# US 11,910,184 B2 · Method for establishing a secure connection between a UE and a network, a user equipment and a communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,910,184 B2 - Document ID: US11910184B2 - Status: Granted - Kind: B2 - Application number: 17/422,035 - Filed: 2020-01-10 - Published: 2022-03-31 - Granted: 2024-02-20 - Earliest claimed: 2019-01-18 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Sheeba Backia Mary Baskaran; Sander De Kievit; Sivabalan Arumugam; Anand Raghawa Prasad - Web page: https://patentgrep.com/patent/US11910184B2 ## CPC - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 8/04: Registration at HLR or HSS [Home Subscriber Server] - H04W 8/18: Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data - H04W 8/26: Network addressing or numbering for mobility support - H04W 12/06: Authentication - H04W 12/72: Subscriber identity - H04W 60/00: Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration - H04W 48/12: using downlink control channel - H04W 60/001: {Registration rejection or failure} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure provides a User Equipment (UE) comprising a transceiver circuit; and a controller configured to control the transceiver circuit to send, to an Access and mobility Management Function (AMF) of a communication node, an identifier, wherein upon successful authentication of a network access function of the UE in the communication node, the controller is configured to maintain a secure connection with the communication node. ## Claims ### Claim 1 A communication system comprising: a user equipment (UE); a first node; a second node; and a third node, wherein the first node is configured to: receive a registration request transmitted by the UE, including information indicating whether the UE has a subscription for specific service, wherein the registration request includes a first identifier, and the first identifier includes the information; verify the registration request, and send an authentication request to the second node of the network including a second identifier upon successful verification of the information based on a second identifier which is included in the first identifier, wherein the second identifier routes nodes of the network for the specific service, and the authentication request includes the first identifier, UE network access capability and a third identifier, wherein the third identifier identifies a specific serving network; wherein the second node of the network is configured to: verify the third identifier, and send, to the third node, upon successful verification of the third identifier, an authentication data request based on the second identifier, and wherein the third node is configured to: de-conceal the first identifier to verify UE network access restriction information; send upon successful verification of the de-concealed first identifier and the information, an authentication data feedback to the second node of the network including the first identifier and authentication vector for the specific service. ### Claim 2 (depends on 1) The communication system according to claim 1, wherein the first node is further configured to transmit a registration failure message upon failure of matching of the information against a network service access restriction. ### Claim 3 (depends on 1) The communication system according to claim 1, wherein the first node is an Access and Mobility Management Function (AMF). ### Claim 4 (depends on 1) The communication system according to claim 1, wherein the second node is an Authentication Server Function (AUSF). ### Claim 5 (depends on 1) The communication system according to claim 1, wherein the third node is a Unified Data Management (UDM). ### Claim 6 (depends on 1) The communication system according to claim 1, wherein the information is network subscription type information. ### Claim 7 (depends on 1) The communication system according to claim 1, wherein the first identifier is a Subscription Concealed Identifier (SUCI). ### Claim 8 (depends on 1) The communication system according to claim 1, wherein the second identifier is a Routing ID. ### Claim 9 (depends on 1) The communication system according to claim 1, wherein the third identifier is a serving network ID. ### Claim 10 (depends on 1) The communication system according to claim 1, wherein the specific service is non-public network service. ### Claim 11 A method for establishing a secure connection between a user equipment (UE) and a network, the method comprising: sending, from the UE to a first node of the network, a registration request including information indicating whether the UE has a subscription for specific service, wherein the registration request includes a first identifier, and the first identifier includes the information; verifying, by the first node of the network, the registration request; sending an authentication request to a second node of the network upon successful verification of the information based on a second identifier which is included in the first identifier, wherein the second identifier routes nodes of the network for the specific service, and the authentication request includes the first identifier, UE network access capability and a third identifier, wherein the third identifier identifies a specific serving network; verifying, by the second node of the network, the third identifier; sending, by the second node of the network, upon successful verification of the third identifier, an authentication data request to a third node of the network based on the second identifier; de-concealing the first identifier, by the third node of the network, to verify UE network access restriction information; and sending, by the third node of the network, upon successful verification of the de-concealed first identifier and the information, an authentication data feedback to the second node of the network including the first identifier and authentication vector for the specific service.