SUCI encryption based on post-quantum key encapsulation mechanism

Abstract

The invention relates to SUCI encryption based on a post quantum key encapsulation mechanism. Example embodiments of the present disclosure relate to SUCI encryption based on a post quantum key encapsulation mechanism. In an aspect, a terminal device generates a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, where the public key is generated based on a post quantum cryptography (PQC) key encapsulation mechanism (KEM). And then, the terminal equipment sends the SUCI to network equipment. According to some embodiments of the present disclosure, a brand new fully post-quantum based SUCI ensures that different types of attacks are avoided.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of communications, and more particularly to a terminal device, a network device, a method, an apparatus, and a computer-readable storage medium for SUCI encryption based on a post-quantum key encapsulation mechanism. Background of the Invention

[0003] Communication security is crucial for any communication system, including 5G systems. Appropriate encryption and encapsulation schemes play an important role in communication security. The 3rd Generation Partnership Project 3GPP is committed to developing secure communication systems. There are still challenges in ensuring communication security. Summary of the invention

[0004] Generally speaking, example embodiments of the present disclosure provide a SUCI encryption solution based on a post-quantum key encapsulation mechanism.

[0005] In a first aspect, a terminal device is provided. The terminal device includes at least one processor and at least one memory storing instructions, which when executed by the at least one processor cause the terminal device to at least: generate a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network (HN) of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and send the SUCI to a network device.

[0006] In a second aspect, a network device is provided. The network device includes at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, cause the network device to at least: receive a subscription hidden identifier (SUCI) of a terminal device; and obtain a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0007] In a third aspect, a method is provided. The method includes: generating, at a terminal device, a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and sending the SUCI to a network device.

[0008] In a fourth aspect, a method is provided. The method includes: receiving a subscription hidden identifier (SUCI) of a terminal device at a network device; and obtaining a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0009] In a fifth aspect, an apparatus is provided. The apparatus includes: a component for generating, at a terminal device, a subscription hidden identifier (SUCI) of a terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and a component for sending the SUCI to a network device.

[0010] In a sixth aspect, an apparatus is provided. The apparatus includes: a component for receiving a subscription hidden identifier (SUCI) of a terminal device at a network device; and a component for obtaining a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0011] In a seventh aspect, a non-transitory computer-readable storage medium comprising instructions is provided. When the instructions are executed by an apparatus, the apparatus at least performs the following operations: generating, at a terminal device, a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and sending the SUCI to a network device.

[0012] In an eighth aspect, a non-transitory computer-readable storage medium comprising instructions is provided. When executed by an apparatus, the instructions cause the apparatus to at least perform the following operations: receiving a subscription hidden identifier (SUCI) of a terminal device at a network device; and obtaining a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0013] In a ninth aspect, there is provided a computer program comprising instructions which, when executed by an apparatus, cause the apparatus to at least: generate a subscription hidden identifier (SUCI) for a terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and send the SUCI to a network device.

[0014] The present invention provides a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus to at least: receive a subscription hidden identifier (SUCI) of a terminal device; and obtain a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0015] In an eleventh aspect, a terminal device is provided. The terminal device comprises: a generating circuit configured to generate a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and a sending circuit configured to send the SUCI to a network device.

[0016] In a twelfth aspect, a network device is provided. The network device comprises: a receiving circuit configured to receive a subscription hidden identifier (SUCI) of a terminal device; and an obtaining circuit configured to obtain a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0017] It should be understood that the abstract is not intended to identify the key or essential features of the embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0019] Figure 1A shows an example of a network environment in which some example embodiments of the present disclosure may be implemented;

[0020] Figure 1B The encryption steps at the UE end according to the Elliptic Curve Integrated Encryption Scheme (ECIES) are shown;

[0021] Figure 1C shows the encryption steps at the network end according to the ECIES scheme;

[0022] Figure 1D SUPI defined in 3GPP TS 23.003 clause 2.2A is shown;

[0023] Figure 1E SUCI according to current specifications is shown;

[0024] Figure 1F shows the scheme output for the ECIES scheme;

[0025] Figure 2 A flow chart showing a communication process according to some example embodiments of the present disclosure;

[0026] Figure 3 Schematically illustrates the newly defined SUCI type according to some embodiments of the present disclosure;

[0027] Figure 4 An example schematic diagram of PQC key encapsulation for encrypting SUPI in a UE according to some example embodiments of the present disclosure is shown;

[0028] Figure 5 An example schematic diagram showing decapsulation of a PQC key for decrypting a SUPI in a network side (SIDF) according to some example embodiments of the present disclosure;

[0029] Figure 6 A flowchart showing an example method implemented at a terminal device according to some embodiments of the present disclosure is shown;

[0030] Figure 7 Another flow chart illustrating an example method implemented at a network device according to some embodiments of the present disclosure;

[0031] Figure 8 shows a simplified block diagram of a device suitable for implementing some example embodiments of the present disclosure; and

[0032] Fig. 9 A block diagram illustrating an example of a computer readable medium according to some example embodiments of the present disclosure is shown.

[0033] Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. DETAILED DESCRIPTION

[0034] The principle of the present disclosure will now be described with reference to some example embodiments. It should be understood that these embodiments are described only for illustrative purposes and help those skilled in the art to understand and implement the present disclosure without placing any limitation on the scope of the present disclosure. The disclosure described herein can be implemented in various ways except as described below.

[0035] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0036] References in this disclosure to "one embodiment," "an embodiment," and "an example embodiment" indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment must include the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered that such feature, structure, or characteristic may be implemented in other embodiments within the knowledge of those skilled in the art, whether or not explicitly described.

[0037] It should be understood that although the terms "first", "second", etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, a first element may be named a second element, and similarly, a second element may be named a first element without departing from the scope of the exemplary embodiments. As used herein, the term "and / or" includes any and all combinations of one or more of the listed items.

[0038] The terms used herein are only for the purpose of describing specific embodiments and are not intended to limit exemplary embodiments. As used herein, the singular forms of "one", "an" and "the" also include plural forms unless the context clearly indicates. It should also be understood that when the terms "comprises / comprising", "has / having" and / or "includes / including" are used herein, the existence of the features, elements and / or parts, etc. is specified, but the existence or addition of one or more other features, elements, parts and / or their combinations is not excluded. As used herein, "at least one of the following: <list of two or more elements>" and "at least one of <list of two or more elements>" and similar wording (wherein the list of two or more elements is connected by "and" or "or") represent at least any one element in the element, or at least any two or more elements in the element, or at least all elements.

[0039] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0040] (a) hardware circuit implementation only (such as implementation in analog and / or digital circuits only) and

[0041] (b) a combination of hardware circuitry and software such as (where applicable):

[0042] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0043] (ii) any portion of a hardware processor with software (including a digital signal processor), software and memory that work together to enable a device such as a mobile phone or server to perform various functions), and

[0044] (c) Hardware circuits and / or processors, such as a microprocessor or portion of a microprocessor, that require software (e.g., firmware) to operate, but where the software may not be present when the software is not required for operation.

[0045] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers a specific implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers (for example, if applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0046] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as Long Term Evolution (LTE), Advanced LTE (LTE-A), Wideband Code Division Multiple Access (WCDMA), High Speed ​​Packet Access (HSPA), Narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal equipment and the network equipment in the communication network can be performed according to any suitable generation of communication protocol, including but not limited to the fourth generation (4G), 4.5G, fifth generation (5G) communication protocol, sixth generation (6G) communication protocol and / or any other protocol currently known or developed in the future. The embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communication, there will certainly be future types of communication technologies and systems that can embody the present disclosure. It should not be regarded as limiting the scope of the present disclosure to the above-mentioned systems.

[0047] As used herein, the term "access network device" refers to a node in a communication network, via which a terminal device accesses the network and receives services therefrom. Depending on the terminology and technology applied, a network device may refer to a base station (BS) or an access point (AP), such as a NodeB (NodeB or NB), an evolved NodeB (eNodeB or eNB), a NR NB (also known as a gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a repeater, a low-power node such as a femto, a pico, etc. In the following description, the terms "access network device" and "access network node" may be used interchangeably.

[0048] The term "core network equipment" or "CN equipment" refers to equipment that can communicate with access network equipment and provide services to terminal equipment in the core network. Examples of core network equipment may include mobile switching centers (MSCs), mobility management entities (MMEs), access and mobility management functions (AMFs), operations and management (O&M) nodes, operations support system (OSS) nodes, self-organizing network (SON) nodes, and positioning nodes, such as enhanced serving mobile location centers (E-SMLCs). In other embodiments, the core network equipment may be any other suitable application or entity in the core network.

[0049] The term "terminal device" refers to any terminal device that can perform wireless communication. As an example and not limitation, the terminal device may also be referred to as a communication device, user equipment (UE), user station (SS), portable user station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device such as a digital camera, a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop embedded device (LEE), a laptop computer installation device (LME), a USB dongle, a smart device, a wireless customer premises equipment (CPE), an Internet of Things (IoT) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in industrial and / or automated processing chain environments), consumer electronic devices, , equipment running on commercial and / or industrial wireless networks, etc. In the following description, the terms “terminal device”, “communication device”, “terminal”, “user equipment” and “UE” may be used interchangeably.

[0050] First reference Figure 1A, which shows an example of a communication system in which some example embodiments of the present disclosure may be implemented. Figure 1A In an example scenario, there is a cellular communication system including a first user equipment UE 110 and a second user equipment UE 112, one or more base stations BS 120 and a core network element 130. The first UE 110 is connected to the BS 120 via an air interface 115. The BS 120 may be connected to the core network 130 directly or via at least one intermediate node via an interface 125. The core network 130 may in turn be connected to another network ( Figure 1A The core network 130 may be coupled to another network (not shown) through which a connection to other networks may be obtained, for example via a global interconnection network. In the case of 4G, the core network 130 may be referred to as an evolved packet core (EPC), and in the case of 5G, the core network 130 may be referred to as a 5G core (5GC). In any case, the embodiments of the present disclosure are not limited to any particular cellular communication technology.

[0051] The core network 130 may include more than one public land mobile network PLMN, each PLMN is equipped with at least one network function (NF). NF may refer to an operation and / or physical entity. NF may be a specific network node or element, or a specific function or a set of functions performed by one or more entities (such as virtual NF). At least some example embodiments of the present disclosure may also be applied to containerized or partitioned deployments. A physical node may be configured to perform the tasks of multiple NFs.

[0052] exist Figure 1A In the example, the first UE 110 or a subscription module hosted by the first UE 110 may be a legitimate user and the second UE 112 may be an attacker. For example, as an attacker, the second UE 112 may steal the identifier of the first UE 110 to perform communication, which is undesirable. In the GSM / UMTS / EPS system, a unique International Mobile Subscriber Identity (IMSI) should be assigned to each mobile user.

[0053] The Subscription Permanent Identifier (SUPI) is a globally unique 5G subscription permanent identifier assigned to each user in the 5G system. The SUCI is a privacy-preserving identifier that contains a hidden SUPI. Traditionally, the hiding of the SUPI is based on the Elliptic Curve Integrated Encryption Scheme (ECIES). The use of ECIES to hide the SUPI should comply with the standards of the Efficient Cryptographic Group (SECG) specification. The processing on the UE side and the home network side will be described in detail later.

[0054] When the SUPI is of IMSI type, the subscription identifier portion of the IMSI (i.e., the Mobile Subscriber Identification Number (MSIN)) used to construct the scheme input shall be encoded as hexadecimal numbers using packed BCD encoding, where the order of the digits within the octet is the same as the MSIN digit order specified in the Figures of TS 24.501. If the MSIN consists of an odd number of digits, then bits 5 to 8 of the last octet shall be encoded as "1111". When the SUPI is of Network Specific Identifier type, the subscription identifier portion of the SUPI used to construct the scheme input shall follow the encoding rules specified in Annex B.2.1.2 of TS 33.220.

[0055] Figure 1B The encryption steps at the UE end according to the ECIES scheme are shown. The ECIES scheme should be implemented so as to calculate the new SUCI, and the UE should use the preset home network public key and the newly generated ECC (Elliptic Curve Cryptography) temporary public / private key pair according to the ECIES parameters provided by the home network. The processing on the UE end should be performed according to the encryption operation, which includes: generating key data K of length enckeylen+icblen+mackeylen; parsing the leftmost enckeylen octets of K as the encryption key EK, parsing the middle icblen octets of K as ICB, and parsing the rightmost mackeylen octets of K as the MAC key MK. The final output of the ECIES hiding scheme should be the concatenation of the ECC temporary public key, the ciphertext value, the MAC tag value, and any other parameters (if applicable). It should be noted that the reason for mentioning "any other parameters, if applicable" in the final output is to allow situations where, for example, the sender is able to send additional sign indications when point compression is used.

[0056] Figure 1C The encryption steps at the home network end, specifically, at the NF in the core network, such as the subscription identifier de-hiding function (SIDF), according to the ECIES scheme are shown. The ECIES scheme should be implemented so that in order to de-hide the SUCI, the home network should use the received ECC temporary public key of the UE and the home network private key for the UE. The processing on the home network end should be performed according to the decryption operation, which includes: generating key data K of length enckeylen+icblen+mackeylen; parsing the leftmost enckeylen octets of K as encryption key EK, parsing the middle icblen octets of K as ICB, and parsing the rightmost mackeylen octets of K as MAC key MK. It should be noted that, unlike the UE, the home network does not need to perform a new temporary key pair generation for each decryption. How often the home network generates a new public / private key pair and how to provide the public key to the UE is not within the scope of the present disclosure.

[0057] As mentioned above, SUPI is a globally unique 5G subscription permanent identifier assigned to each user in the 5G system. SUPI is defined in 3GPP TS23.501 clause 5.9.2. Figure 1D As shown, SUPI is defined to include "SUPI type" and "IMSI / NSI / GLI / GCI". "SUPItype" may indicate an IMSI, a network specific identifier (NSI), a global line identifier (GLI), or a global cable identifier (GCI). Depending on the value of "SUPI type", "IMSI / NSI / GLI / GCI" may be an IMSI as defined in TS23.003 clause 2.1, an NSI in the form of a network access identifier (NAI) as defined in TS23.003 clause 28.7.2, a GCI in the form of an NAI as defined in TS23.03 clause 28.15.2, or a GLI in the form of an NAI as defined in TS23.003 clause 28.16.2.

[0058] As also mentioned above, SUCI is a privacy-preserving identifier that contains a hidden SUPI. SUCI is defined in 3GPP TS 33.501, clause 6.12.2. Note that the SUPI type may take different formats depending on the protocol used to communicate the SUPI.

[0059] like Figure 1E As shown, according to the specification, SUCI consists of the following parts. The first part is the SUPI type, which consists of values ​​in the range of 0 to 7. It identifies the type of SUPI hidden in the SUCI. The following values ​​are defined: IMSI is 0, NSI is 1, GLI is 2, GCI is 3, and 4 to 7 are spare values ​​for future use.

[0060] The second part is the Home Network Identifier that identifies the user's home network. When the SUPI Type is IMSI, the Home Network Identifier consists of two parts: the Mobile Country Code (MCC) consisting of three decimal digits; and the Mobile Network Code (MNC) consisting of two or three decimal digits. The MCC uniquely identifies the country of registration for the mobile subscription. The MNC identifies the home PLMN or SNPN of the mobile subscription. When the SUPI Type is Network Specific Identifier (NSI), GLI or GCI, the Home Network Identifier consists of a string with variable length representing a domain name as specified in IETF RFC 7542 Section 2.2. For GLI or GCI, the domain name should correspond to the domain part specified in the NAI format for SUPI in Sections 28.15.2 and 28.16.2.

[0061] The third part is the routing indicator, which consists of a 1 to 4 decimal number assigned by the home network operator and provided in the USIM, which allows the network signaling with SUCI to be routed to the AUSF and UDM instances that can serve the user together with the home network identifier. Each decimal number in the routing indicator should be considered meaningful (for example, the value "012" is different from the value "12"). If the routing indicator is not configured on the USIM, this data field should be set to the value 0 (i.e., consisting of only a decimal number "0").

[0062] The fourth part is the protection scheme identifier, whose value is in the range of 0 to 15 (see Annex C.1 of 3GPP TS 33.501). It indicates the null scheme or non-null scheme specified in Annex C of 3GPP TS 33.501, or the protection scheme specified by the HPLMN; if the SUPI type is GLI or GCI, the null scheme should be used.

[0063] The fifth part is the Home Network Public Key Identifier consisting of a value in the range of 0 to 255. It represents the public key provided by the HPLMN or SNPN and is used to identify the key used for SUPI protection. This data field shall be set to the value 0 if and only if the Null Protection Scheme is used.

[0064] The sixth part is a scheme output consisting of a string of 1 or 1 hexadecimal digits with variable length, depending on the protection scheme used. It represents the output of the public key protection scheme specified in Annex C of 3GPP TS 33.501 or the output of the protection scheme specified by the HPLMN.

[0065] According to the specification, the format of the scheme output is variable length characters as specified for Username in IETF RFC 7542 section 2.2. Note that if the null protection scheme is used, the NF may derive the SUPI from the SUCI if needed. When the Routing Indicator is zero and the protection scheme is null, the AMF derives the SUPI for AUSF discovery from the SUCI. For anonymous SUCI, the NF may derive the anonymous SUPI from the anonymous SUCI if needed; that is, the NF may derive the SUPI in NAI format where the "Username" part of the SUPI is "anonymous" or omitted.

[0066] Figure 1F The scheme output of the Elliptic Curve Integrated Encryption Scheme (ECIES) Profile A is shown. The figures of TS23.003 may refer to the scheme output of other profiles, such as the Elliptic Curve Integrated Encryption Scheme Profile B. The challenge in the ECIES scheme is that a cryptographically correlated quantum computer (CRQC) can break the elliptic curve algorithm used in the conventional SUCI encryption scheme (i.e., ECIES).

[0067] In particular, quantum computers pose a threat to using only the Home Network (HN) public key, and using Shor's algorithm, one can easily get the SUPI from the SUCI. This occurs because the CRQC using Shor's algorithm can break the elliptic curve algorithm used in the conventional SUCI encryption scheme. Therefore, the CRQC poses a threat to an attacker who can easily get the SUPI from the SUCI using only the Home Network's public key and Shor's algorithm. This will therefore make the encryption scheme vulnerable because the whole concept is based on someone not being able to crack the HN private key from the HN public key. Unfortunately, the CRQC using Shor's algorithm can break the elliptic curve algorithm in use. Therefore, a solution is needed for this PQC migration for SUCI. Some embodiments of the present disclosure are applicable after the transition from a hybrid encryption scheme to using only the PQC KEM.

[0068] As can be seen, the conventional SUCI encryption mechanism uses elliptic curves based on the discrete logarithm problem, which makes it vulnerable to attacks. In this attack, the adversary can collect your HN public key, and using CRQC (cryptographically correlated quantum computer) can gain access to the HN private key. If the adversary gains access to the HN private key, the SUCI encryption can be directly cracked to obtain SUPI.

[0069] In view of the above discussion and analysis, some embodiments of the present disclosure provide a solution with a network-supported PQC migration option and a new SUCI type defined. At the UE end, the PQC KEM public key of the HN is used for a key encapsulation mechanism to generate a ciphertext and a shared secret. The shared secret is used as an input to a key derivation function (KDF) to generate an encryption key, thereby generating a ciphertext of the SUPI and MAC values. At the SIDF end, the received PQC KEM ciphertext (contained in the received SUCI) is used together with the PQC KEM key of the HN (stored in the SIDF itself) to decapsulate and generate a shared secret, which is then used as an input to the KDF to generate a decryption key to decrypt the ciphertext (contained in the received SUCI) and verify the MAC (contained in the received SUMI).

[0070] According to some embodiments of the present disclosure, the new fully post-quantum based SUCI ensures that different types of attacks are avoided, such as Shor's algorithm attack on asymmetric cryptographic methods based on prime factorization or discrete logarithm problems (finite fields or elliptic curves). It should be noted that some embodiments of the present disclosure have removed the traditional UE temporary key generation and use to generate temporary shared secrets in UE and SIDF. During migration, the new SUCI type or the old SUCI type will help. The SUCI type is readable by any NF (such as UDM). Therefore, it is de-hidden via ARPF application.

[0071] Figure 2 2 shows a flow chart of a communication process 200 according to some example embodiments of the present disclosure. For the purpose of discussion, reference will be made to Figures 1A to 1F Describe the communication process 200. It should be understood that although reference has been made to Figure 1A The communication process 200 is described with reference to the network environment 100, but the communication process 200 can also be applied to other similar communication scenarios.

[0072] like Figure 2 As shown, the terminal device 110 generates 202 a subscription hidden identifier (SUCI) of the terminal device 110 based on a subscription permanent identifier (SUPI) of the terminal device 110 and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM). In this document, the public key may also be referred to as a "PQC KEM public key". The terminal device 110 then sends 204 the SUCI 205 to the network device 130, for example for registration. For example, the network device 130 may be or include a NF in the core network, such as a subscription identifier de-hiding function (SIDF). In some embodiments, the network device 130 may reside at a unified data management (UDM) network function or an authentication server function, an AUSF, or any other future network function in the core network.

[0073] Accordingly, the network device 130 receives 206 the SUCI 205 of the terminal device 110 and obtains 208 the SUPI of the terminal device 110 based on the received SUCI 205 of the terminal device 110 and a private key of the home network of the terminal device 110, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0074] As described above, in order to solve the attack problem in the ECIES-based SUCI solution, some embodiments of the present disclosure provide a solution with a network-supported PQC migration option and define a new SUCI type. Figure 3The newly defined SUCI type according to some embodiments of the present disclosure is schematically illustrated. The new SUCI includes a "Home Network Public Key Identifier (PQC KEM)", whose value is in the range of 0 to 255, indicating a public key provided by the HPLMN or SNPN, and is used to identify keys used for SUPI protection in addition to traditional HN public keys. An example of a PQC KEM public key is Kyber (selected by the NIST standard). There are several other key encapsulation methods, such as BIKE, HQC, and classic McEliece. The new SUCI also includes a "scheme output" consisting of a string with variable length or hexadecimal digits, depending on the protection scheme used (PQC KEM, as described below). "Scheme output" represents the output of the public key protection scheme. As Figure 3 As shown, the “Ciphertext Value” in the “Scheme Output” is the PQC-KEM ciphertext, which means that the post-quantum cryptography key encapsulation mechanism uses the PQC-KEM public key of the home network to generate the ciphertext.

[0075] and Figure 1E and Figure 1F Compared with the SUCI shown in Figure 3 The newly defined SUCI types in the Schema have been changed in the circled sections. In particular, the ECIES-based sections "Home Network Public Key ID" and "Scheme Output" have been changed to be based on PQC KEM. Figure 3 As shown, the three parts A, B and C included in the “scheme output” are “PQC KEM ciphertext”, “ciphertext value” and “MAC tag value”, respectively, where the “ciphertext value” is formed by the hidden SUPI. According to some embodiments of the present disclosure, the hidden SUPI is generated using PQC-KEM.

[0076] The generation of the three parts A, B and C contained in the "Scheme Output" will be described in detail below. Figure 2 In some embodiments, the terminal device 110 may receive the public key from the network device 130 in advance. Alternatively, the terminal device 110 may receive the public key from another network device in advance. Alternatively, the public key may be configured in the terminal device itself, for example, the public key has been written into the SIM card of the terminal device 110 by the mobile operator. It should be understood that the terminal device 110 may use any other method to obtain the public key, and the scope of the present disclosure is not limited in this respect. Using the public key of the home network of the terminal device 110, the terminal device 110 may generate the SUCI.

[0077] In some embodiments, the terminal device 110 may generate a SUCI based on a public key by the following steps. First, the terminal device 110 may generate a first ciphertext and a first shared secret based on the public key. Second, the terminal device 110 may derive an encryption key using a key derivation function (KDF) based on the generated first shared secret. Then, the terminal device 110 may generate a ciphertext value and a message authentication code tag (MAC tag) value based on the derived encryption key and the SUPI of the terminal device 110. Then, the terminal device 110 may generate a SUCI based on the generated first ciphertext, the generated ciphertext value, and the generated MAC tag value. In some embodiments, the first ciphertext is a PQC-KEM ciphertext, and the first shared secret is a PQC-KEM shared secret.

[0078] In some embodiments, the scheme output field in the SUCI may include the first ciphertext, the ciphertext value, and the MAC tag value. Figure 3 , the terminal device 110 may regard the generated PQC KEM ciphertext as the circled part, the generated ciphertext value as the circled part B, and the generated MAC tag value as the circled part B. Part A, Part B, and Part C are included in the "Scheme Output" of SUCI.

[0079] In some embodiments, the Home Network Public Key ID field in the SUCI may be used to identify the public key. Figure 3 , the Home Network Public Key ID field in the SUCI may be used to identify the PQC KEM public key associated with the PQC KEM private key. The PQCKEM public key and the PQC KEP private key are collectively referred to as a PQC KEN key pair. Each UE is associated with a pre-generated PQC KEM key pair. The generation of the PQC-KEM key pair is typically performed by the network side, such as by the network device 130. The public key is used by the terminal device 110, and the private key is used by the network device 130. In the case where the PQC KEM key pair is generated by the network device 130, the network device 130 provides it to the terminal device 110 in advance. Using the provided PQC KEM public key, the UE may encrypt the SUPI, and using the PQC KEM private key, the network device 130 may decrypt the received SUCI to obtain the SUPI of the terminal device 110, such as to authenticate the terminal device 110.

[0080] Regarding the generation of the PQC KEM key pair, it can be performed in advance by any other device. As described above, the terminal device 110 can receive the public key from the network end, or the public key can be configured in the terminal device.

[0081] In some embodiments, the terminal device 110 may use an authenticated encryption with associated data (AEAD) algorithm to generate a ciphertext value and a MAC tag value. For example, the derived encryption key and the plaintext of the SUPI may be input into the AEAD algorithm to generate a ciphertext value and a MAC tag value. In some embodiments, the AEAD algorithm used by the terminal device 110 may include implementing the Fujisaki-Okamoto (FO) transform or its variant HHK (Hofheinz, Kiltz) transform.

[0082] On the other hand, the network device 130 receives 206 the SUCI. In some embodiments, the network device 130 may obtain 208 the SUPI from the received SUCI by the following steps. First, the network device 130 may extract a first ciphertext, a ciphertext value, and a MAC tag value from the received SUCI. In some embodiments, the first ciphertext is a PQC-KEM ciphertext. As described above, the scheme output field in the received SUCI may include the PQC KEM ciphertext, the ciphertext value, and the MAC tag value (corresponding to the reference ciphertext, respectively). Figure 3 That is, Part A, Part B, and Part C are included in the "scheme output" of the received SUCI. The network device 130 can extract the circled Part A as the PQC-KEM ciphertext, the circled Part B as the generated ciphertext value, and the circled Part C as the generated MAC tag value.

[0083] Second, the network device 130 may generate a first shared secret based on the extracted first ciphertext and the private key. In some embodiments, the first shared secret is a PQC-KEM shared secret. Here, according to the home network public key ID field in the received SUCI (the field identifies the public key of the home network of the terminal device 110 associated with the private key), the network device 130 determines the private key corresponding to the terminal device 110, thereby performing the generation of the PQC-KEM shared secret. Then, the network device 130 may derive a decryption key using a key derivation function (KDF) based on the generated PQC-KEM shared secret. Then, the network device 130 may verify the extracted MAC tag value based on the derived decryption key and decrypt the extracted ciphertext value.

[0084] In some embodiments, the network device 130 may use (such as the terminal device 110) an AEAD algorithm to verify the extracted MAC tag value and decrypt the extracted ciphertext value. In some embodiments, the network device 130 may verify the extracted MAC tag value and decrypt the extracted ciphertext value through the following steps. First, the network device 130 may input the derived encryption key and the extracted MAC tag value into the AEAD algorithm to verify the extracted MAC tag. Then, in response to the verification being passed, the network device 130 may input the derived encryption key and the extracted ciphertext value into the AEAD algorithm to decrypt the extracted ciphertext value.

[0085] In this way, the terminal device 110 generates SUCI based on the PQC KEM. According to some embodiments of the present disclosure, the new fully post-quantum-based SUCI ensures the avoidance of different types of attacks, such as Shor's algorithm attack on asymmetric cryptographic methods based on prime number factorization or discrete logarithm problems (finite fields or elliptic curves).

[0086] In view of the above, the solutions provided by some embodiments of the present disclosure have many advantages, for example, DoS attacks on legitimate UEs can be resolved. In addition, replay attacks can be avoided. In addition, existing mechanisms are reused to a large extent, which can be more easily accepted in the development of related technologies.

[0087] Figure 4 An example schematic diagram of PQC key encapsulation for encrypting SUPI in a UE according to some example embodiments of the present disclosure is shown. Figure 4 As shown, at 401, the network generates a PQC KEM key pair for the UE. As described above, regarding the generation of the PQC KEM key pair, it can be performed by any network device. The UE obtains 402 the PQC KEM public key of HN (pk) 403 as the public key of the PQC KEM key pair. In some examples, the PQC KEM public key of HN (pk) 403 can be Kyber's. The UE can receive the PQC KEM public key of HN (pk) 403 from the network. Alternatively, the PQC KEM public key 403 of HN (pk) 403 can be pre-configured in the terminal device.

[0088] At 404, the UE generates a PQC shared secret (ss) 406 and a PQCKEM ciphertext (ct) 405 based on the PQC KEM public key 403 of HN (pk) 403. The PQC KEM ciphertext (ct) 405 is considered Figure 3Part A shown. At 407, based on the PQC shared secret (ss) 406, the UE uses a key derivation function (KDF) to derive an encryption key 408. At 409, the UE uses an AEAD algorithm to generate a ciphertext value 411 and a MAC tag value 412 based on the derived encryption key 408 and the plaintext block (SUPI) 410 of the terminal device. The ciphertext value 411 is regarded as Figure 3 Part B shown. The MAC tag value 412 is considered Figure 3 Part C shown.

[0089] In view of the above situation, Figure 4 In FIG. 4 , at the UE end, the PQC KEM public key (pk) 403 of the home network is used in a key encapsulation mechanism (asymmetric cryptographic scheme) to generate a PQC KEM ciphertext (ct) 405 and a PQC shared secret (ss) 406. A key derivation function is used to derive an encryption key 408. The encryption key 408 is fed into the AEAD algorithm along with the plaintext (SUPI) 410 to generate a ciphertext value 411 and a MAC tag value 412. The final output contains the PQC KEM ciphertext (ct) 405 concatenated with the ciphertext value 411 (ciphertext of SUPI) and the MAC tag value 412 (MAC value in SUPI).

[0090] In this PQC-based mode, it is necessary to apply the Fujisaki-Okamoto (FO) transform or its variant (HKK) on the PQC KEM part to ensure that the overall scheme is IND-CCA2 secure. The FO transform is performed using a KDF so that the implemented PQCKEM shared secret is IND-CCA2 secure. In this case, in the absence of temporary keys, the PQC KEM keys can be reused according to a certain upper limit level of the number of times the public PQC KEM public key can be reused (but it is not recommended). The upper limit level will be defined based on the number of times the PQC KEM public key can be used, and the exact number does not need to be specified in this disclosure.

[0091] In this way, the UE generates SUCI based on the PQC KEM. According to some embodiments of the present disclosure, the new fully post-quantum based SUCI ensures the avoidance of different types of attacks, such as Shor's algorithm attack on asymmetric cryptographic methods based on prime number factorization or discrete logarithm problems (finite fields or elliptic curves).

[0092] Figure 5 FIG. 2 shows an example schematic diagram of decapsulating the PQC key for decrypting SUPI in the network (SIDF) according to some example embodiments of the present disclosure. Figure 5As shown, at 501, the network generates a PQC KEM key pair for the UE. As described above, regarding the generation of the PQC KEM key pair, it can be performed by any network device. The SIDF obtains 502 the PQC KEM key of HN (sk) 503 as the private key of the PQC KEM key pair. The PQC KEM key of HN (sk) 503 can also be referred to as the key of (HN).

[0093] At 504, the SIDF generates a PQC shared secret (ss) 506 based on the PQC KEM ciphertext (ct) 505 included in the SUCI received from the UE. The PQC KEM ciphertext (ct) 505 is Figure 3 Part A shown. SIDF extracts PQCKEM ciphertext from the received SUCI and then performs generation of PQC shared secret (ss) 506. At 507, based on the PQC shared secret (ss) 506, the UE derives an encryption key 508 using a key derivation function (KDF).

[0094] At 509, SIDF receives the received SUCI ( Figure 3 The ciphertext value 510 included in Part B shown in FIG. 1 is used to verify the received SUMI ( Figure 3 In response to the verification, at 512, SIDF uses the AEAD algorithm to extract the ciphertext value 510 ( Figure 3 510. The AEAD algorithm is used to decrypt the MAC tag value 511.

[0095] In view of the above situation, Figure 5 At the SIDF end, the received PQC KEM ciphertext (ct) 505 and the PQC KEM key (sk) 503 of the home network are used as input parameters to the key encapsulation mechanism (KEM) to decapsulate and generate the PQC shared secret (ss) 506. The PQC shared secret (ss) 506 is also used as an input parameter to the key derivation function to generate the decryption key 508. The decryption key 508 is fed into the AEAD algorithm to decrypt the SUCI to SUPI. In addition, the AEAD algorithm is used to verify the MAC value. It should be noted that the SIDF can use the home network public key id (PQC KEM ID) to identify the PQC KEM key of the HN for the decapsulation mechanism.

[0096] In this way, the new fully post-quantum based SUCI ensures the avoidance of different types of attacks, such as Shor’s algorithm on asymmetric cryptographic methods based on prime number factorization or the discrete logarithm problem (finite fields or elliptic curves).

[0097] Figure 6 FIG. 6 is a flowchart of an example method 600 implemented at a terminal device (eg, terminal device 110) according to some embodiments of the present disclosure. For discussion purposes, reference will be made to Figure 1A and Figure 2 The method 600 is described from the perspective of the terminal device 110 .

[0098] At block 610, the terminal device generates a subscription hidden identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM). At block 620, the terminal device sends the SUCI to a network device.

[0099] In some embodiments, in order to generate SUCI, the terminal device may receive a public key from the network device or from another network device, or obtain a public key configured in the terminal device itself. The terminal device may then generate SUCI based on the received public key.

[0100] In some embodiments, in order to generate the SUCI based on the public key, the terminal device may generate a first ciphertext and a first shared secret based on the public key. Then, the terminal device may derive an encryption key based on the generated first shared secret using a key derivation function (KDF). Then, the terminal device may generate a ciphertext value and a message authentication code tag (MAC tag) value based on the derived encryption key and the SUPI of the terminal device. Then, the terminal device may generate the SUCI based on the generated first ciphertext, the generated ciphertext value, and the generated MAC tag value.

[0101] In some embodiments, the terminal device may use an authenticated encryption with associated data (AEAD) algorithm to generate the ciphertext value and the MAC tag value. In some embodiments, to generate the ciphertext value and the MAC tag value, the terminal device may input the derived encryption key and the plaintext of the SUPI into the AEAD algorithm to generate the ciphertext value and the MAC tag value.

[0102] In some embodiments, the Home Network Public Key ID field in the SUCI may be used to identify the public key. In some embodiments, the Scheme Output field in the SUCI may include a first ciphertext, a ciphertext value, and a MAC tag value, and the first ciphertext, the ciphertext value, and the MAC tag value are generated by the terminal device based on the public key. In some embodiments, the first ciphertext may be a PQC-KEM ciphertext, and the first shared secret may be a PQC KEM shared secret. In some embodiments, the KDF may include a function that implements the properties of a Fujisaki-Okamoto (FO) transform or a HHK transform.

[0103] Figure 7 Another flow chart of an example method 700 implemented at a network device (e.g., network device 130) according to some other embodiments of the present disclosure is shown. For discussion purposes, reference will be made to Figure 1A and Figure 2 The method 700 is described from the perspective of the access network device 130 .

[0104] At block 710, the network device receives a subscription hidden identifier (SUCI) of the terminal device. At block 720, the network device obtains a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0105] In some embodiments, the network device may also generate a PQC-KEM pair for the terminal device, and send a public key of the generated PQC-KEM pair to the terminal device, the public key of the generated PQC KEM pair being associated with the private key. In some embodiments, in order to obtain the SUPI, the network device may extract a first ciphertext, a ciphertext value, and a message authentication code tag (MAC tag) value from the SUCI. The network device may then generate a first shared secret based on the extracted first ciphertext and the private key. The network device may then derive a decryption key using a key derivation function (KDF) based on the generated first shared secret. The network device may then verify the extracted MAC tag value based on the derived decryption key and decrypt the extracted ciphertext value.

[0106] In some embodiments, the network device may use an authenticated encryption with associated data (AEAD) algorithm to verify the extracted MAC tag value and decrypt the extracted ciphertext value. In some embodiments, to verify the extracted MAC tag value and decrypt the extracted ciphertext value, the network device may input the derived encryption key and the extracted MAC tag value into the AEAD algorithm to verify the extracted MAC tag. In response to the verification passing, the network device may input the derived encryption key and the extracted ciphertext value into the AEAD algorithm to decrypt the extracted ciphertext value.

[0107] In some embodiments, the Home Network Public Key ID field in the received SUCI may identify the public key of the home network of the terminal device associated with the private key. In some embodiments, the first ciphertext, ciphertext value, and message authentication code tag (MAC tag) value may be extracted from the Scheme Output field in the received SUCI. In some embodiments, the first ciphertext may be a PQC-KEM ciphertext and the first shared secret may be a PQC KEM shared secret. In some embodiments, the KDF may include a function that implements properties of a Fujisaki-Okamoto (FO) transform or a HHK transform.

[0108] In some embodiments, the network device may reside at a unified data management (UDM) network function or an authentication server function, AUSF, or any other future network function in the core network.

[0109] In some embodiments, an apparatus capable of executing method 600 (eg, terminal device 110) may include components for executing corresponding steps of method 600. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit or a software module.

[0110] In some example embodiments, the apparatus includes: a component for generating, at a terminal device, a subscription concealed identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM); and a component for sending the SUCI to a network device.

[0111] In some embodiments, the component for generating the SUCI may include: a component for receiving a public key from the network device or from another network device, or a component for obtaining a public key configured in the terminal device itself; and a component for generating the SUCI based on the received public key.

[0112] In some embodiments, the component for generating the SUCI may include: a component for generating a first ciphertext and a first shared secret based on a public key; a component for deriving an encryption key using a key derivation function (KDF) based on the generated first shared secret; a component for generating a ciphertext value and a message authentication code tag (MAC tag) value based on the derived encryption key and the SUPI of the terminal device; and a component for generating the SUCI based on the generated first ciphertext, the generated ciphertext value, and the generated MAC tag value.

[0113] In some embodiments, the ciphertext value and the MAC tag value may be generated using an authenticated encryption with associated data (AEAD) algorithm.

[0114] In some embodiments, the ciphertext value and the MAC tag value may be generated by inputting the derived encryption key and the plaintext of the SUPI into an AEAD algorithm to generate the ciphertext value and the MAC tag value.

[0115] In some embodiments, the Home Network Public Key ID field in the SUCI may be used to identify the public key.

[0116] In some embodiments, the scheme output field in the SUCI may include a first ciphertext, a ciphertext value, and a MAC tag value, and the first ciphertext, the ciphertext value, and the MAC tag value are generated by the terminal device based on the public key.

[0117] In some embodiments, the first ciphertext may be a PQC-KEM ciphertext and the first shared secret may be a PQC-KEM shared secret.

[0118] In some embodiments, the KDF may include a function that implements the properties of the Fujisaki-Okamoto (FO) transform or the HHK transform.

[0119] In some embodiments, the apparatus further comprises components for performing other steps in some embodiments of method 600. In some embodiments, the components comprise at least one processor and at least one memory comprising computer program code, the at least one memory and the computer program code being configured to implement the performance of the apparatus together with the at least one processor.

[0120] In some embodiments, an apparatus capable of performing method 700 (eg, network device 130) may include components for performing the corresponding steps of method 700. The components may be implemented in any suitable form. For example, the components may be implemented in a circuit or a software module.

[0121] In some example embodiments, the apparatus includes: a component for receiving, at a network device, a subscription hidden identifier (SUCI) of a terminal device; and a component for obtaining a subscription permanent identifier (SUPI) of the terminal device based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography (PQC) key encapsulation mechanism (KEM).

[0122] In some embodiments, the apparatus may further include: a component for generating a PQC-KEM pair for a terminal device, and a component for sending a public key of the generated PQC-KEM pair to the terminal device, wherein the public key of the generated PQC-KEM pair is associated with a private key.

[0123] In some embodiments, the component for obtaining the SUPI may include: a component for extracting a first ciphertext, a ciphertext value, and a message authentication code tag (MAC tag) value from the SUCI; a component for generating a first shared secret based on the extracted first ciphertext and a private key; a component for deriving a decryption key using a key derivation function (KDF) based on the generated first shared secret; and a component for verifying the extracted MAC tag value based on the derived decryption key and decrypting the extracted ciphertext value.

[0124] In some embodiments, an authenticated encryption with associated data (AEAD) algorithm may be used to verify the extracted MAC tag value and decrypt the extracted ciphertext value.

[0125] In some embodiments, the extracted MAC tag value can be verified and the extracted ciphertext value can be decrypted in the following manner: the derived encryption key and the extracted MAC tag value are input into the AEAD algorithm to verify the extracted MAC tag; and in response to the verification being successful, the derived encryption key and the extracted ciphertext value are input into the AEAD algorithm to decrypt the extracted ciphertext value.

[0126] In some embodiments, the Home Network Public Key ID field in the received SUCI may identify the public key of the home network of the terminal device associated with the private key.

[0127] In some embodiments, the first ciphertext, ciphertext value, and message authentication code tag (MAC tag) value may be extracted from the Scheme Output field in the received SUCI.

[0128] In some embodiments, the first ciphertext may be a PQC-KEM ciphertext and the first shared secret may be a PQC-KEM shared secret.

[0129] In some embodiments, the KDF may include a function that implements the properties of the Fujisaki-Okamoto (FO) transform or the HHK transform.

[0130] In some embodiments, the apparatus further comprises components for performing other steps in some embodiments of method 700. In some embodiments, the components comprise at least one processor and at least one memory comprising computer program code, the at least one memory and the computer program code being configured to implement the performance of the apparatus together with the at least one processor.

[0131] Figure 8 800 is a simplified block diagram of a device suitable for implementing some example embodiments of the present disclosure. The device 800 may be provided to implement a communication device, such as Figure 1A and Figure 2The terminal device 110 and the network device 130 are shown. As shown in the figure, the device 800 includes one or more processors 810, one or more memories 820 coupled to the processors 810, and one or more communication modules 840 coupled to the processors 810.

[0132] The communication module 840 is used for two-way communication. The communication module 840 has at least one antenna to facilitate communication. The communication interface may represent any interface required to communicate with other network elements.

[0133] Processor 810 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 800 may have multiple processors, such as application specific integrated circuit chips that are time slaved to a clock synchronized with a main processor.

[0134] The memory 820 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 824, electrically programmable read-only memory (EPROM), flash memory, hard disks, compact disks (CDs), digital video disks (DVDs), and other magnetic storage devices and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 822 and other volatile memories that do not persist over the duration of a power outage.

[0135] The computer program 830 includes computer executable instructions that are executed by the associated processor 810. The program 830 may be stored in the ROM 824. The processor 810 may perform any suitable actions and processes by loading the program 830 into the RAM 822.

[0136] The embodiments of the present disclosure may be implemented by a program 830, so that the device 800 may execute the reference Figure 2 Any process of the present disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or a combination of software and hardware.

[0137] In some example embodiments, the program 830 may be tangibly embodied in a computer-readable medium that may be included in the device 800 (such as in the memory 820) or in other storage devices accessible to the device 800. The device 800 may load the program 830 from the computer-readable medium to the RAM 822 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc.

[0138] Fig. 9830 is stored on the computer-readable medium 900. Note that although Fig. 9 Computer readable medium 900 is depicted in the form of a CD or DVD, but computer readable medium 900 may be in any other form suitable for carrying or storing program 830.

[0139] In general, various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that, as non-limiting examples, the boxes, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0140] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, such as instructions contained in a program module, executed on a target real or virtual processor in a device to perform the above-referenced Figure 6 or Figure 7 The described method 600 or 700. Typically, a program module includes a routine, program, library, object, class, component, data structure, etc. that performs a specific task or implements a specific abstract data type. In various embodiments, the functions of the program modules can be combined or divided between program modules as needed. The machine executable instructions of the program modules can be executed in a local or distributed device. In a distributed device, the program modules can be located in both local and remote storage media.

[0141] The program code for executing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code may be executed entirely on the machine, partially on the machine, as an independent software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0142] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer readable media, etc.

[0143] The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or apparatuses, or any suitable combination thereof. More specific examples of computer-readable storage media would include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. The term "non-transient" as used herein is a limitation on the medium itself (i.e., tangible, not a signal), not a limitation on the persistence of data storage (e.g., RAM vs. ROM).

[0144] In addition, although operations are described in a particular order, this should not be understood as requiring such operations to be performed in the particular order or sequential order shown, or requiring the execution of all shown operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous. Similarly, although several specific implementation details are included in the above discussion, these details should not be interpreted as limitations on the scope of the present disclosure, but rather as descriptions of features that are peculiar to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0145] Although the disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as exemplary forms of implementing the claims.

Claims

1. A terminal device, comprising: at least one processor; and at least one memory storing instructions, which, when executed by the at least one processor, cause the terminal device to at least: Generate a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post-quantum cryptography PQC key encapsulation mechanism KEM; as well as The SUCI is sent to a network device.

2. The terminal device according to claim 1, wherein the terminal device is caused to generate the SUCI by: receiving the public key from the network device or another network device, or obtaining the public key configured in the terminal device itself; and The SUCI is generated based on the received public key.

3. The terminal device according to claim 1, wherein the terminal device is caused to generate the SUCI based on the public key by: Based on the public key, generate a first ciphertext and a first shared secret; Based on the generated first shared secret, derive an encryption key using a key derivation function KDF; generating a ciphertext value and a message authentication code tag (MAC tag) value based on the derived encryption key and the SUPI of the terminal device; as well as The SUCI is generated based on the generated first ciphertext, the generated ciphertext value, and the generated MAC tag value. 4 . The terminal device according to claim 3 , wherein the terminal device is configured to use an authenticated encryption AEAD algorithm with associated data to generate the ciphertext value and the MAC tag value.

5. The terminal device according to claim 4, wherein the terminal device is configured to generate the ciphertext value and the MAC tag value by: The obtained encryption key and the plain text of the SUPI are input into the AEAD algorithm to generate the ciphertext value and the MAC tag value.

6. The terminal device according to claim 1, wherein a field of Home Network Public Key ID in the SUCI is used to identify the public key.

7. The terminal device according to claim 1, wherein: The fields of the scheme output in the SUCI include a first ciphertext, a ciphertext value, and a MAC tag value, and The first ciphertext, the ciphertext value, and the MAC tag value are generated by the terminal device based on the public key.

8. The terminal device according to claim 3, wherein the first ciphertext is a PQC-KEM ciphertext, and the first shared secret is a PQC-KEM shared secret.

9. The terminal device according to claim 3, wherein the KDF comprises a function that implements properties of a Fujisaki-Okamoto (FO) transform or a HHK transform.

10. A network device comprising: at least one processor; and at least one memory storing instructions, which, when executed by the at least one processor, cause the network device to at least: Receiving a subscription hidden identifier SUCI of a terminal device; as well as A subscription permanent identifier SUPI of the terminal device is obtained based on the SUCI of the terminal device and a private key of a home network of the terminal device, wherein the private key is generated based on a post-quantum cryptography PQC key encapsulation mechanism KEM.

11. The network device according to claim 10, wherein the network device is further configured to: A PQC-KEM pair is generated for the terminal device, and a public key of the generated PQC-KEM pair is sent to the terminal device, wherein the public key of the generated PQC KEM pair is associated with the private key.

12. The network device of claim 10, wherein the network device is caused to obtain the SUPI by: extracting a first ciphertext, a ciphertext value, and a message authentication code tag (MAC tag) value from the SUCI; Generate a first shared secret based on the extracted first ciphertext and the private key; Based on the generated first shared secret, using a key derivation function KDF to derive a decryption key; Based on the derived decryption key, the extracted MAC tag value is verified and the extracted ciphertext value is decrypted.

13. The network device of claim 12, wherein the network device is caused to verify the extracted MAC tag value and decrypt the extracted ciphertext value using an authenticated encryption AEAD algorithm with associated data.

14. The network device of claim 13, wherein the network device is caused to verify the extracted MAC tag value and decrypt the extracted ciphertext value by: inputting the derived encryption key and the extracted MAC tag value into the AEAD algorithm to verify the extracted MAC tag; and In response to the verification being successful, the derived encryption key and the extracted ciphertext value are input into the AEAD algorithm to decrypt the extracted ciphertext value.

15. The network device of claim 10, wherein a field of the home network public key ID in the received SUCI identifies a public key of the home network of the terminal device associated with the private key.

16. The network device of claim 15, wherein the first ciphertext, the ciphertext value, and the message authentication code tag (MAC tag) value are extracted from fields of a scheme output in the received SUCI.

17. The network device of claim 12, wherein the first ciphertext is a PQC-KEM ciphertext and the first shared secret is a PQC-KEM shared secret.

18. The network device of claim 12, wherein the KDF comprises a function that implements properties of a Fujisaki-Okamoto (FO) transform or a HHK transform.

19. The network device according to claim 12, wherein the network device resides at a unified data management (UDM) network function or an authentication server function (AUSF).

Images