Abstract:
The present disclosure relates to a communication method and system for converging a 5G communication system for supporting higher data rates beyond a 4G system with a technology for Internet of Things (IoT). A method for establishing a secure communication between a UE and a relay UE is provided. The method includes deriving a ProSe traffic key (PTK) of the relay UE by using a key derivation function (KDF) of at least one of a ProSe group key (PGK) of the UE, a PTK identification (ID) and a ID of the relay UE, and transmitting a security key response message comprising at least the PTK of the relay UE, the PTK ID and PGK ID, to the relay UE. The at least the PTK of relay UE. PTK ID and PGK is used to derive a security key for the D2D group communication between the UE and relay UE.

Description:
CROSS-REFERENCE TO RELATED APPLICATION(S) 
       [0001]    This application claims the benefit under 35 U.S.C. §119(a) of an Indian Provisional application filed on Jan. 14, 2015 in the Indian Patent Office and assigned Serial number 226/CUE/2015, and under 35 U.S.C. §119(a) of an Indian patent application filed on Dec. 8, 2015 in the Indian Patent Office and assigned Serial number 26/CUE/2015, the entire disclosure of each of which is hereby incorporated by reference. 
     
    
     TECHNICAL FIELD 
       [0002]    The present disclosure relates to device-to-device (D2D) communications (proximity services). More particularly, the present disclosure relates to method and system for establishing a secure communication between remote user equipment (UE) and relay UE in a D2D communication network. 
       BACKGROUND 
       [0003]    To meet the demand for wireless data traffic having increased since deployment of 4G communication systems, efforts have been made to develop an improved 5G or pre-5G communication system. Therefore, the 5G or pre-5G communication system is also called a ‘Beyond 4G Network’ or a ‘Post LTE System’. The 5G communication system is considered to be implemented in higher frequency (mmWave) bands, e.g., 60 GHz bands, so as to accomplish higher data rates. To decrease propagation loss of the radio waves and increase the transmission distance, the beamforming, massive multiple-input multiple-output (MIMO), Full Dimensional MIMO (FD-MIMO), array antenna, an analog beam forming, large scale antenna techniques are discussed in 5G communication systems. In addition, in 5G communication systems, development for system network improvement is under way based on advanced small cells, cloud Radio Access Networks (RANs), ultra-dense networks, device-to-device (D2D) communication, wireless backhaul, moving network, cooperative communication, Coordinated Multi-Points (CoMP), reception-end interference cancellation and the like. In the 5G system, Hybrid FSK and QAM Modulation (FQAM) and sliding window superposition coding (SWSC) as an advanced coding modulation (ACM), and filter bank multi carrier (FBMC), non-orthogonal multiple access(NOMA), and sparse code multiple access (SCMA) as an advanced access technology have been developed. 
         [0004]    The Internet, which is a human centered connectivity network where humans generate and consume information, is now evolving to the Internet of Things (IoT) where distributed entities, such as things, exchange and process information without human intervention. The Internet of Everything (IoE), which is a combination of the IoT technology and the Big Data processing technology through connection with a cloud server, has emerged. As technology elements, such as “sensing technology”, “wired/wireless communication and network infrastructure”, “service interface technology”, and “Security technology” have been demanded for IoT implementation, a sensor network, a Machine-to-Machine (M2M) communication, Machine Type Communication (MTC), and so forth have been recently researched. Such an IoT environment may provide intelligent Internet technology services that create a new value to human life by collecting and analyzing data generated among connected things. IoT may be applied to a variety of fields including smart home, smart building, smart city, smart car or connected cars, smart grid, health care, smart appliances and advanced medical services through convergence and combination between existing Information Technology (IT) and various industrial applications. 
         [0005]    In line with this, various attempts have been made to apply 5G communication systems to IoT networks. For example, technologies such as a sensor network, Machine Type Communication (MTC), and Machine-to-Machine (M2M) communication may be implemented by beamforming, MIMO, and array antennas. Application of a cloud Radio Access Network (RAN) as the above-described Big Data processing technology may also be considered to be as an example of convergence between the 5G technology and the IoT technology. 
         [0006]    Device-to-device (D2D) communication is being studied in communication standard groups to enable data communication services between a plurality of user equipment (UEs). During the D2D communication a transmitting D2D UE may transmit data packets to a group of D2D UEs or broadcast data packets to all the D2D UEs. The D2D communication between the transmitter and receiver(s) are connectionless in nature (i.e., there is no connection setup between the transmitter and receiver before the transmitter starts transmitting the data packets). During the transmission, the transmitter includes the source identification (ID) and the destination ID in the data packets. The source ID is set to the UE ID of the transmitter. The destination ID is the broadcast ID or group ID or UE ID of an intended recipient of the transmitted packet. 
         [0007]    One of the requirements of D2D communication is that a UE in out of coverage of a network should be able to communicate with the network via another UE (i.e., UE-to-network relay which is in coverage of network and is in proximity of a remote UE. This is illustrated in  FIG. 1 . 
         [0008]      FIG. 1  is a flow diagram illustrating a D2D communication between a remote UE and a UE-to-network relay according to the related art. 
         [0009]    Referring to  FIG. 1 , communication between a remote UE and a UE-to-network relay includes a remote UE  102 , UE-to-network relay  104 , an e node B (eNB)  106 , an evolved packet core (EPC)  108  and a public safety server  110 . The remote UE  102  communicates with the UE-to-network relay  104  using D2D communication. Further requirements of the D2D communication is that UEs out of proximity with each other should be able to communicate via another UE (i.e., UE-to-UE relay) which is in proximity to both UEs. 
         [0010]    In order to support the security for the D2D communication a proximity-based service (ProSe) group key (PGK) is defined. The PGK is specific to a group of D2D UEs. Multiple PGKs per group may be pre-provisioned in the UE. Each of these PGKs for a same group is identified using a PGK ID (usually, 8 bits in size). Each PGK also has an expiry time associated with the PKG. If the UE wants to send data packets to a group, then the UE derives a ProSe traffic key (PTK) from the PGK corresponding to that group. The PTK is identified using PTK ID. The PTK is a group member specific key generated from the PGK. Each PTK is also associated with a PTK ID counter (usually, 16 bits in size). For encrypting data the combination of &lt;PTK, packet data convergence protocol (PDCP) counter&gt; is unique. The PDCP counter is updated for every packet transmitted. If the PDCP counter rolls over, then a new PTK is generated from the PGK. PTK=key derivation function (KDF) (PGK, PTK ID, group member identity of transmitter). A ProSe encryption key (PEK) is also generated whenever PTK is generated. PEK=KDF (PTK, algorithm ID). Algorithm ID identifies the security algorithm, for example, SNOW third generation (3G) integrity algorithms or advanced encryption standard (AES) encryption algorithm, like so. The key hierarchy is illustrated in  FIG. 2 . 
         [0011]      FIG. 2  is a flow diagram illustrating a key hierarchy for D2D group communication according to the related art. 
         [0012]    Referring to  FIG. 2 , a PGK ID, a PTK ID and a PDCP counter value are transmitted along with a data packet. The PTK ID, the PGK ID and the PDCP counter value are included by the transmitter along with the secured data packet. The receiver generates the PTK used by transmitter using the PTK ID, the PGK ID and a destination ID (identifying the group) received along with the packet for decryption. 
         [0013]    During the group communication the security key (i.e., PGK) is already known to both the transmitter and receiver(s). In case of communication between remote UE  102  and UE-to-network relay  104  wherein the remote UE and UE-to-network relay belong to different groups, then a different security key (i.e., PGK) is available at the remote UE  102  and the UE-to-network relay  104 . So communication between the remote UE  102  and the UE-to-network relay  104  cannot be secured. In other words, the UE-to-network relay  104  may not belong to all/any of the groups (formed by the network (e.g. ProSe function)), which implies, the UE-to-network relay  104  may not have all the group keys to secure or decrypt the packets to be relayed. Further, the UE-to-network relay  104  which belongs to a specific group(s) may need to take the role/functionality of relaying packets securely to all other (or specific) group members (e.g., for mission critical communication, only one UE-to-network relay  104  is in coverage of network). 
         [0014]    Thus, there is a need for a method and system for securing communication between remote UE and UE-to-network relay. 
         [0015]    The above information is presented as background information only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with regard to the present disclosure. 
       SUMMARY OF THE DISCLOSURE 
       [0016]    Aspects of the present disclosure are to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present disclosure is to provide a method and system for establishing a secure communication between a remote user equipment (UE) and UE-to-network relay in a device-to-device (D2D) group communication. 
         [0017]    In accordance with an aspect of the present disclosure, method by a proximity-based service (ProSe) key management function (PKMF) for establishing a secure communication between a remote-user equipment (UE) and a UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The method including deriving a ProSe traffic key (PTK) of the UE-to-network relay by using a key derivation function (KDF) of at least one of a ProSe group key (PGK) of the remote-UE, a PTK identification (ID) and a UE ID of the UE-to-network relay, and transmitting a security key response message comprising at least one of the PTK of the UE-to-network relay, the PTK ID and the PGK ID, to the UE-to-network relay. The at least one of the PTK of the UE-to-network relay, the PTK ID and the PGK ID is used to derive a security key for the D2D group communication between the remote-UE and the UE-to-network relay. 
         [0018]    In accordance with an aspect of the present disclosure, a method by an user equipment (UE)-to-network relay for establishing a secure communication between a remote-UE and the UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The method includes receiving a security key response message comprising at least one of a proximity-based service (ProSe) traffic key (PTK) of the UE-to-network relay, a PTK identification (ID) and a ProSe group key (PGK) ID, from the a ProSe key management function (PKMF), generating a ProSe encryption key (PEK) of the UE-to-network relay based on the PTK of the UE-to-network, transmitting, an authentication request message comprising the PGK ID and the PTK ID, to the remote-UE, and securing packets for transmitting to the remote-UE using the PEK of the UE-to-network relay. 
         [0019]    In accordance with an aspect of the present disclosure, a method by a remote-user equipment (UE) for establishing a secure communication between a remote-UE and a UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The method includes receiving, an authentication request message comprising a proximity-based service (ProSe) group key (PGK) identification (ID) and a ProSe traffic key (PTK) ID, from the remote-UE, deriving the PTK of the remote-UE from a key derivation function (KDF) of at least one of the PGK corresponding to the PGK ID and the group ID of the remote-UE, and the PTK ID, ID of UE-to-network relay, and deriving a ProSe encryption key (PEK) of the remote-UE from the KDF of at least one of the PTK of the remote-UE and an algorithm ID. 
         [0020]    In accordance with an aspect of the present disclosure, a proximity-based service (ProSe) key management function (PKMF) for establishing a secure communication between a remote-user equipment (UE) and a UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The PKMF includes a transceiver configured to transmit and receive signals, and a controller configured to derive ProSe traffic key (PTK) of the UE-to-network relay by using key derivation function (KDF) of at least one of a ProSe group key (PGK) of the remote-UE, a PTK identification (ID) and a UE ID of the UE-to-network relay, and transmit a security key response message comprising at least one of the PTK of the UE-to-network relay, the PTK ID and PGK ID, to the UE-to-network relay. The at least one of the PTK of the UE-to-network relay, the PTK ID and the PGK ID are used to derive security key for the D2D group communication between the remote-UE and the UE-to-network relay. 
         [0021]    In accordance with an aspect of the present disclosure, a user equipment (UE)-to-network relay for establishing a secure communication between a remote-UE and the UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The UE-to-network relay includes a transceiver configured to transmit and receive signals, and a controller configured to receive a security key response message comprising at least one of a proximity-based service (ProSe) traffic key (PTK) of the UE-to-network relay, a PTK identification (ID) and a ProSe group key (PGK) ID, from the ProSe key management function (PKMF), generate a ProSe encryption key (PEK) of the UE-to-network relay based on the PTK of the UE-to-network, transmit an authentication request message comprising the PGK ID and the PTK ID to the remote-UE, and secure packets for transmitting to the remote-UE using the PEK of the UE-to-network relay. 
         [0022]    In accordance with an aspect of the present disclosure, remote-user equipment (UE) for establishing a secure communication between a remote-UE and a UE-to-network relay that belongs to a different group than the remote-UE in a device-to-device (D2D) group communication is provided. The remote-UE includes a transceiver configured to transmit and receive signals, and a controller configured to receive an authentication request message comprising a proximity-based service (ProSe) group key (PGK) identification (ID) and a ProSe traffic key (PTK) ID, from the remote-UE, derive PTK of the remote-UE from a key derivation function (KDF) of at least one of the PGK corresponding to the PGK ID and a group ID of the remote-UE, the PTK ID, an ID of UE-to-network relay, and derive a ProSe encryption key (PEK) of the remote-UE from a key derivation function (KDF) of at least one of the PTK of the remote-UE and algorithm ID. 
         [0023]    Other aspects, advantages, and salient features of the disclosure will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the annexed drawings, discloses various embodiments of the present disclosure. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0024]    The above and other aspects, features, and advantages of certain embodiments of the present disclosure will be more apparent from the following description taken in conjunction with the accompanying drawings, in which: 
           [0025]      FIG. 1  is a flow diagram illustrating a device-to-device (D2D) communication between a remote user equipment (UE) and a UE-to-network relay according to the related art; 
           [0026]      FIG. 2  is a flow diagram illustrating a key hierarchy for D2D group communication according to the related art; 
           [0027]      FIG. 3  is a flowchart illustrating a method for establishing a secure communication between first UE and second UE according to an embodiment of the present disclosure; 
           [0028]      FIG. 4  is a flow diagram illustrating a method for establishing a secure communication between remote UE and UE-to-network relay according to an embodiment of the present disclosure; 
           [0029]      FIG. 5  is a flow diagram illustrating a method for establishing a secure communication between remote UE and UE-to-network relay according to an embodiment of the present disclosure; 
           [0030]      FIG. 6  is a flow diagram illustrating a method for establishing a secure communication between remote UE and UE-to-network relay according to an embodiment of the present disclosure; and 
           [0031]      FIG. 7  is a flow diagram illustrating a method for establishing a secure communication between remote UE and UE-to-network relay according to an embodiment of the present disclosure. 
       
    
    
       [0032]    Throughout the drawings, like reference numerals will be understood to refer to like parts, components, and structures. 
       DETAILED DESCRIPTION 
       [0033]    The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of various embodiments of the present disclosure as defined by the claims and their equivalents. It includes various specific details to assist in that understanding but these are to be regarded as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the various embodiments described herein may be made without departing from the scope and spirit of the present disclosure. In addition, descriptions of well-known functions and constructions may be omitted for clarity and conciseness. 
         [0034]    The terms and words used in the following description and claims are not limited to the bibliographical meanings, but, are merely used by the inventor to enable a clear and consistent understanding of the present disclosure. Accordingly, it should be apparent to those skilled in the art that the following description of various embodiments of the present disclosure is provided for illustration purpose only and not for the purpose of limiting the present disclosure as defined by the appended claims and their equivalents. 
         [0035]    It is to be understood that the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to “a component surface” includes reference to one or more of such surfaces. 
         [0036]    The present disclosure provides a method and system for establishing a secure communication between a remote user equipment (UE) and UE-to-network relay in a device to device (D2D) communication network. 
         [0037]    It will be further understood that the terms “includes”, “comprises”, “including” and/or “comprising” when used in this specification, specify the presence of stated features, integers, operations, elements and/or components, but do not preclude the presence or addition of one or more other features integers, operations, elements, components, and/or groups thereof. As used herein, the term “and/or” includes any and all combinations and arrangements of one or more of the associated listed items. 
         [0038]    Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein. 
         [0039]    Throughout the specification, the terms UE-to-network relay and relay UE are interchangeably used. Throughout the specification, the terms remote UE and UE are interchangeably used. Throughout this specification, the message between the remote UE and the UE-to-network relay and the message between the UE-to-network relay and the proximity-based service (ProSe) function may be ProSe protocol specific messages. Further, throughout the specification, the terms server, ProSe server, network node, network entity and ProSe key management function (PKMF) are interchangeably used. For each of the server, the relay UE and the UE, a control unit (at least one processor) controls overall states and operations of the components of the apparatus. For example, the control unit may control a storage unit to store information received through a transceiver. 
         [0040]      FIG. 3  is a flowchart illustrating a method for establishing a secure communication between a first UT and a second UE according to an embodiment of the present disclosure. 
         [0041]    Referring to  FIG. 3 , in this embodiment, a first user equipment (UE 1 ) communicates with network via a second user equipment (UE 2 ). 
         [0042]    In operation  302 , a security key request is sent to a ProSe server or the PKMF by the UE 2 . The security key request comprises a UE 1  ID and a UE 2  ID. In operation  304 , a security key, called ProSe traffic key (PTK UE 2 ), is derived by the ProSe server or the PKMF for the UE 2  to securely transmit data packets to the UE 1 . In operation  306 , the security key response including PTK is received by the UE 2 . In operation  308 , a ProSe encryption key (PEK UE2 ) is generated by UE 2  using the PTK UE2  received in the security key response. The generated PEK UE2  and ProSe group key (PGK) identification (ID) associated with the UE 2  is then transmitted to the UE 1  signaling message or in a data packet header in operation  310 . In operation  312 , security keys (PTK UE1 and  PEK UE1 ) are generated by the UE 1  to establish secure communication with the UE 2 . 
         [0043]      FIG. 4  is a flow diagram illustrating a method for establishing a secure communication between a remote UE and a UT-to-network relay according to an embodiment of the present disclosure. 
         [0044]    Referring to  FIG. 4 , in an embodiment, a UE-to-network relay  404  transmits a security key request to a ProSe server  406  or the PKMF in operation  410 . The security key request comprises a remote UE ID and a UE-to-network relay&#39;s UE ID. The security key request may also comprise a group ID of a remote UE  402 . In various embodiments, a remote UE group ID may be included in the security key request if the remote UE  402  belongs to multiple groups. In various embodiments, the remote UE group ID may also be included in the security key request if the remote UE ID is unique within the group. In these embodiments, if the remote UE ID is unique within the group, then the remote UE ID and the remote UE group ID together identify the remote UE  402 . The UE-to-network relay  404  obtains the remote UE  402  ID and/or remote UE  402  group ID of the remote UE  402  during the UE-to-network relay discovery process. 
         [0045]    Alternately, the UE-to-network relay  404  may receive the remote UE ID and/or remote UE group ID of the remote UE  402  from the remote UE  402  in the communication or connection request message. The UE-to-network relay  404  may transmit a security key request to the ProSe server  406  or the PKMF upon receiving the communication or connection request message from the remote UE  402 . 
         [0046]    In response to the security key request, the ProSe server  406  or the PKMF derives the security key (PTK UE-to-network-relay ), a PTK for the UE-to-network relay  404  to secure data packets transmitted to the remote UE  402  or to the remote UE&#39;s group. The ProSe server  406  or the PKMF, in operation  420 , derives the security key as follows: 
         [0000]      PTK UE-to-network-relay =key derivation function(KDF)(PGK remote-UE,  PTK ID, UE-to-network relay UE ID) 
         [0047]    The PGK remote-UE  is any valid PGK of the remote UE  402  if the remote UE  402  is associated with one group. The PGK remote-UE  is any valid PGK of the remote UE  402  corresponding to the group identified by the remote UE group ID wherein the remote UE group ID is received by ProSe server  406  or the PKMF in security key request. The KDF is well known in the related art and hence not explained here. 
         [0048]    In an embodiment, the ProSe server  406  or the PKMF may further derive a PEK for the UE-to-network relay (PEK UE-to-network-relay ) wherein the PEK UE-to-network-relay  is derived as follows: 
         [0000]      PEK UE-to-network-relay =KDF(PTK UE-to-network-relay , algorithm ID). 
         [0000]    wherein the algorithm ID identifies the security algorithm, for example, SNOW third generation (3G) integrity algorithm or advanced encryption standard (AES) encryption algorithm. 
         [0049]    The ProSe server  406  or the PKMF transmits the security key response to the UE-to-network relay in operation  430 . The security key response comprises the PTK UE-to-network-relay , PTK ID and the PGK ID. The PTK UE-to-network-relay  is the security key derived by the ProSe server  406  or the PKMF which is to be used by UE-to-network relay  404  to secure the packets transmitted to the remote UE  402 . The PTK ID is the ID used as input to derive the PTK UE-to-network-relay  and the PGK ID is the index of the PGK remote-UE  used to derive the PTK UE-to-network-relay . In an embodiment, the PEK UE-to-network-relay  is included in the security key response instead of the PTK UE-to-network-relay . 
         [0050]    The UE-to-network relay  404 , in operation  440 , generates the PEK UE-to-network-relay  using the PTK UE-to-network-relay  received in the security key response from ProSe server  406  or the PKMF as follows: 
         [0000]      PEK UE-to-network-relay =KDF(PTK UE-to-network-relay , algorithm ID) 
         [0051]    The PEK UE-to-network-relay  is then used for transmitting the data packets to the remote UE  402 . Alternatively, the ProSe server  406  or the PKMF transmits the PEK UE-to-network-relay  in the security key response and the PEK UE-to-network-relay  is used by UE-to-network relay  404  for securing the packets transmitted to remote UE  402 . The PEK UE-to-network-relay  is also used by UE-to-network relay  404  to decrypt the packets received from the remote UE  402 . The UE-to-network relay  404  then informs the PGK ID and the PTK ID received in security key response to the remote UE  402  in a signaling message and/or in data packet header in operation  450 . The UE-to-network relay  404  may also send a MAC-I along with the PGK ID and the PTK ID. For MAC-I, UE-to-network relay  404  may derive a security key PTK UE-to-network-relay ) as follows: 
         [0000]      PIK UE-to-network-relay =KDF(PTK UE-to-network-relay , algorithm ID). 
         [0052]    The method to generate the MAC-I is well known in the related art and hence not explained here. 
         [0053]    Upon receiving the security key from the UE-to-network relay  404 , the remote UE  402  generates the security key (i.e., PTK) for securely transmitting data packets to the UE-to-network relay  404  in operations  460  and  470 . The security key is derived as follows: 
         [0054]    PTK remote-UE =KDF(PGK corresponding to PGK ID and remote UE group ID received from UE-to-network relay, PTK ID received from UE-to-network relay, UE-to-network relay UE ID). 
         [0000]      PEK remote-UE =KDF(PEK remote-UE , algorithm ID). 
         [0055]    The PEK remote-UE  is used by the remote UE  402  for securing the packets transmitted to the UE-to-network relay  404 . The PEK remote-UE  is also used by the remote UE  402  for decrypting the packets received from the UE-to-network relay  404 . 
         [0056]    In an embodiment in which the MAC-I is included, the remote UE  402  verifies the MAC-I included by the UE-to-network relay  404  using the derived keys. For the MAC-I, the remote UE  402  may derive a security key PIK remote UE =KDF(PTK remote UE , algorithm ID). 
         [0057]    After verification, the remote UE  402  sends a message to the UE-to-network relay  404  with the MAC-I. The UE-to-network relay  404  then verifies the MAC- 1  and accepts the connection with the remote UE  402 . 
         [0058]    In an embodiment, the remote UE ID may be used in place of the UE-to-network relay UE ID in deriving the PTK UE-to-network-relay  and the PTK remote-UE . In an embodiment, the remote UE ID may be used in addition to the UE-to-network relay UE ID in deriving the PTK UE-to-network-relay  and the PTK remote-UE . 
         [0059]      FIG. 5  is a flow diagram illustrating a method for establishing a secure communication between a remote UE and a UE-to-network relay according to an embodiment of the present disclosure. 
         [0060]    Referring to  FIG. 5 , a remote UE  502  transmits security key information comprising the PGK ID and the PTK ID to a UE-to-network relay  504  in operation  510 . The PGK ID is the index of the PGK used by the remote UE  502  for deriving the security key (PTK remote-UE ). The remote UE  502  derives a PEK (PEK remote-UE ) from PTK remote-UE . The PEK remote-UE  is used by the remote UE  502  to secure the packets transmitted to UE-to-network relay  504 . 
         [0061]    After receiving the security key information from the remote UE  502 , the UE-to-network relay  504  transmits a security key request to a ProSe server  506  or a PKMF in operation  515 . The security key request comprises the remote UE ID, the UE-to-network relay&#39;s UE ID, the PGK ID received from remote UE, and the PTK ID received from remote UE  502 . In various embodiments, the remote UE group ID may be included in the security key request if the remote UE  502  belongs to multiple groups. In various embodiments, the remote UE group ID may also be included in the security key request if the remote UE ID is unique within the group. If the remote UE ID is unique only within the group, then the remote UE ID and the remote UE group ID together identify the remote UE. The UE-to-network relay  504  obtains the remote UE ID and/or the remote UE group ID of the remote UE  502  during the UE-to-network relay discovery process. Alternately, the UE-to-network relay  504  may receive the remote UE ID and/or the remote UE group ID of the remote UE  502  from the remote UE  502  in the communication or connection request message. The UE-to-network relay  504  may transmit a security key request to a ProSe server  506  or the PKMF upon receiving the communication or connection request message from remote UE  502 . 
         [0062]    The ProSe server  506  or the PKMF, in operation  520 , derives a first security key (i.e., PTK  1 ), which is used by the UE-to-network relay  504  to secure the packets transmitted to the remote UE  502  or the remote UE&#39;s group where the derivation of the security key is as follows: 
         [0000]      PTK UE-to-network-relay-TX =KDF(PGK remote-UE , PTK ID, UE-to-network relay UE ID). 
         [0063]    The PGK remote-UE is any valid PGK of the remote UE 502 if the remote UE 502 is associated with one group. The PGK   remote-UE  is any valid PGK of the remote UE corresponding to the group identified by the remote UE group ID. 
         [0064]    In an embodiment, the ProSe server  506  or the PKMF may derive the PEK UE-to-network-relay-TX, wherein the PEK   UE-to-network-relay-TX =KDF(PTK UE-to-network-relay-TX, algorithm ID) and wherein the algorithm ID identifies the security algorithm for example, SNOW  3G integrity algorithm or AES encryption algorithm. 
         [0065]    The ProSe server  506  or the PKMF, in operation  525 , further derives a second security key (i.e., PTK  2 ) to be used by the UE-to-network relay  504  to decrypt the packets received from the remote UE  502  or remote UE&#39;s group. The derivation of PTK  2  is as follows: 
         [0000]      PTK UE-to-network-relay-RX =KDF(PGK remote-UE,  PTK ID, remote UE ID). 
         [0066]    Where PGK remote-UE  is the PGK of the remote UE  502  corresponding to PGK ID received from UE-to-network relay in security key request. The PTK ID is the PTK ID received from UE-to-network relay in security key request. In an embodiment, the ProSe server or the PKMF may derive PEK UE-to-network-relay-RX  wherein, 
         [0000]      PEK UE-to-network-relay-RX =KDF(PTK UE-to-network-relay-RX, algorithm ID)    
         [0000]    in which the algorithm ID identifies the security algorithm, for example, SNOW 3G integrity algorithm or AES encryption algorithm. 
         [0067]    The ProSe server  506  or the PKMF then transmits the security key response to the UE-to-network relay  504  in operation  530 . The security key response comprises the PTK UE-to-network-relay-TX,  the PTK ID, the PGK ID and the PTK UE-to-network-relay-RX,  where the PTK UE-to-network-relay-TX  is the security derived by the ProSe server  506  or the PKMF which is used by the UE-to-network relay  504  to secure the packets transmitted to the remote UE  502 . The PTK ID is the ID used as input to derive the PTK UE-to-network-relay-TX . The PGK ID is the index of the PGK remote-UE  used to derive the PTK UE-to-network-relay-TX . The PTK UE-to-network-relay-RX  is the security derived by the ProSe server  506  or the PKMF which is used by the UE-to-network relay  504  to decrypt the packets received from the remote UE  502 . In an embodiment, the PEK UE-to-network-relay-TX  and the PEK UE-to-network-relay-RX  is included in security key response instead of/or along with the PTK UE-to-network-relay-TX  and the PTK UE-to-network-relay-RX . 
         [0068]    The UE-to-network relay  504  generates two keys, one for secure transmission of data packets to remote UE  502  and another for secure reception of data packets from the remote UE  502 . The UE-to-network relay  504 , in operation  535 , generates a secure transmission key, (PEK UE-to-network-relay-TX ) using the PTK UE-to-network-relay-TX  received in the security key response from the ProSe server  506  or the PKMF wherein 
         [0000]      PEK UE-to-network-relay-TX =KDF(PTK UE-to-network-relay-TX , algorithm ID) 
         [0069]    The PEK UE-to-network-relay-TX  is then used for securing the packets transmitted to the remote UE  502 . In an embodiment, the PEK UE-to-network-relay-TX  is received in the security key response from the ProSe server  506  or the PKMF and is used by the UE-to-network relay  504  for securing the packets transmitted to the remote UE  502 . Further, the PTK ID and the PGK ID received from the ProSe server  506  or the PKMF in the security key response are transmitted by UE-to-network relay  504  in header of the secured data packets. 
         [0070]    The UE-to-network relay  504 , in operation  540 , generates the PEK UE-to-network-relay-RX  using the PTK UE-to-network-relay-RX  received in the security key response from the ProSe server  506  or the PKMF wherein 
         [0000]      PEK UE-to-network-relay-RX =KDF(PTK UE-to-network-relay-RX , algorithm ID) 
         [0071]    The PEK UE-to-network-relay-RX  is then used for decrypting the packets received from the remote UE  502 . In an embodiment, PEK UE-to-network-relay-RX  is received in the security key response from the ProSe server  506  or the PKMF and is used by the UE-to-network relay  504  for decrypting the packets received from the remote UE  502 . 
         [0072]    The remote UE generates the security keys internally. The keys are generated before sending the security key info to the UE-to-network relay  504 . The remote UE  502  first generates a security key (i.e., PTK) for transmission to the UE-to-network relay  504  in operations  545  and  550 . The security key is derived as follows: 
         [0000]      PTK remote-UE-TX =KDF(PGK corresponding to PGK ID informed to UE-to-network relay, PTK ID informed to UE-to-network relay and remote UE ID) 
         [0000]      PEK remote-UE-TX =KDF(PEK remote-UE-TX, algorithm ID)    
         [0073]    The PEK remote-UE-TX is used by the remote UE 502 for securing the packets transmitted to the UE-to-network relay 504.    
         [0074]    The remote UE  502  generates a security key (i.e., PTK) for decrypting reception from the UE-to-network relay  504  in operations  555  and  560 . The security key is derived as follows: PTK remote-UE-RX =KDF(PGK corresponding to PGK ID received in data packet from the UE-to-network relay  504 , the PTK ID received in data packet from the UE-to-network relay  504 , the UE-to-network relay UE ID) 
         [0000]      PEK remote-UE-RX =KDF(PEK remote-UE-RX, algorithm ID)    
         [0000]    where PEK remote-UE-RX  is used by the remote UE  502  for decrypting the packets received from the UE-to-network relay  504 . 
         [0075]    In an embodiment, the remote UE ID may be used in place of the UE-to-network relay UE ID in deriving PTK UE-to-network-relay-TX  and the PTK remote-UE-RX.  In an embodiment, the remote UE ID may be used in addition to the UE-to-network relay UE ID in deriving the PTK UE-to-network-relay-TX  and the PTK remote-UE-RX . 
         [0076]      FIG. 6  is a flow diagram illustrating a method for establishing a secure communication between a remote UE and a UE-to-network relay according to an embodiment of the present disclosure. 
         [0077]    Referring to  FIG. 6 , a UE-to-network relay  604  transmits a security key request to a ProSe server  606  or a PKMF in operation  610 . The security key request comprises a remote UE ID and a UE-to-network relay&#39;s UE ID. The security key request may also comprise a remote UE group ID. In various embodiments, the remote UE group ID may be included in the security key request, if a remote UE  602  belongs to multiple groups. In various embodiments, the remote UE group ID may also be included in the security key request if the remote UE ID is unique within the group. If remote UE ID is unique only within the group, the remote UE ID and the remote UE group ID together identify the remote UE  602 . In an embodiment, the UE-to-network relay  604  obtains the remote UE ID and/or remote UE group ID of the remote UE  602  during the UE-to-network relay  604  discovery process. Alternately, the UE-to-network relay  604  may receive the remote UE ID and/or remote UE group ID of the remote  602  from the remote UE  602  in the communication or connection request message. The UE-to-network relay  604  may transmit a security key request to a ProSe server  606  or the PKMF on receiving the communication or connection request message from remote UE  602 . 
         [0078]    The ProSe server  606  or the PKMF derives a first security key (i.e., PTK  1 ) which is used by the UE-to-network relay  604  to secure data packets transmitted to the remote UE  602  or the remote UE&#39;s group in operation  615 . The ProSe server  606  or the PKMF derives the security key as follows: 
         [0000]      PTK UE-to-network-relay-TX =KDF(PGK remote-UE,  PTK ID 1, UE-to-network relay 604 UE ID) 
         [0000]    where, the PGK remote-UE  is any valid PGK of the remote UE  602  if the remote UE  602  is associated with one group. The PGK remote-UE  is any valid PGK of the remote UE  602  corresponding to the group identified by the remote UE group ID. In an embodiment, the ProSe server  606  or the PKMF may derive PEK UE-to-network-relay-TX  wherein 
         [0000]      PEK UE-to-network-relay-TX =KDF(PTK UE-to-network-relay-TX , algorithm ID) 
         [0000]    where, the algorithm ID identifies the security algorithm, for example, a SNOW 3G integrity algorithm or an AES encryption algorithm. 
         [0079]    The ProSe server  606  or the PKMF further derives a second security key (i.e., PTK  2 ) which is used by the UE-to-network relay  604  to decrypt the packets received from the remote UE  602  in operation  620 . The ProSe server  606  or the PKMF derives the security key as follows: 
         [0000]      PTK UE-to-network-relay-RX =KDF(PGK remote-UE,  PTK ID 2, remote UE ID), 
         [0000]    where, the PGK remote-UE  is any valid PGK of the remote UE  602  if the remote UE  602  is associated with one group. The PGK remote-UE  is any valid PGK of the remote UE  602  corresponding to the group identified by the remote UE group ID. In an embodiment, the ProSe server  606  or the PKMF may derive PEK UE-to-network-relay-RX  wherein 
         [0000]      PEK UE-to-network-relay-RX =KDF(PTK UE-to-network-relay-RX, algorithm ID)    
         [0080]    The algorithm ID identifies the security algorithm, for example, a SNOW 3G integrity algorithms or an AES encryption algorithm. 
         [0081]    The ProSe server  606  or the PKMF transmits the security key response to the UE-to-network relay  604  at in operation  625 . The security key response comprises the PTK UE-to-network-relay-TX,  PGK ID and the PTK ID used to derive the PTK UE-to-network-relay-TX, the  PTK UE-to-network-relay-RX,  the PGK ID and the PTK ID used to derive the PTK UE-to-network-relay-RX . The PTK UE-to-network-relay-TX  is the security key derived by the ProSe server  606  or the PKMF which is to be used by the UE-to-network relay  604  to secure the packets transmitted to the remote UE  602 . The PTK ID is the ID used as input to derive the PTK UE-to-network-relay-TX.  The PGK ID is the index of the PGK remote-UE  used to derive the PTK UE-to-network-relay-TX.  The PTK UE-to-network-relay-RX  is the security derived by the ProSe server  606  or the PKMF which is used by the UE-to-network relay  604  to decrypt the packets received from the remote UE  602 . In an embodiment, the PEK UE-to-network-relay-TX  and the PEK UE-to-network-relay-RX  are included in security key response instead of or along with the PTK UE-to-network-relay-TX  and the PTK UE-to-network-relay-RX.    
         [0082]    The UE-to-network relay  604 , in operation  630 , generates the PEK UE-to-network-relay-TX  using the PTK UE-to-network-relay-TX received in the security key response from the ProSe server 606 or the PKMF wherein    
         [0000]      PEK UE-to-network-relay-TX =KDF(PTK UE-to-network-relay-TX , algorithm ID) 
         [0083]    The PEK UE-to-network-relay-TX  is then used for securing the packets transmitted to the remote UE  602 . In an embodiment, the PEK UE-to-network-relay-TX  is received in the security key response from the ProSe server  606  or the PKMF and is used by the UE-to-network relay  604  for securing the packets transmitted to the remote UE. Later, the PTK ID and the PGK ID received from the ProSe server  606  or the PKMF in security key response are transmitted by the UE-to-network relay  604  in header of secured data packets. 
         [0084]    The UE-to-network relay  604 , in operation  635 , further generates a PEK UE-to-network-relay-RX  using the PTK UE-to-network-relay-RX  received in the security key response from the ProSe server  606  or the PKMF wherein 
         [0000]      PEK UE-to-network-relay-RX =KDF(PTK UE-to-network-relay-RX , algorithm ID) 
         [0085]    The PEK UE-to-network-relay-RX  is then used for decrypting the packets received from the remote UE  602 . In an embodiment, the PEK UE-to-network-relay-RX  is received in the security key response from the ProSe server  606  or the PKMF and is used by the UE-to-network relay  604  for decrypting data packets received from the remote UE  602 . The PTK ID and the PGK ID received from the ProSe server  606  or the PKMF in security key response corresponding to the PTK UE-to-network-relay-RX  are transmitted by the UE-to-network relay  604  in security key information in operation  640 . 
         [0086]    The remote UE  602  generates the security key (i.e., PTK) for transmission to the UE-to-network relay  604  in operation  645  and  650 . The security key is derived as follows: 
         [0000]      PTK remote-UE-TX =KDF(PGK corresponding to the PGK ID received from the UE-to-network relay 604 the PTK ID received from the UE-to-network relay 604 and the remote UE ID) 
         [0000]      PEK remote-UE-TX =KDF(PEK remote-UE-TX , algorithm ID) 
         [0087]    The PEK remote-UE-TX  is used by the remote UE  602  for securing data packets to be transmitted to the UE-to-network relay  604 . 
         [0088]    Further, the remote UE  602  generates the security key (i.e., PTK) for decrypting reception from the UE-to-network relay  604  in operation  655  and  660 . The security key is derived as follows: 
         [0000]      PTK remote-UE-RX =KDF(the PGK corresponding to the PGK ID received in a data packet from the UE-to-network relay 604, the PTK ID received in data packet from the UE-to-network relay 604, the UE-to-network relay UE ID). 
         [0000]      PEK remote-UE-RX =KDF(PEK remote-UE-RX , algorithm ID). 
         [0089]    The PEK remote-UE-RX  is used by the remote UE  602  for decrypting data packets received from the UE-to-network relay  604 . 
         [0090]    In an embodiment, the remote UE ID may be used in place of the UE-to-network relay  604  UE ID in deriving the PTK UE-to-network-relay-TX  and the PTK remote-UE-RX . In an embodiment, the remote UE ID may be used in addition to the UE-to-network relay  604  UE ID in deriving security keys for transmission and reception (PTK UE-to-network-relay-TX  and PTK remote-UE-RX ). 
         [0091]      FIG. 7  is a flow diagram illustrating a method for establishing a secure communication between a remote UE and a UE-to-network relay according to an embodiment of the present disclosure. 
         [0092]    Referring to  FIG. 7 , a UE-to-network relay  704  transmits a security key request to a ProSe server  706  or a PKMF in operation  710 . The security key request comprises a remote UE ID and a UE-to-network relay&#39;s UE ID. In various embodiments, the remote UE group ID may be included in the security key request if a remote UE  702  belongs to multiple groups. In various embodiments, the remote UE group ID may also be included in the security key request if the remote UE ID is unique within the group. If the remote UE ID is unique only within the group, then the remote UE ID and the remote UE group ID together identify the remote UE  702 . The UE-to-network relay  704  may also obtain the remote UE ID and/or the remote UE group ID of the remote UE  702  during a UE-to-network relay discovery process. Alternately, the UE-to-network relay  704  may receive the remote UE ID and/or the remote UE group ID of the remote UE  702  from the remote UE  702  in a connection request procedure. 
         [0093]    The ProSe server  706  or the PKMF derives the security key (i.e., PTK) which is used to secure communication between the remote UE  702  and the UE-to-network relay  704  in operation  720 . The ProSe server  706  or the PKMF derives the security key as follows: 
         [0000]      PTK=KDF(security key of the remote UE, COUNTER and/or NONCE and/or remote UE ID and/or UE-to-network relay UE ID), 
         [0000]    where the security key of the remote UE  702  is a UE specific key known to the remote UE  702  and the ProSe server  706  or the PKMF. In an embodiment, the security key is a master key (K ASME ) obtained from a home subscriber server (HSS) by the ProSe server  706  or by the PKMF specific to the UE. The K ASME  is provided to the ProSe server  706  or the PKMF along with an authentication vector. In an embodiment, the ProSe server  706  or the PKMF transmits an AUTN and RAND along with the PTK/PEK to the UE-to-network relay  704 . The UE-to-network relay  704  forwards the AUTN and RAND to the remote UE  702 , so that the remote UE  702  derives the K ASME  and other keys. In an embodiment, ProSe server  706  or the PKMF may derive PEK wherein 
         [0000]      PEK=KDF(PTK, algorithm ID) 
         [0094]    The algorithm ID identifies the security algorithm, for example, a SNOW 3G integrity algorithms or an AES encryption algorithm. The algorithm to be used may be pre-configured in the remote UE  702  by the ProSe server  706  or the PKMF for the group or alternatively the data packets include the algorithm ID in the header. The ProSe server  706  or the PKMF transmits the security key response to the UE-to-network relay  704  in operation  730 . The security key response comprises the PTK and a COUNTER and/or a NONCE. In an embodiment, the PEK is included in security key response instead of or along with the PTK. 
         [0095]    The UE-to-network relay  704 , in operation  740 , generates a PEK using the PTK received in the security key response from the ProSe server  706  or the PKMF wherein 
         [0000]      PEK=KDF(PTK, algorithm ID) 
         [0096]    The PEK is then used for decrypting the packets received from the remote UE  702  and also to encrypt the packets transmitted to the remote UE  702 . In an embodiment, the PEK is received in the security key response from the ProSe server  706  or the PKMF and is used by the UE-to-network relay  704  for decrypting the packets received from remote UE  702  and also to encrypt the packets transmitted to the remote UE  702 . The COUNTER and/or the NONCE received from the ProSe server  706  or the PKMF in the security key response corresponding to the PTK are transmitted in operation  750  by the UE-to-network relay  704  in a data packet header or a signaling message. 
         [0097]    The remote UE  702  generates the security key (i.e., PTK) for transmission to the UE-to-network relay  704  in operations  760  and  770 . The security key is derived as follows: 
         [0000]      PTK=KDF(security key of the remote UE, COUNTER and/or NONCE received from UE-to-network relay and/or remote UE ID and/or UE-to-network relay UE ID) 
         [0000]      PEK=KDF(PEK, algorithm ID), 
         [0000]    where PEK remote-UE-TX is used by the remote UE 702 for securing the packets transmitted to the UE-to-network relay 704 and for decrypting the packets received from the UE-to-network relay 704.    
         [0098]    In an embodiment, the ProSe server  706  or the PKMF may derive two PTKs instead of one wherein one is used for securing the packets transmitted by the UE-to-network relay  704  and another is used for securing the packets transmitted by the remote UE  702 . The UE-to-network relay  704  further contacts the ProSe server  706  or the PKMF in case of any key refresh/key update. For the key refresh/update, the UE-to-network relay  704  transmits the current PTK ID and/or all the PTK IDs used for the group to the ProSe server  706  or the PKMF for obtaining fresh key(s). 
         [0099]    In an embodiment, a method for establishing a secure communication between the remote UE  702  and the UE-to-network relay  704  in a D2D communication is explained as follows. 
         [0100]    The ProSe server  706  or the PKMF assigns one or more of the PRGKs to the UE-to-network relay  704 . The PRGKs are assigned in addition to assignment of the PGKs corresponding to the PRKGs affiliated group(s). Further, the ProSe server  706  or the PKMF also assigns one or more of the PRGKs to the remote UE  702  in addition to the assignment of the PGKs corresponding to its affiliated group(s). 
         [0101]    Using the PRGKs associated with the remote UE  702 , the remote UE  702  derives security key for encrypting the data packets transmitted to UE-to-network relay  704  as follows: 
         [0000]      PRTK=KDF(PRGK, PRTK ID, remote UE ID). 
         [0000]      PREK=KDF(PRTK, algorithm ID) 
         [0102]    The algorithm ID identifies the security algorithm, for example, a SNOW 3G integrity algorithms or an AES encryption algorithm. The algorithm to be used may be pre-configured in the remote UE by the ProSe server for the group or alternatively the data packets include the algorithm ID in the header. A PREK is used by remote UE for encrypting the data packets transmitted to the UE-to-network relay  704 . Further, a PRGK ID corresponding to the PRGK and the PRTK ID are transmitted along with encrypted data packet in data packet header. 
         [0103]    Similarly, the UE-to-network relay  704  derives the security key for encrypting the data packets transmitted to remote UE  702  as follows: 
         [0000]      PRTK=KDF(PRGK, PRTK ID, UE-to-network relay UE ID). 
         [0000]      PREK=KDF(PRTK, algorithm ID) 
         [0104]    In the above, the algorithm ID identifies the security algorithm, for example, a SNOW 3G integrity algorithms or an AES encryption algorithm. The algorithm to be used may be pre-configured in the UE-to-network relay  704  by the ProSe server  706  for the group or alternatively the data packets include the algorithm ID in the header. The PREK is used by the UE-to-network relay  704  for encrypting the data packets transmitted to the remote UE  702 , The PRGK ID corresponding to the PRGK and the PRTK ID are transmitted along with encrypted data packet in data packet header. 
         [0105]    In all the embodiments, the security mechanisms are applied to the data packets which are relayed by the UE-to-network relay  704 . The UE-to-network relay  704  may determine using the protocol data unit (PDU) type field in the packet data convergence protocol (PDCP) header whether the packet is to be relayed or not. Similarly, the remote UE  702  may determine using the PDU type field in the PDCP header whether the packet received is relayed by the UE-to-network relay  704  or not. Alternately, logical channel ID may be used to indicate relay of data packets. 
         [0106]    It should be noted that the embodiments of the present disclosure may be applied to communication between any UE 1  (instead of the remote UE) and UE 2  (instead of the UE-to-network relay). The PGK remote UE  used in the present disclosure may be UE 1 &#39;s master key instead of the group key. 
         [0107]    While the present disclosure has been shown and described with reference to various embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents.