embodiment of the present application.
  • the communication method is mainly applicable to the communication between the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF NE can be a remote AUSF NE, such as the AUSF network
  • the element is determined according to the identity of the remote UE, and is used to support the authentication of the remote UE, or it may be any other possible form of AUSF network element, which is not specifically limited.
  • the UDM network element may be a remote UDM network element.
  • the UDM network element is determined according to the identity of the remote UE, and is used to generate an authentication vector for the remote UE, or it may be any other possible form of UDM network element.
  • the UDM network element determines based on the request from the AUSF network element to establish a secure ProSe relay communication based on EAP AKA' (it can also be called the EAP-AKA' process of ProSe relay communication, referred to as ProSe EAP-AKA' ).
  • EAP-AKA' authentication process of ProSe relay communication AMF network elements, AUSF network elements and UDM network elements can interact by using existing service operations.
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request the key for relay communication, or request the key for ProSe relay communication, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay key request message may also include: the identifier of the relay UE, such as 5G GUTI.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element may determine whether the relay UE is authorized to provide services as a relay according to the subscription information of the relay UE from the UDM network element.
  • the relay AMF network element sends UE authentication request message #1 to the AUSF network element.
  • the AUSF network element receives the UE authentication request message #1 from the relay AMF network element.
  • the AUSF network element sends a UE authentication acquisition request message to the UDM network element.
  • the UDM network element receives the UE authentication obtaining request message from the AUSF network element.
  • the UDM network element generates an authentication vector for ProSe relay communication.
  • the UDM network element can determine the data to obtain the ProSe authentication according to the UE authentication obtaining request message. Specifically, the UDM network element, or the UDM network element may call the SIDF, resolve the SIDF, resolve the SUCI, and obtain the SUPI.
  • the UDM network element can determine the authentication of ProSe relay communication according to the subscriber data and request message corresponding to SUPI. authentication mechanisms, such as EAP-AKA' to determine communication using ProSe relays. In this way, the UDM network element can generate an authentication vector for ProSe relay communication, for example, a ProSe authentication vector of EAP-AKA'(EAP-AKA' ProSe AV).
  • the ProSe authentication vectors of EAP-AKA' may include: RAND, AUTN, XRES, and CK' and IK'.
  • RAND Random Access Memory
  • AUTN AUTN
  • XRES XRES
  • CK' and IK' can be derived from the root key and RAND, and are used to derive the ProSe key.
  • the UDM network element/ARPF can deduce CK and IK based on the root key and RAND, and then deduce CK' and IK' according to CK and IK.
  • CK' and IK' is only an example, and CK' and IK can also replace any other possible keys, for example, according to CK and IK, and new SN or new parameters, such as PROSE character derivation K PROSE .
  • the authentication mechanism for the UDM network element to determine the ProSe relay communication may also be: if the UE authentication obtaining request message carries the ProSe relay communication indication information #2, the UDM network element determines the EAP- AKA'. In this case, the UDM network element does not need to query the subscriber data, which can improve the authentication efficiency.
  • the UDM network element can judge whether the user is authorized to use relay communication according to the subscriber data corresponding to SUPI.
  • the specific implementation principle can also refer to the relevant introduction in S809 above, and will not be repeated .
  • EAP-AKA' of ProSe relay communication is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as EAP-AKA' of 5G ProSe relay communication. AKA', or 5G ProSe EAP-AKA', etc., without any limitation.
  • the ProSe authentication vector of EAP-AKA' is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as EAP-AKA'ProSe authentication vector, ProSe There is no limitation on the EAP-AKA' authentication vector, or the EAP-AKA' authentication vector of ProSe relay communication.
  • the UDM network element sends a UE authentication obtaining response message to the AUSF network element.
  • the UDM network element receives the UE authentication obtaining response message from the AUSF network element.
  • the UE authentication obtaining response message is a response message to the above UE authentication obtaining request message.
  • the UE authentication obtaining response message may include: ProSe authentication vector of EAP-AKA', optionally, may also include: SUPI.
  • the UE authentication obtaining response message may also indicate: the ProSe authentication vector of the EAP-AKA' is a 5G AKA authentication vector supporting ProSe relay communication.
  • the indication information may be added in the UE authentication acquisition response message to indicate that EAP-AKA' supports ProSe relay communication.
  • adding indication information in the UE authentication obtaining response message is used to indicate that the authentication vector is used for EAP-AKA', and EAP-AKA' supports ProSe relay communication.
  • the AUSF network element stores the XRES.
  • the AUSF network element may store the XRES, and optionally also store the SUPI, for subsequent authentication.
  • the AUSF network element may not deduce K SEAF to prevent redundant information from being generated and waste of resources.
  • the AUSF network element sends a UE authentication response message #1 to the relay AMF network element.
  • the relay AMF network element receives UE authentication response message #1 from the AUSF network element.
  • the UE authentication response message #1 is a response message to the above UE authentication request message #1.
  • the UE authentication response message #1 may include: EAP request message/AKA' challenge message.
  • EAP Request messages/AKA' Challenge messages can It is a NAS message determined according to UE authentication obtaining response message #1, including: RAND and AUTN.
  • the relay AMF network element sends a ProSe communication authentication request message to the relay UE.
  • the relay UE receives the ProSe communication authentication request message from the relay AMF network element.
  • the ProSe communication authentication request message can be used to indicate that it is used to authenticate the remote UE, or to instruct the relay UE to send authentication data to the remote UE, so as to prevent the relay UE from performing authentication by itself after receiving the ProSe communication authentication request message, preventing authentication Failed to establish a communication connection.
  • the ProSe communication authentication request message may instruct the relay UE to send authentication data to the remote UE through its message type or the indication information it carries, or refer to authenticate the remote UE.
  • the relay UE may also be instructed to send authentication data to the remote UE by carrying indication information in an existing message (such as an authentication request message), which is not limited here.
  • the ProSe communication authentication request message may include: EAP request message/AKA' challenge message (authentication data). That is to say, after the relay AMF network element receives the UE authentication response message #1, it can continue to encapsulate the EAP request message/AKA' challenge message in the UE authentication response message #1 into the ProSe communication authentication request message, thereby sending The relay UE transparently transmits the EAP request message/AKA' challenge message.
  • the relay AMF skips obtaining the ngKSI and ABBA parameters.
  • the relay AMF network element skips generating ngKSI and ABBA parameters.
  • the relay AMF network element does not send the ngKSI and ABBA parameters to the relay UE, that is, the ProSe communication authentication request message does not include the ngKSI and ABBA parameters.
  • the relay UE sends a remote UE authentication request message to the remote UE.
  • the remote UE receives the remote UE authentication request message from the relay UE.
  • the remote UE authentication request message can be used to instruct the remote UE to perform ProSe authentication, or to authenticate the remote UE, to ensure that the remote UE and the network perform authentication and deduce the ProSe key, and to establish secure communication between the remote UE and the relay UE .
  • the ProSe communication authentication request message may instruct the remote UE to perform ProSe authentication, or to authenticate the remote UE, through its message type or the indication information carried therein.
  • the remote UE may also be instructed to perform ProSe authentication by carrying indication information in an existing message, which is not limited here.
  • the ProSe communication authentication request message may include: EAP request message/AKA'challenge message, so that the remote UE can perform ProSe authentication.
  • the relay UE after the relay UE receives the ProSe communication authentication request message, it can continue to encapsulate the EAP request message/AKA' challenge message in the ProSe communication authentication request message into the remote UE authentication request message to send
  • the EAP request message/AKA'challenge message is transparently transmitted so as to be used for remote UE authentication.
  • the remote UE deduces the RES.
  • the remote UE may include: ME and USIM.
  • the USIM can verify the AUTN according to the RAND and its own root key. If the USIM fails to verify the AUTN, it means that the remote UE fails to authenticate the network, and the process ends. If the USIM passes the verification of the AUTN, it means that the remote UE passes the verification of the network.
  • USIM can use the root key and RAND to deduce RES, CK and IK, and send RES, CK and IK to ME.
  • the ME may deduce CK' and IK' according to CK and IK, and then perform S1016.
  • the remote UE if the network side uses a new key derivation method or a new authentication parameter derivation method, the remote UE also uses the same method as the network side to perform key authentication. Derivation or authentication parameter derivation, and generation of other authentication data.
  • the remote UE sends a remote UE authentication response message to the relay UE.
  • the remote UE receives Remote UE authentication response message from relay UE.
  • the remote UE authentication response message is a response message to the remote UE authentication request message.
  • the ProSe communication authentication response message may be used to indicate that it is an authentication response message of the remote UE.
  • the ProSe communication authentication response message may indicate that it is an authentication response message of the remote UE through the type of the message or the information element contained in the message.
  • the remote UE authentication response message may include: EAP response message/AKA' challenge message.
  • the EAP response message/AKA' challenge message may include: RES.
  • the relay UE sends a ProSe communication authentication response message to the relay AMF network element.
  • the relay AMF network element receives the ProSe communication authentication response message from the relay UE.
  • the ProSe communication authentication response message is a response message to the aforementioned ProSe communication authentication request message.
  • the ProSe communication authentication response message is used to indicate that it is an authentication response message of the remote UE.
  • the ProSe communication authentication response message may indicate that it is an authentication response message of the remote UE through the type of the message or the information element contained in the message.
  • the ProSe communication authentication response message may include: EAP response message/AKA' challenge message.
  • the relay UE can obtain the EAP response message/AKA'challenge message from the remote UE authentication response message, and continue to encapsulate it into the ProSe communication authentication response message, so as to transparently transmit the EAP response message to the AUSF network element/ AKA' challenge message.
  • the relay AMF network element sends UE authentication request message #2 to the AUSF network element.
  • the AUSF network element receives the UE authentication request message #2 from the relay AMF network element.
  • UE Authentication Request message #2 may be used to request authentication of the remote UE.
  • the UE authentication request message #2 may use new indication information to indicate that the remote UE should be authenticated.
  • UE authentication request message #2 may include: EAP response message/AKA' challenge message. That is to say, the relay AMF network element can obtain the EAP response message/AKA'challenge message from the ProSe communication authentication response message, encapsulate it into the UE authentication request message #2, and transparently transmit the EAP response message to the AUSF network element /AKA' challenge message.
  • UE authentication request message #2 may also include: RSC and Nonce_1, that is, the relay AMF network element may also encapsulate RSC and Nonce_1 into UE Authentication Request message #2.
  • UE authentication request message #2 may still include: RSC and Nonce_1.
  • the RSC and Nonce_1 may also be used to indicate that the remote UE is authenticated.
  • the AUSF network element authenticates the remote UE.
  • the AUSF network element After the AUSF network element receives the UE authentication request message #2, it can obtain the EAP response message/AKA' challenge message and further obtain the RES. The AUSF network element can compare the RES with the previously saved XRES. If the RES and the XRES do not match, for example, the RES and the XRES are different, it means that the remote UE fails to be authenticated, and the procedure ends. If RES and XRES match, for example, RES and XRES* are the same, it means that the authentication of the remote UE is passed.
  • the AUSF network element can generate Nonce_2, and deduce the ProSe key according to the previously saved CK', IK', RSC, Nonce_1 and Nonce_2, which is used for the communication between the remote UE and the relay UE.
  • the AUSF network element may deduce EMSK according to CK' and IK', determine K AUSF according to EMSK, for example, determine the first 256 bits of EMSK as K AUSF , and not deduce K SEAF .
  • the AUSF network element can deduce the ProSe key according to K AUSF , RSC, Nonce_1 and Nonce_2.
  • the AUSF network element can first deduce an intermediate key according to K AUSF and RSC, and then deduce the ProSe key according to the intermediate key, Nonce_1 and Nonce_2.
  • the AUSF network element can directly according to K AUSF , RSC, Nonce_1 and Nonce_2, Deduce the ProSe key.
  • the AUSF network element may also use any other possible ways to derive the ProSe key, which is not specifically limited.
  • the AUSF network element when it is determined to authenticate the remote UE, performs the above-mentioned ProSe key derivation process.
  • the AUSF network element sends UE authentication response message #2 to the relay AMF network element.
  • the relay AMF network element receives UE authentication response message #2 from the AUSF network element.
  • the UE authentication response message #2 is a response message to UE authentication request message #2.
  • the UE authentication response message #2 may include: an EAP success message to indicate that the authentication is passed, and may also include: a ProSe key and Nonce_2. That is to say, after the AUSF network element determines that the remote UE has passed the authentication, it can generate an EAP success message, encapsulate the EAP success message, ProSe key and Nonce_2 into UE authentication response message #2, and then send it to the relay AMF network element UE authentication response message #2.
  • the UE authentication response message #2 may further include: the SUPI of the remote UE.
  • the SUPI of the remote UE may be used to instruct the relay UE to report the execution information of the remote UE to the network side.
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay key response message is a response message to the above relay key request message, and may include: EAP success message, ProSe key and Nonce_2, and optionally, may also include: SUPI of the remote UE. That is to say, after receiving the UE authentication response message #2, the relay AMF network element can obtain the EAP success message, ProSe key and Nonce_2 according to the UE authentication response message #2, and optionally, can also obtain the remote UE's SUPI, and encapsulate it into the Relay Key Response message to send the Relay Key Response message to the relay UE.
  • the relay UE can store the ProSe key, and optionally, can also store the SUPI of the remote UE.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • Direct security mode command messages may be used to establish PC5 security.
  • the direct security mode command message may include: EAP success message and Nonce_2. That is to say, after receiving the relay key response message, the relay UE can obtain the EAP success message and Nonce_2 therefrom, and then encapsulate them into the direct security mode command message, so as to send the direct security mode command message to the remote UE.
  • the remote UE deduces the ProSe key.
  • the remote UE can use the same method as AUSF to derive the ProSe key, that is, derive the ProSe key based on the previously derived CK' and IK', as well as RSC, Nonce_1 and Nonce_2.
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • the direct security mode command complete message is a response message to the direct security mode command message, and is used to indicate that the remote UE has determined the ProSe key.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication.
  • the interaction between relay AMF network elements, AUSF network elements and UDM network elements can be realized by reusing existing service operations, the authentication between the remote UE and the network can be realized without introducing new service operations, and the generation of A key for secure communication between the relay UE and the remote UE.
  • FIG. 11 is a fourth schematic flowchart of the communication method provided by the embodiment of the present application.
  • the communication method is mainly applicable to the communication between the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF network element can be a remote AUSF network element.
  • the AUSF network element is determined according to the identity of the remote UE to support the authentication of the remote UE, or it can be any other possible form of AUSF network element. Be specific.
  • the UDM network element may be a remote UDM network element.
  • the UDM network element is determined according to the identity of the remote UE, and is used to generate an authentication vector for the remote UE, or it may be any other possible form of UDM network element. For this Not specifically limited.
  • the UDM network element determines based on the request from the AUSF network element to establish a secure ProSe relay communication based on EAP AKA' (it can also be called the EAP-AKA' process of ProSe relay communication, referred to as ProSe EAP-AKA' ) or the new EAP AKA.
  • EAP-AKA' the EAP-AKA' process of ProSe relay communication
  • AMF network elements, AUSF network elements and UDM network elements can interact through new service operations or service names.
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request the relay communication, or to request the key of the ProSe relay communication, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay key request message may also include: the identifier of the relay UE, such as 5G GUTI.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element may determine whether the relay UE is authorized to provide services as a relay according to the subscription information of the relay UE from the UDM network element.
  • the relay AMF network element sends the ProSe UE authentication request message #1 to the AUSF network element.
  • the AUSF network element receives the ProSe UE authentication request message #1 from the relay AMF network element.
  • the AUSF network element sends a ProSe UE authentication obtaining request message to the UDM network element. corresponding, The UDM network element receives the ProSe UE authentication obtaining request message from the AUSF network element.
  • the UDM network element generates an authentication vector for ProSe relay communication.
  • the UDM network element can obtain the request message according to the ProSe UE authentication, and determine to perform ProSe authentication. On this basis, the UDM network element, or the UDM network element can invoke the SIDF, resolve the SIDF, resolve the SUCI, and obtain the SUPI.
  • the UDM network element can determine the authentication mechanism of the ProSe relay communication according to the subscriber data corresponding to the SUPI, for example, determine the EAP-AKA' using the ProSe relay communication. In this way, the UDM network element can generate the authentication vector of the ProSe relay communication, and the specific implementation principle can refer to the relevant introduction in the above S1109, and will not be repeated here.
  • the UDM network element can judge whether the user is authorized to use relay communication according to the subscriber data corresponding to SUPI.
  • the specific implementation principle can also refer to the relevant introduction in S809 above, and will not be repeated .
  • the UDM network element sends a ProSe UE authentication obtaining response message to the AUSF network element.
  • the UDM network element receives the ProSe UE authentication obtaining response message from the AUSF network element.
  • the ProSe UE authentication acquisition response message is a response message to the above ProSe UE authentication acquisition request message.
  • the ProSe UE authentication obtaining response message may include: the ProSe authentication vector of EAP-AKA', optionally, may also include: SUPI.
  • the ProSe UE authentication obtained response message may also indicate: the ProSe authentication vector of the EAP-AKA' is an EAP-AKA' authentication vector supporting ProSe relay communication.
  • the ProSe UE authentication obtaining response message can indicate the authentication vector for EAP-AKA' through its own message type, and EAP-AKA' supports ProSe relay communication.
  • the ProSe UE authentication acquisition response message may also use the carried indication information to indicate that the authentication vector is used for EAP-AKA', and EAP-AKA' supports ProSe relay communication.
  • the AUSF network element stores the XRES.
  • the AUSF network element After the AUSF network element receives the ProSe UE authentication obtained response message, it can store the XRES, and optionally, also store the SUPI for subsequent authentication. In the ProSe authentication, the AUSF network element may not deduce K SEAF to prevent redundant information from being generated and waste of resources.
  • the AUSF network element sends a ProSe UE authentication response message #1 to the relay AMF network element.
  • the relay AMF network element receives the ProSe UE authentication response message #1 from the AUSF network element.
  • the ProSe UE authentication response message #1 is a response message to the above ProSe UE authentication request message #1.
  • ProSe UE authentication response message #1 may include: EAP request message/AKA' challenge message.
  • the EAP request message/AKA' challenge message may be a NAS message determined according to the UE authentication acquisition response message #1, including: RAND and AUTN.
  • the relay AMF network element sends a ProSe communication authentication request message to the relay UE.
  • the relay UE receives the ProSe communication authentication request message from the relay AMF network element.
  • the relay UE sends a remote UE authentication request message to the remote UE.
  • the remote UE receives the remote UE authentication request message from the relay UE.
  • the remote UE deduces the RES.
  • the remote UE sends a remote UE authentication response message to the relay UE.
  • the remote UE receives the remote UE authentication response message from the relay UE.
  • the relay UE sends a ProSe communication authentication response message to the relay AMF network element.
  • relay The AMF network element receives the ProSe communication authentication response message from the relay UE.
  • the relay AMF network element sends the ProSe UE authentication request message #2 to the AUSF network element.
  • the AUSF network element receives the ProSe UE authentication request message #2 from the relay AMF network element.
  • the ProSe UE authentication request message #2 can be used to request ProSe authentication for the remote UE, including: EAP response message/AKA’challenge message. That is to say, the relay AMF network element can obtain the EAP response message/AKA'challenge message from the ProSe communication authentication response message, encapsulate it into the ProSe UE authentication request message #2, and transparently transmit the EAP response to the AUSF network element Messages/AKA 'challenge messages.
  • the ProSe UE authentication request message #2 may also include: RSC and Nonce_1, that is, the relay AMF network element can also use RSC and Nonce_1 Encapsulated into ProSe UE authentication request message #2.
  • the ProSe UE authentication request message #2 may still include: RSC and Nonce_1.
  • the AUSF network element authenticates the remote UE.
  • the AUSF network element sends a ProSe UE authentication response message #2 to the relay AMF network element.
  • the relay AMF network element receives the ProSe UE authentication response message #2 from the AUSF network element.
  • the ProSe UE authentication response message #2 is a response message to the ProSe UE authentication request message #2.
  • the ProSe UE authentication response message #2 may include: an EAP success message to indicate that the authentication is passed, and may also include: a ProSe key and Nonce_2. That is to say, after the AUSF network element determines that the remote UE has passed the authentication, it can generate an EAP success message, and encapsulate the EAP success message, ProSe key and Nonce_2 into the ProSe UE authentication response message #2, and then send the message to the relay AMF network element Send ProSe UE authentication response message #2.
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • the remote UE deduces the ProSe key.
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication. Since the interaction between the relay AMF network element, the AUSF network element and the UDM network element can be realized through new signaling, it can be decoupled from the existing authentication process and avoid the impact of the authentication process on ProSe authentication.
  • FIG. 12 is a fifth schematic flowchart of the communication method provided by the embodiment of the present application.
  • This communication method is mainly applicable to communication among remote UEs, relay UEs, AMF network elements, AUSF network elements, and UDM network elements.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF network element may be a relay AUSF network element, or any other possible form of AUSF network element, which is not specifically limited.
  • the UDM network element may be a relay UDM network element, or any other possible form of UDM network element, which is not specifically limited.
  • the remote UE or the relay AMF network element can determine whether ProSe authentication has been performed.
  • the existing key such as K AUSF
  • the relay AUSF network element can be used to derive the ProSe key without performing Prose authentication again.
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE determines authentication indication information.
  • the authentication indication information may be used to indicate whether the remote UE has performed a main authentication procedure with the network, or to determine whether to perform ProSe authentication.
  • the authentication indication information includes: 1 bit.
  • the value of this 1 bit is 1, indicating that the remote UE has performed the main authentication process, or determined that ProSe authentication is not required, or determined to use the existing K AUSF .
  • the value of this 1 bit is 0, indicating that the remote UE has not performed primary authentication, or is determined to perform ProSe authentication.
  • the value of this 1 bit is 1, indicating that the remote UE does not perform the main authentication, or determines to perform the ProSe authentication procedure.
  • the value of this 1 bit is 0, indicating that the remote UE has performed primary authentication, or determined that ProSe authentication does not need to be performed, or determined to use the existing K AUSF .
  • the remote UE after the remote UE discovers the relay UE through the relay discovery process, it can determine whether the key used for deriving the ProSe key, such as K AUSF , is locally stored. If the above K AUSF is stored, it means that the remote UE has performed ProSe authentication, and generates authentication instruction information corresponding to the value. Otherwise, if the above K AUSF is not stored, it means that the remote UE has not performed ProSe authentication, and authentication instruction information corresponding to the value is generated.
  • K AUSF the key used for deriving the ProSe key
  • the key used for deriving the ProSe key is K AUSF is only an example, and K AUSF may be replaced by other keys, such as the above-mentioned K PROSE .
  • the key used for deriving the ProSe key may also be stored in the remote UE and the network respectively. For example, after the remote UE and the network perform ProSe authentication, the key can be stored in the remote UE and the network respectively. There is no limit here.
  • S1204 is an optional step, that is, the remote UE directly indicates whether it has performed authentication through the authentication indication information, which is only an exemplary manner.
  • the remote UE may also correspondingly indicate whether it has performed authentication by generating indication information indicating authentication.
  • the subsequent device may determine whether the remote UE has performed authentication by checking whether the signaling carries authentication indication information. If the signaling carries authentication indication information, it is used to indicate that the remote UE has performed authentication. If the signaling does not carry the authentication indication information, it is used to implicitly indicate that the remote UE does not perform authentication. Or, if the signaling carries authentication indication information, it is used to display and indicate that the remote UE does not perform authentication. If the signaling does not carry authentication indication information, it is used to implicitly indicate that the remote UE has performed authentication. For another example, optionally, the remote UE may not indicate whether it has performed ProSe authentication, It is determined by the relay AMF network element itself.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the direct communication request message may further include: authentication indication information.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request the relay communication, or to request the key of the ProSe relay communication, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay key request message may also include the identifier of the relay UE, such as 5G GUTI.
  • the relay key request message may further include: authentication indication information. That is to say, after the relay UE receives the direct communication request message and obtains the authentication indication information, it can continue to encapsulate the authentication indication information into the relay key request message, and then send the relay key to the relay AMF network element request message.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element determines whether to initiate ProSe authentication.
  • the relay AMF network element may determine whether to initiate ProSe authentication according to the authentication indication information in the relay key request message, or according to whether the relay key request message carries authentication indication information. In this case, if the relay AMF network element determines not to initiate ProSe authentication, it obtains the identity of the AUSF network element from the UDM network element to obtain the ProSe key from the AUSF network element, that is, S1209-S1216. Otherwise, if the relay AMF network element determines to initiate ProSe authentication, ProSe authentication is performed, that is, S1217.
  • S1208 is an optional step. If the remote UE does not indicate whether it has performed authentication, the relay AMF network element can skip S1208 and execute S1209, so as to obtain the identity of the AUSF network element from the UDM network element. , to determine whether the remote UE has performed authentication or the network has an available key (such as K AUSF ), that is, to determine whether to initiate ProSe communication authentication. If the relay AMF network element determines not to initiate the ProSe authentication, execute S1211-S1216. Otherwise, if the relay AMF network element determines to initiate ProSe authentication, perform S1217.
  • K AUSF available key
  • the relay AMF network element sends an AUSF acquisition request (Nudm_AUSFIdGet Request) message to the UDM network element.
  • the UDM network element receives the AUSF acquisition request message from the relay AMF network element.
  • the AUSF obtain request message is used to request the UDM network element to feed back the identifier of the AUSF network element, such as the ID (instance Id) of the AUSF network element, or the IP address (such as IPv4 address, IPv6 address or prefix) of the AUSF network element.
  • the AUSF acquisition request message may include: the SUCI of the remote UE. In this way, the UDM network element can obtain the SUCI of the remote UE from it, so as to find the identity of the AUSF network element according to the SUCI.
  • UDM The network element, or the UDM network element can call the SIDF to parse the SUCI to obtain the SUPI, so as to obtain the context of the remote UE stored in the UDM network element according to the SUPI, to determine whether the identity of the AUSF network element can be obtained from the context.
  • the UDM network element can also judge whether the user is authorized to use the relay communication according to the subscriber data corresponding to the SUPI.
  • the specific implementation principle can also refer to the relevant introduction in the above S809, and will not be repeated here.
  • AUSF obtaining request message is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as AUSF identification obtaining request message, or AUSF address obtaining request message Wait, no qualifications for that.
  • the UDM network element sends an AUSF get response (Nudm_AUSFIdGet Response) message to the relay AMF network element.
  • the UDM network element receives the AUSF obtain response message from the relay AMF network element.
  • the AUSF obtain response message is the response message of the above AUSF obtain request message.
  • the AUSF obtaining response message may include: the identifier of the AUSF network element, and optionally may also include: SUPI.
  • the context of the remote UE should store the identity of the AUSF network element that authenticated the remote UE.
  • the UDM network element can obtain the identifier of the AUSF network element from the context of the remote UE, encapsulate it into an AUSF obtain response message, and then send the AUSF obtain response message to the relay AMF network element.
  • the remote UE does not perform ProSe authentication, then there is no identity of the AUSF network element in the context of the remote UE. In this case, the UDM network element cannot obtain the identity of the AUSF network element from the context of the remote UE, but directly sends an AUSF obtainment response message to the relay AMF network element.
  • the relay AMF network element should be able to obtain the identity of the AUSF network element.
  • AUSF obtaining response message is only an exemplary naming method in the embodiment of this application, and it can also be replaced by any other possible naming methods, such as AUSF identification obtaining response message, or AUSF address obtaining response message Wait, no qualifications for that.
  • the relay AMF network element sends a ProSe key request (Nausf_ProSe_Key Request) message to the AUSF network element.
  • the AUSF network element receives the ProSe key request message from the relay AMF network element.
  • the relay AMF network element can send a ProSe key request message to the AUSF network element according to the identifier of the AUSF network element.
  • the ProSe key request message is mainly used to request ProSe keys, including: SUPI, RSC and Nonce_1.
  • the AUSF network element can obtain RSC and Nonce_1 from it. In this way, the AUSF network element can deduce the ProSe key according to the previously determined K AUSF when authenticating the remote UE, the Nonce_2 generated this time, and the RSC and Nonce_1.
  • the relevant introduction in S820 for the specific implementation principle of deriving the ProSe key, reference may be made to the relevant introduction in S820 above, and details will not be repeated here.
  • ProSe key request message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as the ProSe communication key request message, which is not done Any restrictions.
  • the AUSF network element sends a ProSe key response (Nausf_ProSe_Key Response) message to the relay AMF network element.
  • the relay AMF network element receives the ProSe key response message from the AUSF network element interest.
  • the ProSe key response message is a response message to the above ProSe key request message, including: ProSe key and Nonce_2.
  • the ProSe key response message is only an exemplary naming method in the embodiment of the present application, and it can also be replaced by any other possible naming methods, such as the ProSe communication key response message, which is not limited in any way .
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • the remote UE deduces the ProSe key.
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication.
  • the AUSF network element can deduce the ProSe key without authentication, so as to effectively improve the operating efficiency of the equipment.
  • Secure communication between the relay UE and the remote UE can be established by performing ProSe authentication.
  • S1217 can be S807-S822 in scene 1, or S907-S922 in scene 2, or S1007-S1021 in scene 3, or S1107-S1121 in scene 4.
  • the specific implementation principle is similar to scene 1-scene 4 , you can refer to it for understanding, so I won’t repeat it here.
  • FIG. 13 is a sixth schematic flowchart of the communication method provided by the embodiment of the present application.
  • the communication method is mainly applicable to the communication between the remote UE, the relay UE, the AMF network element, the AUSF network element, and the UDM network element.
  • the AMF network element may include: a relay AMF network element and a remote AMF network element, and the two may be the same or different AMF network elements, which are not specifically limited.
  • the AUSF network element may include: a relay AUSF network element and a remote AUSF network element, and the two may be different AUSF network elements.
  • the UDM network element may be a remote UDM network element, or any other possible form of UDM network element, which is not specifically limited.
  • the UDM network element can determine whether the remote UE has performed authentication. After the authentication has been performed, the ProSe key can be directly deduced without re-authentication.
  • the flow of the communication method is as follows:
  • the remote UE registers with the network, and acquires ProSe communication policy information from the network.
  • the relay UE registers with the network, and acquires ProSe communication policy information from the network.
  • the remote UE performs a relay discovery process.
  • the remote UE wants to use the ProSe relay to communicate, it can discover the relay UE by performing the relay discovery process.
  • the remote UE sends a direct communication request message to the relay UE.
  • the relay UE receives the direct communication request message from the remote UE.
  • the direct communication request message can be used for the remote UE to request to communicate with the relay UE, including: SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay UE sends a relay key request message to the relay AMF network element.
  • the relay AMF network element receives the relay key request message from the relay UE.
  • the relay key request message is mainly used for the relay UE to request the relay communication, or to request the key of the ProSe relay communication, including: the SUCI of the relay UE, the SUCI, RSC, and Nonce_1 of the remote UE.
  • the relay AMF network element verifies the relay UE.
  • the relay AMF network element sends a UE authentication request message/sends a ProSe UE authentication request message to the relay AUSF network element.
  • the relay AUSF network element receives UE authentication request message #1/ProSe UE authentication request message #1 from the relay AMF network element.
  • the specific implementation principle of the UE authentication request message can refer to the relevant introduction in the above S807, and the specific implementation principle of the ProSe UE authentication request message can refer to the relevant introduction in the above S1007, and will not be repeated.
  • the relay AUSF network element sends a UE authentication acquisition request message/ProSe UE authentication acquisition request message to the UDM network element.
  • the UDM network element receives the UE authentication acquisition request message/ProSe UE authentication acquisition request message from the relay AUSF network element.
  • the specific implementation principle of the UE authentication acquisition request message can refer to the relevant introduction in the above S808, and the specific implementation principle of the ProSe UE authentication acquisition request message can refer to the relevant introduction in the above S1008, and will not be repeated.
  • the UDM network element determines whether the remote UE has performed authentication, or determines whether there is a serving AUSF instance.
  • the UDM network element receives the UE authentication acquisition request message/ProSe UE authentication acquisition request message, and can obtain the SUCI of the remote UE from it, so as to find the identity of the remote AUSF network element according to the SUCI.
  • the UDM network element, or the UDM network element can call the SIDF to parse the SUCI to obtain the SUPI, so as to obtain the context of the remote UE stored in the UDM network element according to the SUPI, to determine whether the remote AUSF network element can be obtained from the context logo.
  • the UDM network element can obtain the identity of the remote AUSF network element, it means that the remote UE has performed authentication, and the serving AUSF instance can directly obtain the ProSe key from the remote AUSF network element, that is, S1310 -S1317, no need to re-authenticate. Otherwise, if the UDM network element cannot obtain the identity of the remote AUSF network element, it means that the remote UE has not performed main authentication, and there is no serving AUSF instance, and needs to perform ProSe authentication, that is, S1318.
  • the UDM network element sends a ProSe key request message to the remote AUSF network element.
  • the remote AUSF network element receives the ProSe key request message from the UDM network element.
  • the UDM network element can send a ProSe key request message to the remote AUSF network element according to the identifier of the remote AUSF network element.
  • the ProSe key request message is mainly used to request ProSe keys, including: SUPI, RSC and Nonce_1.
  • the remote AUSF network element After the remote AUSF network element receives the ProSe key request message, it can obtain the RSC and Nonce_1. In this way, the remote AUSF network element can deduce the ProSe key according to the previously determined K AUSF when authenticating the remote UE, the Nonce_2 generated this time, and the RSC and Nonce_1.
  • the relevant introduction in S820 for the specific implementation principle of deriving the ProSe key, reference may be made to the relevant introduction in S820 above, and details will not be repeated here.
  • the remote AUSF network element sends a ProSe key response message to the UDM network element.
  • the UDM network element receives the ProSe key response message from the remote AUSF network element.
  • the ProSe key response message is a response message to the above ProSe key request message, and may include: the ProSe key and Nonce_2.
  • the UDM network element sends a UE authentication acquisition response message/ProSe UE authentication acquisition response message to the relay AUSF network element.
  • the relay A USF network element receives the UE authentication acquisition response message/ProSe UE authentication acquisition response message from the UDM network element.
  • the UE authentication obtaining response message/ProSe UE authentication obtaining response message may include: ProSe key and Nonce_2.
  • ProSe key For the specific implementation principle of the UE authentication obtaining response message, please refer to the relevant introduction in the above S810, and for the specific implementation principle of the ProSe UE authentication obtaining response message, please refer to the above relevant introduction in S1010, and will not repeat them here.
  • the relay AUSF network element sends the UE authentication response message/ProSe UE authentication response message to the relay AMF network element.
  • the relay AMF network element receives the UE authentication response message/ProSe UE authentication response message from the relay AUSF network element.
  • the UE authentication response message/ProSe UE authentication response message may include: ProSe key and Nonce_2.
  • the specific implementation principle of the UE authentication response message can also refer to the relevant introduction in the above S812, and the specific implementation principle of the ProSe UE authentication response message can also refer to the relevant introduction in the above S1012, and will not be repeated.
  • the relay AMF network element sends a relay key response message to the relay UE.
  • the relay UE receives the relay key response message from the relay AMF network element.
  • the relay UE sends a direct security mode command message to the remote UE.
  • the remote UE receives the direct security mode command message from the relay UE.
  • the remote UE deduces the ProSe key.
  • the remote UE sends a direct security mode command completion message to the relay UE.
  • the relay UE receives the direct security mode command completion message from the remote UE.
  • both the remote UE and the relay UE have obtained the same ProSe key, and the session keys of the PC5 connection, such as the encryption key and the integrity protection key, can be deduced based on the ProSe key to ensure the security of the ProSe relay communication.
  • the remote AUSF network element can deduce the ProSe key without authentication, so as to effectively improve the operating efficiency of the equipment.
  • Secure communication between the relay UE and the remote UE can be established by performing ProSe authentication.
  • S1318 can be S809-S822 in scene 1, or S909-S922 in scene 2, or S1009-S1021 in scene 3, or S1109-S1121 in scene 4.
  • the specific implementation principle is similar to scene 1-scene 4 , you can refer to it for understanding, so I won’t repeat it here.
  • FIG. 14 is a seventh schematic flowchart of a communication method provided by an embodiment of the present application.
  • the communication method can be applied to the communication between the remote terminal, the relay terminal, the access and mobility management network element, the authentication service network element, and the data management network element.
  • the remote terminal may be the remote UE in the above scenarios 1-6.
  • the relay terminal may be the relay UE in the above scenarios 1-6.
  • the access and mobility management network element may be the relay AMF network element in the above scenarios 1-6.
  • the authentication service network element may be the AUSF network element in the above scenarios 1-6.
  • the data management network element may be the UDM network element in the above scenarios 1-6.
  • the access and mobility management network element sends an authentication request message #3 to the authentication service network element.
  • the authentication service network element receives the authentication request message #3 from the access and mobility management network element.
  • Authentication request message #3 may be used to request authentication of the remote terminal.
  • requesting the authentication service network element to authenticate the remote terminal is used to trigger the authentication service network element to execute the authentication process of ProSe communication, so as to ensure the correctness and reliability of the authentication.
  • the authentication request message #3 includes: the SUCI of the remote terminal, and may also include at least one of the following: service network name, RSC, random value #1 (such as the above-mentioned Nonce_1) or ProSe relay communication indication information (such as the above-mentioned ProSe relay communication Instruction #1).
  • any one of the service network name, RSC or ProSe relay communication indication information can be used to indicate that the authentication is the authentication of ProSe relay communication, so as to trigger the authentication process of the authentication service network element to perform ProSe communication, so as to ensure the accuracy and accuracy of the authentication. Reliability without impacting existing processes.
  • Any one of the service network name, RSC, or random value #1 can be used to determine the ProSe key, so that the AUSF network element can directly deduce the ProSe key based on these parameters without additional acquisition when it is determined that the authentication is passed. Improve the efficiency of key derivation.
  • the authentication request message #3 may specifically be the UE authentication request message #1 above, or the ProSe UE authentication request message #1.
  • the specific implementation principle may refer to the relevant introduction in the above S807, S907, S1007, or S1107, and will not be repeated.
  • the authentication service network element can also save the RSC and random value #1, so that they can be directly used in the subsequent key derivation without re-obtaining. Further improve the efficiency of key derivation.
  • the authentication service network element sends an authentication request message #1 to the data management network element.
  • the data management network element receives the authentication request message #1 from the authentication service network element.
  • Authentication request message #1 may be used to request authentication of the remote terminal.
  • the authentication request message #1 includes at least one of the following items: SUCI of the remote terminal, service network name, RSC or ProSe relay communication indication information, for example, the ProSe relay communication indication information is the above-mentioned ProSe relay communication indication information #2, The ProSe relay communication indication information is used to indicate that the authentication is the authentication of ProSe relay communication.
  • the authentication request message #1 triggers the data management network element to obtain the authentication vector corresponding to the ProSe relay communication, so as to ensure the correctness and reliability of the authentication of the ProSe relay communication.
  • the authentication request message #1 may be the above-mentioned UE authentication acquisition request message, or the ProSe UE authentication acquisition request message.
  • the specific implementation principle can refer to the relevant introduction in the above S808, S908, S1008, or S1108, and will not be repeated here.
  • sending the authentication request message #1 from the authentication service network element to the data management network element may also include: the authentication service network element generates the authentication request message #1 according to the authentication request message #3 from the mobility and access management network element, and then Send an authentication request message #1 to the data management network element.
  • the data management network element sends an authentication response message #1 to the authentication service network element. Accordingly, authentication services The network element receives the authentication response message #1 from the data management network element.
  • the authentication response message #1 may be the above-mentioned UE authentication acquisition response message, or the ProSe UE authentication acquisition response message.
  • the authentication response message #1 includes: ProSe authentication information #1.
  • the ProSe authentication information #1 may include at least one of the following: information for the remote terminal to authenticate the network, or information for authenticating the remote terminal.
  • the ProSe authentication information #1 may be at least one of the following: ProSe authentication vector #1 of AKA (for example, ProSe authentication vector #1 of 5G AKA), or ProSe authentication vector of EAP-AKA'. That is to say, the authentication between the remote UE and the network can be based on the enhancement of existing authentication methods, such as 5G AKA or EAP-AKA', to ensure ProSe relay communication without introducing new authentication methods Safety.
  • ProSe authentication information #1 is ProSe authentication vector #1 of AKA, it may include at least one of the following items: information used for remote terminal authentication network, such as the above-mentioned RAND and AUTN, used for authentication service network element authentication remote Terminal information, such as the above-mentioned XRES*, or information used to determine the ProSe key, such as the above-mentioned K AUSF .
  • ProSe authentication information #1 is the ProSe authentication vector of EAP-AKA', it may include at least one of the following items: information for the remote terminal authentication network, such as the above-mentioned RAND and AUTN, for the authentication service
  • the network element authenticates the information of the remote terminal, such as the above-mentioned XRES, or the information used to determine the ProSe key, such as the above-mentioned CK and IK.
  • the authentication response message #1 may also include: indication information, used to indicate that the ProSe authentication information #1 is the authentication information corresponding to the authentication method, such as indicating that the authentication information is the authentication information of the EAP-AKA' mechanism or the 5G AKA mechanism Certification Information.
  • the indication information is also used to indicate that the authentication information is authentication information for ProSe communication, or in other words supports authentication for ProSe communication. That is to say, the indication information can be used to indicate that the authentication information is the authentication information of EAP-AKA' or 5G AKA supported by ProSe relay communication, that is, the authentication information of enhanced EAP-AKA' or AKA.
  • the enhanced EAP-AKA' mechanism or 5G AKA mechanism can be understood as: in the authentication process, any network element participating in the authentication uses a new authentication vector generation method to determine the authentication vector, use new messages, and use new services. operation, or adding new cells, it can be considered as an enhanced EAP-AKA' mechanism or a 5G AKA mechanism.
  • the data management network element may also determine that the remote terminal is authorized to obtain the relay service. That is to say, the ProSe relay communication authentication is performed on the remote terminal only after it is determined that the remote terminal has the authority to use the relay communication, so as to avoid invalid authentication. And, before S1403, the data management network element may determine the ProSe authentication information #1 according to the authentication request message #1.
  • the data management network element can select the supported EAP-AKA' mechanism or the 5G AKA mechanism of the ProSe relay communication, That is, enhanced EAP-AKA' mechanism or AKA mechanism.
  • Data management network elements can also choose the existing EAP-AKA’ mechanism or 5G AKA mechanism to ensure that for ProSe relay communication scenarios, relevant network elements only need to support the enhanced logic of one process to reduce complexity.
  • the existing EAP-AKA’ mechanism or 5G AKA mechanism selected by the data management network element can be understood as: the data management network element uses the existing method to deduce the authentication vector and use the existing service operation, etc.
  • the authentication service network element sends an authentication response message #3 to the access and mobility management network element.
  • the access and mobility management network element receives the authentication response message #3 from the authentication service network element.
  • the authentication response message #3 may be the above UE authentication response message #1, or the ProSe UE authentication response message #1.
  • Authentication response message #3 includes: ProSe authentication information #2.
  • ProSe authentication information #2 includes: information for the remote terminal to authenticate the network.
  • the ProSe authentication information #2 may also include: information for the network to authenticate the remote terminal. That is to say, the authentication of ProSe relay communication can be triggered by the access and mobility management network element, for example, when there is a business demand, so that the authentication service network element can perform authentication in a targeted manner to ensure the validity of the authentication.
  • ProSe authentication information #2 may be determined according to ProSe authentication information #1.
  • ProSe authentication information #2 may be at least one of the following: ProSe authentication vector #2 of AKA (for example, ProSe authentication vector #2 of 5G AKA), or EAP request message or AKA' challenge message.
  • ProSe authentication vector #2 of AKA for example, ProSe authentication vector #2 of 5G AKA
  • EAP request message or AKA' challenge message for example, if the existing AKA authentication mechanism is adopted, the AKA ProSe authentication vector #2 can be determined according to the AKA ProSe authentication vector #1, without introducing new functions, thereby reducing the complexity of network elements.
  • the EAP request message or AKA' challenge message can be determined according to the ProSe authentication vector of EAP-AKA', without introducing new functions, thereby reducing the complexity of network elements.
  • ProSe authentication information #2 is ProSe authentication vector #2 of AKA, it may include at least one of the following: information used for remote terminal authentication network, such as RAND and AUTN, or information for access and mobility management network Meta-authentication information of the remote terminal, such as the above-mentioned HXRES*.
  • information used for remote terminal authentication network such as RAND and AUTN
  • information for access and mobility management network Meta-authentication information of the remote terminal such as the above-mentioned HXRES*.
  • the ProSe authentication information #2 is an EAP request message or an AKA' challenge message
  • it may include: information for the remote terminal authentication network, such as RAND and AUTN.
  • the authentication service network element encapsulates the information used in the ProSe authentication information #1 for the remote terminal authentication network into the EAP request message or the AKA'challenge message, so that the message can be used as a container for access and mobility management
  • the network element sends the message so that the access and mobility management network elements can directly transparently transmit the message, so as to improve processing efficiency and reduce overhead.
  • the authentication service network element skips deriving the key used for communication between the remote terminal and the network, such as K SEAF , so as to prevent redundant information from being generated, causing waste of resources or affecting existing mechanisms.
  • the authentication service network element may determine to skip deriving the key used for the communication between the remote terminal and the network according to the locally stored information (such as RSC or Nonce_1) or the received authentication response message #1.
  • the access and mobility management network element sends information for the remote terminal to authenticate the network to the relay terminal.
  • the relay terminal receives the information for the authentication network of the remote terminal from the access and mobility management network element.
  • the information for the remote terminal authentication network may include: EAP request message/AKA'challenge message of RAND and AUTN, or directly include: RAND and AUTN, or include: a container, and the container includes: RAND and AUTN.
  • Information for the remote terminal to authenticate the network may be carried in the message. For example, in the ProSe communication authentication request message, or any other possible messages, there is no specific limitation on this. The name of the message or the indication information carried may be used to indicate that the authentication process of the ProSe relay communication needs to be performed by the remote terminal. In this way, the relay terminal can send a message for the remote terminal to authenticate the network to the remote terminal according to the message.
  • the message is a message protected by a communication key, that is, the information used for the remote terminal to authenticate the network is information protected by a communication key.
  • the communication key is used for the communication between the relay terminal and the network, so as to ensure the communication security between the relay terminal and the network.
  • the access and mobility management network element before the access and mobility management network element sends the remote terminal authentication network information to the relay terminal, the access and mobility management network element skips obtaining ngKSI and ABBA parameters, or the access and mobility management network element skips Generate keyset ID and anti-downgrade parameters. Access and mobility management network elements do not send ngKSI and ABBA parameters to the relay terminal.
  • the relay terminal sends information for the remote terminal to authenticate the network to the remote terminal.
  • the remote terminal receives information for the remote terminal to authenticate the network from the relay terminal.
  • the information for the remote terminal authentication network may include: an EAP request message/AKA'challenge message carrying RAND and AUTN, or directly include: RAND and AUTN, or include: a container, which includes: RAND and AUTN.
  • the information for the remote terminal authentication network may be carried in a message, such as a remote terminal authentication request message, or any other possible message, which is not specifically limited.
  • the name of the message or the indication information carried may indicate that the authentication process of the ProSe relay communication needs to be performed by the remote terminal or indicate that authentication of the remote UE is requested.
  • the relay terminal sending the information for the remote terminal authentication network to the remote terminal may include: the relay terminal sends the information for the remote terminal authentication network to the remote terminal according to the message, so as to ensure ProSe relay communication Certified reliability.
  • the relay terminal sends information for the remote terminal to authenticate the network to the remote terminal according to the name of the message or the indication information included in the message.
  • the message may be the above-mentioned remote UE authentication request message, and specific implementation principles may refer to related introductions in S814, S914, S1014, or S1114 above, and will not be repeated here.
  • the remote terminal sends the authentication response information determined by the remote terminal to the relay terminal.
  • the relay terminal receives the authentication response information from the remote terminal.
  • the authentication response information determined by the remote terminal is used to authenticate the remote terminal, such as the above-mentioned RES or RES*. That is to say, the relay terminal can actively interact with the remote terminal to ensure that the remote terminal can authenticate the network, and feed back its own authentication response message to the network to ensure that the network can also authenticate the remote terminal.
  • the authentication response information determined by the remote terminal may be carried in a remote terminal authentication response message or any other possible message, which is not specifically limited.
  • the remote terminal authentication response message may be the above remote UE authentication response message, and the specific implementation principle may refer to the relevant introduction in S815-S816, S915-S916, S1015-S1016, or S1115-S1116 above, and will not be repeated here.
  • the remote terminal skips deriving a key used for communication between the remote terminal and the network, such as K SEAF .
  • the relay terminal sends the authentication response information determined by the remote terminal to the access and mobility management network element.
  • the access and mobility management network element receives the authentication response information determined by the remote terminal from the relay terminal.
  • the authentication response information determined by the remote terminal is used to authenticate the remote terminal, such as the above-mentioned RES or RES*.
  • the authentication response information determined by the remote terminal may be carried in a ProSe communication authentication response message or any other possible message, which is not specifically limited.
  • the ProSe communication authentication response message is a message protected by a communication key, that is, the authentication response information determined by the remote terminal is information protected by a communication key, so as to ensure that the relay terminal Security of communications between endpoints and the network.
  • the communication key is a non-access stratum security key established between the relay terminal and the access and mobility management network element, and the non-access stratum security key may include an encryption key and an integrity protection key.
  • S140817, S917, S1017, or S1117 reference may be made to relevant introductions in S817, S917, S1017, or S1117 above, and will not be repeated here.
  • the access and mobility management network element sends an authentication request message #2 to the authentication service network element.
  • the authentication service network element receives the authentication request message #2 from the access and mobility management network element.
  • Authentication request message #2 is used to request authentication of the remote terminal.
  • the authentication request message #2 may include at least one of the following: the authentication response information determined by the remote terminal, the RSC used to determine the ProSe key, or the random value #1 used to determine the ProSe key, and the authentication response message is used to authenticate the remote terminal. end terminal. That is to say, the access and mobility management network element can send parameters for deriving the ProSe key, such as RSC and/or random value #1, to the authentication service network element only after determining that the remote terminal has passed the authentication, so that Provide necessary parameters on demand, without pre-stored information, and prevent waste of resources.
  • the authentication request message #2 can be the UE authentication request message #2 above, or the ProSe UE authentication request message #2, and the specific implementation principle can refer to the relevant introduction in the above S819, S919, S1018, or S1118, and will not be repeated.
  • the authentication service network element can also save the RSC and the random value #1, so that they can be directly used in subsequent key derivation without re-obtaining, so as to further improve the efficiency of key derivation.
  • the information used to determine the ProSe key includes an intermediate key such as K AUSF , or CK' and IK', or K PROSE .
  • the authentication service network element determines the ProSe key according to at least one of the following: service network name, RSC, random value #1, random value #2 and the intermediate key. That is to say, the authentication service network element can select appropriate parameters to determine the ProSe key according to business scenarios and key isolation requirements, so as to adapt to more business scenarios.
  • the ProSe key is determined from the RSC, random value #1, random value #2 and the intermediate key.
  • the ProSe key is determined according to the serving network name, random value #1, random value #2 and the intermediate key.
  • deduce the intermediate key of the adjacent service according to the intermediate key, RSC and SUPI of the remote terminal and then determine the ProSe key according to the intermediate key of the adjacent service, random value #1 and random value #2, or through other combinations Determine the ProSe key, which will not be listed here.
  • the authentication service network element sends an authentication response message #2 to the access and mobility management network element.
  • the access and mobility management network element receives the sending authentication response message #2 from the authentication service network element.
  • Authentication response message #2 includes: ProSe key.
  • the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the authentication response message #2 may further include: a random value #2.
  • the random value #2 is used to determine the ProSe key, so that the remote terminal can directly deduce the ProSe key according to the random value #2 when it is determined that the authentication is passed, so as to ensure that different keys are deduced for different ProSe communications of the remote UE.
  • Implement key isolation The authentication request message #2 can be the above-mentioned UE authentication response message #2, or the ProSe UE authentication response message #2.
  • the specific implementation principle can refer to the relevant introduction in the above S820-S821, S920-S921, S1019-S1020, or S1119-S1120 ,No longer.
  • the authentication response message #2 may further include at least one of the following items: a user hidden identity SUPI of the remote terminal, or an EAP success message.
  • the EAP success message may be used to indicate that the network authenticates the remote terminal successfully.
  • the SUPI of the remote terminal is used to indicate that the relay terminal needs to report the information of the remote UE to the network.
  • the access and mobility management network element sends the ProSe key to the relay terminal.
  • the relay terminal receives the ProSe key from the access and mobility management network element.
  • the access and mobility management network element may also send the SUPI of the remote terminal to the relay terminal to indicate that the relay terminal needs to report the information of the remote UE to the network.
  • the access and mobility management network element may also send an EAP success message to the relay terminal to indicate that the network authenticates the remote terminal successfully.
  • the remote terminal and the relay terminal can deduce the communication protection key of the PC5 connection based on the ProSe key.
  • the remote terminal and the relay terminal can deduce a session key based on the ProSe key, and then the remote terminal The terminal and the relay terminal further deduce the communication protection key (such as the encryption key and the integrity protection key) based on the session key, which is not limited in this application.
  • the access and mobility management network element may *Deduced XRES*), and the information used for accessing and mobility management network elements to authenticate the remote terminal (the above-mentioned HXRES*), to determine that the authentication of the remote terminal is passed. That is, access and mobility management network elements can authenticate remote terminals from the perspective of the service network, thereby improving the comprehensiveness of authentication and further ensuring the security of ProSe relay communication.
  • the access and mobility management network elements can authenticate remote terminals from the perspective of the service network, thereby improving the comprehensiveness of authentication and further ensuring the security of ProSe relay communication.
  • the access and mobility management network element may send the random value #2 to the relay terminal.
  • the relay terminal can receive the random value #2 from the access and mobility management network element.
  • the relay terminal can send the random value #2 to the remote terminal, so that the remote terminal receives the random value #2 from the relay terminal, based on at least one of the following: service network name, RSC, random value #1, random Value #2 and the intermediate key, determine the ProSe key.
  • the access and mobility management network element can send the parameters used to deduce the ProSe key to the remote terminal after the network authentication of the remote terminal is passed, that is, the random value #2, so as to avoid these parameters before the authentication is passed.
  • the access and mobility management network element determines that no authentication has been performed on the remote terminal or there is no key (such as K AUSF ) for deriving the ProSe key.
  • the authentication process of the ProSe relay communication is executed, so as to avoid waste of resources caused by repeated execution of the authentication process.
  • the existing key such as K AUSF
  • the access and mobility management network element determines that no authentication has been performed on the remote terminal or there is no key for deriving the ProSe key, which may include: the access and mobility management network element receives the remote terminal from the relay terminal The terminal indication information, the remote terminal indication information is used to indicate that the remote terminal has not performed authentication or does not have a key for deriving the ProSe key.
  • the access and mobility management network element determines that ProSe relay communication authentication has not been performed on the remote terminal according to the indication information of the remote terminal.
  • the access and mobility management network element determines that no authentication has been performed on the remote terminal or there is no key for deriving the ProSe key, which may include: the access and mobility management network element sends the authentication service network element to the data management network element The element obtains the request message, and receives the authentication service network element obtains the response message from the data management network element.
  • the request message obtained by the authentication service network element is used to request the identification of the authentication service network element, and the authentication service network element is used for ProSe relay communication authentication of the remote terminal.
  • the response message obtained by the authentication service network element does not carry the identification of the authentication service network element, which is used to indicate that no authentication has been performed on the remote terminal or that there is no key for deriving the ProSe key.
  • the access and mobility management network element obtains a response message from the authentication service network element, and determines that no authentication has been performed on the remote terminal or there is no key used to derive the ProSe key.
  • the access and mobility management network element can use the instruction information of the remote terminal instead of communicating with Interaction with other network elements can determine whether to perform authentication of ProSe relay communication. Or, the remote terminal may not indicate whether it has performed the authentication of ProSe relay communication, and the access and mobility management network element determines it according to the information fed back by the data management network element, so that the communication between the remote terminal and the access and mobility management network can be reduced. Communication overhead between elements, improve communication efficiency.
  • the data management network element determines that no authentication has been performed on the remote terminal, or determines that there is no key for deriving the ProSe key, or determines that it serves the remote terminal AUSF network elements.
  • the authentication process of the ProSe relay communication is performed , to avoid waste of resources due to repeated execution of the authentication process.
  • the data management network element can request the authentication service network element to use the existing key (such as K AUSF ) to derive the ProSe key, without performing the ProSe relay communication authentication again.
  • the remote terminal and the network can authenticate each other through the ProSe authentication information #1 provided by the data management network element.
  • the ProSe key for the communication between the remote UE and the relay UE can be generated, so as to deduce the communication of the PC5 connection (that is, the connection between the remote UE and the relay UE) based on the ProSe key Protect keys, such as encryption keys and integrity protection keys, to ensure the security of ProSe relay communication and avoid leakage of user information due to attacks.
  • the communication method provided by the embodiment of the present application is described in detail above with reference to FIG. 8-FIG. 14 .
  • the communication device for implementing the communication method provided by the embodiment of the present application will be described in detail below with reference to FIG. 15-FIG. 16 .
  • FIG. 15 is a first schematic structural diagram of a communication device provided by an embodiment of the present application.
  • a communication device 1500 includes: a receiving module 1501 and a sending module 1502 .
  • FIG. 15 shows only the main components of the communication device.
  • the communication device 1500 may be applicable to the communication system shown in FIG. 7 , to perform the function of the AUSF network element in the communication method shown in FIGS. 8-13 , or be applicable to the communication system shown in FIG. 7 In the communication system shown in FIG. 14 , the function of authenticating the service network element in the communication method shown in FIG. 14 is performed.
  • the sending module 1502 is configured to send the authentication request message #1 to the data management network element.
  • the receiving module 1501 is configured to receive the authentication response message #1 from the data management network element.
  • Authentication request message #1 is used to request authentication
  • the authentication response message #1 includes: proximity service ProSe authentication information #1
  • the ProSe authentication information #1 includes at least one of the following: information for the remote terminal to authenticate the network, or information for authenticating the remote terminal .
  • the receiving module 1501 is also used to receive the authentication request message #2 from the access and mobility management network element, and when the remote terminal is authenticated and passed, the sending module 1502 , which is also used to send authentication response message #2 to the access and mobility management network element.
  • the authentication request message #2 is used to request authentication of the remote terminal;
  • the authentication response message #2 includes: a ProSe key, and the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the ProSe authentication information #1 may be at least one of the following: the ProSe authentication vector #1 of the 5th generation communication system authentication and key agreement AKA, or the ProSe of the extended authentication protocol request EAP-AKA' Authentication vector.
  • the ProSe authentication vector #1 of AKA or the ProSe authentication vector of EAP-AKA' may include at least one of the following: information for the remote terminal to authenticate the network, and information for the authentication service network element to authenticate the remote terminal , or information used to determine the ProSe key.
  • the receiving module 1501 is further configured to receive the authentication request message #3 from the access and mobility management network element before the sending module 1502 sends the authentication request message #1 to the data management network element.
  • the sending module 1502 is further configured to, before the receiving module 1501 receives the authentication request message #2 from the access and mobility management network element, Send an authentication response message #3 to the access and mobility management network element.
  • the authentication response message #3 may include: ProSe authentication information #2, and the ProSe authentication information #2 includes: information for the remote terminal to authenticate the network.
  • ProSe authentication information #2 may be determined according to ProSe authentication information #1.
  • the ProSe authentication information #2 may be at least one of the following: AKA's ProSe authentication vector #2, or an EAP request message or an AKA' challenge message.
  • the ProSe authentication vector #2 of the AKA may be determined according to the ProSe authentication vector #1 of the AKA.
  • the EAP request message or the AKA' challenge message can be determined according to the ProSe authentication vector of EAP-AKA'.
  • the ProSe authentication vector #2 of the AKA may include at least one of the following items: information for the remote terminal to authenticate the network, or information for access and mobility management network elements to authenticate the remote terminal.
  • the EAP request message or the AKA' challenge message may include: information for the remote terminal to authenticate the network.
  • the authentication request message #3 may be used to request authentication of the remote terminal.
  • the authentication request message #3 may include at least one of the following: the remote terminal's concealed user identity SUCI, service network name, relay service code RSC, random value #1, or ProSe relay communication indication information. Wherein, any one of the service network name, RSC or ProSe relay communication indication information may be used to indicate that the authentication is the authentication of ProSe relay communication. Any of Serving Network Name, RSC, or Random Value #1 may be used to determine the ProSe key.
  • the communication device 1500 may further include: a processing module (not shown in FIG. 15 ).
  • the processing module is configured to save the RSC and the random value #1 if the authentication request message #3 includes the RSC and the random value #1 before the sending module 1502 sends the authentication response message #2 to the access and mobility management network element.
  • the information used to determine the ProSe key includes: an intermediate key.
  • the processing module is further configured to, before the sending module 1502 sends the authentication response message #2 to the access and mobility management network element, in the case that the remote terminal is authenticated, according to at least one of the following: service network name, RSC, random value #1, random value #2 and intermediate secret key to determine the ProSe key.
  • the authentication request message #2 may include at least one of the following: authentication response information determined by the remote terminal, RSC used to determine the ProSe key, or random value #1 used to determine the ProSe key , the authentication response message is used to authenticate the remote terminal.
  • the authentication response message #2 may include: random value #2. Random value #2 is used to determine the ProSe key.
  • the authentication response message #2 may also include at least one of the following: SUPI of the remote terminal, or an EAP success message.
  • the authentication service network element skips deriving the key used for the communication between the remote terminal and the network.
  • the receiving module 1501 and the sending module 1502 may also be integrated into one module, such as a transceiver module (not shown in FIG. 15 ).
  • the transceiver module is used to realize the sending function and the receiving function of the communication device 1500 .
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction, the communication device 1500 can perform the function of the AUSF network element in the communication method shown in any one of Figures 8-13, or perform the authentication in the communication method shown in Figure 14 The function of the serving network element.
  • the processing module involved in the communication device 1500 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1500 can be a network device, such as an AUSF network element or an authentication service network element, or a chip (system) or other components or components that can be set in the network device, or a network device that includes the network device. device, which is not limited in this application.
  • the communication device 1500 may be applicable to the communication system shown in FIG. 7, and perform the function of relaying AMF network elements in the communication methods shown in FIGS. 8-13, or be applicable to the communication system shown in FIG. In the communication system shown in , the functions of the access and mobility management network element in the communication method shown in FIG. 14 are performed.
  • the sending module 1502 is used to send the authentication request message #3 to the authentication service network element, and the receiving module 1501 is used to receive the authentication response message #3 from the authentication service network element.
  • the authentication response message #3 includes: ProSe authentication information #2, and the ProSe authentication information #2 includes: information for the remote terminal to authenticate the network.
  • the sending module 1502 is also used to send the authentication request message #2 to the authentication service network element, and when the remote terminal is authenticated, the receiving module 1501 is also used to Receive the authentication response message #2 from the authentication service network element, so that the sending module 1502 sends the ProSe key to the relay terminal.
  • the authentication request message #2 is used to request authentication of the remote terminal.
  • the authentication response message #2 includes: a ProSe key, which is used for communication between the relay terminal and the remote terminal.
  • the ProSe authentication information #2 may be at least one of the following: AKA's ProSe authentication vector #2, or an EAP request message or an AKA' challenge message.
  • the ProSe authentication vector #2 of AKA may include at least one of the following: network information, or information used for access and mobility management network elements to authenticate remote terminals.
  • the EAP request message or the AKA' challenge message may include: information for the remote terminal to authenticate the network.
  • the sending module 1502 is also used to Sending the information for the remote terminal to authenticate the network to the relay terminal
  • the receiving module 1501 is also used to receive the authentication response information determined by the remote terminal from the relay terminal. The authentication response information is used to authenticate the remote terminal.
  • the communication device 1500 may further include: a processing module (not shown in FIG. 15 ).
  • the processing module is further configured to, after the receiving module 1501 receives the remote terminal authentication response message from the relay terminal and before the sending module 1502 sends the authentication request message #2 to the authentication service network element, according to the authentication response determined by the remote terminal message, and the information used for the access and mobility management network element to authenticate the remote terminal, to determine that the remote terminal has passed the authentication.
  • the information for the remote terminal to authenticate the network and the authentication response information determined by the remote terminal are information protected by a communication key, and the communication key is used for communication between the relay terminal and the network.
  • the authentication request message #2 may include at least one of the following: the authentication response message determined by the remote terminal, the RSC used to determine the ProSe key, or the random value #1 used to determine the ProSe key, the authentication response message Used to authenticate remote terminals.
  • the authentication response message #2 may include: a random value #2, and the random value #2 is used to determine the ProSe key.
  • the authentication response message #2 may also include at least one of the following: SUPI of the remote terminal, or an EAP success message.
  • the sending module 1502 is further configured to send the random value #2 to the relay terminal after the receiving module 1501 receives the authentication response message #2 from the authentication service network element.
  • the processing module is further configured to determine that no ProSe relay communication authentication has been performed on the remote terminal before the sending module 1502 sends the authentication request message #3 to the authentication service network element.
  • the receiving module 1501 is further configured to receive remote terminal indication information from the relay terminal, where the remote terminal indication information is used to indicate that the remote terminal has not performed ProSe authentication for performing communication.
  • the processing module is further configured to determine, according to the indication information of the remote terminal, that no ProSe relay communication authentication has been performed on the remote terminal.
  • the sending module 1502 is further configured to send an authentication service network element acquisition request message to the data management network element
  • the receiving module 1501 is further configured to receive an authentication service network element acquisition response message from the data management network element.
  • the request message obtained by the authentication service network element is used to request the identification of the authentication service network element
  • the authentication service network element is used for ProSe relay communication authentication of the remote terminal.
  • the response message obtained by the authentication service network element does not carry the identification of the authentication service network element, which is used to indicate that the remote terminal has not been authenticated for the ProSe relay communication.
  • the processing module is further configured to determine that the authentication of the ProSe relay communication has not been performed on the remote terminal according to the response message obtained by the authentication service network element.
  • the receiving module 1501 and the sending module 1502 may also be integrated into one module, such as a transceiver module (not shown in FIG. 15 ).
  • the transceiver module is used to realize the sending function and receiving function of the communication device 1500 able.
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction, the communication device 1500 can perform the function of relaying the AMF network element in any of the communication methods shown in FIG. 8-FIG. 13, or execute the communication method shown in FIG. 14 Access and mobility management network element functions.
  • the processing module involved in the communication device 1500 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1500 may be a network device, such as a relay AMF network element or an access and mobility management network element, or may be a chip (system) or other components or components that may be set in the network device, or may be It is a device including network equipment, which is not limited in this application.
  • the communication device 1500 may be applicable to the communication system shown in FIG. 7 , to perform the functions of the UDM network element in the communication method shown in FIGS. 8-13 , or be applicable to the communication system shown in FIG. 7 In the communication system shown, the function of the data management network element in the communication method shown in FIG. 14 is performed.
  • the receiving module 1501 is used for receiving the authentication request message #1 from the authentication service network element
  • the sending module 1502 is used for sending the authentication response message #1 to the authentication service network element.
  • the authentication response message #1 includes: ProSe authentication information #1.
  • the ProSe authentication information #1 includes at least one of the following items: information for the remote terminal to authenticate the network, or information for authenticating the remote terminal.
  • the ProSe authentication information #1 may be at least one of the following: ProSe authentication vector #1 of AKA, or ProSe authentication vector of EAP-AKA'.
  • the ProSe authentication vector #1 of AKA or the ProSe authentication vector of EAP-AKA' may include at least one of the following: information for the remote terminal to authenticate the network, and information for the authentication service network element to authenticate the remote terminal , or information used to determine the ProSe key.
  • the method described in the third aspect may further include: the receiving module 1501 is also configured to receive the authentication request message #1 from the access and mobility management network element
  • the sending module 1502 is further configured to send an authentication serving network element obtaining response message to the access and mobility management network element.
  • the request message obtained by the authentication service network element is used to request the identification of the authentication service network element, and the authentication service network element is used for ProSe relay communication authentication of the remote terminal.
  • the response message obtained by the authentication service network element does not carry the identification of the authentication service network element, which is used to indicate that the remote terminal has not been authenticated for the ProSe relay communication.
  • the communications apparatus 1500 may further include: a processing module (not shown in FIG. 15 ).
  • the processing module is further configured to determine that the remote terminal is authorized to obtain the relay service before the sending module 1502 sends the authentication response message #1 to the authentication service network element.
  • the processing module is further configured to determine the ProSe authentication information #1 according to the authentication request message #1 before the sending module 1502 sends the authentication response message #1 to the authentication service network element.
  • the processing module is further configured to determine that no ProSe relay communication authentication has been performed on the remote terminal before the sending module 1502 sends the authentication response message #1 to the authentication service network element.
  • the receiving module 1501 and the sending module 1502 may also be integrated into one module, such as a transceiver module (not shown in FIG. 15 ).
  • the transceiver module is used to realize the sending function and the receiving function of the communication device 1500 .
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device 1500 can execute the function of the UDM network element in the communication method shown in any one of Figures 8-13, or execute the data in the communication method shown in Figure 14 The function of managing network elements.
  • the processing module involved in the communication device 1500 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1500 can be a network device, such as a UDM network element or a data management network element, or a chip (system) or other components or components that can be set in the network device, or a network device that includes the network device. device, which is not limited in this application.
  • the communication device 1500 may be applicable to the communication system shown in FIG. 7, and perform the function of relaying UE in the communication methods shown in FIGS. In the communication system shown, the function of the relay terminal in the communication method shown in FIG. 14 is performed.
  • the receiving module 1501 is used to receive the information used for the remote terminal authentication network from the access and mobility management network element, and the sending module 1502 is used to send the authentication response determined by the remote terminal to the access and mobility management network element information.
  • the authentication response information is used to authenticate the remote terminal.
  • the receiving module 1501 is also configured to receive the ProSe key from the access and mobility management network element, and the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the information for the remote terminal to authenticate the network and the authentication response information determined by the remote terminal are information protected by a communication key, and the communication key is used for communication between the relay terminal and the network.
  • the sending module 1502 sends the remote terminal identification information to the access and mobility management network element.
  • the sending module 1502 is also configured to send information for the remote terminal to authenticate the network to the remote terminal, and the receiving module 1501 is also configured to receive the authentication response information determined by the remote terminal from the remote terminal.
  • the information for the remote terminal to authenticate the network may be carried in a message, and the name of the message or the indication information carried may indicate that the remote terminal needs to perform the authentication process of the ProSe relay communication.
  • the processing module is further configured to control the sending module 1502 to send information for the remote terminal to authenticate the network to the remote terminal according to the message.
  • the sending module 1502 sends the ProSe communication authentication response message to the access and mobility management network element
  • the receiving module 1501 is also used to receive the random value #2 from the access and mobility management network element
  • the sending module is also used to send the random value #2 to the remote terminal.
  • the random value #2 is used to determine the ProSe key
  • the ProSe key is used for communication between the relay terminal and the remote terminal.
  • the receiving module 1501 and the sending module 1502 can also be integrated into one module, such as a transceiver module (not shown in Figure 15).
  • the transceiver module is used to realize the sending function and the receiving function of the communication device 1500 .
  • the communication device 1500 may further include a processing module (not shown in FIG. 15 ), where the processing module is configured to implement a processing function of the communication device 1500 .
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction, the communication device 1500 can perform the function of relaying the UE in any of the communication methods shown in FIG. 8-FIG. Following the function of the terminal.
  • the processing module involved in the communication device 1500 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1500 can be a terminal, such as a relay UE or a relay terminal, or a chip (system) or other components or components that can be set in a terminal, or a device that includes a terminal. This application There is no limit to this.
  • the communication device 1500 may be applicable to the communication system shown in FIG. 7 , to perform the functions of the remote UE in the communication methods shown in FIGS. 8-13 , or be applicable to the communication system shown in FIG. 7 In the illustrated communication system, the functions of the remote terminal in the communication method illustrated in FIG. 14 are performed.
  • the receiving module 1501 is configured to receive the information for the authentication network of the remote terminal from the relay terminal.
  • the sending module 1502 is configured to send the authentication response information determined by the remote terminal to the relay terminal, where the authentication response information is used to authenticate the remote terminal.
  • the communications apparatus 1500 may further include: a processing module (not shown in FIG. 15 ).
  • the sending module 1502 sends the authentication response information determined by the remote terminal to the relay terminal
  • the receiving module 1501 is further configured to receive the random value #2 from the relay terminal
  • the processing module is further configured to perform according to at least one of the following: service The network name, RSC, random value #1, random value #2 and intermediate key determine the ProSe key.
  • the receiving module 1501 and the sending module 1502 may also be integrated into one module, such as a transceiver module (not shown in FIG. 15 ).
  • the transceiver module is used to realize the sending function and the receiving function of the communication device 1500 .
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction, the communication device 1500 can perform the function of the remote UE in the communication method shown in any one of FIGS. end-to-end functionality.
  • the processing module involved in the communication device 1500 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • the communication device 1500 can be a terminal, such as a remote UE or a remote terminal, or a chip (system) or other components or components that can be set in a terminal, or a device that includes a terminal. This application There is no limit to this.
  • FIG. 16 is a second structural schematic diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be a terminal or a network device, or a chip (system) or other components or components that may be provided in the terminal or the network device.
  • a communication device 1600 may include a processor 1601 .
  • the communication device 1600 may further include a memory 1602 and/or a transceiver 1603 .
  • the processor 1601 is coupled with the memory 1602 and the transceiver 1603, such as may be connected through a communication bus.
  • the components of the communication device 1600 are specifically introduced below in conjunction with FIG. 16 :
  • the processor 1601 is the control center of the communication device 1600, and may be one processor, or may be a general term for multiple processing elements.
  • the processor 1601 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 1601 can execute various functions of the communication device 1600 by running or executing software programs stored in the memory 1602 and calling data stored in the memory 1602, for example, executing the above-mentioned functions shown in FIGS. 8-14 communication method.
  • the processor 1601 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 16 .
  • the communication device 1600 may also include multiple processors, for example, the processor 1601 and the processor 1604 shown in FIG. 16 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 1602 is used to store a software program for executing the solution of the present application, and the execution is controlled by the processor 1601 .
  • the processor 1601 controls the execution of the solution of the present application.
  • the memory 1602 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices for instructions can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical discs storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and any other medium that can be accessed by a computer, but is not limited to.
  • the memory 1602 can be integrated with the processor 1601 or exist independently, and is coupled with the processor 1601 through an interface circuit (not shown in FIG. 16 ) of the communication device 1600 , which is not specifically limited in this embodiment of the present
  • Transceiver 1603 used for communication with other communication devices.
  • the communication apparatus 1600 is a terminal, and the transceiver 1603 can be used to communicate with a network device, or communicate with another terminal device.
  • the communication apparatus 1600 is a network device, and the transceiver 1603 may be used to communicate with a terminal or communicate with another network device.
  • the transceiver 1603 may include a receiver and a transmitter (not separately shown in FIG. 16 ). Wherein, the receiver is used to realize the receiving function, and the transmitter is used to realize the sending function.
  • the transceiver 1603 may be integrated with the processor 1601, or may exist independently, and be coupled to the processor 1601 through an interface circuit (not shown in FIG. 16 ) of the communication device 1600, which is not made in this embodiment of the present application. Specific limits.
  • the structure of the communication device 1600 shown in FIG. 16 does not constitute a limitation to the communication device, and an actual communication device may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.
  • An embodiment of the present application provides a communication system.
  • the communication system includes one or more terminals in the foregoing method embodiments, and one or more network devices in the foregoing method embodiments.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center By wired (such as infrared, wireless, microwave, etc.) Transmission to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of this application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of software products
  • the computer software product is stored in a storage medium, including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application .
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other various media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法及装置，涉及通信领域，用以确保临近业务中继通信的安全。该方法中，通过数据管理网元提供的临近业务认证信息#1，远端终端和网络可以彼此认证对方并生成用于远端终端和中继终端通信的临近业务密钥，进一步的，远端终端设备和中继终端设备基于该临近业务密钥推演PC5连接(即远端终端和中继终端间的连接)的通信保护密钥，可以包含加密密钥和完整性保护密钥中的至少一个，以确保临近业务中继通信安全，避免出现因被攻击而导致用户信息泄露等情况。

Description

通信方法及装置
本申请要求于2022年01月30日提交国家知识产权局、申请号为202210114688.0、申请名称为“通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种通信方法及装置。
背景技术
在通信系统中，如果某个用户设备(user equipment，UE)1处于网络覆盖之外、或与接入网(radio access network，RAN)设备间通信信号不好、或需要其他UE协助传输数据时，UE1可以通过另一个UE(例如UE2)的辅助，从网络侧获取业务。例如，UE1与UE2在空口建立临近业务通信5(ProSe communication 5，PC5)接口连接，以通过PC5连接与网络侧通信。这种情况下，UE1可认为是临近业务(proximity based services，ProSe)远端(remote)UE，或者简称为远端UE。UE2可认为是临近业务UE到网络的中继(ProSe UE-to-network relay)，或者简称为中继UE。远端UE通过中继UE与网络侧之间的通信可以认为是ProSe中继通信。
然而，ProSe中继通信存在安全风险，容易被攻击，导致用户信息泄露。
发明内容
本申请实施例提供一种通信方法及装置，用以确保ProSe中继通信的安全，避免出现因被攻击而导致用户信息泄露等情况。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种通信方法。该通信方法包括：认证服务网元向数据管理网元发送认证请求消息#1，并接收来自数据管理网元的认证响应消息#1。认证请求消息#1用于请求认证远端终端，认证响应消息#1包括：临近业务ProSe认证信息#1，ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。在远端终端认证网络通过的情况下，认证服务网元接收来自接入和移动管理网元的认证请求消息#2，该认证请求消息#2用于请求认证远端终端。如此，在认证远端终端通过的情况下，例如认证服务网元认证远端终端通过，或者认证服务网元和接入和移动管理网元都认证远端终端通过，认证服务网元向接入和移动管理网元发送认证响应消息#2。其中，认证请求消息#2用于请求认证远端终端；认证响应消息#2包括：ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
基于第一方面所述的方法可知，通过数据管理网元提供的ProSe认证信息#1，远端终端和网络可以彼此认证对方。在双方都认证通过的情况下，便可生成用于远端UE和中继UE通信的ProSe密钥，以便基于ProSe密钥推演PC5连接(即远端UE和中继UE间的连接)的通信保护密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全，避免出现因被攻击而导致用户信息泄露等情况。
可选地，远端终端和中继终端可以基于ProSe密钥推演PC5连接的通信保护密钥，例如，远端终端和中继终端可以基于ProSe密钥推演一个会话密钥，然后远端终端和中继终端基于会话密钥进一步推演通信保护密钥(如加密密钥和完整性保护密钥)，本申请不限制。
一种可能的设计方案中，ProSe认证信息#1可以为如下至少一项：认证与密钥协商AKA的ProSe认证向量#1、或扩展认证协议请求EAP-AKA’的ProSe的认证向量。也就是说，远端UE与网络之间的认证可以基于对已有认证方法，例如5G AKA或EAP-AKA’增强实现，以实现在不引入新的认证方法的情况下，确保ProSe中继通信安全。
可选地，AKA的ProSe认证向量#1或EAP-AKA’的ProSe的认证向量可以包括如下至少一项：用于远端终端认证网络的信息、用于认证服务网元认证远端终端的信息、或用于确定ProSe密钥的信息。可以看出，认证向量不仅可用于远端UE与网络之间的认证，还用于确定ProSe密钥。以便AUSF网元在确定认证通过的情况下，可以根据认证向量推演ProSe密钥，无需额外获取，以提高认证效率和密钥推演效率。
可选地，在认证服务网元向数据管理网元发送认证请求消息#1之前，第一方面所述的方法还可以包括：认证服务网元接收来自接入和移动管理网元的认证请求消息#3。相应的，在认证服务网元接收来自数据管理网元的认证响应消息#1之后，在认证服务网元接收来自接入和移动管理网元的认证请求消息#2之前，第一方面所述的方法还可以包括：认证服务网元向接入和移动管理网元发送认证响应消息#3。认证响应消息#3可以包括：ProSe认证信息#2，ProSe认证信息#2包括：用于远端终端认证网络的信息。可选地，ProSe认证信息#2还可以包括：用于网络认证远端终端的信息。也就是说，ProSe中继通信的认证可以由接入和移动管理网元触发，例如在业务有需求的情况下触发，以便认证服务网元可以有针对性地执行认证，确保认证的有效性。
进一步的，ProSe认证信息#2可根据ProSe认证信息#1确定。ProSe认证信息#2可以为如下至少一项：AKA的ProSe认证向量#2、或EAP请求消息或AKA’挑战消息。例如，如果采用增强的AKA认证机制，则AKA的ProSe认证向量#2可根据AKA的ProSe认证向量#1确定，无需引入新的功能，从而降低网元复杂度。如果采用增强的EAP-AKA’认证机制，则EAP请求消息或AKA’挑战消息可根据EAP-AKA’的ProSe的认证向量确定，无需引入新的功能，从而降低网元复杂度。
进一步的，AKA的ProSe认证向量#2可以包括：用于接入和移动管理网元认证远端终端的信息。如此，AKA的ProSe认证向量#2还可用于接入和移动管理网元从服务网的角度认证远端终端，从而可以提高认证的全面性，进一步确保ProSe中继通信安全。
可选地，认证请求消息#3可用于请求认证远端终端。比如，请求认证服务网元认证远端终端，用以触发认证服务网元执行ProSe通信的认证流程，确保认证的可靠性。
进一步的，认证请求消息#3可以包括如下至少一项：远端终端的用户隐藏标识SUCI、服务网络名称、中继服务码RSC、随机值#1、或ProSe中继通信指示信息。 其中，服务网络名称、RSC或ProSe中继通信指示信息中的任一项可用于指示认证为ProSe中继通信的认证，以触发认证服务网元执行ProSe通信的认证流程，确保认证的准确性和可靠性，避免对现有流程的影响。服务网络名称、RSC、或随机值#1中的任一项可用于确定ProSe密钥，以便AUSF网元在确定认证通过的情况下，可以直接根据这些参数推演ProSe密钥，无需额外获取，以提高密钥推演效率。
进一步的，在认证服务网元向接入和移动管理网元发送认证响应消息#2之前，第一方面所述的方法还可以包括：若认证请求消息#3中包括：RSC和随机值#1，则认证服务网元保存RSC和随机值#1，以便后续密钥推演时可直接使用，无需再次获取，以进一步提高密钥推演效率。
进一步的，用于确定ProSe密钥的信息包括：中间密钥。在认证服务网元向接入和移动管理网元发送认证响应消息#2之前，第一方面所述的方法还可以包括：在认证远端终端通过的情况下，认证服务网元根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密钥，确定ProSe密钥。也就是说，认证服务网元可以根据业务场景以及密钥隔离等需求，选择合适的参数来确定ProSe密钥，以适应更多业务场景。例如，根据RSC、随机值#1、随机值#2和中间密钥确定ProSe密钥。或者，根据服务网络名称、随机值#1、随机值#2和中间密钥确定ProSe密钥。其中，中间密钥也可以是根据ProSe认证向量确定的。
一种可能的设计方案中，认证请求消息#2可以包括如下至少一项：远端终端确定的认证响应信息、用于确定ProSe密钥的RSC、或用于确定ProSe密钥的随机值#1。认证响应信息用于认证远端终端。也就是说，接入和移动管理网元可以在确定远端终端认证通过的情况下，才向认证服务网元发送用于推演ProSe密钥的参数，例如RSC和/或随机值#1，从而实现按需提供必要的参数，无需预存信息，防止资源浪费。
可选地，认证响应消息#2可以包括：随机值#2。随机值#2用于确定ProSe密钥，以便远端终端在确定认证通过的情况下，可以直接根据随机值#2推演ProSe密钥，保证为远端UE的不同ProSe通信推演不同的密钥，实现密钥的隔离。
进一步地，认证响应消息#2还可以包括如下至少一项：远端终端的用户隐藏标识SUPI、或EAP成功消息。其中，EAP成功消息可以用于指示网络认证远端终端成功。该远端终端的SUPI可以用于指示中继终端需要向网络上报远端UE的信息。
一种可能的设计方案中，认证服务网元跳过推演用于远端终端与网络之间通信的密钥，以防止生成冗余的信息，造成资源的浪费。
可选地，认证请求消息#1可以包括如下至少一项：远端终端的SUCI、或ProSe中继通信指示信息。ProSe中继通信指示信息用于指示认证为ProSe中继通信的认证，以触发数据管理网元发选择ProSe中继通信对应的认证向量，确保ProSe中继通信认证的可靠性。
第二方面，提供一种通信方法。该通信方法包括：接入和移动管理网元向认证服务网元发送认证请求消息#3，并接收来自认证服务网元的认证响应消息#3。认证响应消息#3包括：ProSe认证信息#2，ProSe认证信息#2包括：用于远端终端认证网络的信息。可选地，ProSe认证信息#2还可以包括：用于网络认证远端终端的信息。如 此，在远端终端认证网络通过的情况下，接入和移动管理网元向认证服务网元发送认证请求消息#2，并在认证远端终端通过的情况下，接收来自认证服务网元的认证响应消息#2，以向中继终端发送ProSe密钥。其中，认证请求消息#2用于请求认证远端终端。认证响应消息#2包括：ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，ProSe认证信息#2可以为如下至少一项：AKA的ProSe认证向量#2、或EAP请求消息或AKA’挑战消息。
可选地，AKA的ProSe认证向量#2可包括如下至少一项：用于远端终端认证网络的信息、或用于接入和移动管理网元认证远端终端的信息。
可选地，EAP请求消息或AKA’挑战消息可包括：用于远端终端认证网络的信息。
一种可能的设计方案中，在接入和移动管理网元接收来自认证服务网元的认证响应消息#3之后，在接入和移动管理网元向认证服务网元发送认证请求消息#2之前，第二方面所述的方法还可以包括：接入和移动管理网元向中继终端发送用于远端终端认证网络的信息，接收来自中继终端的远端终端确定的认证响应信息，认证响应信息用于认证远端终端。其中，用于远端终端认证网络的信息可以用于指示中继终端向远端终端转发ProSe中继通信的认证数据，即用于远端终端认证网络的信息，避免中继终端执行其他操作，例如自行认证，确保ProSe中继通信认证的可靠性。
一种可能的设计方案中，在接入和移动管理网元向中继终端发送用于远端终端认证网络的信息之前，接入和移动管理网元跳过获取密钥集标识和反降级参数。或者接入和移动管理网元跳过生成密钥集标识和反降级参数。
可选地，在ProSe认证信息#2可以包括：用于接入和移动管理网元认证远端终端的信息的情况下，在接入和移动管理网元接收来自中继终端的远端终端认证响应消息之后，在接入和移动管理网元向认证服务网元发送认证请求消息#2之前，第二方面所述方法还可以包括：接入和移动管理网元根据远端终端确定的认证响应消息，以及用于接入和移动管理网元认证远端终端的信息，确定远端终端认证通过。
可选地，用于远端终端认证网络的信息和远端终端确定的认证响应信息为通过通信密钥保护的信息，通信密钥用于中继终端与网络的通信，以确保中继终端与网络之间的通信安全。例如，通信密钥为中继终端与接入和移动管理网元之间建立的非接入层安全密钥，该非接入层安全密钥可以包含加密密钥和完整性保护密钥。
可选地，认证请求消息#2可以包括如下至少一项：远端终端确定的认证响应消息、用于确定ProSe密钥的RSC、或用于确定ProSe密钥的随机值#1。该认证响应消息用于认证远端终端。
可选地，认证响应消息#2可以包括：随机值#2，随机值#2用于确定ProSe密钥。
进一步的，认证响应消息#2还可以包括如下至少一项：远端终端的SUPI、或EAP成功消息。
进一步的，在接入和移动管理网元接收来自认证服务网元的认证响应消息#2之后，第二方面所述的方法还可以包括：接入和移动管理网元向中继终端发送随机值 #2。也就是说，接入和移动管理网元可以在网络认证远端终端通过后，才向远端终端发送用于推演ProSe密钥的参数，也即随机值#2，从而实现按需提供必要的参数，无需预存信息，防止资源浪费。
一种可能的设计方案中，在接入和移动管理网元向认证服务网元发送认证请求消息#3之前，第二方面所述的方法还可以包括：接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥(如KAUSF)。换言之，只有在远端终端没有执行过认证的情况下或不存在用于推演ProSe密钥的密钥，才执行ProSe中继通信的认证流程，避免因重复执行认证流程而导致资源浪费。当然，在对远端终端执行过认证的情况下，可使用认证服务网元上已有的密钥(如KAUSF)推演ProSe密钥，无需再次执行ProSe中继通信认证。
可选地，接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥，可以包括：接入和移动管理网元接收来自中继终端的远端终端指示信息，远端终端指示信息用于指示远端终端未执行认证或不存在用于推演ProSe密钥的密钥。接入和移动管理网元根据远端终端指示信息，确定未对远端终端执行过ProSe中继通信的认证。
可选地，接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥，可以包括：接入和移动管理网元向数据管理网元发送认证服务网元获得请求消息，并接收来自数据管理网元的认证服务网元获得响应消息。其中，认证服务网元获得请求消息用于请求认证服务网元的标识，该认证服务网元用于远端终端的ProSe中继通信认证。认证服务网元获得响应消息未携带该认证服务网元的标识，用以表示未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥。接入和移动管理网元根据认证服务网元获得响应消息，确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥。
可以看出，在远端终端指示其是否执行过认证的情况下或不存在用于推演ProSe密钥的密钥，接入和移动管理网元可根据远端终端的指示信息，而不用再与其他网元交互，便可确定是否执行ProSe中继通信的认证。或者，远端终端可以不指示其是否执行过ProSe中继通信的认证，由接入和移动管理网元根据数据管理网元反馈的信息确定，如此可以降低远端终端与接入和移动管理网元之间的通信开销，提高通信效率。
此外，第二方面所述的方法的其他技术效果可以参考第一方面所述的方法中的技术效果，不再赘述。
第三方面，提供一种通信方法。该通信方法包括：数据管理网元接收来自认证服务网元的认证请求消息#1，并向认证服务网元发送认证响应消息#1。认证响应消息#1包括：ProSe认证信息#1。ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。
一种可能的设计方案中，ProSe认证信息#1可以为如下至少一项：AKA的ProSe认证向量#1、或EAP-AKA’的ProSe的认证向量。
可选地，AKA的ProSe认证向量#1或EAP-AKA’的ProSe的认证向量可以包括如下至少一项：用于远端终端认证网络的信息、用于认证服务网元认证远端终端的信 息、或用于确定ProSe密钥的信息。
可选地，在数据管理网元接收来自认证服务网元的认证请求消息#1之前，第三方面所述的方法还可以包括：数据管理网元接收来自接入和移动管理网元的认证服务网元获得请求消息，并向接入和移动管理网元发送认证服务网元获得响应消息。其中，认证服务网元获得请求消息用于请求认证服务网元的标识，该认证服务网元用于远端终端的ProSe中继通信认证。认证服务网元获得响应消息未携带该认证服务网元的标识，用以表示未对远端终端执行过ProSe中继通信的认证。
一种可能的设计方案中，在数据管理网元向认证服务网元发送认证响应消息#1之前，第三方面所述的方法还可以包括：数据管理网元确定远端终端授权获取中继服务。也就是说，在确定远端终端有中继通信的权限的基础上，才对其进行ProSe中继通信认证，避免无效认证。
一种可能的设计方案中，在数据管理网元向认证服务网元发送认证响应消息#1之前，第三方面所述的方法还可以包括：数据管理网元根据认证请求消息#1，确定ProSe认证信息#1。
一种可能的设计方案中，在数据管理网元向认证服务网元发送认证响应消息#1之前，第三方面所述的方法还可以包括：数据管理网元确定未对远端终端执行过认证，或确定不存在用于推演ProSe密钥的密钥，或确定不存在为远端终端服务的AUSF网元。换言之，只有在远端终端没有执行过认证，或不存在用于推演ProSe密钥的密钥，或不存在为远端终端服务的AUSF网元的情况下，才执行ProSe中继通信的认证流程，避免因重复执行认证流程而导致资源浪费。当然，在对远端终端执行过认证的情况下，数据管理网元可以请求认证服务网元使用已有的密钥(如KAUSF)推演ProSe密钥，无需再次执行ProSe中继通信认证。
此外，第三方面所述的方法的其他技术效果，可以参考第一方面或第二方面所述的方法中的技术效果，不再赘述。
第四方面，提供一种通信方法。该通信方法包括：中继终端接收来自接入和移动管理网元的用于远端终端认证网络的信息，并向接入和移动管理网元发送远端终端确定的认证响应信息。远端终端确定的认证响应信息用于认证远端终端。如此，中继终端接收来自接入和移动管理网元的ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，用于远端终端认证网络的信息和远端终端确定的认证响应信息为通过通信密钥保护的消息，通信密钥用于中继终端与网络的通信。例如，通信密钥为中继终端与接入和移动管理网之间建立的非接入层安全密钥，该非接入层安全密钥可以包含加密密钥和完整性保护密钥。
一种可能的设计方案中，在中继终端接收来自接入和移动管理网元的用于远端终端认证网络的信息之后，在中继终端向接入和移动管理网元发送远端终端确定的认证响应信息之前，第四方面所述的方法还可以包括：中继终端向远端终端发送用于远端终端认证网络的信息，并接收来自远端终端的远端终端确定的认证响应信息。也就是说，中继终端可以主动与远端终端交互，以确保远端终端能够认证网络，并向网络反馈自身的认证响应消息，确保网络也能够认证远端终端。
可选地，用于远端终端认证网络的信息承载在消息中，该消息的名称或携带的指示信息，可以指示需要由远端终端执行ProSe中继通信的认证流程或指示请求认证远端UE。如此，中继终端向远端终端发送用于远端终端认证网络的信息，可以包括：中继终端根据消息，向远端终端发送用于远端终端认证网络的信息，以确保ProSe中继通信认证的可靠性。例如，中继终端根据该消息的名称或消息中包含的指示信息，向远端终端发送用于远端终端认证网络的信息。
一种可能的设计方案中，在中继终端向接入和移动管理网元发送的ProSe通信认证响应消息之后，第四方面所述的方法还可以包括：中继终端接收来自接入和移动管理网元的随机值#2，并向远端终端发送随机值#2。随机值#2用于确定ProSe密钥。
此外，第四方面所述的方法的其他技术效果，可以参考第一方面或第二方面所述的方法中的技术效果，不再赘述。
第五方面，提供一种通信方法。该通信方法包括：远端终端接收来自中继终端的用于远端终端认证网络的信息。如此，在远端终端确定认证网络通过的情况下，远端终端向中继终端发送远端终端确定的认证响应信息，该认证响应信息用于认证远端终端。
一种可能的设计方案中，在远端终端向中继终端发送远端终端确定的认证响应信息之后，方法还包括：远端终端接收来自中继终端的随机值#2，以根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密钥，确定ProSe密钥，该ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，在远端终端向中继终端发送远端终端确定的认证响应信息之后，方法还包括：远端终端跳过推演用于远端终端与网络通信的密钥，如跳过KSEAF的推演。
此外，第五方面所述的方法的其他技术效果，可以参考第一方面或第二方面所述的方法中的技术效果，不再赘述。
第六方面，提供一种通信装置。该通信装置包括：用于执行第一方面所述的通信方法的模块，例如接收模块和发送模块。
可选地，发送模块和接收模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第六方面所述的通信装置的发送功能和接收功能。
可选地，第六方面所述的通信装置还可以包括处理模块。其中，处理模块用于实现该通信装置的处理功能。
可选地，第六方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当该处理模块执行该程序或指令时，使得该通信装置可以执行第一方面所述的通信方法。
需要说明的是，第六方面所述的通信装置可以是网络设备，例如认证服务网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，第六方面所述的通信装置的技术效果可以参考第一方面所述的通信方法的技术效果，此处不再赘述。
第七方面，提供一种通信装置。该通信装置包括：用于执行第二方面所述的通信 方法的模块，例如接收模块和发送模块。
可选地，发送模块和接收模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第七方面所述的通信装置的发送功能和接收功能。
可选地，第七方面所述的通信装置还可以包括处理模块。其中，处理模块用于实现该通信装置的处理功能。
可选地，第七方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当该处理模块执行该程序或指令时，使得该通信装置可以执行第二方面所述的通信方法。
需要说明的是，第七方面所述的通信装置可以是网络设备，例如接入和移动管理网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，第七方面所述的通信装置的技术效果可以参考第二方面所述的通信方法的技术效果，此处不再赘述。
第八方面，提供一种通信装置。该通信装置包括：用于执行第三方面所述的通信方法的模块，例如接收模块和发送模块。
可选地，发送模块和接收模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第八方面所述的通信装置的发送功能和接收功能。
可选地，第八方面所述的通信装置还可以包括处理模块。其中，处理模块用于实现该通信装置的处理功能。
可选地，第八方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当该处理模块执行该程序或指令时，使得该通信装置可以执行第三方面所述的通信方法。
需要说明的是，第八方面所述的通信装置可以是网络设备，例如数据管理网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，第八方面所述的通信装置的技术效果可以参考第三方面所述的通信方法的技术效果，此处不再赘述。
第九方面，提供一种通信装置。该通信装置包括：用于执行第四方面所述的通信方法的模块，例如接收模块和发送模块。
可选地，发送模块和接收模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第九方面所述的通信装置的发送功能和接收功能。
可选地，第九方面所述的通信装置还可以包括处理模块。其中，处理模块用于实现该通信装置的处理功能。
可选地，第九方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当该处理模块执行该程序或指令时，使得该通信装置可以执行第四方面所述的通信方法。
需要说明的是，第九方面所述的通信装置可以是终端，例如中继终端，也可以是可设置于终端中的芯片(系统)或其他部件或组件，还可以是包含终端的装置，本申请对此不做限定。
此外，第九方面所述的通信装置的技术效果可以参考第四方面所述的通信方法的技术效果，此处不再赘述。
第十方面，提供一种通信装置。该通信装置包括：用于执行第五方面所述的通信方法的模块，例如接收模块和发送模块。
可选地，发送模块和接收模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第十方面所述的通信装置的发送功能和接收功能。
可选地，第十方面所述的通信装置还可以包括处理模块。其中，处理模块用于实现该通信装置的处理功能。
可选地，第十方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当该处理模块执行该程序或指令时，使得该通信装置可以执行第五方面所述的通信方法。
需要说明的是，第十方面所述的通信装置可以是终端，例如远端终端，也可以是可设置于终端中的芯片(系统)或其他部件或组件，还可以是包含终端的装置，本申请对此不做限定。
此外，第十方面所述的通信装置的技术效果可以参考第五方面所述的通信方法的技术效果，此处不再赘述。
第十一方面，提供一种通信装置。该通信装置包括：处理器，该处理器用于执行第一方面至第五方面中任意一种可能的实现方式所述的通信方法。
在一种可能的设计方案中，第十一方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第十一方面所述的通信装置与其他通信装置通信。
在一种可能的设计方案中，第十一方面所述的通信装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面至第五方面中任一方面所述的通信方法所涉及的计算机程序和/或数据。
在本申请中，第十一方面所述的通信装置可以为第一方面、第二方面或第三方面中的网络设备，或第四方面或第五方面中的终端，或者可设置于该终端或网络设备中的芯片(系统)或其他部件或组件，或者包含该终端或网络设备的装置。
此外，第十一方面所述的通信装置的技术效果可以参考第一方面至第五方面中任意一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十二方面，提供一种通信装置。该通信装置包括：处理器，该处理器与存储器耦合，该处理器用于执行存储器中存储的计算机程序，以使得该通信装置执行第一方面至第五方面中任意一种可能的实现方式所述的通信方法。
在一种可能的设计方案中，第十二方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第八方面所述的通信装置与其他通信装置通信。
在本申请中，第十二方面所述的通信装置可以为第一方面、第二方面或第三方面中的网络设备，或第四方面或第五方面中的终端，或者可设置于该终端或网络设备中的芯片(系统)或其他部件或组件，或者包含该终端或网络设备的装置。
此外，第十二方面所述的通信装置的技术效果可以参考第一方面至第五方面中任 意一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十三方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机程序，当该处理器执行该计算机程序时，以使该通信装置执行第一方面至第五方面中的任意一种实现方式所述的通信方法。
在一种可能的设计方案中，第十三方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第十三方面所述的通信装置与其他通信装置通信。
在本申请中，第十三方面所述的通信装置可以为第一方面、第二方面或第三方面中的网络设备，或第四方面或第五方面中的终端，或者可设置于该终端或网络设备中的芯片(系统)或其他部件或组件，或者包含该终端或网络设备的装置。
此外，第十三方面所述的通信装置的技术效果可以参考第一方面至第五方面中任意一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十四方面，提供了一种通信装置，包括：处理器；该处理器用于与存储器耦合，并读取存储器中的计算机程序之后，根据该计算机程序执行如第一方面至第五方面中的任意一种实现方式所述的通信方法。
在一种可能的设计方案中，第十四方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第十四方面所述的通信装置与其他通信装置通信。
在本申请中，第十四方面所述的通信装置可以为第一方面、第二方面或第三方面中的网络设备，或第四方面或第五方面中的终端，或者可设置于该终端或网络设备中的芯片(系统)或其他部件或组件，或者包含该终端或网络设备的装置。
此外，第十四方面所述的通信装置的技术效果可以参考第一方面至第五方面中任意一种实现方式所述的通信方法的技术效果，此处不再赘述。
第十五方面，提供一种通信系统。该通信系统包括：第四方面或第五方面所述的一个或多个终端设备，例如中继终端和远程终端，以及第一方面、第二方面或第三方面所述一个或多个网络设备，例如认证服务网络、接入和移动管理网元和数据管理网元。
第十六方面，提供一种计算机可读存储介质，包括：计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第五方面中任意一种可能的实现方式所述的通信方法。
第十七方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第五方面中任意一种可能的实现方式所述的通信方法。
附图说明
图1为5G的架构示意图；
图2为层3中继架构的架构示意图；
图3为层2中继架构的架构示意图；
图4为ProSe通信建立安全连接的流程示意图；
图5为主认证流程的流程示意图一；
图6为主认证流程的流程示意图二；
图7为本申请实施例提供的通信系统的架构示意图；
图8为本申请实施例提供的通信方法的流程示意图一；
图9为本申请实施例提供的通信方法的流程示意图二；
图10为本申请实施例提供的通信方法的流程示意图三；
图11为本申请实施例提供的通信方法的流程示意图四；
图12为本申请实施例提供的通信方法的流程示意图五；
图13为本申请实施例提供的通信方法的流程示意图六；
图14为本申请实施例提供的通信方法的流程示意图七；
图15为本申请实施例提供的通信装置的结构示意图一；
图16为本申请实施例提供的通信装置的结构示意图二。
具体实施方式
方便理解，下面先介绍本申请实施例所涉及的技术术语。
1、第五代(5th generation，5G)移动通信系统：
图1为5G系统的架构示意图，如图1所示，5G系统包括：接入网(access network，AN)和核心网(core network，CN)，还可以包括：终端。
上述终端可以为具有收发功能的终端，或为可设置于该终端的芯片或芯片系统。该终端也可以称为用户设备(uesr equipment，UE)、接入终端、用户单元(subscriber unit)、用户站、移动站(mobile station，MS)、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端可以是手机(mobile phone)、蜂窝电话(cellular phone)、智能电话(smart phone)、平板电脑(Pad)、无线数据卡、个人数字助理电脑(personal digital assistant，PDA)、无线调制解调器(modem)、手持设备(handset)、膝上型电脑(laptop computer)、机器类型通信(machine type communication，MTC)终端、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、车载终端、具有终端功能的路边单元(road side unit，RSU)等。本申请的终端还可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元。
上述AN用于实现接入有关的功能，可以为特定区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等确定不同质量的传输链路以传输用户数据。AN在终端与CN之间转发控制信号和用户数据。AN可以包括：接入网设备，也可以称为无线接入网设备(radio access network，RAN)设备。
RAN设备可以是为终端提供接入的设备，主要负责空口侧的无线资源管理、服 务质量(quality of service，QoS)管理、数据压缩和加密等功能。RAN设备可以包括5G，如新空口(new radio，NR)系统中的gNB，或，5G中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB、传输点(transmission and reception point，TRP或者transmission point，TP)或传输测量功能(transmission measurement function，TMF)的网络节点，如基带单元(building base band unit，BBU)，或，集中单元(centralized unit，CU)或分布单元(distributed unit，DU)、具有基站功能的RSU，或者有线接入网关，或者5G的核心网网元。或者，RAN设备还可以包括无线保真(wireless fidelity，WiFi)系统中的接入点(access point，AP)，无线中继节点、无线回传节点、各种形式的宏基站、微基站(也称为小站)、中继站、接入点、可穿戴设备、车载设备等等。或者，RAN设备可以也可以包括下一代移动通信系统，例如6G的接入网设备，例如6G基站，或者在下一代移动通信系统中，该网络设备也可以有其他命名方式，其均涵盖在本申请实施例的保护范围以内，本申请对此不做任何限定。
CN主要负责维护移动网络的签约数据，为终端提供会话管理、移动性管理、策略管理以及安全认证等功能。CN主要包括如下网元：用户面功能(user plane function，UPF)网元、认证服务功能(authentication server function，AUSF)网元、接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、网络功能仓储功能(NF repository function，NRF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、应用功能(application function，AF)网元、以及网络切片和独立非公共网络(standalone non-public network，SNPN)的鉴权授权功能(network slice-specific and SNPN authentication and authorization function，NSSAAF)网元。
其中，UPF网元主要负责用户数据处理(转发、接收、计费等)。例如，UPF网元可以接收来自数据网络(data network，DN)的用户数据，通过接入网设备向终端转发该用户数据。UPF网元也可以通过接入网设备接收来自终端的用户数据，并向DN转发该用户数据。DN网元指的是为用户提供数据传输服务的运营商网络。例如网际互连协议(internet protocol，IP)多媒体业务(IP multi-media srvice，IMS)、互联网(internet)等。DN可以为运营商外部网络，也可以为运营商控制的网络，用于向终端设备提供业务服务。
AUSF网元可用于执行终端的安全认证。
AMF网元主要负责移动网络中的移动性管理。例如用户位置更新、用户注册网络、用户切换等。
SMF网元主要负责移动网络中的会话管理。例如会话建立、修改、释放。具体功能例如为用户分配互联网协议(internet protocol，IP)地址，选择提供报文转发功能的UPF等。
PCF网元主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略决策相关的用户签约信息。PCF网元可以向AMF网 元、SMF网元提供策略，例如服务质量(quality of service，QoS)策略、切片选择策略等。
NSSF网元可用于为终端选择网络切片。
NEF网元可用于支持能力和事件的开放。
UDM网元可用于存储用户数据，例如签约数据、鉴权/授权数据等。
AF网元主要支持与CN交互来提供服务，例如影响数据路由决策、策略控制功能或者向网络侧提供第三方的一些服务。
NSSAAF网元可用于支持切片认证和授权，以及支持使用凭据持有者的凭据访问独立非公共网络。NSSAAF网元可以通过认证、授权和计费代理(authentication，authorization，and accounting proxy，AAA-P)与认证、授权和计费服务器(authentication，authorization，and accounting server，AAA-S)交互。
SCP(Service Communication Proxy，服务通信代理)网元可用于实现网络功能之间的通信转发，还可以用于实现负载均衡和网络功能选择等。
2、近距离通信：
随着移动通信的高速发展，新业务类型，如视频聊天、虚拟现实(virtual reality，VR)/增强现实(augmented AR)等数据业务的普遍应用，提高了用户对带宽的需求。对此，近距离通信，例如设备到设备(device-to-device，D2D)通信是一种解决方案。
D2D通信允许UE之间直接进行通信，例如通过PC5接口进行通信，实现数据面和控制面的信息传输。这样，用户在小区(cell)网络的控制下便可与其他小区用户共享频谱资源，有效提高频谱资源的利用率。D2D通信包括：一对多通信(one to many communication)，以及一对一通信(One to one communication)。一对多通信通常对应于组播和广播通信，一对一通信通常对应于单播通信。在一对一通信中，若发送方UE与接收方UE在近距离范围内，通过相互发现后可以直接通信。
3、临近业务(proximity based services，ProSe)通信：
ProSe通信又称为近距离业务通信，是D2D通信中的一种典型业务场景。ProSe通信可以包含临近业务直接通信、临近业务UE到网络中继通信。针对临近业务UE到网络中继通信(可简称ProSe中继通信)，在某个UE(记为UE1)处于网络覆盖之外、或与RAN设备间的通信信号不好、或需要其他UE(记为UE2)协助传输数据的情况下，UE1可以通过UE2的辅助，从网络获取业务。此时，UE1可称为临近业务远端UE(ProSe remote UE)，或者5G临近业务远端UE(5G ProSe remote UE)，或者简称为远端UE(remote UE)。UE2可为称为临近业务UE到网络中继(ProSe UE-to-network relay)，或者5G临近业务UE到网络中继(5G ProSe UE-to-network relay)，或者简称为中继UE(relay UE)。中继UE可用于提供支持远端UE连接到网络的ProSe功能，以便远端UE可通过中继UE提供的ProSe功能与DN通信，即ProSe中继通信。
为支持ProSe功能，第三代合作伙伴计划(3rd generation partnership project，3GPP)引入了层3中继架构和层2中继架构。下面分别介绍。
图2为层3中继架构的架构示意图。如图2所示，远端UE与中继UE建立PC5 连接，中继UE通过RAN设备接入核心网(5GC)。这样，远端UE通过PC5连接，以及中继UE接入的核心网，从DN获得业务，实现ProSe通信。例如，中继UE可以建立或修改针对于远端UE的协议数据单元(protocol data unit，PDU)会话，并通知SMF网元将远端UE的相关信息存储在会话管理(session management，SM)上下文中。这样，远端UE便能够通过中继UE的PDU会话从DN获得业务，实现ProSe通信。或者，中继UE也可以建立或修改针对于远端UE的PDU会话，以便远端UE可通过该PDU会话进行密钥交换协议(internet key exchange,IKE)流程与非3GPP互通功能(non-3GPP interworking function,N3IWF)建立信令的互联网安全协议(internet protocol security，IPsec)隧道，并执行非接入层(non-access stratum，NAS)注册流程。这样，远端UE便能够通过中继UE建立的PDU会话和N3IWF建立远端UE的PDU会话，并从DN获得业务，实现ProSe中继通信。此外，中继UE可以位于家乡公共陆地移动网(public land mobile network，PLMN)，也可以位于拜访PLMN，对此不做具体限定。
图3为层2中继架构的架构示意图。如图3所示，远端UE与中继UE建立PC5连接，中继UE与RAN设备建立Uu口连接。RAN设备可以与远端UE接入的核心网连接，以及也可以与中继UE接入的核心网连接。这种情况下，远端UE与中继UE建立PC5连接后，远端UE通过建立的PC5连接与RAN建立无线资源连接，进一步与核心网建立非接入层(non-stradum,NAS)连接，从而可以建立PDU会话，从DN获取业务，实现ProSe中继通信。例如，远端UE可通过中继UE接入网络并建立或修改远端UE自身的PDU会话，以通过该PDU会话从DN获得业务，实现ProSe中继通信。此外，远端UE接入的核心网与中继UE接入的核心网可以是相同的PLMN，或者不同的PLMN，对此不做具体限定。
需要说明的是，在层2中继架构中，远端UE可以称为5G ProSe层2远端UE、ProSe层2远端UE、或层2远端UE。类似的，在层3中继架构中，远端UE可以称为5G ProSe层3远端UE、ProSe层3远端UE、或层3远端UE。下文提到的远端UE可以理解为层2中继架构或层3中继架构中的远端UE，其命名也可以相应替换。同理，在层2中继架构中，中继UE可以称为5G ProSe层2中继UE、ProSe层2中继UE、或层2中继UE。类似的，在层3中继架构中，中继UE可以称为5G ProSe层3中继UE、ProSe层3中继UE、或层3中继UE。在没有特别说明的情况下，下文提到的中继UE可以理解为层2中继架构或层3中继架构中的中继UE，其命名也可以相应替换。
4、ProSe中继通信的安全：
为确保ProSe中继通信的安全，远端UE与中继UE之间应当建立安全的PC5连接。图4为建立安全的ProSe中继通信的流程示意图，如图4所示，该流程包括如下步骤：
S401，远端UE注册到网络，并与网络之间执行认证和授权。
S402，中继UE注册到网络，并与网络之间执行认证和授权。
需要指出的是，远端UE可以通过服务远端UE的AMF网元(记为远端AMF网元)注册到网络。中继UE可以通过服务中继UE的AMF网元(记为中继AMF网 元)注册到网络。远端AMF网元与中继AMF网元可以是相同的网元，或者不同的网元，对此不做具体限定。
S403，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，则通过执行中继发现流程来发现中继UE。
S404，远端UE向中继UE发送直接通信请求(direct communication request)消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信。直接通信请求消息可包括远端UE的如下参数：安全能力、安全策略、用户隐藏标识(subscription concealed identifier，SUCI)、中继通信码(relay service code，RSC)、以及Nonce_1。其中，安全能力用于指示远端UE支持的加密和/或完整性保护算法。安全策略用于指示是否开启安全保护，其中安全保护包含加密保护和/或完整性保护示。例如安全策略可以包含加密为必须的或推荐的或不需要的；和/或完整性保护为必须的，或推荐的或不需要的。RSC用于标识中继UE可为远端UE提供的一个连接服务。Nonce_1为由远端UE生成的随机数，用于推演远端UE和中继UE之间安全通信的密钥KNR_ProSe。远端UE和中继UE基于KNR_ProSe生成用于通信的安全密钥，如加密密钥和/或完整性密钥。
S405，中继UE向中继AMF网元发送中继密钥请求(relay key request)消息。相应的，中继AMF网元接收来自中继UE向的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信，或者说请求ProSe通信的密钥。中继密钥请求消息可以包括：中继UE的标识、远端UE的SUCI、RSC、以及Nonce_1。
S406，中继AMF网元验证中继UE。
中继AMF网元根据中继UE的标识验证中继UE，以确定中继UE授权作为中继提供服务。
S407，中继AMF网元向远端AUSF网元发送UE认证请求(Kausf_UEAuthentication_Authenticate Request)消息。相应的，远端AUSF网元接收来自中继AMF网元的UE认证请求消息。
其中，UE认证请求消息可以包括：远端UE的SUCI、RSC、以及Nonce_1。
S408，远端AUSF网元执行UE认证获得(Nudm_UEAuthentication_Get)流程。
远端AUSF网元可以根据UE认证请求消息，执行UE认证获得流程，以从远端UDM网元获得认证向量。远端UDM网元可以是服务远端UE的UDM网元。
S409，远端AUSF网元执行针对远端UE的主认证流程(Primary authentication of Remote UE)。
S410，远端UE确定5GPRUK和5GPRUK ID。
远端UE通过主认证流程认证网络通过后，可以确定5GPRUK和5GPRUK ID。例如，远端UE可根据主认证流程中推演得到的密钥，例如KAUSF推演得到5GPRUK和5GPRUK ID。5GPRUK用于推演远端UE和中继UE之间安全通信的密钥。5GPRUK ID用于定位5GPRUK。
S411，远端AUSF网元确定5GPRUK和5GPRUK ID。
远端AUSF网元通过主认证流程认证远端UE通过后，也可以确定5GPRUK和5GPRUK ID。例如，远端AUSF网元也可根据主认证流程中推演得到的密钥，例如KAUSF推演得到5GPRUK和5GPRUK ID。此外，S411与S410的执行顺序不限定。
S412，远端AUSF网元推演KNR_ProSe。
远端AUSF网元通过主认证流程认证远端UE通过后，可根据5GPRUK、Nonce_1和Nonce_2推演KNR_ProSe。Nonce_2为由远端AUSF网元生成的随机数。
S413，远端AUSF网元向中继AMF网元发送UE认证响应(Nausf_UEAuthentication_Authenticate response)消息。相应的，中继AMF网元接收来自远端AUSF网元的UE认证响应消息。
UE认证响应消息为UE认证请求消息的响应消息，用于指示ProSe通信认证通过。UE认证响应消息可以包括：KNR_ProSe、5GPRUK ID、以及Nonce_2。
S414，中继AMF网元向中继UE发送中继密钥响应(Relay Key Response)消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
其中，中继密钥响应消息主要用于为中继UE配置KNR_ProSe。中继密钥响应消息可以包括：KNR_ProSe、5GPRUK ID、以及Nonce_2。
S415，中继UE向远端UE发送直接安全模式命令(direct security mode commend)消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
直接安全模式命令消息用于指示远端UE确定KNR_ProSe。直接安全模式命令消息可以包括：5GPRUK ID、以及Nonce_2。
S416，远端UE推演KNR_ProSe。
远端UE在接收到直接安全模式命令消息后，可以根据5GPRUK ID定位用于建立PC5连接的5GPRUK，从而根据5GPRUK、Nonce_1和Nonce_2推演KNR_ProSe。
S417，远端UE向中继UE发送直接安全模式命令完成(direct security mode commend complete)消息。相应的，远端UE接收来自中继UE的直接安全模式命令完成消息。
可以看出，3GPP大致定义了ProSe通信的安全流程，即需要通过主认证流程来对ProSe通信进行认证，并在认证通过后推演KNR_ProSe，以确保ProSe通信安全。方便理解，下面介绍主认证流程。
图5为3GPP中主认证流程的流程示意图一，如图5所示，该流程包括如下步骤：
S501，UE向安全锚点功能(security anchor function，SEAF)发送N1消息。相应的，SEAF接收来自UE的N1消息。
SEAF可以部署在AMF网元或者其他任何可能的网元上，或者独立部署，对此不做具体限定。N1消息可以是注册请求(register request)消息，用于UE请求注册到网络。N1消息中可以包括：UE的标识，例如，SUCI，或者5G-全球唯一临时UE标识(globally unique temporary UE identity，GUTI)。
S502，SEAF向AUSF网元发送UE认证请求(Nausf_UEAuthentication_Authenticate Request)消息。相应的，AUSF网元接收来 自SEAF的UE认证请求消息。
UE认证请求消息用于请求AUSF网元执行认证流程。UE认证请求消息中可以包括：SUCI或用户永久标识(subscription permanent identifier，SUPI)、服务网络名称(service network name，SN-name)。
其中，SEAF接收到N1消息后，可确定5G-GUTI有效，且需要重新认证UE。那么，SEAF应当在UE认证请求消息中携带SUPI，否则应当携带SUCI。
S503，AUSF网元向UDM网元发送UE认证获得请求(Nudm_UEAuthentication_Get Request)消息。相应的，UDM网元接收来自AUSF网元UE认证获得请求消息。
UE认证获得请求消息用于请求UDM网元生成认证向量，以便后续认证使用。UE认证获得请求消息中可以包括：SUCI或SUPI、服务网络名称。
其中，AUSF网元接收到UE认证请求消息后，可验证服务网络名称，例如将UE认证请求消息中携带的服务网络名称与预期的服务网络名称比较。如果UE认证请求消息中携带的服务网络名称与预期的服务网络名称匹配，则AUSF网元确定SEAF有权使用该服务网络名称，向UDM网元发送UE认证获得请求消息。如果UE认证请求消息中携带的服务网络名称与预期的服务网络名称不匹配，则AUSF网元确定SEAF无权使用该服务网络名称，流程结束，并向SEAF发送消息，用以指示该服务网络未授权。
S504，UDM网元选择认证方式。
如果UE认证获得请求消息中携带的是SUCI，则UDM网元可以调用用户隐藏标识解密功能(subscription identifier de-concealing function，SIDF)解析SUCI，获得SUPI。UDM网元，或者UDM网元可以调用认证凭证存储和处理功能(authentication credential repository and processing function，ARPF)根据SUPI选择签约用户数据里支持的认证方法。该流程中UDM网元/ARPF确定选择5G认证与密钥协商(authentication and key agreement，AKA)机制。
S505，UDM网元生成认证向量。
UDM网元/ARPF可以生成5G AKA机制对应的认证向量，例如5G家乡环境认证向量(5G home environment authentication vector，5G HE AV)。认证向量可以包括：随机数(RAND)、认证令牌(authentication token，AUTN)、XRES*和KAUSF。其中，RAND和AUTN用于UE认证网络。XRES*可用于AUSF网元认证UE。KAUSF可用于保护发送给的UE的信息，还可用于密钥推演，以获得后续用于通信的密钥，例如KAMF。XRES*和KAUSF可由根密钥和RAND推演得到。
具体的，UDM网元/ARPF可以生成一些参数，包括：消息验证码(MAC)、期待的响应(XRES)、加密密钥(CK)、完整性密钥(IK)、以及匿名密钥(AK)。MAC由序列号(SQN)、RAND、AMF和根密钥经f1算法计算得到。XRES由RAND和根密钥经算法f2计算得到。CK由根密钥和RAND经f3算法计算得到。IK由根密钥和RAND经f4算法计算得到。AK由根密钥和RAND经f5算法计算得到。在此基础上，UDM网元/ARPF可以得到AUTN，AUTN包括：AK与SQN异或(SQN异或AK)与AMF和MAC串联 UDM网元/ARPF可以根据XRES和RAND推演XRES*,推演的过程中还使用下面参数，如服务网络名称、服务网络名称的长度，RAND的长度。UDM网元/ARPF还可以根据IK和CK推演KAUSF。至此，认证向量包含的参数均被推演出，也即生成认证向量。
S506，UDM网元向AUSF网元发送UE认证获得响应(Nudm_UEAuthentication_Get Response)消息。相应的，AUSF网元接收来自UDM网元的UE认证获得响应消息。
其中，UE认证获得响应消息为上述UE认证获得请求消息的响应消息。UE认证获得响应消息中可以包括：认证向量和指示信息，该指示信息用以指示该认证向量用于5G AKA。可选地，如果UE认证获得请求消息中携带的是SUCI，则UE认证获得响应消息中还可以包括：SUPI。
S507，AUSF网元储存XRES*，推演HXRES*以及KSEAF。
AUSF网元接收到UE认证获得响应消息后，可储存XRES*，或者XRES*和SUPI，以便后续认证使用。AUSF网元可根据XRES*推演HXRES*，该HXRES*可用于SEAF认证UE。AUSF网元还可根据KAUSF推演KSEAF，该KSEAF可用于SEAF的密钥推演，以获得KAMF。
S508，AUSF网元向SEAF发送UE认证响应(Nausf_UEAuthentication_Authenticate Response)消息。相应的，SEAF接收来自AUSF网元的UE认证响应消息。
UE认证响应消息为上述UE认证请求消息的响应消息。UE认证响应消息中可以包括：认证向量，例如5G服务环境认证向量(5G serving environment authentication vector，5G SE AV)。认证向量可以包括：RAND、AUTN、以及HXRES*。也就是说，AUSF网元将认证向量中的XRES*替换为HXRES*，并移除认证向量中的KAUSF，得到认证向量。
S509，SEAF向UE发送认证请求(authenticate request)消息。相应的，UE接收来自SEAF的认证请求消息。
认证请求消息可以是NAS消息，用于请求UE认证网络。认证请求消息可以包括：RAND、AUTN、5G密钥集标识(key set identifier in 5G，ngKSI)、以及不同架构之间的反降级(anti-bidding down between architectures，ABBA)参数。ngKSI可以由SEAF确定，用于UE和AMF网元标识KAMF和部分原生安全上下文。ABBA参数可以由SEAF确定，用于推演KAMF。
S510，UE推演RES*。
RES*用于认证UE。
其中，UE可以包括：移动设备(mobile equipment，ME)和全球用户识别卡(universal subscriber identity module，USIM)。UE接收到认证请求消息后，USIM可根据RAND和自身的根密钥，验证AUTN。如果USIM验证AUTN失败，则表示UE认证网络失败，流程结束。如果USIM验证AUTN通过，则表示UE认证网络通过。在此基础上，USIM可以利用根密钥和RAND推演RES、以及CK和IK，并向ME发送RES、以及CK和IK。ME可以根据CK和IK推演KAUSF，再根据KAUSF推 演KSEAF。ME还可以根据RES推演RES*，然后执行S511。
S511，UE向SEAF发送认证响应(authenticate response)消息。相应的，SEAF接收来自UE的认证响应消息。
认证响应消息可以是NAS消息，用于响应上述认证请求消息。认证响应消息中可以包括：RES*。
S512，SEAF认证UE。
SEAF接收到认证响应消息后，可根据RES*推演HRES*，以比较HRES*和先前获得的HXRES*。如果HRES*和HXRES*不匹配，则表示认证UE失败，认证流程结束。如果HRES*和HXRES*匹配，则表示认证UE通过，或者说从服务网的角度认为认证通过，然后执行S513。
S513，SEAF向AUSF网元发送UE认证请求消息。相应的，AUSF网元接收来自SEAF的UE认证请求消息。
UE认证请求消息用于请求认证UE。UE认证请求消息中可以包括：RES*。
S514，AUSF网元认证UE。
AUSF网元接收到UE认证请求消息后，可比较RES*与先前保存的XRES*。如果RES*和XRES*不匹配，则表示认证UE失败，流程结束。如果RES*和XRES*匹配，则表示认证UE通过，或者说从归属网的角度认为认证通过，然后执行S515。AUSF网元还可以根据本地网络运营商的策略确定存储KAUSF。
S515，AUSF网元向SEAF发送UE认证响应消息。相应的，SEAF接收来自AUSF网元的UE认证响应消息。
UE认证响应消息为UE认证请求消息的响应消息，用于指示认证UE通过。UE认证响应消息中可以包括：KSEAF。可选地，如果UE认证请求消息中携带的是SUCI，则UE认证响应消息中还可以包括：SUPI。其中，SEAF接收到UE认证响应消息后，可根据KSEAF、ABBA参数、以及SUPI，推演KAMF，并向AMF网元发送ngKSI和KAMF。
如果UE认证请求消息中携带的是SUCI，即SUCI用于此认证，则SEAF应当在接收到UE认证响应消息后，即包含SUPI的UE认证响应消息，才向AMF网元提供ngKSI和KAMF，以便在此之前，服务网不会为UE提供通信服务。
另外，UE在确定认证通过后，也可根据KSEAF、ABBA参数、以及SUPI自行推演KAMF。至此，UE和AMF网元都获得了相同的密钥，即KAMF，双方可使用该密钥进一步推演加密密钥和/或完整性保护密钥，并使用推演的密钥用对UE与AMF网元之间的信息进行安全保护，保证通信安全。
图6为3GPP中主认证流程的流程示意图二，如图6所示，该流程包括如下步骤：
S601，UE向SEAF发送N1消息。相应的，SEAF接收来自UE的N1消息。
S602，SEAF向AUSF网元发送UE认证请求消息。相应的，AUSF网元接收来自SEAF的UE认证请求消息。
S603，AUSF网元向UDM网元发送UE认证获得请求消息。相应的，UDM网元接收来自AUSF网元UE认证获得请求消息。
其中，S601-S603的具体实现原理与上述S501-S503类似，可参考理解，不再赘述。
S604，UDM网元选择认证方式。
如果UE认证请求消息中携带的是SUCI，则UDM网元可以调用SIDF解析SUCI，获得SUPI。UDM网元，或者UDM网元可以调用ARPF根据SUPI选择签约用户数据里支持的认证方法。该流程中UDM网元/ARPF确定选择扩展认证协议(extensible authentication protocol，EAP)-AKA’机制。
S605，UDM网元生成认证向量。
UDM网元/ARPF可以生成EAP-AKA’机制对应的认证向量，例如转换的认证向量AV’(transformed authentication vector)。认证向量可以包括：RAND、AUTN、XRES、以及CK’和IK’。其中，RAND、AUTN和XRES的具体实现原理可以参考上述S505中的相关介绍，不再赘述。CK’和IK’可由根密钥和RAND推演得到。例如，UDM网元/ARPF推演出CK和IK，再根据CK和IK推演CK’和IK’。CK和IK的具体实现原理可以参考上述S505中的相关介绍，不再赘述。
S606，UDM网元向AUSF网元发送UE认证获得响应消息。相应的，AUSF网元接收来自UDM网元的UE认证获得响应消息。
其中，UE认证获得响应消息用于响应上述UE认证获得请求消息。UE认证获得响应消息中可以包括：认证向量和指示信息，该指示信息用以指示该认证向量用于EAP-AKA’。可选地，如果UE认证获得请求消息中携带的是SUCI，则UE认证获得响应消息中还可以包括：SUPI。
S607，AUSF网元向SEAF发送UE认证响应消息。相应的，SEAF接收来自AUSF网元的UE认证响应消息。
UE认证响应消息用于响应上述UE认证请求消息。UE认证响应消息中可以包括：EAP请求(EAP-Request)消息/AKA’挑战(AKA'-Challenge)消息。EAP请求消息/AKA’挑战消息可以是根据UE认证获得响应消息确定的，消息中包括：RAND和AUTN。
S608，SEAF向UE发送认证请求消息。相应的，UE接收来自SEAF的认证请求消息。
认证请求消息可以是NAS消息，用于请求UE认证网络。认证请求消息中可以包括：EAP请求消息/AKA’挑战消息。也就是说，SEAF接收到UE认证响应消息后，可以将UE认证响应消息中的EAP请求消息/AKA’挑战消息继续封装到认证请求消息中，以向UE透传该EAP请求消息/AKA’挑战消息。此外，SEAF的认证请求消息中还可以包括：ngKSI、以及ABBA参数。ngKSI和ABBA参数的具体实现原理与上述S509中类似，可参考理解，不再赘述。此外，在EAP-AKA’认证过程中，SEAF向UE发送的ngKSI值和ABBA参数不能更改。
S609，UE推演RES。
RES用于认证UE。
UE可以包括：ME和USIM。UE接收到认证请求消息后，USIM可根据RAND和自身的根密钥，验证AUTN。如果USIM验证AUTN失败，则表示UE认证网络失 败，认证流程结束。如果USIM验证AUTN通过，则表示UE认证网络通过。在此基础上，USIM可以利用根密钥和RAND，推演RES、以及CK和IK，并向ME发送RES、以及CK和IK。ME可以根据CK和IK推演CK’和IK’。
S610，UE向SEAF发送认证响应消息。相应的，SEAF接收来自UE的认证响应消息。
认证响应消息可以是NAS消息，用于响应上述认证请求消息。认证响应消息中可以包括：EAP响应(EAP-response)消息/AKA’挑战消息。EAP响应消息/AKA’挑战消息中可以包括：RES。
S611，SEAF向AUSF网元发送UE认证请求消息。相应的，AUSF网元接收来自SEAF的UE认证请求消息。
UE认证请求消息用于请求认证UE。UE认证请求消息中可以包括：EAP响应消息/AKA’挑战消息。也就是说，SEAF接收到认证响应消息后，可以将认证响应消息中的EAP响应消息/AKA’挑战消息继续封装到UE认证请求消息中，以向AUSF网元透传该EAP响应消息/AKA’挑战消息。
S612，AUSF网元认证UE。
AUSF网元接收到UE认证请求消息后，可将EAP响应消息/AKA’挑战消息中的RES与本地保存的XRES比较。如果RES和XRES不匹配，则表示认证UE失败，认证流程结束。如果RES和XRES匹配，则表示认证UE通过，然后执行S614。
S613，AUSF网元向SEAF发送UE认证响应消息。相应的，SEAF接收来自AUSF网元的UE认证响应消息。
UE认证响应消息为UE认证请求消息的响应消息。UE认证响应消息中可以包括：EAP成功(EAP success)消息，用以指示认证通过，以及还可以包括：KSEAF。可选地，如果UE认证请求消息中携带的是SUCI，则UE认证响应消息中还可以包括：SUPI。可以理解，AUSF网元确定认证通过后，可根据CK’和IK’推演EMSK，根据EMSK确定KSEAF，具体的，AUSF网元确定EMSK的前256位作为KAUSF，然后根据KAUSF推演KSEAF。相应的，SEAF接收到UE认证响应消息后，可根据KSEAF、ABBA参数、以及SUPI，推演KAMF，并向AMF网元发送ngKSI和KAMF。
需要指出的是，如果UE认证请求消息中携带的是SUCI，即SUCI用于认证，则SEAF应当在接收到UE认证响应消息后，即包含SUPI的UE认证响应消息，才向AMF网元提供ngKSI和KAMF，以便在此之前，服务网不会为UE提供通信服务。
S614，SEAF向UE发送N1消息。相应的，UE接收来自SEAF的N1消息。
N1消息中可以包括：EAP成功消息、ngKSI和ABBA参数。这样，UE在确定认证通过后，也可根据KSEAF、ABBA参数、以及SUPI自行推演KAMF。至此，UE和AMF网元都获得了相同的密钥，即KAMF，双方可使用该密钥进一步推演加密密钥和/或完整性保护密钥，并使用推演的密钥用对UE与AMF网元之间的信息进行安全保护，保证通信安全。
如图5和图6所示，以上介绍了目前3GPP定义的主认证流程。该主认证流程主要定义了UE和网络如何执行认证并建立相同的密钥，如KAMF。如图4基于主认证流程的ProSe中继通信流程，有两个UE，包括：远端UE和中继UE。这种情况下， AUSF网元使用主认证流程认证ProSe中继通信场景下的远端UE，根据现有流程AUSF网络在认证过程中可以为远端UE存储KAUSF，推演用于UE和网络安全通信的KSEAF。但在中继通信场景下，远端UE并不会与中继AMF网元建立非接入层连接，也不会通过中继AMF网元注册到网络，因此无需建立UE与网络之间的安全上下文。并且中继通信场景下，需要建立的是远端UE和中继UE的安全通信，即需要为中继UE推演需要的密钥，现有认证流程无法支持AUSF网元实现该功能。此外，中继通信场景下，远端UE与网络之间的认证流程是通过中继UE和中继AMF执行，在中继UE接收到认证请求时，根据现有的流程，中继UE会解析认证请求，并执行网络验证，由于认证参数是基于远端UE的根密钥确定，中继UE验证网络会失败，导致流程终结，导致无法建立通信连接。
综上，针对上述技术问题，本申请实施例提出了如下技术方案，用以实现建立安全的ProSe中继通信。下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如无线保真(wireless fidelity，WiFi)系统，车到任意物体(vehicle to everything，V2X)通信系统、设备间(device-todevie，D2D)通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例的”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“信息(information)”，“信号(signal)”，“消息(message)”，“信道(channel)”、“信令(singaling)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是匹配的。“的(of)”，“相应的(corrEAPonding，relevant)”和“对应的(corrEAPonding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是匹配的。此外，本申请提到的“/”可以用于表示“或”的关系。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图7中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性的，图7为本申请实施例提供的通信方法所适用的一 种通信系统的架构示意图。
如图7所示，该通信系统可以适用于上述5G架构下的中继架构(层2中继架构或者层3中继架构)，主要包括：远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元。其中，远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元的相关功能，可以参考上述1、5G移动通信系统、2、近距离通信、以及3、ProSe通信中的相关介绍，不再赘述。在本申请实施例的通信系统中，远端UE通过中继UE接入后，可触发AUSF网元对远端UE进行认证并建立安全通信。
下面将结合图8-图14，通过方法实施例具体介绍远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的交互流程。为方便理解，下面先介绍本申请实施例主要所涉及的一些信元，如下表1所示。
表1

下面介绍本申请实施例所应用的各种场景。
场景1：
示例性的，图8为本申请实施例提供的通信方法的流程示意图一。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以是远端AUSF网元，如AUSF网元是根据远端UE的标识确定的，用于支持对远端UE的认证，或者也可以其他任何可能形态的AUSF网元，对此不做具体限定。UDM网元可以是远端UDM网元，如该UDM网元是根据远端UE的标识确定的，用于为远端UE生成认证向量，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景1中，UDM根据来自的AUSF网元的请求确定基于5G AKA建立安全的ProSe中继通信(也可以称为ProSe中继通信的5G AKA流程，简称5G ProSe AKA)。在增强的5G AKA的认证流程中，AMF网元、AUSF网元与UDM网元之间可通过使用已经服务操作(即service operation)进行交互。
具体的，如图8所示，该通信方法的流程如下：
S801，远端UE注册到网络，从网络获取ProSe通信策略信息。
S802，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，ProSe通信策略信息用于支持UE执行ProSe直接发现、建立ProSe直接通信、执行ProSe中继UE发现、建立中继通信连接中的一个或多个服务。S801为可选步骤，即在执行中继通信流程中之前，远端UE可以执行S801，获得ProSe通信策略信息，并基于该ProSe通信策略信息执行中继发现和建立直接通信连接。或者，在执行中继通信流程中之前，远端UE未接入网络获取ProSe通信策略信息，则远端UE基于本地预配置的ProSe通信策略信息执行中继发现和建立直接通信连接。
S803，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
S804，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。
S805，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信的密钥，或者说请求ProSe中继通信的密钥，请求包括：远端UE的SUCI、RSC、以及Nonce_1。可选的，中继密钥请求消息中还可以包括：中继UE的标识，如5G GUTI。
S806，中继AMF网元验证中继UE。
具体的，中继AMF网元可根据来自UDM网元的中继UE的签约信息，判断中继UE是否授权作为中继提供服务。
其中，S803-S806的具体实现原理与上述S403-S406类似，可参考理解，不再赘述。
S807，中继AMF网元向AUSF网元发送UE认证请求消息#1。相应的，AUSF网元接收来自中继AMF网元的UE认证请求消息#1。
中继AMF网元可根据远端UE的SUCI选择AUSF网元，如中继AMF网元与NRF网元交互确定服务的AUSF网元，或者根据本地存储的AUSF网元信息确定服务的AUSF网元。如此，中继AMF网元可根据来自中继UE的中继密钥请求消息，确定向被选中的AUSF网元发送UE认证请求消息#1。例如，中继AMF网元可以根据消息名称，确定向AUSF网元发送UE认证请求消息#1。
UE认证请求消息#1可以为Kausf_UEAuthentication_Authenticate Request消息。UE认证请求消息#1可以用于请求触发建立ProSe中继通信安全的认证流程(简称为触发ProSe认证)，以保证AUSF推演用于保护中继通信安全的密钥，避免AUSF执行错误的流程。该ProSe的认证用于远端UE通过中继UE与网络执行双向认证，并建立远端UE和中继UE之间安全通信的密钥。UE认证请求消息#1包含远端UE的SUCI，服务网络名称，还可以包括如下至少一项：RSC、Nonce_1或ProSe中继通信指示信息#1(例如，ProSe ind)。RSC或Nonce_1或ProSe中继通信指示信息#1或者服务网络名称都可用于指示请求的是ProSe认证，或者说指示认证用于认证远端UE。也就是说，UE认证请求消息#1可以通过其携带的信元来指示请求触发ProSe认证。该信元可以是新的信元或者已有信元，针对已有信元，可以通过使用新的值来指示。
具体的，一种可能的方式中，UE认证请求消息#1中可以包括：远端UE的SUCI、服务网络名称、以及ProSe中继通信指示信息#1，以通过ProSe中继通信指示信息#1其用于请求或者说用于触发ProSe认证。在此基础上，中继AMF网元可以在后续确定远端UE认证通过的情况下，再向AUSF网元发送RSC和Nonce_1，以使AUSF网元推演中继通信密钥，例如ProSe密钥。
或者，另一种可能的方式中，UE认证请求消息#1中可以包括：远端UE的SUCI、RSC、Nonce_1、以及服务网络名称，以通过RSC和/或Nonce_1指示其用于请求ProSe认证。
或者，又一种可能的方式中，UE认证请求消息#1中可以包括：远端UE的SUCI、服务网络名称、RSC、Nonce_1、以及ProSe中继通信指示信息#1，以通过显示的ProSe中继通信指示信息#1请求ProSe认证。
上述三种可能的方式中，服务网络名称可以为5G:SN ID或5G:ProSe或者5G:ProSe||SN ID。
或者，再一种可能的方式中，UE认证请求消息#1中可以包括：远端UE的SUCI、服务网络名称、RSC、Nonce_1。服务网络名称设置为5G:ProSe5G或者ProSe||SN ID，AUSF网元可根据该特定的服务网络名称确定为ProSe认证。
或者，还一种可能的方式中，UE认证请求消息#1中可以包括：远端UE的 SUCI、服务网络名称。服务网络名称设置为5G:ProSe或5G:ProSe||SN ID，AUSF网元可根据该特定的服务网络名称确定为ProSe认证。这种方式中，中继AMF网元在接收到下述的ProSe通信认证响应消息后，再向AUSF网元发送RSC和Nonce_1，以使AUSF网元推演ProSe密钥。
此外，若AUSF网元接收了来自AMF网元的RSC和Nonce_1，则AUSF保存RSC和Nonce_1，用于后续ProSe密钥推演。
可以理解，上述通过SN名的设置来指示的认证方式仅为一些示例，其具体的实现方式不限，下文中的相关介绍也可以参考理解，不再赘述。
S808，AUSF网元向UDM网元发送UE认证获得请求消息。相应的，UDM网元接收来自AUSF网元的UE认证获得请求消息。
AUSF网元可以根据UE认证请求消息#1，向UDM网元发送UE认证获得请求消息。UE认证获得请求消息可以为Nudm_UEAuthentication_Request请求消息。UE认证获得请求消息可用于请求ProSe认证的数据。UE认证获得请求消息中可以包括：远端UE的SUCI、服务网络名称。
若UE认证请求消息#1包括：远端UE的SUCI、服务网络名称、以及ProSe中继通信指示信息#1，则UE认证获得请求消息还可以包含：ProSe中继通信指示信息#2。ProSe中继通信指示信息#2用于请求ProSe认证的数据，或者说指示获取用于认证远端UE的认证数据。也即，UE认证获得请求消息可以通过其携带显示的信元，例如ProSe中继通信指示信息#2，指示其用于请求ProSe认证的数据。其中，AUSF网元可复用该ProSe中继通信指示信息#1，将其封装到UE认证获得请求消息中。此时，ProSe中继通信指示信息#1与ProSe中继通信指示信息#2可以为同一指示信息。或者，AUSF网元也可根据UE认证请求消息#1中的ProSe中继通信指示信息#1，生成ProSe中继通信指示信息#2。此时，ProSe中继通信指示信息#1与ProSe中继通信指示信息#2可以为不同的指示信息。
若UE认证请求消息#1包括：远端UE的SUCI、RSC、Nonce_1、以及服务网络名称，则UE认证获得请求消息还可以包含：RSC，Nonce_1、或ProSe中继通信指示信息#2。其中，RSC，Nonce_1或ProSe中继通信指示信息#2用于获取ProSe认证的数据，或者说用于获取认证远端UE的认证数据。
若UE认证请求消息#1包括：远端UE的SUCI、服务网络名称、RSC、Nonce_1、以及ProSe中继通信指示信息#1，则UE认证获得请求消息还可以包含：RSC，Nonce_1或ProSe中继通信指示信息#2。其中，RSC，Nonce_1或ProSe中继通信指示信息#2用于获取ProSe认证的数据，或者说用于获取认证远端UE的认证数据。
若UE认证请求消息#1包括：远端UE的SUCI、服务网络名称、RSC、Nonce_1，服务网络名称设置为5G:ProSe或5G:ProSe||SN ID，AUSF网元根据该特定的服务网络名称确定为ProSe认证，则UE认证获得请求消息还可以包含：RSC，Nonce_1。此时，服务网络名称用于指示获取ProSe认证的数据，或者用于指示获取认证远端UE的认证数据。
若UE认证请求消息#1包括：远端UE的SUCI、服务网络名称，服务网络名称 设置为5G:ProSe或5G:ProSe||SN ID，AUSF根据该特定的服务网络名称确定为ProSe认证，则服务网络名称用于指示获取ProSe认证的数据，或者用于指示获取认证远端UE的认证数据。
可以理解，上述UE认证请求消息#1中包括的各种参数组合仅为示例，不作为限定，其他组合也可以参考理解，不再赘述。
S809，UDM网元生成ProSe中继通信的认证向量。
UDM网元接收到UE认证获得请求消息后，可根据ProSe中继通信指示信息#2、或RSC、或服务网络名称，确定获取ProSe认证的数据。
具体的，UDM网元，或者UDM网元可以调用SIDF，解析SIDF解析SUCI获取SUPI。UDM网元可以根据SUPI对应的签约用户数据和请求消息，确定ProSe中继通信的认证机制，例如确定使用ProSe中继通信的5G AKA，也即5G ProSe AKA。如此，UDM网元可以生成ProSe中继通信的认证向量，例如，5G ProSe AKA的认证向量#1(5G ProSe AKA HE AV)。5G ProSe AKA的认证向量#1可以包括：RAND、AUTN、XRES*、以及KAUSF。RAND和AUTN可以由UDM网元确定，用于远端UE认证网络。其中XRES*可由UDM网元或ARPF根据XRES推演得到，用于AUSF网元认证远端UE。XRES可由UDM网元或ARPF根据根密钥(K)和RAND推演得到。KAUSF由UDM网元或ARPF根据IK、CK和服务网络名称推演得到，用于推演ProSe密钥。
可以理解，上述介绍了5G ProSe AKA的认证向量#1的一些实现方式，5G ProSe AKA的认证向量#1还可以替换为其他任何的可能的实现方式。例如，5G ProSe AKA的认证向量#1包括：RAND、AUTN、XRES以及KPROSE。其中，XRES仍可由UDM网元或ARPF根据根密钥和RAND推演得到。KPROSE可由UDM网元或ARPF根据IK、CK、服务网络名称和字符串(PROSE)推演得到，用于推演ProSe密钥。或者，UDM网元或ARPF先推演得到KAUSF，再根据KAUSF推演KPROSE，具体的推演方法不限制。又例如，5G ProSe AKA的认证向量#1包括：RAND、AUTN、XRES*以及KPROSE。
可选地，UDM网元确定ProSe中继通信的认证机制也可以为：如果UE认证获得请求消息中携带有新的信元(如ProSe中继通信指示信息#2或RSC)，则UDM网元确定使用5G ProSeAKA。或者通过携带新的SN名，如5G：PROSE或5G:ProSe||SN ID，使得UDM网元确定使用5G ProSe AKA。
可选地，在确定执行ProSe认证基础上，UDM网元可以根据SUPI对应的签约用户数据，判断用户是否授权使用中继通信。如果确定用户授权使用中继通信，则授权检查通过，流程继续。否则，UDM网元向AUSF网元发送用于指示认证失败的响应消息，流程结束。可以理解，UDM网元执行判断用户是否授权使用中继通信的流程，与上述UDM网元执行确定ProSe中继通信的认证机制的流程之间的顺序可以不限定。
需要指出的是，ProSe中继通信的5G AKA仅为本申请实施例中的一种示例性命名方式，其也可以替换为其他任何可能的命名方式，例如5G ProSe中继通信的AKA、或5G ProSe AKA等，对此不做任何限定。同理，5G AKA的ProSe认证向量 #1也仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如5G AKA ProSe认证向量#1、5G ProSe AKA认证向量#1、或5G ProSe AKA的认证向量#1等，对此不做任何限定。
S810，UDM网元向AUSF网元发送UE认证获得响应消息。相应的，UDM网元接收来自AUSF网元的UE认证获得响应消息。
UE认证获得响应消息可以用于响应上述UE认证获得请求消息。UE认证获得响应消息中可以包括：5G ProSe AKA的认证向量#1，可选地，还可以包括：SUPI。UE认证获得响应消息还可以指示：该5G ProSe AKA的认证向量#1为用于ProSe中继通信的认证向量。例如，在UE认证获得响应消息已有指示信息指示认证向量用于5G AKA的基础上，可在UE认证获得响应消息中新增指示信息，用以指示5G AKA支持ProSe中继通信。或者，在UE认证获得响应消息中新增指示信息，用以指示认证向量用于5G ProSe认证和密钥管理。即认证向量用于远端UE与网络之间执行双向认证，以及建立远端UE和中继UE之间安全通信的密钥。
S811，AUSF网元储存XRES*，推演HXRES*。
AUSF网元接收到UE认证获得响应消息后，可储存XRES*，可选地，还存储SUPI。
一种可能的实现方式中，AUSF网元可根据XRES*推演HXRES*，该HXRES*可用于中继AMF网元认证远端UE。在ProSe中继通信认证流程中，AUSF网元不推演KSEAF，以防止生成冗余的信息，造成资源的浪费。
或者，另一种可能的实现方式中，AUSF网元可以不推演HXRES*，下述S812中发送给中继AMF网元的认证向量中可包含AUTN和RAND，不包含HXRES*，使得中继AMF网元后续可以不执行服务网的认证流程。或者，若来自UDM网元的认证向量中包含XRES，下述S812中向中继AMF网元发送的认证向量中也可包含AUTN和RAND，不包含HXRES，使得中继AMF网元后续可以不执行服务网的认证流程。此处不限制。
可以理解，上述两种实现方式都可以防止网元资源的浪费。
S812，AUSF网元向中继AMF网元发送UE认证响应消息#1。相应的，中继AMF网元接收来自AUSF网元的UE认证响应消息#1。
UE认证响应消息#1为上述UE认证请求消息#1的响应消息。UE认证响应消息#1中可以包括：5G AKA的ProSe认证向量#2(5G ProSe AKA SE AV)。5G AKA的ProSe认证向量#1可以包括：RAND、AUTN、以及HXRES*。也就是说，AUSF网元可以将5G AKA的ProSe认证向量#1中的XRES*替换为HXRES*，以及移除5G AKA的ProSe认证向量#1中的KAUSF，得到5G AKA的ProSe认证向量#2。
此外，根据上述S811中的介绍，一种可能的实现方式中，5G AKA的ProSe认证向量#2可以包括：RAND和AUTN，不包括：HXRES或HXRES*。
可选地，UE认证响应消息#1中也可以包括：指示信息，用以指示认证向量用于认证远端UE。
需要指出的是，5G AKA的ProSe认证向量#2也仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如5G AKA ProSe认证 向量#2、5G ProSe AKA认证向量#2、或5G ProSe AKA的认证向量#2等，对此不做任何限定。
S813，中继AMF网元向中继UE发送ProSe通信认证请求消息。相应的，中继UE接收来自中继AMF网元的ProSe通信认证请求消息。
ProSe通信认证请求消息可用于指示对远端UE认证，或者说指示中继UE向远端UE发送认证数据，以避免中继UE接收到ProSe通信认证请求消息后自行执行认证，防止认证失败，无法建立通信连接。ProSe通信认证请求消息可以通过其消息类型或其携带的指示信息进行指示。当然，也可通过已有消息(如认证请求消息)携带指示信息指示中继UE向远端UE发送认证数据，或指示对远端UE进行认证，此处不限制。ProSe通信认证请求消息中可以包括：RAND和AUTN(认证数据)，也即中继AMF网元可以从5G ProSe AKA的认证向量#2中获得的RAND和AUTN，并将其封装到ProSe通信认证请求消息中。RAND和AUTN用于远端UE认证网络。
可选地，中继AMF网元向中继UE发送ProSe通信认证请求消息前，中继AMF跳过获取ngKSI和ABBA参数。或者，中继AMF网元跳过生成ngKSI和ABBA参数。中继AMF网元不向中继UE发送ngKSI和ABBA参数，也即ProSe通信认证请求消息不包含ngKSI和ABBA参数。
需要指出的是，ProSe通信认证请求消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如ProSe认证请求消息、远端UE ProSe认证请求消息、或已有的认证请求等等。此外，S813的具体实现也可以是在已有消息中引入新的容器信元，容器中包含RAND和AUTN。若中继UE接收到包含该容器的消息，则执行S814。
S814，中继UE向远端UE发送远端UE认证请求消息。相应的，远端UE接收来自中继UE的远端UE认证请求消息。
远端UE认证请求消息可用于指示认证远端UE，或者说指示远端UE执行ProSe认证，确保远端UE与网络执行认证并推演ProSe密钥，建立远端UE和中继UE之间的安全通信。例如，远端UE认证请求消息可以通过其消息类型，或其携带的指示信息，指示远端UE执行ProSe认证。当然，也可通过已有消息携带指示信息来指示认证远端UE，或者说指示远端UE执行ProSe认证，此处不限制。远端UE认证请求消息中可以包括：RAND和AUTN。也就是说，中继UE接收到ProSe通信认证请求消息后，可将ProSe通信认证请求消息携带的RAND和AUTN，继续封装到远端UE认证请求消息中，以便远端UE认证使用。
需要指出的是，远端UE认证请求消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如远端UE ProSe通信认证请求消息、或远端UE ProSe认证请求消息等等。此外，若中继UE接收的为上述容器，则直接向远端UE转发该容器。
S815，远端UE推演RES*。
其中，该RES*可用于认证远端UE。
远端UE可以包括：ME和USIM。远端UE接收到远端UE认证请求消息后，USIM可根据RAND和自身的根密钥，验证AUTN。如果USIM验证AUTN失败， 则表示UE认证网络失败，流程结束。如果USIM验证AUTN通过，则表示UE认证网络通过。在UE认证网络通过后，USIM可以利用根密钥和RAND推演RES、以及CK和IK，并向ME发送RES、以及CK和IK。ME可以根据CK和IK推演KAUSF，以及根据RES推演RES*，然后执行S816。在ProSe认证中，ME可以不推演KSEAF，以提高认证效率。
需要说明的是，如上述S809和S811中的相关介绍可知，若网络侧使用新的密钥推演方法或新的认证参数的推演方法，则远端UE也使用和网络侧相同的方法执行密钥推演或认证参数推演，以及其他认证数据的生成。
S816，远端UE向中继UE发送远端UE认证响应消息。相应的，中继UE接收来自远端UE的远端UE认证响应消息。
远端UE认证响应消息为远端UE认证请求消息的响应消息。可选地，ProSe通信认证响应消息可用于指示其为远端UE的认证响应消息，例如可以通过消息的类型或消息中包含的信元指示且为远端UE的认证响应消息。远端UE认证响应消息中可以包括：RES*。
需要指出的是，远端UE认证响应消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如远端UE ProSe通信认证响应消息、或远端UE ProSe认证响应消息等等。
S817，中继UE向中继AMF网元发送ProSe通信认证响应消息。相应的，中继AMF网元接收来自中继UE的ProSe通信认证响应消息。
ProSe通信认证响应消息为上述ProSe通信认证请求消息的响应消息。ProSe通信认证响应消息中可以包括：RES*。也就是说，中继UE可以从远端UE认证响应消息中获得RES*，将其继续封装到ProSe通信认证响应消息中。
需要指出的是，ProSe通信认证响应消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如ProSe认证响应消息、或远端UE ProSe认证响应消息等等。
S818，中继AMF网元认证远端UE。
中继AMF网元接收到ProSe通信认证响应消息后，可根据接收到的RES*推演HRES*，以比较HRES*和S812获得的HXRES*。如果HRES*和HXRES*不匹配，例如HRES*和HXRES*不相同，则表示认证远端UE失败，认证流程结束。如果HRES*和HXRES*匹配，例如HRES*和HXRES*相同，则表示认证UE通过，或者说从服务网的角度认为认证通过，然后执行S819。
可以理解，若S811不推演HXRES*，则中继AMF网元无需推演HRES*，也无需执行服务网的认证。
S819，中继AMF网元向AUSF网元发送UE认证请求消息#2。相应的，AUSF网元接收来自中继AMF网元的UE认证请求消息#2。
UE认证请求消息#2可用于请求对远端UE进行ProSe认证。例如，UE认证请求消息#2可以通过新的指示信息指示对远端UE进行认证。UE认证请求消息#2中可以包括：RES*。也就是说，中继AMF网元在认证远端UE通过后，可将RES*封装到UE认证请求消息#2中，然后向AUSF网元发送UE认证请求消息#2。可选地，如果 S807中的UE认证请求消息#1未携带RSC和Nonce_1，则UE认证请求消息#2中还可以包括：RSC和Nonce_1，即中继AMF网元还可以将RSC和Nonce_1封装到UE认证请求消息#2中。或者，在S807中的UE认证请求消息#1携带RSC和Nonce_1的情况下，UE认证请求消息#2中仍可以包括：RSC和Nonce_1。此时，RSC和Nonce_1也可以用于指示对远端UE进行认证。
S820，AUSF网元认证远端UE。
AUSF网元接收到UE认证请求消息#2后，可比较RES*与先前保存的XRES*。如果RES*和XRES*不匹配，例如RES*和XRES*不相同，则表示认证远端UE失败，流程结束。如果RES*和XRES*匹配，例如RES*和XRES*相同，则表示认证远端UE通过，或者说从归属网的角度认为认证通过。在此基础上，AUSF网元可以生成Nonce_2，根据先前保存的KAUSF、RSC、Nonce_1和Nonce_2，推演ProSe密钥(KNR_ProSe)，用于远端UE与中继UE的通信使用。例如，AUSF网元可以先根据KAUSF和RSC推演一个中间密钥，再根据中间密钥、Nonce_1和Nonce_2推演ProSe密钥。或者，AUSF网元可以直接根据KAUSF、RSC、Nonce_1以及Nonce_2，推演ProSe密钥。或者，AUSF网元还可以采用其他任何可能的方式推演ProSe密钥，对此不做具体限定。
可选地，AUSF网元认证远端UE通过后，AUSF网元可以根据认证为ProSe认证，确定跳过向UDM网元发送认证结果的流程，即不向UDM网元发送认证结果，而执行下述S821，以向中继AMF网元发送UE认证响应消息#2，从而保证仅执行必要的流程，防止资源浪费。
可选地，在确定认证远端UE的情况下，AUSF网元执行上述ProSe密钥推演的过程。
需要指出的是，ProSe密钥仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如ProSe通信密钥。此外，如果上述5GAKA的ProSe认证向量#1中的密钥为KPROSE，则AUSF网元应当使用KPROSE来推演ProSe密钥，即KAUSF替换为KPROSE。
S821，AUSF网元向中继AMF网元发送UE认证响应消息#2。相应的，中继AMF网元接收来自AUSF网元的UE认证响应消息#2。
UE认证响应消息#2为UE认证请求消息#2的响应消息，可用于指示认证远端UE通过。UE认证响应消息#2中可以包括：ProSe密钥和Nonce_2。也就是说，AUSF网元确定远端UE认证通过后，可将ProSe密钥和Nonce_2封装到UE认证响应消息#2中，然后向中继AMF网元发送UE认证响应消息#2。
可选地，UE认证响应消息#2中还可以包括：远端UE的SUPI。该远端UE的SUPI可用于指示中继UE向网络侧上报执行远端UE的信息。
S822，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
中继密钥响应消息为上述中继密钥请求消息的响应消息，可以包括：ProSe密钥和Nonce_2，可选地，还可以包括：远端UE的SUPI。也就是说，中继AMF网元接收到UE认证响应消息#2后，可根据UE认证响应消息#2，获得ProSe密钥和 Nonce_2，可选地，还可以获得远端UE的SUPI，并将其封装到中继密钥响应消息中，以向中继UE发送中继密钥响应消息。相应的，中继UE可以存储ProSe密钥，可选地，还可以存储远端UE的SUPI。
S823，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
直接安全模式命令消息可用于指示建立PC5安全。直接安全模式命令消息中可以包括：Nonce_2。也就是说，中继UE接收到中继密钥响应消息后，可从中获得Nonce_2，然后将其封装到直接安全模式命令消息中，从而向远端UE发送直接安全模式命令消息。
S824，远端UE推演ProSe密钥。
远端UE可以使用与AUSF相同的方式推演ProSe密钥，即根据先前推演得到的KAUSF、RSC、Nonce_1和Nonce_2，推演ProSe密钥。此外，如果远端UE上述推演的密钥为KPROSE，则远端UE应当使用KPROSE来推演ProSe密钥，即KAUSF替换为KPROSE。
S825，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
直接安全模式命令完成消息为上述直接安全模式命令消息的响应消息，用以指示远端UE已确定ProSe密钥。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。由于中继AMF网元、AUSF网元与UDM网元之间的交互可通过复用已有服务操作实现，在不引入新的服务操作的情况实现远端UE与网络之间的认证，以及生成中继UE和远端UE之间的安全通信的密钥。
需要指出的是，图8所示的流程中提到的消息#1、消息#2、向量#1、向量#2等等，仅用于命名上的区分，不作为任何限定。
场景2：
示例性的，图9为本申请实施例提供的通信方法的流程示意图二。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以是远端AUSF网元，如AUSF网元是根据远端UE的标识确定的，用于支持对远端UE的认证，或者也可以其他任何可能形态的AUSF网元，对此不做具体限定。UDM网元可以是远端UDM网元，如该UDM网元是根据远端UE的标识确定的，用于为远端UE生成认证向量，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景2中，根据来自的AUSF的请求确定基于增强的5G AKA建立安全的ProSe中继通信(也可以称为ProSe中继通信的5G AKA流程，简称5G ProSe AKA)。在ProSe中继通信的5G AKA的认证流程中，AMF网元、AUSF网元与UDM网元之间可通过新的服务操作或新的服务名称进行交互。
具体的，如图9所示，该通信方法的流程如下：
S901，远端UE注册到网络，从网络获取ProSe通信策略信息。
S902，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，S901-S902的具体实现原理与上述S801-S802类似，可参考理解，不再赘述。
S903，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
S904，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。
S905，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信，或者说请求ProSe中继通信的密钥，包括：远端UE的SUCI、RSC、以及Nonce_1。可选地，中继密钥请求消息中还可以包括：中继UE的标识，如5G GUTI。
S906，中继AMF网元验证中继UE。
具体的，中继AMF网元根据来自UDM网元的中继UE的签约信息，判断中继UE是否授权作为中继提供服务。
其中，S903-S906的具体实现原理与上述S403-S406类似，可参考理解，不再赘述。
S907，中继AMF网元向AUSF网元发送ProSe UE认证请求(Nausf_ProSeUEAuthentication_Authenticate Request或Nausf_UEAuthentication_ProSeAuthenticate Request)消息#1。相应的，AUSF网元接收来自中继AMF网元的ProSe UE认证请求消息#1。
中继AMF网元可根据远端UE的SUCI选择AUSF网元，如中继AMF网元与NRF网元交互确定服务的AUSF网元，或者根据本地存储的AUSF网元信息确定服务的AUSF网元。如此，中继AMF网元可根据来自中继UE的中继密钥请求消息，确定向被选中的AUSF网元发送ProSe UE认证请求消息#1。例如，中继AMF网元可以根据消息名称，确定向AUSF网元发送ProSe UE认证请求消息#1。
ProSe UE认证请求消息#1可以用于请求建立ProSe中继通信安全的认证流程(可简称触发ProSe认证)，或者说触发ProSe认证，以保证AUSF推演用于保护中继通信安全的密钥，避免AUSF执行错误的流程。例如，ProSe UE认证请求消息#1可以通过自身服务类型、服务操作、或服务名称，指示其用于请求ProSe认证。该ProSe认证用于远端UE通过中继UE与网络执行双向认证，并建立远端UE和中继UE之间安全通信的密钥。ProSe UE认证请求消息#1可以包括如下至少一项：远端UE的SUCI、RSC、Nonce_1、或服务网络名称。
具体的，一种可能的方式中，ProSe UE认证请求消息#1中可以包括：远端UE的SUCI、以及服务网络名称。在此基础上，中继AMF网元可以在后续确定远端UE认证通过的情况下，再向AUSF网元发送RSC和Nonce_1，以进一步按需提供参 数。或者，另一种可能的方式中，ProSe UE认证请求消息#1中可以包括：远端UE的SUCI、RSC、Nonce_1、以及服务网络名称。
上述服务网络名称可以为5G:SN ID或5G:ProSe或者5G:ProSe||SN ID。若使用5G:ProSe或者5G:ProSe||SN ID，可以保证AV向量与直接认证的不同，达到安全隔离的密钥。
需要指出的是，通过ProSe UE认证请求消息这一名称指示新的服务名称或服务操作仅为一种示例，其也可以替换为其他任何可能的命名，例如5G ProSe UE认证请求消息、ProSe通信UE认证请求消息、或5G ProSe通信UE认证请求消息等等，对此不做任何限定。
S908，AUSF网元向UDM网元发送ProSe UE认证获得请求
(Nudm_ProSeUEAuthentication_Get Request或Nudm_UEAuthentication_GetProSeAV)消息。相应的，UDM网元接收来自AUSF网元的ProSe UE认证获得请求消息。
AUSF网元可以根据ProSe UE认证请求消息#1，向UDM网元发送ProSe UE认证获得请求消息。ProSe UE认证获得请求消息可用于请求ProSe认证(触发ProSe认证)。例如，ProSe UE认证获得请求消息可以通过自身服务类型、服务操作、或服务名称，指示其用于请求ProSe认证。ProSe UE认证获得请求消息中可以包括：远端UE的SUCI。
可以理解，ProSe UE认证获得请求消息的上述实现方式仅为一些示例，不作为限定。例如，ProSe UE认证获得请求消息仍可以携带上述ProSe中继通信指示信息#2，以通过ProSe中继通信指示信息#2指示其用于请求ProSe认证。ProSe中继通信指示信息#2的具体实现原理可以参考上述S808中的相关介绍，不再赘述。
需要指出的是，通过ProSe UE认证获得请求消息这一名称指示新的服务名称或服务操作仅为一种示例，其也可以替换为其他任何可能的命名，例如5G ProSe UE认证获得请求消息、ProSe通信UE认证获得请求消息、或5G ProSe通信UE认证获得请求消息等等，对此不做任何限定。
S909，UDM网元生成ProSe中继通信的认证向量。
UDM网元可根据ProSe UE认证获得请求消息，确定执行ProSe认证。在此基础上，UDM网元，或者UDM网元可以调用SIDF，解析SIDF解析SUCI获取SUPI。UDM网元可以根据SUPI对应的签约用户数据，确定ProSe中继通信的认证机制，例如确定使用ProSe中继通信的5G AKA，也即5G ProSe AKA。如此，UDM网元可以生成ProSe中继通信的认证向量，具体实现原理可以参考上述S809中的相关介绍，不再赘述。
可选地，在确定执行ProSe认证的基础上，UDM网元可以根据SUPI对应的签约用户数据，判断用户是否授权使用中继通信，具体实现原理也可以参考上述S809中的相关介绍，不再赘述。
S910，UDM网元向AUSF网元发送ProSe UE认证获得响应(Nudm_ProSeUEAuthentication_Get Response或Nudm_ProSeUEAuthentication_GetProSeAV Response)消息。相 应的，UDM网元接收来自AUSF网元的ProSe UE认证获得响应消息。
ProSe UE认证获得响应消息为上述ProSe UE认证获得请求消息的响应消息。ProSe UE认证获得响应消息中可以包括：5G ProSe AKA的认证向量#1，可选地，还可以包括：SUPI。ProSe UE认证获得响应消息还可以指示该5G ProSe AKA的认证向量#1为支持ProSe中继通信的5G AKA认证向量。例如，ProSe UE认证获得响应消息可以通过自身消息类型、服务操作、或服务名称，指示认证向量用于5G AKA，5G AKA支持ProSe中继通信。或者，ProSe UE认证获得响应消息也可以通过携带的指示信息，指示认证向量用于5G AKA，5G AKA支持ProSe中继通信。
需要指出的是，通过ProSe UE认证获得响应消息这一名称指示新的服务名称或服务操作仅为一种示例，其也可以替换为其他任何可能的命名方式，例如5G ProSe UE认证响应请求消息、ProSe通信UE认证获得响应消息、或5G ProSe通信UE认证获得响应消息等等，对此不做任何限定。
S911，AUSF网元储存XRES*，推演HXRES*。
其中，S911的具体实现原理与上述S811类似，可参考理解，不再赘述。
S912，AUSF网元向中继AMF网元发送ProSe UE认证响应(Nausf_ProSeUEAuthentication_Authenticate response或Nausf_UEAuthentication_ProSeAuthenticate response)消息#1。相应的，中继AMF网元接收来自AUSF网元的ProSe UE认证响应消息#1。
ProSe UE认证响应消息#1为上述ProSe UE认证请求消息#1的响应消息。ProSe UE认证响应消息#1中可以包括：5G ProSe AKA的认证向量#2，具体实现原理可以参考上述S812中的相关介绍，不再赘述。ProSe UE认证响应消息#1还可以指示该5G ProSe AKA的认证向量#2为支持ProSe中继通信的5G AKA。例如，ProSe UE认证响应消息#1可以通过自身消息类型、服务操作、或服务名称，指示认证向量用于5G AKA，5G AKA支持ProSe中继通信。或者，ProSe UE认证响应消息#1也可以通过携带的指示信息，指示认证向量用于5G AKA，5G AKA支持ProSe中继通信。
需要指出的是，通过ProSe UE认证响应消息这一名称指示新的服务名称或服务操作仅为一种示例，其也可以替换为其他任何可能的命名方式，例如5G ProSe UE认证响应消息、ProSe通信UE认证响应消息、或5G ProSe通信UE认证响应消息等等，对此不做任何限定。
S913，中继AMF网元向中继UE发送ProSe通信认证请求消息。相应的，中继UE接收来自中继AMF网元的ProSe通信认证请求消息。
S914，中继UE向远端UE发送远端UE认证请求消息。相应的，远端UE接收来自中继UE的远端UE认证请求消息。
S915，远端UE推演RES*。
S916，远端UE向中继UE发送远端UE认证响应消息。相应的，远端UE接收来自中继UE的远端UE认证响应消息。
S917，中继UE向中继AMF网元发送ProSe通信认证响应消息。相应的，中继AMF网元接收来自中继UE的ProSe通信认证响应消息。
S918，中继AMF网元认证远端UE。
其中，S913-S918的具体实现原理与S813-S818类似，可以参考理解，不再赘述。
S919，中继AMF网元向AUSF网元发送ProSe UE认证请求消息#2。相应的，AUSF网元接收来自中继AMF网元的ProSe UE认证请求消息#2。
ProSe UE认证请求消息#2可用于请求对远端UE进行ProSe认证，包括：RES*。也就是说，中继AMF网元在认证远端UE通过后，可将RES*封装到ProSe UE认证请求消息#2中，然后向AUSF网元发送ProSe UE认证请求消息#2。可选地，如果S907中的UE认证请求消息#1未携带RSC和Nonce_1，则ProSe UE认证请求消息#2中还可以包括：RSC和Nonce_1，即中继AMF网元还可以将RSC和Nonce_1封装到ProSe UE认证请求消息#2中。或者，在S907中的ProSe UE认证请求消息#1携带RSC和Nonce_1的情况下，ProSe UE认证请求消息#2中仍可以包括：RSC和Nonce_1。
S920，AUSF网元认证远端UE。
其中，S920的具体实现原理与S820类似，可以参考理解，不再赘述。
S921，AUSF网元向中继AMF网元发送ProSe UE认证响应消息#2。相应的，中继AMF网元接收来自AUSF网元的ProSe UE认证响应消息#2。
ProSe UE认证响应消息#2为ProSe UE认证请求消息#2的响应消息，可用于指示认证远端UE通过。ProSe UE认证响应消息#2中可以包括：ProSe密钥和Nonce_2。
S922，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
S923，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
S924，远端UE推演ProSe密钥。
S925，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
其中，S921-S925的具体实现原理与S821-S825类似，可以参考理解，不再赘述。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。由于中继AMF网元、AUSF网元与UDM网元之间的交互可通过新的信令实现，实现与已有认证流程解耦，避免认证流程对ProSe认证产生影响。
需要指出的是，图9所示的流程中提到的消息#1、消息#2、向量#1、向量#2等等，仅用于命名上的区分，不作为任何限定。
场景3：
示例性的，图10为本申请实施例提供的通信方法的流程示意图三。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以是远端AUSF网元，如AUSF网 元是根据远端UE的标识确定的，用于支持对远端UE的认证，或者也可以其他任何可能形态的AUSF网元，对此不做具体限定。UDM网元可以是远端UDM网元，如该UDM网元是根据远端UE的标识确定的，用于为远端UE生成认证向量，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景3中，UDM网元根据来自的AUSF网元的请求确定基于EAP AKA’建立安全的ProSe中继通信(也可以称为ProSe中继通信的EAP-AKA’流程，简称ProSe EAP-AKA’)。在ProSe中继通信的EAP-AKA’的认证流程中，AMF网元、AUSF网元与UDM网元之间可通过使用已有服务操作进行交互。
具体的，如图10所示，该通信方法的流程如下：
S1001，远端UE注册到网络，从网络获取ProSe通信策略信息。
S1002，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，S1001-S1002的具体实现原理与上述S801-S802类似，可参考理解，不再赘述。
S1003，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
S1004，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。
S1005，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信的密钥，或者说请求ProSe中继通信的密钥，包括：远端UE的SUCI、RSC、以及Nonce_1。可选地，中继密钥请求消息中还可以包括：中继UE的标识，如5G GUTI。
S1006，中继AMF网元验证中继UE。
具体的，中继AMF网元可根据来自UDM网元的中继UE的签约信息，判断中继UE是否授权作为中继提供服务。
其中，S1003-S1006的具体实现原理与上述S403-S406类似，可参考理解，不再赘述。
S1007，中继AMF网元向AUSF网元发送UE认证请求消息#1。相应的，AUSF网元接收来自中继AMF网元的UE认证请求消息#1。
S1008，AUSF网元向UDM网元发送UE认证获得请求消息。相应的，UDM网元接收来自AUSF网元的UE认证获得请求消息。
其中，S1007-S1008的具体实现原理与上述S807-S808类似，可参考理解，不再赘述。
S1009，UDM网元生成ProSe中继通信的认证向量。
UDM网元可根据UE认证获得请求消息，确定获取ProSe认证的数据。具体的，UDM网元，或者UDM网元可以调用SIDF，解析SIDF解析SUCI获取SUPI。UDM网元可以根据SUPI对应的签约用户数据和请求消息，确定ProSe中继通信的认 证机制，例如确定使用ProSe中继通信的EAP-AKA’。如此，UDM网元可以生成ProSe中继通信的认证向量，例如，EAP-AKA’的ProSe认证向量(EAP-AKA’ProSe AV)。EAP-AKA’的ProSe认证向量可以包括：RAND、AUTN、XRES、以及CK’和IK’。其中，RAND、AUTN以及XRES的具体实现原理可以参考上述S809中的相关介绍，不再赘述。CK’和IK’可由根密钥和RAND推演得到，用于推演ProSe密钥。例如，UDM网元/ARPF可以根密钥和RAND推演CK和IK，再根据CK和IK推演CK’和IK’。可以理解，采用CK’和IK’仅为一种示例，CK’和IK也可以替换其他任何可能的密钥，例如根据CK和IK，以及新的SN或新的参数，如PROSE字符推演KPROSE。
可选地，UDM网元确定ProSe中继通信的认证机制也可以为：如果UE认证获得请求消息中携带有ProSe中继通信指示信息#2，则UDM网元确定使用ProSe中继通信的EAP-AKA’。这种情况下，UDM网元无需查询签约用户数据，可提高认证效率。
可选地，在确定执行ProSe认证的基础上，UDM网元可以根据SUPI对应的签约用户数据，判断用户是否授权使用中继通信，具体实现原理也可以参考上述S809中的相关介绍，不再赘述。
需要指出的是，ProSe中继通信的EAP-AKA’仅为本申请实施例中的一种示例性命名方式，其也可以替换为其他任何可能的命名方式，例如5G ProSe中继通信的EAP-AKA’、或5G ProSe EAP-AKA’等，对此不做任何限定。同理，EAP-AKA’的ProSe认证向量也仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如EAP-AKA’ProSe认证向量、ProSe EAP-AKA’认证向量、或ProSe中继通信的EAP-AKA’认证向量等，对此不做任何限定。
S1010，UDM网元向AUSF网元发送UE认证获得响应消息。相应的，UDM网元接收来自AUSF网元的UE认证获得响应消息。
UE认证获得响应消息为上述UE认证获得请求消息的响应消息。UE认证获得响应消息中可以包括：EAP-AKA’的ProSe认证向量，可选地，还可以包括：SUPI。UE认证获得响应消息还可以指示：该EAP-AKA’的ProSe认证向量为支持ProSe中继通信的5G AKA认证向量。例如，在UE认证获得响应消息已有指示信息指示认证向量用于EAP-AKA’基础上，可在UE认证获得响应消息中新增指示信息，用以指示EAP-AKA’支持ProSe中继通信。或者，在UE认证获得响应消息中新增指示信息，用以指示认证向量用于EAP-AKA’，EAP-AKA’支持ProSe中继通信。
S1011，AUSF网元储存XRES。
AUSF网元接收到UE认证获得响应消息后，可储存XRES，可选地，还存储SUPI，以便后续认证使用。在ProSe认证中，AUSF网元可以不推演KSEAF，以防止生成冗余的信息，造成资源的浪费。
S1012，AUSF网元向中继AMF网元发送UE认证响应消息#1。相应的，中继AMF网元接收来自AUSF网元的UE认证响应消息#1。
UE认证响应消息#1为上述UE认证请求消息#1的响应消息。UE认证响应消息#1中可以包括：EAP请求消息/AKA’挑战消息。EAP请求消息/AKA’挑战消息可以 是根据UE认证获得响应消息#1确定的NAS消息，包括：RAND和AUTN。
S1013，中继AMF网元向中继UE发送ProSe通信认证请求消息。相应的，中继UE接收来自中继AMF网元的ProSe通信认证请求消息。
ProSe通信认证请求消息可用于指示用于对远端UE进行认证，或者说指示中继UE向远端UE发送认证数据，以避免中继UE接收到ProSe通信认证请求消息后自行执行认证，防止认证失败，无法建立通信连接。例如，ProSe通信认证请求消息可以通过其消息类型，或其携带的指示信息，指示中继UE向远端UE发送认证数据，或者说指式对远端UE进行认证。当然，也可通过已有消息(如认证请求消息)携带指示信息来指示中继UE向远端UE发送认证数据，此处不限制。ProSe通信认证请求消息中可以包括：EAP请求消息/AKA’挑战消息(认证数据)。也就是说，中继AMF网元接收到UE认证响应消息#1后，可将UE认证响应消息#1中的EAP请求消息/AKA’挑战消息，继续封装到ProSe通信认证请求消息中，从而向中继UE透传该EAP请求消息/AKA’挑战消息。
可选地，中继AMF网元向中继UE发送ProSe通信认证请求消息前，中继AMF跳过获取ngKSI和ABBA参数。或者，中继AMF网元跳过生成ngKSI和ABBA参数。中继AMF网元不向中继UE发送ngKSI和ABBA参数，也即ProSe通信认证请求消息不包含ngKSI和ABBA参数。
S1014，中继UE向远端UE发送远端UE认证请求消息。相应的，远端UE接收来自中继UE的远端UE认证请求消息。
远端UE认证请求消息可用于指示远端UE执行ProSe认证，或者说认证远端UE，确保远端UE与网络执行认证并推演ProSe密钥，建立远端UE和中继UE之间的安全通信。例如，ProSe通信认证请求消息可以通过其消息类型，或其携带的指示信息，指示远端UE执行ProSe认证，或者说认证远端UE。当然，也可通过已有消息携带指示信息来指示远端UE执行ProSe认证，此处不限制。ProSe通信认证请求消息中可以包括：EAP请求消息/AKA’挑战消息，以便远端UE执行ProSe认证使用。也就是说，中继UE接收到ProSe通信认证请求消息后，可将ProSe通信认证请求消息中的EAP请求消息/AKA’挑战消息，继续封装到远端UE认证请求消息中，以向远端UE透传该EAP请求消息/AKA’挑战消息，以便远端UE认证使用。
S1015，远端UE推演RES。
其中，远端UE可以包括：ME和USIM。UE接收到远端UE认证请求消息后，USIM可根据RAND和自身的根密钥，验证AUTN。如果USIM验证AUTN失败，则表示远端UE认证网络失败，流程结束。如果USIM验证AUTN通过，则表示远端UE认证网络通过。在此基础上，USIM可以利用根密钥和RAND，推演RES、以及CK和IK，并向ME发送RES、以及CK和IK。ME可以根据CK和IK推演CK’和IK’，然后执行S1016。
需要说明的是，如上述S1009和S1111中的相关介绍可知，若网络侧使用新的密钥推演方法或新的认证参数的推演方法，则远端UE也使用和网络侧相同的方法执行密钥推演或认证参数推演，以及其他认证数据的生成。
S1016，远端UE向中继UE发送远端UE认证响应消息。相应的，远端UE接收 来自中继UE的远端UE认证响应消息。
远端UE认证响应消息为上述远端UE认证请求消息的响应消息。可选地，ProSe通信认证响应消息可用于指示其为远端UE的认证响应消息。例如，ProSe通信认证响应消息可以通过消息的类型或消息中包含的信元，指示其为远端UE的认证响应消息。远端UE认证响应消息中可以包括：EAP响应消息/AKA’挑战消息。EAP响应消息/AKA’挑战消息中可以包括：RES。
S1017，中继UE向中继AMF网元发送ProSe通信认证响应消息。相应的，中继AMF网元接收来自中继UE的ProSe通信认证响应消息。
ProSe通信认证响应消息为上述ProSe通信认证请求消息的响应消息。可选地，ProSe通信认证响应消息用于指示其为远端UE的认证响应消息。例如，ProSe通信认证响应消息可以通过消息的类型或消息中包含的信元，指示其为远端UE的认证响应消息。ProSe通信认证响应消息中可以包括：EAP响应消息/AKA’挑战消息。也就是说，中继UE可以从远端UE认证响应消息中获得EAP响应消息/AKA’挑战消息，将其继续封装到ProSe通信认证响应消息中，以向AUSF网元透传该EAP响应消息/AKA’挑战消息。
S1018，中继AMF网元向AUSF网元发送UE认证请求消息#2。相应的，AUSF网元接收来自中继AMF网元的UE认证请求消息#2。
UE认证请求消息#2可用于请求对远端UE进行认证。例如，UE认证请求消息#2可以通过新的指示信息指示对远端UE进行认证。UE认证请求消息#2中可以包括：EAP响应消息/AKA’挑战消息。也就是说，中继AMF网元可以从ProSe通信认证响应消息中获得EAP响应消息/AKA’挑战消息，将其封装到UE认证请求消息#2中，以向AUSF网元透传该EAP响应消息/AKA’挑战消息。可选地，如果S1007中的UE认证请求消息#1未携带RSC和Nonce_1，则UE认证请求消息#2中还可以包括：RSC和Nonce_1，即中继AMF网元还可以将RSC和Nonce_1封装到UE认证请求消息#2中。或者，在S1007中的UE认证请求消息#1携带RSC和Nonce_1的情况下，UE认证请求消息#2中仍可以包括：RSC和Nonce_1。此时，RSC和Nonce_1也可以用于指示对远端UE进行认证。
S1019，AUSF网元认证远端UE。
AUSF网元接收到UE认证请求消息#2后，可从中获得EAP响应消息/AKA’挑战消息，并进一步获得RES。AUSF网元可以比较RES与先前保存的XRES。如果RES和XRES不匹配，例如RES和XRES不相同，则表示认证远端UE失败，流程结束。如果RES和XRES匹配，例如RES和XRES*相同，则表示认证远端UE通过。在此基础上，AUSF网元可以生成Nonce_2，根据先前保存的CK’、IK’、RSC、Nonce_1以及Nonce_2，推演ProSe密钥，用于远端UE与中继UE的通信使用。
具体的，AUSF网元可以根据CK’和IK’推演EMSK，根据EMSK确定KAUSF，例如确定EMSK的前256位作为KAUSF，且不推演KSEAF。AUSF网元可以根据KAUSF、RSC、Nonce_1以及Nonce_2，推演ProSe密钥。例如，AUSF网元可以先根据KAUSF和RSC推演一个中间密钥，再根据中间密钥、Nonce_1和Nonce_2推演ProSe密钥。或者，AUSF网元可以直接根据KAUSF、RSC、Nonce_1以及Nonce_2， 推演ProSe密钥。或者，AUSF网元还可以采用其他任何可能的方式推演ProSe密钥，对此不做具体限定。
可选地，在确定认证远端UE的情况下，AUSF网元执行上述ProSe密钥推演的过程。
S1020，AUSF网元向中继AMF网元发送UE认证响应消息#2。相应的，中继AMF网元接收来自AUSF网元的UE认证响应消息#2。
UE认证响应消息#2为UE认证请求消息#2的响应消息。UE认证响应消息#2中可以包括：EAP成功消息，用以指示认证通过，以及还可以包括：ProSe密钥和Nonce_2。也就是说，AUSF网元确定远端UE认证通过后，可生成EAP成功消息，并将EAP成功消息、ProSe密钥和Nonce_2封装到UE认证响应消息#2中，然后向中继AMF网元发送UE认证响应消息#2。
可选地，UE认证响应消息#2中还可以包括：远端UE的SUPI。该远端UE的SUPI可用于指示中继UE向网络侧上报执行远端UE的信息。
S1021，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
中继密钥响应消息为上述中继密钥请求消息的响应消息，可以包括：EAP成功消息、ProSe密钥和Nonce_2，可选地，还可以包括：远端UE的SUPI。也就是说，中继AMF网元接收到UE认证响应消息#2后，可根据UE认证响应消息#2，获得EAP成功消息、ProSe密钥和Nonce_2，可选地，还可以获得远端UE的SUPI，并将其封装到中继密钥响应消息中，以向中继UE发送中继密钥响应消息。相应的，中继UE可以存储ProSe密钥，可选地，还可以存储远端UE的SUPI。
S1022，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
直接安全模式命令消息可用于建立PC5安全。直接安全模式命令消息中可以包括：EAP成功消息和Nonce_2。也就是说，中继UE接收到中继密钥响应消息后，可从中获得EAP成功消息和Nonce_2，然后将其封装到直接安全模式命令消息中，从而向远端UE发送直接安全模式命令消息。
S1023，远端UE推演ProSe密钥。
远端UE可以使用与AUSF相同的方式推演ProSe密钥，即根据先前推演得到的CK’和IK’，以及RSC、Nonce_1和Nonce_2，推演ProSe密钥。
S1024，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
直接安全模式命令完成消息为上述直接安全模式命令消息的响应消息，用以指示远端UE已确定ProSe密钥。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。由于中继AMF网元、AUSF网元与UDM网元之间的交互可通过复用已有服务操作实现，在不引入新的服务操作的情况实现远端UE与网络之间的认证，以及生成中继UE和远端UE之间的安全通信的密钥。
需要指出的是，图10所示的流程中提到的消息#1、消息#2等等，仅用于命名上的区分，不作为任何限定。
场景4：
示例性的，图11为本申请实施例提供的通信方法的流程示意图四。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以是远端AUSF网元，如AUSF网元是根据远端UE的标识确定的，用于支持对远端UE的认证，或者也可以其他任何可能形态的AUSF网元，对此不做具体限定。UDM网元可以是远端UDM网元，如该UDM网元是根据远端UE的标识确定的，用于为远端UE生成认证向量，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景4中，UDM网元根据来自的AUSF网元的请求确定基于EAP AKA’建立安全的ProSe中继通信(也可以称为ProSe中继通信的EAP-AKA’流程，简称ProSe EAP-AKA’)或者新的EAP AKA。在ProSe中继通信的5G EAP-AKA’的认证流程中，AMF网元、AUSF网元与UDM网元之间可通过新的服务操作或服务名称进行交互。
具体的，如图11所示，该通信方法的流程如下：
S1101，远端UE注册到网络，从网络获取ProSe通信策略信息。
S1102，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，S1101-S1102的具体实现原理与上述S801-S802类似，可参考理解，不再赘述。
S1103，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
S1104，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。
S1105，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信，或者说请求ProSe中继通信的密钥，包括：远端UE的SUCI、RSC、以及Nonce_1。可选地，中继密钥请求消息中还可以包括：中继UE的标识，如5G GUTI。
S1106，中继AMF网元验证中继UE。
具体的，中继AMF网元可根据来自UDM网元的中继UE的签约信息，判断中继UE是否授权作为中继提供服务。
其中，S1103-S1106的具体实现原理与上述S403-S406类似，可参考理解，不再赘述。
S1107，中继AMF网元向AUSF网元发送ProSe UE认证请求消息#1。相应的，AUSF网元接收来自中继AMF网元的ProSe UE认证请求消息#1。
S1108，AUSF网元向UDM网元发送ProSe UE认证获得请求消息。相应的， UDM网元接收来自AUSF网元的ProSe UE认证获得请求消息。
其中，S1107-S1108的具体实现原理与上述S907-S908类似，可参考理解，不再赘述。
S1109，UDM网元生成ProSe中继通信的认证向量。
UDM网元可根据ProSe UE认证获得请求消息，确定执行ProSe认证。在此基础上，UDM网元，或者UDM网元可以调用SIDF，解析SIDF解析SUCI获取SUPI。UDM网元可以根据SUPI对应的签约用户数据，确定ProSe中继通信的认证机制，例如确定使用ProSe中继通信的EAP-AKA’。如此，UDM网元可以生成ProSe中继通信的认证向量，具体实现原理可以参考上述S1109中的相关介绍，不再赘述。
可选地，在确定执行ProSe认证的基础上，UDM网元可以根据SUPI对应的签约用户数据，判断用户是否授权使用中继通信，具体实现原理也可以参考上述S809中的相关介绍，不再赘述。
S1110，UDM网元向AUSF网元发送ProSe UE认证获得响应消息。相应的，UDM网元接收来自AUSF网元的ProSe UE认证获得响应消息。
ProSe UE认证获得响应消息为应上述ProSe UE认证获得请求消息的响应消息。ProSe UE认证获得响应消息中可以包括：EAP-AKA’的ProSe认证向量，可选地，还可以包括：SUPI。ProSe UE认证获得响应消息还可以指示：该EAP-AKA’的ProSe认证向量为支持ProSe中继通信的EAP-AKA’认证向量。例如，ProSe UE认证获得响应消息可以通过自身消息类型，指示认证向量用于EAP-AKA’，EAP-AKA’支持ProSe中继通信。或者，ProSe UE认证获得响应消息也可以通过携带的指示信息，指示认证向量用于EAP-AKA’，EAP-AKA’支持ProSe中继通信。
S1111，AUSF网元储存XRES。
AUSF网元接收到ProSe UE认证获得响应消息后，可储存XRES，可选地，还存储SUPI，以便后续认证使用。在ProSe认证中，AUSF网元可以不推演KSEAF，以防止生成冗余的信息，造成资源的浪费。
S1112，AUSF网元向中继AMF网元发送ProSe UE认证响应消息#1。相应的，中继AMF网元接收来自AUSF网元的ProSe UE认证响应消息#1。
ProSe UE认证响应消息#1为上述ProSe UE认证请求消息#1的响应消息。ProSe UE认证响应消息#1中可以包括：EAP请求消息/AKA’挑战消息。EAP请求消息/AKA’挑战消息可以是根据UE认证获得响应消息#1确定的NAS消息，包括：RAND和AUTN。
S1113，中继AMF网元向中继UE发送ProSe通信认证请求消息。相应的，中继UE接收来自中继AMF网元的ProSe通信认证请求消息。
S1114，中继UE向远端UE发送远端UE认证请求消息。相应的，远端UE接收来自中继UE的远端UE认证请求消息。
S1115，远端UE推演RES。
S1116，远端UE向中继UE发送远端UE认证响应消息。相应的，远端UE接收来自中继UE的远端UE认证响应消息。
S1117，中继UE向中继AMF网元发送ProSe通信认证响应消息。相应的，中继 AMF网元接收来自中继UE的ProSe通信认证响应消息。
其中，S1113-S1117的具体实现原理与S1013-S1017类似，可以参考理解，不再赘述。
S1118，中继AMF网元向AUSF网元发送ProSe UE认证请求消息#2。相应的，AUSF网元接收来自中继AMF网元的ProSe UE认证请求消息#2。
ProSe UE认证请求消息#2可用于请求对远端UE进行ProSe认证，包括：EAP响应消息/AKA’挑战消息。也就是说，中继AMF网元可以从ProSe通信认证响应消息中获得EAP响应消息/AKA’挑战消息，将其封装到ProSe UE认证请求消息#2中，以向AUSF网元透传该EAP响应消息/AKA’挑战消息。可选地，如果S1107中的ProSe UE认证请求消息#1未携带RSC和Nonce_1，则ProSe UE认证请求消息#2中还可以包括：RSC和Nonce_1，即中继AMF网元还可以将RSC和Nonce_1封装到ProSe UE认证请求消息#2中。或者，在S1107中的ProSe UE认证请求消息#1携带RSC和Nonce_1的情况下，ProSe UE认证请求消息#2中仍可以包括：RSC和Nonce_1。
S1119，AUSF网元认证远端UE。
其中，S1119的具体实现原理与S1019类似，可以参考理解，不再赘述。
S1120，AUSF网元向中继AMF网元发送ProSe UE认证响应消息#2。相应的，中继AMF网元接收来自AUSF网元的ProSe UE认证响应消息#2。
ProSe UE认证响应消息#2为ProSe UE认证请求消息#2的响应消息。ProSe UE认证响应消息#2中可以包括：EAP成功消息，用以指示认证通过，以及还可以包括：ProSe密钥和Nonce_2。也就是说，AUSF网元确定远端UE认证通过后，可生成EAP成功消息，并将EAP成功消息、ProSe密钥和Nonce_2封装到ProSe UE认证响应消息#2中，然后向中继AMF网元发送ProSe UE认证响应消息#2。
S1121，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
S1122，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
S1123，远端UE推演ProSe密钥。
S1124，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。由于中继AMF网元、AUSF网元与UDM网元之间的交互可通过新的信令实现，实现与已有认证流程解耦，避免认证流程对ProSe认证产生影响。
需要指出的是，图11所示的流程中提到的消息#1、消息#2等等，仅用于命名上的区分，不作为任何限定。
场景5：
示例性的，图12为本申请实施例提供的通信方法的流程示意图五。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通 信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以是中继AUSF网元，或者也可以其他任何可能形态的AUSF网元，对此不做具体限定。UDM网元可以是中继UDM网元，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景5中，远端UE或者中继AMF网元可以判断是否执行过ProSe认证。在执行过对远端UE认证的情况下，可使用中继AUSF网元上已有的密钥(如KAUSF)推演ProSe密钥，无需再次执行Prose认证。
具体的，如图12所示，该通信方法的流程如下：
S1201，远端UE注册到网络，从网络获取ProSe通信策略信息。
S1202，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，S1101-S1102的具体实现原理与上述S801-S802类似，可参考理解，不再赘述。
S1203，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
其中，S1102的具体实现原理与上述S403类似，可参考理解，不再赘述。
S1204，远端UE确定认证指示信息。
认证指示信息可以用于指示远端UE是否与网络执行过主认证流程，或者用于确定是否执行ProSe认证。例如，认证指示信息包括：1比特(bit)。这1比特的取值为1，表示远端UE执行过主认证流程，或确定无需执行ProSe认证，或确定使用现有的KAUSF。这1比特的取值为0，表示远端UE未执行过主认证，或确定执行ProSe认证。或者，这1比特的取值为1，表示远端UE未执行主认证，或确定执行ProSe认证流程。这1比特的取值为0，表示远端UE执行过主认证，或确定无需执行ProSe认证，或确定使用现有的KAUSF。
其中，远端UE通过中继发现流程发现中继UE后，可判断本地是否储存有上述用于推演ProSe密钥的密钥，例如KAUSF。如果储存有上述KAUSF，则表示远端UE执行过ProSe认证，生成对应取值的认证指示信息。否则，如果未储存上述KAUSF，则表示远端UE未执行ProSe认证，生成对应取值的认证指示信息。
可选地，用于推演ProSe密钥的密钥为KAUSF仅为一种示例，KAUSF可替换为其他的密钥，例如上述KPROSE。或者，用于推演ProSe密钥的密钥也可以分别存储在远端UE和网络中。例如，在远端UE与网络执行ProSe认证之后，该密钥便可以分别存储在远端UE和网络中。此处不限制。
S1204为可选步骤，即远端UE通过认证指示信息直接指示其是否执行过认证，其仅为一种示例性的方式。例如，可选地，远端UE也可通过是否生成指示认证指示信息，来对应指示其是否执行过认证。这种情况下，后续的设备可通过信令中是否携带认证指示信息，来判断远端UE是否执行过认证。如果信令中携带有认证指示信息，则用以显示指示远端UE执行过认证。如果信令中未携带认证指示信息，则用以隐式指示远端UE未执行认证。或者，如果信令中携带有认证指示信息，则用以显示指示远端UE未执行认证。如果信令中未携带认证指示信息，则用以隐式指示远端UE执行过认证。又例如，可选地，远端UE可以不指示其是否执行过ProSe认证， 由中继AMF网元自行确定。
需要指出的是，通过认证指示信息这一命名来指示其是否执行过认证仅为一种示例，其也可以替换为其他任何可能的命名，例如指示信息、或ProSe指示信息等等，对此不做任何限定。
S1205，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。可选地，直接通信请求消息中还可以包括：认证指示信息。
S1206，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信，或者说请求ProSe中继通信的密钥，包括：远端UE的SUCI、RSC、以及Nonce_1。可选地，中继密钥请求消息中还可以包括中继UE的标识，如5G GUTI。远端UE的SUCI、RSC以及Nonce_1可以参考上述S405中的相关介绍，不再赘述。可选地，在直接通信请求消息中携带有认证指示信息的情况下，中继密钥请求消息中还可以包括：认证指示信息。也就是说，中继UE接收到直接通信请求消息，并从中获得认证指示信息后，可将认证指示信息继续封装到中继密钥请求消息中，然后向中继AMF网元发送中继密钥请求消息。
S1207，中继AMF网元验证中继UE。
其中，S1207的具体实现原理与上述S406类似，可参考理解，不再赘述。
S1208，中继AMF网元确定是否发起ProSe认证。
中继AMF网元可以根据中继密钥请求消息中的认证指示信息，或者根据中继密钥请求消息中是否有携带认证指示信息，确定是否发起ProSe认证。这种情况下，如果中继AMF网元确定不发起ProSe认证，则从UDM网元获得AUSF网元的标识，以从AUSF网元获得ProSe密钥，也即S1209-S1216。否则，如果中继AMF网元确定发起ProSe认证，则执行ProSe认证，也即S1217。
可以理解，S1208为可选步骤，在远端UE未指示其是否执行过认证的情况下，中继AMF网元可跳过S1208执行S1209，以根据是否能够从UDM网元获得AUSF网元的标识，确定远端UE是否执行过认证或网络有可用的密钥(如KAUSF)，也即确定是否发起ProSe通信认证。如果中继AMF网元确定不发起ProSe认证，则执行S1211-S1216。否则，如果中继AMF网元确定发起ProSe认证，则执行S1217。
S1209，中继AMF网元向UDM网元发送AUSF获得请求(Nudm_AUSFIdGet Request)消息。相应的，UDM网元接收来自中继AMF网元的AUSF获得请求消息。
其中，AUSF获得请求消息用于请求UDM网元反馈AUSF网元的标识，例如AUSF网元的ID(instance Id)，或AUSF网元的IP地址(如IPv4地址、IPv6地址或前缀)。AUSF获得请求消息中可以包括：远端UE的SUCI。如此，UDM网元可以从中获得远端UE的SUCI，以根据该SUCI查找AUSF网元的标识。例如，UDM 网元，或者UDM网元可以调用SIDF解析该SUCI获得SUPI，从而根据SUPI获取存储在UDM网元中的远端UE的上下文，以判断是否能够从上下文中获取AUSF网元的标识。
可选的，UDM网元也可以根据SUPI对应的签约用户数据，判断用户是否授权使用中继通信，具体实现原理也可以参考上述S809中的相关介绍，不再赘述。
需要指出的是，AUSF获得请求消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如AUSF标识获得请求消息、或AUSF地址获得请求消息等等，对此不做任何限定。
S1210，UDM网元向中继AMF网元发送AUSF获得响应(Nudm_AUSFIdGet Response)消息。相应的，UDM网元接收来自中继AMF网元的AUSF获得响应消息。
AUSF获得响应消息为上述AUSF获得请求消息的响应消息。AUSF获得响应消息中可以包括：AUSF网元的标识，可选地，还可以包括：SUPI。
其中，如果远端UE执行过认证，或者说远端UE本地存储了KAUSF，那么远端UE的上下文中应当储存有当初认证远端UE的AUSF网元的标识。这种情况下，UDM网元能够从远端UE的上下文中获取AUSF网元的标识，并将其封装到AUSF获得响应消息中，然后向中继AMF网元发送该AUSF获得响应消息。否则，如果远端UE未执行ProSe认证，那么远端UE的上下文中没有AUSF网元的标识。这种情况下，UDM网元无法从远端UE的上下文中获取AUSF网元的标识，而直接向中继AMF网元发送AUSF获得响应消息。
可以理解，在远端UE指示其执行过主认证的情况下，通过执行S1209-S1210，中继AMF网元应当能够获得AUSF网元的标识。
需要指出的是，AUSF获得响应消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如AUSF标识获得响应消息、或AUSF地址获得响应消息等等，对此不做任何限定。
S1211，中继AMF网元向AUSF网元发送ProSe密钥请求(Nausf_ProSe_Key Request)消息。相应的，AUSF网元接收来自中继AMF网元的ProSe密钥请求消息。
中继AMF网元可以根据AUSF网元的标识，向AUSF网元发送ProSe密钥请求消息。ProSe密钥请求消息主要用于请求ProSe密钥，包括：SUPI、RSC以及Nonce_1。AUSF网元接收到ProSe密钥请求消息后，可从中获得RSC以及Nonce_1。这样，AUSF网元可以根据先前认证远端UE时确定KAUSF、本次生成的Nonce_2、以及RSC和Nonce_1，推演ProSe密钥。其中，推演ProSe密钥的具体实现原理可以参考上述S820中的相关介绍，不再赘述。
需要指出的是，ProSe密钥请求消息仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如ProSe通信密钥请求消息，对此不做任何限定。
S1212，AUSF网元向中继AMF网元发送ProSe密钥响应(Nausf_ProSe_Key Response)消息。相应的，中继AMF网元接收来自AUSF网元的ProSe密钥响应消 息。
ProSe密钥响应消息为上述ProSe密钥请求消息的响应消息，包括：ProSe密钥和Nonce_2。此外，ProSe密钥响应消息也仅为本申请实施例中的一种示例性的命名方式，其也可以替换为其他任何可能的命名方式，例如ProSe通信密钥响应消息，对此不做任何限定。
S1213，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
S1214，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
S1215，远端UE推演ProSe密钥。
S1216，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
其中，S1213-S1216的具体实现原理与S822-S825类似，可参考理解，不再赘述。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。此外，在远端UE执行过ProSe认证的情况，AUSF网元无需认证即可推演ProSe密钥，以有效提高设备运行效率。
S1217，ProSe认证。
通过执行ProSe认证可建立中继UE和远端UE的安全通信。
其中，S1217可以为场景1中的S807-S822、或者场景2中的S907-S922、或者场景3中的S1007-S1021、或者场景4中的S1107-S1121，具体实现原理与场景1-场景4类似，可参考理解，不再赘述。
场景6：
示例性的，图13为本申请实施例提供的通信方法的流程示意图六。该通信方法主要适用于远端UE、中继UE、AMF网元、AUSF网元、以及UDM网元之间的通信。AMF网元可以包括：中继AMF网元和远端AMF网元，二者可以是同一或不同的AMF网元，对此不做具体限定。AUSF网元可以包括：中继AUSF网元和远端AUSF网元，二者可以是不同的AUSF网元。UDM网元可以是远端UDM网元，或者也可以其他任何可能形态的UDM网元，对此不做具体限定。在场景6中，UDM网元可以判断远端UE是否执行过认证。在执行过认证的情况下，可直接推演ProSe密钥，无需再次认证。
具体的，如图13所示，该通信方法的流程如下：
S1301，远端UE注册到网络，从网络获取ProSe通信策略信息。
S1302，中继UE注册到网络，从网络获取ProSe通信策略信息。
其中，S1301-S1302的具体实现原理与上述S801-S802类似，可参考理解，不再赘述。
S1303，远端UE执行中继发现流程。
远端UE若要采用ProSe中继通信，可通过执行中继发现流程来发现中继UE。
S1304，远端UE向中继UE发送直接通信请求消息。相应的，中继UE接收来自远端UE的直接通信请求消息。
直接通信请求消息可用于远端UE请求与中继UE通信，包括：远端UE的SUCI、RSC、以及Nonce_1。
S1305，中继UE向中继AMF网元发送中继密钥请求消息。相应的，中继AMF网元接收来自中继UE的中继密钥请求消息。
中继密钥请求消息主要用于中继UE请求中继通信，或者说请求ProSe中继通信的密钥，包括：中继UE的SUCI、远端UE的SUCI、RSC、以及Nonce_1。
S1306，中继AMF网元验证中继UE。
其中，S1303-S1306的具体实现原理与上述S403-S406类似，可参考理解，不再赘述。
S1307，中继AMF网元向中继AUSF网元UE认证请求消息/发送ProSe UE认证请求消息。相应的，中继AUSF网元接收来自中继AMF网元的UE认证请求消息#1/ProSe UE认证请求消息#1。
其中，UE认证请求消息的具体实现原理可以参考上述S807中的相关介绍，ProSe UE认证请求消息的具体实现原理可以参考上述S1007中的相关介绍，不再赘述。
S1308，中继AUSF网元向UDM网元发送UE认证获得请求消息/ProSe UE认证获得请求消息。相应的，UDM网元接收来自中继AUSF网元的UE认证获得请求消息/ProSe UE认证获得请求消息。
其中，UE认证获得请求消息的具体实现原理可以参考上述S808中的相关介绍，ProSe UE认证获得请求消息的具体实现原理可以参考上述S1008中的相关介绍，不再赘述。
S1309，UDM网元确定远端UE是否执行过认证，或确定是否有服务的AUSF实例。
UDM网元接收到UE认证获得请求消息/ProSe UE认证获得请求消息，可从中获得远端UE的SUCI，以根据该SUCI查找远端AUSF网元的标识。例如，UDM网元，或者UDM网元可以调用SIDF解析该SUCI获得SUPI，从而根据SUPI获取存储在UDM网元中的远端UE的上下文，以判断是否能够从上下文中获取远端AUSF网元的标识。这种情况下，如果UDM网元能够获取远端AUSF网元的标识，则表示远端UE执行过认证，有服务的AUSF实例，可直接从该远端AUSF网元获得ProSe密钥，即S1310-S1317，无需再次认证。否则，如果UDM网元无法获取远端AUSF网元的标识，则表示远端UE未执行主认证，没有服务的AUSF实例，需要执行ProSe认证，即S1318。
S1310，UDM网元向远端AUSF网元发送ProSe密钥请求消息。相应的，远端AUSF网元接收来自UDM网元的ProSe密钥请求消息。
UDM网元可以根据远端AUSF网元的标识，向远端AUSF网元发送ProSe密钥请求消息。ProSe密钥请求消息主要用于请求ProSe密钥，包括：SUPI、RSC以及Nonce_1。远端AUSF网元接收到ProSe密钥请求消息后，可从中获得RSC以及 Nonce_1。这样，远端AUSF网元可以根据先前认证远端UE时确定KAUSF、本次生成的Nonce_2、以及RSC和Nonce_1，推演ProSe密钥。其中，推演ProSe密钥的具体实现原理可以参考上述S820中的相关介绍，不再赘述。
S1311，远端AUSF网元向UDM网元发送ProSe密钥响应消息。相应的，UDM网元接收来自远端AUSF网元的ProSe密钥响应消息。
ProSe密钥响应消息为上述ProSe密钥请求消息的响应消息，可以包括：ProSe密钥和Nonce_2。
S1312，UDM网元向中继AUSF网元发送UE认证获得响应消息/ProSe UE认证获得响应消息。相应的，中继A USF网元接收来自UDM网元的UE认证获得响应消息/ProSe UE认证获得响应消息。
UE认证获得响应消息/ProSe UE认证获得响应消息中可以包括：ProSe密钥和Nonce_2。UE认证获得响应消息的具体实现原理也可以参考上述S810中的相关介绍，ProSe UE认证获得响应消息的具体实现原理也可以参考上述S1010中的相关介绍，不再赘述。
S1313，中继AUSF网元向中继AMF网元发送UE认证响应消息/ProSe UE认证响应消息。相应的，中继AMF网元接收来自中继AUSF网元的UE认证响应消息/ProSe UE认证响应消息。
UE认证响应消息/ProSe UE认证响应消息中可以包括：ProSe密钥和Nonce_2。UE认证响应消息的具体实现原理也可以参考上述S812中的相关介绍，ProSe UE认证响应消息的具体实现原理也可以参考上述S1012中的相关介绍，不再赘述。
S1314，中继AMF网元向中继UE发送中继密钥响应消息。相应的，中继UE接收来自中继AMF网元的中继密钥响应消息。
S1315，中继UE向远端UE发送直接安全模式命令消息。相应的，远端UE接收来自中继UE的直接安全模式命令消息。
S1316，远端UE推演ProSe密钥。
S1317，远端UE向中继UE发送直接安全模式命令完成消息。相应的，中继UE接收来自远端UE的直接安全模式命令完成消息。
其中，S1314-S1317的具体实现原理与S822-S825类似，可参考理解，不再赘述。
至此，远端UE和中继UE都获得了相同的ProSe密钥，可以基于ProSe密钥推演PC5连接的会话密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全。此外，在远端UE执行过ProSe认证的情况，远端AUSF网元无需认证即可推演ProSe密钥，以有效提高设备运行效率。
S1318，ProSe认证。
通过执行ProSe认证可建立中继UE和远端UE的安全通信。
其中，S1318可以为场景1中的S809-S822、或者场景2中的S909-S922、或者场景3中的S1009-S1021、或者场景4中的S1109-S1121，具体实现原理与场景1-场景4类似，可参考理解，不再赘述。
以上结合场景1-场景6介绍了本申请实施例提供的通信方法在各个场景下的具体 流程。下面结合图14介绍本申请实施例提供的通信方法在各个场景下的整体流程。
示例性的，图14为本申请实施例提供的通信方法的流程示意图七。该通信方法可以适用于远端终端、中继终端、接入和移动管理网元、认证服务网元、以及数据管理网元之间的通信。其中，远端终端可以是上述场景1-场景6中的远端UE。中继终端可以是上述场景1-场景6中的中继UE。接入和移动管理网元可以是上述场景1-场景6中的中继AMF网元。认证服务网元可以是上述场景1-场景6中的AUSF网元。数据管理网元可以是上述场景1-场景6中的UDM网元。
如图14所示，该通信方法的流程如下：
S1401，接入和移动管理网元向认证服务网元发送认证请求消息#3。相应的，认证服务网元接收来自接入和移动管理网元的认证请求消息#3。
认证请求消息#3可用于请求认证远端终端。比如，请求认证服务网元认证远端终端，用以触发认证服务网元执行ProSe通信的认证流程，确保认证的正确性和可靠性。认证请求消息#3包括：远端终端的SUCI，还可以包括如下至少一项：服务网络名称、RSC、随机值#1(例如上述Nonce_1)或ProSe中继通信指示信息(例如上述ProSe中继通信指示信息#1)。其中，服务网络名称、RSC或ProSe中继通信指示信息中的任一项可用于指示认证为ProSe中继通信的认证，以触发认证服务网元执行ProSe通信的认证流程，确保认证的准确性和可靠性，避免对现有流程的影响。服务网络名称、RSC、或随机值#1中的任一项可用于确定ProSe密钥，以便AUSF网元在确定认证通过的情况下，可以直接根据这些参数推演ProSe密钥，无需额外获取，以提高密钥推演效率。认证请求消息#3具体可以为上述UE认证请求消息#1，或者ProSe UE认证请求消息#1，具体实现原理可以参考上述S807、S907、S1007、或S1107中的相关介绍，不再赘述。
可选地，若认证请求消息#3中包括：RSC和随机值#1，则认证服务网元还可以保存RSC和随机值#1，以便后续密钥推演时可直接使用，无需再次获取，以进一步提高密钥推演效率。
S1402，认证服务网元向数据管理网元发送认证请求消息#1。相应的，数据管理网元接收来自认证服务网元的认证请求消息#1。
认证请求消息#1可以用于请求认证远端终端。例如，认证请求消息#1包括如下至少一项：远端终端的SUCI、服务网络名称、RSC或ProSe中继通信指示信息，例如ProSe中继通信指示信息为上述ProSe中继通信指示信息#2，ProSe中继通信指示信息用于指示认证为ProSe中继通信的认证。如此，认证请求消息#1触发数据管理网元获取ProSe中继通信对应的认证向量，确保ProSe中继通信认证的正确性和可靠性。认证请求消息#1可以为上述UE认证获得请求消息，或者ProSe UE认证获得请求消息，具体实现原理可以参考上述S808、S908、S1008、或S1108中的相关介绍，不再赘述。
可选地，认证服务网元向数据管理网元发送认证请求消息#1还可以包括：认证服务网元根据来自移动与接入管理网元的认证请求消息#3生成认证请求消息#1，然后向数据管理网元发送认证请求消息#1。
S1403，数据管理网元向认证服务网元发送认证响应消息#1。相应的，认证服务 网元接收来自数据管理网元的认证响应消息#1。
认证响应消息#1可以为上述UE认证获得响应消息，或者ProSe UE认证获得响应消息。认证响应消息#1包括：ProSe认证信息#1。ProSe认证信息#1可以包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。
具体的，ProSe认证信息#1可以为如下至少一项：AKA的ProSe认证向量#1(例如5G AKA的ProSe认证向量#1)、或EAP-AKA’的ProSe的认证向量。也就是说，远端UE与网络之间的认证可以基于对已有认证方法，例如5G AKA或EAP-AKA’增强实现，以实现在不引入新的认证方法的情况下，确保ProSe中继通信安全。
在ProSe认证信息#1为AKA的ProSe认证向量#1的情况下，其可以包括如下至少一项：用于远端终端认证网络的信息，例如上述RAND和AUTN、用于认证服务网元认证远端终端的信息，例如上述XRES*、或用于确定ProSe密钥的信息，例如上述KAUSF。
或者，在ProSe认证信息#1为EAP-AKA’的ProSe的认证向量的情况下，其可以包括如下至少一项：用于远端终端认证网络的信息，例如上述RAND和AUTN、用于认证服务网元认证远端终端的信息，例如上述XRES、或用于确定ProSe密钥的信息，例如上述CK和IK。
可选地，认证响应消息#1还可以包括：指示信息，用于指示ProSe认证信息#1为认证方法对应的认证信息，如指示认证信息为EAP-AKA’机制的认证信息或5G AKA机制的认证信息。可选地，该指示信息还用于指示认证信息为用于ProSe通信的认证信息，或者说支持ProSe通信的认证。也就是说，该指示信息可以用于指示认证信息为支持的ProSe中继通信的EAP-AKA’或5G AKA的认证信息，也即增强的EAP-AKA’或AKA的认证信息。其中，增强的EAP-AKA’机制或5G AKA机制可以理解为：在认证流程中，有任一参与认证的网元使用新的认证向量生成方法确定认证向量、使用新的消息、使用新的服务操作、或者新增信元，则可认为是增强的EAP-AKA’机制或5G AKA机制。
可选地，在S1403之前，数据管理网元还可以确定远端终端授权获取中继服务。也就是说，在确定远端终端有使用中继通信的权限的基础上，才对其进行ProSe中继通信认证，避免无效认证。以及，在S1403之前，数据管理网元可以根据认证请求消息#1，确定ProSe认证信息#1。
可选地，在S1403之前，若触发ProSe中继通信的认证，或者说认证远端终端的流程，则数据管理网元可以选择支持的ProSe中继通信的EAP-AKA’机制或5G AKA机制，也即增强的EAP-AKA’机制或AKA机制。数据管理网元也可以选择已有的EAP-AKA’机制或5G AKA机制，保证针对ProSe中继通信场景，相关网元仅需要支持一种流程的增强逻辑即可实现，降低复杂度。其中，数据管理网元选择的已有的EAP-AKA’机制或5G AKA机制可以理解为：数据管理网元使用已有的方法推演认证向量和使用已有的服务操作等。
此外，S1403的具体实现原理可以参考上述S809-S810、S909-S910、S1009-S1010、或S1109-S1110中的相关介绍，不再赘述。
S1404，认证服务网元向接入和移动管理网元发送认证响应消息#3。相应的，接入和移动管理网元接收来自认证服务网元的认证响应消息#3。
认证响应消息#3可以为上述UE认证响应消息#1，或者ProSe UE认证响应消息#1。认证响应消息#3包括：ProSe认证信息#2。ProSe认证信息#2包括：用于远端终端认证网络的信息。可选地，ProSe认证信息#2还可以包括：用于网络认证远端终端的信息。也就是说，ProSe中继通信的认证可以由接入和移动管理网元触发，例如在业务有需求的情况下触发，以便认证服务网元可以有针对性地执行认证，确保认证的有效性。
具体的，ProSe认证信息#2可根据ProSe认证信息#1确定。ProSe认证信息#2可以为如下至少一项：AKA的ProSe认证向量#2(例如5G AKA的ProSe认证向量#2)、或EAP请求消息或AKA’挑战消息。例如，如果采用已有的AKA认证机制，则AKA的ProSe认证向量#2可根据AKA的ProSe认证向量#1确定，无需引入新的功能，从而降低网元复杂度。如果采用增强的EAP-AKA’认证机制，则EAP请求消息或AKA’挑战消息可根据EAP-AKA’的ProSe的认证向量确定，无需引入新的功能，从而降低网元复杂度。
在ProSe认证信息#2为AKA的ProSe认证向量#2的情况下，其可包括如下至少一项：用于远端终端认证网络的信息，例如RAND和AUTN、或用于接入和移动管理网元认证远端终端的信息，例如上述HXRES*。如此，AKA的ProSe认证向量#2不仅可用于远端终端认证网络，还可用于接入和移动管理网元从服务网的角度认证远端终端，从而可以提高认证的全面性，进一步确保ProSe中继通信安全。
或者，在ProSe认证信息#2为EAP请求消息或AKA’挑战消息的情况下，其可包括：用于远端终端认证网络的信息，例如RAND和AUTN。也就是说，认证服务网元将ProSe认证信息#1中用于远端终端认证网络的信息，封装到EAP请求消息或AKA’挑战消息中，可实现将该消息作为容器向接入和移动管理网元发送，以便接入和移动管理网元直接透传该消息，以提高处理效率，降低开销。
可选地，认证服务网元跳过推演用于远端终端与网络之间通信的密钥，例如KSEAF，以防止生成冗余的信息，造成资源的浪费或对现有机制的影响。例如，认证服务网元可以根据本地存储的信息(如RSC或Nonce_1)或接收到的认证响应消息#1，确定跳过推演用于远端终端与网络通信的密钥。
此外，S1404的具体实现原理可以参考上述S811-S812、S911-S912、S1011-S1012、或S1111-S1112中的相关介绍，不再赘述。
S1405，接入和移动管理网元向中继终端发送用于远端终端认证网络的信息。相应的，中继终端接收来自接入和移动管理网元的用于远端终端认证网络的信息。
用于远端终端认证网络的信息可以包括：RAND和AUTN的EAP请求消息/AKA’挑战消息，或者直接包括：RAND和AUTN，或者包括：容器，该容器中包括：RAND和AUTN。用于远端终端认证网络的信息可以承载在消息中。例如，ProSe通信认证请求消息，或者其他任何可能的消息中，对此不做具体限定。该消息的名称或携带的指示信息，可用于指示需要由远端终端执行ProSe中继通信的认证流程。如此，中继终端可以根据该消息，向远端终端发送用于远端终端认证网络的信 息，避免中继终端执行其他操作，例如自行认证，确保ProSe中继通信认证的可靠性。此外，该消息为通过通信密钥保护的消息，也即该用于远端终端认证网络的信息为通过通信密钥保护的信息。该通信密钥用于中继终端与网络的通信，以确保中继终端与网络之间的通信安全。
可选地，接入和移动管理网元向中继终端发送远端终端认证网络的信息前，接入和移动管理网元跳过获取ngKSI和ABBA参数，或者接入和移动管理网元跳过生成密钥集标识和反降级参数。接入和移动管理网元不向中继终端发送ngKSI和ABBA参数。
此外，S1405的具体实现原理可以参考上述S813、S913、S1013、或S1113中的相关介绍，不再赘述。
S1406，中继终端向远端终端发送用于远端终端认证网络的信息。相应的，远端终端接收来自中继终端的用于远端终端认证网络的信息。
用于远端终端认证网络的信息可以包括：携带有RAND和AUTN的EAP请求消息/AKA’挑战消息，或者直接包括：RAND和AUTN，或者包括：容器，该容器中包括：RAND和AUTN。用于远端终端认证网络的信息可以承载在消息中，例如远端终端认证请求消息，或者其他任何可能的消息中，对此不做具体限定。可选地，该消息的名称或携带的指示信息，可以指示需要由远端终端执行ProSe中继通信的认证流程或指示请求认证远端UE。如此，中继终端向远端终端发送用于远端终端认证网络的信息，可以包括：中继终端根据消息，向远端终端发送用于远端终端认证网络的信息，以确保ProSe中继通信认证的可靠性。例如，中继终端根据该消息的名称或消息中包含的指示信息，向远端终端发送用于远端终端认证网络的信息。此外，该消息可以为上述远端UE认证请求消息，具体实现原理可以参考上述S814、S914、S1014、或S1114中的相关介绍，不再赘述。
S1407，远端终端向中继终端发送远端终端确定的认证响应信息。相应的，中继终端接收来自远端终端的认证响应信息。
远端终端确定的认证响应信息用于认证远端终端，例如上述RES或RES*。也就是说，中继终端可以主动与远端终端交互，以确保远端终端能够认证网络，并向网络反馈自身的认证响应消息，确保网络也能够认证远端终端。该远端终端确定的认证响应信息可以承载在远端终端认证响应消息，或者其他任何可能的消息中，对此不做具体限定。远端终端认证响应消息可以为上述远端UE认证响应消息，具体实现原理可以参考上述S815-S816、S915-S916、S1015-S1016、或S1115-S1116中的相关介绍，不再赘述。
可选地，远端终端跳过推演用于远端终端与网络之间通信的密钥，例如KSEAF。
S1408，中继终端向接入和移动管理网元发送远端终端确定的认证响应信息。相应的，接入和移动管理网元接收来自中继终端的远端终端确定的认证响应信息。
远端终端确定的认证响应信息用于认证远端终端，例如上述RES或RES*。该远端终端确定的认证响应信息可以承载在ProSe通信认证响应消息，或者其他任何可能的消息中，对此不做具体限定。ProSe通信认证响应消息为通过通信密钥保护的消息，也即该远端终端确定的认证响应信息为通过通信密钥保护的信息，以确保中继终 端与网络之间的通信安全。例如，通信密钥为中继终端与接入和移动管理网元之间建立的非接入层安全密钥，该非接入层安全密钥可以包含加密密钥和完整性保护密钥。此外，S1408的具体实现原理可以参考上述S817、S917、S1017、或S1117中的相关介绍，不再赘述。
S1409，接入和移动管理网元向认证服务网元发送认证请求消息#2。相应的，认证服务网元接收来自接入和移动管理网元的认证请求消息#2。
认证请求消息#2用于请求认证远端终端。认证请求消息#2可以包括如下至少一项：远端终端确定的认证响应信息、用于确定ProSe密钥的RSC、或用于确定ProSe密钥的随机值#1，认证响应消息用于认证远端终端。也就是说，接入和移动管理网元可以在确定远端终端认证通过的情况下，才向认证服务网元发送用于推演ProSe密钥的参数，例如RSC和/或随机值#1，从而实现按需提供必要的参数，无需预存信息，防止资源浪费。认证请求消息#2可以为上述UE认证请求消息#2，或者ProSe UE认证请求消息#2，具体实现原理可以参考上述S819、S919、S1018、或S1118中的相关介绍，不再赘述。
可选地，在S1409之前，认证服务网元还可以保存RSC和随机值#1，以便后续密钥推演时可直接使用，无需再次获取，以进一步提高密钥推演效率。例如，用于确定ProSe密钥的信息包括中间密钥，例如KAUSF，或者CK’和IK’，或者KPROSE。在认证远端终端通过的情况下，认证服务网元根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密钥，确定ProSe密钥。也就是说，认证服务网元可以根据业务场景以及密钥隔离等需求，选择合适的参数来确定ProSe密钥，以适应更多业务场景。例如，根据RSC、随机值#1、随机值#2和中间密钥确定ProSe密钥。例如，根据服务网络名称、随机值#1、随机值#2和中间密钥确定ProSe密钥。例如，根据中间密钥、RSC和远端终端的SUPI推演临近业务中间密钥，再根据临近业务中间密钥、随机值#1和随机值#2确定ProSe密钥，或者还可以通过其他组合方式确定ProSe密钥，这里不一一列举。
S1410，认证服务网元向接入和移动管理网元发送认证响应消息#2。相应的，接入和移动管理网元接收来自认证服务网元的发送认证响应消息#2。
认证响应消息#2中包括：ProSe密钥。该ProSe密钥用于中继终端与远端终端的通信。可选地，认证响应消息#2中还可以包括：随机值#2。随机值#2用于确定ProSe密钥，以便远端终端在确定认证通过的情况下，可以直接根据随机值#2推演ProSe密钥，保证为远端UE的不同ProSe通信推演不同的密钥，实现密钥的隔离。认证请求消息#2可以为上述UE认证响应消息#2，或者ProSe UE认证响应消息#2，具体实现原理可以参考上述S820-S821、S920-S921、S1019-S1020、或S1119-S1120中的相关介绍，不再赘述。
可选地，认证响应消息#2中还可以包括如下至少一项：远端终端的用户隐藏标识SUPI、或EAP成功消息。EAP成功消息可以用于指示网络认证远端终端成功。该远端终端的SUPI用于指示中继终端需要向网络上报远端UE的信息。
S1411，接入和移动管理网元向中继终端发送ProSe密钥。相应的，中继终端接收来自接入和移动管理网元的ProSe密钥。
可选地，接入和移动管理网元还可以向中继终端发送远端终端的SUPI，用以指示中继终端需要向网络上报远端UE的信息。
可选地，接入和移动管理网元还可以向中继终端发送EAP成功消息，用以指示网络认证远端终端成功。
其中，S1411的具体实现原理可以参考上述S822、S922、S1021、或S1121中的相关介绍，不再赘述。
之后，可选地，远端终端和中继终端可以基于ProSe密钥推演PC5连接的通信保护密钥，例如，远端终端和中继终端可以基于ProSe密钥推演一个会话密钥，然后远端终端和中继终端基于会话密钥进一步推演通信保护密钥(如加密密钥和完整性保护密钥)，本申请不限制。
可选地，第一种可能的应用场景，如果为AKA的ProSe认证，则在S1408之后，以及在S1409之前，接入和移动管理网元可以根据远端终端确定的认证响应消息(上述基于RES*推演的XRES*)，以及用于接入和移动管理网元认证远端终端的信息(上述HXRES*)，确定远端终端认证通过。即实现接入和移动管理网元从服务网的角度认证远端终端，从而可以提高认证的全面性，进一步确保ProSe中继通信安全。第一种可能的应用场景的具体实现原理，也可以参考上述S818或S918中的相关介绍，不再赘述。
可选地，第二可能的应用场景，在S1410之后，接入和移动管理网元可以向中继终端发送随机值#2。相应的，中继终端可以接收来自接入和移动管理网元的随机值#2。如此，中继终端可以向远端终端发送随机值#2，以便远端终端接收来自中继终端的随机值#2，以根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密钥，确定ProSe密钥。可以看出，接入和移动管理网元可以在网络认证远端终端通过后，才向远端终端发送用于推演ProSe密钥的参数，也即随机值#2，避免这些参数在认证通过前提前暴露，确保认证通过前的通信安全。此外，第二可能的应用场景的具体实现原理，也可以参考上述S822-S825、S922-S925、S1021-S1023、或1121-S1124中的相关介绍，不再赘述。
可选地，第三可能的应用场景，在S1401之前，接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥(如KAUSF)。换言之，只有在远端终端没有执行过认证的情况下或不存在用于推演ProSe密钥的密钥，才执行ProSe中继通信的认证流程，避免因重复执行认证流程而导致资源浪费。当然，在对远端终端执行过认证的情况下，可使用认证服务网元上已有的密钥(如KAUSF)推演ProSe密钥，无需再次执行ProSe中继通信认证。
具体的，接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥，可以包括：接入和移动管理网元接收来自中继终端的远端终端指示信息，远端终端指示信息用于指示远端终端未执行认证或不存在用于推演ProSe密钥的密钥。接入和移动管理网元根据远端终端指示信息，确定未对远端终端执行过ProSe中继通信的认证。
或者，接入和移动管理网元确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥，可以包括：接入和移动管理网元向数据管理网元发送认证服务网 元获得请求消息，并接收来自数据管理网元的认证服务网元获得响应消息。其中，认证服务网元获得请求消息用于请求认证服务网元的标识，该认证服务网元用于远端终端的ProSe中继通信认证。认证服务网元获得响应消息未携带该认证服务网元的标识，用以表示未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥。接入和移动管理网元根据认证服务网元获得响应消息，确定未对远端终端执行过认证或不存在用于推演ProSe密钥的密钥。
可以看出，在远端终端指示其是否执行过认证的情况下或不存在用于推演ProSe密钥的密钥，接入和移动管理网元可根据远端终端的指示信息，而不用再与其他网元交互，便可确定是否执行ProSe中继通信的认证。或者，远端终端可以不指示其是否执行过ProSe中继通信的认证，由接入和移动管理网元根据数据管理网元反馈的信息确定，如此可以降低远端终端与接入和移动管理网元之间的通信开销，提高通信效率。
此外，第三可能的应用场景的具体实现原理，也可以参考上述场景5中的相关介绍，不再赘述。
可选地，第四可能的应用场景，在S1403之前，数据管理网元确定未对远端终端执行过认证，或确定不存在用于推演ProSe密钥的密钥，或确定为远端终端服务的AUSF网元。换言之，只有在远端终端没有执行过认证，或不存在用于推演ProSe密钥的密钥，或不存在为远端终端服务的AUSF网元的情况下，才执行ProSe中继通信的认证流程，避免因重复执行认证流程而导致资源浪费。当然，在对远端终端执行过认证的情况下，数据管理网元可以请求认证服务网元使用已有的密钥(如KAUSF)推演ProSe密钥，无需再次执行ProSe中继通信认证。
此外，第四可能的应用场景的具体实现原理，也可以参考上述场景6中的相关介绍，不再赘述。
综上，基于图8-图14中任一项所示的通信方法，通过数据管理网元提供的ProSe认证信息#1，远端终端和网络可以彼此认证对方。在双方都认证通过的情况下，便可生成用于远端UE和中继UE通信的ProSe密钥，以便基于ProSe密钥推演PC5连接(即远端UE和中继UE间的连接)的通信保护密钥，例如加密密钥和完整性保护密钥，以确保ProSe中继通信安全，避免出现因被攻击而导致用户信息泄露等情况。
以上结合图8-图14详细说明了本申请实施例提供的通信方法。以下结合图15-图16详细说明用于执行本申请实施例提供的通信方法的通信装置。
示例性地，图15是本申请实施例提供的通信装置的结构示意图一。如图15所示，通信装置1500包括：接收模块1501和发送模块1502。为了便于说明，图15仅示出了该通信装置的主要部件。
一些实施例中，通信装置1500可适用于图7中所示出的通信系统中，执行图8-图13中所示出的通信方法中AUSF网元的功能，或者适用于图7中所示出的通信系统中，执行图14中所示出的通信方法中认证服务网元的功能。
其中，发送模块1502，用于向数据管理网元发送认证请求消息#1。接收模块1501，用于接收来自数据管理网元的认证响应消息#1。认证请求消息#1用于请求认 证远端终端，认证响应消息#1包括：临近业务ProSe认证信息#1，ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。如此，在远端终端认证网络通过的情况下，接收模块1501，还用于接收来自接入和移动管理网元的认证请求消息#2，并在认证远端终端通过的情况下，发送模块1502，还用于向接入和移动管理网元发送认证响应消息#2。其中，认证请求消息#2用于请求认证远端终端；认证响应消息#2包括：ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，ProSe认证信息#1可以为如下至少一项：第5代通信系统认证与密钥协商AKA的ProSe认证向量#1、或扩展认证协议请求EAP-AKA’的ProSe的认证向量。
可选地，AKA的ProSe认证向量#1或EAP-AKA’的ProSe的认证向量可以包括如下至少一项：用于远端终端认证网络的信息、用于认证服务网元认证远端终端的信息、或用于确定ProSe密钥的信息。
可选地，接收模块1501，还用于在发送模块1502向数据管理网元发送认证请求消息#1之前，接收来自接入和移动管理网元的认证请求消息#3。相应的，在认证服务网元接收来自数据管理网元的认证响应消息#1之后，发送模块1502，还用于在接收模块1501接收来自接入和移动管理网元的认证请求消息#2之前，向接入和移动管理网元发送认证响应消息#3。认证响应消息#3可以包括：ProSe认证信息#2，ProSe认证信息#2包括：用于远端终端认证网络的信息。
进一步的，ProSe认证信息#2可根据ProSe认证信息#1确定。ProSe认证信息#2可以为如下至少一项：AKA的ProSe认证向量#2、或EAP请求消息或AKA’挑战消息。其中，AKA的ProSe认证向量#2可根据AKA的ProSe认证向量#1确定。EAP请求消息或AKA’挑战消息可根据EAP-AKA’的ProSe的认证向量确定。
进一步的，AKA的ProSe认证向量#2可以包括如下至少一项：用于远端终端认证网络的信息、或用于接入和移动管理网元认证远端终端的信息。
进一步的，EAP请求消息或AKA’挑战消息可以包括：用于远端终端认证网络的信息。
可选地，认证请求消息#3可用于请求认证远端终端。
进一步的，认证请求消息#3可以包括如下至少一项：远端终端的用户隐藏标识SUCI、服务网络名称、中继服务码RSC、随机值#1、或ProSe中继通信指示信息。其中，服务网络名称、RSC或ProSe中继通信指示信息中的任一项可用于指示认证为ProSe中继通信的认证。服务网络名称、RSC、或随机值#1中的任一项可用于确定ProSe密钥。
进一步的，通信装置1500还可以包括：处理模块(图15中未示出)。处理模块，用于在发送模块1502向接入和移动管理网元发送认证响应消息#2之前，若认证请求消息#3中包括：RSC和随机值#1，则保存RSC和随机值#1。
进一步的，用于确定ProSe密钥的信息包括：中间密钥。处理模块，还用于在发送模块1502向接入和移动管理网元发送认证响应消息#2之前，在认证远端终端通过的情况下，根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密 钥，确定ProSe密钥。
一种可能的设计方案中，认证请求消息#2可以包括如下至少一项：远端终端确定的认证响应信息、用于确定ProSe密钥的RSC、或用于确定ProSe密钥的随机值#1，认证响应消息用于认证远端终端。
可选地，认证响应消息#2可以包括：随机值#2。随机值#2用于确定ProSe密钥。
进一步的，认证响应消息#2还可以包括如下至少一项：远端终端的SUPI、或EAP成功消息。
一种可能的设计方案中，认证服务网元跳过推演用于远端终端与网络之间通信的密钥。
可选地，接收模块1501和发送模块1502也可以集成为一个模块，如收发模块(图15中未示出)。其中，收发模块用于实现通信装置1500的发送功能和接收功能。
可选地，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1500可以执行图8-图13中任一项所示出的通信方法中AUSF网元的功能，或者执行图14所示出的通信方法中认证服务网元的功能。
应理解，通信装置1500中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置1500可以是网络设备，例如AUSF网元或者认证服务网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8-图14中任一项所示出的通信方法的技术效果，此处不再赘述。
另一些实施例中，通信装置1500可适用于图7中所示出的通信系统中，执行图8-图13中所示出的通信方法中中继AMF网元的功能，或者适用于图7中所示出的通信系统中，执行图14中所示出的通信方法中接入和移动管理网元的功能。
其中，发送模块1502，用于向认证服务网元发送认证请求消息#3，接收模块1501，用于接收来自认证服务网元的认证响应消息#3。认证响应消息#3包括：ProSe认证信息#2，ProSe认证信息#2包括：用于远端终端认证网络的信息。如此，在远端终端认证网络通过的情况下，发送模块1502，还用于向认证服务网元发送认证请求消息#2，并在认证远端终端通过的情况下，接收模块1501，还用于接收来自认证服务网元的认证响应消息#2，以便发送模块1502向中继终端发送ProSe密钥。其中，认证请求消息#2用于请求认证远端终端。认证响应消息#2包括：ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，ProSe认证信息#2可以为如下至少一项：AKA的ProSe认证向量#2、或EAP请求消息或AKA’挑战消息。
可选地，AKA的ProSe认证向量#2可包括如下至少一项：用于远端终端认证网 络的信息、或用于接入和移动管理网元认证远端终端的信息。
可选地，EAP请求消息或AKA’挑战消息可包括：用于远端终端认证网络的信息。
一种可能的设计方案中，在接收模块1501接收来自认证服务网元的认证响应消息#3之后，在发送模块1502向认证服务网元发送认证请求消息#2之前，发送模块1502，还用于向中继终端发送用于远端终端认证网络的信息，接收模块1501，还用于接收来自中继终端的远端终端确定的认证响应信息。该认证响应信息用于认证远端终端。
可选地，在ProSe认证信息#2可以包括：用于接入和移动管理网元认证远端终端的信息的情况下，通信装置1500还可以包括：处理模块(图15中未示出)。处理模块，还用于在接收模块1501接收来自中继终端的远端终端认证响应消息之后，以及在发送模块1502向认证服务网元发送认证请求消息#2之前，根据远端终端确定的认证响应消息，以及用于接入和移动管理网元认证远端终端的信息，确定远端终端认证通过。
可选地，用于远端终端认证网络的信息和远端终端确定的认证响应信息为通过通信密钥保护的信息，通信密钥用于中继终端与网络的通信。
可选地，认证请求消息#2可以包括如下至少一项：远端终端确定的认证响应消息、用于确定ProSe密钥的RSC、或用于确定ProSe密钥的随机值#1，认证响应消息用于认证远端终端。
可选地，认证响应消息#2可以包括：随机值#2，随机值#2用于确定ProSe密钥。
进一步的，认证响应消息#2还可以包括如下至少一项：远端终端的SUPI、或EAP成功消息。
进一步的，发送模块1502，还用于在接收模块1501接收来自认证服务网元的认证响应消息#2之后，向中继终端发送随机值#2。
一种可能的设计方案中，处理模块，还用于在发送模块1502向认证服务网元发送认证请求消息#3之前，确定未对远端终端执行过ProSe中继通信的认证。
可选地，接收模块1501，还用于接收来自中继终端的远端终端指示信息，远端终端指示信息用于指示远端终端未执行ProSe执行通信的认证。处理模块，还用于根据远端终端指示信息，确定未对远端终端执行过ProSe中继通信的认证。
可选地，发送模块1502，还用于向数据管理网元发送认证服务网元获得请求消息，接收模块1501，还用于接收来自数据管理网元的认证服务网元获得响应消息。其中，认证服务网元获得请求消息用于请求认证服务网元的标识，该认证服务网元用于远端终端的ProSe中继通信认证。认证服务网元获得响应消息未携带该认证服务网元的标识，用以表示未对远端终端执行过ProSe中继通信的认证。如此，处理模块，还用于根据认证服务网元获得响应消息，确定未对远端终端执行过ProSe中继通信的认证。
可选地，接收模块1501和发送模块1502也可以集成为一个模块，如收发模块(图15中未示出)。其中，收发模块用于实现通信装置1500的发送功能和接收功 能。
可选地，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1500可以执行图8-图13中任一项所示出的通信方法中中继AMF网元的功能，或者执行图14所示出的通信方法中接入和移动管理网元的功能。
应理解，通信装置1500中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置1500可以是网络设备，例如中继AMF网元或者接入和移动管理网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8-图14中任一项所示出的通信方法的技术效果，此处不再赘述。
又一些实施例中，通信装置1500可适用于图7中所示出的通信系统中，执行图8-图13中所示出的通信方法中UDM网元的功能，或者适用于图7中所示出的通信系统中，执行图14中所示出的通信方法中数据管理网元的功能。
其中，接收模块1501，用于接收来自认证服务网元的认证请求消息#1，发送模块1502，用于向认证服务网元发送认证响应消息#1。认证响应消息#1包括：ProSe认证信息#1。ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。
一种可能的设计方案中，ProSe认证信息#1可以为如下至少一项：AKA的ProSe认证向量#1、或EAP-AKA’的ProSe的认证向量。
可选地，AKA的ProSe认证向量#1或EAP-AKA’的ProSe的认证向量可以包括如下至少一项：用于远端终端认证网络的信息、用于认证服务网元认证远端终端的信息、或用于确定ProSe密钥的信息。
可选地，在接收模块1501接收来自认证服务网元的认证请求消息#1之前，第三方面所述的方法还可以包括：接收模块1501，还用于接收来自接入和移动管理网元的认证服务网元获得请求消息，发送模块1502，还用于向接入和移动管理网元发送认证服务网元获得响应消息。其中，认证服务网元获得请求消息用于请求认证服务网元的标识，该认证服务网元用于远端终端的ProSe中继通信认证。认证服务网元获得响应消息未携带该认证服务网元的标识，用以表示未对远端终端执行过ProSe中继通信的认证。
一种可能的设计方案中，通信装置1500还可以包括：处理模块(图15中未示出)。处理模块，还用于在发送模块1502向认证服务网元发送认证响应消息#1之前，确定远端终端授权获取中继服务。
一种可能的设计方案中，处理模块，还用于在发送模块1502向认证服务网元发送认证响应消息#1之前，根据认证请求消息#1，确定ProSe认证信息#1。
一种可能的设计方案中，处理模块，还用于在发送模块1502向认证服务网元发送认证响应消息#1之前，确定未对远端终端执行过ProSe中继通信的认证。
可选地，接收模块1501和发送模块1502也可以集成为一个模块，如收发模块(图15中未示出)。其中，收发模块用于实现通信装置1500的发送功能和接收功能。
可选地，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1500可以执行图8-图13中任一项所示出的通信方法中UDM网元的功能，或者执行图14所示出的通信方法中数据管理网元的功能。
应理解，通信装置1500中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置1500可以是网络设备，例如UDM网元或者数据管理网元，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8-图14中任一项所示出的通信方法的技术效果，此处不再赘述。
再一些实施例中，通信装置1500可适用于图7中所示出的通信系统中，执行图8-图13中所示出的通信方法中中继UE的功能，或者适用于图7中所示出的通信系统中，执行图14中所示出的通信方法中中继终端的功能。
其中，接收模块1501，用于接收来自接入和移动管理网元的用于远端终端认证网络的信息，发送模块1502，用于向接入和移动管理网元发送远端终端确定的认证响应信息。该认证响应信息用于认证远端终端。如此，接收模块1501，还用于接收来自接入和移动管理网元的ProSe密钥，ProSe密钥用于中继终端与远端终端的通信。
一种可能的设计方案中，用于远端终端认证网络的信息和远端终端确定的认证响应信息为通过通信密钥保护的信息，通信密钥用于中继终端与网络的通信。
一种可能的设计方案中，在接收模块1501接收来自接入和移动管理网元的用于远端终端认证网络的信息之后，在发送模块1502向接入和移动管理网元发送远端终端确定的认证响应信息之前，发送模块1502，还用于向远端终端发送用于远端终端认证网络的信息，接收模块1501，还用于接收来自远端终端的远端终端确定的认证响应信息。
可选地，用于远端终端认证网络的信息可以承载在消息中，该消息的名称或携带的指示信息，可以指示需要由远端终端执行ProSe中继通信的认证流程。如此，处理模块，还用于根据消息，控制发送模块1502向远端终端发送用于远端终端认证网络的信息。
一种可能的设计方案中，在发送模块1502向接入和移动管理网元发送的ProSe通信认证响应消息之后，接收模块1501，还用于接收来自接入和移动管理网元的随机值#2，发送模块，还用于向远端终端发送随机值#2。随机值#2用于确定ProSe密钥，该ProSe密钥用于中继终端与远端终端的通信。
可选地，接收模块1501和发送模块1502也可以集成为一个模块，如收发模块 (图15中未示出)。其中，收发模块用于实现通信装置1500的发送功能和接收功能。
可选地，通信装置1500还可以包括处理模块(图15中未示出)，该处理模块用于实现该通信装置1500的处理功能。
可选地，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1500可以执行图8-图13中任一项所示出的通信方法中中继UE的功能，或者执行图14所示出的通信方法中中继终端的功能。
应理解，通信装置1500中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置1500可以是终端，例如中继UE或者中继终端，也可以是可设置于终端中的芯片(系统)或其他部件或组件，还可以是包含终端的装置，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8-图14中任一项所示出的通信方法的技术效果，此处不再赘述。
还一些实施例中，通信装置1500可适用于图7中所示出的通信系统中，执行图8-图13中所示出的通信方法中远端UE的功能，或者适用于图7中所示出的通信系统中，执行图14中所示出的通信方法中远端终端的功能。
其中，接收模块1501，用于接收来自中继终端的用于远端终端认证网络的信息。如此，在确定认证网络通过的情况下，发送模块1502，用于向中继终端发送远端终端确定的认证响应信息，该认证响应信息用于认证远端终端。
一种可能的设计方案中，通信装置1500还可以包括：处理模块(图15中未示出)。在发送模块1502向中继终端发送远端终端确定的认证响应信息之后，接收模块1501，还用于接收来自中继终端的随机值#2，处理模块，还用于根据如下至少一项：服务网络名称、RSC、随机值#1、随机值#2和中间密钥，确定ProSe密钥。
可选地，接收模块1501和发送模块1502也可以集成为一个模块，如收发模块(图15中未示出)。其中，收发模块用于实现通信装置1500的发送功能和接收功能。
可选地，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得通信装置1500可以执行图8-图13中任一项所示出的通信方法中远端UE的功能，或者执行图14所示出的通信方法中远端终端的功能。
应理解，通信装置1500中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置1500可以是终端，例如远端UE或者远端终端，也可以是可设置于终端中的芯片(系统)或其他部件或组件，还可以是包含终端的装置，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8-图14中任一项所示出的通信方法的技术效果，此处不再赘述。
示例性地，图16为本申请实施例提供的通信装置的结构示意图二。该通信装置可以是终端或网络设备，也可以是可设置于终端或网络设备的芯片(系统)或其他部件或组件。如图16所示，通信装置1600可以包括处理器1601。可选地，通信装置1600还可以包括存储器1602和/或收发器1603。其中，处理器1601与存储器1602和收发器1603耦合，如可以通过通信总线连接。
下面结合图16对通信装置1600的各个构成部件进行具体的介绍：
其中，处理器1601是通信装置1600的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器1601是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
可选地，处理器1601可以通过运行或执行存储在存储器1602内的软件程序，以及调用存储在存储器1602内的数据，执行通信装置1600的各种功能，例如执行上述图8-图14所示的通信方法。
在具体的实现中，作为一种实施例，处理器1601可以包括一个或多个CPU，例如图16中所示出的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置1600也可以包括多个处理器，例如图16中所示的处理器1601和处理器1604。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
其中，所述存储器1602用于存储执行本申请方案的软件程序，并由处理器1601来控制执行，具体实现方式可以参考上述方法实施例，此处不再赘述。
可选地，存储器1602可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1602可以和处理器1601集成在一起，也可以独立存在，并通过通信装置1600的接口电路(图16中未示出)与处理器1601耦合，本申请实施例对此不作具体限定。
收发器1603，用于与其他通信装置之间的通信。例如，通信装置1600为终端，收发器1603可以用于与网络设备通信，或者与另一个终端设备通信。又例如，通信装置1600为网络设备，收发器1603可以用于与终端通信，或者与另一个网络设备通信。
可选地，收发器1603可以包括接收器和发送器(图16中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。
可选地，收发器1603可以和处理器1601集成在一起，也可以独立存在，并通过通信装置1600的接口电路(图16中未示出)与处理器1601耦合，本申请实施例对此不作具体限定。
需要说明的是，图16中示出的通信装置1600的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
此外，通信装置1600的技术效果可以参考上述方法实施例所述的通信方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该通信系统包括上述方法实施例中的一个或多个终端，以及上述方法实施例中一个或多个网络设备。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式 向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出 来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (40)

  1. 一种通信方法，其特征在于，所述方法包括：
    认证服务网元向数据管理网元发送认证请求消息#1，所述认证请求消息#1用于请求认证远端终端的信息；
    所述认证服务网元接收来自所述数据管理网元的认证响应消息#1，所述认证响应消息#1包括：临近业务ProSe认证信息#1，所述ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证所述远端终端的信息；
    在所述远端终端认证网络通过的情况下，所述认证服务网元接收来自接入和移动管理网元的认证请求消息#2，所述认证请求消息#2用于请求认证所述远端终端；
    在认证所述远端终端通过的情况下，所述认证服务网元向所述接入和移动管理网元发送认证响应消息#2，所述认证响应消息#2包括：ProSe密钥，所述ProSe密钥用于中继终端与所述远端终端的通信。
  2. 根据权利要求1所述的方法，其特征在于，所述ProSe认证信息#1为如下至少一项：认证与密钥协商AKA的ProSe认证向量#1、或扩展认证协议请求EAP-AKA’的ProSe的认证向量。
  3. 根据权利要求2所述的方法，其特征在于，所述AKA的ProSe认证向量#1或所述EAP-AKA’的ProSe的认证向量包括如下至少一项：用于所述远端终端认证网络的信息、用于所述认证服务网元认证所述远端终端的信息、或用于确定所述ProSe密钥的信息。
  4. 根据权利要求2或3所述的方法，其特征在于，在所述认证服务网元向数据管理网元发送认证请求消息#1之前，所述方法还包括：
    所述认证服务网元接收来自所述接入和移动管理网元的认证请求消息#3；
    相应的，在所述认证服务网元接收来自所述数据管理网元的认证响应消息#1之后，在所述认证服务网元接收来自接入和移动管理网元的认证请求消息#2之前，所述方法还包括：
    所述认证服务网元向所述接入和移动管理网元发送认证响应消息#3，所述认证响应消息#3包括：ProSe认证信息#2，所述ProSe认证信息#2包括：用于所述远端终端认证网络的信息。
  5. 根据权利要求4所述的方法，其特征在于，所述ProSe认证信息#2根据所述ProSe认证信息#1确定，所述ProSe认证信息#2为如下至少一项：AKA的ProSe认证向量#2、或EAP请求消息或AKA’挑战消息；所述AKA的ProSe认证向量#2根据所述AKA的ProSe认证向量#1确定，所述EAP请求消息或AKA’挑战消息根据所述EAP-AKA’的ProSe的认证向量确定。
  6. 根据权利要求5所述的方法，其特征在于，所述AKA的ProSe认证向量#2包括：用于所述接入和移动管理网元认证所述远端终端的信息。
  7. 根据权利要求4-6中任一项所述的方法，其特征在于，所述认证请求消息#3用于请求认证所述远端终端。
  8. 根据权利要求7所述的方法，其特征在于，所述认证请求消息#3包括如下至少 一项：所述远端终端的用户隐藏标识SUCI、服务网络名称、中继服务码RSC、随机值#1、或ProSe中继通信指示信息；所述服务网络名称、所述RSC或所述ProSe中继通信指示信息中的任一项用于指示认证为ProSe中继通信的认证；所述服务网络名称、所述RSC或所述随机值#1中的任一项用于确定所述ProSe密钥。
  9. 根据权利要求8所述的方法，其特征在于，在所述认证服务网元向所述接入和移动管理网元发送认证响应消息#2之前，所述方法还包括：
    若所述认证请求消息#3中包括：所述RSC和所述随机值#1，则所述认证服务网元保存所述RSC和所述随机值#1。
  10. 根据权利要求9所述的方法，其特征在于，所述用于确定所述ProSe密钥的信息包括：中间密钥，在所述认证服务网元向所述接入和移动管理网元发送认证响应消息#2之前，所述方法还包括：
    在认证所述远端终端通过的情况下，所述认证服务网元根据如下至少一项：所述服务网络名称、所述RSC、所述随机值#1、随机值#2和所述中间密钥，确定所述ProSe密钥。
  11. 根据权利要求1-7中任一项所述的方法，其特征在于，所述认证请求消息#2包括如下至少一项：所述远端终端确定的认证响应消息、用于确定所述ProSe密钥的RSC、或用于确定所述ProSe密钥的随机值#1，所述认证响应消息用于认证所述远端终端。
  12. 根据权利要求1-9、11中任一项所述的方法，其特征在于，所述认证响应消息#2包括：随机值#2，所述随机值#2用于确定所述ProSe密钥。
  13. 根据权利要求12所述的方法，其特征在于，所述认证响应消息#2还包括如下至少一项：远端终端的用户隐藏标识SUPI、或EAP成功消息。
  14. 根据权利要求1-7中任一项所述的方法，其特征在于，所述认证请求消息#1包括如下至少一项：所述远端终端的SUCI、或ProSe中继通信指示信息，所述ProSe中继通信指示信息用于指示认证为ProSe中继通信的认证。
  15. 根据权利要求1-14中任一项所述的方法，其特征在于，所述认证服务网元跳过推演用于远端终端与网络之间通信的密钥。
  16. 一种通信方法，其特征在于，所述方法包括：
    中继终端接收来自接入和移动管理网元的用于远端终端认证网络的信息；
    所述中继终端向所述接入和移动管理网元发送所述远端终端确定的认证响应信息，所述认证响应信息用于认证所述远端终端；
    所述中继终端接收来自所述接入和移动管理网元的ProSe密钥，所述ProSe密钥用于所述中继终端与所述远端终端的通信。
  17. 根据权利要求16所述的方法，其特征在于，所述远端终端认证网络的信息和所述远端终端确定的认证响应信息为通过通信密钥保护的信息，所述通信密钥用于所述中继终端与网络的通信。
  18. 根据权利要求16或17所述的方法，其特征在于，在所述中继终端接收来自接入和移动管理网元的用于所述远端终端认证网络的信息之后，在所述中继终端向所述接入和移动管理网元发送所述远端终端确定的认证响应信息之前，所述方法还包 括：
    所述中继终端向所述远端终端发送所述用于所述远端终端认证网络的信息；
    所述中继终端接收来自所述远端终端的所述认证响应信息。
  19. 根据权利要求18所述的方法，其特征在于，所述用于所述远端终端认证网络的信息承载在消息中，所述中继终端向所述远端终端发送所述用于所述远端终端认证网络的信息，包括：
    所述中继终端根据所述消息，向所述远端终端发送所述用于所述远端终端认证网络的信息。
  20. 根据权利要求16-19中任一项所述的方法，其特征在于，在所述中继终端向所述接入和移动管理网元发送所述远端终端确定的认证响应信息之后，所述方法还包括：
    所述中继终端接收来自所述接入和移动管理网元的随机值#2；
    所述中继终端向所述远端终端发送所述随机值#2，所述随机值#2用于确定所述ProSe密钥。
  21. 一种通信方法，其特征在于，所述方法包括：
    远端终端接收来自中继终端的用于所述远端终端认证网络的信息；
    在所述远端终端确定认证网络通过的情况下，所述远端终端向所述中继终端发送所述远端终端确定的认证响应信息，所述认证响应信息用于认证所述远端终端。
  22. 根据权利要求21所述的方法，其特征在于，在所述远端终端向所述中继终端发送所述远端终端确定的认证响应信息之后，所述方法还包括：
    所述远端终端接收来自所述中继终端的随机值#2；
    所述远端终端根据如下至少一项：服务网络名称、RSC、随机值#1、所述随机值#2和中间密钥，确定ProSe密钥，所述ProSe密钥用于所述中继终端与所述远端终端的通信。
  23. 一种通信方法，其特征在于，所述方法包括：
    数据管理网元接收来自认证服务网元的认证请求消息#1，所述认证请求消息#1用于请求认证远端终端的信息；
    所述数据管理网元向所述认证服务网元发送认证响应消息#1，所述认证响应消息#1包括：临近业务ProSe认证信息#1；所述ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证远端终端的信息。
  24. 根据权利要求23所述的方法，其特征在于，所述ProSe认证信息#1为如下至少一项：认证与密钥协商AKA的ProSe认证向量#1、或扩展认证协议请求EAP-AKA’的ProSe的认证向量。
  25. 根据权利要求24所述的方法，其特征在于，所述AKA的ProSe认证向量#1或所述EAP-AKA’的ProSe的认证向量包括如下至少一项：用于所述远端终端认证网络的信息、用于所述认证服务网元认证所述远端终端的信息、或用于确定所述ProSe密钥的信息。
  26. 根据权利要求23-25中任一项所述的方法，其特征在于，在所述数据管理网元向所述认证服务网元发送认证响应消息#1之前，所述方法还包括：
    所述数据管理网元确定所述远端终端授权获取中继服务。
  27. 一种通信方法，其特征在于，所述方法包括：
    认证服务网元向数据管理网元发送认证请求消息#1，所述认证请求消息#1用于请求认证远端终端的信息；
    所述数据管理网元接收来自认证服务网元的认证请求消息#1，并向所述认证服务网元发送认证响应消息#1，所述认证响应消息#1包括：临近业务ProSe认证信息#1，所述ProSe认证信息#1包括如下至少一项：用于远端终端认证网络的信息、或用于认证所述远端终端的信息；
    所述认证服务网元接收来自所述数据管理网元的认证响应消息#1；
    在所述远端终端认证网络通过的情况下，接入和移动管理网元向所述认证服务网元发送认证请求消息#2，所述认证请求消息#2用于请求认证所述远端终端；
    所述认证服务网元接收来自所述接入和移动管理网元的所述认证请求消息#2；
    在认证所述远端终端通过的情况下，所述认证服务网元向所述接入和移动管理网元发送认证响应消息#2，所述认证响应消息#2包括：ProSe密钥，所述ProSe密钥用于中继终端与所述远端终端的通信；
    所述接入和移动管理网元接收来自所述认证服务网元的所述认证响应消息#2。
  28. 根据权利要求27所述的方法，其特征在于，所述ProSe认证信息#1为如下至少一项：认证与密钥协商AKA的ProSe认证向量#1、或扩展认证协议请求EAP-AKA’的ProSe的认证向量。
  29. 根据权利要求28所述的方法，其特征在于，所述AKA的ProSe认证向量#1或所述EAP-AKA’的ProSe的认证向量包括如下至少一项：用于所述远端终端认证网络的信息、用于所述认证服务网元认证所述远端终端的信息、或用于确定所述ProSe密钥的信息。
  30. 一种通信方法，其特征在于，所述方法包括：
    中继终端接收来自接入和移动管理网元的用于远端终端认证网络的信息；
    所述远程终端接收来自所述中继终端的用于所述远端终端认证网络的信息；
    在所述远端终端确定认证网络通过的情况下，所述远端终端向所述中继终端发送所述远端终端确定的认证响应信息，所述认证响应信息用于认证所述远端终端；
    所述中继终端向所述接入和移动管理网元发送所述远端终端确定的认证响应信息，并接收来自所述接入和移动管理网元的临近业务ProSe密钥，所述ProSe密钥用于所述中继终端与所述远端终端的通信。
  31. 根据权利要求30所述的方法，其特征在于，所述远端终端认证网络的信息和所述远端终端确定的认证响应信息为通过通信密钥保护的信息，所述通信密钥用于所述中继终端与网络的通信。
  32. 一种通信装置，其特征在于，所述通信装置包括：用于执行如权利要求1-15中任一项所述的通信方法的模块。
  33. 一种通信装置，其特征在于，所述通信装置包括：用于执行如权利要求16-20中任一项所述的通信方法的模块。
  34. 一种通信装置，其特征在于，所述通信装置包括：用于执行如权利要求21或 22所述的通信方法的模块。
  35. 一种通信装置，其特征在于，所述通信装置包括：用于执行如权利要求23或26所述的通信方法的模块。
  36. 一种通信装置，其特征在于，所述通信装置包括：处理器；其中，
    所述处理器，用于执行如权利要求1-26中任一项所述的通信方法。
  37. 一种通信装置，其特征在于，所述通信装置包括：处理器和存储器；所述存储器用于存储计算机指令，当所述处理器执行该指令时，以使所述通信装置执行如权利要求1-26中任一项所述的通信方法。
  38. 一种通信系统，其特征在于，所述通信系统包括：如权利要求1-13中任一项所述的认证服务网元、如权利要求13-18中任一项所述的中继终端、以及如权利要求21或22所述的远端终端。
  39. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-26中任一项所述的通信方法。
  40. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-26中任一项所述的通信方法。
PCT/CN2023/072627 2022-01-30 2023-01-17 通信方法及装置 Ceased WO2023143251A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP23746133.0A EP4422236A4 (en) 2022-01-30 2023-01-17 COMMUNICATION METHOD AND DEVICE
AU2023211342A AU2023211342B2 (en) 2022-01-30 2023-01-17 Communication method and apparatus
CA3239348A CA3239348A1 (en) 2022-01-30 2023-01-17 Communication method and apparatus
US18/666,841 US20240305983A1 (en) 2022-01-30 2024-05-17 Communication method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210114688.0A CN116567620A (zh) 2022-01-30 2022-01-30 通信方法及装置
CN202210114688.0 2022-01-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/666,841 Continuation US20240305983A1 (en) 2022-01-30 2024-05-17 Communication method and apparatus

Publications (1)

Publication Number Publication Date
WO2023143251A1 true WO2023143251A1 (zh) 2023-08-03

Family

ID=87470676

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/072627 Ceased WO2023143251A1 (zh) 2022-01-30 2023-01-17 通信方法及装置

Country Status (6)

Country Link
US (1) US20240305983A1 (zh)
EP (1) EP4422236A4 (zh)
CN (1) CN116567620A (zh)
AU (1) AU2023211342B2 (zh)
CA (1) CA3239348A1 (zh)
WO (1) WO2023143251A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117062173A (zh) * 2023-09-07 2023-11-14 江苏鸿剑网络科技有限公司 边缘网络下的安全通信方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023193214A1 (en) * 2022-04-08 2023-10-12 Zte Corporation Network relay security
WO2025118206A1 (en) * 2023-12-07 2025-06-12 Zte Corporation Refreshing keys for authentication and key management for applications after authentication failures
CN121220177A (zh) * 2024-04-24 2025-12-26 北京小米移动软件有限公司 通信方法、通信设备、通信系统及存储介质
CN119233251A (zh) * 2024-09-27 2024-12-31 中国联合网络通信集团有限公司 密钥生成方法、装置、存储介质及程序产品

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020091281A1 (ko) * 2018-11-02 2020-05-07 엘지전자 주식회사 무선 통신 시스템 엑세스 허가를 위한 단말의 대행 인증 방법 및 장치
CN112219415A (zh) * 2018-04-05 2021-01-12 诺基亚技术有限公司 在第一网络中使用用于第二旧网络的订户标识模块的用户认证
CN113543121A (zh) * 2020-03-31 2021-10-22 华为技术有限公司 一种终端参数更新的保护方法和通信装置
US20210400475A1 (en) * 2018-11-12 2021-12-23 Telefonaktiebolaget Lm Ericsson (Publ) Authentication of a Communications Device
WO2022019627A1 (en) * 2020-07-20 2022-01-27 Samsung Electronics Co., Ltd. Methods and systems for establishing secure communication in wireless communication system

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210345104A1 (en) * 2020-05-01 2021-11-04 Qualcomm Incorporated Relay sidelink communications for secure link establishment
CN118542003A (zh) * 2022-01-21 2024-08-23 瑞典爱立信有限公司 无线通信设备进行业务中继的安全性

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112219415A (zh) * 2018-04-05 2021-01-12 诺基亚技术有限公司 在第一网络中使用用于第二旧网络的订户标识模块的用户认证
WO2020091281A1 (ko) * 2018-11-02 2020-05-07 엘지전자 주식회사 무선 통신 시스템 엑세스 허가를 위한 단말의 대행 인증 방법 및 장치
US20210400475A1 (en) * 2018-11-12 2021-12-23 Telefonaktiebolaget Lm Ericsson (Publ) Authentication of a Communications Device
CN113543121A (zh) * 2020-03-31 2021-10-22 华为技术有限公司 一种终端参数更新的保护方法和通信装置
WO2022019627A1 (en) * 2020-07-20 2022-01-27 Samsung Electronics Co., Ltd. Methods and systems for establishing secure communication in wireless communication system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4422236A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117062173A (zh) * 2023-09-07 2023-11-14 江苏鸿剑网络科技有限公司 边缘网络下的安全通信方法及装置

Also Published As

Publication number Publication date
EP4422236A1 (en) 2024-08-28
US20240305983A1 (en) 2024-09-12
CN116567620A (zh) 2023-08-08
CA3239348A1 (en) 2023-08-03
EP4422236A4 (en) 2025-02-26
AU2023211342A1 (en) 2024-05-30
AU2023211342B2 (en) 2026-02-19

Similar Documents

Publication Publication Date Title
AU2023211342B2 (en) Communication method and apparatus
CN116458109B (zh) 密钥获取方法和通信装置
CN113543135B (zh) 授权方法、策略控制功能设备和接入和移动管理功能设备
KR101961301B1 (ko) 통합된 스몰 셀 및 wi-fi 네트워크를 위한 통합 인증
WO2023011630A1 (zh) 授权验证的方法及装置
EP4478759A1 (en) Communication method and apparatus
US20240179525A1 (en) Secure communication method and apparatus
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
CN113841366B (zh) 通信方法及装置
WO2022213951A1 (zh) 通信方法及装置
EP4460059A1 (en) Authorization method and apparatus
CN113412679B (zh) 通信方法及装置
WO2022027686A1 (zh) 一种注册方法及装置
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
CN117793710A (zh) 鉴权方法、通信装置及通信系统
EP4615025A1 (en) Communication method and communication apparatus
CN121264080A (zh) 一种安全密钥的确定方法及装置
CN116546490A (zh) 密钥生成方法及装置
CN119450638A (zh) 通信方法及装置
CN120456019A (zh) 一种通信方法和通信装置
CN118488437A (zh) 通信方法及装置
CN118317302A (zh) 鉴权方法及通信装置
WO2024067200A1 (zh) 通信方法、装置以及系统
CN121773634A (zh) 通信方法、终端设备和网络设备
CN119835639A (zh) 通信方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23746133

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202427037103

Country of ref document: IN

Ref document number: AU2023211342

Country of ref document: AU

ENP Entry into the national phase

Ref document number: 3239348

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 2023746133

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023746133

Country of ref document: EP

Effective date: 20240522

ENP Entry into the national phase

Ref document number: 2023211342

Country of ref document: AU

Date of ref document: 20230117

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE