Network relay security
Techniques are described to perform network relay security. An example wireless communication method includes receiving, by a network device, a request message that includes an identifier associated with a first communication device; determining, by the network device in response to the receiving, that the first communication device is authenticated based on a local policy of the network device; and sending, by the network device in response to the determining, a message to a second communication device to relay to the first communication device, where the message indicates that the identifier is rejected by the network device for communication with the first communication device, or where the message indicates that the first communication device is triggered to send another identifier.
1 . A wireless communication method, comprising:
receiving, by a first network device from a second network device, a first request message that includes an identifier associated with a first communication device, the identifier including a 5G ProSe Relay User Key (PRUK) identifier (ID) that includes a routing identifier or a routing indicator (RID);
transmitting, by the first network device to a third network device, a second request message that includes the identifier; and
receiving, by the first network device from the third network device, a response message in response to the second request message, wherein the response message indicates whether the third network device identifies a relay key using the identifier;
wherein the relay key includes 5G PRUK, and
wherein the 5G PRUK ID includes a first part that includes the RID and a prose temporary user equipment identifier (P-TID), and a second part that includes a home network identifier.
2 . The method of claim 1 , wherein the third network device is selected by the first network device based on the identifier.
3 . The method of claim 1 , wherein the second network device verifies whether a second communication device is authorized to provide a UE-to-network relay service to the first communication device.
4 . The method of claim 1 ,
wherein the first network device includes an authentication server function (AUSF) device,
wherein the second network device includes a remote access and mobility management function (AMF) device, and
wherein the third network device includes a prose anchor function (PAnF).
5 . An apparatus for wireless communication comprising at least one processor, configured to implement a method, the at least one processor configured to:
receive, by a first network device from a second network device, a first request message that includes an identifier associated with a first communication device, the identifier including a 5G ProSe Relay User Key (PRUK) identifier (ID) that includes a routing identifier or a routing indicator (RID);
transmit, by the first network device to a third network device, a second request message that includes the identifier; and
receive, by the first network device from the third network device, a response message in response to the second request message, wherein the response message indicates whether the third network device identifies a relay key using the identifier;
wherein the relay key includes 5G PRUK, and
wherein the 5G PRUK ID includes a first part that includes the RID and a prose temporary user equipment identifier (P-TID), and a second part that includes a home network identifier.
6 . The apparatus of claim 5 , wherein the third network device is selected by the first network device based on the identifier.
7 . The apparatus of claim 5 , wherein the at least one processor of the second network device is configured to verify whether a second communication device is authorized to provide a UE-to-network relay service to the first communication device.
8 . The apparatus of claim 5 ,
wherein the first network device includes an authentication server function (AUSF) device,
wherein the second network device includes a remote access and mobility management function (AMF) device, and
wherein the third network device includes a prose anchor function (PAnF).
9 . A non-transitory computer readable program storage medium having code stored thereon, the code, when executed by at least one processor, causing the at least one processor to implement a method, comprising:
receiving, by a first network device from a second network device, a first request message that includes an identifier associated with a first communication device, the identifier including a 5G ProSe Relay User Key (PRUK) identifier (ID) that includes a routing identifier or a routing indicator (RID);
transmitting, by the first network device to a third network device, a second request message that includes the identifier; and
by the first network device from the third network device, a response message in response to the second request message, wherein the response message indicates whether the third network device identifies a relay key using the identifier;
wherein the relay key includes 5G PRUK, and
wherein the 5G PRUK ID includes a first part that includes the RID and a prose temporary user equipment identifier (P-TID), and a second part that includes a home network identifier.
10 . The non-transitory computer readable program storage medium of claim 9 , wherein the third network device is selected by the first network device based on the identifier.
11 . The non-transitory computer readable program storage medium of claim 9 , wherein the second network device verifies whether a second communication device is authorized to provide a UE-to-network relay service to the first communication device.
12 . The non-transitory computer readable program storage medium of claim 9 ,
wherein the first network device includes an authentication server function (AUSF) device,
wherein the second network device includes a remote access and mobility management function (AMF) device, and
wherein the third network device includes a prose anchor function (PAnF).