Patent ID: 12207350

DETAILED DESCRIPTION

Described herein are techniques for accommodating legacy subscriber identity modules (SIMs) that may be used in 5th-Generation (5G) communication devices and networks.

Cellular communication devices such as smartphones are often configured and sold by different wireless network operators, each of which maintains a respective wireless communication network. The different networks are interconnected so that subscribers of different providers can communicate with each other.

A given network operator may sell or distribute a communication device that has been customized to be associated with the operator's network. In some cases, customization may happen during a provisioning process that is performed when the device initially boots up and connects to the operator's network. For purposes of discussion, the network operator with which a communication device is associated and/or from which it has been provisioned will be referred to as the provisioning network operator.

An installed subscriber identity module (SIM) is used for further configuration of a network device. A SIM is a removable smart card used to identify a user of a device to a service provider network. A SIM configures a device to have a unique identifier that is referred to in the 5G environment as a subscription permanent identifier (SUPI). The SUPI associates the device with a corresponding home network and is used for authenticating the device with the home network.

In 5G systems, the SUPI is encrypted before it is transmitted over the air by the device. The encrypted SUPI is referred to as a subscription concealed identifier (SUCI). The SUCI is generated by encrypting the SUPI, using an encryption key associated with the home network. The encrypting uses one of several encryption schemes specified by 5G specifications. The encrypting is performed dynamically, upon demand, so that the SUCI changes frequently.

A 5G SIM stores an encryption key, referred to herein as the home network key, that is used for encrypting the SUPI and creating the SUCI. In some cases, a 5G SIM itself may be capable of generating the SUCI based on its stored home network key and SUPI. In other cases, the device may retrieve the home network key and the SUPI from the SIM and perform the encryption to create the SUCI.

When a legacy SIM is installed in a 5G-capable device, it may be desirable for the device to establish a 5G connection even though the legacy SIM provides no mechanism for providing or creating a SUCI such as would normally be used for authenticating in 5G networks. In a described embodiment, a 5G-capable device may be configured to establish 5G connections even when the device is using a legacy SIM that is not 5G compatible.

Prior to and/or in preparation for network authentication, the device determines whether a SUCI is available from the SIM. If the device can obtain the SUCI from the SIM, the device proceeds with network authentication using this SUCI. If the SUCI is not available from the SIM, the device determines whether the home network key is available from the SIM. If the home network key is available from the SIM, the device obtains the SUPI from the SIM and encrypts it using the home network key to create the SUCI. The device then proceeds with network authentication using the generated SUCI.

If neither the SUCI nor the home network key is available from the SIM, the device determines whether it has been provisioned with a home network key of the home network specified by the SIM. This is typically the case when the home network is that of the provisioning network operator. If the home network key of the home network is present in the memory of the device, the device obtains the SUPI from the SIM and uses the provisioned encryption key to encrypt the SUPI and to create the SUCI. The device then proceeds with network authentication using this SUCI.

If neither the SUCI nor the home network key is available from the SIM, and device has not been provisioned with the home network key of the home network, the device proceeds with authentication using the SUPI stored by the SIM.

This procedure ensures that subscriber identifiers are concealed in most situations, including in the case of legacy SIMs issued by the provisioning network operator. In the case of a legacy SIM that is issued by another network operator, authentication is still possible using an unconcealed subscriber identifier.

FIGS.1A and1Billustrate an example communications system100in which the described techniques may be implemented.FIG.1Aillustrates a scenario in which both a cellular communication device102and its installed SIM104are associated with a single network operator106, which as mentioned above is referred to herein as the provisioning network operator106.

FIG.1Billustrates a scenario in which the device102is provided by the provisioning network operator106but the SIM104is associated with a different network operator108, which will be referred to herein as the other network operator108.

The device102may comprise any of various types of wireless cellular communication devices that are capable of wireless data and/or voice communications, including smartphones and other mobile devices, “Internet-of-Things” (IoT) devices, smarthome devices, computers, wearable devices, entertainment devices, industrial control equipment, etc. In some environments, the communication device102may be referred to as a User Equipment (UE) or a Mobile Station (MS). The device102may support 5G communication networks as well as networks using older standards such as 4th-generation (4G) networks.

The device102has memory110for storing various applications and data. For example, the memory110may store an operating system and other software or firmware that manages operations of the device102. The memory110may store various other software, including user-installed software.

The system100includes a cellular communication network112, which for purposes of this discussion may comprise any number of different operator networks. The illustrated network112may be the home network of the device102or a visited network. The illustrated network112may be provided by the provisioning network operator106, the other operator108, or any other network operator. The network112may include a radio access network (RAN) and core network components. In described embodiments, the network112is a 5G wireless network, but the network112may also include 4G support.

The device102may be configured in part by a provisioning process that is performed the first time that the device102connects to the network112. In other cases, the device may be configured by the provisioning network operator prior to or at the time of the sale of the device102.

The SIM104also provides certain configuration parameters. For example, the SIM104specifies information such as the telephone number of the device and the home network of the device. In the case illustrated byFIG.1A, the SIM specifies specify the network of the provisioning network operator106as the home network. In the case illustrated byFIG.1B, the SIM specifies the network of the other operator108as the home network. Generally, the network of the operator supplying the SIM is specified as the home network.

When configuring the device102, the provisioning network operator106may store a public encryption key114, also referred to herein as a home network key114, in the memory110of the device102. The home network key114may be the public part of an asymmetrical public/private key pair that is unique to the provisioning network operator106. In other embodiments, the home network key114may comprise another type of key, such as a symmetrical key. In some embodiments, storing the home network public key in the memory110may be performed as part of a secure provisioning process.

The SIM104may be either a 5G SIM104(a) or a legacy SIM104(b). The term SIM as used herein is intended to encompass various types of SIMs, including universal SIMs (USIMs) embedded SIMs (eSIMs), integrated SIMs (iSIMs), universal integrated circuit cards (eUICCs), etc.

A 5G SIM supports privacy features by providing a concealed subscriber identifier or by providing information allowing the device102to generate the concealed subscriber identifier. More specifically, the 5G SIM104(a) contains an unconcealed subscriber identifier118(a). The unconcealed subscriber identifier118(a) is a globally unique, unencrypted identifier, unique to the 5G SIM104(a), that is referred to as a subscription permanent identifier (SUPI) in the 5G environment. In practice, the SUPI is based on and includes an international mobile subscriber identifier (IMSI) that is unique to the SIM104.

The 5G SIM104(a) specifies a home network for the device102and also specifies a home network key116of the specified home network. In the scenario ofFIG.1A, the provisioning network operator106provides the device102, the home network key114, and the SIM104. In this case, the home network key114and the home network key116may be the same key.

In some cases, the 5G SIM104(a) is capable of generating a concealed subscriber identifier120, referred to as a subscription concealed identifier (SUCI) in the 5G environment, by encrypting the unconcealed subscriber identifier118(a) with the home network key116of the SIM104(a). The device102can then obtain the concealed subscriber identifier120from the 5G SIM104(a). In other cases, the device102may retrieve the home network key116from the SIM104(a) and encrypt the unconcealed subscriber identifier118(a) to create the concealed subscriber identifier120.

Note that although public key, asymmetric cryptology is described as being used in the illustrated embodiments, other types of key-based cryptography may also be used to conceal the unconcealed subscriber identifier118(a), including certificate-based schemes.

The legacy SIM104(b) contains an unconcealed subscriber identifier118(b), but does not contain an encryption key for encrypting the unconcealed subscriber identifier118(b). As with the unconcealed subscriber identifier118(a), the unconcealed subscriber identifier118(b) is an identifier that is globally unique to the SIM104(b). In the 5G environment, the unconcealed subscriber identifier118(b) may be a SUPI, which in turn may comprise or contain an IMSI such as used in 4th-generation (4G) or older communication networks.

In the scenario ofFIG.1A, the concealed subscriber identifier120is provided from the device102to the network112for authentication during registration and initial attachment. When the 5G SIM104(a) is installed in the device102, the concealed subscriber identifier120is generated by either the 5G SIM104(a) itself or by the device102based on the home network key116obtained from the SIM104(a). When the legacy SIM104(b) is installed in the device102, the concealed subscriber identifier120is calculated using on the stored home network key114, after retrieving the key114from the memory110of the device102. Because both the device102and the 5G SIM104(a) are provided by the same network operator, the home network key114stored by the device102is the same as the home network key116stored by the 5G SIM the 5G-compatible SIM104(a).

In the scenario ofFIG.1B, either the concealed subscriber identifier120or the unconcealed subscriber identifier118(b) is provided from the device102to the network112for authentication during registration and initial attachment. When the 5G SIM104(a) is installed in the device102, the concealed subscriber identifier120is generated by either the 5G SIM104(a) itself or by the device102based on the home network key116, which is obtained from the SIM104(a). The concealed subscriber identifier120is then sent to the 5G network for authentication. When the legacy SIM104(b) is installed in the device, the unconcealed subscriber identifier118(b) is provided to the network112. In this situation, the home network operator is not the same as the provisioning network operator106, and the device102is therefore not provisioned with the home network key of the home network.

FIG.2illustrates an example method200that may be implemented by the device102or other communication device for obtaining and using subscriber identifiers for authentication with a home network specified by the SIM104. The example method200assumes that the home network key114of the provisioning network operator106has been stored in non-volatile memory of the device102during provisioning or during some other configuration process.

An action202comprises beginning or preparing to begin an initial attachment to a wireless communication network, using the SIM104that is installed in the device102. The SIM104may be a 5G SIM that supports concealed subscriber identifiers or a legacy SIM that does not support concealed subscriber identifiers. The actions ofFIG.2subsequent to the action202are performed in order to obtain either an unconcealed subscriber identifier or a concealed subscriber identifier to be used in authenticating with the home network specified by the SIM104.

An action204comprises determining whether the device102is connecting to a 5G network or to a different, legacy network. If the device is connecting to a legacy network other than a 5G network, or to any network that does not support concealed subscriber identifiers, an action206is performed of obtaining the unconcealed subscriber identifier118from the SIM104that is currently installed in the device102(i.e., the SIM104(a) or104(b)). An action208, performed as part of an attachment procedure, comprises sending the unconcealed subscriber identifier118to the network112for registration and authentication with the home network specified by the SIM104.

An action210is performed if the device102is connecting to a 5G network or other network that supports concealment of subscriber identifiers. The action210comprises determining whether the concealed subscriber identifier120is available from the SIM104. In the 5G environment, this may comprise reading the Universal SIM Service Table (UF-UST) of the SIM104, which indicates the services supported by the SIM104. In particular, the action212comprises determining that both of services no124and no125are available. The availability of service no124indicates that SUCI identifier privacy is supported. The availability of service no125indicates that the SIM104itself is capable of calculating and providing the SUCI.

If the concealed subscriber identifier120is available from the SIM104, an action212is performed of obtaining the concealed subscriber identifier120from the SIM104. An action214is then performed of sending the concealed subscriber identifier120to the network for registration and authentication with the home network specified by the SIM104.

If the concealed subscriber identifier120is not available from the SIM104, an action216is performed of determining whether the home network key116, for encrypting the unconcealed subscriber identifier118, is available from the SIM104. This action may comprise determining whether the SIM104specifies that the no125service is available. If the no125service is available, the SIM104is capable of calculating the concealed subscriber identifier. If the no125service is unavailable, the SIM104is not capable of calculating the concealed subscriber identifier.

If the home network key116is available from the SIM104(i.e., service no125is available), an action218is performed of obtaining the home network key116(referred to as KPUB inFIG.2) and the unconcealed subscriber identifier118from the SIM104. These parameters are stored by the SIM104in an elementary file (EF) and are referred to as Subscription Concealed Identifier Calculation Information. (SUCI_Calc_Info).

An action220is then performed of encrypting the unconcealed subscriber identifier118using the home network key116to generate the concealed subscriber identifier120. An action222is then performed of sending the concealed subscriber identifier120to the network112for registration and authentication with the home network specified by the SIM104.

If no home network key is available from the SIM104(service no125is not available), an action224is performed of determining whether the home network key114of the home network specified by the currently installed SIM is stored in the memory110of the device102. This is the case inFIG.1A. InFIG.1B, the home network key114is not the home key of the SIM-specified home network.

If the home network key of the SIM-specified home network is stored by and available from the device102, an action226is performed of obtaining the home network key114from the memory110of the device102and obtaining an unconcealed subscriber identifier118from the SIM104. The action220is then performed, comprising encrypting the unconcealed subscriber identifier118using the home network key114to generate the concealed subscriber identifier120. The action222is then performed of sending the concealed subscriber identifier120to the network112for registration and authentication with the home network specified by the SIM104.

If the home network key of the SIM-specified home network is not stored by and available from the device102, an action228is performed of obtaining the unconcealed subscriber identifier118from the SIM104. The action230is then performed, comprising sending the unconcealed subscriber identifier118to the network112for authentication.

Note that although a home network key may be stored in the memory110of the device102, this home network key will not always be the home network key of the home network specified by the SIM104. When a SIM of a network operator other than the provisioning network operator is installed in the device102, the SIM will generally specify a home network other than network of the provisioning network operator106

FIG.3illustrates an example cellular communication device300that may be used to implement the techniques described herein. The method200ofFIG.2, for example, may be implemented by a device such as the device300. The device300is an example of the device102ofFIG.1.FIG.3shows only basic, high-level components of the device300.

The device300may include memory302and a processor304. The memory302may include both volatile memory and non-volatile memory. The memory302can also be described as non-transitory computer-readable media or machine-readable storage memory, and may include removable and non-removable media implemented in any method or technology for storage of information, such as computer executable instructions, data structures, program modules, or other data.

The memory302may include, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible, physical medium which can be used to store the desired information. The memory302may in some cases include storage media used to transfer or distribute instructions, applications, and/or data. In some cases, the memory302may include data storage that is accessed remotely, such as network-attached storage that the device300accesses over some type of data communication network.

The memory302stores one or more sets of computer-executable instructions (e.g., software) such as programs that embody operating logic for implementing and/or performing desired functionality of the device300. The instructions may also reside at least partially within the processor304during execution thereof by the device300. Generally, the instructions stored in the computer-readable storage media may include various applications306that are executed by the processor304, an operating system (OS)308that is also executed by the processor304, and data310. The data310may be used to store a network key such as the home network key114.

In some embodiments, the processor(s)304is a central processing unit (CPU), a graphics processing unit (GPU), both CPU and GPU, or other processing unit or component known in the art. Furthermore, the processor(s)304may include any number of processors and/or processing cores. The processor(s)304is configured to retrieve and execute instructions from the memory302.

The device300may have interfaces312, which may comprise any sort of interfaces known in the art. The interfaces312may include any one or more of an Ethernet interface, wireless local-area network (WLAN) interface, a near field interface, a DECT chipset, or an interface for an RJ-11 or RJ-45 port. A wireless LAN interface can include a Wi-Fi interface or a Wi-Max interface, or a Bluetooth interface that performs the function of transmitting and receiving wireless communications using, for example, the IEEE 802.11, 802.16 and/or 802.20 standards. The near field interface can include a Bluetooth® interface or radio frequency identifier (RFID) for transmitting and receiving near field radio communications via a near field antenna. For example, the near field interface may be used for functions, as is known in the art, such as communicating directly with nearby devices that are also, for instance, Bluetooth® or RFID enabled.

The device300may also have a Long-Term Evolution (LTE) radio314and a 5G radio316, which transmit and receive radio frequency communications via an antenna (not shown) for communications with wireless networks.

The device300may have a display318, which may comprise a liquid crystal display or any other type of display commonly used in telemobile devices or other portable devices. For example, the display318may be a touch-sensitive display screen, which may also act as an input device or keypad, such as for providing a soft-key keyboard, navigation buttons, or the like.

The device300may have input and output devices320. These devices may include any sort of output devices known in the art, such as a display (already described as display318), speakers, a vibrating mechanism, or a tactile feedback mechanism. Output devices may also include ports for one or more peripheral devices, such as headphones, peripheral speakers, or a peripheral display. Input devices may include any sort of input devices known in the art. For example, the input devices may include a microphone, a keyboard/keypad, or a touch-sensitive display (such as the touch-sensitive display screen described above). A keyboard/keypad may be a push button numeric dialing pad (such as on a typical telemobile device), a multi-key keyboard (such as a conventional QWERTY keyboard), or one or more other types of keys or buttons, and may also include a joystick-like controller and/or designated navigation buttons, or the like.

The device300may have a removable SIM322as described above, which may comprise a SIM that supports 5G subscriber privacy or a SIM that does not support 5G subscriber privacy.

Although features and/or methodological acts are described above, it is to be understood that the appended claims are not necessarily limited to those features or acts. Rather, the features and acts described above are disclosed as example forms of implementing the claims.