User Identity Privacy Protection in Public Wireless Local Access Network, WLAN, Access

A wireless device configured to provide privacy of a user identity during a connection establishment with a network over a non-third generation partnership project, non-3GPP, access network, the wireless device comprising:

• at least one transceiver;
• at least one processor;
• and
• memory comprising instructions executable by the at least one processor whereby the wireless device is operable to:
• send a message comprising an anonymous user identity;
• receive a request to obfuscate the user identity wherein the request comprises a server certificate;
• and
• validate the server certificate and send a response message comprising the user identity obfuscated by a public key associated with the server certificate.

A method of operation of a server in a network for enabling privacy of a user identity when a wireless device of a user requests a connection to the network, the method comprising:

• receiving an Authentication and Authorization, AA, request message for the wireless device, wherein the AA request message comprises an anonymous user identity;
• sending an instruction for the wireless device to request obfuscation of the user identity, wherein the instruction further comprises a certificate of the server;
• and
• upon receiving the user identity encrypted by a public key associated with the certificate of the server, decrypting the user identity using a corresponding private key and authenticating the user.

A server in a network, comprising:

• at least one processor;
• and
• memory comprising instructions executable by the at least one processor whereby the server is operable to:
• receive an Authentication and Authorization, AA, request message for a wireless device, wherein the AA request message comprises an anonymous user identity;
• send an instruction for the wireless device to request obfuscation of a corresponding user identity, wherein the instruction further comprises a certificate of the server;
• and
• upon receiving the corresponding user identity encrypted by a public key associated with the certificate of the server, decrypt the corresponding user identity using a private key associated with the certificate and authenticating the user.