Subscription hidden identifier encryption

Abstract

Embodiments of the present disclosure relate to subscription hidden identifier (SUCI) encryption. In one aspect, a terminal device generates a Subscription Persistent Identifier (SUCI) of the terminal device based on the SUCI of the terminal device. The SUCI includes a SUPI type that indicates that both Elliptic Curve Cryptography (ECC) and Post Quantum Cryptography (PQC) are used in the generation of the SUCI. And the terminal equipment also sends the SUCI to the network equipment. Thus, the SUCI may be defined to include a SUPI type that indicates that the ECC and the PQC are used in the generation of the SUCI. By using the SUCI generated based on both the ECC and the PQC, different types of cryptographic analysis attacks can be avoided.

Description

Technical Field

[0001] Various example embodiments relate to the field of communications, and in particular, to devices, methods, apparatus, and computer-readable storage media for Subscription Concealed Identifier (SUCI) encryption. Background Art

[0002] SUPI is a 5G globally unique subscription permanent identifier (SUPI) assigned to each subscriber as defined in 3GPP specification TS23.501. SUCI is a privacy protection identifier that contains a hidden SUPI for communication security. Traditionally, the hiding of SUPI is based on the Elliptic Curve Integrated Encryption Scheme (ECIES), which generates SUCI based on an elliptic curve cryptography (ECC) temporary public and private key pair and a provided public key of the home network of the user equipment (UE). However, there are still challenges in how to ensure communication security by using ECIES-based SUCI encryption. For example, ECIES-based SUCI encryption will fall into quantum cryptanalysis. Summary of the invention

[0003] In general, example embodiments of the present disclosure provide a solution for SUCI encryption.

[0004] In a first aspect, a terminal device is provided. The terminal device comprises: at least one processor; and at least one memory storing instructions, which when executed by the at least one processor, causes the terminal device to at least: generate a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, and the SUPI type indicates that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and send the SUCI to a network device.

[0005] In a second aspect, a network device is provided. The network device includes: at least one processor; and at least one memory storing instructions, which when executed by the at least one processor, cause the network device to at least: receive a subscription concealed identifier SUCI from a terminal device for concealing a subscription permanent identifier SUPI of the terminal device, wherein the SUCI includes a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and determine the SUPI by decrypting the SUCI.

[0006] In a third aspect, a method is provided. The method comprises: generating, at a terminal device, a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and sending the SUCI from the terminal device to a network device.

[0007] In a fourth aspect, a method is provided. The method comprises: receiving, at a network device, a subscription concealed identifier (SUCI) from a terminal device for concealing a subscription permanent identifier (SUPI) of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography (ECC) and post-quantum cryptography (PQC) are used in generating the SUCI; and determining the SUPI by decrypting the SUCI at the network device.

[0008] In a fifth aspect, an apparatus is provided, comprising: means for generating, at a terminal device, a subscription hidden identifier SUCI of a terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and means for sending the SUCI from the terminal device to a network device.

[0009] In a sixth aspect, an apparatus is provided, comprising: means for receiving, at a network device, a subscription concealed identifier (SUCI) from a terminal device for concealing a subscription permanent identifier (SUPI) of the terminal device, wherein the SUCI comprises a SUPI type indicating that both elliptic curve cryptography (ECC) and post-quantum cryptography (PQC) are used in the generation of the SUCI; and means for determining the SUPI by decrypting the SUCI at the network device.

[0010] In a seventh aspect, a non-transitory computer-readable medium is provided, the non-transitory computer-readable medium comprising program instructions for causing an apparatus to at least execute a method according to any one of the third and fourth aspects above.

[0011] In an eighth aspect, a computer program is provided, the computer program comprising instructions, which when executed by an apparatus, causes the apparatus to at least: generate, at a terminal device, a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and send the SUCI to a network device.

[0012] In a ninth aspect, a computer program is provided, the computer program comprising instructions, which when executed by an apparatus, causes the apparatus to at least: receive, at a network device, a subscription concealed identifier SUCI from a terminal device to conceal a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and determine the SUPI by decrypting the SUCI.

[0013] In a tenth aspect, a terminal device is provided, comprising: a generating circuit system configured to: generate a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, and the SUPI type indicates that: both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of SUCI; and a transmitting circuit system configured to: transmit the SUCI to a network device.

[0014] In an eleventh aspect, a network device is provided, comprising: a receiving circuit system configured to: receive a subscription hidden identifier SUCI from a terminal device to hide a subscription permanent identifier SUPI of the terminal device, wherein the SUCI includes a SUPI type, and the SUPI type indicates that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and a determining circuit system configured to: determine the SUPI by decrypting the SUCI.

[0015] It is to be understood that the summary of the invention section is not intended to identify key or essential features of the embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become readily apparent through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0017] Figure 1A illustrates an example communication network in which embodiments of the present disclosure may be implemented;

[0018] Figure 1B The diagram illustrates the encryption steps on the UE side according to the ECIES scheme;

[0019] Figure 1C The diagram illustrates the decryption steps on the network side according to the ECIES scheme;

[0020] Figure 1D The diagram illustrates the SUPI defined in 3GPP TS23.501;

[0021] Figure 1E The SUCI according to the current specification is illustrated;

[0022] Figure 1F The scheme output of the ECIES scheme is illustrated;

[0023] Figure 2 illustrates an example of a process for SUCI encryption and decryption according to some embodiments of the present disclosure;

[0024] Figure 3 illustrates examples of SUPI and SUCI according to some embodiments of the present disclosure;

[0025] Figure 4 An example of a SUCI encryption process based on a hybrid key exchange at a terminal device according to some embodiments of the present disclosure is illustrated;

[0026] Figure 5 illustrates an example of a SUCI decryption process based on a hybrid key exchange at a network device according to some embodiments of the present disclosure;

[0027] Figure 6 A flowchart of a method implemented at a terminal device according to some embodiments of the present disclosure is illustrated;

[0028] Figure 7 A flowchart of a method implemented at a network device according to some embodiments of the present disclosure is illustrated;

[0029] Figure 8 illustrates a simplified block diagram of an apparatus suitable for implementing embodiments of the present disclosure; and

[0030] Fig. 9 A block diagram of an example computer-readable medium is illustrated in accordance with some embodiments of the present disclosure.

[0031] Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. DETAILED DESCRIPTION

[0032] The principle of the present disclosure will now be described with reference to some example embodiments. It is to be understood that these embodiments are described only for illustration and to help those skilled in the art understand and implement the purpose of the present disclosure, without any limitation to the scope of the present disclosure. The present disclosure described herein can be implemented in various ways except as follows.

[0033] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0034] In the present disclosure, references to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, whether or not explicitly described, it is considered to be within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments.

[0035] It should be understood that although the terms "first" and "second" etc. may be used to describe various elements in this article, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the exemplary embodiment, the first element may be referred to as the second element, and similarly, the second element may be referred to as the first element. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0036] The terms used herein are only for the purpose of describing a particular embodiment, and are not intended to limit the exemplary embodiments. As used herein, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are also intended to include plural forms. It is also to be understood that when used herein, the terms "comprises", "comprising", "has", "having", "includes" and / or "including" specify the existence of specified features, elements and / or components, but do not exclude the existence or addition of one or more other features, elements, components and / or their combinations. As used herein, "at least one of the following: " and "at least one of ", and similar wording (wherein a list of two or more elements is connected by "and" or "or") refer to at least any one element in an element, or at least any two or more elements in an element, or at least all elements.

[0037] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0038] (a) hardware circuit implementation only (such as implementation in analog and / or digital circuitry only); and

[0039] (b) a combination of hardware circuitry and software such as (where applicable):

[0040] (i) a combination of analog and / or digital hardware circuits and software / firmware, and

[0041] (ii) any part of hardware processor(s) with software (including digital signal processor(s)), software and memory(s) that work together to enable a device (such as a mobile phone, or a server)

[0042] Perform various functions; and

[0043] (c) Hardware circuit(s) and / or processor(s) that require software (e.g., firmware) to operate, such as microprocessor(s), or portions of microprocessor(s), but where software is not required for operation, the software may not be present.

[0044] This definition of circuitry applies to all uses of the term in this application, including in any claims. As yet another example, as used in this application, the term circuitry would also cover an implementation of only a hardware circuit or processor (or processors), or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. For example, and if applicable to a particular claim element, the term circuitry would also cover a baseband integrated circuit or processor integrated circuit used in a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0045] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as long term evolution (LTE), LTE-Advanced (LTE-A), wideband code division multiple access (WCDMA), high speed packet access (HSPA), narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal equipment and the network equipment in the communication network can be performed according to the communication protocol of any suitable generation, including but not limited to the first generation (1G), the second generation (2G), 2.5G, 2.75G, the third generation (3G), the fourth generation (4G), 4.5G, the future fifth generation (5G) communication protocol, and / or any other protocol currently known or to be developed in the future. The embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communication, there will certainly be communication technologies and systems that can embody the future types of the present disclosure. It should not be considered that the scope of the present disclosure is limited to the above-mentioned system.

[0046] As used herein, the term "network device" refers to a node in a communication network via which a terminal device accesses the network and receives services from it. A network device may refer to a base station (BS) or an access point (AP), such as a NodeB (NodeB or NB), an evolved NodeB (eNodeB or eNB), a NR NB (also known as a gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, a low power node (such as a femto node, a pico node), etc., depending on the terminology and technology applied.

[0047] The term "terminal device" refers to any final device that can perform wireless communication. By way of example and not limitation, the terminal device may also be referred to as a communication device, user equipment (UE), subscriber station (SS), portable subscriber station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device (such as a digital camera), a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop embedded equipment (LEE), a laptop computer installation equipment (LME), a USB dongle, a smart device, a wireless customer premises equipment (CPE), an Internet of Things (IoT) device, a watch or other wearable device, a head mounted display (HMD), a vehicle, a drone, medical equipment and applications (such as remote surgery), industrial equipment and applications (such as robots and / or other wireless devices operating in the context of industrial and / or automated processing chains), consumer electronic devices, equipment operating on commercial and / or industrial wireless networks, etc. In the following description, the terms "terminal device", "communication device", "terminal", "user equipment" and "UE" may be used interchangeably.

[0048] First refer to Figure 1A , Figure 1A An example of a communication system in which some example embodiments of the present disclosure may be implemented is illustrated. Figure 1A In an example scenario, there is a cellular communication system including a first UE 110 and a second UE 112, one or more base stations (BSs) 120, and a core network 130. The first UE 110 is connected to the BS 120 via an air interface 115. The BS 120 may be connected to the core network 130 via an interface 125, directly or via at least one intermediate node. The core network 130 may in turn be connected to another network ( Figure 1AThe core network 130 may be coupled to another network (not shown) via which connectivity with other networks may be obtained, for example, via a global interconnection network. In the case of 4G, the core network 130 may be referred to as an evolved packet core (EPC), and in the case of 5G, the core network 130 may be referred to as a 5G core (5GC). In any case, the embodiments of the present disclosure are not limited to any particular cellular communication technology.

[0049] The core network 130 may include more than one public land mobile network (PLMN), each PLMN is equipped with at least one network function (NF). NF may refer to an operation and / or physical entity. NF may be a specific network node or element, or a specific function or set of functions performed by one or more entities (such as virtual NF). At least some example embodiments of the present disclosure may also be applied to containerized or partitioned deployment. A physical node may be configured to perform the tasks of multiple NFs.

[0050] In a 5G network, the core network 130 may include a home subscriber function. Examples of the home subscriber function may include a unified data management (UDM) function, an authentication server function (AUSF), a network slice selection function (NSSF), a network exposure function (NEF), a network repository function (NRF), a policy control function (PCF), and an application function (AF).

[0051] The UDM functions may include an Authentication Credentials Repository and Processing Function (ARPF), and a Subscription Identifier De-hiding Function (SIDF). The SIDF may be responsible for decomposing the SUPI from the SUCI, and the ARPF may contain the subscriber's credentials.

[0052] It is to be appreciated that this particular arrangement of system elements is merely an example, and that in other embodiments, other types and arrangements of additional or alternative elements may be used to implement the communication system.

[0053] The communication in the communication system can be implemented according to any appropriate (multiple) communication protocols, including but not limited to cellular communication protocols of the first generation (1G), second generation (2G), third generation (3G), fourth generation (4G) and fifth generation (5G), wireless local network communication protocols (such as Institute of Electrical and Electronics Engineers (IEEE) 802.11, etc.), and / or any other protocol currently known or to be developed in the future. In addition, the communication can utilize any appropriate wireless communication technology, including but not limited to: code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplex (FDD), time division duplex (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiple access (OFDM), discrete Fourier transform spread OFDM (DFT-s-OFDM), and / or any other technology currently known or to be developed in the future.

[0054] exist Figure 1A In the example, the first UE 110, or a subscription module hosted by the first UE 110, may be a legitimate subscriber, while the second UE 112 may be an attacker. For example, as an attacker, the second UE 112 may steal the identifier of the first UE 110 to perform communication, which is undesirable.

[0055] As mentioned above, in the 5G system, a SUPI may be assigned to each subscriber, and a SUCI may be generated to hide the SUPI for communication privacy protection. Traditionally, the hiding of the SUPI is based on the ECIES scheme, and using ECIES to hide the SUPI may comply with the Efficient Cipher Group (SECG) specification.

[0056] Figure 1B The encryption steps on the UE side according to the ECIES scheme are illustrated. The ECIES scheme can be implemented to calculate a new SUCI. The UE can use the provided public key of the home network and the newly generated ECC temporary public key / private key pair according to the ECIES parameters provided by the home network. The processing on the UE side can be performed according to the encryption operation, including: generating key data K of length 'enckeylen+icblen+mackeylen'; parsing the leftmost enckeylen octets of K as an encryption key (EK), parsing the middle icblen octets of K as an initial counter block (ICB), and parsing the rightmost mackeylen octets of K as a message authentication code (MAC) key (MK). The final output of the ECIES hiding scheme can be a cascade of the ECC temporary public key, the ciphertext value, the MAC tag value, and any other parameters (if applicable).

[0057] Figure 1C The diagram illustrates the decryption steps at the home network side, specifically at the NF (such as SIDF) in the core network, according to the ECIES scheme. The ECIES scheme can be implemented for de-hiding SUCI. The home network can use the received ECC temporary public key of the UE and the private key of the home network of the UE. The processing on the home network side can be performed according to the decryption operation, including: generating key data K of length 'enckeylen+icblen+mackeylen'; parsing the leftmost enckeylen octet of K as a decryption key (DK), parsing the middle icblen octet of K as ICB, and parsing the rightmost mackeylen octet of K as a MAC key (MK). It should be noted that, unlike the UE, the home network does not need to perform a new temporary key pair generation for each decryption. How frequently the home network generates a new public / private key pair and how to provide the public key to the UE is outside the scope of this disclosure.

[0058] Figure 1D The diagram illustrates the SUPI defined in 3GPP TS23.501; Figure 1E illustrates a SUCI according to current specifications; and Figure 1F The scheme output of the ECIES scheme is illustrated. As defined in the current 3GPP specification, the SUPI may include a value indicating the SUPI type. The SUPI type may indicate an International Mobile Subscriber Identity (IMSI), a Network Specific Identifier (NSI), a Global Line Identifier (GLI), or a Global Cable Identifier (GCI). Depending on the value of the SUPI type, the SUPI may include a field indicating the corresponding IMSI, NSI, GLI, or GCI.

[0059] In addition, depending on the protocol used to convey the SUPI, the SUPI type may take different formats. For 3GPP radio access technology (RAT), a valid SUPI may consist of a mobile country code (MCC), a mobile network code (MNC), and a mobile subscription identification number (MSIN) as defined in 3GPP TS23.003. For non-3GPP RAT, a valid SUPI may consist of a network access identifier (NAI) as defined in RFC4282. NAI may take different forms to define NSI, GLI, or GCI.

[0060] The SUCI may be generated by hiding at least a portion of the SUPI (e.g., the MSIN portion). Figure 1E As illustrated in FIG, the ECIES-based SUCI may consist of the following parts. The first part is the SUPI type, which consists of values ​​ranging from 0 to 7. It identifies the type of SUPI hidden in the SUCI. The following values ​​are defined: IMSI is 0, NSI is 1, GLI is 2, GCI is 3, and 4 to 7 are spare values ​​for future use.

[0061] The second part is the home network identifier, which identifies the subscriber's home network. The third part is the routing indicator, which consists of 1 to 4 decimal digits assigned by the home network operator and provided in the USIM. The fourth part is the protection scheme identifier, which consists of values ​​in the range of 0 to 15 (see Annex C.1 of 3GPP TS 33.501). It represents the empty scheme or non-empty scheme specified in Annex C of 3GPP TS33.501, or the protection scheme specified by the HPLMN. The fifth part is the home network public key identifier, which consists of values ​​in the range of 0 to 255. It represents the public key provided by the HPLMN or SNPN, and it is used to identify the key used for SUPI protection. The sixth part is the scheme output, which consists of a string of variable length or hexadecimal digits, depending on the protection scheme used. It represents the output of the public key protection scheme specified in Annex C of 3GPP TS 33.501, or the output of the protection scheme specified by the HPLMN. Figure 1F An example solution output is shown. Other formats of solution output may be referenced in 3GPP TS 23.003. Figure 1B As discussed, the scheme output may include an ECC temporary public key, a ciphertext value, and a MAC tag value.

[0062] By hiding the SUPI and sending the SUCI containing the hidden SUPI, communication privacy can be achieved over the air radio interface. However, conventional ECIES-based SUCI encryption will fall to quantum cryptanalysis. From the 3GPP perspective, cryptographically dependent quantum computers (CRQCs) pose a threat that an attacker can easily obtain the SUPI from the SUCI using the home network public key and Shor's algorithm. This will therefore make the encryption scheme vulnerable as the entire concept is based on someone not being able to crack the home network private key from the home network public key.

[0063] At the same time, the migration to post-quantum cryptography (PQC) is unique in the history of modern digital cryptography because neither classical nor post-quantum algorithms can be fully trusted to protect data for the required data lifecycle. Post-quantum algorithms can be subject to uncertainty in the underlying mathematics, compliance issues, unknown vulnerabilities, hardware and software implementations that have not had enough time to mature to rule out classical cryptanalytic attacks and implementation vulnerabilities. Therefore, during the transition from classical to post-quantum algorithms, protocols using both algorithm types are expected or required.

[0064] According to an embodiment of the present disclosure, a solution for SUCI encryption based on hybrid cryptography is provided. In some embodiments, a terminal device generates a SUCI of the terminal device based on a SUPI of the terminal device, wherein the SUCI includes a SUPI type, and the SUPI type indicates that both ECC and PQC are used in the generation of the SUCI. The terminal device also sends the SUCI to a network device.

[0065] In this way, SUCI generated based on ECC and PQC (also referred to herein as hybrid SUCI or new SUCI or SUCI-E (SUCI extension)) can avoid different kinds of attacks, such as Shor's algorithmic attack on asymmetric cryptographic methods based on prime factorization or discrete logarithm problems (finite fields or elliptic curves). For example, SUCI encryption based on ECIES uses elliptic curves based on discrete logarithm problems, which makes it vulnerable to quantum cryptanalysis. In this case, the adversary can collect the home network public key and use CRQC to gain access to the home network private key. If the adversary gains access to the home network private key, the SUCI encryption can be directly broken to obtain SUPI. Therefore, using ECC and PQC, hybrid SUCI can ensure security against adversaries who intend to launch Shor's attack.

[0066] The principles and embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. However, it should be noted that these embodiments are illustrated only as examples and are not intended to limit the scope of the present application in any way.

[0067] Now refer to Figure 2 , which illustrates an example of a process 200 for SUCI encryption according to an embodiment of the present disclosure. For the purpose of discussion, the process 200 will refer to Figure 1A describe.

[0068] like Figure 2 As shown in FIG. 2 , the process 200 may involve a terminal device 201 and a network device 202. The terminal device 201 may be Figure 1A 1, and the network device 202 may be an example of one or more elements of the core network 130. The terminal device 201 or a subscription module hosted by the terminal device 201 may be assigned a globally unique subscription identifier, i.e., a SUPI. The network device 202 may refer to a network entity responsible for de-hiding the SUCI, i.e., determining the SUPI by decrypting the SUCI. For example, the network device 202 may be a reference to Figure 1A SIDF, ARPF or UDM discussed.

[0069] In the process 200, the terminal device 201 generates a SUCI of the terminal device 201 based on the SUPI of the terminal device 201. The SUCI includes a SUPI type indicating that both ECC and PQC are used in the generation of the SUCI.

[0070] In some embodiments, the SUPI may be as defined in 3GPP TS 23.501. Figure 3 310 according to some embodiments of the present disclosure. Figure 3 As shown in , the SUPI 310 may include a field of SUPI type, and a field of IMSI, NSI, GLI, or GCI. The SUPI type may consist of a value in the range of 0 to 7, and it identifies the type of the SUPI. A value of 0 may indicate that the type of the SUPI is IMSI, a value of 1 may indicate that the type of the SUPI is NSI, a value of 2 may indicate that the type of the SUPI is GLI, a value of 3 may indicate that the type of the SUPI is GCI, and values ​​4 to 7 may be spare values ​​for future use. Alternatively or additionally, the SUPI may be defined in any suitable manner to uniquely identify a subscriber of the terminal device 201.

[0071] Figure 3 Also illustrated is an example of a SUCI 320 according to some embodiments of the present disclosure. Figure 3 As illustrated in , the SUCI 320 includes a field for a SUPI type. In some embodiments, the SUPI type in the SUCI 320 may consist of a value in the range of 0 to 7, and the value may identify the type of SUPI hidden in the SUCI.

[0072] In some embodiments, a value of 0 may indicate that the type of SUPI is IMSI; a value of 1 may indicate that the type of SUPI is NSI; a value of 2 may indicate that the type of SUPI is GLI; and a value of 3 may indicate that the type of SUPI is GCI. Notably, a value of 4 may indicate that both ECC and PQC are used to generate the SUCI 320. Values ​​5 to 7 may be spare values ​​for future use.

[0073] Alternatively or additionally, SUCI may be defined in any suitable manner to indicate that both ECC and PQC are used to generate SUCI 320. For example, any of the values ​​5 to 7 may indicate that both ECC and PQC are used to generate SUCI 320.

[0074] In this way, SUCI can be defined to include a SUPI type that indicates that both ECC and PQC are used in the generation of SUCI. In addition, both the new SUCI type (value 4) or the old SUCI type (values ​​such as 0, 1, 2, or 3) can be supported and are helpful during migration to PQC. In addition, the SUCI type is readable by any NF (such as UDM) and thus the de-hiding of SUCI can be applied accordingly via ARPF.

[0075] In some embodiments, the SUCI 320 may further include a home network public key identifier (ID) associated with a legacy key encapsulation mechanism (KEM), and a home network public key identifier associated with a PQC KEM. For example, the SUCI 320 may include an ECC home network public key identifier (also referred to as an ECC public key identifier), and a PQC KEM home network public key identifier (also referred to as a PQC public key identifier). The home network of the terminal device 201 may include a home public land mobile network (HPLMN), or a stand-alone non-public network (SNPN).

[0076] In some embodiments, the ECC public key identifier may consist of a value ranging from 0 to 255. The ECC public key identifier may indicate an ECC public key provided by the home network for the terminal device 201. The value of the ECC public key identifier may be set to 0 when and only when the null protection scheme is used.

[0077] In some embodiments, the PQC public key identifier may consist of a value in the range of 0 to 255. The PQC public key identifier may indicate: a PQC KEM public key provided by the home network for the terminal device 201. As used in PQC, examples of PQC KEM public keys may include Kyber, bit flip key encapsulation (BIKE), Hamming quasi-cycle (HQC), and classic McEliece. The PQC KEM public key may be different from the ECC public key. The PQC KEM public key may be used to identify a key for SUPI protection instead of a traditional home network public key (e.g., an ECC public key).

[0078] In some embodiments, the SUCI 320 may also include a Scheme Output field. The Scheme Output may be the cryptographically generated portion of the SUCI 320 and may be used to determine the SUPI via the SUCI 320. As defined below, the Scheme Output may consist of a string of variable length or hexadecimal digits, depending on the protection scheme used. The Scheme Output may represent the output of a public key protection scheme according to some embodiments of the present disclosure.

[0079] In some embodiments, the scheme output field may include an ECC temporary public key, a PQC KEM ciphertext value, a second ciphertext value, and a MAC tag value. The PQC KEM ciphertext value may refer to a PQC KEM ciphertext generated by PQC KEM using the PQC KEM public key of the home network. The second ciphertext may refer to a ciphertext value generated by ECC and PQC KEM. The scheme output may be a cascade of the above values. If applicable, the scheme output may include any other suitable parameters.

[0080] like Figure 3 As shown in FIG. 1 , the ECC temporary public key may be represented by a mark 'A', the PQC KEM ciphertext may be represented by a mark 'B', the second ciphertext value may be represented by a mark 'C', and the MAC tag value may be represented by a mark 'D'. Figure 4 and Figure 5 The details of the scheme output generation are described in FIG. 1. Note that parameters such as the PQC KEM ciphertext and the PQC home network public identifier can be added in the UE or USIM and verified in the UDM.

[0081] In some embodiments, the SUCI 320 may also include a home network identifier field that identifies the home network of the subscriber of the terminal device 201. When the SUCI type is IMSI, the home network identifier may include an MCC and an MNC. The MCC may consist of three decimal digits and uniquely identifies the country of registration of the mobile subscription. The MNC may consist of two or three decimal digits and identifies the home PLMN or SNPN of the mobile subscription.

[0082] When the SUPI type is NSI, GLI, or GCI, the home network identifier may consist of a character string with variable length, representing a domain name specified in Section 2.2 of IETF RFC 7542. For GLI or GCI, the domain name may correspond to the realm part specified in the NAI format for SUPI in Sections 28.15.2 and 28.16.2 of 3GPP TS 23.003.

[0083] In some embodiments, the SUCI 320 may also include a routing indicator field. The routing indicator may consist of 1 to 4 decimal digits assigned by the home network operator and provided in the Universal Subscriber Identity Module (USIM), which allows network signaling with the SUCI to be routed to the AUSF and UDM instances that can serve the subscriber together with the home network identifier. Each decimal digit present in the routing indicator may be considered meaningful (e.g., the value "012" is not the same as the value "12"). If the routing indicator is not configured on the USIM, this data field may be set to a value of 0 (i.e., consisting of only one decimal digit "0").

[0084] In some embodiments, the SUCI 320 may also include a protection scheme identifier field. The protection scheme identifier may consist of a value in the range of 0 to 15 (see Annex C.1 of 3GPP TS 33.501). It may represent the null scheme or non-null scheme specified in Annex C of 3GPP TS 33.501, or a protection scheme specified by the HPLMN. If the SUPI type is GLI or GCI, the null scheme may be used.

[0085] Return to reference Figure 2 , the terminal device 201 sends the generated SUCI 230 (eg Figure 3 2) to the network device 202. The network device 202 receives 235 the SUCI 230 and determines 240 the SUPI by decrypting the SUCI 230. As mentioned above, de-hiding of the SUCI 230 may be performed by a SIDF, an ARPF, or a UDM.

[0086] Using process 200, a new SUCI may be defined that includes a SUPI type indicating that ECC and PQC are used in the generation of the SUCI. Using ECC and PQC, the new SUCI may avoid different types of attacks. For example, if CRQC breaks the traditional ECC algorithm using the Shor algorithm, the new SUCI may still ensure security against an adversary that intends to launch a Shor attack because PQC is used when generating the new SUCI.

[0087] Figure 4 An example of a SUCI encryption process 400 based on a hybrid key exchange at a terminal device according to some embodiments of the present disclosure is illustrated. For the purpose of discussion, the process 400 will refer to Figure 2 The process 400 may be performed by the terminal device 201 .

[0088] like Figure 4 As illustrated in FIG, at the UE side, the PQC KEM public key of the home network (HN) (see step 1b) may be used in a key encapsulation mechanism to generate a PQC KEP ciphertext ('B', also referred to as a PQC KEM ciphertext value) and a shared secret (ss). This shared secret may be used together with a conventional ECC temporary shared key in a key combiner function to generate a combined encryption key, thereby generating a ciphertext value ('C') and a MAC tag value ('D') of the SUPI.

[0089] Specifically, as illustrated in steps 1a, 2a, and 3a, the terminal device 201 may generate a key pair (ECC temporary public key ('A') and a private key) using a key pair generation primitive. The terminal device 201 may determine the ECC temporary shared key based on the ECC temporary private key and the HN public key (i.e., the public key of the HPLMN or SNPN). In some embodiments, based on the Diffie-Hellman primitive, the ECC temporary shared secret key element may be derived (from the HN's public key and the generated temporary private key).

[0090] As illustrated in steps 1b, 2b, and 3b, the terminal device 201 may also determine a PQC KEM ciphertext value ('B') and a PQC shared secret based on the PQC KEM public key. For example, the PQC KEM ciphertext (ct) may be generated using a key encapsulation mechanism (asymmetric cryptographic scheme), where PK is the PQC KEM public key of HN. A PQC shared secret (ss) may also be generated and used as an input to a key derivation function (KDF) to derive a final PQC shared secret.

[0091] In some embodiments, the terminal device 201 may also update the final PQC shared secret by utilizing a key derivation function (KDF) to implement the Fujisaki-Okamoto (FO) transformation or its variant HHK (Hofheinz, and Kiltz). The FO transform can be performed using a KDF such that the implemented PQC KEM shared secret is indistinguishable under adaptive chosen ciphertext attack (IND-CCA2) security. In other words, the FO transform or its variant HHK can be applied to the PQC KEM part to ensure that the overall scheme is IND-CCA2 secure when the traditional part is compromised.

[0092] In this case, without the temporary key (whenever the legacy key is compromised), the PQC KEM key can be reused less than a predetermined threshold number of times (but not recommended). Depending on some upper limit level, the PQC KEM key can be reused multiple times. The upper limit level will be defined based on the number of times the KEM public key can be used, and the exact number does not need to be specified in this disclosure.

[0093] As illustrated in step 4, the terminal device 201 can determine the key data based on the combination of the PQC shared secret and the ECC temporary shared key. The key data may include a temporary encryption key (EK) and an initial counter block (ICB). The key combiner function can be used to combine the traditional shared key and the newly generated final PQC shared secret (from the KDF function) to generate key data K of length 'temporary key (EK) + initial counter block (ICB)'.

[0094] Then in step 5, the terminal device 201 may determine the ciphertext value ('C', also referred to as a second ciphertext value different from the PQC KEM ciphertext) and the MAC tag value ('D') based on the SUPI, EK, and ICB. In some embodiments, the terminal device 201 may determine the ciphertext value ('C') and the MAC tag value ('D') by using authenticated encryption with associated data (AEAD) symmetric encryption. In other words, using the derived key EK and ICB, AEAD may be performed to encrypt the plaintext block (SUPI) to generate the ciphertext ('C') and the MAC key ('D').

[0095] Based on the determined ECC temporary public key ('A'), the PQC KEM ciphertext value ('B'), the second ciphertext value ('C'), and the MAC tag value ('D'), the terminal device 201 may determine a scheme output, thereby generating a SUCI including a hidden SUPI.

[0096] Figure 5 An example of a SUCI decryption process 500 based on a hybrid key exchange at a network device according to some embodiments of the present disclosure is illustrated. For the purpose of discussion, the process 500 will refer to Figure 2 Process 500 may be performed by a network device 202, such as a SIDF, UDM, or ARPF.

[0097] like Figure 5 As illustrated in FIG. 1 , in steps 1a and 2a, the network device 202 may determine the ECC temporary shared key based on the ECC temporary public key ('A') and the private key of the HPLMN or SNPN. For example, on the SIDF side, the received UE temporary public key ('A') and the private key of the home network may be used to generate the temporary shared key.

[0098] In step 1b, the network device 202 may identify the PQC KEM secret key of the HPLMN or SNPN from the PQC public key identifier. For example, the SIDF may use the home network public key identifier (PQC KEM ID) to identify the PQC KEM secret of the HN for use in the decapsulation mechanism. In addition, the network device 202 may determine the PQC shared secret based on the PQC KEM ciphertext value ('B') and the PQC KEM secret key (sk). The PQC KEM ciphertext (ct) may be used in a key decapsulation mechanism (asymmetric cryptographic scheme) together with the PQC KEM secret key of the HN to generate a shared secret. In step 2b, the generated shared secret may be used as an input to the KDF function and the final PQC shared secret may be derived.

[0099] In step 3, the network device 202 may determine key data based on the combination of the PQC shared secret and the ECC temporary shared key, and the key data may include a temporary decryption key (DK) and an initial counter block (ICB). In other words, the newly generated shared secret may be used together with the traditional temporary shared key as an input to a key combiner function to generate key data K of length 'temporary decryption key (DK)+initial counter block (ICB)'.

[0100] Then in step 4, the network device 202 can determine the SUPI based on the second ciphertext value ('C'), the DK, and the ICB. In some embodiments, the network device 202 can determine the plaintext block (i.e., the SUPI) by using AEAD symmetric decryption. The generated DK and ICB can be used to decrypt the ciphertext value ('C') using AEAD symmetric decryption.

[0101] Additionally, in step 5, the network device 202 may compare the MAC tag value with the expected MAC; and verify the integrity of the SUCI based on the comparison. In other words, the received MAC tag value ('D') may be compared with the expected MAC, and using this comparison, the integrity of the SUCI may be verified.

[0102] Figure 6 FIG. 6 is a flowchart of an example method 600 implemented at a terminal device according to some embodiments of the present disclosure. For the purpose of discussion, the method 600 will refer to Figure 2 , described from the perspective of terminal device 201.

[0103] At block 610, the terminal device generates a SUCI of the terminal device based on the SUPI of the terminal device, wherein the SUCI includes a SUPI type indicating that both ECC and PQC are used in the generation of the SUCI. At block 620, the terminal device sends the SUCI to the network device.

[0104] In some embodiments, the SUCI may include an ECC public key identifier and a PQC public key identifier, wherein the ECC public key identifier indicates: an ECC public key provided by a home public land mobile network HPLMN or an independent non-public network SNPN for the terminal device, and the PQC public key identifier indicates: a PQC KEM public key provided by the HPLMN or SNPN.

[0105] In some embodiments, the SUCI may further include a scheme output field, and the scheme output field may include: an ECC temporary public key, a PQC KEM ciphertext value, a second ciphertext value, and a message authentication code MAC tag value.

[0106] In some embodiments, the terminal device may determine the SUCI by: determining the ECC temporary shared key based on the ECC temporary private key and the public key of the HPLMN or SNPN; determining the PQC KEM ciphertext value and the PQC shared secret based on the PQC KEM public key; determining key data based on a combination of the PQC shared secret and the ECC temporary shared key, wherein the key data includes: a temporary encryption key EK and an initial counter block ICB; determining a second ciphertext value and a MAC tag value based on the SUPI, EK and ICB; and determining a scheme output based on the ECC temporary public key, the PQC KEM ciphertext value, the second ciphertext value and the MAC tag value.

[0107] In some embodiments, the terminal device may determine the second ciphertext value and the MAC tag value based on the SUPI, the EK, and the ICB by using authenticated encryption AEAD symmetric encryption with associated data.

[0108] In some embodiments, the terminal device can also derive a second PQC shared secret from the PQC shared secret; and update the second PQC shared secret by utilizing KDF to realize the characteristics of Fujisaki-Okamoto (FO) transformation or its variant HHK, wherein the updated second PQC shared secret is IND-CCA2 secure.

[0109] In some embodiments, the value of SUPI type may be 4. In some embodiments, the PQC KEM public key may be one of Kyber, BIKE, Hamming Quasi-Cycle, or Classical McEliece. In some embodiments, the PQC KEM public key may be reused a number of times less than a predetermined threshold number.

[0110] In some embodiments, an apparatus capable of executing any method in method 600 (e.g., terminal device 201) may include a component for executing the corresponding steps of method 600. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit system or a software module.

[0111] In some embodiments, the apparatus comprises: means for generating, at the terminal device, a SUCI of the terminal device based on a SUPI of the terminal device, wherein the SUCI comprises a SUPI type indicating that both ECC and PQC are used in the generation of the SUCI; and means for sending, at the terminal device, the SUCI to a network device.

[0112] In some embodiments, the SUCI may include an ECC public key identifier and a PQC public key identifier, wherein the ECC public key identifier indicates: an ECC public key provided by a home public land mobile network HPLMN or an independent non-public network SNPN for the terminal device, and the PQC public key identifier indicates: a PQC KEM public key provided by the HPLMN or SNPN.

[0113] In some embodiments, the SUCI may further include a scheme output field, and the scheme output field may include an ECC temporary public key, a PQC KEM ciphertext value, a second ciphertext value, and a message authentication code MAC tag value.

[0114] In some embodiments, the means for determining the SUCI may include: a means for determining an ECC temporary shared key based on an ECC temporary private key and a public key of the HPLMN or SNPN; a means for determining a PQC KEM ciphertext value and a PQC shared secret based on a PQC KEM public key; a means for determining key data based on a combination of the PQC shared secret and the ECC temporary shared key, wherein the key data includes a temporary encryption key EK and an initial counter block ICB; a means for determining a second ciphertext value and a MAC tag value based on the SUPI, the EK and the ICB; and a means for determining a scheme output based on the ECC temporary public key, the PQC KEM ciphertext value, the second ciphertext value and the MAC tag value.

[0115] In some embodiments, the means for determining the second ciphertext value and the MAC tag value based on the SUPI, the EK, and the ICB may include means for determining the second ciphertext value and the MAC tag value using authenticated encryption AEAD symmetric encryption with associated data.

[0116] In some embodiments, the apparatus may further include: a component for deriving a second PQC shared secret from the PQC shared secret; and a component for updating the second PQC shared secret by utilizing a KDF to implement the characteristics of a Fujisaki-Okamoto (FO) transform or its variant HHK, wherein the updated second PQC shared secret is IND-CCA2 secure.

[0117] In some embodiments, the value of SUPI type may be 4. In some embodiments, the PQC KEM public key may be one of Kyber, BIKE, Hamming Quasi-Cycle, or Classical McEliece. In some embodiments, the PQC KEM public key may be reused a number of times less than a predetermined threshold number.

[0118] In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of method 600. In some embodiments, the means comprises: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause execution of the apparatus.

[0119] Figure 7 A flowchart of an example method 700 implemented at a network device according to some embodiments of the present disclosure is illustrated. For discussion purposes, the method 700 will refer to Figure 2 , described from the perspective of network device 202.

[0120] At block 710, the network device receives a SUCI from a terminal device for concealing a SUPI of the terminal device, wherein the SUCI includes a SUPI type indicating that both ECC and PQC are used in generating the SUCI. At block 720, the network device determines the SUPI by decrypting the SUCI.

[0121] In some embodiments, the SUCI may further include an ECC public key identifier and a PQC public key identifier, wherein the ECC public key identifier indicates: an ECC public key provided by a home public land mobile network HPLMN or an independent non-public network SNPN for the terminal device, and the PQC public key identifier indicates: a PQC key encapsulation mechanism KEM public key provided by the HPLMN or SNPN.

[0122] In some embodiments, the SUCI may further include a scheme output, and the scheme output includes an ECC temporary public key, a PQC KEM ciphertext value, a second ciphertext value, and a message authentication code MAC tag value.

[0123] In some embodiments, the network device may determine the SUPI by: determining an ECC temporary shared key based on the ECC temporary public key and a private key of the HPLMN or SNPN; identifying a PQCKEM secret key of the HPLMN or SNPN from a PQC public key identifier; determining a PQC shared secret based on a PQC KEM ciphertext value and a PQC KEM secret key; determining key data based on a combination of the PQC shared secret and the ECC temporary shared key, the key data including a temporary decryption key DK and an initial counter block ICB; and determining the SUPI based on the second ciphertext value, DK, and ICB.

[0124] In some embodiments, the network device may determine the SUPI based on the second ciphertext value, the DK, and the ICB by using AEAD symmetric decryption.

[0125] In some embodiments, the network device may also compare the MAC tag value with the expected MAC; and verify the integrity of the SUCI based on the comparison.

[0126] In some embodiments, the value of the SUPI type may be 4. In some embodiments, the PQC KEM secret key may be one of Kyber, BIKE, Hamming Quasi-Cycle, or Classical McEliece. In some embodiments, the network device may decrypt the SUCI at any of the following: a Subscriber Identity De-Hiding Function SIDF, a Unified Data Management UDM Function, or an Authentication Credentials Repository and Processing ARPF Function.

[0127] In some embodiments, an apparatus capable of executing any of the methods 700 (e.g., network device 202) may include a component for executing the corresponding steps of the method 700. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit system or a software module.

[0128] In some embodiments, the apparatus includes: means for receiving, at a network device, from a terminal device a SUCI for concealing a SUPI of the terminal device, wherein the SUCI includes a SUPI type indicating that both ECC and PQC are used in the generation of the SUCI; and means for determining the SUPI by decrypting the SUCI.

[0129] In some embodiments, the SUCI may further include an ECC public key identifier and a PQC public key identifier, wherein the ECC public key identifier indicates: an ECC public key provided by a home public land mobile network HPLMN or an independent non-public network SNPN for the terminal device, and the PQC public key identifier indicates: a PQC key encapsulation mechanism KEM public key provided by the HPLMN or SNPN.

[0130] In some embodiments, the SUCI may further include a scheme output, and the scheme output includes: an ECC temporary public key, a PQC KEM ciphertext value, a second ciphertext value, and a message authentication code MAC tag value.

[0131] In some embodiments, the means for determining the SUPI may include: means for determining the ECC temporary shared key based on the ECC temporary public key and the private key of the HPLMN or SNPN; means for identifying the PQC KEM secret key of the HPLMN or SNPN from the PQC public key identifier; means for determining the PQC shared secret based on the PQC KEM ciphertext value and the PQC KEM secret key; means for determining key data based on a combination of the PQC shared secret and the ECC temporary shared key, the key data including a temporary decryption key DK and an initial counter block ICB; and means for determining the SUPI based on the second ciphertext value, DK and ICB.

[0132] In some embodiments, the means for determining the SUPI based on the second ciphertext value, the DK, and the ICB may include means for determining the SUPI by using AEAD symmetric decryption.

[0133] In some embodiments, the apparatus may further include: means for comparing the MAC tag value to an expected MAC; and means for verifying the integrity of the SUCI based on the comparison.

[0134] In some embodiments, the value of the SUPI type may be 4. In some embodiments, the PQC KEM secret key may be one of Kyber, BIKE, Hamming Quasi-Cycle, or Classical McEliece. In some embodiments, the means for decrypting the SUCI may include means for decrypting the SUCI at any of: a Subscriber Identity De-Hiding Function SIDF, a Unified Data Management UDM Function, or an Authentication Credentials Repository and Processing ARPF Function.

[0135] In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of method 700. In some embodiments, the means comprises: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause execution of the apparatus.

[0136] Figure 8 is a simplified block diagram of a device 800 suitable for implementing an embodiment of the present disclosure. The device 800 may be provided to implement a communication device, such as Figure 2 The terminal device 201 and the network device 202 are shown. As shown, the device 800 includes one or more processors 810, one or more memories 840 coupled to the processors 810, and one or more communication modules 840 coupled to the processors 810.

[0137] The communication module 840 is used for two-way communication. The communication module 840 has at least one antenna to facilitate communication. The communication interface may represent any interface necessary to communicate with other network elements.

[0138] Processor 810 may be of any type suitable for the local technology network, and may include, as non-limiting examples, one or more of the following: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 800 may have multiple processors, such as application specific integrated circuit chips that are time slaved to a clock synchronized with a main processor.

[0139] The memory 820 may include one or more non-volatile memories, and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 824, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic storage devices and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 822, and other volatile memories that do not persist over the duration of a power outage.

[0140] The computer program 830 includes computer executable instructions that are executed by the associated processor 810. The program 830 may be stored in the ROM 824. The processor 810 may perform any suitable actions and processes by loading the program 830 into the RAM 822.

[0141] The embodiments of the present disclosure can be implemented by means of program 830, so that the device 800 can execute the reference Figures 2 to 7 The embodiments of the present disclosure may also be implemented by hardware, or a combination of software and hardware.

[0142] In some embodiments, the program 830 may be tangibly embodied in a computer-readable medium, which may be included in the device 800 (such as the memory 820), or other storage devices accessible by the device 800. The device 800 may load the program 830 from the computer-readable medium to the RAM 822 for execution. The computer-readable medium may include any type of tangible non-volatile storage device, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. Fig. 9 An example of a computer readable medium 900 in the form of a CD or DVD is shown. The computer readable medium has a program 830 stored thereon.

[0143] Generally, various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are illustrated and described as block diagrams, flow charts, or using some other graphical representations, it is to be understood that the boxes, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof as non-limiting examples.

[0144] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer executable instructions, such as those included in a program module executed in a device on a target real or virtual processor, to perform the above-referenced Figures 2 to 7 Method 600 or 700 described. Typically, a program module includes routines, programs, libraries, objects, categories, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or split between program modules as needed. The machine executable instructions of the program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in both local and remote storage media.

[0145] The program code for executing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code, when executed by the processor or controller, enables the function / operation specified in the flow chart and / or block diagram to be realized. The program code can be executed completely on the machine, partially on the machine, as an independent software package, partially on the machine and partially on a remote machine, or completely on a remote machine or server.

[0146] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform the above-mentioned various processes and operations. Examples of carriers include signals, computer-readable media, etc.

[0147] Computer readable medium can be a computer readable signal medium or a computer readable storage medium. Computer readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, or equipment or any suitable combination of the foregoing. More specific examples of computer readable storage medium will include electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices or any suitable combination of the foregoing. The term "non-transient" used herein is a restriction on the medium itself (i.e., tangible, not a signal), rather than a restriction on data storage persistence (e.g., RAM and ROM).

[0148] In addition, although the operation is depicted in a particular order, this should not be understood as requiring that such operation be performed in the particular order shown or in a sequential order, or that all illustrated operations are performed, to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limitations on the scope of the present disclosure, but should be interpreted as descriptions of features that can be specific to a particular embodiment. Some features described in the context of a separate embodiment can also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment can also be implemented individually in multiple embodiments, or implemented with any suitable sub-combination.

[0149] Although the disclosure has been described in language specific to structural features and / or methodological acts, it is to be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A device for communication, comprising: means for generating, at a terminal device, a subscription hidden identifier SUCI of the terminal device based on a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type, the SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; as well as means for sending the SUCI from the terminal device to a network device.

2. The apparatus of claim 1 , wherein the SUCI comprises an ECC public key identifier and a PQC public key identifier, and The ECC public key identifier indicates: the ECC public key provided by the home public land mobile network HPLMN or the independent non-public network SNPN for the terminal device, and the PQC public key identifier indicates: the PQC key encapsulation mechanism KEM public key provided by the HPLMN or the SNPN.

3. The apparatus of claim 2, wherein the SUCI further comprises a scheme output field, and the scheme output field comprises: ECC temporary public key, PQC KEM ciphertext value, second ciphertext value, and message authentication code MAC tag value.

4. The apparatus of claim 3, wherein the terminal device is caused to determine the SUCI by: Determine an ECC temporary shared key based on the ECC temporary private key and the public key of the HPLMN or the SNPN; Based on the PQC KEM public key, determine the PQC KEM ciphertext value and the PQC shared secret; Determine key data based on a combination of the PQC shared secret and the ECC temporary shared key, wherein the key data includes: a temporary encryption key EK, and an initial counter block ICB; Determine the second ciphertext value and the MAC tag value based on the SUPI, the EK, and the ICB; and The scheme output is determined based on the ECC temporary public key, the PQC KEM ciphertext value, the second ciphertext value and the MAC tag value.

5. The apparatus of claim 4, wherein the terminal device is caused to determine the second ciphertext value and the MAC tag value based on the SUPI, the EK, and the ICB by using authenticated encryption AEAD symmetric encryption with associated data.

6. The apparatus according to claim 5, wherein the terminal device is further configured to: deriving a second PQC shared secret from the PQC shared secret; and The second PQC shared secret is updated by using a key derivation function KDF to realize the characteristics of Fujisaki-Okamoto (FO) transformation or its variant HHK, wherein the updated second PQC shared secret is IND-CCA2 secure.

7. The apparatus of claim 1, wherein a value of the SUPI type is 4.

8. The apparatus of claim 2, wherein the PQC KEM public key is one of Kyber, BIKE, Hamming Quasi-Cycle, or Classical McEliece.

9. The apparatus according to claim 2, wherein the number of times the PQC KEM public key is reused is less than a predetermined threshold number.

10. An apparatus for communication, comprising: means for receiving, at a network device, a subscription concealed identifier SUCI from a terminal device for concealing a subscription permanent identifier SUPI of the terminal device, wherein the SUCI comprises a SUPI type indicating that both elliptic curve cryptography ECC and post-quantum cryptography PQC are used in the generation of the SUCI; and means for determining the SUPI by decrypting the SUCI.

Images