Communication method, apparatus, and system
Embodiments of this application provide a communication method, apparatus, and system, to improve security of a vehicle-to-everything (V2X) PC5 establishment procedure. In the method, a first terminal device obtains a first security protection method, where the first security protection method is a security protection method determined in a discovery procedure between the first terminal device and a second terminal device. Also in the method, the first terminal device determines a second security protection method according to the first security protection method, where the second security protection method is a security protection method for a PC5 connection between the first terminal device and the second terminal device. For example, a security level of the second security protection method is higher than a security level of the first security protection method. The communication method is applicable to the V2X communication field.
1. A communication method, wherein the method comprises:
determining, by a first terminal device, a first security protection method in a discovery procedure between the first terminal device and a second terminal device;
performing, by the first terminal device, security protection on at least one message in a PC5 establishment procedure between the first terminal device and the second terminal device using the first security protection method; and
sending, by the first terminal device, the at least one security-protected message to the second terminal device.
2. The method according to claim 1 , wherein the at least one message comprises a first message in the PC5 establishment procedure.
3. The method according to claim 1 , wherein the method further comprises:
determining, by the first terminal device, a second security protection method for a PC5 connection between the first terminal device and the second terminal device according to the first security protection method.
4. The method according to claim 3 , wherein the determining, by the first terminal device, the second security protection method according to the first security protection method comprises:
receiving, by the first terminal device, a second security policy from the second terminal device, wherein the second security policy is a security policy of the second terminal device in the PC5 connection; and
determining, by the first terminal device, the second security protection method according to the second security policy and the first security protection method.
5. The method according to claim 1 , wherein the obtaining, by the first terminal device, the first security protection method comprises:
sending, by the first terminal device, first information and 3 rd generation partnership project (3GPP) identity information of the first terminal device to a first direct communication discovery name management function network element, wherein the first information comprises identity information used for a proximity-based service (ProSe) or information used to determine the identity information used for the ProSe; and
receiving, by the first terminal device, the first security protection method from the first direct communication discovery name management function network element.
6. A communication method, wherein the method comprises:
receiving, by a first direct communication discovery name management function network element, first information and 3 rd generation partnership project (3GPP) identity information of a first terminal device from the first terminal device, wherein the first information comprises identity information used for a proximity-based service (ProSe) or information used to determine the identity information used for the ProSe;
determining, by the first direct communication discovery name management function network element based on the first information and the 3GPP identity information of the first terminal device, a security protection method required for using the ProSe by the first terminal device; and
sending, by the first direct communication discovery name management function network element to the first terminal device, the security protection method required for using the ProSe by the first terminal device.
7. The method according to claim 6 , wherein the security protection method required for using the ProSe is used to determine a security protection method for a PC5 connection between the first terminal device and the second terminal device.
8. The method according to claim 7 , wherein at least one of:
the security protection method for the PC5 connection is used to perform security protection on a part or all of parameters transferred in control plane signaling of the PC5 connection; or
the security protection method for the PC5 connection is used to perform security protection on a part or all of user plane data of the PC5 connection.
9. The method according to claim 6 , wherein the security protection method required for using the ProSe is used to perform security protection on at least one message in a PC5 establishment procedure between the first terminal device and the second terminal device.
10. The method according to claim 9 , wherein the at least one message comprises a first message in the PC5 establishment procedure.
11. A communication apparatus, comprising:
a processor coupled to a memory storing instructions and configured to execute the instructions to cause the communication apparatus to:
determine a first security protection method in a discovery procedure between the communication apparatus and a second terminal device;
perform security protection on at least one message in a PC5 establishment procedure between the communication apparatus and the second terminal device by using the first security protection method; and
send the at least one security-protected message to the second terminal device.
12. The communication apparatus according to claim 11 , wherein the at least one message comprises a first message in the PC5 establishment procedure.
13. The communication apparatus according to claim 11 , wherein the instructions further cause the communication apparatus to determine a second security protection method according to the first security protection method, wherein the second security protection method is a security protection method for a PC5 connection between the communication apparatus and the second terminal device.
14. The communication apparatus according to claim 13 , wherein the instructions cause the communication apparatus to determine the second security protection method by:
receiving a second security policy from the second terminal device, wherein the second security policy is a security policy of the second terminal device in the PC5 connection; and
determining the second security protection method according to the second security policy and the first security protection method.
15. The communication apparatus according to claim 11 , wherein the instructions cause the communication apparatus to obtaini the first security protection method by:
sending first information and 3 rd generation partnership project (3GPP) identity information of the communication apparatus to a first direct communication discovery name management function network element, wherein the first information comprises identity information used for a proximity-based service (ProSe) or information used to determine the identity information used for the ProSe; and
receiving the first security protection method from the first direct communication discovery name management function network element.
16. A first direct communication discovery name management function network element, comprising:
a processor coupled to a memory storing instructions and configured to execute the instructions to cause the first direct communication discovery name management function network element to:
receive first information and 3 rd generation partnership project (3GPP) identity information of a first terminal device from the first terminal device, wherein the first information comprises identity information used for a proximity-based service (ProSe) or information used to determine the identity information used for the ProSe;
determine, based on the first information and the 3GPP identity information of the first terminal device, a security protection method required for using the ProSe by the first terminal device; and
send, to the first terminal device, the security protection method required for using the ProSe by the first terminal device.
17. The first direct communication discovery name management function network element according to claim 16 , wherein the security protection method required for using the ProSe is used to determine a security protection method for a PC5 connection between the first terminal device and the second terminal device.
18. The first direct communication discovery name management function network element according to claim 17 , wherein at least one of:
the security protection method for the PC5 connection is used to perform security protection on a part or all of parameters transferred in control plane signaling of the PC5 connection; or
the security protection method for the PC5 connection is used to perform security protection on a part or all of user plane data of the PC5 connection.
19. The first direct communication discovery name management function network element according to claim 16 , wherein the security protection method required for using the ProSe is used to perform security protection on at least one message in a PC5 establishment procedure between the first terminal device and the second terminal device.
20. The first direct communication discovery name management function network element according to claim 19 , wherein the at least one message comprises a first message, and the first message is a first message in the PC5 establishment procedure.