Method and apparatus to perform device to device communication in wireless communication network

A method and an apparatus for verifying identity of a direct communication message using asymmetric keys in a wireless communication network comprising a plurality of electronic devices is provided. The method includes distributing a public key associated with a second electronic device among a plurality of electronic devices by a Device-to-Device (D2D) server. The method includes receiving the direct communication message from the second electronic device at a first electronic device. The direct communication message comprises a digital signature generated using a private key associated with the second electronic device. Further, the method includes verifying the identity of the direct communication message using the public key associated with the second electronic device.

PRIORITY

This application is a National Phase Entry of PCT International Application No. PCT/KR2014/010297, which was filed on Oct. 30, 2014, and claims a priority to Indian Provisional Patent Application No. 4896/CHE/2013, which was filed on Oct. 30, 2013, and claims a priority to Indian Complete Patent Application No. 4896/CHE/2013, which was filed on Oct. 27, 2014 the contents of which are incorporated herein by reference.

TECHNICAL FIELD

The present invention relates to wireless communication networks and more particularly relates to a method and system for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network.

BACKGROUND ART

Proximity services (ProSe) may support Device-to-Device (D2D) communication in a cellular technology ecosystem. ProSe may rely on the proximity between two or more electronic devices, (for example, User Equipment (UEs) or Mobile Stations (MSs)), and allow specific commercial and social applications, network offloading, or public safety direct communications. Other alternatives, such as Wi-Fi or Bluetooth, may also support D2D communication, but they may operate on a license-exempt band (unlicensed spectrum), and thus they may be subject to higher interference and lower quality of service (QoS). ProSe may use D2D discovery and various communication procedures to address these issues.

Third Generation Partnership Project (3GPP) is currently focusing on a UE's ability to discover other UEs in its vicinity by using direct UE-to-UE signaling with E-UTRA. Further, the 3GPP is considering procedure for discovery, signaling between involved UEs, criteria to determine proximity, support of discovery of UEs subscribed to different operators and direct user plane packets communication. The D2D communication enables an electronic device to directly discover, communicate and exchange data with a neighboring electronic device without the help of a cellular network, and each electronic device for the D2D communication broadcasts the electronic devices own information in order to inform other electronic devices of information on itself. In case of open discovery, there is no explicit permission that is needed from the UE being discovered and restricted discovery needs an explicit permission from the UE that is being discovered. There are two possible D2D discovery enablers: direct communication and standalone services. When the UE receives a discovery message (a direct communication message), there is need for authenticity verification of the direct communication message. The authenticity verification of the direct communication message is needed so as to confirm the information provided in the direct communication message is from an authenticated UE.

Further, it is necessary to ensure that no malicious UE is impersonating the actions of another genuine UE. Authenticity verification is recommended for both open and restricted discovery. For standalone service case, the authentic verification to be completed without any further message exchange with the UE to be discovered. For direct communication, it is possible to verify the authenticity, by running authentication procedure as subsequent messages exchanges are possible.

DISCLOSURE

Technical Problem

The principal object of the embodiments herein is to provide a method and system for verifying identity of a direct communication message by the receiving electronic devices using asymmetric keys in a wireless direct communication network.

Another object of the invention is to provide a method to identity authenticity verification when electronic devices communicate directly with each other in a network coverage area or when the electronic devices are out of the coverage area.

Another object of the invention is to provide a method for securing the direct communication message by an electronic device and the wireless direct communication network by deriving a digital signature.

Technical Solution

Accordingly the invention provides a method for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network comprising a plurality of electronic devices, wherein the method comprises distributing by a Device-to-Device (D2D) server a public key associated with a second electronic device distributed among the plurality of electronic devices. Further, the method comprises receiving at a first electronic device the direct communication message from the second electronic device, wherein the direct communication message comprises a digital signature generated using a private key associated with the second electronic device by the second electronic device. Furthermore, the method comprises verifying at the first electronic device the identity of the direct communication message using the public key associated with the second electronic device.

Accordingly the invention provides a method for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network comprising a plurality of electronic devices, wherein the method comprises obtaining a private key associated with a first electronic device by registering for D2D services with the wireless direct communication network at the first electronic device. The method comprises sending the direct communication message including digital signature using the private key by the first electronic device to a second electronic device. Further, the method comprises verifying the identity of the direct communication message by verifying the digital signature included in the direct communication message using the identity of the first electronic device as the public key at the second electronic device.

Accordingly the invention provides a User Equipment (UE) for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network, wherein the UE is configured to receive the direct communication message from another UE, wherein the direct communication message comprises a digital signature generated using a private key associated with another UE. Further, the UE is configured to verify the identity of the direct communication message by verifying the digital signature included in the direct communication message using the public key associated with another UE.

Accordingly the invention provides a User Equipment (UE) for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network comprising a plurality of electronic devices, wherein the UE is configured to receive the direct communication message including digital signature using a private key from another UE. Further, the UE is configured to verify the identity of the direct communication message by verifying the digital signature included in the direct communication message using an identity of another UE as public key.

Accordingly the invention provides a wireless direct communication network for receiving a public key of a User Equipment (UE), the wireless direct communication network comprises a Bootstrapping server Function (BSF) entity, a Direct Provisioning Function (DPF) entity, a Home Subscription Server (HSS) and a Device to Device (D2D) server, wherein the D2D server is configured to distribute the public key associated with the UE among the plurality UEs.

Accordingly the invention provides a method for verifying identity of a direct communication message using asymmetric keys in a wireless direct communication network comprising a plurality of electronic devices, wherein the method comprises distributing by a primary network node a public key associated with a second electronic device distributed among the plurality of electronic devices. Further, the method comprises receiving at a first electronic device the direct communication message from the second electronic device, wherein the direct communication message comprises a digital signature generated using a private key associated with the second electronic device. Furthermore, the method comprises verifying at the first electronic device the identity of the direct communication message using the public key associated with the second electronic device.

MODE FOR INVENTION

The embodiments herein achieve a method to verify identity of a direct communication message using asymmetric keys in a wireless direct communication network comprising a plurality of electronic devices is provided. The method includes distributing a public key associated with a second electronic device among a plurality of electronic devices by a Device-to-Device (D2D) server. The method includes distributing the private key associated with second electronic device to the second electronic device. The method includes receiving a direct communication (e.g. discovery announcement) message from the second electronic device at a first electronic device. The direct communication message comprises a digital signature generated using a private key associated with the second electronic device.

Further, the method includes verifying the identity of the direct communication message using the public key associated with the second electronic device at the first electronic device.

Unlike the conventional method, the proposed method provides the usage of public key cryptography to identity authenticity verification in D2D communication that can mitigate the risk during the D2D communication. The disclosed method provides the mechanism for identity authenticity verification when the electronic devices communicate directly with each other in a network coverage area or when the electronic devices are out of the coverage area of the network.

Further, the disclosed method provides a mechanism for securing direct communication message by the electronic device and the wireless direct communication network by deriving the digital signature using one or more network controlled parameters with time stamp and the public key of the electronic device.

The electronic device can be a User Equipment (UE). The method for verifying identity of the direct communication message using asymmetric keys in a wireless direct communication network can be applicable for various electronic devices including the UE. The public key of the electronic device and other keys associated with the various Network Application Functions (such as D2D server, Direct Provisioning Function (DPF) entity and so on) are provided in the description with respect to the UE. It can be understood that the public key can be associated with the electronic device (in a general scenario) even through it is not explicitly mentioned throughout the description.

Throughout the description, the terms D2D communication, Prose communication, direct communication and P2P communication will have the same meaning.

Throughout the description, the term direct communication message refers to a discovery announcement message or a unicast/group cast/broadcast communication packet carrying Internet Protocol (IP) or other upper layer user information or a unicast/group cast/broadcast communication packet carrying control signaling or a unicast/group cast/broadcast user plane packet.

Further, the D2D server can be a primary network node, a Bootstrapping server Function (BSF) entity can be a first network node, a DPF entity is a second network node and a Home Subscription Server (HSS) is a third network node in the wireless communication network according to the below description.

Referring now to the drawings and more particularly toFIGS. 1 through 11where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments.

FIGS. 1A and 1Billustrate electronic devices communicating securely in a wireless direct communication network, according to embodiments as disclosed herein. As depicted in theFIG. 1A, the electronic devices100and100aare connected to a network node102, for example, a base station. The electronic device100or electronic device100acan be a mobile phone, a smart phone, Personal Digital Assistants (PDAs), a tablet and the like.

The electronic device100is in proximity to the electronic device100awhere both the devices are in a radio coverage area of the network node102as shown in theFIG. 1A.

The electronic device100is in the radio coverage area of the network node102and the electronic device100is in proximity to the electronic device100ain a radio coverage area of a Network node104as shown in theFIG. 1B. In an embodiment, the electronic device100is in proximity to the electronic device100awhere both the devices are not in a radio coverage area of the any network node (out-of-coverage). In an embodiment, the electronic device100is in proximity to the electronic device100awhere one of the device is in a radio coverage area of the any network node and other device is not in coverage of any network node.

In an embodiment, the electronic device100asends the public key to the D2D server may be through various network elements (not shown in the figure and is explained in the later parts of the description). The D2D server distributes the public key of the electronic device among the plurality of electronic devices interested in D2D services.

In an embodiment, the electronic device100registers for D2D services with the wireless communication network (e.g. ProSe Function) and obtains the public key of the electronic device100a. The electronic device100abroadcasts an direct communication message with a digital signature using a private key. The private key may be obtained by the obtained by the electronic device100afrom the D2D server or may generate itself or may obtain the same from a designated network entity. When the electronic device100receives the direct communication message from the electronic device100a, the electronic device100verifies the identity of the direct communication message using the public key of the electronic device100a.

In an embodiment, if Identity-based cryptography is used, then the electronic device100aregisters for D2D services with the wireless communication network (ProSe Function) and obtains private key (key material associated with its identity). The electronic device100amay sign the direct communication message using the private key associated with it (the identity of the electronic device100a). The electronic device100monitors for the direct communication message in its proximity. When the electronic device100receives the direct communication message from the electronic device100a, the electronic device100verifies the identity of the direct communication message (origin of the message) using the identity of the electronic device100a. In an embodiment, if the electronic device100asends the direct communication message to communication message to the electronic device100, then electronic device100aencrypts the message using the identity of the electronic device100. When the electronic device100receives the encrypted message from the electronic device100a, the electronic device100decrypts the message using the private key associated with it.

Throughout the description, the terms first electronic device100and the electronic device100are used interchangeably.

Throughout the description, the terms second electronic device100aand the electronic device100aare used interchangeably.

FIG. 2illustrates a block diagram of an electronic device with various modules, according to the embodiments as disclosed herein. The electronic device100includes a communication interface module202, a controlling module204, a Universal Integrated Circuit Card (UICC) module206and a memory module208. The communication interface module202helps the UE100to connect to the wireless direct communication network that may include but not limited to a plurality of eNBs.

In an embodiment, the method allows the controlling module204to perform one or more actions for verifying the identity of the direct communication message using the asymmetric keys. The method allows the controlling module204to generate the direct communication message. The direct communication message comprises a digital signature generated using a private key and/or encrypted using a private key associated with the electronic device100a. The method400allows the controlling module204to verify and/or decrypt the direct communication message using the public key associated with the second electronic device100a. In an embodiment, the public key being the identity of the electronic device or identity of the user of electronic device or identity of the user specific to application running on the electronic device.

The UICC module206enables the communication between the electronic device100and the wireless communication network through the communication interface module202. The UICC module206is a smart card on the electronic device100which is referred as a Subscriber Identity Module (SIM) in second Generation (2G) context and also referred as Universal SIM (USIM) in third Generation (3G) context. The UICC module206includes a memory that may store information and instructions. In an embodiment, the UICC module206generates GBA specific key, Ks. The electronic module uses the shared key, Ks to generate a shared secret key, which is used to ensure security on the Ua interface, thus enabling a secure channel between the electronic device100and a Network Application Function (NAF).

The memory module208may include a random access memory (RAM) or another type of storage device such as a flash memory that may store information and instructions, for example an application, for execution by processor, a read-only memory (ROM) device or another type of static storage device. The memory module208stores the public key distributed by the D2D server. In an embodiment, the public key is obtained from the memory module208for verifying the identity of the direct communication message from the electronic device100a.

FIG. 3illustrates network architecture with various network elements for verifying identity of a direct communication message using asymmetric keys in the wireless communication network (direct communication), according to the embodiments as disclosed herein. The network architecture100includes the electronic device100a, a bootstrapping server function (BSF) entity302, a Home Subscription Server (HSS)304and at least one NAF306. The HSS304and the BSF entity302may be hosted in one or more network devices and/or servers that are part of the infrastructure of the network architecture100. The NAF306includes a Direct Provisioning Function (DPF) entity306aand a D2D server306b(not shown in the figure). In an embodiment, the DPF entity306aand the D2D server306bmay be co-located as a single entity.

The HSS304interfaces with the BSF entity302through Zh interface as shown inFIG. 3. The HSS304includes a database that contains mobile subscriber information, including an International Mobile Subscriber Identity (IMSI) for each electronic device100abelonging to the subscriber. The IMSI is a unique number that is associated with the electronic device100ain the wireless communication network. The IMSI is also stored in the UICC module of each electronic device100a.

The BSF entity302is communicatively coupled to the electronic device100athrough the Ub interface. This interface may be a wired or wireless interface. The Ub interface is defined by the 3GPP Generic Bootstrapping Architecture (GBA) specification. The BSF entity302and the electronic device100arun the 3GPP GBA protocol to generate a shared key, Ks. The electronic device100auses the shared key, Ks to generate a shared secret key, which is used to ensure security on the Ua interface, thus enabling a secure interface between the electronic device100aand the NAF306.

The BSF entity302interfaces with the NAF306or with a trusted application running on the NAF306through the Zn interface. The Zn interface is typically an operator-specific or proprietary protocol. The Zn interface may allow a generic NAF, such as a trusted application running on the electronic device100a, to fetch the key agreed by the BSF entity302during a previous GBA protocol transfer over the Ub interface between the BSF entity302and the electronic device100a. Thus, the NAF306receives the shared secret key, from the BSF entity302over the Zn interface.

In an embodiment, the BSF entity302is configured to receive the public key from the electronic device100aor any other possible network entity (for example, Key Management System (KMS)). The BSF entity302obtains a key request from a DPF entity306with a Bootstrapping Transaction Identifier (B-TID) and sends the public key to DPF entity306in response to the key request from the DPF entity306.

Further, the BSF entity302is configured to obtain a key request from the D2D server306bwith the B-TID. The BSF entity302sends the public key to the D2D server306bin response to receiving the key request from the D2D server306b.

In an embodiment, the HSS304is configured to receive the public key from the electronic device100a. Further, the HSS304sends the public key to the BSF entity302through a Generic Bootstrapping Architecture (GBA) User Security Settings (GUSS). The GUSS is stored in the HSS304. In an embodiment, the DPF entity306ais configured to receive the public key from the electronic device100aor any other possible network entity (for example KMS) directly. The DPF entity306aobtains a key request from the electronic device100(not shown inFIG. 3) and sends the public key to the electronic device100in response to the key request from the electronic device100, if it is authorized for receiving the direct communication message from the electronic device100a. Asymmetric security keys can provide protection against impersonation by monitoring ProSe electronic device100, especially for one to many communication scenarios. Public Key of the ProSe electronic device100aor ProSe application in the ProSe electronic device100ais provided to ProSe server securely and ProSe server distributes the Public Key to the authorized ProSe electronic devices for direct communication message verification (e.g. discovery information verification in case of D2D discovery service). In case of D2D discovery service, once the Prose electronic device100agets authorized and configured for ProSe discovery, then the ProSe electronic device100astarts sending its announcement for other electronic devices to discover it. The direct communication message is digitally signed using its private key and the direct communication message carries the digital signature. When this direct communication message is received by other prose electronic devices which are in interest to communicate with this electronic device100a, would have obtained public key of this electronic device100afrom the D2D Server. So the monitoring ProSe electronic devices verify the authenticity of the direct communication message.

FIG. 4is a flow diagram explaining a method400for verifying identity of the direct communication message using asymmetric keys in a wireless communication network, according to the embodiments as disclosed herein. In an embodiment, at step402, the method400includes distributing a public key to a plurality of electronic devices by the D2D server306b. In an embodiment, the method400allows the D2D server306bto obtain the public key from various network elements or from the electronic device directly and the method400allows the D2D server306bto distribute the public key among the plurality of electronic devices.

In an embodiment, the D2D server306bsends a key request message with a Bootstrapping Transaction Identifier (B-TID) and a D2D server ID to the BSF entity302. The B-TID is received from the electronic device100aby the D2D server306b. The BSF entity302sends the public key of the second electronic device100aand the D2D server specific key (in association with the electronic device100a) in a key response message to the D2D server.

In an embodiment, the D2D server306bobtains the public key of the second electronic device100ain a message from the second electronic device100a. The message from electronic device100ato the D2D server306bmay comprises one or more of the B-TID, MAC, D2D server ID along with the public key of the second electronic device100a. In an embodiment, the message can be a PC3 interface (defined in TS 23.303) specific protocol message. For example, in case of D2D discovery service this message is the Get Expression code request message. In an embodiment, the D2D server306bobtains the public key of the second electronic device100ain a register key message from the second electronic device100a. The register key message comprises the B-TID, MAC, D2D server ID along with the public key of the second electronic device100a. Further, the D2D server obtains the D2D server specific key in a key response message from the BSF entity102.

At step402, the D2D server306bprovides the public key of the second electronic device100ato the first electronic device100in response to the request message from the first electronic device100. In an embodiment, the request message can be a PC3 interface (defined in TS 23.303) specific protocol message. For example, in case of D2D discovery service this message is the Get Expression code request message. In an embodiment, request message can be a key request message. In an embodiment, request message can be a service authorization message.

In an embodiment at step402, the D2D server306balso provides the private key of the second electronic device100ain a PC3 interface (defined in TS 23.303) specific protocol message to the second electronic device100a. In an embodiment, the D2D server306bmay obtain the private key associated with the electronic device100afrom other possible network entities.

At step404, the method400includes receiving the direct communication message from the second electronic device100a. The direct communication message comprises a digital signature generated using a private key associated with the second electronic device. In an embodiment, the direct communication message may also be encrypted using a private key associated with the second electronic device. In an embodiment, the direct communication message is broadcasted or group casted or unicasted by the second electronic device100a. The electronic devices in the proximity or vicinity of the second electronic device100areceive the direct communication message from the second electronic device100a.

At step406, the method includes verifying the direct communication message by a first electronic device using the public key associated with the second electronic device100a.

Further, the various actions, units, steps, blocks, or acts described in the method400can be performed in the order presented, in a different order, simultaneously, or a combination thereof. Furthermore, in some embodiments, some of the actions, units, steps, blocks, or acts listed in theFIG. 4may be omitted.

FIG. 5illustrates a sequence diagram in which the electronic device sends a public key to a Bootstrapping Server Function (BSF) entity, according to the embodiments as disclosed herein. A GBA bootstrapping procedure is performed between the electronic device100aand the BSF entity302. The GBA procedure results in the electronic device100adevice and the BSF entity302each establishing a corresponding D2D shared key (Ks_UEa).

Initially, the electronic device100asends in operation502the public key (KUEa_publickey) to the BSF entity302. In an embodiment, the electronic device100asends the list of network entity IDs authorized to obtain the public key.

In an embodiment, the electronic device100sends its public key (KUEa_PublicKey) to the BSF entity302using the Ub interface for storing and forwarding it to the NAF306(which includes D2D server306band other electronic devices) as shown inFIG. 2.

In an embodiment, if the KUEa_PublicKeyis device specific key, then the electronic device100asends only device specific key to BSF entity302. In an embodiment, if the KUEa_PublicKeyis application specific key, then the electronic device100asends all the D2D application specific keys to the BSF entity302.

In an embodiment, the electronic device100apossesses device specific and application specific public keys to the BSF entity302.

The reference point Ub is between the electronic device100aand the BSF entity302. The reference point Ub provides mutual authentication between the electronic device100aand the BSF entity302. The Ub allows the electronic device100ato bootstrap the session keys based on 3GPP Authentication and Key Agreement (AKA) protocol. The HTTP Digest AKA protocol, which is specified in RFC 3310, is used on the reference point Ub.

In an embodiment, the electronic device100asends its public key as an attribute along with the “Request Authorization: Digest” message as shown below.

*86 In an embodiment, the electronic device100asends its public key in a separate HTTP digest AKA protocol message.

The BSF entity302stores the public key along with the Ks_UEaand sends the one or more public key (KUEa_PublicKey) along with the D2D server specific key (KDPF entity_UEa/KD2DSer_UEa) when requested by D2D network entities (NAFs).

The electronic device100asends in operation504the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation506a key request message with the B-TID and a DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation508a key response message with a D2D network specific entity key (KDPF entity_UEa) and one or more public key (KUEa_publickey) of the electronic device100ato the DPF entity306b. The Keys (KDPF entity_UEa/KProSeSer_UEa) are derived as specified in 3GPP TS 33.220 specification.

The DPF entity306asends in operation510the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected with (KDPF entity_UEa). In an embodiment, the configuration registration message includes the private key associated with the electronic device ID100a, if Identity based asymmetric cryptography is used. The electronic device100auses the received private key for generating the signature or to decrypt the message received from other electronic devices.

The electronic device100areceives the configuration from the DPF entity306a, derives in operation512the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a.

The electronic device100asends in operation514the Get expression code request along with the B-TID for requesting an own code to the D2D server306b. The D2D server obtains the Get expression code request from the electronic device100aand sends in operation516a key request with B-TID and the D2D server ID to the BSF entity302.

The BSF entity302sends in operation518the key response with D2D network specific entity key (KD2Dser_UEa) along with the public key to the D2D server. Further, the D2D server306bgenerates in operation520an expression code for the electronic device100aand stores mapping of the electronic device100a's expression code and B-TID and/or the public key (KUEa_publickey).

The D2D server306bsends in operation522the expression code response message to the electronic device100a. In an embodiment, the expression code response message is protected by the network specific entity key (KD2Dser_UEa). The expression code response message from the D2D server includes the expression code of the electronic device100a.

The electronic device100asends in operation524the get expression code request message to the D2D server306bwith the B-TID for requesting the expression code of the other electronic devices. The D2D server306bretrieves in operation526the expression code of other electronic devices or UEs and the corresponding public keys of the other electronic devices form a mapping table. In an embodiment, when the public key of other electronic device is unavailable in the D2D server306b, then the D2D server306bsends in operation528the key request to the BSF entity302with the B-TID (of the other electronic device) requesting for the public key of the other electronic device. The BSF entity302sends in operation530the public key of the other electronic device in a key response message to the D2D server306b.

Further, the D2D server306bsends in operation532the expression code response message that includes relevant expression codes of other electronic devices along with the public keys of the other electronic devices to the electronic device100a.

The electronic device100areceives the expression code response from the D2D server306band derives in operation534the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation536for D2D service and obtains the expression code along with the Public key (KUEa_Publickey) from the D2D server. The electronic device100abroadcasts in operation538the direct communication message to the electronic device100as shown inFIG. 5.

The electronic device100monitors in operation540for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation542the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation544the direct communication message using the public key (KUEa_publickey) of the electronic device100a. In an embodiment, the public key (KUEa_publickey) can be the identity of the announcing electronic device100a.

FIG. 6illustrates a sequence diagram in which the electronic device sends the public key to a D2D server, according to the embodiments as disclosed herein. As depicted in the sequence diagram the BSF entity302authenticates in operation602the electronic device100ausing GBA authentication procedure. The BSF entity302and the electronic device100aobtains the B-TID and the corresponding D2D shared key (Ks_UEa) as a result of GBA authentication procedure.

The second electronic device100asends in operation604the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation606a key request message with the B-TID and a DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation608a key response message with a D2D network specific entity key (KDPF entity_UEa) and to the DPF entity306b.

The DPF entity306asends in operation610the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected with (KDPF entity_UEa).

The electronic device100areceives the configuration from the DPF entity306a, derives in operation612the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a.

The electronic device100asends in operation614the Get expression code request along with the B-TID for requesting an own code to the D2D server306b. The D2D server obtains the Get expression code request from the electronic device100aand sends in operation616a key request with B-TID and the D2D server ID to the BSF entity302.

The BSF entity302sends in operation618the key response with D2D network specific entity key (KD2Dser_UEa) to the D2D server. The D2D server verifies in operation620the D2D network specific entity key (KD2Dser_UEa).

Further, the D2D server306bsends in operation622the expression code response message that includes relevant expression codes of other electronic devices along with the public keys of the other electronic devices to the electronic device100a.

The electronic device100areceives the expression code response from the D2D server306band derives in operation624the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation626for D2D service and obtains the expression code along with the Public key (KUEa_Publickey) from the D2D server. The electronic device100abroadcasts in operation628the direct communication message to the electronic device100as shown inFIG. 6.

The electronic device100monitors in operation630for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation632the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation634the direct communication message using the public key (KUEa_publickey) of the electronic device100a.

FIG. 7illustrates a sequence diagram in which the electronic device sends the public key to a Home subscription server (HSS), according to the embodiments as disclosed herein. As depicted in the sequence diagram the electronic device100asends in operation702the public key (KUEa_publickey) to the HSS304. In an embodiment, the electronic device100asends the list of network entity IDs authorized to obtain the public key. The BSF entity302authenticates in operation704the electronic device100ausing GBA authentication procedure. The BSF entity302and the electronic device100aobtains the B-TID and the corresponding D2D shared key (Ks_UEa) as a result of GBA authentication procedure.

The BSF entity302acquires in operation706the public key (KUEa_publickey) of the electronic device100afrom the GUSS which is stored in the HSS304. Further, the BSF entity302obtains the list of authorized network entities (to obtain the public key) from the GUSS in the HSS304. The second electronic device100asends in operation708the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation710a key request message with the B-TID and a DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation712a key response message with a D2D network specific entity key (KDPF entity_UEa) and the public key (KUEa_publickey) of the electronic device100ato the DPF entity306b.

The DPF entity306asends in operation714the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected by the D2D network specific entity key (KDPF entity_UEa). The electronic device100areceives the configuration from the DPF entity306a, derives in operation716the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a.

The electronic device100asends in operation718the Get expression code request along with the B-TID to the D2D server306b. The D2D server306bobtains the Get expression code request from the electronic device100aand sends in operation720a key request with B-TID and the D2D server ID to the BSF entity302.

The BSF entity302sends in operation722the key response with D2D server specific entity key (KD2Dser_UEa) along with the public key to the D2D server306b. The D2D server306bsends in operation724the expression code response message that includes relevant expression codes of other electronic devices along with the public keys of the other electronic devices to the electronic device100a. The electronic device100areceives the expression code response from the D2D server306band derives in operation726the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation728for D2D service and obtains the expression code along with the Public key (KUEa_Publickey) from the D2D server. The electronic device100abroadcasts in operation730the direct communication message to the electronic device100as shown inFIG. 7.

The electronic device100monitors in operation732for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation734the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation736the direct communication message using the public key (KUEa_publickey) of the electronic device100a.

FIG. 8illustrates a sequence diagram in which the electronic device sends the public key to the BSF entity and the BSF entity shares the public key with the D2D server, according to the embodiments as disclosed herein. As depicted in the sequence diagram the electronic device100asends in operation802the public key (KUEa_publickey) to the BSF entity302. In an embodiment, the electronic device100asends the list of network entity IDs authorized to obtain the public key.

The second electronic device100asends in operation804the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation806a key request message with the B-TID and a DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation808a key response message with a D2D network specific entity key (KDPF entity_UEa) and the public key (KUEa_publickey) of the electronic device100ato the DPF entity306b.

The DPF entity306asends in operation810the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected with (KDPF entity_UEa).

The electronic device100areceives the configuration from the DPF entity306a, derives in operation812the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a. The electronic device100asends in operation814a register key message to the D2D server306b. The Register key message comprises the D2D ID of the electronic device100aand the B-TID.

The D2D server sends in operation816a key request message with B-TID and the D2D server ID to the BSF entity302. The BSF entity302sends in operation818the key response with D2D network specific entity key (KD2Dser_UEa) along with the public key to the D2D server. Further, the D2D server306bstores in operation820mapping of the electronic device100a's D2D ID and the B-TID and/or the public key (KUEa_publickey).

The D2D server306b, after mapping the electronic device100a's expression code and B-TID and/or the public key (KUEa_publickey), sends in operation822a register key acknowledgment (ACK) message to the electronic device100a. Further, The electronic device100asends in operation824a get key request message to the D2D server306bwith the B-TID for requesting the D2D IDs of the other electronic devices (for example, the electronic device100). The D2D server306bretrieves in operation826the D2D IDs of other electronic devices or UEs and the corresponding public keys of the other electronic devices form the mapping table. In an embodiment, when the public key of other electronic device is unavailable in the D2D server306b, then the D2D server306bsends in operation828the key request to the BSF entity302with the B-TID (of the other electronic device, for example, the electronic device100) requesting for the public key of the other electronic device. The BSF entity302sends in operation830the public key of the other electronic device in a key response message to the D2D server306b.

Further, the D2D server306bsends in operation832a get key response message that includes relevant D2D IDs of other electronic devices along with the public keys of the other electronic devices to the electronic device100a.

The electronic device100areceives get key response from the D2D server306band derives in operation834the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation836for D2D services and obtains the expression code along with the public key (KUEa_Publickey) from the D2D server. The electronic device100abroadcasts in operation838the direct communication message to the electronic device100as shown inFIG. 8.

The electronic device100monitors in operation840for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation842the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation844the direct communication message using the public key (KUEa_publickey) of the electronic device100a.

FIG. 9illustrates a sequence diagram in which the electronic device sends the public key to the D2D server in a register key message, according to the embodiments as disclosed herein. As depicted in the sequence diagram the BSF entity302authenticates in operation902the electronic device100ausing GBA authentication procedure. The BSF entity302and the electronic device100aobtains the B-TID and the corresponding D2D shared key (Ks_UEa) as a result of GBA authentication procedure.

The second electronic device100asends in operation904the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation906a key request message with the B-TID and a DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation908a key response message with a D2D network specific entity key (KDPF entity_UEa) and to the DPF entity306b.

The DPF entity306asends in operation910the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected with (KDPF entity_UEa). The electronic device100areceives the configuration from the DPF entity306a, derives in operation912the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a. The electronic device100asends in operation914a register key message to the D2D server306b. The Register key message comprises the D2D ID of the electronic device100a, the B-TID, the MAC and the public key of the electronic device100a.

The D2D server sends in operation916a key request message with B-TID and the D2D server ID to the BSF entity302. The BSF entity302sends in operation918the key response with the public key to the D2D server306b. Further, the D2D server306bstores in operation920mapping of the electronic device100a's D2D ID and B-TID and/or the public key (KUEa_publickey).

The D2D server306b, after mapping the electronic device100a's expression code and B-TID and/or the public key (KUEa_publickey), sends in operation922a register key acknowledgment (ACK) message to the electronic device100a. Further, The electronic device100asends in operation924a get key request message to the D2D server306bwith the B-TID for requesting the D2D IDs of the other electronic devices (for example, the electronic device100). The D2D server306bretrieves in operation926the D2D IDs of other electronic devices or UEs and the corresponding public keys of the other electronic devices form the mapping table. In an embodiment, when the public key of other electronic devices are unavailable in the D2D server306b, then the D2D server306bsends in operation928the key request to the BSF entity302with the B-TID (of the other electronic device, for example, the electronic device100) requesting for the public key of the other electronic device. The BSF entity302sends in operation930the public key of the other electronic device in a key response message to the D2D server306b.

Further, the D2D server306bsends in operation932a get key response message that includes relevant D2D IDs of other electronic devices along with the public keys of the other electronic devices to the electronic device100a.

The electronic device100areceives the get key response from the D2D server306band derives in operation934the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation936for D2D services and obtains the public key (KUEa_Publickey) of the electronic device100a. The electronic device100abroadcasts in operation938the direct communication message to the electronic device100as shown inFIG. 9.

The electronic device100monitors in operation940for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation942the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation944the direct communication message using the public key (KUEa_publickey) of the electronic device100a.

FIG. 10illustrates a sequence diagram in which the electronic device sends the public key to the HSS and the D2D server obtains the public key from the BSF entity, according to the embodiments as disclosed herein. As depicted in the sequence diagram the electronic device100asends in operation1002the public key (KUEa_publickey) to the HSS304. In an embodiment, the electronic device100asends the list of network entity IDs authorized to obtain the public key. The BSF entity302authenticates in operation1004the electronic device100ausing GBA authentication procedure. The BSF entity302and the electronic device100aobtains the B-TID and the corresponding D2D shared key (Ks_UEa) as a result of GBA authentication procedure.

The BSF entity302acquires in operation1006the public key (KUEa_publickey) of the electronic device100afrom the GUSS which is stored in the HSS304. Further, the BSF entity302obtains the list of authorized network entities (to obtain the public key) from the GUSS in the HSS304. The second electronic device100asends in operation1008the D2D direct configuration or registration request with the B-TID to a Direct Provisioning Function (DPF) entity306a. Further, the DPF entity306bsends in operation1010a key request message with the B-TID and the DPF entity ID to the BSF entity302. The BSF entity302receives the key request from the DPF entity306aand sends in operation1012a key response message with a D2D network specific entity key (KDPF entity_UEa) and the public key (KUEa_publickey) of the electronic device100ato the DPF entity306b.

The DPF entity306asends in operation1014the D2D direct configuration registration response to the electronic device100a. In an embodiment, the configuration is protected by the D2D network specific entity key (KDPF entity_UEa). The electronic device100areceives the configuration from the DPF entity306a, derives in operation1016the KDPF entity_UEaand verifies the configuration obtained from the DPF entity306a. The electronic device100asends in operation1018a register key message to the D2D server306b. The Register key message comprises the D2D ID of the electronic device100aand the B-TID.

The D2D server sends in operation1020a key request message with B-TID and the D2D server ID to the BSF entity302. The BSF entity302sends in operation1022the key response with D2D network specific entity key (KD2Dser_UEa) along with the public key of the electronic device100ato the D2D server306b. Further, the D2D server306bstores in operation1024mapping of the electronic device100a's D2D ID and B-TID and/or the public key (KUEa_publickey).

The D2D server306b, after mapping the electronic device100a's D2D ID and B-TID and/or the public key (KUEa_publickey), sends in operation1026a register key acknowledgment (ACK) message to the electronic device100a. Further, the electronic device100asends in operation1028a get key request message to the D2D server306bwith the B-TID for requesting the D2D IDs of the other electronic devices (for example, the electronic device100). The D2D server306bretrieves in operation1030the D2D IDs of other electronic devices or UEs and the corresponding public keys of the other electronic devices form the mapping table. In an embodiment, when the public key of other electronic device is unavailable in the D2D server306b, then the D2D server306bsends in operation1032the key request to the BSF entity302with the B-TID (of the other electronic device, for example, the electronic device100) requesting for the public key of the other electronic device. The BSF entity302sends in operation1034the public key of the other electronic device in a key response message to the D2D server306b.

Further, the D2D server306bsends in operation1036a get key response message that includes relevant D2D IDs of other electronic devices along with the public keys of the other electronic devices to the electronic device100a.

The electronic device100areceives get key response from the D2D server306band derives in operation1038the network specific entity key (KD2Dser_UEa). Further, the electronic device100astores the corresponding codes and the public key of the other electronic devices.

The electronic device100registers in operation1040for D2D services and obtains the expression code along with the public key (KUEa_Publickey) from the D2D server. The electronic device100abroadcasts in operation1042the direct communication message to the electronic device100as shown inFIG. 8.

The electronic device100monitors in operation1044for the direct communication message from the electronic device100a. In an embodiment, the electronic device100asends in operation1046the D2D direct communication message with a digital signature to the electronic device100. The electronic device100verifies in operation1048the direct communication message using the public key (KUEa_publickey) of the electronic device100a.

In an embodiment, the method utilizes GBA to send Prose device specific keys to a network after mutual authentication. The method also utilizes GBA to distribute keys of an authenticated prose electronic device in a network supporting direct communication to other authorized network entities. Further, the method distributes keys between the authenticated prose devices in a network supporting direct communication using ProSe signaling message for the identity authenticity verification. The method extends the GBA to support authenticity verification of direct communication devices. Leveraging the use of GBA in ProSe key distribution for entities and devices supporting direct communication.

The method causes the device having a ProSe identity to be tethered with the public key of the device in the network for its identity authenticity verification when communicating directly with other devices, when electronic devices are in network coverage or when electronic devices are out-of-coverage.

The method also discloses the mechanism of securing the discovery by the electronic device and the network by deriving digital signature using at least one network controlled parameter with timestamp and public key of the announcing ProSe UE.

In another embodiment, Utilizing Long Term Evolution (LTE) control plane signaling message to send Prose device specific keys to a network after mutual authentication. The method also utilizes Long Term Evolution (LTE) control plane signaling to distribute keys of an authenticated prose device in a network supporting direct communication to other authorized network entities. Further, the method distributes keys between the authenticated prose devices in a network supporting direct communication using ProSe signaling message for the identity authenticity verification. The method extends the Long Term Evolution (LTE) signaling to support authenticity verification of direct communication devices. Leveraging the use of Long Term Evolution (LTE) signaling in ProSe key distribution for entities and devices supporting direct communication.

FIG. 11illustrates a computing environment implementing the method for identity verification of the direct communication message using asymmetric keys in the wireless communication network, according to the embodiments as disclosed herein. As depicted the computing environment1102comprises at least one processing unit604that is equipped with a control unit1104and an Arithmetic Logic Unit (ALU)1106, a memory1110, a storage unit1112, plurality of networking devices608and a plurality Input output (I/O) devices1114. The processing unit1108is responsible for processing the instructions of the algorithm. The processing unit1108receives commands from the control unit in order to perform its processing. Further, any logical and arithmetic operations involved in the execution of the instructions are computed with the help of the ALU1106.

The overall computing environment1102can be composed of multiple homogeneous and/or heterogeneous cores, multiple CPUs of different kinds, special media and other accelerators. The processing unit1108is responsible for processing the instructions of the algorithm. Further, the plurality of processing units1108may be located on a single chip or over multiple chips.

The algorithm comprising of instructions and codes required for the implementation are stored in either the memory unit1110or the storage1112or both. At the time of execution, the instructions may be fetched from the corresponding memory1110and/or storage1112, and executed by the processing unit1108.

In case of any hardware implementations various networking devices1116or external I/O devices1114may be connected to the computing environment to support the implementation through the networking unit and the I/O device unit.

The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device and performing network management functions to control the elements. The elements shown inFIGS. 1-3 and 5-11include blocks which can be at least one of a hardware device, or a combination of hardware device and software module.