5G key generation / ECC key generation and SUCI computation

Abstract

The present disclosure provides a method for generating a 5G Subscriber Hidden Identifier (SUCI) for a 5G mobile communication network in a UICC. The method comprises the steps executed in a processing entity included in the UICC: (1) generating a public key / private key pair or an ECC public key / private key pair; (2) performing DH or ECDH derivation of the temporary shared key based on the public / private key pair or the ECC public / private key pair; (3) deriving a symmetric encryption key from the temporary shared key; (4) hiding at least a portion of the Subscriber Persistent Identifier, SUPI, in particular MSIN or username, with the generated symmetric key in order to calculate SUCI, characterized in that steps (1), (2) are triggered by the occurrence of a deterministic event at the UICC, and further comprising: storing the generated public / private key pair or ECC public / private key pair and a temporary shared key in a key memory provided in the UICC; and steps (3), (4) are triggered by receiving a GET IDENTITY command at the UICC after the steps (1), (2).

Description

Technical Field

[0001] The present invention relates to 5G key generation or ECC key generation and SUCI calculation in the UICC, in particular in the case of services 124 and / or 125 available in the UICC. Background Art

[0002] Mobile communication means communication of a mobile equipment ME (or user equipment UE) hosting a UICC in a mobile communication network. Mobile equipment ME is known in the form of, for example, smartphones, tablets, M2M devices and IoT devices. UICC is known in the form of, for example, a plug-in UICC (also known as a SIM card), an embedded UICC (also known as an eUICC) and an integrated UICC (also known as an iUICC).

[0003] In the communication in the 5G mobile communication network, the command GET_IDENTITY (get identity) sent from the mobile entity ME to the UICC triggers the calculation of the subscriber hidden identifier SUCI in the UICC. Part of the SUCI generation is the generation of an ECC (elliptic curve cryptography) public / private key pair, followed by the ECDH (elliptic curve Diffie Hellman) derivation of a temporary shared key, followed by the generation of a symmetric key and the encryption of a part of the subscriber permanent identifier SUPI (SUPI similarly corresponds to the IMSI of 4G and earlier networks) with the symmetric key in order to create the SUCI, where the encrypted MSIN is part of the SUCI. The hidden identifier SUCI is used in the secure network authentication process, which is superior to the plaintext identifier IMSI used in 4G and previous networks. In addition, when the symmetric key is generated, an initial counter block ICB is generated, a message authentication code MAC key is generated, and a MAC function with the MAC key is applied to calculate the MAC value to achieve authentication.

[0004] According to specification [1] 3GPP 31.102, V17.5.0, 2022-04, "Universal Mobile Telecommunications System (UMTS); LTE; 5G; Characteristics of the Universal Subscriber Identity Module (USIM) application (= ETSI TS131.102)", Chapter 4.2.8, the functions of the UICC are implemented by services available to the UICC, where service 124 is a service that implements subscription identifier privacy support and service 125 is a service that implements SUCI calculation by the USIM. Services 124 and 125 (if available) are available in file EF_UST of the UICC.

[0005] Instead of via the GET IDENTITY command, the generation of the ECC public / private key pair and the ECDH (Elliptic Curve DiffieHellman) temporary shared key generation may alternatively be triggered by receiving a STATUS-like APDU command at the UICC.

[0006] In detail, specification [1] 3GPP 31.102 section 5.3.48 describes the calculation of SUCI through the USIM procedure. Specification [2] 3GPP 33.501, V17.5.0, 2022-05, "5G; Security architecture and procedures for 5G System" (=ETSI TS133.501), Annex C.3.2, describes the ECIES key scheme, which includes the following steps: key generation, including (1) generation of an ECC public / private key pair and (2) ECDH derivation of a temporary shared key; (3) deriving a symmetric encryption key from the temporary shared key and generating an ICB and MAC key; (4) hiding the SUPI with the generated symmetric key and the ICB to calculate the SUCI, and (5) MAC calculation.

[0007] The processing time for ECC key pair generation and ECDH temporary key derivation is quite long, and for hardware chips with only moderate performance, meeting the requirement of outputting a readily computed SUCI within a preset time frame after the UICC receives the GET IDENTITY command may be a challenge that is not easily met. If the UICC exceeds the preset time frame after the GET IDENTITY command in order to output the computed SUCI back to the mobile device, the process terminates with failure.

[0008] Typically, instead of ECC public / private key pairs and ECDH key derivation, public / private key pairs and Diffie Hellman DH key derivation are known, in contrast to ECC public / private key pairs and ECDH key derivation based on elliptic curve cryptography ECC, which are not based on elliptic curve cryptography ECC.

[0009] According to specification [5] 3GPP 23.003 V16.3.0 (2020-10) (= ETSI TS123.003), several types of SUPI are defined, and depending on the value of the SUPI type, the SUPI can be an IMSI or a Network Access Identifier NAI. In order to generate the hidden identifier SUCI, a part of the SUPI is encrypted and used as part of the SUCI. If the SUPI type is IMSI, the MSIN is encrypted. If the SUPI type is NAI, the username is encrypted.

[0010] Document [3] WO2023016669A1 from the prior art discloses a method for calculating a subscriber hidden identifier SUCI in a UICC, the method being triggered by receiving a GET IDENTITY command at the UICC. The symmetric key used to encrypt SUPI into SUCI has been generated in the UICC before receiving the GET IDENTITY command. In particular, the symmetric key can be derived by the ECIES key scheme before receiving the GET IDENTITY command. Once the GET IDENTITY command is received at the UICC, the symmetric key generated before receiving the GET IDENTITY command reduces the time span required for SUCI calculation.

[0011] Document [4] WO2019068731A1 discloses pre-calculating SUCI in a UICC and storing pre-generated SUCI in the UICC. Due to the pre-calculation of SUCI, when a GET IDENTITY command is received at the UICC, it is not necessary to calculate SUCI, but only to call SUCI from the memory.

[0012] It would be desirable to have a method for SUCI generation which has a reduced time span required for SUCI generation when a GET IDENTITY command is received at the UICC and which is applicable to a variety of use cases and scenarios and in a controllable manner.

[0013] Purpose of the Invention

[0014] The object of the present invention is to provide a method for SUCI generation having a reduced time span required for SUCI generation when a GETIDENTITY command is received at the UICC and which can be applied in various use cases and situations and in a controllable manner. Summary of the invention

[0015] The object of the invention is achieved by a method according to claim 1 having the following features. Embodiments of the invention are presented in the dependent claims.

[0016] In more detail, the object of the present invention is achieved by a method for generating a 5G subscriber hidden identifier SUCI in a UICC, wherein when a GET IDENTITY command is received at the UICC, a subscriber permanent identifier SUPI is hidden by encrypting at least a part of the SUPI with a symmetric key to calculate a part of the SUCI. The method is characterized by the following combination of features: the generation of an ECC public / private key pair and the ECDH derivation of the temporary shared key are triggered by a deterministic event occurring at the UICC, rather than directly by receiving a GET IDENTITY command. In addition, after the deterministic event and after the generation of the ECC public / private key pair and the ECDH derivation of the temporary shared key triggered by the deterministic event, the derivation of the symmetric encryption key and the calculation of the SUCI using the symmetric encryption key are performed. Therefore, after the UICC receives the GETIDENTITY command, no time is needed for the ECDH derivation of the ECC public / private key pair and the temporary shared key. Instead, the ECC public / private key pair and the temporary shared key already exist in the key memory of the UICC and only need to be called from the key memory. Furthermore, deterministic events may be provided to cover various use cases and scenarios, as will be elaborated in detail below. Furthermore, deterministic events allow for control to ensure that SUCI computation time is reduced in a controlled manner.

[0017] Alternatively, a non-ECC public / private key pair may be used instead of an ECC public / private key pair.Instead of ECDH, DH may be used, ie non-ECC DH.

[0018] The proposed method thus provides a method for SUCI generation with a reduced time span required for SUCI generation upon receipt of a GETIDENTITY command at the UICC and the method is applicable to a variety of use cases and scenarios and in a controllable manner.

[0019] Preferably, services 124 and 125 according to [1] 3GPP 31.102 are available in the file EF_UST UICC and used in the SUCI calculation.

[0020] In particular, the proposed solution allows the use of chip hardware with relatively low performance and / or low cost and at the same time keeping the preset time frame for SUCI calculation as preset in the specification.

[0021] SUPI can be of IMSI type or NAI type. For IMSI type SUPI, the MSIN contained in the IMSI is encrypted (other parts such as MCC and MNC remain unencrypted) and integrated as part of SUCI. For NAI type SUPI, the username contained in the NAI is encrypted and integrated as part of SUCI.

[0022] The ECIES key scheme according to [5] also comprises a MAC generation, which is preferably also included in the method according to the invention.

[0023] Therefore, the method of the present invention preferably further comprises the following steps:

[0024] Together with (3) deriving the symmetric encryption key:

[0025] (3.1) generating an initial counter block ICB; or / and

[0026] (3.2) Generate a message authentication code MAC key; and in the case of (3.2),

[0027] Step (5) is triggered by receiving a GET IDENTITY command, and a MAC tag value is generated using a message authentication code MAC key.

[0028] According to some embodiments of the present invention, in steps (1.1) and (1.2), multiple public key / private key pairs or ECC public key / private key pairs and temporary shared keys are generated and stored in a key memory of the UICC.

[0029] According to the embodiments described herein, a stock of multiple public / private key pairs or ECC public / private key pairs and temporary shared keys is implemented, where the number of keys can be designed according to specific requirements and constraints such as hardware and / or memory and / or processing power.

[0030] According to some embodiments, deterministic events are established as:

[0031] - Consume the generated SUCI in the AUTHENTICATE command processed in the UICC after SUCI generation.

[0032] In other words, according to the method of the present invention, when the SUCI and thus the pre-generated key is consumed, a new key is pre-generated and stored, so that when the next authentication command requiring the SUCI is to be processed, the pre-generated key is available.

[0033] According to some embodiments, deterministic events are established as:

[0034] -After performing SUCI generation in the UICC, registering that one public / private key pair or ECC public / private key pair and the temporary shared key are consumed to generate the SUCI, the registered consumption of the public / private key pair or ECC public / private key pair and the temporary shared key acts as a trigger to generate a new public / private key pair or ECC public / private key pair and the temporary shared key, and storing the public / private key pair or ECC public / private key pair and the temporary shared key to the key storage.

[0035] According to some embodiments, where a deterministic event is established as:

[0036] - There are no or insufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys in the key storage.

[0037] According to some embodiments, a key status flag or a key counter connected to the key memory is implemented in the UICC, indicating the presence or absence of stored public / private key pairs or ECC public / private key pairs and temporary shared keys in the key memory, or a sufficient or insufficient number of stored public / private key pairs or ECC public / private key pairs and temporary shared keys.

[0038] According to some embodiments, the UICC further comprises monitor logic coupled to the key storage, the method further comprising the steps of:

[0039] - monitoring a key status flag or a key counter by the monitor logic;

[0040] -Wherein, a deterministic event is established when the monitor logic detects the absence or absence of a sufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys based on the monitored key status flags or key counters.

[0041] According to some embodiments, the insufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys in the key store is the number of: twenty, ten, five, one, or some other intermediate value from twenty to one.

[0042] According to some embodiments, deterministic events are established as:

[0043] - Loss of network coverage or connectivity in 5G mobile communications networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Embodiments of the present invention will now be described with reference to the accompanying drawings, wherein like parts are designated by like reference numerals throughout, and wherein:

[0045] Figure 1A method for ECC and ECDH key generation according to [2] 3GPP 33.501 Annex C.3.2 according to an embodiment of the present invention, with indication of steps triggered by deterministic events;

[0046] Figure 2 The structure of the IMSI according to [5] 3GPP 23.003 Chapter 2.2;

[0047] Figure 3 The SUPI part that is encrypted to generate the SUPI, and a data set output by the ECIES keying scheme used to generate the SUIC, according to [5] 3GPP 23.003 2.2B. DETAILED DESCRIPTION

[0048] Figure 1 The ECIES key scheme according to an embodiment of the present invention is shown, which includes (ECC) public / private key pair generation and (ECDH) temporary key generation according to [2] 3GPP 33.501 Appendix C.3.2, where the dotted circle surrounds the steps triggered by the deterministic event. In addition to the dotted circle, Figure 1 Corresponding to Figure C.3.2-1 of Appendix C.3.2 of 3GPP 33.501 [2]. According to the prior art of [1] and [2], Figure 1 The steps (see Figure C.3.2-1 of document [2] 3GPP 33.501) are triggered because the UICC receives a GET IDENTITY APDU command from the mobile device. According to the present invention, steps 1 and 2 surrounded by a circular dashed line are triggered by deterministic events. Only the steps outside the circle are triggered to be executed by the GET IDENTITY APDU command. The steps triggered by the GETIDENTITY APDU command are step 3: key derivation of an encryption key for encrypting a portion of the SUPI, step 4: encrypting a portion of the SUPI to generate a portion of the SUCI, and step 5) generating a MAC key and generating a MAC value.

[0049] Figure 2 The structure of the IMSI according to [2] 3GPP 23.003 Chapter 2.2 is shown. The IMSI consists of the MCC, MNC and MSIN. Only the MSIN is encrypted to generate the SUPI. The MCC and MNC remain unencrypted.

[0050] Figure 3 The SUPI parts that are encrypted to generate the SUPI are shown, namely the MSIN for an IMSI type SUPI and the username for an NAI type SUPI.

[0051] Figure 3Further shown is a data set of three data elements output by the ECIES keying scheme for generating SUICI according to [5] 3GPP 23.003 2.2B. Figure 1 , the MSIN or username is input as a plaintext block to step 4 for encryption using symmetric encryption (key) to generate a ciphertext value as the output of step 4, which is in Figure 3 is shown as the middle data element of the three data elements. Figure 1 , Step 1, Generate an ECC (temporary) public key / private key pair. The ECC (temporary) public key is also output from the ECIES key scheme and is Figure 3 The left data element is shown as three data elements. Figure 1 , based on the ciphertext value and the (temporary) MAC key, the MAC function of step 5 is used to generate a MAC tag value, and the MAC tag value is also output as part of the ECIES scheme, and in Figure 3 The right data element of the three data elements output by the ECIES key scheme is shown in FIG.

[0052] References

[0053] [1] 3GPP 31.102, V17.5.0, 2022-04, "Universal Mobile Telecommunications System (UMTS); LTE; 5G; Characteristics of the Universal Subscriber IdentityModule (USIM) application (= ETSI TS131.102)";

[0054] [2]3GPP 33.501, V17.5.0, 2022-05, "5G; Security architecture and procedures for 5G System" (=ETSI TS 133.501)

[0055] [3]WO2023016669A1

[0056] [4] WO2019068731A1

[0057] [5]3GPP 23.003 V16.3.0(2020-10)(=ETSI TS 123.003).

Claims

1. A method for generating a 5G Subscriber Hidden Identifier (SUCI) for a 5G mobile communication network in a UICC, the method comprising the steps performed in a processing entity included in the UICC: (1) Generate a public key / private key pair or an ECC public key / private key pair; (2) performing DH or ECDH derivation of a temporary shared key based on a public / private key pair or an ECC public / private key pair; (3) deriving a symmetric encryption key from the temporary shared key; (4) hiding at least a part of the subscriber permanent identifier SUPI, in particular the MSIN or the user name, with the generated symmetric key to calculate the SUCI, Features - Steps (1) and (2) are triggered by the occurrence of a deterministic event at the UICC, and further include: storing the generated public key / private key pair or ECC public key / private key pair and the temporary shared key in a key storage provided in the UICC; and - Steps (3) and (4) are triggered by receiving a GET IDENTITY command at the UICC after steps (1) and (2).

2. The method according to claim 1, further comprising the steps of: Together with step (3) to derive the symmetric encryption key: (3.1) generating an initial counter block ICB; or / and (3.2) Generate a message authentication code MAC key; and in the case of (3.2), Step (5) is triggered by receiving the GET IDENTITY command, and the MAC tag value is generated using the message authentication code MAC key.

3. The method according to claim 1 or 2, wherein: In steps (1.1) and (1.2), a plurality of public key / private key pairs or ECC public key / private key pairs and a temporary shared key are generated and stored in the key memory of the UICC.

4. The method according to any one of claims 1 to 3, wherein: The deterministic events are established as: - Consume the generated SUCI in the AUTHENTICATE command processed in the UICC after SUCI generation.

5. The method system according to any one of claims 1 to 3, wherein: The deterministic events are established as: -After performing SUCI generation in the UICC, registering that one public / private key pair or ECC public / private key pair and the temporary shared key are consumed to generate the SUCI, the registered consumption of the public / private key pair or ECC public / private key pair and the temporary shared key acts as a trigger to generate a new public / private key pair or ECC public / private key pair and the temporary shared key, and storing the public / private key pair or ECC public / private key pair and the temporary shared key to the key storage.

6. The method system according to any one of claims 1 to 3, wherein: The deterministic events are established as: - There are no or insufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys in the key storage.

7. The method according to any one of claims 4 to 6, wherein: A key status flag or a key counter connected to the key memory is implemented in the UICC, indicating whether there is a stored public key / private key pair or ECC public key / private key pair and a temporary shared key in the key memory, or whether the number of stored public key / private key pairs or ECC public key / private key pairs and temporary shared keys is sufficient.

8. The method according to claim 7, wherein: The UICC further comprises monitor logic coupled to the key storage, the method further comprising the steps of: - monitoring the key status flag or key counter by the monitor logic; -Wherein, the deterministic event is established when the monitor logic detects the absence or absence of a sufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys based on the monitored key status flag or key counter.

9. The method according to any one of claims 4 to 8, wherein: The insufficient number of public / private key pairs or ECC public / private key pairs and temporary shared keys in the key store is the following number: twenty, ten, five, one, or some other intermediate value from twenty to one.

10. The method system according to any one of claims 1 to 3, wherein: The deterministic events are established as: - Loss of network coverage or connectivity in 5G mobile communications networks.

Images