Protection of the UE identity during 802.1x carrier hotspot and Wi-Fi calling authentication

A third generation partnership project (3GPP) network entity for performing authentication, comprising:

• at least one network connection configured to communicate with a first radio access network, wherein the first radio access network is a non-third generation partnership project (non-3GPP) access network;
• a memory medium;
• and
• at least one processor coupled to the memory medium and the at least one network connection;
• wherein the 3GPP network entity is configured to:
• perform initial authentication on a user equipment device (UE) through the first radio access network, said initial authentication comprising:
• receiving an encrypted International Mobile Subscriber Identity (IMSI) in an encoding format from the UE via the first radio access network, wherein the encoding format comprises a public Key Identifier that was used in generating the encrypted IMSI;
• decrypting the IMSI received from the UE;
• authenticating the UE based on the decrypted IMSI.

A user equipment device (UE), comprising:

• at least one antenna;
• wireless communication circuitry communicatively coupled to the at least one antenna, wherein the wireless communication circuitry is configured to communicate with a first radio access network, wherein the first radio access network is a non-third generation partnership project (non-3GPP) access network, and wherein the first radio access network is coupled to a third generation partnership project (3GPP) authentication server through an interface;
• and
• at least one processor communicatively coupled to the wireless communication circuitry;
• wherein the UE is configured to perform an initial authentication procedure with the 3GPP authentication server through the first radio access network, wherein in performing the initial authentication procedure, the UE is configured to:
• exchange an internet key exchange (IKE) security association (SA) initial (INIT) package with the interface through the first radio access network;
• after exchanging the IKE SA INIT package, receive a first server certificate from the interface through the first radio access network;
• send a server identifier to the interface, wherein the server identifier is associated with the 3GPP authentication server, and wherein the first server certificate is received in response to sending the server identifier;
• determine the first server certificate is valid;
• and
• in response to a determination that the first server certificate is valid, transmit, via the first radio access network, an identity associated with the UE to the interface for forwarding to the 3GPP authentication server.

A network entity, comprising:

• at least one network connection configured to communicate with each of a non-third generation partnership project (non-3GPP) access network and a third generation partnership project (3GPP) authentication server;
• a memory medium;
• and
• at least one processor coupled to the memory medium and the at least one network connection;
• wherein the network entity is configured to:
• perform an initial authentication procedure on a user equipment (UE) through the non-3GPP access network, wherein, in performing the initial authentication procedure, the network entity is configured to:
• exchange an internet key exchange (IKE) security association (SA) initial (INIT) package with the UE through the non-3GPP radio access network;
• after exchanging the IKE SA INIT package, send, to the UE, a server certificate associated with the 3GPP authentication server, wherein sending the server certificate is performed in response to receiving, from the UE, a server identifier associated with the 3GPP authentication server;
• and
• forward authentication messages between the UE and the 3GPP authentication server to complete the initial authentication procedure after sending the server certificate.