Relay UE and remote UE authorization
A method performed by a relay UE for determining whether the relay UE may provide a relay service to a remote UE. The method includes the relay UE receiving from the remote UE a first message comprising a first authorization token and a first digital signature for verifying the authenticity of the first authorization token, wherein the first digital signature was generated by a first network function using the first authorization token and a first key, and the first authorization token indicates whether or not the remote UE is authorized to utilize a relay service provided by the relay UE. The method further includes the relay UE verifying the authenticity of the first authorization token.
1. A method performed by a relay user equipment (UE) for determining whether the relay UE is authorized to provide a relay service to a remote UE, the method comprising:
the relay UE receiving from the remote UE a first message comprising a first authorization token and a first digital signature for verifying the authenticity of the first authorization token, wherein the first digital signature was generated by a first network function implemented in a network using the first authorization token and a first key, and the first authorization token indicates whether or not the remote UE is authorized to utilize a relay service provided by the relay UE;
the relay UE verifying the authenticity of the first authorization token; and
the relay UE transmitting to the remote UE a second message comprising a second authorization token and a second digital signature for verifying the authenticity of the second authorization token, wherein
the second digital signature was generated by a second network function implemented in the network or the first network function, and
the second authorization token indicates that the relay UE is authorized to provide a relay service to the remote UE.
2. The method of claim 1 , wherein the second digital signature was generated using the first key.
3. The method of claim 1 , further comprising:
prior to the relay UE transmitting to the remote UE the second message comprising the second authorization token, the relay UE receiving a third message comprising the second authorization token and the second digital signature.
4. The method of claim 1 , wherein the first authorization token further includes one or more of the following:
information specifying a time at which the first authorization token expires,
a UE identifier associated with the remote UE or with a group of UEs that includes the remote UE,
relay type information identifying a type of relay UE that the remote UE is authorized to utilize,
layer information indicating whether the remote UE supports layer-2 relaying and/or layer-3 relaying,
location information identifying one or more geographical areas, or
quality-of-service (QOS) information.
5. The method of claim 1 , wherein the step of verifying the authenticity of the first authorization token comprises the relay UE requesting a network function to verify the authenticity of the first authorization token.
6. The method of claim 1 , wherein
the first authorization token comprises a UE identifier that identifies a particular UE, and the method further comprises the relay UE determining whether the remote UE is the particular UE identified by the UE identifier, or
the first authorization token comprises a UE identifier that identifies a group of UEs, and the method further comprises the relay UE determining whether the remote UE is included in the group of UEs identified by the UE identifier.
7. A method performed by a remote user equipment (UE) for determining whether a relay UE is authorized to provide a relay service to the remote UE, the method comprising:
the remote UE receiving from the relay UE a first message comprising a first authorization token and a first digital signature for verifying the authenticity of the first authorization token, wherein the first digital signature was generated by a first network function implemented in a network using the first authorization token and a first key, and the first authorization token indicates whether or not the relay UE is authorized to provide a relay service to the remote UE; and
the remote UE verifying the authenticity of the first authorization token; and
the remote UE transmitting to the relay UE a second message comprising a second authorization token and a second digital signature for verifying the authenticity of the second authorization token, wherein
the second digital signature was generated by a second network function implemented in the network or the first network function, and
the second authorization token indicates that the remote UE is authorized to utilize a relay service provided by the relay UE.
8. The method of claim 7 , wherein the second digital signature was generated using the first key.
9. The method of claim 7 , further comprising:
prior to the remote UE transmitting to the relay UE the second message comprising the second authorization token, the remote UE receiving a third message comprising the second authorization token and the second digital signature.
10. The method of claim 7 , wherein the first authorization token further includes one or more of the following:
information specifying a time at which the first authorization token expires,
a UE identifier associated with the relay UE or with a group of UEs that includes the relay UE,
service types that the relay UE supports,
application types that the relay UE supports,
traffic types that the relay UE supports,
remote UE type information identifying a type of remote UE that the relay UE is authorized to serve,
layer information indicating whether the relay UE supports layer-2 relaying and/or layer-3 relaying,
a list of one or more Public Land Mobile Network (PLMN) identifies identifying PLMN that the relay is authorized to access,
location information identifying one or more geographical areas, or
quality-of-service information.
11. The method of claim 7 , wherein the step of verifying the authenticity of the first authorization token comprises the remote UE requesting a network function to verify the authenticity of the first authorization token.
12. The method of claim 7 , wherein
the first authorization token comprises a UE identifier that identifies a particular UE, and the method further comprises the remote UE determining whether the relay UE is the particular UE identified by the UE identifier, or
the first authorization token comprises a UE identifier that identifies a group of UEs, and the method further comprises the remote UE determining whether the relay UE is included in the group of UEs identified by the UE identifier.
13. A method performed by a first network node, the method comprising:
receiving a first request message; and
transmitting a first response message responsive to the first request message, wherein
the first response message comprises an authorization token and a digital signature for verifying the authenticity of the authorization token,
the digital signature was generated using a first key, and
the authorization token indicates at least one of: i) that a user equipment (UE) is authorized to utilize a relay service provided by one or more relay UEs or ii) that the UE is authorized to provide a relay service to one or more remote UEs.
14. The method of claim 13 , wherein the first response message further comprises a second key that is paired with the first key, which second key can be is used to verify the authenticity of the authorization token.