HK1229085B - Prevention of replay attack in long term evolution device-to-device discovery - Google Patents

Description

Preventing Replay Attacks in Long Term Evolution Device-to-Device Discovery

Cross-references

This patent application claims priority to U.S. patent application No. 14/609,003, filed by Cheng et al. on January 29, 2015, entitled “Prevention of Replay Attack in Long Term Evolution Device-to-Device Discovery,” and U.S. provisional patent application No. 61/955,601, filed by Cheng et al. on March 19, 2014, entitled “Prevention of Replay Attack in Long Term Evolution Device-to-Device Discovery,” each of which is assigned to the assignee of this application.

background

public domain

The present disclosure relates, for example, to wireless communication systems, and more particularly, to preventing replay attacks in Long Term Evolution device-to-device discovery.

Related technical description

Wireless communication systems are widely deployed to provide various types of communication content, such as voice, video, packet data, messaging, broadcast, and more. These systems may be multiple-access systems capable of supporting communication with multiple users by sharing available system resources (e.g., time, frequency, and power). Examples of such multiple-access systems include code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), and orthogonal frequency division multiple access (OFDMA). Generally speaking, a wireless multiple-access communication system may include several base stations, each of which simultaneously supports communication with multiple user devices. A base station can communicate with the devices on both the downlink and uplink. Each base station has a coverage area, which may be referred to as the coverage area of the base station or cell.

Devices in close proximity (i.e., user equipment (UE)) can also communicate directly via device-to-device (D2D) or proximity-based services (ProSe) communication. However, this direct communication includes potential security vulnerabilities. Specifically, for example, devices participating in D2D discovery communications may be vulnerable to replay attacks by rogue base stations. Therefore, the security of devices participating in D2D discovery communications can be enhanced.

Overview

The described features generally relate to one or more improved methods, systems, or apparatuses for managing wireless communications. These improved methods include receiving a timing variable at a device while the device is in a connected mode. The timing variable can then be used to verify the authenticity of a device-to-device (D2D) discovery message during D2D discovery communications.

According to a first set of illustrative examples, a wireless communication method may include receiving, at a device, a timing variable from a network, wherein the timing variable is received while the device is in a connected mode. The method further includes using the timing variable for D2D discovery message authentication. The timing variable may also be stored at the device for comparison with a local timing variable. In some examples, the timing variable is received from a Proximity-Based Services (ProSe) function in the network. The timing variable may be received along with a D2D discovery application code and may be in Coordinated Universal Time (UTC). Additionally, a timing offset allowance may be received from the ProSe function in the network, wherein the method may then include comparing the received timing variable with a local timing variable to determine whether a difference between the received timing variable and the local timing variable is less than the timing offset allowance. The local timing variable may be received via a System Information Block (SIB). If the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance, the method may include declaring the D2D discovery application code. If the difference is greater than the timing offset allowance, the method may include notifying the ProSe function of an anomaly. In some examples, the method may include transitioning to a connected mode with a base station. Otherwise, the method may include making a request for the timing variable to the base station via a radio resource control (RRC) message.

The method may further include synchronizing the timing variable received from the ProSe function with the local timing variable when the difference is less than the timing offset allowed. When the difference is greater than the timing offset allowed, the ProSe function may be notified of an anomaly.

A timing variable received from the network may be used to generate a message integrity code (MIC) to be included in a D2D discovery announcement. The MIC may be generated when transmitting the D2D discovery announcement based on a D2D discovery application code, a key associated with the D2D discovery application code, and a local version of the timing variable. Alternatively, the method may include receiving a D2D discovery announcement including the MIC, and transmitting the received MIC and the timing variable to a ProSe function in the network.

In some examples, the method may further include receiving authorization to participate in D2D discovery while the device is in connected mode, and detecting a SIB while the device is in connected mode. The timing variable may be received via a system information block (SIB). The SIB may be dedicated to D2D discovery information. The method may also include ignoring the timing variable received in the SIB if the device detects more than one SIB with timing information; and obtaining the timing variable outside the SIB. In addition, the method may include comparing the timing variable received in the SIB with a local timing variable. If the received timing variable differs from the local timing variable by more than a predetermined threshold, the method may include obtaining the timing variable outside the SIB.

In some examples, the method may include receiving, via a radio resource control (RRC) message, a SIB for timing variable synchronization when the device is in connected mode. The method may also include requesting D2D discovery resources via an RRC message when the device is using a network-controlled D2D discovery resource allocation scheme, wherein the timing variable is received via a response to the RRC message. Alternatively, the method may include requesting D2D discovery resources via an RRC message when the device is using a device-controlled D2D discovery resource allocation scheme, and receiving a response to the RRC message, the response including the timing variable and an empty resource allocation element.

Other examples include forwarding the received timing variable to another device. The timing variable may be UTC. Alternatively, the timing variable may be a counter that increments with the D2D discovery period.

According to a second set of illustrative examples, an apparatus for wireless communication may include means for receiving, at a device, a timing variable from a network, the timing variable received while the device is in connected mode, and means for using the timing variable for D2D discovery message authentication. The timing variable may be received from a ProSe function in the network. The timing variable may be received along with a D2D discovery application code and may be in Universal Time (UTC). The apparatus may further include means for receiving a timing offset allowance from the ProSe function in the network, and means for comparing the timing variable received from the network with a local timing variable to determine whether a difference between the received timing variable and the local timing variable is less than the timing offset allowance. The apparatus may also include means for announcing the D2D discovery application code if the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance. The apparatus may also include means for using the timing variable to generate a MIC to be included in the D2D discovery announcement. Alternatively, the apparatus may include means for receiving a D2D discovery announcement including a MIC, and means for transmitting the received MIC and the timing variable to the ProSe function in the network. The apparatus may further include means for receiving authorization to participate in D2D discovery when the device is in connected mode. It may also include means for receiving a local timing variable via the SIB.

In some examples, the apparatus may further include means for receiving, via an RRC message, a SIB for timing variable synchronization when the device is in connected mode. In other examples, the apparatus includes means for requesting D2D discovery resources via an RRC message when the device is using a network-controlled D2D discovery resource allocation scheme, wherein the timing variable is received via a response to the RRC message. The apparatus may include means for requesting D2D discovery resources via an RRC message when the device is using a device-controlled D2D discovery resource allocation scheme.

According to another set of illustrative examples, an apparatus configured for wireless communication may include at least one processor and a memory coupled to the at least one processor. The at least one processor may be configured to receive, at a device, a timing variable from a network, the timing variable received while the device is in connected mode, and use the timing variable for D2D discovery message authentication. The timing variable may be received from a ProSe function in the network. The timing variable may be received along with a D2D discovery application code and may be in UTC. The processor may be further configured to receive a timing offset allowance from the ProSe function in the network, and compare the timing variable received from the network with a local timing variable to determine whether a difference between the received timing variable and the local timing variable is less than the timing offset allowance. Additionally, the processor may be configured to declare the D2D discovery application code if the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance.

According to another set of illustrative examples, a computer program product may include at least one processor and a non-transitory computer-readable medium having non-transitory program code recorded thereon. The non-transitory program code may include program code for receiving, at a device, a timing variable from a network, the timing variable received while the device is in connected mode, and program code for using the timing variable for D2D discovery message authentication. The timing variable may be received from a ProSe function in the network. The timing variable may be received along with a D2D discovery application code and may be in Universal Time (UTC). The program code may further include program code for receiving a timing offset allowance from the ProSe function in the network, and comparing the timing variable received from the network with a local timing variable to determine whether a difference between the received timing variable and the local timing variable is less than the timing offset allowance. Additionally, the program code may include program code for announcing the D2D discovery application code if the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance.

According to another set of illustrative examples, a wireless communication method in a wireless network may include entering a connected mode with a device and, while the device is in the connected mode, transmitting a timing variable to the device for use in D2D discovery message authentication. The timing variable may be transmitted from a ProSe function. The timing variable may be transmitted along with a D2D discovery application code and may be in UTC. The method may include transmitting a timing offset allowance to the device, wherein the timing offset allowance is a maximum difference between the timing variable and a local timing variable at the device. In some examples, the method may also include receiving a discovery request from the device including a Proximity-Based Service (ProSe) application ID, and sending a discovery response to the device including the timing variable, the D2D discovery application code, a key associated with the D2D discovery application code, and the timing offset allowance. Alternatively, the method may include transmitting an RRC message including a SIB, the SIB including the timing variable. In other examples, the method may include receiving an RRC request for discovery resources, wherein transmitting the timing variable includes transmitting a response to the RRC request, the response including the timing variable.

According to another set of illustrative examples, an apparatus for wireless communication in a wireless network may include means for entering a connected mode with a device, and means for transmitting a timing variable to the device while the device is in the connected mode for use in D2D discovery message authentication. The timing variable may be transmitted from a ProSe function. The timing variable may be transmitted along with a D2D discovery application code and may be in Universal Time (UTC). The apparatus may also include means for transmitting a timing offset allowance to the device, wherein the timing offset allowance is the maximum difference between the timing variable and a local timing variable at the device. The apparatus may also include means for receiving a discovery request from the device including a ProSe application ID, and means for sending a discovery response to the device including the timing variable, the D2D discovery application code, a key associated with the D2D discovery application code, and the timing offset allowance. Additionally, the apparatus may include means for transmitting an RRC message including a SIB, the SIB including the timing variable. In other examples, the apparatus may include means for receiving an RRC request for discovery resources, wherein transmitting the timing variable includes transmitting a response to the RRC request, the response including the timing variable.

In another set of illustrative examples, an apparatus configured for wireless communication may include at least one processor and a memory coupled to the at least one processor. The at least one processor may be configured to enter a connected mode with a device and, while the device is in the connected mode, transmit a timing variable to the device for use in D2D discovery message authentication. The timing variable may be transmitted from a ProSe function. The timing variable may be transmitted along with a D2D discovery application code and may be a UTC-based counter. The processor may be further configured to transmit a timing offset allowance to the device, wherein the timing offset allowance is a maximum difference between the timing variable and a local timing variable at the device. The processor may also be configured to receive a discovery request from the device including a ProSe application ID, and to send a discovery response to the device including the timing variable, the D2D discovery application code, a key associated with the D2D discovery application code, and the timing offset allowance. Alternatively, the processor may be configured to transmit an RRC message including a SIB, the SIB including the timing variable. In other examples, the processor may be further configured to receive an RRC request for discovery resources, wherein transmitting the timing variable includes transmitting a response to the RRC request, the response including the timing variable.

According to another set of illustrative examples, a computer program product may include a non-transient computer-readable medium having non-transient program code recorded thereon. The non-transient program code may include program code for entering a connected mode with a device, and program code for transmitting a timing variable to the device when the device is in the connected mode for use in D2D discovery message authentication. The timing variable may be transmitted from a ProSe function. The timing variable may be transmitted along with a D2D discovery application code and may be in UTC. The program code may further include program code for transmitting a timing offset allowance to the device, wherein the timing offset allowance is the maximum difference between the timing variable and a local timing variable at the device. The program code may also include program code for receiving a discovery request from the device including a ProSe application ID, and sending a discovery response to the device including the timing variable, the D2D discovery application code, a key associated with the D2D discovery application code, and the timing offset allowance. The program code may also include program code for transmitting an RRC message including an SIB, the SIB including the timing variable. In other examples, the program code may include program code to receive an RRC request to discover resources, wherein transmitting the timing variable includes transmitting a response to the RRC request, the response including the timing variable.

Further scope of applicability of the described methods and apparatus will become apparent from the following detailed description, claims, and accompanying drawings. The detailed description and specific examples are given by way of illustration only, since various changes and modifications within the spirit and scope of the description will become apparent to those skilled in the art.

BRIEF DESCRIPTION OF THE DRAWINGS

A further understanding of the nature and advantages of the present invention may be achieved by referring to the following drawings. In the drawings, similar components or features may have the same reference number. In addition, components of the same type may be distinguished by following the reference number with a dash and a second reference number that distinguishes between similar components. If only the first reference number is used in the specification, the description applies to any of the similar components having the same first reference number, regardless of the second reference number.

FIG1 illustrates a block diagram of an example of a wireless communication system according to various aspects of the present disclosure;

2 is a block diagram of an example of a system for device-to-device (D2D) discovery and wireless communication according to various aspects of the present disclosure;

3 shows a message flow diagram illustrating communications between a user equipment (UE) participating in D2D discovery and a proximity-based service (ProSe) function in a network according to various aspects of the present disclosure;

4 illustrates a block diagram of an apparatus for use in wireless communications according to various aspects of the present disclosure;

5 shows a message flow diagram illustrating communications between a UE and a base station participating in D2D discovery according to various aspects of the present disclosure;

FIG6 shows a message flow diagram illustrating communications between a UE and a base station participating in D2D discovery according to various aspects of the present disclosure;

7 shows a message flow diagram illustrating communications between a UE and a base station participating in D2D discovery according to various aspects of the present disclosure;

FIG8 shows a message flow diagram illustrating communications between a UE, a ProSe function, and a base station participating in D2D discovery according to various aspects of the present disclosure;

FIG9 illustrates a block diagram of a UE for use in wireless communications according to various aspects of the present disclosure;

FIG10 illustrates a block diagram of an apparatus for use in wireless communications according to various aspects of the present disclosure;

FIG11 illustrates a block diagram of a communication system configured for receiving and transmitting D2D discovery communications according to various aspects of the present disclosure;

FIG12 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG13 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG14 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG15 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG16 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG17 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG18 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG19 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG20 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure;

FIG21 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure; and

22 shows a flow chart illustrating an example of a method of wireless communication according to various aspects of the present disclosure.

Detailed description

Typically, devices (i.e., user equipment (UE)) participate in wireless communications by communicating with a base station of a wireless communication system. However, these devices may also participate in direct device-to-device (D2D) or proximity-based services (ProSe) wireless communications. D2D discovery allows UEs that are within range of each other to communicate directly with each other, rather than through a base station. An example of when D2D wireless communication may be desired is when a UE intends to have a communication session with other UEs in close proximity, or is only visible to other UEs in the same location. A UE may broadcast a D2D discovery announcement (such as a direct peer discovery signal in a Long Term Evolution (LTE) system), which may then be received by UEs in the neighborhood that are monitoring for such discovery communications. A declaring UE may include a code, such as a D2D discovery application code, in an over-the-air (OTA) discovery announcement message. The D2D discovery application code may indicate the desired intent or functionality of the declaring UE. A monitoring UE may receive the D2D discovery announcement with its D2D discovery application code and may then determine whether the monitoring UE is available to participate in D2D communications with the declaring UE.

However, without additional information or action, the monitoring UE may not be able to verify the authenticity of the D2D discovery announcement. To mitigate this potential security risk, the declaring UE may include a message integrity code (MIC) in its D2D discovery announcement, which the monitoring UE can use in conjunction with the D2D discovery module in the wireless network to determine the authenticity of the D2D discovery communication. The element used during the generation of the MIC is a timing variable. Because the generation of the MIC by the declaring UE and the analysis of the MIC by the monitoring device require both UEs to have access to accurate timing variables, there is a need to ensure that the UEs can securely obtain or determine the timing variables.

The following description provides examples and does not limit the scope, applicability, or configuration set forth in the claims. The functions and arrangements of the elements discussed may be changed without departing from the spirit and scope of this disclosure. Various examples may appropriately omit, substitute, or add various procedures or components. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. In addition, features described with respect to certain examples may be combined in other examples.

FIG1 illustrates a block diagram of an example wireless communication system 100 according to various aspects of the present disclosure. Wireless communication system 100 includes a base station (or cell) 105, a communication device 115, and a core network 130. Base stations 105 can communicate with communication devices 115 under the control of a base station controller (not shown), which, in various examples, can be part of core network 130 or base station 105. Base stations 105 can communicate control information or user data with core network 130 via backhaul links 132. In various examples, base stations 105 can communicate with each other directly or indirectly over backhaul links 134, which can be wired or wireless communication links. Wireless communication system 100 can support operation on multiple carriers (waveform signals of different frequencies). A multicarrier transmitter can simultaneously transmit modulated signals on these multiple carriers. For example, each communication link 125 can be a multicarrier signal modulated according to the various radio technologies described above. Each modulated signal can be sent on a different carrier and can carry control information (e.g., reference signals, control channels, etc.), overhead information, data, etc.

Base station 105 can communicate wirelessly with UE 115 via one or more base station antennas. Each of base station 105 sites can provide communication coverage for a corresponding coverage area 110. In some examples, base station 105 can be referred to as a base transceiver station, a radio base station, an access point, a radio transceiver, a basic service set (BSS), an extended service set (ESS), a Node B, an evolved Node B (eNB), a Home Node B, a Home eNode B, or some other suitable terminology. The coverage area 110 of a base station can be divided into sectors (not shown) that constitute only a portion of the coverage area. The wireless communication system 100 can include different types of base stations 105 (e.g., macro base stations, micro base stations, or pico base stations). There may be overlapping coverage areas of different technologies.

In various examples, wireless communication system 100 is an LTE/LTE-A network. In an LTE/LTE-A network, the terms evolved Node B (eNB) and UE may be generally used to describe base station 105 and UE 115, respectively. Wireless communication system 100 may be a heterogeneous LTE/LTE-A network, in which different types of base stations provide coverage for various geographic regions. For example, each base station 105 may provide communication coverage for a macrocell, a picocell, a femtocell, or other types of cells. A macrocell generally covers a relatively large geographic area (e.g., an area with a radius of several kilometers) and may allow unrestricted access by UEs with service subscriptions with the network provider. A picocell generally covers a relatively small geographic area and may allow unrestricted access by UEs with service subscriptions with the network provider. A femtocell also generally covers a relatively small geographic area (e.g., a residence) and, in addition to unrestricted access, may also provide restricted access by UEs associated with the femtocell (e.g., UEs in a closed subscriber group (CSG), UEs of users in the residence, etc.). A base station for a macro cell may be referred to as, for example, a macro eNB. A base station for a pico cell may be referred to as, for example, a pico eNB. Also, a base station for a femto cell may be referred to as a femto eNB or a home eNB. A base station may support one or more (e.g., two, three, four, etc.) cells.

The core network 130 can communicate with the base stations 105 via a backhaul link 132 (e.g., S1, etc.). The base stations 105 can also communicate with each other, for example, directly or indirectly via a backhaul link 134 (e.g., X2, etc.) or via a backhaul link 132 (e.g., through the core network 130). The wireless communication system 100 can support synchronous or asynchronous operation. For synchronous operation, the base stations can have similar frame timing, and transmissions from different base stations can be approximately aligned in time. For asynchronous operation, the base stations can have different frame timing, and transmissions from different base stations may not be aligned in time. The techniques described herein can be used for both synchronous and asynchronous operation.

Base station 105 may also communicate information and commands to UE 115. For example, when UE 115 enters a connected mode with base station 105, base station 105 and UE 115 mutually authenticate each other. Once authenticated, base station 105 may securely communicate information to UE 115. Information that may be communicated from base station 105 to UE 115 includes information related to the current time or some other timing variable so that UE 115 can be fully synchronized with base station 105 (and other devices in wireless communication system 100). The current time or other timing variable may be used by UE 115 during authentication of D2D discovery messages, as further explained in the following examples.

UEs 115 are dispersed throughout the wireless communication system 100, and each UE may be stationary or mobile. UEs 115 may also be referred to by those skilled in the art as UEs, mobile devices, mobile stations, subscriber stations, mobile units, subscriber units, wireless units, remote units, wireless devices, wireless communication devices, remote devices, mobile subscriber stations, access terminals, mobile terminals, wireless terminals, remote terminals, handsets, user agents, mobile clients, clients, relays, or some other suitable terminology. UEs 115 may be cellular phones, personal digital assistants (PDAs), wireless modems, wireless communication devices, handheld devices, tablet computers, laptop computers, cordless phones, wireless local loop (WLL) stations, and the like. UEs may be capable of communicating with macro eNBs, pico eNBs, femto eNBs, relays, and the like. UEs 115-a may also communicate directly with another UE 115 via D2D wireless communication. In one example, UE 115-a-1 within coverage area 110-a of base station 105 can act as a relay for UE 115-a-2 outside of coverage area 110-a of base station 105. In-coverage UE 115-a-1 can relay (or retransmit) communications from base station 105 to out-of-coverage UE 115-a-2. Similarly, in-coverage UE 115-a-1 can relay communications from out-of-coverage UE 115-a-2 to base station 105. Furthermore, D2D wireless communication can occur between UEs 115 that are each in-coverage and can occur for many different reasons. Thus, in-coverage UE 115-a-1 can participate in D2D wireless communication with in-coverage UE 115-a-3. UE 115-a-3 can also participate in D2D wireless communication with UE 115-a-2.

In order for UE 115 to participate in D2D wireless communication, UE 115 may first engage in D2D discovery. D2D discovery allows UE 115 to discover other UEs capable of participating in D2D communication. D2D discovery involves a declaring UE, which broadcasts a D2D discovery announcement, and a monitoring UE, which monitors the D2D discovery announcement. The monitoring UE may receive the D2D discovery announcement and may subsequently respond and participate in D2D wireless communication with the declaring UE. However, excluding a base station or other network modules from such D2D communication may expose the communication to security risks. Examples of these risks and how to mitigate them are explained below.

The communication link 125 shown in the wireless communication system 100 may include an uplink (UL) transmission from the UE 115 to the base station 105, or a downlink (DL) transmission from the base station 105 to the UE 115. Downlink transmissions may also be referred to as forward link transmissions, while uplink transmissions may also be referred to as reverse link transmissions. The communication link 125 may also include D2D messages (including D2D discovery messages) exchanged between the UEs 115.

FIG2 illustrates a block diagram of an example of a system 200 for D2D discovery and wireless communication according to various aspects of the present disclosure. The system 200 of FIG2 may be an example of the wireless communication system 100 described with reference to FIG1 . In one configuration, a base station 105-a-1 may communicate with one or more devices within a coverage area 110-b-1 of the base station 105-a-1. An in-coverage UE 115-b-1 may receive communications from/transmit communications to the base station 105-a-1. One or more UEs 115-b-2, 115-b-3, 115-b-4 may be outside the coverage area 110-b-1 of the base station 105-a-1 and may participate in D2D communication. Another UE 115-b-5 may be within the coverage area 110-b-1 of the base station 105-a-1 but may also participate in D2D communication. UEs 115-b-2 and 115-b-3 may also be within the coverage area 110-b-2 of a different base station 105-a-2 and may be in communication with the base station 105-a-2. The base station 105-a and the UE 115-b may be examples of the base station 105 and the UE 115 described with reference to FIG.

In one embodiment, the in-coverage UE 115-b-1 may broadcast, multicast, or unicast a D2D discovery signal via the communication link 125. The signal may be sent to one or more UEs in or out of coverage. The D2D discovery signal may be a D2D discovery announcement message. The D2D discovery announcement message may indicate, for example, an identifier of the in-coverage UE 115-b-1. For example, the identifier may be a media access control (MAC) address of the in-coverage UE 115-b-1. In addition, the D2D discovery signal may include a D2D discovery application code of the UE 115-b-1.

In one configuration, an out-of-coverage UE may transmit a D2D discovery signal to one or more in-coverage UEs 115-b-1. The peer discovery signal may indicate that the out-of-coverage UE is out of coverage or is requesting relay service. The signal may include an identifier for the out-of-coverage UE. In one configuration, a UE may broadcast a D2D discovery signal when it senses that it is about to leave the coverage area 110-b-1 of base station 105-a-1. In another embodiment, a UE may broadcast a signal when it is already outside the coverage area 110-b-1.

As an additional example, two in-coverage UEs 115-b-1 and 115-b-5 may also communicate with each other via a direct D2D connection. In this example, UE 115-b-5 may transmit a signal requesting a direct D2D connection with another UE adjacent to UE 115-b-5. UE 115-b-1 may receive the request and subsequently initiate direct D2D communication with UE 115-b-5. In an additional example, UEs 115-b-2 and 115-b-3 may each communicate with UE 115-b-1 via a direct D2D connection. For example, UE 115-b-1 may act as a relay for UEs 115-b-2 and 115-b-3.

Before UE 115 can participate in D2D wireless communication, it may first be authorized. Authorization is granted by core network 130-a. Specifically, core network 130-a may include a network D2D discovery module 210 enabled to authorize D2D communication. An example of network D2D discovery module 210 is ProSe functionality. UE 115 may request authorization for D2D communication by communicating with network D2D discovery module 210 via wireless interface 215 (such as a PC3 interface). Network D2D discovery module 210 may respond by authorizing the requesting UE 115.

During authorization for D2D communication, the network D2D discovery module 210 generates a D2D discovery application code (such as a ProSe application code). For example, the D2D discovery application code corresponds to the D2D functionality to be engaged by the announcer UE 115-b-1. Thus, once authorized, the announcer UE 115-b-1 may broadcast the D2D discovery application code as part of a D2D discovery announcement.

The network D2D discovery module 210 may also be used to generate security elements for use by the UE 115 participating in D2D discovery to protect D2D discovery messages. This may provide protection against rogue base stations, such as the base station 105-a-3 in the system 200. The base station 105-a-3 may be used to hijack D2D communications originating from the UE 115. Thus, the security scheme may be used by the UE 115 and the network D2D discovery module 210 to protect against the risk of rogue base stations 105-a-3.

FIG3 shows a message flow diagram 300 illustrating a security scheme used by UEs 115-c-1, 115-c-2 and a network D2D discovery module 210-a participating in D2D discovery according to various aspects of the present disclosure. The UEs and the network D2D discovery module may be examples of the UEs 115 described in FIG1 and/or 2 and the network D2D discovery module 210 described in FIG2.

The announcing UE 115-c-1 may send a discovery request 305 to a network D2D discovery module 210-a in the network to request permission to announce the D2D discovery application code to other devices, such as the monitoring UE 115-c-2. In response, the network D2D discovery module 210-a may return the D2D discovery application code to the announcing UE 115-c-1. In addition to generating the D2D discovery application code for the announcing UE 115-c-1, the network D2D discovery module 210-a may also generate a key associated with the D2D discovery application code. The network D2D discovery module 210-a may transmit a discovery response message 310 to the announcing UE 115-c-1, including the D2D discovery application code and the associated key. In addition, the network D2D discovery module 210-a may provide the announcer UE 115-c-1 with a current time (CURRENT_TIME) parameter, which may include current timing information (e.g., timing variable) and a timing offset allowance at the D2D discovery module 210-a. The D2D discovery module 210-a in the network may be a ProSe function in a home public land mobile network (HPLMN) or a visited PLMN (VPMLN) serving the UE. The timing offset allowance may be referred to herein as a maximum offset (MAX_OFFSET) indicating the maximum difference between the timing variable and a local timing variable at the UE. The announcer UE 115-c-1 may use the received D2D discovery application code and associated key and the timing variable to generate a message integrity code (MIC) (at step 315). The timing variable may be an element of timing information, such as Coordinated Universal Time (UTC) or some other system time. Alternatively, the timing variable may be a counter value that is incremented, for example, for each D2D discovery cycle but does not wrap around very frequently. In either case, the timing variable may be obtained from other sources. For example, the timing variable may be obtained via a network identity and time zone (NITZ), a network time protocol (NTP), a broadcast system information block 16 (SIB16), or a global positioning system (GPS). The announcer UE 115-c-1 may then compare the timing variable received from the D2D discovery module 210-a with the local timing variable to determine whether the difference between the received timing variable and the local timing variable is within a timing offset allowance (e.g., MAX_OFFSET). If it is determined that the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance, the announcer UE 115-c-1 may begin announcing a D2D application code (such as a ProSe application code). If the difference is greater than the timing offset allowance, the announcer UE 115-c-1 may recognize that an anomaly has occurred and attempt some other method, which may be pre-configured or configured by the ProSe function, to receive an updated timing variable. For example, the announcer UE 115-c-1 may notify the ProSe function of the anomaly. Alternatively, the announcer UE 115-c-1 may transition to connected mode and make a request for updated timing variables to a base station (eg, eNB) via an RRC message.

Announcer UE 115-c-1 may use the associated discovery key and timing variables to generate a MIC to be included in the D2D discovery application code (step 315). Announcer UE 115-c-1 may then include the MIC along with the D2D discovery application code in its D2D discovery announcement message 320. Monitoring UE 115-c-2 may be served by a network different from the network serving announcer UE 115-c-1. Thus, the network D2D discovery module of monitoring UE 115-c-2 may be different from the network D2D discovery module 210-a of announcer UE 115-c-1. In such a scenario, the D2D discovery module of the monitoring UE and the D2D discovery module of the announcer UE may exchange monitoring request and response messages.

Before receiving the D2D discovery announcement message 320, the monitoring UE 115-c-2 may exchange discovery requests 305-a and response messages 310-a with the D2D discovery module 210-b of its own network. For example, the monitoring UE 115-c-2 may send a discovery request message containing a D2D application code to a D2D discovery module (e.g., a ProSe function) in the network to obtain the discovery filter it wants to listen for. The D2D discovery module in the network may then return a discovery filter containing the D2D application code or the ProSe mask, or both, along with CURRENT_TIME and MAX_OFFSET parameters. The monitoring UE 115-c-2 may then set its ProSe clock to CURRENT_TIME and store MAX_OFFSET, overwriting any previous value. Like the announcer UE 115-c-1, the monitoring UE 115-c-2 may have received a timing variable from various sources available to the monitoring UE 115-c-2 (e.g., SIB16, NITZ, NTP, or GPS). The received timing variable may be stored by the monitoring UE 115-c-2 and incremented according to the type of timing information represented by the timing variable. With the received discovery filter, the monitoring UE 115-c-2 may listen for discovery announcement messages that match the discovery filter if the timing variable is within the MAX_OFFSET of its ProSe clock.

When monitoring UE 115-c-2 receives D2D discovery announcement message 320, monitoring UE 115-c-2 transmits the received D2D discovery application code to network D2D discovery module 210-a for verification in message 325. Message 320 also includes a timing variable as known by monitoring UE 115-c-2. In some examples, the message may be a match report 325 containing a UTC-based timing variable having four least significant bits (LSBs) equal to the four LSBs received with the discovery announcement message and closest to the timing variable of the monitoring UE associated with the discovery slot in which the discovery announcement was heard. In a case where the network D2D discovery module of the monitoring UE 115-c-2 is different from the network D2D discovery module 210-a of the announcing UE 115-c-1, the D2D discovery module 210-b of the network serving the monitoring UE 115-c-2 passes the matching report 325 to the D2D discovery module 210-a of the network serving the announcing UE 115-c-1.

The network D2D discovery module 210-a verifies the MIC (at step 330) using the timing variables received from the monitoring UE 115-c-2. For example, if the timing variables received from the monitoring UE 115-c-2 are within the allowed timing offset, the MIC is verified. If the timing variables used by the announcer UE 115-c-1 to generate the MIC are similar to the timing variables transmitted to the network D2D discovery module 210-a by the monitoring UE 115-c-2, the MIC is verified. If the MIC is verified, the network D2D discovery module 210-a notifies the monitoring UE 115-c-2 via a message 335, potentially including additional information regarding the D2D communication. In the event that the network D2D discovery module 210-b of the monitoring UE 115-c-2 is different from the network D2D discovery module 210-a of the announcer UE 115-c-1, the D2D discovery module 210-a of the announcer UE 115-c-1 may send an acknowledgment of the successful verification of the MIC to the D2D discovery module 210-b of the network serving the monitoring UE 115-c-2 in a match report ACK message 336. The D2D discovery module 210-b of the monitoring UE 115-c-2 may then send a match response 337 to the monitoring UE 115-c-2. The monitoring UE 115-c-2 may then engage in D2D wireless communication 340 with the announcer UE 115-c-1.

In the above security scheme, both the announcer and the monitoring UE can use unprotected time to obtain the timing variable associated with the discovery slot. This means that if the UE is tricked into using a time different from the current time, the discovery announcement message can be successfully replayed by an attacker (such as rogue base station 105-a-3 (Figure 2)).

For example, rogue base station 105-a-3 can be configured to broadcast a different system time in the SIB that is ahead of the actual UTC. If an announcer UE synchronizes to the broadcasted time, the announcer UE will broadcast a MIC based on a timing variable whose time value has not yet occurred. Rogue base station 105-a-3 can receive the D2D discovery announcement message from the announcer UE and store the associated D2D discovery application code and MIC. Subsequently, at a later time corresponding to the time erroneously broadcast by rogue base station 105-a-c, an attacker can "replay" the stored D2D discovery application code and MIC as a broadcast, thereby potentially tricking other monitoring UEs into engaging in D2D communications with an unauthorized entity.

In another example, an attacker may record the broadcast D2D discovery announcements from the announcer UE (recording both the D2D discovery application code and the MIC) as well as the system time at which the D2D discovery announcements were broadcast. At some later time, the attacker may deploy a rogue base station 105-a-3 that broadcasts a SIB containing an incorrect timing variable. Instead of including the correct time, the incorrectly broadcast SIB includes the system time corresponding to when the announcer UE broadcast its D2D discovery announcements. If a monitoring UE synchronizes its timing variable to the incorrectly broadcast SIB, the attacker can replay the recorded D2D discovery messages and thereby trick the monitoring UE into engaging in D2D communications with the attacker.

Therefore, disclosed herein are methods and apparatus for precluding such replay attacks involving timing variables. In the disclosed examples, both the announcer and the monitoring UE may be able to obtain and synchronize with the received timing variables in a secure manner.

The timing offset allowed (e.g., MAX_OFFSET) can be used to limit the ability of an attacker to successfully replay a discovery message or obtain a correctly integrity checked discovery message for later use. For example, MAX_OFFSET is used as the maximum difference between the UTC-based time associated with the discovery slot and a local timing variable stored at the monitoring device (e.g., a ProSe clock maintained by the monitoring device). In some examples, the UE may receive the timing variable when it is in connected mode to securely obtain the timing variable. For example, when the UE is in radio resource control (RRC) connected mode, the UE and the connected entity (e.g., a base station) are mutually authenticated. Thereby, the information exchanged between the connected entities at this time can be protected. The timing variable received by the UE when in connected mode can therefore be considered secure or can at least be verified to be valid.

Because entering connected mode is expensive in terms of battery life, spectrum, and processing at the UE, the reception of the timing variable should occur while the UE is already in connected mode. In other words, the UE should avoid entering connected mode simply for the purpose of obtaining and synchronizing to the timing variable. Instead, the UE can obtain the timing variable when it has entered connected mode, for example, to obtain D2D discovery authorization. Thus, the UE can also obtain the timing variable when authorized for D2D discovery communications.

FIG4 illustrates a block diagram 400 of an apparatus 405 for use in wireless communications, according to various aspects of the present disclosure. In some examples, apparatus 405 may be an example of aspects of one or more UEs 115 described with reference to FIG1 , 2 , and/or 3 , and may participate in D2D wireless communications. Apparatus 405 may also be a processor. Apparatus 405 may include a receiver module 410, a D2D discovery module 415, and/or a transmitter module 420. Each of these components may be in communication with one another.

The components of device 405 may be implemented individually or collectively using one or more application-specific integrated circuits (ASICs) adapted to perform some or all applicable functions in hardware. Alternatively, these functions may be performed by one or more other processing units (or cores) on one or more integrated circuits. In other examples, other types of integrated circuits (e.g., structured/platform ASICs, field programmable gate arrays (FPGAs), and other semi-custom ICs) that can be programmed in any manner known in the art may be used. The functions of each unit may also be implemented, in whole or in part, using instructions embodied in memory and formatted to be executed by one or more general-purpose or application-specific processors.

In some examples, receiver module 410 may include at least one radio frequency (RF) receiver, such as at least one RF receiver operable to receive transmissions over a radio frequency spectrum. In some examples, the radio frequency spectrum may be used for LTE/LTE-A communications, as described, for example, with reference to Figures 1, 2, and/or 3. Receiver module 410 may be used to receive various types of data and/or control signals (i.e., transmissions) over one or more communication links of a wireless communication system, such as one or more communication links 125 of wireless communication system 100 described with reference to Figures 1 and/or 2. In addition, receiver module 410 may also be used to receive D2D communications over one or more communication links of a wireless communication system, such as one or more communication links 125 of wireless communication system 100. Specific examples of some types of D2D communications received by receiver module 410 include messages 305, 315, and 330, and D2D wireless communications 335, as described with reference to Figure 3.

In some examples, transmitter module 420 may include at least one RF transmitter, such as at least one RF transmitter operable to transmit D2D messages. Transmitter module 420 may be used to transmit various types of data and/or control signals (i.e., transmissions) over one or more communication links of a wireless communication system, such as one or more communication links 125 of wireless communication system 100 described with reference to FIGs. 1 and/or 2. Additionally, transmitter module 420 may also be used to transmit D2D communications over one or more communication links 125. Examples of the types of data or control signals received by transmitter module 420 include messages 315 and 320 and D2D wireless communications 335, as described with reference to FIG. 3.

In some examples, the D2D discovery module 415 can be used to manage the reception and transmission of D2D discovery messages and D2D communications via the receiver module 410 and/or the transmitter module 420. Managing the transmission and reception of D2D discovery messages can include receiving a D2D discovery application code and key from the network D2D discovery module, transmitting the D2D discovery application code, MIC, and local timing variable, and receiving MIC verification, as illustrated in messages 305, 310, 315, 320, 325, and 335 and step 310 of FIG3 . The MIC module 425 of the D2D discovery module 415 can be used in the advertiser UE to generate a MIC from the D2D discovery application code, key, and timing variable received from the network. The MIC module 425 can also be used to assist in verifying the MIC in the monitoring UE. Furthermore, to enhance the security of the MIC, the D2D discovery module 415 can include a timing variable module 430, which can be used to receive and store timing variables used to generate and/or verify the MIC. The timing variable module 430 may use several different alternative methods to accomplish this.

5 shows a message flow diagram 500 illustrating communications between a UE 115-d and a base station 105-b participating in D2D discovery according to various aspects of the present disclosure. The UE and base station may be examples of the UE 115 described in FIGs. 1, 2, 3, and/or 4 and the base station 105 described in FIGs.

Once UE 115-d is in connected mode 505 with base station 105-b, UE 115-d and base station 105-b are mutually authenticated, and thus communications exchanged between the two entities during this connected mode 505 can be secure. Base station 105-b can determine (at block 510) whether UE 115-d is authorized to participate in D2D discovery communications (e.g., via receiving authorization from a network D2D discovery module). UE 115-d can send a discovery request message 510 to base station 105-b to be allowed to announce a D2D discovery application code. In response, base station 105-b can return a D2D discovery application code and a discovery key associated with the D2D discovery application code to enable UE 115-d to make the announcement. Once base station 105-b recognizes UE 115-d as a D2D UE, base station 105-b can send a discovery response 515 to UE 115-d, including the application code and the associated discovery key. The discovery response may also include a CURRENT_TIME parameter (which may include the UTC-based time at the D2D discovery module 210 - a ), a MAX_OFFSET, and/or a validity timer, as described with reference to FIG. 3 .

When UE 115-d receives the discovery response 515, UE 115-d may set its clock (e.g., ProSe clock) used for authentication to the value of CURRENT_TIME and store MAX_OFFSET, thereby overwriting the previous value. In some examples, UE 115-d may receive the value of a UTC-based counter associated with the discovery slot. The counter may be set to a UTC time value with a granularity of seconds. In some cases, UE 115-d seeks to detect and obtain the timing variable, for example, via SIB broadcast message 520. For example, UE 115-d may obtain the SIB broadcast schedule via System Information Block Type 1, which is typically obtained by UEs in connected mode. SIBs are generally transmitted in the downlink channel DL_SCH. When UE 115-d receives the SIB and the timing variable included therein, UE 115-d may verify that no anomalies have occurred (step 525) and then store the received timing variable to compare the timing variable with its own local timing variable (step 530).

In certain situations where a rogue base station is active, verification that no anomalies have occurred may be necessary. For example, the rogue base station may also receive SIB scheduling information from the legitimate base station 105-b and subsequently attempt to inject timing-related SIBs into the same broadcast slot scheduled by the legitimate base station 105-b. Therefore, in this situation, UE 115-d may observe multiple SIBs of the same type being broadcast simultaneously. Many UEs are unable to handle receiving two SIBs of the same type in the same broadcast slot and may default to reading only one of the received SIBs. Other UEs are able to receive multiple SIBs of the same type, but may then compare the timing variables (e.g., UTC-based times) included in the received SIBs to determine whether there is a conflict. If UE 115-d receives multiple SIBs of the same type or determines that there is a difference between the received timing variables of the received SIBs, UE 115-d may choose not to store and synchronize the received timing variables, but instead continue to use its own local copy. Alternatively, UE 115-d may choose to use a different method (described below) for updated timing variables.

When a rogue base station broadcasts an SIB at the same time as a legitimate base station 105-b broadcasts the same type of SIB, various anomalies may occur at UE 115-d. As described above, UE 115-d may receive both broadcast SIBs. Alternatively, the broadcast SIBs may conflict with each other, in which case UE 115-d is unable to receive either of the broadcast SIBs. In another scenario, legitimate SIBs may be broadcast with sufficient power so that UE 115-d only detects counterfeit SIBs. Thus, it is useful to have UE 115-d compare the received timing variable with its own local copy and determine whether there is a significant difference. If there is a significant difference (i.e., the difference exceeds a predetermined threshold), UE 115-d can recognize that an anomaly has occurred and UE 115-d should try some other method for receiving updated timing variables.

FIG6 illustrates a method for obtaining a timing variable. FIG6 shows a message flow diagram 600 illustrating communications between a UE 115-e and a base station 105-c participating in D2D discovery according to various aspects of the present disclosure. The UE and base station may be examples of the UE 115 described in FIG1, 2, 3, and/or 4 and the base station 105 described in FIG1 and/or 2.

Once UE 115-e is in connected mode 605 with base station 105-c, UE 115-e and base station 105-c are mutually authenticated, and thus communications exchanged between the two entities during this connected mode 605 can be secure. Base station 105-c can determine (at block 610) whether UE 115-e is authorized to participate in D2D discovery communications (e.g., via receiving authorization from a network D2D discovery module). Once base station 105-c recognizes UE 115-e as a D2D UE, base station 105-c can proactively forward an RRC message 615 to UE 115-e without waiting for a request from UE 115-e. RRC message 615 may include a SIB with the required timing variables. For example, RRC message 615 may be an RRC connection reconfiguration message and may include SIB16 or some other SIB dedicated to D2D communications that includes timing variables. Once UE 115-e receives the timing variable via RRC message 615, UE 115-e may compare its own local timing variable with the received timing variable (step 620). Note that the base station may only send the additional timing variable in signaling to UEs authorized for D2D communication, thereby maintaining legacy support by not affecting other UEs not participating in D2D communication.

FIG7 illustrates another method for obtaining a timing variable. FIG7 shows a message flow diagram 700 illustrating communications between a UE 115-f and a base station 105-d participating in D2D discovery, according to various aspects of the present disclosure. The UE and base station may be examples of the UE 115 described in FIG1, 2, 3, and/or 4 and the base station 105 described in FIG1 and/or 2.

Once UE 115-f is in connected mode 705 with base station 105-d, UE 115-f and base station 105-d authenticate each other, and thus communications exchanged between the two entities during this connected mode 705 can be secure. In this method, UE 115-f utilizes additional messages that may already be necessary to participate in D2D communications. For example, UE 115-f may transmit a dedicated RRC message 710 to base station 105-d to request D2D resources. D2D resources may be allocated by the base station according to either a Type 1 (public or device-controlled) resource allocation or a Type 2 (dedicated or network-controlled) resource allocation. Device-controlled or Type 1 discovery resources are not dedicated to any given UE, but rather represent a pool of discovery resources from which one or more UEs may autonomously select resources for D2D discovery. Type 2 or network-controlled resources are uniquely allocated to individual UEs.

Thus, when UE 115-f is using a Type 2 allocation, UE 115-f may send an RRC request 710 to base station 105-d to receive its specific resource allocation. Base station 105-d may return an RRC response 715 to UE 115-f in response to RRC request 710. In the case of a Type 2 allocation, RRC response 715 may include an allocation of resources for D2D communication. In addition, however, RRC response 715 may also include necessary timing variables.

When UE 115-f is using a Type 1 allocation of D2D resources, UE 115-f may not be required to obtain a specific resource allocation from base station 105-d. However, in this method, UE 115-f still sends an RRC request 710 to base station 105-d. Base station 105-d may respond with an RRC response 715. However, because resource allocation is not required from base station 105-d, RRC response 715 may not include a resource allocation, but instead may only include the necessary timing variables.

Therefore, regardless of whether UE 115-f is using a Type 1 or Type 2 allocation of D2D resources, UE 115-f may send an RRC request 710 to base station 105-d. In either case, base station 105-d will send an RRC response 715 to UE 115-f, where RRC response 715 includes the necessary timing variables. An example of an RRC request 710 that may be sent by UE 115-f is an RRC ProSe resource allocation request. An example of an RRC response 715 that may be received is an RRC ProSe resource allocation. Once UE 115-f receives the timing variables via RRC response 715, UE 115-f may synchronize its own local timing variables to the received timing variables (step 720).

An additional method for securely obtaining a timing variable is illustrated in FIG8 , which shows a message flow diagram 800 illustrating communications between a UE 115-g participating in D2D discovery, a network D2D discovery module 210-b, and a base station 105-e, according to various aspects of the present disclosure. The UE may be an example of the UE 115 described in FIG1 , 2, 3, and/or 4. The base station may be an example of the base station 105 described in FIG1 and/or 2. The network D2D discovery module 210-b may be an example of the network D2D discovery module 210 and/or 210-a described with reference to FIG2 and/or 3.

In this scenario, the timing variable information is not initially obtained from the base station 105-e, but instead is obtained from the network D2D discovery module 210-b. This occurs when the UE 115-g is seeking authorization from the network D2D discovery module 210-b to engage in D2D communications. To do so, the UE 115-g enters a connected mode 805 with the network D2D discovery module 210-b. The UE 115-g then submits a request 810 for D2D discovery authorization to the network D2D discovery module 210-b. The network D2D discovery module 210-b responds with a response 815, which may include the authorization and the required timing variables. The UE 115-g may then synchronize the received timing variables (step 820).

Response 815 may also include a timing offset allowance. Because communications between UE 115-g and network D2D discovery module 210-b may be subject to various network delays, the timing offset allowance is included along with the timing variable to indicate a maximum timing offset that can be used to prevent the aforementioned replay attack. The timing offset allowance enables UE 115-g to evaluate the accuracy of a later received timing variable, as explained below.

After storing and synchronizing the timing variable received from the network D2D discovery module 210-b via message 815 (step 820), the UE 115-g may detect the local timing variable in the broadcast SIB. For example, the base station 105-e may broadcast a SIB broadcast message 825 including the timing variable. The UE 115-g may then compare the timing variable (previously synchronized with the timing variable provided by the network D2D discovery module 210-b) with the local timing variable provided in the broadcast SIB, thereby identifying any anomalies (block 830). If the two timing variables are within the allowable offset specified by the timing offset allowance, the UE 115-g may assume that the broadcast SIB is authentic and the UE 115-g may store the local timing variable included with the broadcast SIB (block 835). If the difference between the two timing variables is greater than the offset allowed by the timing offset allowance, the UE 115-g may mark this as an anomaly and may continue to use the stored timing variables, may notify the network D2D discovery module 210-b, and/or may use one of the different methods described above to obtain an updated timing variable.

The timing offset allowance may also be used by the network D2D discovery module 210 during verification of the MIC (as described with reference to FIG3 ). Thus, when the network D2D discovery module 210 verifies the MIC, the timing offset allowance may be used to define an acceptable difference between the timing variable used to generate the MIC and the timing variable transmitted by the monitoring UE.

While the timing variable module 430 may perform functions related to the timing variables using any of the methods described above with reference to FIGs. 5, 6, 7, and/or 8, the MIC module 425 (of FIG. 4) uses the timing variables to generate and/or verify the MIC.

Returning again to FIG. 4 , MIC module 425 generates a MIC based on timing variables when UE 115 is ready to broadcast a MIC (e.g., via message 320 of FIG. 3 ). For example, MIC module 425 may obtain an estimated message transmission time from transmitter module 420, for example. This transmission time estimate may be based on the D2D discovery time slot, available D2D discovery resources allocated by the network, and the UE's timing variables. As an example, the discovery time slot may be set by the network every ten seconds, and D2D discovery messages may only be sent within certain radio resources and within certain radio frames. Therefore, in addition to its current state, transmitter module 420 may also consider factors such as the number of D2D discovery messages in its queue, transmission opportunities based on the control algorithm, any estimated delay in preparing the message for transmission, etc., when determining the estimated time of transmission. Transmitter module 420 may then provide an estimated time when the MIC message may be sent over the air and then provide this estimated time to MIC module 425. MIC module 425 may then use this estimated time in generating its MIC.

If the device 405 is a monitoring UE, the MIC module 425 may receive the MIC and timestamp the received message using the UE's timing variable. The device 405 then passes the received MIC, the received D2D discovery application code, and the timestamp based on the timing variable to the network D2D discovery module 210.

Alternatively, the monitoring UE may include in its message to the network D2D discovery module 210 a time difference representing the elapsed time between the time when the monitoring UE receives the MIC and the time when the monitoring UE transmits the MIC to the network D2D discovery module 210. In this case, the network D2D discovery module 210 may use the time difference to determine the timing variable value when the MIC is received.

Thus, the D2D discovery module 415 may be used in both the announcer and the monitor UEs to receive the timing variable and generate and/or forward the MIC. Additionally, the device 405 may use the D2D discovery module 415 to forward the timing variable to other UEs, such as out-of-coverage UEs (e.g., UE 115-b-4 of FIG. 2 ).

FIG9 shows a block diagram 900 of a UE 115-i for use in wireless communications according to various aspects of the present disclosure. The UE 115-i can have various configurations and can be included in or part of a personal computer (e.g., a laptop computer, a netbook computer, a tablet computer, etc.), a cellular phone, a smartphone, a PDA, a digital video recorder (DVR), an internet appliance, a game console, an e-reader, etc. The UE 115-i can have an internal power source (not shown) such as a small battery to facilitate mobile operation in some examples. In some examples, the UE 115-i can be an example of one or more aspects of one of the UEs 115 or devices 405 described with reference to FIG1 , 2, 3, 4, 5, 6, 7, and/or 8. The UE 115-i can be configured to implement at least some of the features and functions described with reference to FIG1 , 2, 3, 4, 5, 6, 7, and/or 8.

The UE 115-i may include a UE processor module 905, a UE memory module 910, at least one UE transceiver module (represented by the UE transceiver module 930), at least one UE antenna (represented by the UE antenna 935), or a D2D discovery module 415-a. Each of these components may communicate with each other directly or indirectly over one or more UE buses 925. The UE 115-i may also include a base station communication module 925 that may perform operations related to communication with one or more base stations.

The UE memory module 910 may include random access memory (RAM) or read-only memory (ROM). The UE memory module 910 may store computer-readable, computer-executable UE software (SW) code 920 containing instructions that, when executed, are configured to cause the UE processor module 905 to perform the various functions described herein, such as for communicating D2D discovery-related messages. Alternatively, the UE software code 920 may not be directly executable by the UE processor module 905, but may be configured (e.g., when compiled and executed) to cause the UE 115-i to perform the various functions described herein.

The UE processor module 905 may include intelligent hardware devices, such as a central processing unit (CPU) (such as those manufactured by companies or), a microcontroller, an application-specific integrated circuit (ASIC), etc. The UE processor module 905 may process information received through the UE transceiver module 930 or information to be sent to the UE transceiver module 930 for transmission through the UE antenna 935. The UE processor module 905 may handle various aspects of transmitting, receiving, and managing D2D discovery communications alone or in conjunction with the D2D discovery module 415-a.

The UE transceiver module 930 may include a modem configured to modulate packets and provide the modulated packets to the UE antenna 935 for transmission, and to demodulate packets received from the UE antenna 935. In some examples, the UE transceiver module 930 may be implemented as one or more transmitter modules and one or more separate receiver modules. The UE transceiver module 930 may support D2D discovery-related communications. The UE transceiver module 930 may be configured to communicate bidirectionally with, for example, a base station 105-f (which may be one or more base stations 105 described with reference to Figures 1, 2, 5, 6, 7, and/or 8) via the UE antenna 935 and communication link 125. The UE transceiver module 930 may also be configured to communicate bidirectionally with, for example, a UE 115-h (which may be one or more of the UE 115 described with reference to Figures 1, 2, 3, 5, 6, 7, and/or 8, or the apparatus 405 described with reference to Figure 4) via the UE antenna 935 and communication link 125. Although UE 115 - i may include a single UE antenna, there are examples where UE 115 - i may include multiple UE antennas 935 .

The D2D discovery module 415-a can be configured to perform or control some or all of the features or functions related to D2D discovery described with reference to Figures 1, 2, 3, 4, 5, 6, 7, and/or 8. For example, the D2D discovery module 415-a can be configured to support the transmission and reception of D2D discovery messages and the management of D2D discovery enabled by the D2D discovery messages. In some examples, and by way of example, the D2D discovery module 415-a can be an example of one or more aspects of the D2D discovery module 415 described with reference to Figures 4, 5, 6, 7, and/or 8. The D2D discovery module 415-a can include a MIC module 425-a (which can be an example of the MIC module 425 of Figure 4) and a timing variable module 430-a (which can be an example of the timing variable module 430 of Figure 4). The D2D discovery module 415-a or portions thereof may include a processor, or some or all of the functions of the D2D discovery module 415-a may be performed by or in conjunction with the UE processor module 905. Additionally, the D2D discovery module 415-a or portions thereof may include a memory, or some or all of the functions of the D2D discovery module 415-a may use or be used in conjunction with the UE memory module 910.

FIG10 illustrates a block diagram 1000 of an apparatus 1005 for use in wireless communications according to various aspects of the present disclosure. In some examples, apparatus 1005 may be an example of aspects of one or more base stations 105 described with reference to FIG1 , 2, 5, 6, 7, and/or 8. Apparatus 1005 may also be a processor. Apparatus 1005 may include a base station receiver module 1010, a base station D2D discovery module 1015, or a base station transmitter module 1020. Each of these components may be in communication with one another.

The components of device 1005 may be implemented individually or collectively using one or more ASICs adapted to perform some or all applicable functions in hardware. Alternatively, these functions may be performed by one or more other processing units (or cores) on one or more integrated circuits. In other examples, other types of integrated circuits (e.g., structured/platform ASICs, FPGAs, and other semi-custom ICs) that can be programmed in any manner known in the art may be used. The functions of each unit may also be implemented, in whole or in part, using instructions embodied in memory and formatted to be executed by one or more general-purpose or application-specific processors.

In some examples, the base station receiver module 1010 may include at least one RF receiver, such as at least one RF receiver operable to receive transmissions over a radio frequency spectrum. In some examples, the radio frequency spectrum may be used for LTE/LTE-A communications, as described, for example, with reference to FIG. 1 , 2 , or 7 . The base station receiver module 1010 may be used to receive various types of data or control signals (i.e., transmissions) over one or more communication links of a wireless communication system, such as one or more communication links 125 , 134 of the wireless communication system 100 described with reference to FIG. 1 or 2 . Examples of the types of data or control signals received by the base station receiver module 1010 include D2D discovery communications as described with reference to FIG. 5 , 6 , 7 , or 8 .

In some examples, base station transmitter module 1020 may include at least one RF transmitter, such as at least one RF transmitter operable to transmit D2D discovery communications. Base station transmitter module 1020 may be used to transmit various types of data or control signals (i.e., transmissions) over one or more communication links of a wireless communication system, such as one or more communication links 125, 134 of wireless communication system 100 described with reference to FIG. 1 or 2 . Examples of the types of data or control signals transmitted by base station transmitter module 1020 include D2D discovery communications as described with reference to FIG. 5 , 6 , 7 , or 8 .

In some examples, the base station D2D discovery module 1015 can be used to manage the reception of the D2D discovery request 710 and the transmission of the D2D discovery messages 515, 520, 615, 715, or 825 (see Figures 5, 6, 7, and 8) via the base station receiver module 1010 and/or the base station transmitter module 1020. Managing the reception and transmission of D2D discovery communications can include transmitting a timing variable to the UE while the UE is in a connected mode with the device 1005. For example, referring to Figure 5, the base station D2D discovery module 1015 can manage the communication of the SIB in the message 520. In an additional example, referring to Figure 6, the base station D2D discovery module 1015 can manage the communication of the RRC message 615 to the connected UE 115-e, where the RRC message includes the SIB with the timing variable. 7 , the base station D2D discovery module 1015 may manage the reception of an RRC request 710 for resources and respond with an RRC response 715 including a timing variable in response to the request 710. Referring to FIG8 , the device 1005 may broadcast a SIB with a timing variable in an SIB message 825.

FIG11 illustrates a block diagram of a communication system 1100 that can be configured for use in receiving and transmitting D2D discovery communications, according to aspects of the present disclosure. System 1100 can be an example of aspects of wireless communication systems 100 and/or 200 described in FIG1 and/or 2. System 1100 can include a base station 105-g. Base station 105-g can include a base station antenna 1145, a base station transceiver module 1150, a base station memory 1180, and a base station processor module 1170, each of which can be in direct or indirect communication with one another (e.g., over one or more buses). Base station transceiver module 1150 can be configured to communicate bidirectionally with UE 115-j (which can be an example of UE 115 of FIG1 , 2 , 3 , 5 , 6 , 7 , and/or 8 and/or apparatus 405 of FIG4 ) via base station antenna 1145. Base station transceiver module 1150 (and/or other components of base station 105-g) can also be configured to communicate bidirectionally with one or more networks. In some cases, the base station 105-g can communicate with the core network 130-b and/or the controller 1120 via the network communication module 1175. The base station 105-g can be an example of the base station 105 of Figures 1, 2, 5, 6, 7, and/or 8 and/or the apparatus 1005 of Figure 10, and can also be an eNodeB base station, a Home eNodeB base station, a NodeB base station, and/or a Home NodeB base station. In some cases, the controller 1120 can be integrated into the base station 105-g, such as for an eNodeB base station.

Base station 105-g may also communicate with other base stations 105, such as base station 1005-m and base station 1005-n. Each of base stations 105 may communicate with UE 115-j using a different wireless communication technology, such as a different radio access technology. In some cases, base station 105-g may utilize base station communication module 1165 to communicate with other base stations, such as 1005-m and/or 1005-n. In some examples, base station communication module 1165 may provide an X2 interface within LTE wireless communication technology to provide communication between some base stations 105. In some examples, base station 105-g may communicate with other base stations via controller 1120 and/or core network 130-b.

Base station memory 1180 may include RAM and ROM. Base station memory 1180 may also store computer-readable, computer-executable software code 1185, which contains instructions configured to, when executed, cause base station processor module 1170 to perform the various functions described herein (e.g., receiving and transmitting D2D discovery communications). Alternatively, software code 1185 may not be directly executable by base station processor module 1170, but may be configured (e.g., when compiled and executed) to cause a computer to perform the functions described herein.

The base station processor module 1170 may include intelligent hardware devices, such as a CPU, a microcontroller, an ASIC, etc. The base station processor module 1170 may include a speech encoder (not shown) configured to receive audio via a microphone, convert the audio into packets representing the received audio (e.g., 30 ms in length, etc.), provide these audio packets to the base transceiver module 1150, and provide an indication of whether the user is speaking. Alternatively, the encoder may simply provide packets to the base transceiver module 1150, with the indication of whether the user is speaking being provided by the provision or withholding/suppression of the packets themselves.

The base station transceiver module 1150 may include a modem configured to modulate packets and provide the modulated packets to the base station antenna 1145 for transmission, and to demodulate packets received from the base station antenna 1145. Although some examples of the base station 105-g may include a single base station antenna 1145, the base station 105-g preferably includes multiple base station antennas 1145 for multiple links, which may support carrier aggregation. For example, one or more links may be used to support macro communications with the UE 115-j.

According to the architecture of FIG11 , the base station 105-g may further include a communication management module 1160. The communication management module 1160 may manage communications with other base stations 105. By way of example, the communication management module 1160 may be a component of the base station 105-g that is in communication with some or all of the other components of the base station 105-g via a bus. Alternatively, the functionality of the communication management module 1160 may be implemented as a component of the base transceiver module 1150, as a computer program product, and/or as one or more controller elements of the base station processor module 1170.

The components of base station 105-g may be configured to implement various aspects discussed above with respect to apparatus 1005 of FIG. 10 , and for the sake of brevity, these aspects may not be repeated here. For example, base station 105-g may include base station D2D discovery module 1015-a. Base station D2D discovery module 1015-a may be an example of base station D2D discovery module 1015 of FIG. Base station D2D discovery module 1015-a may be configured to perform or control some or all of the features or functions related to D2D discovery described with reference to FIG. 1 , 2, 5, 6, 7, 8, and/or 10 . For example, base station D2D discovery module 1015-a may be configured to support the reception and transmission of D2D discovery communications. Specifically, base station D2D discovery module 1015-a may be configured to support the transmission of timing variables to a UE (e.g., UE 115-j) when the UE is in a connected mode with base station 105-g. The base station D2D discovery module 1015-a or its respective parts may include a processor, or some or all functions of the base station D2D discovery module 1015-a may be performed by or in conjunction with the base station processor module 1170. In addition, the base station D2D discovery module 1015-a or its respective parts may include a memory, or some or all functions of the base station D2D discovery module 1015-a may use or in conjunction with the base station memory 1180.

FIG12 is a flow chart illustrating an example of a wireless communication method 1200 according to various aspects of the present disclosure. For clarity, the method 1200 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1, 2, 3, 5, 6, 7, 8, and/or 9, or aspects of one or more of the devices 405 described with reference to FIG4. In some examples, a UE (such as one of the UEs 115) or a device (such as the device 405) may execute one or more code sets to control functional elements of the UE or device to perform the functions described below.

At block 1205, method 1200 may include receiving, at the device, a timing variable from the network, the timing variable being received while the device is in connected mode. The timing variable may be received in the form of messages 520, 615, 715, 815, and/or 825, as described above with reference to Figures 5, 6, 7, and/or 8.

At block 1210 , method 1200 may include using the timing variable for D2D discovery message authentication. For example, the received timing variable may be used to generate a MIC or verify a MIC, as described above with reference to FIG. 3 .

In some examples, the operations at blocks 1205 or 1210 may be performed using the D2D discovery module 415 described with reference to Figures 4 and/or 9. However, it should be noted that method 1200 is just one implementation and the operations of method 1200 may be rearranged or otherwise modified such that other implementations are possible.

FIG13 is a flow chart illustrating an example of a wireless communication method 1300 according to various aspects of the present disclosure. For clarity, the method 1300 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1, 2, 3, 5, 6, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG4. In some examples, a UE (such as one of the UEs 115) or a device (such as the device 405) may execute one or more code sets to control functional elements of the UE or device to perform the functions described below.

Method 1300 illustrates two alternative flow paths, represented by paths 1335 and 1340. At block 1305, method 1300 may include entering a connected mode. As explained above, the UE may benefit from receiving timing variables while the UE is in a connected mode (such as RRC_Connected Mode), in which the UE and a connected entity are mutually authenticated. Therefore, at block 1305, the UE enters a connected mode, as illustrated, for example, by connected modes 505 and/or 605 in Figures 5 and/or 6. The UE may then use one of flow paths 1335, 1340 to obtain the required timing variables. Additional alternative flow paths are illustrated in Figure 14, described below.

Following flow path 1335, at block 1310, method 1300 may include detecting a SIB having the required timing variable. The detection of the SIB is in response to receiving a command to do so. The SIB is detected while the UE is still in connected mode. An example of this SIB detection is illustrated in FIG5 by message 520.

At block 1315, method 1300 may include a step of verifying that there are no anomalies associated with the received timing variables. An example of this step is illustrated in FIG5 by step 525. In certain situations where a rogue base station is active, verification that no anomalies have occurred may be necessary. For example, the rogue base station may attempt to inject timing-related SIBs into the same broadcast slots scheduled by legitimate base stations. Thus, in this case, the UE may observe multiple SIBs of the same type being broadcast simultaneously. Alternatively, multiple SIBs may collide such that the UE does not receive the SIBs. In addition, the UE may only receive SIBs broadcast by the rogue base station, where the UE determines that there is a significant difference between the received timing variables (from legitimate SIBs) and the UE's locally stored timing variables. In each of these situations, the UE may determine that an anomaly has occurred and that a different method should be used to obtain the timing variables.

If it is deemed that no anomaly has occurred, the received timing variable is stored at the UE (at block 1320). Similar steps are described at step 530 in FIG.

If an alternative path for obtaining the timing variable (such as path 1340) is used, method 1300 includes block 1330. At block 1330, method 1300 includes receiving an RRC message that includes the SIB with the required timing variable. An example of the received RRC message may include message 615, as illustrated in FIG6. The RRC message may be received without the UE specifically requesting the message, as the transmitting base station may independently determine that the UE is participating in D2D discovery communications. Once the UE receives the RRC message with its timing variable, the UE may store the timing variable at block 1320.

It should be noted that method 1300 is only one implementation and the operations of method 1300 may be rearranged or otherwise modified to make other implementations possible. As a specific example, not every operation illustrated in method 1300 needs to be performed, and many operations may be performed in a different order than illustrated in FIG.

FIG14 is a flow chart illustrating an example of a wireless communication method 1400 according to various aspects of the present disclosure. For clarity, the method 1400 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1, 2, 3, 7, 8, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG4. In some examples, a UE (such as one of the UEs 115) or a device (such as the device 405) may execute one or more code sets to control functional elements of the UE or device to perform the functions described below.

Method 1400 illustrates two alternative flow paths, represented by paths 1450 and 1455. At block 1405, method 1400 may include entering a connected mode. As explained above, the UE may benefit from receiving timing variables while the UE is in a connected mode (such as RRC_Connected Mode), in which the UE and the connected entity are mutually authenticated. Therefore, at block 1405, the UE enters a connected mode, as illustrated, for example, by connected modes 705 and/or 805 in Figures 7 and/or 8. The UE may then use one of flow paths 1450, 1455 to obtain the required timing variables. Additional alternative flow paths are illustrated in Figure 13 described above.

Following flow path 1450, at block 1410, method 1400 may include transmitting an RRC request for discovery resources. The RRC request may be transmitted from the UE to the base station. The RRC request may be transmitted regardless of whether the UE is using Type 1 (or device-controlled) resource allocation or Type 2 (or network-controlled) resource allocation. Device-controlled or Type 1 discovery resources are not dedicated to any given UE but rather represent a pool of discovery resources from which one or more UEs may autonomously select resources for D2D discovery. Type 2 or network-controlled resources are uniquely allocated to individual UEs. Therefore, when UE 115 is using Type 2 allocation, the UE is required to transmit an RRC request to the base station to receive its specific resource allocation. When the UE is using Type 1 allocation of D2D resources, the UE is not required to obtain a specific resource allocation from the base station. However, in method 1400, the UE still transmits an RRC request regardless of whether the UE is using Type 1 or Type 2 resource allocation. An example of a transmitted RRC request is RRC request 710 of FIG. 7 .

At block 1415, the UE receives an RRC response including the timing variable. If the UE is using Type 2 resource allocation, the received RRC response may include both the resource allocation and the timing variable. If the UE is using Type 1 resource allocation, the received RRC response may not include the actual resource allocation, but may include only the timing variable. An example of a received RRC response is RRC response 715 of FIG. 7 .

Once received, the timing variables are stored at the UE (block 1430). Similar steps are described in FIG. 7 at block 720.

If an alternative path for obtaining the timing variable (such as path 1455) is used, method 1400 includes blocks 1420, 1425, 1430, 1435, 1440, and 1445. At block 1420, method 1400 includes transmitting a request for D2D discovery authorization. The transmitted request is transmitted from the UE to a network D2D discovery module (such as a ProSe function). An example of the transmitted request is request 810 of FIG. 8 .

At block 1425, the UE receives a grant message from the network D2D discovery module. The received grant message may also include a timing variable. The received grant message may additionally include a timing offset allowance (such as MAX_OFFSET). An example of a received grant message with a timing variable and a timing offset allowance is message 815 of FIG. 8 .

The timing variable received from the network D2D discovery module may be used by the UE to compare with its own locally stored timing variable. Thus, at block 1430, the UE may store the received timing variable. An example of this step is illustrated at block 820 of FIG. 8 . Additionally, if a timing offset grant is also received, the timing offset grant may be stored. The UE may use the received timing offset grant to determine whether the difference between the received timing variable and the local timing variable is within the timing offset variable, as explained below and in conjunction with FIG. 8 .

At block 1435, the UE may receive a SIB broadcast from the base station. The received SIB may include a local timing variable. An example of a SIB broadcast message received by the UE may include message 825 of FIG. 8 .

At block 1440, the UE verifies that there is no anomaly between the received timing variable (received from the network D2D discovery module) and the local timing variable received from the base station as part of the SIB. When comparing the two timing variables, the UE uses the previously received timing offset allowance. If the two timing variables differ by more than the received timing offset allowance, an anomaly may exist and the UE may need to use a different method to obtain an updated timing variable. However, if the two timing variables differ by less than the received timing offset allowance, the UE can infer that there is no anomaly. An example of this verification step is illustrated at block 830 of Figure 8.

If there is no anomaly, the UE may begin broadcasting a discovery announcement message (such as a ProSe application code) at block 1445, as described with reference to FIG3. An example of this announcement step is illustrated at block 835 of FIG8.

It should be noted that method 1400 is only one implementation and the operations of method 1400 may be rearranged or otherwise modified to make other implementations possible. As a specific example, not every operation illustrated in method 1400 needs to be performed, and many operations may be performed in a different order than illustrated in FIG.

FIG15 is a flow chart illustrating an example of a wireless communication method 1500 according to various aspects of the present disclosure. For clarity, the method 1500 is described below with reference to aspects of one or more of the base stations 105 described with respect to FIG1, 2, 5, 6, 7, 8, and/or 11 or aspects of one or more of the devices 1005 described with reference to FIG10. In some examples, a base station (such as one of the base stations 105) or a device (such as the device 1005) may execute one or more code sets to control functional elements of the base station or device to perform the functions described below.

At block 1505, method 1500 may include entering a connected mode with the device. A connected mode (such as connected modes 505, 605, and/or 705 of Figures 5, 6, and/or 7) may ensure mutual authentication between the base station and the connected UE.

At block 1510, method 1500 may include transmitting a timing variable to the device while the device is in connected mode. The timing variable may be transmitted in the form of messages 520, 615, and/or 715, as described above with reference to Figures 5, 6, and/or 7.

In some examples, the operations at blocks 1205 or 1210 may be performed using the base station D2D discovery module 1015 described with reference to Figures 10 and/or 11. However, it should be noted that method 1500 is only one implementation and the operations of method 1500 may be rearranged or otherwise modified such that other implementations are possible.

FIG16 is a flow chart illustrating an example of a wireless communication method 1600 according to various aspects of the present disclosure. For clarity, the method 1600 is described below with reference to aspects of one or more of the base stations 105 described with respect to FIG1, 2, 5, 6, 7, and/or 11 or aspects of one or more of the devices 1005 described with reference to FIG10. In some examples, a base station (such as one of the base stations 105) or a device (such as the device 1005) may execute one or more code sets to control functional elements of the base station or device to perform the functions described below.

Method 1600 illustrates three alternative flow paths, represented by paths 1645, 1650, and 1655. At block 1605, method 1600 may include entering into communication with a UE in connected mode. As explained above, the UE may benefit from receiving timing variables while the UE is in connected mode (such as RRC_Connected Mode), in which the UE and base station are mutually authenticated. Thus, at block 1605, the base station is in communication with the UE in connected mode, as illustrated, for example, by connected modes 505, 605, and/or 705 in Figures 5, 6, and/or 7. The base station may then use one of the flow paths 1645, 1650, and 1655 to obtain the required timing variables.

Following flow path 1645, at block 1610, method 1600 may include determining whether the connected UE is authorized to conduct D2D discovery. For example, the base station may be able to determine whether the connected UE is authorized to participate in D2D discovery communications by receiving authorization from a network D2D discovery module. An example of this step is illustrated at block 510 of FIG. 5 .

At block 1615, method 1600 may include broadcasting a SIB including the timing variable. The broadcasted SIB (such as SIB message 520 of FIG. 5 ) may be SIB16 or a SIB specific to D2D discovery. In this manner, a receiving UE is enabled to receive the timing variable while the UE is in connected mode with the base station.

Alternatively, flow path 1650 may be followed. In flow path 1650, at block 1625, method 1600 may include determining whether the connected UE is authorized to conduct D2D discovery. For example, the base station may be able to determine whether the connected UE is authorized to participate in D2D discovery communications by receiving authorization from a network D2D discovery module. An example of this step is illustrated at block 610 of FIG. 6 .

At block 1630, method 1600 may include transmitting an RRC message including a SIB with a timing variable. Because the base station has determined that the connected UE is authorized for D2D discovery, the base station may transmit the RRC message without waiting for a request from the connected UE. An example of the transmitted RRC message may include RRC message 615 of FIG. 6 .

Alternatively, flow path 1655 may be followed. In flow path 1655, at block 1635, method 1600 may include receiving an RRC request for discovery resources (such as RRC request 710 of FIG. 7 ). The RRC request may be from a UE allocating type 1 (device-controlled) or type 2 (network-controlled) resources for D2D discovery.

At block 1640, method 1600 may include transmitting an RRC response to the RRC request. If the connected UE is using type 2 (network-controlled) resource allocation, the RRC response may include both the allocated resources and the timing variable. If the connected UE is using type 1 (device-controlled) resource allocation, the RRC response need not include any resource allocation and may instead include only the timing variable. In either case, the timing variable is included as part of the RRC response. An example of an RRC response may include RRC response 715 of FIG. 7 .

It should be noted that method 1600 is only one implementation and the operations of method 1600 may be rearranged or otherwise modified to make other implementations possible. As a specific example, not every operation illustrated in method 1600 needs to be performed, and many operations may be performed in a different order than illustrated in Figure 16.

FIG17 is a flow chart illustrating an example of a wireless communication method 1700 according to various aspects of the present disclosure. For clarity, the method 1700 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1, 2, 3, 5, 6, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG4. In some examples, a UE (such as one of the UEs 115) or a device (such as the device 405) may execute one or more code sets to control functional elements of the UE or device to perform the functions described below.

At block 1705, method 1700 includes sending a discovery request to a ProSe function in the network to be allowed to announce the D2D discovery application code, as described above with reference to FIG3 . The discovery request may include the ProSe application ID. The discovery request may be sent to a D2D discovery module (such as a ProSe function in the HPLMN or VPMLN serving the UE). The operation(s) of block 1705 may be performed by the D2D discovery module 415 in conjunction with the transmitter module 420 described above with reference to FIG4 .

At block 1710, method 1700 includes receiving a discovery response from the network, as described above with reference to FIG3. The discovery response may include a timing variable and a timing offset allowance. The operation(s) of block 1710 may be performed by D2D discovery module 415 in conjunction with receiver module 410 described above with reference to FIG4.

FIG18 is a flow chart illustrating an example of a wireless communication method 1800 according to various aspects of the present disclosure. For clarity, the method 1800 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1 , 2, 3, 5, 6, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG4 .

At block 1805, method 1800 includes sending a discovery request to the network to be allowed to announce the D2D discovery application code, as described above with reference to FIG3. The discovery request may include the ProSe application ID. The discovery request may be sent to a D2D discovery module (such as a ProSe function in a PLMN or VPMLN serving the UE). The operation(s) of block 1805 may be performed by the D2D discovery module 415 in conjunction with the transmitter module 420 described above with reference to FIG4.

At block 1810, method 1800 includes receiving a discovery response from the network, as described above with reference to FIG3. The discovery response may include a timing variable and a timing offset allowance. The operation(s) of block 1810 may be performed by D2D discovery module 415 in conjunction with receiver module 410 described above with reference to FIG4.

At block 1815, method 1800 includes comparing the timing variable received from the network to the local timing variable at the device to determine whether the difference between the timing variable from the network and the local timing variable is within the timing offset received from the network, as described above with reference to FIG3. The operation(s) of block 1815 may be performed by timing variable module 430 as described above with reference to FIG4.

At block 1820, method 1800 includes broadcasting a D2D discovery announcement if the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance, as described above with reference to FIG3. The operation(s) of block 1820 may be performed by the timing variable module 430 as described above with reference to FIG4.

FIG19 is a flow chart illustrating an example of a wireless communication method 1900 according to various aspects of the present disclosure. For clarity, the method 1900 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIG1, 2, 3, 5, 6, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG4.

At block 1905, method 1900 includes sending a discovery request to the network to be allowed to announce the D2D discovery application code, as described above with reference to FIG3. The discovery request may include the ProSe application ID. The discovery request may be sent to a D2D discovery module (such as a ProSe function in a PLMN or VPMLN serving the UE). The operation(s) of block 1905 may be performed by the D2D discovery module 415 in conjunction with the transmitter module 420 described above with reference to FIG4.

At block 1910, method 1900 includes receiving a discovery response from the network, as described above with reference to FIG3. The discovery response may include a timing variable and a timing offset allowance. The operation(s) of block 1910 may be performed by D2D discovery module 415 in conjunction with receiver module 410 described above with reference to FIG4.

At block 1915, method 1900 includes comparing the timing variable received from the network with the local timing variable at the device to determine whether the difference between the timing variable from the network and the local timing variable is within the timing offset received from the network, as described above with reference to FIG3. The operation(s) of block 1915 may be performed by timing variable module 430 as described above with reference to FIG4.

At block 1920, method 1900 includes generating a MIC to be included in the D2D discovery advertisement, as described above with reference to FIG3. The operation(s) of block 1920 may be performed by the MIC module 425 as described above with reference to FIG4.

At block 1925, method 1900 includes broadcasting a D2D discovery announcement if the difference between the timing variable received from the network and the local timing variable is within the timing offset allowance, as described above with reference to FIG3 . The D2D discovery code includes a MIC and a D2D discovery application code. The operations of block 1925 may be performed by the timing variable module 430 in conjunction with the transmitter module 420 described above with reference to FIG4 .

20 is a flow chart illustrating an example of a wireless communication method 2000 according to various aspects of the present disclosure. The method 2000 is described below with reference to aspects of one or more of the UEs 115 described with respect to FIGs. 1, 2, 3, 5, 6, and/or 9, respectively, or aspects of one or more of the devices 405 described with reference to FIG. 4.

At block 2005, method 2000 includes receiving, by monitoring UE 115-c-2, a D2D discovery announcement, as described above with reference to FIG3. The D2D discovery announcement may include a D2D discovery application code and the MIC generated in announcing UE 115-c-1 of FIG3. The operation(s) of block 2005 may be performed by receiver module 410 as described above with reference to FIG4.

At block 2010, method 2000 includes sending a matching report to the network for verification, as described above with reference to FIG3. The matching report may include a D2D discovery application code, a MIC, and a timing variable. The operation(s) of block 2010 may be performed by transmitter module 420 as described above with reference to FIG4.

21 is a flow chart illustrating an example of a wireless communication method 2100 according to various aspects of the present disclosure. For clarity, the method 2100 is described below with reference to aspects of one or more of the base stations 105 and the core network 130 described with respect to FIGs. 1, 2, 5, 6, 7, 8, and/or 11, or aspects of one or more of the devices 1005 described with reference to FIG. 10. In some examples, a base station (such as one of the base stations 105) or a device (such as the device 1005) may execute one or more code sets to control functional elements of the base station or device to perform the functions described below.

At block 2105, method 2100 may include receiving a discovery request from a device, as described above with reference to FIG 3. The operation(s) of block 2105 may be performed by receiver module 1010 as described above with reference to FIG 10.

At block 2110, method 2100 may include sending a discovery response to the device, as described above with reference to FIG3. The discovery response may include a timing variable and a timing offset allowance. The operation(s) of block 2110 may be performed by transmitter module 1020 as described above with reference to FIG10.

FIG22 is a flow chart illustrating an example of a wireless communication method 2200 according to various aspects of the present disclosure. For clarity, the method 2200 is described below with reference to aspects of the network D2D discovery module 210 and/or 1015 described with respect to FIG2, 3, 8, and/or 10. In some examples, an apparatus (such as apparatus 1005) may execute one or more code sets to control a base station or functional elements of the apparatus to perform the functions described below.

At block 2205, method 2200 may include receiving a match report from the device, as described above with reference to FIG. 3. The match report may be received from the monitoring UE and may include the MIC and timing variables as well as the D2D discovery application code. The operation(s) of block 2205 may be performed by receiver module 1010 as described above with reference to FIG. 10.

At block 2210, method 2200 may include verifying that the MIC included in the match report is valid, as described with reference to FIG3. The operation(s) of block 2210 may be performed by D2D discovery module 210 and/or 1015 as described above with reference to FIG2, 3, 8, and/or 10.

At block 2215, method 2200 may include sending a match response to the device, as described above with reference to FIG3 . The match response may include a timing variable indicating the current time at the network and a ProSe application ID. The operations of block 2215 may be performed by the D2D discovery module 210 and/or 1015 in conjunction with the transmitter module 1020 described above with reference to FIG10 .

It should be noted that the methods illustrated by flow charts 1700 , 1800 , 1900 , 2000 , 2100 , and 2200 are merely example implementations, and that the operations of the methods and steps may be rearranged or otherwise modified such that other implementations are possible.

The detailed description set forth above in conjunction with the accompanying drawings describes examples and does not represent the only examples that can be implemented or fall within the scope of the claims. The terms "example" and "exemplary" when used in this specification mean "serving as an example, instance, or illustration" and do not mean "better than" or "better than other examples." This detailed description includes specific details to provide an understanding of the described techniques. However, these techniques can be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described examples.

The technology described herein can be used in various wireless communication systems, such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, and other systems. The terms "system" and "network" are often used interchangeably. A CDMA system can implement radio technologies such as CDMA2000 and Universal Terrestrial Radio Access (UTRA). CDMA2000 covers IS-2000, IS-95, and IS-856 standards. IS-2000 versions 0 and A are often referred to as CDMA2000 1X, 1X, etc. IS-856 (TIA-856) is often referred to as CDMA2000 1xEV-DO, High Rate Packet Data (HRPD), etc. UTRA includes Wideband CDMA (WCDMA) and other CDMA variants. A TDMA system can implement radio technologies such as Global System for Mobile Communications (GSM). OFDMA systems can implement radio technologies such as Ultra Mobile Broadband (UMB), Evolved UTRA (E-UTRA), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, and Flash-OFDM. UTRA and E-UTRA are parts of the Universal Mobile Telecommunications System (UMTS). 3GPP Long Term Evolution (LTE) and LTE-Advanced (LTE-A) are new versions of UMTS that use E-UTRA. UTRA, E-UTRA, UMTS, LTE, LTE-A, and GSM are described in documents from an organization called the "3rd Generation Partnership Project" (3GPP). CDMA2000 and UMB are described in documents from an organization called the "3rd Generation Partnership Project 2" (3GPP2). The techniques described herein can be used for the systems and radio technologies mentioned above as well as for other systems and radio technologies. However, the above description describes an LTE system for example purposes, and LTE terminology is used in much of the above description, but these techniques can also be applied to applications beyond LTE.

A communication network that can accommodate some of the various disclosed examples can be a packet-based network operating according to a layered protocol stack. For example, communications at the bearer or packet data convergence protocol (PDCP) layer can be IP-based. The radio link control (RLC) layer can perform packet segmentation and reassembly to communicate on logical channels. The media access control (MAC) layer can perform priority handling and multiplex logical channels into transport channels. The MAC layer can also use hybrid automatic repeat request (HARQ) to provide retransmissions at the MAC layer, thereby improving link efficiency. At the physical layer, transport channels can be mapped to physical channels.

Information and signals may be represented using any of a variety of different techniques and technologies. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

The various illustrative blocks and modules described in conjunction with the disclosure herein may be implemented or executed with a general-purpose processor, a digital signal processor (DSP), an ASIC, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. In some cases, the processor may be in electrical communication with a memory that stores instructions that can be executed by the processor.

The functions described herein can be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, each function can be stored on a computer-readable medium as one or more instructions or codes or transmitted therethrough. Other examples and implementations fall within the scope and spirit of this disclosure and the appended claims. For example, due to the nature of software, the functions described above can be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination thereof. The features that implement the functions can also be physically located in various locations, including being distributed so that the various parts of the functions are implemented at different physical locations. In addition, as used herein (including in the claims), the "or" used in the enumeration of items indicates a disjunctive enumeration, so that, for example, the enumeration of "at least one of A, B, or C" means A or B or C or AB or AC or BC or ABC (i.e., A and B and C).

Computer program products or computer-readable media both include computer-readable storage media and communication media, including any media that facilitate the transfer of computer programs from one place to another. Storage media can be any medium that can be accessed by a general-purpose or special-purpose computer. As an example and not limitation, computer-readable media can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer-readable program code in the form of instructions or data structures and can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Any connection is also properly referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote light source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwaves, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwaves are included in the definition of medium. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.

The previous description of the disclosure is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure. Throughout this disclosure, the term "example" indicates an example or instance and does not imply or require any preference for the referenced example. Thus, the disclosure is not limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (30)

1. A method for conducting wireless communication in a wireless network, comprising: Receive timing variables and timing offset permissions from the network at the device, wherein the timing variables are received while the device is in connectivity mode; and The received timing variable and the timing offset are allowed for device-to-device (D2D) discovery message authentication by comparing the received timing variable with the local timing variable to determine whether the difference between the received timing variable and the local timing variable is within the allowed timing offset. 2. The method as described in claim 1, further comprising: The received timing variables are stored at the device for comparison with local timing variables. 3. The method as described in claim 1, wherein the timing variable is received from a proximity-based service (ProSe) function in the network. 4. The method as described in claim 1, wherein the timing variable is received together with the D2D discovery application code. 5. The method of claim 3, further comprising: Receive the timing offset permission from the ProSe function in the network. 6. The method of claim 5, further comprising: When the difference between the received timing variable and the local timing variable is within the timing offset allowable, the D2D discovery application code is declared. 7. The method of claim 5, further comprising: When the difference exceeds the allowed timing offset, an exception is notified to the ProSe function. 8. The method of claim 5, wherein the timing variable received from the network is Coordinated Universal Time (UTC). 9. The method of claim 5, further comprising: The local timing variables are received via the System Information Block (SIB). 10. The method of claim 1, further comprising: Send a discovery request to the network, including a Proximity-based Service (ProSe) Application Identifier (ID). 11. The method of claim 10, further comprising: Receive a discovery response from the network, the discovery response including the timing variable and the timing offset permission. 12. The method of claim 1, further comprising: The timing variable received from the network is used to generate the Message Integrity Code (MIC) to be included in the D2D discovery announcement. 13. The method of claim 12, wherein the MIC is generated based on the D2D discovery application code, the key associated with the D2D discovery application code, and the timing variable when transmitting the D2D discovery announcement. 14. The method of claim 1, further comprising: Receive D2D discovery announcements including Message Integrity Code (MIC); and The received MIC and the timing variable are transmitted to the proximity-based service (ProSe) function in the network. 15. The method of claim 9, further comprising: If the device detects more than one SIB with timing information, the local timing variable received in the SIB is ignored; and The local timing variable is obtained outside of the SIB. 16. The method of claim 9, further comprising: The timer variable received in the System Information Block (SIB) is compared with the local timer variable; and If the received timing variable differs from the local timing variable by more than a predetermined threshold, the timing variable is obtained outside the SIB. 17. The method of claim 1, further comprising: When the device is using a network-controlled D2D discovery resource allocation scheme, it requests D2D discovery resources via Radio Resource Control (RRC) messages. The timing variable is received via a response to the RRC message. 18. The method of claim 1, further comprising: Receive a Radio Resource Control (RRC) message that includes the timing variable and the empty resource allocation element. 19. The method of claim 5, further comprising: When the difference is less than the allowed timing offset, the timing variable received from the ProSe function will be synchronized with the local timing variable. 20. An apparatus configured for wireless communication, comprising: At least one processor; and A memory coupled to the at least one processor, wherein the at least one processor is configured to: Receive timing variables and timing offset permissions from the network at the device, wherein the timing variables are received while the device is in connectivity mode; and The received timing variable and the timing offset are allowed for device-to-device (D2D) discovery message authentication by comparing the received timing variable with the local timing variable to determine whether the difference between the received timing variable and the local timing variable is within the allowed timing offset. 21. The apparatus of claim 20, wherein the timing variable is received from a proximity-based service (ProSe) function in the network. 22. The apparatus of claim 21, wherein the at least one processor is further configured to: Receive the timing offset permission from the ProSe function in the network. 23. The apparatus of claim 22, wherein the at least one processor is further configured to: If the difference between the received timing variable and the local timing variable is within the timing offset allowable, then a D2D discovery code is declared. 24. A method for conducting wireless communication in a wireless network, comprising: Entering the device connectivity mode; and When the device is in the connectivity mode, a timing variable and a timing offset allowance are transmitted to the device for use in device-to-device (D2D) discovery message authentication, wherein the timing variable is used to compare the timing variable with a local timing variable to determine whether the difference between the timing variable and the local timing variable is within the timing offset allowance. 25. The method of claim 24, wherein the timing variable is transmitted from a proximity-based service (ProSe) function. 26. The method of claim 24, further comprising: The timing variable is transmitted along with the D2D discovery application code. 27. The method as described in claim 24, characterized in that: The timing offset is allowed to be the maximum difference between the timing variable and the local timing variable at the device. 28. The method of claim 24, further comprising: Receive from the device a discovery request including a Proximity-based Service (ProSe) application identifier (ID); and Send a discovery response to the device, the discovery response including the timing variable and the timing offset permission. 29. The method of claim 24, further comprising: Receive Radio Resource Control (RRC) requests for discovered resources. The transmission of the timing variable includes transmitting a response to the RRC request, the response including the timing variable. 30. An apparatus configured for wireless communication, comprising: At least one processor; and A memory coupled to the at least one processor, wherein the at least one processor is configured to: Entering the device connectivity mode; and When the device is in the connectivity mode, a timing variable and a timing offset allowance are transmitted to the device for use in device-to-device (D2D) discovery message authentication, wherein the timing variable is used to compare the timing variable with a local timing variable to determine whether the difference between the timing variable and the local timing variable is within the timing offset allowance.