Patent ID: 11956627
Assignee: NOKIA TECHNOLOGIES OY
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. An apparatus comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
receive, at a network entity of a core network of a communication system with which user equipment has a subscription, a request for identification information for the user equipment from an entity external to the communication system, the external entity comprising an application function outside the communication system, the application function being managed by a third party different than a network operator of the communication system with which the user equipment has the subscription;
generate, at the network entity of the core network of the communication system, a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment, the public subscription identifier being distinct from a corresponding subscription permanent identifier of the user equipment, wherein the encrypted form of the public subscription identifier associated with the user equipment is generated based at least in part on an identifier of the external entity, wherein the public subscription identifier comprises an external identifier that identifies a subscription associated to an International Mobile Subscriber Identity (IMSI), wherein the IMSI is a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN),
wherein generating the secure identifier for the user equipment further comprises:
generating a hash value by hashing the public subscription identifier with the identifier of the external entity and one or more of a time duration for which the secure identifier remains valid and a random number; and encrypting the hash value with a cryptographic key corresponding to a key identifier;

send, from the network entity of the core network of the communication system, the secure identifier to the external entity;
receive, at the network entity of the core network of the communication system, the secure identifier in a subsequent request from the external entity; and
utilize, at the network entity of the core network of the communication system, the received secure identifier to confirm the received secure identifier corresponds to the user equipment,
wherein the apparatus sends the key identifier and time duration along with the secure identifier to the external entity,
wherein the apparatus receives the key identifier and time duration along with the secure identifier from the external entity together with the subsequent request,
wherein the apparatus utilizes the key identifier and time duration along with the secure identifier to confirm the received secure identifier corresponds to the user equipment,
wherein the network entity of the core network of the communication system operates in:, a stateless manner by storing the cryptographic key corresponding to the key identifier; or a stateful manner by storing a mapping for the secure identifier comprising an association between the public subscription identifier, the identifier of the external entity, and the time duration, and wherein the network entity of the core network of the communication system comprises a network exposure function, and
wherein, in response to storing the mapping, the apparatus sends the secure identifier to the external entity, receives the secure identifier from the external entity in accordance with the subsequent request, and utilizes the received secure identifier to consult the mapping to confirm the received secure identifier corresponds to the user equipment.