Methods and apparatus for direct communication key establishment

A method performed by a device, for obtaining a key for direct communication with a user equipment (UE) over an interface, the method comprising:

• receiving, from the UE, a transaction identifier, a Direct Communication Element identifier, and a request to obtain a direct communication key;
• sending, to a Direct Communication Element identified by the Direct Communication Element identifier the transaction identifier and an identifier of the device, and requesting the Direct Communication Element to provide the device with the direct communication key, wherein the interface comprises a Proximity Services (ProSe) interface, and wherein the Direct Communication Element comprises at least one of a ProSe Function or a ProSe Key Management Server (KMS);
• receiving the direct communication key and the direct communication key encrypted with a UE delivery key from the Direct Communication Element, wherein the UE delivery key is derived from at least a session shared key and the identifier of the device;
• and
• sending the encrypted direct communication key to the UE.

A method performed by a Direct Communication Element, for establishing a key for direct communication over an interface between a user equipment (UE) and a device, the method comprising:

• receiving, from the device, a transaction identifier, a device identifier and a request to provide a direct communication key to the device;
• sending the transaction identifier to a Bootstrapping Server Function (BSF) corresponding to the transaction identifier;
• receiving a session shared key from the BSF;
• deriving a UE delivery key from the session shared key and at least the device identifier;
• generating a direct communication key for direct communication between the UE and the device;
• encrypting the direct communication key with the UE delivery key;
• and
• sending the direct communication key and the encrypted direct communication key to the device, wherein the interface comprises a Proximity Services (ProSe) interface, and wherein the Direct Communication Element comprises at least one of a ProSe Function or a ProSe Key Management Server (KMS).

A system for securing direct communication between a user equipment (UE) and a device over an interface, the system comprising a UE, a device, and a Direct Communication Element;

• wherein the UE is configured to establish a UE shared key with a Bootstrapping Server Function (BSF) using a Generic Bootstrapping Architecture (GBA) procedure;
• to receive an encrypted direct communication key from the device;
• to derive a UE delivery key from at least a session shared key and an identifier of the device, wherein the session shared key is derived from at least the UE shared key;
• and to decrypt the encrypted direct communication key using the UE delivery key;
• wherein the device is configured to receive a transaction identifier associated with the UE shared key from the UE;
• to send the transaction identifier to the Direct Communication Element;
• to receive, from the Direct Communication Element, the direct communication key and the direct communication key encrypted with the UE delivery key;
• and to send the encrypted direct communication key to the UE;
• wherein the Direct Communication Element is configured to receive the transaction identifier from the device;
• to obtain the session shared key from the BSF;
• to derive the UE delivery key;
• to generate the direct communication key;
• to encrypt the direct communication key with the UE delivery key;
• and to send the direct communication key and the encrypted direct communication key to the device;
• wherein the interface comprises a Proximity Services (ProSe) interface;
• and
• wherein the Direct Communication Element comprises at least one of a ProSe Function or a ProSe Key Management Server (KMS).