Secure communication method and apparatus

A secure communication method, comprising:

• receiving, by a first network element, a parameter obtaining request from a first terminal device, wherein the parameter obtaining request comprises an identity of the first terminal device;
• allocating, by the first network element, a ProSe temporary identity to the first terminal device only after an authorization check on the first terminal device based on the identity of the first terminal device succeeds;
• sending, by the first network element, a key generation parameter, wherein the key generation parameter comprises the ProSe temporary identity of the first terminal device;
• receiving, by the first network element, a verification request from a second terminal device, wherein the verification request comprises the ProSe temporary identity and a message integrity code;
• determining, by the first network element, a first discovery key at a ProSe granularity of the first terminal device by inputting the ProSe temporary identity and a root key into a key derivation function;
• generating, by the first network element, an expected message integrity code based on the first discovery key;
• and
• sending, by the first network element, a verification response to the second terminal device after verifying the first terminal device based on the message integrity code and the expected message integrity code, wherein the verification response indicates a verification result for the first terminal device.

An apparatus, comprising:

• a processor coupled to a memory storing instructions and configured to execute the instructions to cause the apparatus to:
• send a parameter obtaining request to a first network element, wherein the parameter obtaining request comprises an identity of the apparatus;
• and
• receive a parameter obtaining response from the first network element, wherein the parameter obtaining response comprises a key generation parameter, wherein the key generation parameter comprises a ProSe temporary identity of the apparatus that is allocated by the first network element only after an authorization check on the apparatus succeeds;
• generate a first discovery key at a ProSe granularity by inputting a root key and the key generation parameter, comprising the ProSe temporary identity, into a key derivation function;
• generate a message integrity code based on the first discovery key;
• and
• send a ProSe request message, wherein the ProSe request message comprises the ProSe temporary identity and the message integrity code.

An apparatus, comprising:

• a processor coupled to a memory storing instructions and configured to execute the instructions to cause the apparatus to:
• receive a parameter obtaining request from a first terminal device, wherein the parameter obtaining request comprises an identity of the first terminal device;
• allocate a ProSe temporary identity to the first terminal device only after an authorization check on the first terminal device based on the identity of the first terminal device succeeds;
• send a key generation parameter, wherein the key generation parameter comprises the ProSe temporary identity of the first terminal device;
• receive a verification request from a second terminal device, wherein the verification request comprises the ProSe temporary identity and a message integrity code;
• determine a first discovery key at a ProSe granularity of the first terminal device by inputting the ProSe temporary identity and a root key into a key derivation function;
• generate an expected message integrity code based on the first discovery key;
• and
• send a verification response to the second terminal device after verifying the first terminal device based on the message integrity code and the expected message integrity code, wherein the verification response indicates a verification result for the first terminal device.