Protection of communications through user equipment relay

1. One or more non-transitory computer-readable media having instructions that, when executed by one or more processors, cause a source user equipment (UE) to:

access provision information to determine a pair of encryption keys associated with the source UE, the pair of encryption keys to include a public key and a private key;

broadcast, by the source UE, a direct communication request that includes the public key to trigger a peer UE discovery;

receive, from a target UE, a direct communication accept message that includes a public key associated with the target UE;

decrypt communications from the target UE based on the private key associated with the source UE; and

encrypt communications to the target UE based on the public key associated with the target UE.

2. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed, further cause the source UE to:

transmit the encrypted communications to the target UE over an end-to-end secured unicast link between the source UE and the target UE.

3. The one or more non-transitory computer-readable media of claim 2 , wherein the end-to-end secured unicast link traverses a relay UE.

4. The one or more non-transitory computer-readable media of claim 3 , further comprising:

generate a message, with a source Layer-2 identifier that is accessible to the relay UE, to include the encrypted communications.

5. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed, further cause the source UE to:

generate the direct communication request to include a list of supported security algorithms.

6. The one or more non-transitory computer-readable media of claim 5 , wherein the instructions, when executed, further cause the source UE to:

extract, from the direct communication accept message, a security algorithm selected by the target UE from the list of supported security algorithms.

7. The one or more non-transitory computer-readable media of claim 6 , wherein the instructions, when executed, further cause the source UE to:

encrypt communications to the target UE based on the security algorithm; and

transmit the encrypted communications to the target UE via an end-to-end secured unicast link via a UE-to-UE relay.

8. The one or more non-transitory computer-readable media of claim 1 , wherein the instructions, when executed, further cause the source UE to:

generate the direct communication request to include an indication that an elliptic-curve Diffie-Hellman (ECDH) key agreement protocol is to be used to secure a unicast link between the source UE and the target UE.

9. The one or more non-transitory computer-readable media of claim 8 , wherein the instructions, when executed, further cause the source UE to:

generate a shared key based on the ECDH key agreement protocol, the public key associated with the target UE, and the private key associated with the source UE; and

encrypt communications to the target UE using the shared key.

10. A first user equipment (UE) comprising:

memory circuitry to store a private key associated with the first UE and a security credential for an elliptic curve Diffie-Hellman (ECDH) key agreement protocol; and

processing circuitry, coupled with the memory circuitry, the processing circuitry to:

determine, at the first UE, a public key associated with a second UE; and

determine, at the first UE, a shared key based on the security credential, the public key associated with the second UE, and the private key associated with the first UE.

11. The first UE of claim 10 , wherein the processing circuitry is further to:

transmit, to the second UE, a direct communication accept message with an indication of the public key associated with the first UE.

12. The first UE of claim 10 , wherein the first UE is a target UE, the second UE is a source UE, and the processing circuitry is further to:

receive a direct communication request from the source UE, the direct communication request to include an indication of the public key associated with the source UE and an indication of the security credential.

13. The first UE of claim 12 , wherein the indication of the security credential is a credential identifier or a name of the security credential.

14. The first UE of claim 13 , wherein the indication of the security credential is a credential identifier and the processing circuitry is further to:

receive, from a proximity services function in a core network, provisioning information that maps one or more credential identifiers to corresponding one or more credentials; and

determine, the credential identifier corresponds to the security credential based on the provisioning information.

15. The first UE of claim 12 , wherein the direct communication request includes indications of a plurality of security credentials including the security credential and the processing circuitry is further to:

select the security credential based on the security credential being available at the first UE; and

include, within a direct communication accept message, an indication of the selection of the security credential.

16. The first UE of claim 10 , wherein the first UE is a source UE, the second UE is a target UE, and the processing circuitry is further to:

generate a direct communication request to include the public key associated with the first UE, and indication that the ECDH key agreement protocol is to be used, and an indication of the security credential; and

transmit the direct communication request to a relay UE.

17. A method of operating a first user equipment (UE,) the method comprising:

transmitting, by the first UE, a direct communication request that includes a public key associated with the first UE and an indication that an elliptic curve Diffie Hellman (ECDH) key agreement protocol is to be used to establish a secure connection;

receiving, from a second UE via a relay UE, a direct communication accept message that includes a public key associated with the second UE; and

determining a shared secret based on the ECDH key agreement protocol and the public key associated with the second UE.

18. The method of claim 17 , further comprising: generating the direct communication request to further include an indication of a security credential to be used with the ECDH key agreement protocol.

19. The method of claim 18 , wherein the indication is a name of the security credential or a credential identifier associated with the security credential.

20. The method of claim 17 , further comprising:

receiving configuration information to configure the first UE with only one security credential to be used with the ECDH key agreement protocol; and

determining the shared secret using the one credential with the ECDH key agreement protocol.