Providing UE capability information to an authentication server

Patent metadata

Field	Value
Publication number	US-12267672-B2
Application number	US-202017437769-A
Country	US
Kind code	B2
Filing date	Mar 4, 2020
Priority date	Mar 13, 2019
Publication date	Apr 1, 2025
Grant date	Apr 1, 2025

Abstract

A method ( 300 ) for registering with a serving network ( 104 ). The method is performed by a UE ( 102 ). The method includes the UE transmitting (s 302 ) to the serving network ( 104 ) a message ( 212 ) indicating a UE capability that is relevant for a home network ( 106 ), wherein the 5 serving network ( 104 ) is configured to send to the home network ( 106 ) a message ( 216 ) indicating the UE capability.

First claim

The invention claimed is:

1. A method for registering with a serving network, the method being performed by a user equipment (UE) and comprising:
transmitting to the serving network a message indicating a UE capability that is relevant for a home network, wherein
the serving network is configured to send to the home network a message indicating the UE capability, and
the message transmitted by the serving network comprises a Subscriber Concealed Identifier (SUCI) which includes a perfect forward secrecy (PFS) indicator or an encrypted version of the PFS indicator that indicates an authentication capability of the UE; and

after transmitting the message, receiving a challenge transmitted by the home network, wherein the serving network is separate from the home network.

2. The method of claim 1 , wherein transmitting to the serving network the message indicating the UE capability comprises transmitting to a management function of the serving network a Non-Access Stratum (NAS) message comprising the PFS indicator.

3. The method of claim 2 , wherein the NAS message is a 3GPP Registration Request or Service Request.

4. The method of claim 2 , wherein the PFS indicator is a flag.

5. The method of claim 2 , wherein the PFS indicator comprises a Diffie-Hellman parameter.

6. The method of claim 1 , further comprising:
responding to the challenge by transmitting to the home network a response to the challenge.

7. The method of claim 1 , wherein the SUCI includes the encrypted version of the PFS indicator.

8. The method of claim 1 , wherein the PFS indicator comprises a list of elliptic curves supported by the UE.

9. The method of claim 1 , wherein
the PFS indicator comprises an ephemeral public key generated by the UE, and
the ephemeral public key was generated using an elliptic curve supported by the UE.

10. The method of claim 1 , wherein the PFS indicator comprises an indication of an elliptic curve selected by the UE and an ephemeral public key generated by the UE using the selected elliptic curve.

11. The method of claim 1 , wherein SUCI further includes a UE identifier.

12. The method of claim 1 , wherein the challenge is an extensible authentication protocol request message.

13. A computer program comprising a non-transitory computer readable medium having instructions stored thereon which, when executed by a stream controller, cause the stream controller to perform the method of claim 1 .

14. A method, the method comprising:
an authentication server in a user equipment's (UE's) home network, receiving an authentication request transmitted by an entity of a serving network serving the UE, the authentication request indicating an authentication capability of the UE, wherein the authentication request comprises a Subscriber Concealed Identifier (SUCI) which includes a perfect forward secrecy (PFS) indicator or an encrypted version of the PFS indicator that indicates the authentication capability of the UE;
the authentication server determining that the authentication request indicates the authentication capability; and
the authentication server transmitting a challenge towards the UE as a result of determining that the authentication request indicates the authentication capability, wherein
the serving network is separate from the home network.

15. The method of claim 14 , wherein
the method further comprises decrypting the SUCI to produce decrypted data, and
the decrypted data comprises an identifier for identifying the UE and the PFS indicator that indicates the authentication capability of the UE.

16. The method of claim 14 , wherein the PFS indicator is a flag.

17. The method of claim 14 , wherein the PFS indicator comprises a Diffie-Hellman parameter.

18. The method of claim 14 , further comprising:
performing a particular authentication procedure as a result of determining that the authentication request indicates the authentication capability.

19. The method of claim 18 , wherein performing the particular authentication procedure comprises:
generating a first ephemeral key pair comprising a first private key and a first public key, wherein the challenge comprises the first public key.

20. The method of claim 19 , wherein
performing the particular authentication procedure further comprises receiving a response message transmitted by the UE in response to the challenge, and
the response message comprises a second public key of a second ephemeral key pair generated by the UE.

21. The method of claim 14 , wherein
the entity of the serving network transmitted the authentication request in response to receiving a message transmitted by the UE, and
the message transmitted by the UE indicated the authentication capability of the UE.

22. A user equipment (UE), the UE comprising:
memory; and
processing circuitry coupled to the memory, wherein the UE is configured to:
transmit to a serving network a message indicating a UE capability that is relevant for a home network, wherein the serving network is configured to send to the home network a message indicating the UE capability and the message transmitted by the serving network comprises a Subscriber Concealed Identifier (SUCI) which includes a perfect forward secrecy (PFS) indicator or an encrypted version of the PFS indicator that indicates an authentication capability of the UE; and
after transmitting the message, receive a challenge transmitted by the home network, wherein the serving network is separate from the home network.

23. The UE of claim 22 , wherein the message transmitted by the UE is a Non-Access Stratum (NAS) message comprising a perfect forward secrecy (PFS) indicator.

24. An authentication server in a user equipment's (UE's) home network, the authentication server comprising:
memory; and
processing circuitry coupled to the memory, wherein the authentication server is configured to:
process a received authentication request transmitted by an entity of a serving network serving the UE, wherein the authentication request indicates an authentication capability of the UE, wherein the authentication request comprises a Subscriber Concealed Identifier (SUCI) which includes a perfect forward secrecy (PFS) indicator or an encrypted version of the PFS indicator that indicates the authentication capability of the UE;
determine that the authentication request indicates the authentication capability; and
transmit a challenge towards the UE as a result of determining that the authentication request indicates the authentication capability, wherein the serving network is separate from the home network.

25. The authentication server of claim 24 , wherein
the entity of the serving network transmitted the authentication request in response to receiving a message transmitted by the UE, and
the message transmitted by the UE is a Non-Access Stratum (NAS) message comprising a perfect forward secrecy (PFS) indicator.

Assignees

• Ericsson Telefon Ab L M

Inventors

• Arkko Jari
• Lehtovirta Vesa

Classifications

• H04L9/0841 Primary

  involving Diffie-Hellman or related key agreement protocols · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04W12/0431

  Key distribution or pre-distribution; Key agreement · CPC title

• H04W12/72

  Subscriber identity · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title