# US 10,873,464 B2 · Authentication mechanism for 5G technologies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,464 B2 - Document ID: US10873464B2 - Status: Granted - Kind: B2 - Application number: 15/670,964 - Filed: 2017-08-07 - Published: 2018-01-11 - Granted: 2020-12-22 - Earliest claimed: 2016-03-10 - Assignees: Futurewei Technologies, Inc. - Applicants: Futurewei Technologies, Inc. - Inventors: Ahmad Shawky Muhanna; Marcus Wong - Web page: https://patentgrep.com/patent/US10873464B2 ## CPC - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/0822: {using key encryption key} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04W 12/041: Key generation or derivation - H04W 12/06: Authentication - H04W 12/75: Temporary identity - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 2209/80: Wireless - H04W 8/18: Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data - H04W 12/10: Integrity - H04W 12/72: Subscriber identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments of this disclosure provide techniques for securely communicating an IMSI over the air from a UE to an SeAN, as well as for securely validating an unencrypted IMSI that the SeAN receives from the home network, during authentication protocols. In particular, the UE may either encrypt the IMSI assigned to the UE using an IMSI encryption key (KIMSIenc) or compute a hash of the IMSI assigned to the UE using an IMSI integrity key (KIMSIint), and then send the encrypted IMSI or the hash of the IMSI to the serving network. The encrypted IMSI or hash of the encrypted IMSI may then be used by the SeAN to validate an unencrypted IMSI that was previously received from an HSS in the home network of the UE. ## Claims ### Claim 1 A method for secure authentication, the method comprising: sending, by a user equipment (UE), an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (KIMSIenc) or an IMSI integrity key (KIMSIint) associated with a serving home network, wherein the KIMSIenc or the KIMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network. ### Claim 2 (depends on 1) The method of claim 1, further comprising: computing, by the UE, a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and sending the RES to the base station in the serving network. ### Claim 3 (depends on 1) The method of claim 1, wherein the KIMSIenc or the KIMSIint is a NAS encryption or integrity key. ### Claim 4 (depends on 1) The method of claim 1, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key. ### Claim 5 (depends on 1) The method of claim 1, wherein the KIMSIenc or the KIMSIint is an IAS encryption or integrity key (KIMSIenc). ### Claim 6 (depends on 1) The method of claim 1, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network. ### Claim 7 (depends on 1) The method of claim 1, wherein the KIMSIenc or the KIMSIint is a serving network public key (SPuK). ### Claim 8 (depends on 1) The method of claim 1, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication-request (IAR) message. ### Claim 9 (depends on 1) The method of claim 1, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message. ### Claim 10 A user equipment (UE) comprising: a processor; and a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to: send an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (KIMSIenc) or an IMSI integrity key (KIMSIint) associated with a home network, wherein the KIMSIenc or the KIMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network. ### Claim 11 (depends on 10) The UE of claim 10, wherein the programming further includes instructions to: compute a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and send the RES to the base station in the serving network. ### Claim 12 (depends on 10) The UE of claim 10, wherein the KIMSIenc or the KIMSIint is a NAS encryption or integrity key. ### Claim 13 (depends on 10) The UE of claim 10, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key. ### Claim 14 (depends on 10) The UE of claim 10, wherein the KIMSIenc or the KIMSIint is an IAS encryption or integrity key (KIASenc). ### Claim 15 (depends on 10) The UE of claim 10, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network. ### Claim 16 (depends on 10) The UE of claim 10, wherein the KIMSIenc or the KIMSIint is a serving network public key (SPuK). ### Claim 17 (depends on 10) The UE of claim 10, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication-request (IAR) message. ### Claim 18 (depends on 10) The UE of claim 10, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message. ### Claim 19 A computer program product comprising a non-transitory computer readable storage medium storing programming, the programming including instructions to: send an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI from a user equipment (UE) to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (KIMSIenc) or an IMSI integrity key (KIMSIint) associated with a home network, wherein the KIMSIenc or the KIMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the programming further includes instructions to: compute a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and send the RES from the UE to the base station in the serving network. ### Claim 21 (depends on 19) The computer program product of claim 19, wherein the KIMSIenc or the KIMSIint is a NAS encryption or integrity key. ### Claim 22 (depends on 19) The computer program product of claim 19, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key. ### Claim 23 (depends on 19) The computer program product of claim 19, wherein the KIMSIenc or the KIMSIint is an IAS encryption or integrity key (KIASenc). ### Claim 24 (depends on 19) The computer program product of claim 19, wherein the KIMSIenc or the KIMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network. ### Claim 25 (depends on 19) The computer program product of claim 19, wherein the KIMSIenc or the KIMSIint is a serving network public key (SPuK). ### Claim 26 (depends on 19) The computer program product of claim 19, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication request (IAR) message. ### Claim 27 (depends on 19) The computer program product of claim 19, wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message.