End-to-end authentication via a WTRU-to-WTRU relay
A wireless transmit/receive unit (WTRU) may function as a relay between other WTRUs. The relay WTRU may receive a domain name system (DNS) query request from a first WTRU for the internet protocol (IP) address of a second WTRU. The DNS query request may comprise the first WTRU's authentication container. The relay WTRU may: send a first authentication request comprising the first WTRU's authentication container to the second WTRU, receive a first authentication response from the second WTRU indicating successful authentication of the first WTRU and comprising the second WTRU's authentication container, send a second authentication request to the first WTRU comprising the second WTRU's authentication container, receive a second authentication response from the first WTRU indicating successful authentication of the second WTRU, and based on successful authentication of the first and second WTRUs, send a DNS response comprising the IP address of the second WTRU to the first WTRU.
1 . A relay wireless transmit receive unit (WTRU) comprising:
a transceiver; and
a processor configured to:
establish a first PC5 unicast link with a first WTRU and a second PC5 unicast link with a second WTRU;
receive, via the transceiver, a first domain name system (DNS) query from the first WTRU via the first PC5 unicast link, the first DNS query requesting an internet protocol (IP) address of the second WTRU, the first DNS query comprising an authentication container for the first WTRU;
send, via the transceiver, a first authentication request to the second WTRU via the second PC5 unicast link, the first authentication request comprising the authentication container for the first WTRU;
receive, via the transceiver, a first authentication response from the second WTRU via the second PC5 unicast link, the first authentication response indicating successful authentication of the first WTRU by the second WTRU and an authentication container for the second WTRU;
send, via the transceiver, a second authentication request to the first WTRU via the first PC5 unicast link, the second authentication request comprising the authentication container for the second WTRU;
receive, via the transceiver, a second authentication response from the first WTRU via the first PC5 unicast link, the second authentication response indicating successful authentication of the second WTRU by the first WTRU; and
send, via the transceiver, a DNS response comprising the IP address of the second WTRU to the first WTRU via the first PC5 unicast link based on the successful authentication of the first WTRU by the second WTRU, and the successful authentication of the second WTRU by the first WTRU.
2 . The relay WTRU of claim 1 , the processor further configured to:
receive, via the transceiver, a second DNS query comprising an application identifier (ID) from the first WTRU via the first PC5 unicast link, wherein the second DNS query is received prior to receipt of the first DNS query;
send, via the transceiver, a list of application layer IDs of respective WTRUs that support the application ID to the first WTRU via the first PC5 unicast link; and
subsequent to sending the list of application layer IDs, receive, via the transceiver, the first DNS query requesting the IP address of the second WTRU from the first WTRU via the first PC5 unicast link, wherein the IP address of the second WTRU was determined from the list of application layer IDs.
3 . The relay WTRU of claim 1 , the processor further configured to store at least one of:
an indication that the first WTRU is authorized to communicate with the second WTRU; or
an indication that the second WTRU is authorized to communicate with the first WTRU.
4 . The relay WTRU of claim 1 , the processor further configured to:
receive, via the transceiver, a second DNS query requesting an internet protocol (IP) address of the second WTRU from the first WTRU via the first PC5 unicast link, wherein the second DNS query is received prior to receipt of the first DNS query;
send, via the transceiver, a reject message to the first WTRU via the first PC5 unicast link, the reject message indicating that authorization is needed to obtain the IP address of the second WTRU; and
subsequent to sending the reject message, receive, via the transceiver, the first DNS query comprising the authentication container for the first WTRU from the first WTRU via the first PC5 unicast link.
5 . The relay WTRU of claim 4 , the processor further configured to determine that authorization is needed based on an authentication policy associated with the first WTRU and the second WTRU.
6 . A method comprising:
establishing a first PC5 unicast link between a relay wireless transmit receive unit (WTRU) and a first WTRU and a second PC5 unicast link between the relay WTRU and a second WTRU;
receiving a first domain name system (DNS) query requesting an internet protocol (IP) address of the second WTRU, the first DNS query comprising an authentication container for the first WTRU via the first PC5 unicast link;
sending a first authentication request to the second WTRU via the second PC5 unicast link, the first authentication request comprising the authentication container for the first WTRU;
receiving a first authentication response from the second WTRU via the second PC5 unicast link, the first authentication response indicating successful authentication of the first WTRU by the second WTRU and an authentication container for the second WTRU;
sending a second authentication request to the first WTRU via the first PC5 unicast link, the second authentication request comprising the authentication container for the second WTRU;
receiving a second authentication response from the first WTRU via the first PC5 unicast link, the second authentication response indicating successful authentication of the second WTRU by the first WTRU; and
sending a DNS response comprising the IP address of the second WTRU to the first WTRU via the first PC5 unicast link based on the successful authentication of the first WTRU by the second WTRU, and the successful authentication of the second WTRU by the first WTRU.
7 . The method of claim 6 , further comprising:
receiving a second DNS query comprising an application identifier (ID) from the first WTRU via the first PC5 unicast link, wherein the second DNS query is received prior to receipt of the first DNS query;
sending a list of application layer IDs of respective WTRUs that support the application ID to the first WTRU via the first PC5 unicast link;
subsequent to sending the list of application layer IDs, receiving the first DNS query requesting the IP address of the second WTRU from the first WTRU via the first PC5 unicast link, wherein the IP address of the second WTRU was determined from the list of application layer IDs.
8 . The method of claim 6 , further comprising storing at least one of:
an indication that the first WTRU is authorized to communicate with the second WTRU; or
an indication that the second WTRU is authorized to communicate with the first WTRU.
9 . The method of claim 6 , further comprising:
receiving a second DNS query requesting an internet protocol (IP) address of the second WTRU from the first WTRU via the first PC5 unicast link, wherein the second DNS query is received prior to receipt of the first DNS query;
sending a reject message to the first WTRU via the first PC5 unicast link, the reject message indicating that authorization is needed to obtain the IP address of the second WTRU; and
subsequent to sending the reject message, receiving the first DNS query comprising the authentication container for the first WTRU from the first WTRU via the first PC5 unicast link.
10 . The method of claim 9 further comprising determining that authorization is needed based on an authentication policy associated with the first WTRU and the second WTRU.