Authentication mechanism for 5G technologies
AssigneeFuturewei Technologies, Inc.
InventorsAhmad Shawky Muhanna, Marcus Wong
Life of this patent
Estimating the term…
Abstract
Embodiments of this disclosure provide techniques for securely communicating an IMSI over the air from a UE to an SeAN, as well as for securely validating an unencrypted IMSI that the SeAN receives from the home network, during authentication protocols. In particular, the UE may either encrypt the IMSI assigned to the UE using an IMSI encryption key (KIMSIenc) or compute a hash of the IMSI assigned to the UE using an IMSI integrity key (KIMSIint), and then send the encrypted IMSI or the hash of the IMSI to the serving network. The encrypted IMSI or hash of the encrypted IMSI may then be used by the SeAN to validate an unencrypted IMSI that was previously received from an HSS in the home network of the UE.
Claims24
A method for secure authentication, the method comprising:
- receiving, by a Security Anchor Node (SeAN) in a serving network, an unencrypted International Mobile Subscriber Identity (IMSI) from a home subscriber server (HSS) in a home network of a user equipment (UE);
- receiving, by the SeAN, an encrypted IMSI or a hash of an IMSI from the UE;
- and
- validating the unencrypted IMSI received from the HSS in accordance with either the encrypted IMSI received from the UE and an IMSI encryption key (KIMSIenc) or the hash of the IMSI received from the UE and an IMSI integrity key (KIMSIint).
A Security Anchor Node (SeAN) comprising:
- a processor;
- and
- a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to cause the SeAN to perform operations including:
- encrypting an International Mobile Subscriber Identity (IMSI) assigned to a user equipment (UE) using an IMSI encryption key (KIMSIenc) associated with a serving network or computing a hash of the IMSI using an IMSI integrity key (KIMSIint) associated with the serving network;
- and
- sending the encrypted IMSI or the hash of the IMSI to a base station in the serving network.
A method for secure authentication, the method comprising:
- encrypting, by a user equipment (UE), an International Mobile Subscriber Identity (IMSI) of the UE using home network public key (HPuK) associated with a home network of the UE to obtain an HPuK-encrypted IMSI;
- sending, by the UE, a first initial authentication request (JAR) message carrying the HPuK-encrypted IMSI to a Security Anchor Node (SeAN) in a serving network;
- receiving, by the UE, an initial authentication response (IAS) message from the SeAN, the IAS message including an IAR message resend flag;
- and
- in response to identifying the IAR message resend flag in the IAS message:
- encrypting, or otherwise computing a hash of, the IMSI using an serving network public key (SPuK) to obtain an KIMSIenc-encrypted IMSI or an KIMSIint-signed hash of the IMSI, and
- sending a second IAR message that includes the KIMSIenc-encrypted IMSI or the KIMSIint-signed hash of the IMSI to the SeAN.
A user equipment (UE) comprising:
- a processor;
- and
- a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to cause the UE to perform operations including:
- encrypting an International Mobile Subscriber Identity (IMSI) of the UE using home network public key (HPuK) associated with a home network of the UE to obtain an HPuK-encrypted IMSI;
- sending a first initial authentication request (IAR) message carrying the HPuK-encrypted IMSI to a Security Anchor Node (SeAN) in a serving network;
- receiving an initial authentication response (IAS) message from the SeAN, the IAS message including an IAR message resend flag;
- and
- in response to identifying the IAR message resend flag in the IAS message;
- encrypting, or otherwise computing a hash of, the IMSI using an serving network public key (SPuK) to obtain an KIMSIenc-encrypted IMSI or an KIMSIint-signed hash of the IMSI, and
- sending a second IAR message that includes the KIMSIenc-encrypted IMSI or the KIMSIint-signed hash of the IMSI to the SeAN.
A Security Anchor Node (SeAN) comprising:
- a processor;
- and
- a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to cause the SeAN to perform operations including:
- receiving an unencrypted International Mobile Subscriber Identity (IMSI) from a home subscriber server (HSS) in a home network of a user equipment (UE);
- receiving an encrypted IMSI or a hash of an IMSI from the UE;
- and
- validating the unencrypted IMSI received from the HSS in accordance with either the encrypted IMSI received from the UE and an IMSI encryption key (KIMSIenc) or the hash of the IMSI received from the UE and an IMSI integrity key (KIMSIint).
A method comprising:
- encrypting, by a Security Anchor Node (SeAN) in a serving network, an International Mobile Subscriber Identity (IMSI) assigned to a user equipment (UE) using an IMSI encryption key (KIMSIenc) associated with the serving network or computing, by the SeAN, a hash of the IMSI using an IMSI integrity key (KIMSIint) associated with the serving network;
- and
- sending the encrypted IMSI or the hash of the IMSI to a base station in the serving network.
Dependencies are inferred from the claim text.