Methods and apparatus for direct communication key establishment
Methods And Apparatus For Direct Communication Key Establishment Methods ( 100, 200, 300 ) and apparatus ( 400, 500, 600, 700, 800, 900 ) are disclosed for establishing a key for direct communication between a User Equipment device, UE, and a device. The methods and apparatus cooperate to form a system for securing direct communication between a UE and a device over an interface. The system comprises a UE ( 20 ), a device ( 30 ) and a Direct Communication Element ( 40 ). The Direct Communication Element ( 40 ) is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a direct communication key from at least the shared session key, and to send the direct communication key and the GPI to the device ( 30 ). The device ( 30 ) is configured to send the GPI to the UE ( 20 ). The UE ( 20 ) is configured to derive the shared session key from at least the GPI and to derive the direct communication key from the shared session key. Also disclosed are a computer product operable to carry out methods according to the present invention and a computer program product comprising a computer readable medium having such a computer product stored thereon.
1. A method performed by a user equipment (UE) for obtaining a key for direct communication with a device over an interface, the method comprising:
sending to the device an identifier of the UE and requesting key generation for direct communication with the device;
receiving from the device a Message Authentication Code (MAC) with a device identifier and key generation information;
deriving a session shared key from at least the key generation information; and
deriving a direct communication key from at least the session shared key and the identifier of the device, wherein the MAC is generated using the direct communication key.
2. The method as claimed in claim 1 , wherein the interface comprises a Proximity Services, ProSe, interface.
3. The method as claimed in claim 1 , further comprising discovering the device through a discovery procedure.
4. The method as claimed in claim 3 , wherein at least one of the UE identifier, the device identifier or the request for key generation is comprised within a discovery procedure message.
5. The method as claimed in claim 1 , further comprising receiving a discovery message from the device, wherein the discovery message includes the identifier of the device.
6. The method as claimed in claim 5 , wherein sending the identifier of the UE and requesting key generation for direct communication with the device comprises sending a discovery response message responding to the received discovery message.
7. The method as claimed in claim 1 , wherein the key generation information comprises Generic Bootstrapping Architecture Push Information.
8. A method performed by a device, for obtaining a key for direct communication with a user equipment (UE) over an interface, the method comprising:
receiving from the UE an identifier of the UE and a request for key generation for direct communication with the device;
sending to a Direct Communication Element the UE identifier and an identifier of the device, and requesting the Direct Communication Element to provide the device with a direct communication key;
receiving from the Direct Communication Element the direct communication key and key generation information; and
sending a Message Authentication Code (MAC) with the key generation information and the device identifier to the UE, wherein the MAC is generated using the direct communication key.
9. The method as claimed in claim 8 , wherein the interface comprises a Proximity Services, ProSe, interface, and the Direct Communication Element comprises at least one of a ProSe Function or a ProSe Key Management server, KMS.
10. The method as claimed in claim 8 , further comprising receiving from the UE an identifier of the Direct Communication Element.
11. The method as claimed in claim 8 , further comprising discovering the UE through a discovery procedure.
12. The method as claimed in claim 11 , wherein at least one of the UE identifier, the device identifier or the request for key generation is comprised within a discovery procedure message.
13. The method as claimed in claim 8 , further comprising sending a discovery message to the UE, wherein the discovery message includes the identifier of the device.
14. The method as claimed in claim 13 , wherein receiving from the UE an identifier of the UE and a request for key generation for direct communication with the device comprises receiving a discovery response message responding to the sent discovery message.
15. The method as claimed in claim 8 , wherein the key generation information comprises Generic Bootstrapping Architecture Push Information.
16. A method performed by a Direct Communication Element, for establishing a key for direct communication over an interface between a user equipment (UE) and a device, the method comprising:
receiving from the device an identifier of the UE, an identifier of the device and a request to provide a direct communication key to the device;
sending the UE identifier to a Bootstrapping Server Function, BSF, associated with the UE and requesting key generation information from the BSF;
receiving from the BSF a session shared key and key generation information;
deriving the direct communication key from at least the session shared key and the device identifier, wherein the direct communication key is used to generate a Message Authentication Code (MAC), wherein the MAC is sent by the device to the UE with the key generation information and the device identifier; and
sending the direct communication key and the key generation information to the device.
17. The method as claimed in claim 16 , wherein the interface comprises a Proximity Services (ProSe) interface, and the Direct Communication Element comprises at least one of a ProSe Function or a ProSe Management Server.
18. The method as claimed in claim 16 , further comprising checking that at least one of the device or the UE is authorised to establish direct communication.
19. The method as claimed in claim 16 , further comprising mapping the received UE identifier to a public UE identifier and sending the public UE identifier to the BSF.
20. The method as claimed in claim 16 , wherein the device comprises a UE-to-Network Relay.
21. The method as claimed in claim 16 , wherein the key generation information comprises Generic Bootstrapping Architecture Push Information.
22. A system for securing direct communication between a user equipment (UE) and a device over an interface, the system comprising:
a UE;
a device; and
a Direct Communication Element, wherein
the Direct Communication Element is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a direct communication key from at least the shared session key, and to send the direct communication key and the GPI to the device,
the device is configured to send the GPI to the UE, and
the UE is configured to derive the shared session key from at least the GPI and to derive the direct communication key from the shared session key, wherein the direct communication key is used to generate a Message Authentication Code (MAC), wherein the MAC is sent by the device to the UE with the key generation information and the device identifier.