# US 2016/0262015 A1 · Identity privacy in wireless networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0262015 A1
- Document ID: US20160262015A1
- Status: Published application
- Kind: A1
- Application number: 14/808,862
- Filed: 2015-07-24
- Published: 2016-09-08
- Earliest claimed: 2015-03-05
- Assignees: QUALCOMM Incorporated
- Applicants: QUALCOMM Incorporated
- Inventors: Soo Bum Lee; Anand Palanigounder; Adrian Edward Escott; Gavin Bernard Horn
- Web page: https://patentgrep.com/patent/US20160262015A1

## CPC

- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 8/04: Registration at HLR or HSS [Home Subscriber Server]
- H04W 8/183: {Processing at user equipment or user record carrier}
- H04W 12/033: of the user plane, e.g. user's traffic
- H04L 2101/654: International mobile subscriber identity [IMSI] numbers
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/06: Authentication
- H04W 12/72: Subscriber identity
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and techniques are disclosed to protect a user equipment's international mobile subscriber identity by providing a privacy mobile subscriber identity instead. In an attach attempt to a serving network, the UE provides the PMSI instead of IMSI, protecting the IMSI from exposure. The PMSI is determined between a home network server and the UE so that intermediate node elements in the serving network do not have knowledge of the relationship between the PMSI and the IMSI. Upon receipt of the PMSI in the attach request, the server generates a next PMSI to be used in a subsequent attach request and sends the next PMSI to the UE for confirmation. The UE confirms the next PMSI to synchronize between the UE and server and sends an acknowledgment token to the server. The UE and the server then each update local copies of the current and next PMSI values.

## Claims

### Claim 1

A method for network access by a user equipment (UE), comprising:
sending, from the UE, a privacy mobile subscriber identity (PMSI) in place of an international mobile subscriber identity (IMSI) to identify the UE with an initial attach message to a serving network;
receiving, from the serving network, an authentication request that includes a next PMSI determined by a server in communication with the serving network, the next PMSI being derived from the PMSI; and
sending, from the UE, an acknowledgment of receipt of the next PMSI to the server via the serving network.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining, by the UE, the PMSI for network access based on an initial PMSI.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving the initial PMSI during a subscriber registration of the UE with the server.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
provisioning the initial PMSI after a subscriber registration via an over-the-air communication with the server.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
generating, by the UE, a proposed PMSI;
encrypting, by the UE, the generated PMSI using a server public key, wherein the server maintains a corresponding server private key; and
receiving, at the UE, acknowledgement from the server to use the generated PMSI as the initial PMSI.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
determining a UE-based next PMSI; and
comparing the UE-based next PMSI to the next PMSI received as part of the authentication request to determine if there is a match.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
generating an acknowledgement token in response to determining there is a match, the acknowledgement of receipt comprising the acknowledgement token; and
storing the confirmed next PMSI at the UE for use in a next attach message.

### Claim 8 (depends on 1)

The method of claim 1, wherein the receiving the authentication request further comprises:
decrypting the next PMSI in the authentication request using an anonymity key, wherein the anonymity key is derived from a secret key shared between the UE and the server.

### Claim 9

A user equipment comprising:
a memory configured to store a privacy mobile subscriber identity (PMSI);
a transceiver configured to:
send the PMSI in place of an international mobile subscriber identity (IMSI) to identify the UE with an initial attach message to a serving network; and
receive, from the serving network, an authentication request that includes a next PMSI determined by a server in communication with the serving network, the next PMSI being derived from the PMSI; and
a processor configured to generate an acknowledgment of receipt, wherein the transceiver is further configured send the acknowledgement of receipt to the server via the serving network.

### Claim 10 (depends on 9)

The user equipment of claim 9, wherein the processor is further configured to:
determine the PMSI for network access based on an initial PMSI stored in the memory.

### Claim 11 (depends on 10)

The user equipment of claim 10, wherein the user equipment receives the initial PMSI during a subscriber registration of the UE with the server.

### Claim 12 (depends on 10)

The user equipment of claim 10, wherein the user equipment is configured to provision the initial PMSI after a subscriber registration via an over-the-air communication with the server.

### Claim 13 (depends on 12)

The user equipment of claim 12, wherein:
the processor is further configured to generate a proposed initial PMSI and encrypt the generated PMSI using a server public key, wherein the server on the network maintains a corresponding server private key; and
the transceiver is further configured to receive acknowledgement from the server to use the generated PMSI as the initial PMSI.

### Claim 14 (depends on 9)

The user equipment of claim 9, wherein the processor is further configured to:
determine a UE-based next PMSI and compare the UE-based next PMSI to the next PMSI received as part of the authentication request to determine if there is a match.

### Claim 15 (depends on 14)

The user equipment of claim 14, wherein the processor is further configured to:
generate an acknowledgement token in response to a determination that there is a match, the acknowledgement of receipt comprising the acknowledgement token.

### Claim 16 (depends on 14)

The user equipment of claim 14, wherein the memory is further configured to store the next PMSI for use in a next attach message.

### Claim 17 (depends on 9)

The user equipment of claim 9, wherein the processor is further configured to decrypt the next PMSI in the authentication request using an anonymity key, wherein the anonymity key is derived from a secret key shared between the UE and the server.

### Claim 18

A method for setting up network access with a server on a network, comprising:
receiving, from a user equipment (UE) via one or more network elements in an intervening serving network, a privacy mobile subscriber identity (PMSI) in place of an international mobile subscriber identity (IMSI) to identify the UE from an initial attach message;
determining, by the server, a next PMSI based on the PMSI;
transmitting, from the server, authentication information to the serving network that includes the next PMSI, wherein the next PMSI is relayed by the serving network to the UE as part of authentication; and
receiving, from the UE via the serving network, an acknowledgement of receipt that includes confirmation of the next PMSI.

### Claim 19 (depends on 18)

The method of claim 18, further comprising:
determining, by the server, the PMSI for network access based on an initial PMSI.

### Claim 20 (depends on 19)

The method of claim 19, further comprising:
receiving, at the server, the initial PMSI during a subscriber registration of the UE with the server.

### Claim 21 (depends on 19)

The method of claim 19, further comprising:
receiving, from the UE, a proposed initial PMSI;
decrypting, by the server, the proposed initial PMSI using a server private key that was encrypted at the UE by a corresponding server public key; and
transmitting, to the UE, an acknowledgement of the proposed initial PMSI as the initial PMSI.

### Claim 22 (depends on 18)

The method of claim 18, further comprising:
deriving an anonymity key from a secret key shared between the server and the UE;
encrypting the next PMSI in the authentication information using the derived anonymity key;
receiving, as part of the acknowledgment, an acknowledgement token acknowledging the next PMSI; and
storing the next PMSI in place of the PMSI at the server for use in responding to a subsequent initial attach message from the UE.

### Claim 23 (depends on 18)

The method of claim 18, wherein the determining further comprises:
detecting a collision between the next PMSI and another existing PMSI associated with a different UE; and
incrementing a PMSI index and determining a new next PMSI based on the next PMSI and the incremented PMSI index.

### Claim 24 (depends on 18)

The method of claim 18, further comprising:
receiving, from a mobility management entity (MME) on the serving network separate from a home network that the server is on, a request for the IMSI of the UE; and
sending, in response to the request, the PMSI of the UE used in the initial attach message instead of the IMSI of the UE.

### Claim 25 (depends on 18)

The method of claim 18, further comprising:
searching one or more databases for a match to the PMSI included with the initial attach message; and
sending, in response to not locating a match, a notice for the UE to modify a PMSI index maintained at the UE for generation of an updated PMSI at the UE.

### Claim 26

A server comprising:
a database configured to store a plurality of privacy mobile subscriber identities (PMSI) of user equipment (UE);
a transceiver configured to receive, via one or more network elements in an intervening serving network from a UE, a privacy mobile subscriber identity (PMSI) in place of an international mobile subscriber identity (IMSI) to identify the UE from an initial attach message; and
a processor configured to determine a next PMSI for the UE based on the PMSI;
wherein the transceiver is further configured to transmit authentication information to the serving network that includes the next PMSI, wherein the next PMSI is relayed by the serving network to the UE as part of authentication, and receive an acknowledgement of receipt that includes confirmation of the next PMSI from the UE via the serving network.

### Claim 27 (depends on 26)

The server of claim 26, wherein the processor is further configured to determine the PMSI for network access based on an initial PMSI.

### Claim 28 (depends on 27)

The server of claim 27, wherein the transceiver is further configured to receive the initial PMSI during a subscriber registration of the UE with the server.

### Claim 29 (depends on 27)

The server of claim 27, wherein:
the transceiver is further configured to receive, from the UE, a proposed initial PMSI;
the processor is further configured to decrypt the proposed initial PMSI using a server private key that was encrypted at the UE by a corresponding server public key; and
the transceiver is further configured to transmit, to the UE, an acknowledgement of the proposed initial PMSI as the initial PMSI.

### Claim 30 (depends on 26)

The server of claim 26, wherein:
the processor is further configured to derive an anonymity key from a secret key shared between the server and the UE and encrypt the next PMSI in the authentication information using the derived anonymity key;
the transceiver is further configured to receive, as part of the acknowledgment, an acknowledgement token acknowledging the next PMSI; and
the database is further configured to store the next PMSI in place of the PMSI for use in responding to a subsequent initial attach message from the UE.

### Claim 31 (depends on 26)

The server of claim 26, wherein the processor is further configured, as part of the determining, to:
detect a collision between the next PMSI and another existing PMSI associated with a different UE in the database; and
increment a PMSI index and determine a new next PMSI based on the next PMSI and the incremented PMSI index.

### Claim 32 (depends on 26)

The server of claim 26, wherein the transceiver is further configured to:
receive, from a mobility management entity (MME) on the serving network separate from a home network that the server is on, a request for the IMSI of the UE; and
send, in response to the request, the PMSI of the UE used in the initial attach message instead of the IMSI of the UE.

### Claim 33 (depends on 26)

The server of claim 26, wherein:
the processor is further configured to search the database for a match to the PMSI included with the initial attach message; and
the transceiver is further configured to send, in response to not locating a match, a notice for the UE to modify a PMSI index maintained at the UE for generation of an updated PMSI at the UE.

### Claim 34

A computer-readable medium having program code recorded thereon, the program code comprising:
code for causing a user equipment (UE) to send a privacy mobile subscriber identity (PMSI) in place of an international mobile subscriber identity (IMSI) to identify the UE with an initial attach message to a serving network;
code for causing the UE to receive, from the serving network, an authentication request that includes a next PMSI determined by a server in communication with the serving network, the next PMSI being derived from the PMSI; and
code for causing the UE to send an acknowledgment of receipt of the next PMSI to the server via the serving network.

### Claim 35 (depends on 34)

The computer-readable medium of claim 34, further comprising:
code for causing the UE to determine the PMSI for network access based on an initial PMSI.

### Claim 36 (depends on 35)

The computer-readable medium of claim 35, further comprising:
code for causing the UE to receive the initial PMSI during a subscriber registration of the UE with the server.

### Claim 37 (depends on 35)

The computer-readable medium of claim 35, further comprising:
code for causing the UE provision the initial PMSI after a subscriber registration via an over-the-air communication with the server.

### Claim 38 (depends on 37)

The computer-readable medium of claim 37, further comprising:
code for causing the UE to generate a proposed PMSI;
code for causing the UE to encrypt the generated PMSI using a server public key, wherein the server maintains a corresponding server private key; and
code for causing the UE to receive acknowledgement from the server to use the generated PMSI as the initial PMSI.

### Claim 39 (depends on 34)

The computer-readable medium of claim 34, further comprising:
code for causing the UE to determine a UE-based next PMSI; and
code for causing the UE to compare the UE-based next PMSI to the next PMSI received as part of the authentication request to determine if there is a match.

### Claim 40 (depends on 39)

The computer-readable medium of claim 39, further comprising:
code for causing the UE to generate an acknowledgement token in response to determining there is a match, the acknowledgement of receipt comprising the acknowledgement token; and
code for causing the UE to store the confirmed next PMSI at the UE for use in a next attach message.

### Claim 41 (depends on 34)

The computer-readable medium of claim 34, further comprising:
code for causing the UE to decrypt the next PMSI in the authentication request using an anonymity key, wherein the anonymity key is derived from a secret key shared between the UE and the server.

### Claim 42

A computer-readable medium having program code recorded thereon, the program code comprising:
code for causing a server to receive, from a user equipment (UE) via one or more network elements in an intervening serving network, a privacy mobile subscriber identity (PMSI) in place of an international mobile subscriber identity (IMSI) to identify the UE from an initial attach message;
code for causing the server to determine a next PMSI based on the PMSI;
code for causing the server to transmit authentication information to the serving network that includes the next PMSI, wherein the next PMSI is relayed by the serving network to the UE as part of authentication; and
code for causing the server to receive, from the UE via the serving network, an acknowledgement of receipt that includes confirmation of the next PMSI.

### Claim 43 (depends on 42)

The computer-readable medium of claim 42, further comprising:
code for causing the server to determine the PMSI for network access based on an initial PMSI.

### Claim 44 (depends on 43)

The computer-readable medium of claim 43, further comprising:
code for causing the server to receive the initial PMSI during a subscriber registration of the UE with the server.

### Claim 45 (depends on 43)

The computer-readable medium of claim 43, further comprising:
code for causing the server to receive, from the UE, a proposed initial PMSI;
code for causing the server to decrypt the proposed initial PMSI using a server private key that was encrypted at the UE by a corresponding server public key; and
code for causing the server to transmit, to the UE, an acknowledgement of the proposed initial PMSI as the initial PMSI.

### Claim 46 (depends on 42)

The computer-readable medium of claim 42, further comprising:
code for causing the server to derive an anonymity key from a secret key shared between the server and the UE;
code for causing the server to encrypt the next PMSI in the authentication information using the derived anonymity key;
code for causing the server to receive, as part of the acknowledgment, an acknowledgement token acknowledging the next PMSI; and
code for causing the server to store the next PMSI in place of the PMSI at the server for use in responding to a subsequent initial attach message from the UE.

### Claim 47 (depends on 42)

The computer-readable medium of claim 42, wherein the calculating further comprises:
code for causing the server to detect a collision between the next PMSI and another existing PMSI associated with a different UE; and
code for causing the server to increment a PMSI index and determine a new next PMSI based on the next PMSI and the incremented PMSI index.

### Claim 48 (depends on 42)

The computer-readable medium of claim 42, further comprising:
code for causing the server to receive, from a mobility management entity (MME) on the serving network separate from a home network that the server is on, a request for the IMSI of the UE; and
code for causing the server to send, in response to the request, the PMSI of the UE used in the initial attach message instead of the IMSI of the UE.

### Claim 49 (depends on 42)

The computer-readable medium of claim 42, further comprising:
code for causing the server to search one or more databases for a match to the PMSI included with the initial attach message; and
code for causing the server to send, in response to not locating a match, a notice for the UE to modify a PMSI index maintained at the UE for generation of an updated PMSI at the UE.