# US 2019/0246275 A1 · Operation related to user equipment using secret identifier > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0246275 A1 - Document ID: US20190246275A1 - Status: Published application - Kind: A1 - Application number: 16/318,622 - Filed: 2017-07-12 - Published: 2019-08-08 - Earliest claimed: 2016-07-18 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Prajwol Kumar NAKARMI; Noamen BEN HENDA; Christine JOST; Vesa TORVINEN - Web page: https://patentgrep.com/patent/US20190246275A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/30: {for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281)} - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04W 8/08: Mobility data transfer - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/037: of the control plane, e.g. signalling traffic - H04W 12/06: Authentication - H04W 12/062: Pre-authentication - H04W 12/069: using certificates or pre-shared keys - H04W 12/72: Subscriber identity - H04W 84/042: {Public Land Mobile systems, e.g. cellular systems} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method performed by a network node (106) of a serving public land mobile network, PLMN, (112) associated with a user equipment, UE, (102) comprising: obtaining a secret identifier (110) that uniquely identifies the UE, wherein the secret identifier is a secret that is shared between the UE and at least a home PLMN of the UE and that is shared by the home PLMN with the network node; and performing an operation (108) related to the UE using the secret identifier. Other methods, computer programs, computer program products, network nodes and a serving PLMN are also disclosed. ## Claims ### Claim at position 1 1-51. (canceled) ### Claim 52 A method performed by a network node of a serving public land mobile network (PLMN) associated with a user equipment (UE), the method comprising: receiving, from the UE, a public identifier or a pseudonym corresponding to the UE; forwarding to a home PLMN of the UE the public identifier or pseudonym corresponding to the UE; receiving from the home PLMN an IMSI in response to the forwarding of the public identifier and or pseudonym, wherein the IMSI uniquely identifies the UE and is a secret that is shared between the UE and at least a home PLMN; and performing an operation related to a lawful interception of the UE using the IMSI. ### Claim 53 (depends on 52) The method of claim 52, wherein the IMSI is received based on the UE being successfully authenticated by the home PLMN. ### Claim 54 (depends on 52) The method of claim 52, wherein receiving the ISMI comprises receiving an Extensible Authentication Protocol (EAP) message from the home PLMN. ### Claim 55 (depends on 52) The method of claim 52, further comprising: receiving authentication information from the home PLMN, the authentication information allowing the serving PLMN to perform authentication of the UE; and using the authentication information to determine, by the serving PLMN, that the UE is successfully authenticated. ### Claim 56 (depends on 55) The method of claim 55, wherein the authentication information is formed in an Evolved Packet System-Authentication and Key Agreement (EPS-AKA) format and is communicated to the serving PLMN via an authentication vector. ### Claim 57 (depends on 55) The method of claim 55, further comprising communicating an authentication success message to the home PLMN to inform the home PLMN that the UE has been successfully authenticated by the serving PLMN, the authentication success message triggering the home PLMN to send the secret identifier to the serving PLMN. ### Claim 58 (depends on 55) The method of claim 55, wherein obtaining the IMSI comprises receiving the IMSI from the home PLMN before the UE is authenticated by the serving PLMN. ### Claim 59 (depends on 58) The method of claim 58, wherein receiving the ISMI from the home PLMN comprises receiving an authentication-information-answer message from the home PLMN. ### Claim 60 (depends on 55) The method of claim 55, wherein receiving the IMSI comprises receiving the IMSI from the home PLMN after the UE is authenticated by the serving PLMN. ### Claim 61 (depends on 60) The method of claim 60, wherein receiving the secret identifier from the home PLMN comprises receiving an update-location-answer message from the home PLMN. ### Claim 62 (depends on 61) The method of claim 61, further comprising verifying that the public identifier or the pseudonym and the IMSI correspond to the UE. ### Claim 63 (depends on 62) The method of claim 62, wherein the verifying comprises: obtaining encryption information for encrypting the IMSI; generating an encrypted IMSI by encrypting the IMSI using the encryption information; determining that the encrypted IMSI and the public identifier match based on a comparison; and verifying that the public identifier and the IMSI correspond to the UE based on determining that the encrypted IMSI and the public identifier match. ### Claim 64 (depends on 63) The method of claim 63, wherein the encryption information comprises a public key of the home PLMN. ### Claim 65 A method performed by a network node of a home public land mobile network (PLMN) associated with a user equipment (UE), the method comprising: receiving a public identifier or pseudonym of the UE forwarded to the home PLMN by a serving PLMN of the UE; successfully authenticating the UE based on at least the public identifier or pseudonym, determining, upon successful authentication of the UE, to reveal to the serving PLMN, an ISMI that uniquely identifies the UE and is a secret that is shared between the UE and at least the home PLMN; revealing the IMSI to the serving PLMN, the IMSI allowing the serving PLMN to perform an operation related to a lawful interception of the UE using the IMSI. ### Claim 66 (depends on 64) The method of claim 64, wherein revealing the secret identifier to the serving PLMN comprises sending an Extensible Authentication Protocol message to the serving PLMN. ### Claim 67 (depends on 64) The method of claim 64, wherein the IMSI is unencrypted. ### Claim 68 (depends on 64) The method of claim 64, wherein the public identifier comprises the IMSI that is encrypted using a public encryption key of the home PLMN. ### Claim 69 A network node of a serving public land mobile network (PLMN) associated with a user equipment (UE), the network node comprising: a processor; and a memory, the memory containing instructions executable by the processor wherein the network node is configured to: receive, from the UE, a public identifier or a pseudonym corresponding to the UE; forward the public identifier or pseudonym to a home PLMN of the UE; receive from the home PLMN an IMSI in response to the forwarding of the public identifier or pseudonym, wherein the IMSI uniquely identifies the UE and is a secret that is shared between the UE and at least the home PLMN; and perform an operation related to a lawful interception of the UE using the IMSI. ### Claim 70 (depends on 69) The network node of claim 69, wherein the public identifier comprises the IMSI that is encrypted using a public encryption key of the home PLMN. ### Claim 71 A network node of a home public land mobile network (PLMN) associated with a user equipment (UE), the network node comprising: a processor; and a memory, the memory containing instructions executable by the processor wherein the network node is configured to: receive a public identifier or pseudonym of the UE forwarded to the home PLMN by a serving PLMN of the UE; successfully authenticate the UE based on at least the public identifier or pseudonym; determine, upon successful authentication of the UE, to reveal to the serving PLMN, an IMSI that uniquely identifies the UE and is a secret that is shared between the UE and at least the home PLMN; and reveal the IMSI to the serving PLMN, the IMSI allowing the serving PLMN to perform an operation related to a lawful interception of the UE using the IMSI. ### Claim 72 (depends on 71) The network node of claim 71, wherein the public identifier comprises the IMSI that is encrypted using a public encryption key of the home PLMN. ### Claim 73 A method performed by a serving public land mobile network (PLMN) associated with a user equipment (UE), the method comprising: receiving, from the UE, a public identifier or a pseudonym corresponding to the UE; forwarding to a home PLMN of the UE the received public identifier or pseudonym; receiving, from a home PLMN of the UE after the UE has been successfully authenticated by the home PLMN or the serving PLMN, an IMSI that uniquely identifies the UE and is a secret previously shared between the UE and the home PLMN; and performing a lawful interception related to the UE. ### Claim 74 (depends on 71) The method according to claim 71, wherein the UE is authenticated by the serving PLMN. ### Claim 75 (depends on 73) The method of claim 73, wherein the public identifier comprises the IMSI that is encrypted using a public encryption key of the home PLMN. ### Claim 76 A method performed by a home public land mobile network (PLMN) associated with a user equipment (UE), the method comprising: receiving a public identifier or pseudonym of the UE forwarded to the home PLMN by a serving PLMN of the UE; successfully authenticating the UE based on at least the public identifier or pseudonym; determining to reveal, to a serving PLMN of the UE, an IMSI that uniquely identifies the UE and is a secret that is shared between the UE and the home PLMN; and revealing the IMSI to the serving PLMN after the UE has been successfully authenticated by the home PLMN or the serving PLMN, the IMSI allowing the serving PLMN to perform a lawful interception related to the UE. ### Claim 77 (depends on 76) The method according to claim 76, wherein the IMSI is unencrypted.