# US 12,010,508 B2 · Peer-to-peer link security setup for relay connection to mobile network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,508 B2 - Document ID: US12010508B2 - Status: Granted - Kind: B2 - Application number: 17/236,969 - Filed: 2021-04-21 - Published: 2021-10-28 - Granted: 2024-06-11 - Earliest claimed: 2020-04-22 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Karthika Paladugu; Hong Cheng; Adrian Edward Escott; Gavin Bernard Horn; Soo Bum Lee - Web page: https://patentgrep.com/patent/US12010508B2 ## CPC - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/0471: Key exchange - H04W 12/06: Authentication - H04W 12/71: Hardware identity - H04W 76/14: Direct-mode setup - H04W 8/005: {Discovery of network devices, e.g. terminals} - H04W 84/042: {Public Land Mobile systems, e.g. cellular systems} - H04W 88/04: adapted for relaying to or from another terminal or user - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Various aspects pertain to ways to securing a peer-to-peer communication link that serves to relay transmissions to/from a managed mobile network node. A first user equipment may identify a second user equipment that can communicate via a peer-to-peer wireless interface and serve as a relay between the first user equipment and a managed mobile network node. A relay session key material may be obtained from the managed mobile network node. A peer-to-peer communication link between the first user equipment and the second user equipment may be established or modified by, for example, securing the peer-to-peer communication link based on the relay session key material. A protocol data unit session may be established, over the peer-to-peer communication link, between the first user equipment and the managed mobile network node for secured transmissions there between. ## Claims ### Claim 1 A method operational at a first user equipment, the method comprising: identifying a second user equipment that can communicate via a peer-to-peer wireless interface and serve as a relay between the first user equipment and a mobile network node; obtaining a relay session key material from the mobile network node; establishing or modifying a peer-to-peer communication link with the second user equipment, the peer-to-peer communication link secured based on the relay session key material; establishing, over the peer-to-peer communication link, a protocol data unit session with the mobile network node; and further comprising: sending a message directly to the mobile network node, the message including a relay identifier for the second user equipment; and receiving the relay session key material from the mobile network node in response to the message. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the second user equipment includes obtaining the relay identifier from the second user equipment, and the relay identifier is at least one of: (a) a radio network temporary identifier for the second user equipment, and (b) a cell identifier indicative of a serving a mobile network node for the second user equipment. ### Claim 3 (depends on 1) The method of claim 1, wherein the peer-to-peer communication link is established prior to the relay session key material being obtained, and the method further comprising: sending a message to the mobile network node via the peer-to-peer communication link, the message including a relay identifier for the second user equipment; receiving the relay session key material from the mobile network node in response to the message; and securing the peer-to-peer communication link based on the relay session key material. ### Claim 4 (depends on 1) The method of claim 1, wherein the relay session key material includes or is based on at least two of: (a) a relay identifier for the second user equipment; (b) a first user equipment identifier; (c) a target mobile network node key; (d) a first nonce provided by the first user equipment; (e) a second nonce provided by the second user equipment; and (f) a counter value provided by the mobile network node. ### Claim 5 (depends on 1) The method of claim 1, further comprising: deriving a relay session key from the relay session key material; and securing the peer-to-peer communication link using the relay session key. ### Claim 6 (depends on 1) The method of claim 1, wherein the mobile network node is part of a 5G radio access network. ### Claim 7 (depends on 1) The method of claim 1, further comprising: sending, over the peer-to-peer communication link, data for the protocol data session to the mobile network node. ### Claim 8 (depends on 1) The method of claim 1, wherein the peer-to-peer communication link is a Proximity Services Sidelink (PC5). ### Claim 9 A first user equipment, comprising: a peer-to-peer wireless interface to communicate with other wireless devices; and a processing circuit coupled to the wireless interface, the processing circuit configured to identify a second user equipment that can communicate via the peer-to-peer wireless interface and serve as a relay to a mobile network node, obtain a relay session key material from the mobile network node, establish or modify a peer-to-peer communication link with the second user equipment, the peer-to-peer communication link secured based on the relay session key material, establish, over the peer-to-peer communication link, a protocol data unit session with the mobile network node, and further comprising: send a message to the mobile network node via the mobile network interface, the message including a relay identifier for the second user equipment, and receive the relay session key material from the mobile network node in response to the message, wherein the relay session key material is a function of the relay identifier. ### Claim 10 (depends on 9) The first user equipment of claim 9, wherein the peer-to-peer communication link is established prior to the relay session key material being obtained, and the processing circuit is further configured to: send a message to the mobile network node via the mobile network interface, the message including a relay identifier for the second user equipment, receive the relay session key material from the mobile network node in response to the message, wherein the relay session key material is a function of the relay identifier, and secure the peer-to-peer communication link based on the relay session key material. ### Claim 11 (depends on 9) The first user equipment of claim 9, wherein the relay session key material is based on at least two of: (a) a relay identifier for the second user equipment; (b) a first user equipment identifier; (c) a target mobile network node key; (d) a first nonce provided by the first user equipment; (e) a second nonce provided by the second user equipment; and (f) a counter value provided by the mobile network node. ### Claim 12 (depends on 9) The first user equipment of claim 9, wherein the processing circuit is further configured to: derive a relay session key from the relay session key material; and secure the peer-to-peer communication link using the relay session key. ### Claim 13 (depends on 9) The first user equipment of claim 9, wherein the mobile network node is part of a 5G radio access network. ### Claim 14 A method operational at a first user equipment, the method comprising: establishing a network communication link with a mobile network node; establishing a peer-to-peer communication link with a second user equipment; obtaining a relay session key material generated by the mobile network node; securing the peer-to-peer communication link based on the relay session key material; relaying, over the peer-to-peer communication link, a protocol data unit session between the second user equipment and the mobile network node; and wherein the peer-to-peer communication link is established prior to the relay session key material being obtained, and the method further comprising: relaying a message, on behalf of the second user equipment, to the mobile network node via the peer-to-peer communication link, the message including a relay identifier for the first user equipment; receiving the relay session key material from the mobile network node in response to the message; and securing the peer-to-peer communication link based on the relay session key material. ### Claim 15 (depends on 14) The method of claim 14, further comprising: providing a relay identifier to the second user equipment, wherein the relay session key material is a function of the relay identifier. ### Claim 16 (depends on 15) The method of claim 15, wherein the relay identifier is at least one of: (a) a radio network temporary identifier for the first user equipment, and (b) a cell identifier indicative of a serving a mobile network node for the first user equipment. ### Claim 17 (depends on 14) The method of claim 14, wherein the relay session key material includes at least a relay session key and a security configuration identifying an algorithm for the relay session. ### Claim 18 (depends on 14) The method of claim 14, further comprising: deriving a relay session key from the relay session key material; and securing the peer-to-peer communication link using the relay session key. ### Claim 19 (depends on 14) The method of claim 14, wherein prior to securing the peer-to-peer communication link based on the relay session key material, the first user equipment allows only radio resource control signal forwarding over the peer-to-peer communication link. ### Claim 20 (depends on 14) The method of claim 14, wherein prior to securing the peer-to-peer communication link based on the relay session key material, transmissions over the peer-to-peer communication link are secured by public-private key pairs for the first user equipment and the second user equipment. ### Claim 21 (depends on 14) The method of claim 14, wherein receipt of the relay session key material occurs after the second user equipment has been authenticated by the mobile network node, and then the first user equipment sets up a radio bearer for the peer-to-peer communication link. ### Claim 22 (depends on 14) The method of claim 14, wherein the mobile network node is part of a 5G radio access network. ### Claim 23 (depends on 14) The method of claim 14, wherein the peer-to-peer communication link is a Proximity Services Sidelink (PC5). ### Claim 24 A first user equipment, comprising: a mobile network interface to communicate with a mobile network node; a peer-to-peer wireless interface to communicate with other wireless devices; and a processing circuit coupled to the wireless interface, the processing circuit configured to: establish a network communication link with the mobile network node; establish a peer-to-peer communication link with a second user equipment; obtain a relay session key material generated by the mobile network node; secure the peer-to-peer communication link secured based on the relay session key material; relay, over the peer-to-peer communication link, a protocol data unit session between the second user equipment and the mobile network node; and wherein the peer-to-peer communication link is established prior to the relay session key being obtained, and the processing circuit is further configured to: relaying a message, on behalf of the second user equipment, to the mobile network node via the peer-to-peer communication link, the message including a relay identifier for the first user equipment; receiving the relay session key from the mobile network node in response to the message; and securing the peer-to-peer communication link based on the relay session key. ### Claim 25 (depends on 24) The first user equipment of claim 24, wherein the processing circuit is further configured to: provide a relay identifier to the second user equipment, wherein the relay session key material includes or is based on the relay identifier, a second user equipment identifier, and a mobile network node key. ### Claim 26 (depends on 25) The first user equipment of claim 25, wherein the relay identifier is at least one of: (a) a radio network temporary identifier for the first user equipment, and (b) a cell identifier indicative of a serving a mobile network node for the first user equipment.