Patent Description:
The subject matter described herein relates to preventing subscriber identifier leakage. More particularly, the subject matter described herein relates to methods, systems, and computer readable media for preventing subscriber identifier leakage in <NUM> telecommunications networks.

The <NUM>rd Generation Partnership Project (3GPP) is a collaboration between groups of telecommunications standards associations. The 3GPP defined mobile phone system specifications for telecommunications networks including <NUM>, <NUM>, and Long Term Evolution (LTE) networks.

The next generation network for 3GPP is the <NUM> network. The <NUM> specifications target high data rates, reduced latency, energy saving, cost reduction, higher system capacity, and increasing numbers of connected devices.

The <NUM> system architecture introduces the security edge protection proxy (SEPP) as the entity sitting at the perimeter of a public land mobile network (PLMN). The SEPP can protect messages that are sent over interfaces between different networks. The SEPP can be configured as the node that:.

The SEPP implements application layer security for all the service layer information exchanged between two NFs across two different PLMNs.

The <NUM> system architectures includes a subscriber permanent identifier (SUPI) for subscribers. The SUPI is a globally unique identifier allocated to each subscriber in the <NUM> system. <NUM> has introduced concepts like the subscription concealed identifier (SUCI) to make sure that the SUPI remains confidential and known only to user equipment (UE) and the network.

During a roaming scenario, the SUPI needs to be shared with a visitor network for <NUM> service-based interface (SBI) service access. Sharing the SUPI with visitor network, however, opens up the possibility of SUPI leakage. SUPI can leak from the visitor network because of compromised security in visitor network. For example, the visitor access and mobility management function (AMF) can be compromised and may be leaking data. Data leaks from a visitor network may not be exposed for days and months, and leaked SUPIs may already be sold on the dark web by the time the leaks are exposed.

In light of these and other difficulties, there exists a need for methods, systems, and computer readable media for preventing subscriber identifier leakage.

Patent document <CIT> forms part of the relevant background art and discloses the role of a security edge protection proxy, SEPP, in maintaining the hiding of subscriber identifiers, such as SUPI and SUCI. Patent document <CIT> discloses a home PLMN SEPP device replacing a Mobile Country Code (MCC) or Mobile Network Code (MNC) with a predefined value that will trigger, as intended, a rejection from a home PLMN. The mobile device will then select another visited PLMN which is a preferred roaming partner.

Document "<NPL> also forms part of the relevant background art and discloses cryptographic means to safeguard the SUPI by the SEPP.

A method for preventing subscriber identifier leakage from a telecommunications network includes receiving, by a security edge protection proxy (SEPP), an authentication response message authorizing a subscriber in a visitor network, wherein the authentication response message includes a home subscriber identifier used to identify the subscriber within a home network. The method further includes replacing, by the SEPP, the home subscriber identifier in the authentication response message with a visitor subscriber identifier. The method further includes forwarding, by the SEPP, the authentication response message with the visitor subscriber identifier to a visitor network.

According to another aspect of the subject matter described herein, the method includes receiving a request message from the visitor network, the request message including the visitor subscriber identifier; replacing the visitor subscriber identifier in the request message with the home subscriber identifier; and forwarding the request message with the home subscriber identifier to a destination node within the home network.

According to another aspect of the subject matter described herein, the method includes receiving a response message form the destination node within the home network, the response message including the home subscriber identifier; replacing the home subscriber identifier in the response message with the visitor subscriber identifier; and forwarding the response message with the visitor subscriber identifier to the visitor network.

According to another aspect of the subject matter described herein, the method includes creating an association between the visitor subscriber identifier and the home subscriber identifier in a mapping of subscriber identifiers.

According to another aspect of the subject matter described herein, the method includes forwarding a request message from the visitor network including the visitor subscriber identifier by accessing the mapping of subscriber identifiers; looking up the visitor subscriber identifier in the mapping to find the home subscriber identifier; and replacing the visitor subscriber identifier in the request message with the home subscriber identifier.

According to another aspect of the subject matter described herein, the method includes forwarding a response message from a node within the home network including the visitor subscriber identifier by: accessing the mapping of subscriber identifiers; looking up the home subscriber identifier in the mapping to find the visitor subscriber identifier; and replacing the home subscriber identifier in the response message with the visitor subscriber identifier.

According to another aspect of the subject matter described herein, the home network is a <NUM> network and the home subscriber identifier is a subscriber permanent identifier (SUPI).

According to another aspect of the subject matter described herein, forwarding the authentication response message with the visitor subscriber identifier to the visitor network comprises forwarding the authentication response message to a visitor SEPP of the visitor network.

According to another aspect of the subject matter described herein, receiving the authentication response message comprises receiving the authentication response message from a unified data management (UDM) node by way of an authentication service function (AUSF).

According to another aspect of the subject matter described herein, the authentication response message authorizes the subscriber for roaming on the visitor network.

According to another aspect of the subject matter described herein, a system for preventing subscriber identifier leakage from a telecommunications network includes a security edge protection proxy (SEPP) including at least one processor and a memory. The system further includes a subscriber identifier replacer implemented by the at least one processor and configured for receiving an authentication response message authorizing a subscriber in a visitor network, wherein the authentication response message includes a home subscriber identifier used to identify the subscriber within a home network; replacing the home subscriber identifier in the authentication response message with a visitor subscriber identifier; and forwarding the authentication response message with the visitor subscriber identifier to a visitor network.

According to another aspect of the subject matter described herein, the subscriber identifier replacer is configured for: receiving a request message from the visitor network, the request message including the visitor subscriber identifier; replacing the visitor subscriber identifier in the request message with the home subscriber identifier; and forwarding the request message with the home subscriber identifier to a destination node within the home network.

According to another aspect of the subject matter described herein, the subscriber identifier replacer is configured for: receiving a response message form the destination node within the home network, the response message including the home subscriber identifier; replacing the home subscriber identifier in the response message with the visitor subscriber identifier; and forwarding the response message with the visitor subscriber identifier to the visitor network.

According to another aspect of the subject matter described herein, the subscriber identifier replacer is configured for creating an association between the visitor subscriber identifier and the home subscriber identifier in a mapping of subscriber identifiers.

According to another aspect of the subject matter described herein, the subscriber identifier replacer is configured for forwarding a request message from the visitor network including the visitor subscriber identifier by: accessing the mapping of subscriber identifiers; looking up the visitor subscriber identifier in the mapping to find the home subscriber identifier; and replacing the visitor subscriber identifier in the request message with the home subscriber identifier.

According to another aspect of the subject matter described herein, the subscriber identifier replacer is configured for forwarding a response message from a node within the home network including the visitor subscriber identifier by: accessing the mapping of subscriber identifiers; looking up the home subscriber identifier in the mapping to find the visitor subscriber identifier; and replacing the home subscriber identifier in the response message with the visitor subscriber identifier.

According to another aspect of the subject matter described herein, a non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps is provided. The steps include receiving, by a security edge protection proxy (SEPP), an authentication response message authorizing a subscriber in a visitor network, wherein the authentication response message includes a home subscriber identifier used to identify the subscriber within a home network; replacing, by the SEPP, the home subscriber identifier in the authentication response message with a visitor subscriber identifier; and forwarding, by the SEPP, the authentication response message with the visitor subscriber identifier to a visitor network.

The subject matter described herein can be implemented in software in combination with hardware and/or firmware. For example, the subject matter described herein can be implemented in software executed by a processor. In one example implementation, the subject matter described herein may be implemented using a computer readable medium having stored thereon computer executable instructions that when executed by the processor of a computer control the computer to perform steps.

Example computer readable media suitable for implementing the subject matter described herein include non-transitory devices, such as disk memory devices, chip memory devices, programmable logic devices, and application specific integrated circuits. In addition, a computer readable medium that implements the subject matter described herein may be located on a single device or computing platform or may be distributed across multiple devices or computing platforms.

The subject matter described herein relates to methods, systems, and computer readable media for preventing subscriber identifier leakage from a telecommunications network.

In <NUM> telecommunications networks, the network node that provides service is referred to as a producer network function (NF). A network node that consumes services is referred to as a consumer NF. A network function can be both a producer NF and a consumer NF depending on whether it is consuming or providing service.

A given producer NF may have many service endpoints, where a service endpoint is the point of contact for one or more NF instances hosted by the producer NF. The service endpoint is identified by a combination of Internet protocol (IP) address and port number or a fully qualified domain name that resolves to an IP address and port number on a network node that hosts a producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include more than one NF instance. It should also be noted that multiple NF instances can share the same service endpoint.

Producer NFs register with a network function repository function (NRF). The NRF maintains service profiles of available NF instances identifying the services supported by each NF instance. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF.

In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes with the NRF and obtains reachability and service profile information regarding producer NF service instances. Consumer NFs connect to the SCP, and the SCP load balances traffic among producer NF service instances that provide the required service or directly routes the traffic to the destination producer NF instance.

In addition to the SCP, other examples of intermediate proxy nodes or groups of network nodes that route traffic between producer and consumer NFs include the security edge protection proxy (SEPP), the service gateway, and nodes in the <NUM> service mesh. The SEPP is the network node used to protect control plane traffic that is exchanged between different <NUM> public land mobile networks (PLMNs). As such, the SEPP performs message filtering, policing and topology hiding for all application programming interface (API) messages.

During a roaming scenario, the SUPI needs to be shared with a visitor network for <NUM> SBI service access. Roaming refers to the ability for a cellular customer to automatically make and receive voice calls, send and receive data, or access other services, including home data services, when travelling outside the geographical coverage area of the home network, by using a visitor network. For example, should a subscriber travel beyond their cell phone company's transmitter range, their cell phone would automatically hop onto another phone company's service, if available.

"Home network" refers to the network the subscriber is registered with. "Visitor network" refers to the network a subscriber roams temporarily and is outside the bounds of the "home network.

Sharing the SUPI with visitor network, however, opens up the possibility of SUPI leakage. SUPI can leak from the visitor network because of compromised security in visitor network. For example, the visitor access and mobility management function (AMF) can be compromised and may be leaking data. Data leaks from a visitor network may not be exposed for days and months, and leaked SUPIs may already be sold on the dark web by the time the leaks are exposed.

The third generation partnership project (3GPP) technical specification <NUM> defines <NUM> authorization procedures and other security procedures. The security anchor function (SEAF) may initiate an authentication with the UE during any procedure establishing a signalling connection with the UE, according to the SEAF's policy.

The UE can use SUCI or <NUM>-GUTI in the Registration Request. The SEAF shall invoke the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate Request message to the AUSF whenever the SEAF wishes to initiate an authentication. The SEAF shall include the SUPI in the Nausf_UEAuthentication_Authenticate Request message in case the SEAF has a valid <NUM>-GUTI and re-authenticates the UE. Otherwise the SUCI is included in Nausf_UEAuthentication_Authenticate Request.

Upon receiving the Nausf_UEAuthentication_Authenticate Request message, the AUSF shall check that the requesting SEAF in the serving network is entitled to use the serving network name in the Nausf_UEAuthentication_Authenticate Request by comparing the serving network name with the expected serving network name. The AUSF shall store the received serving network name temporarily. If the serving network is not authorized to use the serving network name, the AUSF shall respond with "serving network not authorized" in the Nausf_UEAuthentication_Authenticate Response.

<NUM> AKA enhances the authorization procedure by providing the home network with proof of successful authentication of the UE from the visited network. The proof is sent by the visited network in an Authentication Confirmation message. The authentication procedure for <NUM> AKA works as described in 3GPP TS <NUM>. SUPI is returned in Nausf_UEAuthentication response. The same SUPI is then used in different messages by Visitor PLMN NF consumer in SBI service access requests.

Table <NUM> shows inter-PLMN messages from a visitor PLMN to a home PLMN.

Instead of providing the home SUPI in the authentication procedure, as described in 3GPP TS <NUM>, the SEPP can return a pseudo-SUPI (or "visitor SUPI") in the authentication response. The visitor SUPI can then be used in different messages by the visitor network in service access requests.

This solution can provide one or more of the following advantages:.

<FIG> is a block diagram illustrating an exemplary <NUM> system network architecture. The architecture in <FIG> includes NRF <NUM> and SCP <NUM>, which may be located in the same home public land mobile network (HPLMN). NRF <NUM> may maintain profiles of available producer NF service instances and their supported services and allow consumer NFs or SCPs to subscribe to and be notified of the registration of new/updated producer NF service instances.

SCP <NUM> may also support service discovery and selection of producer NF instances. SCP <NUM> may perform load balancing of connections between consumer and producer NFs. In addition, using the methodologies described herein, SCP <NUM> may perform preferred NF location based selection and routing.

NRF <NUM> is a repository for NF or service profiles of producer NF instances. In order to communicate with a producer NF instance, a consumer NF or an SCP must obtain the NF or service profile or the producer NF instance from NRF <NUM>. The NF or service profile is a JavaScript object notation (JSON) data structure defined in 3GPP Technical Specification (TS) <NUM>.

In <FIG>, any of the nodes (other than NRF <NUM>) can be either consumer NFs or producer NFs, depending on whether they are requesting or providing services. In the illustrated example, the nodes include a policy control function (PCF) <NUM> that performs policy related operations in a network, a user data management (UDM) function <NUM> that manages user data, and an application function (AF) <NUM> that provides application services.

The nodes illustrated in <FIG> further include a session management function (SMF) <NUM> that manages sessions between access and mobility management function (AMF) <NUM> and PCF <NUM>. AMF <NUM> performs mobility management operations similar to those performed by a mobility management entity (MME) in <NUM> networks. An authentication server function (AUSF) <NUM> performs authentication services for user equipment (UEs), such as user equipment (UE) <NUM>, seeking access to the network.

A network slice selection function (NSSF) <NUM> provides network slicing services for devices seeking to access specific network capabilities and characteristics associated with a network slice. A network exposure function (NEF) <NUM> provides application programming interfaces (APIs) for application functions seeking to obtain information about Internet of things (IoT) devices and other UEs attached to the network. NEF <NUM> performs similar functions to the service capability exposure function (SCEF) in <NUM> networks.

A radio access network (RAN) <NUM> connects user equipment (UE) <NUM> to the network via a wireless link. Radio access network <NUM> may be accessed using a g-Node B (gNB) (not shown in <FIG>) or other wireless access point. A user plane function (UPF) <NUM> can support various proxy functionality for user plane services. One example of such proxy functionality is multipath transmission control protocol (MPTCP) proxy functionality.

UPF <NUM> may also support performance measurement functionality, which may be used by UE <NUM> to obtain network performance measurements. Also illustrated in <FIG> is a data network (DN) <NUM> through which UEs access data network services, such as Internet services.

SEPP <NUM> filters incoming traffic from another PLMN and performs topology hiding for traffic exiting the home PLMN. SEPP <NUM> may communicate with an SEPP in a foreign PLMN which manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs may traverse two SEPP functions, one for the home PLMN and the other for the foreign PLMN.

SEPP <NUM> is configured for receiving an authentication response message authorizing a subscriber in a visitor network. The authentication response message includes a home subscriber identifier used to identify the subscriber within a home network. SEPP <NUM> can then be configured for replacing the home subscriber identifier in the authentication response message with a visitor subscriber identifier. SEPP <NUM> can then be configured for forwarding the authentication response message with the visitor subscriber identifier to a visitor network.

<FIG> is a block diagram of an example SEPP <NUM>. SEPP <NUM> includes at least one processor <NUM> and memory <NUM>. SEPP <NUM> includes a subscriber identifier replacer <NUM> implemented by the at least one processor <NUM>.

Subscriber identifier replacer <NUM> includes an identifier generator <NUM> and an identifier mapper <NUM>. Identifier generator <NUM> is configured for generating visitor SUPIs for providing to visitor networks. For example, identifier generator <NUM> can use any appropriate method for generating unique subscriber identifiers to generate new, unique subscriber identifiers for subscribers that are different form subscriber identifiers used on a home network.

Identifier mapper <NUM> is configured for creating associations between visitor SUIPs and home (actual, or real) SUPIs used on the home network within a database of mappings <NUM> between home SUPIs and visitor SUPIs. Although this specification describes SEPP <NUM> as working with SUPIs, in general, SEPP <NUM> can use any types of subscriber identifier that is used within a home network and sent to a visitor network.

Subscriber identifier replacer <NUM> is configured for:.

Subscriber identifier replacer <NUM> is further configured for handling additional requests from the subscriber after the subscribed is authorized on the visitor network. For example, subscriber identifier replacer <NUM> is configured for:.

Subscriber identifier replacer <NUM> can then be further configured for handling responses to requests related to the subscriber after the subscriber makes requests form the visitor network. For example, subscriber identifier <NUM> can be configured for:.

In general, subscriber identifier replacer <NUM> works by creating associations between SUPIs and visitors SUPIs generated by identifier generator <NUM> in the database of mappings <NUM>. When requests are received from visitor networks, SEPP <NUM> replaces the visitor SUPIs with home SUPIs by accessing the database of mappings <NUM>, looking up home SUPIs, and replacing the visitor SUPIs with home SUPIs. When responses are received from nodes within the home network, SEPP <NUM> replaces the home SUPIs with visitor SUPIs by accessing the database of mappings <NUM>, looking up visitor SUPIs, and replacing the home SUPIs with visitors SUPIs.

Subscriber identifier replacer <NUM> can be configured to identify messages for subscriber identifier replacement using any appropriate technique. For example, subscriber identifier replacer <NUM> can store a list of message types or interface types for subscriber identifier replacement. Then, when SEPP <NUM> receives a message matching one of the message types on the list, subscriber identifier performs subscriber identifier replacement. A list is just an example and, in general, any appropriate data structure or technique can be used for identifying messages for subscriber identifier replacement.

In some examples, subscriber identifier replacer <NUM> is configured to check certain outbound messages (destined to a visitor network) to determine if the messages include the home subscriber identifier. If a message does include the home subscriber identifier, then subscriber identifier replacer <NUM> replaces the home subscriber identifier with the visitor subscriber identifier before forwarding the message to the visitor network.

Similarly, subscriber identifier replacer <NUM> can be configured to check certain inbound messages (originating from a visitor network) to determine if the messages include the visitor subscriber identifier. If a message does include the visitor subscriber identifier, then subscriber identifier <NUM> replaces the visitor subscriber identifier with the home subscriber identifier before forwarding the message within the home network.

<FIG> is a message flow diagram illustrating messages exchanged <NUM> to authenticate a UE from a visitor network during a roaming scenario.

As shown in <FIG>, a home network includes a home PLMN <NUM>, and a visitor network includes a visitor PLMN <NUM>. Home PLMN <NUM> includes at least a home SEPP <NUM>, an AUSF <NUM>, and UDM <NUM>. Visitor PLMN <NUM> includes at least a visitor SEPP <NUM> and an AMF <NUM>.

At <NUM>, AMF <NUM> sends a UE authentication request (Nausf_UEAuthentication (suci, servingNetworkName)) to the home network.

At <NUM>, visitor SEPP <NUM> forwards the request to home SEPP <NUM>.

At <NUM>, home SEPP <NUM> forwards the request to AUSF <NUM>.

At <NUM>, AUSF <NUM> fetches AV and SUPI from UDM <NUM> (Nudm_UEAuthentication (suci, servingNetworkName)).

At <NUM>, UDM <NUM> sends AV and SUPI (Nudm_UEAuthentication Response (<NUM> HE AV, SUPI)).

At <NUM>, AUSF <NUM> returns AV to AMF (Nausf_UEAuthentication Response (<NUM> SE AV, authCtxId)). SUPI is not returned.

At <NUM>, home SEPP <NUM> forwards the response to visitor SEPP <NUM>.

At <NUM>, visitor SEPP <NUM> forwards the response to AMF <NUM>.

At <NUM>, AMF <NUM> sends an authentication event (Nausf_UEAuthentication (authCtxId, resStar)).

At <NUM>, visitor SEPP <NUM> forwards the event to home SEPP <NUM>.

At <NUM>, AUSF <NUM> sends the authentication event to UDM <NUM> (Nudm_UEAuthentication Req).

At <NUM>, UDM <NUM> responds back to AUSF <NUM> (Nudm_UEAuthentication Res).

At <NUM>, AUSF <NUM> respond back authentication results and SUPI (Nausf_UEAuthentication Response (authResult, SUPI)). AUSF <NUM> previously stored the SUPI from UDM at <NUM>.

During a roaming scenario, the SUPI needs to be shared with the visitor network for <NUM> SBI service access. Sharing the SUPI with visitor network, however, opens up the possibility of SUPI leakage. SUPI can leak from the visitor network because of compromised security in visitor network. For example, AMF <NUM> can be compromised and may be leaking data. Data leaks from a visitor network may not be exposed for days and months, and leaked SUPIs may already be sold on the dark web by the time the leaks are exposed.

Instead of providing the home SUPI in the authentication procedure, as described in 3GPP TS <NUM>, the SEPP can return a visitor SUPI in the authentication response. The visitor SUPI can then be used in different messages by the visitor network in service access requests.

Referring back to <NUM>, Home SEPP <NUM> replaces the home SUPI (the actual SUPI, used within the home network) with a visitor SUPI.

At <NUM>, home SEPP <NUM> forwards the updated response (with the visitor SUPI) to visitor SEPP <NUM>.

At <NUM>, visitor SEPP <NUM> forwards the updated response to AMF <NUM>. AMF <NUM> stores the visitor SUPI and uses the visitor SUPI as if it was the actual, home SUPI.

<FIG> is a message flow diagram illustrating messages exchanged <NUM> to secure additional services for a UE from a visitor network during a roaming scenario.

As shown in <FIG>, visitor PLMN <NUM> includes a consumer network function <NUM>. Home PLMN <NUM> includes a producer network function <NUM>.

In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a service communication proxy (SCP). The SCP subscribes with the NRF and obtains reachability and service profile information regarding producer NF service instances. Consumer NFs connect to the SCP proxy, and the SCP load balances traffic among producer NF service instances that provide the required service or directly routes the traffic to the destination producer NF instance.

At <NUM>, consumer network function <NUM> sends an SBI service request including the visitor SUPI.

At <NUM>, visitor SEPP <NUM> forwards the request to home SEPP <NUM>. Home SEPP <NUM> replaces the visitor SUPI with the home SUPI.

At <NUM>, home SEPP <NUM> forwards the request to producer network function <NUM>.

At <NUM>, producer network function <NUM> responds to the request (SBI Service Response). Home SEPP <NUM> checks the response message to see if it includes the home SUPI, and if it does, then home SEPP <NUM> replaces the home SUPI with the visitor SUPI.

At <NUM>, visitor SEPP <NUM> forwards the response to consumer network function <NUM>.

<FIG> is a flow diagram of an example method <NUM> for preventing subscriber identifier leakage from a telecommunications network.

Method <NUM> includes receiving, by a security edge protection proxy (SEPP), an authentication response message authorizing a subscriber in a visitor network. The authentication response message includes a home subscriber identifier used to identify the subscriber within a home network (<NUM>). Method <NUM> includes replacing, by the SEPP, the home subscriber identifier in the authentication response message with a visitor subscriber identifier (<NUM>). Method <NUM> includes forwarding, by the SEPP, the authentication response message with the visitor subscriber identifier to a visitor network (<NUM>).

In some examples, method <NUM> includes receiving a request message from the visitor network, the request message including the visitor subscriber identifier; replacing the visitor subscriber identifier in the request message with the home subscriber identifier; and forwarding the request message with the home subscriber identifier to a destination node within the home network. Then, method <NUM> can include receiving a response message from the destination node within the home network, the response message including the home subscriber identifier; replacing the home subscriber identifier in the response message with the visitor subscriber identifier; and forwarding the response message with the visitor subscriber identifier to the visitor network.

In some examples, method <NUM> includes creating an association between the visitor subscriber identifier and the home subscriber identifier in a mapping of subscriber identifiers. Then, method <NUM> can include forwarding a request message from the visitor network including the visitor subscriber identifier by: accessing the mapping of subscriber identifiers; looking up the visitor subscriber identifier in the mapping to find the home subscriber identifier; and replacing the visitor subscriber identifier in the request message with the home subscriber identifier.

Method <NUM> can also include forwarding a response message from a node within the home network including the visitor subscriber identifier by: accessing the mapping of subscriber identifiers; looking up the home subscriber identifier in the mapping to find the visitor subscriber identifier; and replacing the home subscriber identifier in the response message with the visitor subscriber identifier.

In some examples, the home network is a <NUM> network and the home subscriber identifier is a subscriber permanent identifier (SUPI). Forwarding the authentication response message with the visitor subscriber identifier to the visitor network can include forwarding the authentication response message to a visitor SEPP of the visitor network. Receiving the authentication response message can include receiving the authentication response message from a unified data management (UDM) node by way of an authentication service function (AUSF). The authentication response message can authorize the subscriber for roaming on the visitor network.

In some examples, method <NUM> includes checking certain outbound messages (destined to a visitor network) to determine if the messages include the home subscriber identifier. If a message does include the home subscriber identifier, then method <NUM> includes replacing the home subscriber identifier with the visitor subscriber identifier before forwarding the message to the visitor network.

Similarly, method <NUM> can include checking certain inbound messages (originating from a visitor network) to determine if the messages include the visitor subscriber identifier. If a message does include the visitor subscriber identifier, then method <NUM> includes replacing the visitor subscriber identifier with the home subscriber identifier before forwarding the message within the home network.

The scope of the present disclosure includes any feature or combination of features disclosed in this specification (either explicitly or implicitly), or any generalization of features disclosed, whether or not such features or generalizations mitigate any or all of the problems described in this specification. Accordingly, new claims may be formulated during prosecution of this application (or an application claiming priority to this application) to any such combination of features.

Claim 1:
A method (<NUM>) for preventing subscriber identifier leakage from a telecommunications network, the method comprising:
receiving (<NUM>), by a security edge protection proxy, SEPP, an authentication response message authorizing a subscriber in a visitor network, wherein the authentication response message includes a home subscriber identifier used to identify the subscriber within a home network;
replacing (<NUM>), by the SEPP, the home subscriber identifier in the authentication response message with a visitor subscriber identifier; and
forwarding (<NUM>), by the SEPP, the authentication response message with the visitor subscriber identifier to a visitor network.