Authentication of a communication device using homomorphic encryption

Abstract

Security mechanisms for communication networks. In one embodiment, a communication device includes a subscriber identity module (SIM) and a mobile device. The mobile device is configured to send a registration request for registration with a home network of the communication device, receive an authentication request message containing a homomorphically encrypted SIM authentication challenge computed by the home network using homomorphic encryption to authenticate the SIM, and provide the homomorphically encrypted SIM authentication challenge to the SIM. The SIM is configured to compute a homomorphically encrypted SIM challenge response based on the homomorphically encrypted SIM authentication challenge. The mobile device is configured to receive the homomorphically encrypted SIM challenge response computed by the SIM, and send an authentication response message containing the homomorphically encrypted SIM challenge response.

Description

Technical Field

[0001] This disclosure relates to the field of communication networks, and particularly to security in communication networks. Background Technology

[0002] Mobile telecommunications networks or cellular networks (generally referred to herein as communication networks or mobile networks) enable communication between two or more communication devices, provide communication devices with access to data networks, deliver services provided by third-party applications to communication devices, and / or provide services provided by the communication network to communication devices. Communication networks and communication devices can operate according to cellular technologies (also known as radio access technologies), such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications Service (UTMS), Long Term Evolution (LTE or LTE-A), and New Radio (NR). Cellular technologies are standardized by various standards organizations, such as the 3rd Generation Partnership Project (3GPP) or the European Telecommunications Standards Institute (ETSI). 3GPP is currently developing fifth-generation cellular technologies (generally referred to as 5G or NR standards) and sixth-generation cellular technologies (generally referred to as 6G or NR standards). Communication networks operating according to 5G or NR standards are generally referred to as 5G networks or 5G systems, while communication networks operating according to 6G standards are generally referred to as 6G networks or 6G systems; both can generally be referred to as next-generation networks (i.e., networks following the fourth-generation (4G) standard).

[0003] Communication networks (e.g., 5G or 6G networks) include access networks (e.g., radio access networks), which can wirelessly communicate with one or more communication devices by sharing the available resources (e.g., bandwidth, transmit power, etc.) of the access network. Communication networks can also establish reliable and secure connections between communication devices and the core network of the communication network via the access network. With the widespread use of communication networks across countries and around the world, communications may be intercepted or subjected to other types of attacks. To ensure security and privacy, 3GPP and / or other organizations have been working to develop security mechanisms for communication networks and the security processes performed within them. Given the importance of security in communication networks, there is a desire to continue developing improved security mechanisms. Summary of the Invention

[0004] This document describes enhancements to security mechanisms used in communication networks. As an overview, the communication network provides an enhanced authentication process for communication devices (e.g., 6G devices). The communication network can use authentication processes (such as a master authentication process) to perform mutual authentication with the communication device before authorizing access to services. Traditional authentication processes involve an authentication challenge issued by the communication network to the communication device (i.e., an authentication challenge to the communication device's Subscriber Identity Module (SIM), and the communication network evaluates the challenge response or answer to authenticate the communication device. In the embodiments described herein, the authentication challenge issued by the communication network can be encrypted using homomorphic encryption. The communication device can perform computation (e.g., using a homomorphic encryption evaluation function) on the homomorphically encrypted authentication challenge to generate a homomorphically encrypted challenge response. The communication network can then decrypt the homomorphically encrypted challenge response from the communication device and evaluate the decrypted challenge response to authenticate the communication device. One technical advantage is that the authentication challenge and corresponding challenge response are encrypted using homomorphic encryption to prevent attacks. Another technical advantage is that, due to the nature of homomorphic encryption, communication devices can directly perform computation on homomorphically encrypted authentication challenges when generating challenge responses, without having to decrypt the authentication challenges, which saves time and computing resources within the communication device.

[0005] In one embodiment (also referred to as an aspect), a communication device includes a Subscriber Identity Module (SIM) and a mobile device, the mobile device including at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, cause the mobile device to at least: send a registration request to register with a home network of the communication device; receive an authentication request message containing a homomorphically encrypted SIM authentication challenge computed by the home network using homomorphic encryption for authenticating the SIM; and provide the homomorphically encrypted SIM authentication challenge to the SIM. The SIM is configured to compute a homomorphically encrypted SIM challenge response based on the homomorphically encrypted SIM authentication challenge. When executed by the at least one processor, the instructions also cause the mobile device to at least: receive the homomorphically encrypted SIM challenge response computed by the SIM; and send an authentication response message containing the homomorphically encrypted SIM challenge response.

[0006] In one embodiment, an apparatus includes: a home network authentication entity in the home network of a communication device, the apparatus including at least one processor and at least one memory storing instructions. The communication device includes a mobile device and a subscriber identity module (SIM). When executed by the at least one processor, the instructions cause the home network authentication entity to perform at least: receiving an authentication request message regarding the registration of the communication device with the home network, calculating a homomorphically encrypted SIM authentication challenge for authenticating the SIM of the communication device using homomorphic encryption, and sending an authentication response message containing the homomorphically encrypted SIM authentication challenge.

[0007] Other embodiments may include computer-readable media, other systems or apparatuses, or other methods or components as described below. Furthermore, one or more embodiments as described above may be combined as illustrated herein.

[0008] The foregoing summary provides a basic understanding of some aspects of this specification. This summary is not a comprehensive overview of the specification. It is not intended to identify key or essential elements of the specification, nor to define any scope of any particular embodiment or claim. Its sole purpose is to present some concepts of the specification in a simplified form as a prelude to a more detailed description later. Attached Figure Description

[0009] Some embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings. Throughout the drawings, the same reference numerals denote the same elements or elements of the same type.

[0010] Figure 1 The diagram illustrates the advanced architecture of a 5G system;

[0011] Figure 2 The diagram illustrates the non-roaming architecture of a 5G system;

[0012] Figure 3 The diagram illustrates the security mechanisms within a 5G system;

[0013] Figure 4 The diagram illustrates the advanced architecture of a 6G system;

[0014] Figure 5 This is a block diagram of a system for providing security management in an illustrative embodiment;

[0015] Figure 6 This is a block diagram of a user equipment (UE) in an illustrative embodiment;

[0016] Figure 7 The illustration shows the authentication process between a 6G device and its home network in an illustrative embodiment;

[0017] Figure 8 This is a message diagram illustrating the authentication process between a 6G device and its home network in an illustrative embodiment.

[0018] Figure 9 This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0019] Figure 10 This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0020] Figure 11A The illustration shows the authentication entity of the home network in an illustrative embodiment;

[0021] Figure 11B The illustration shows the authentication entity of a 6G device in an illustrative embodiment;

[0022] Figure 12 This is a message diagram illustrating the authentication process between a 6G device and its home network in an illustrative embodiment.

[0023] Figures 13A-13B This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0024] Figures 14A-14B This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0025] Figure 15A The illustration shows the generation of the authentication vector in an illustrative embodiment;

[0026] Figure 15B The illustration shows the generation of a challenge response in an illustrative embodiment;

[0027] Figure 16A The illustration shows the authentication entity of the home network in an illustrative embodiment;

[0028] Figure 16B The illustration shows the authentication entity of a 6G device in an illustrative embodiment;

[0029] Figure 17 The illustration shows SUCI in an illustrative embodiment;

[0030] Figures 18A-18B The illustrations respectively depict SUPI hiding and dehiding in the illustrative embodiments;

[0031] Figure 19 This is a message diagram illustrating the authentication process between a 6G device and its home network in an illustrative embodiment.

[0032] Figures 20A-20C This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0033] Figures 21A-21B This is a flowchart illustrating a method for performing an authentication process in an illustrative embodiment;

[0034] Figure 22A The illustration shows the authentication entity of the home network in an illustrative embodiment;

[0035] Figure 22B The illustration shows the authentication entity of a 6G device in an illustrative embodiment;

[0036] Figure 23 This is a block diagram of the key derivation function (KDF) in an illustrative embodiment; and

[0037] Figure 24 It is an illustrative embodiment. Figure 9 A flowchart of the additional steps of the method. Detailed Implementation

[0038] The accompanying drawings and the following description illustrate specific exemplary embodiments. Therefore, it should be understood that those skilled in the art will be able to design various arrangements, which, although not explicitly described or shown herein, embody the principles of the embodiments and are included within the scope of the embodiments. Furthermore, any examples described herein are intended to aid in understanding the principles of the embodiments and should be construed as not being limited to these specifically referenced examples and conditions. Therefore, the inventive concept is not limited to the specific embodiments or examples described below, but is defined by the claims and their equivalents.

[0039] Figure 1 The diagram illustrates the high-level architecture of a 5G system 100. The 5G system (5GS) 100 is a communication system (e.g., a 3GPP system) that includes an access network ((R)AN) 102 (also referred to herein as RAN, 5G access network, etc.) and a core network 104 (also referred to herein as 5G core network or 5GC) that communicate with user equipment (UE) 106 (e.g., a 5G-enabled UE, which is generally referred to as a communication device). RAN 102 and core network 104 together may be referred to as a 5G network 101, a 5G mobile network, a 5G communication network, a next-generation network, etc.

[0040] RAN 102 provides radio or wireless connectivity to UE 106 and connects UE 106 to core network 104. RAN 102 may include a Next Generation Radio Access Network (NG-RAN), Evolved Universal Terrestrial Radio Access Network (E-UTRAN), Non-3GPP Access Network (N3AN), Non-Terrestrial Access Network (NTN), and / or another type of RAN connected to core network 104. RAN 102 may support access via at least one RAN node, such as a gNodeB (gNB), ng-eNodeB (ng eNB), eNodeB (eNB), and / or a Wireless Local Area Network (WLAN) access point. RAN 102 may support satellite radio access, New Radio Access Technology (RAT), etc. 5G access networks may also support fixed access. Core network 104 interconnects RAN 102 with data network (DN) 108. The core network 104 comprises network functions (NFs) 110, which can be implemented as network elements on dedicated hardware, chips or chipsets included in network elements, software instances running on dedicated hardware, virtualized network functions (VNFs) instantiated on dedicated or general virtualization platforms (e.g., cloud infrastructure), etc. The data network 108 can be a public or private data network outside the operator, or a data network within the operator (e.g., for IP Multimedia Subsystem (IMS) services). The UE 106 (also referred to as a mobile terminal or communication device) includes 5G-enabled devices configured to register with the core network 104 to access services. The UE 106 can include end-user equipment such as mobile phones (e.g., smartphones), tablets, computers with mobile broadband adapters, etc. The UE 106 can be enabled for voice services, data services, machine-to-machine (M2M) or machine-type communication (MTC) services, and / or other services.

[0041] Figure 2 The diagram illustrates the non-roaming architecture 200 of a 5G system. Figure 2Architecture 200 is a service-based representation, as further described in 3GPP TS 23.501 (Release 19), which is incorporated herein by reference as if fully included herein. Architecture 200 consists of network functions (NFs) of core network 104, with the NFs for the control plane (CP) separate from the user plane (UP). The control plane of core network 104 includes Authentication Server Function (AUSF) 210, Access and Mobility Management Function (AMF) 212, Session Management Function (SMF) 214, Policy Control Function (PCF) 216, Unified Data Management (UDM) 218, Network Slice Selection Function (NSSF) 220, and Application Function (AF) 222. The control plane of core network 104 also includes Network Open Function (NEF) 224, NF Repository Function (NRF) 226, Serving Communication Agent (SCP) 228, Network Slice Admission Control Function (NSACF) 230, Network Slice Specific and SNPN Authentication and Authorization Function (NSSAAF) 232, and Edge Application Server Discovery Function (EASDF) 234. The user plane of core network 104 includes one or more User Plane Functions (UPF) 240 that communicate with data network 108. UE 106 can access the control plane and user plane of core network 104 via RAN 102.

[0042] Typically, UE 106 can have service availability when it connects to the Home Public Land Mobile Network (HPLMN) or its home network via one or more access types (such as 3GPP access and non-3GPP access (trusted or untrusted)). UE 106 can also have service availability when it connects to the Visited Public Land Mobile Network (VPLMN) or its serving network via one or more access types (again, such as 3GPP access and non-3GPP access (trusted or untrusted)).

[0043] A large number of subscribers are able to access services from operators or home / mobile network operators that implement mobile networks including 5G System 100, such as Figures 1-2 As shown. Communication between the user or subscriber (i.e., through the UE) and the mobile network is protected by security mechanisms, such as those standardized by 3GPP. Subscribers and carriers expect security guarantees from these mechanisms.

[0044] Figure 3The diagram illustrates security mechanisms 300 within the 5G system 100. One of these security mechanisms 300 is the master authentication and key negotiation between the network (e.g., AMF212 / UDM 218) and UE 106. Other security mechanisms 300 are used to protect signaling between the network and UE 106. For example, security mechanism 300 is used to protect non-access stratum (NAS) signaling between AMF 212 and UE 106. Other security mechanisms 300 are used to protect access stratum (AS) communications between RAN nodes (e.g., gNB 306) and UE 106, such as Radio Resource Control (RRC) signaling between gNB 306 and UE 106, and user plane (UP) services (also known as UP data) between gNB 306 and UE 106. Within the network, security mechanisms 300 can be used to protect IP connections between gNB 306 and core network 104 (e.g., AMF 212 / UPF 240), such as Internet Protocol Security (IPSec). Another security mechanism 300 is used for roaming and interconnection security, such as protecting control plane signaling between the Security Edge Protection Agent (SEPP) 310 and another network 301 (e.g., a visited 5G network), and / or protecting user plane data between the UPF 240 and other networks 301. Another security mechanism 300 can be used to protect the IP connection between the gateway 320 (e.g., in the case of untrusted non-3GPP access, Non-3GPP Interoperability Function (N3IWF)) and the UE 106. Additional security mechanisms 300 can be defined or used; for the sake of brevity, they will not be discussed here.

[0045] 6G is the next generation of cellular networks built on 5G learning and technology, such as enabling new and expanded use cases and new and enhanced capabilities. Figure 4 The diagram illustrates the high-level architecture of a 6G system 400. The 6G system (6GS) 400 is a communication system (e.g., a 3GPP system) that includes a 6G access network (AN) 402 and a 6G core network 404 (often also referred to as 6CN) communicating with one or more 6G devices 406. Together, the 6G AN 402 and the 6G core network 404 can be referred to as a 6G network 401, a 6G mobile network, a 6G communication network, etc.

[0046] 6G AN 402 may include a 6G Radio Access Network (RAN) 403 that provides radio or wireless connectivity to 6G devices 406 and connects 6G devices 406 to the 6G core network 404. 6G RAN 403 may include one or more 6G NodeBs (NBs) 408, which are RAN nodes (e.g., radio base stations) responsible for the radio link between mobile users and the fixed portion of the network. 6G core network 404 consists of 6G Network Functions (NFs) 405 for the control plane and user plane. 6G NFs 405 may be implemented as network elements on dedicated hardware, chips or chipsets included in network elements, software instances running on dedicated hardware, virtualized network functions (VNFs) instantiated on dedicated or general virtualization platforms (e.g., cloud infrastructure), etc. As an example of a control plane, 6G NF 405 may include a 6G Mobility Management (MM) NF 412 configured to manage the mobility of devices within 6G network 401. The 6G MM NF 412 may provide functionality similar to the AMF 212 described for 5G. Although not specifically shown, the 6G MM NF 412 may include a 6G Security Anchor Function (SEAF) providing authentication functionality in the serving network of 6G device 406. 6G NF 405 may include a 6G Authentication Server (AUS) NF 410 configured to perform 6G authentication within 6G network 401. The 6G AUS NF 410 may provide functionality similar to the AUSF 210 described for 5G. 6G NF 405 may include a 6G Unified Data Management (UDM) NF 418 configured to manage user data within 6G network 401. The 6G UDM NF 418 may provide functionality similar to the UDM 218 described for 5G. The 6G device 406 (also known as a 6G-enabled device, a 6G-capable device, a 6G communication device, etc.) is configured to register with the 6G network 401 to access services, and in some embodiments may be referred to as a user equipment (UE) or a 6G user equipment (UI).

[0047] Since 6G can be developed or evolved from 5G, some of the concepts or systems described in this article for 5G can be incorporated into the discussion of 6G. Furthermore, while the examples provided in this article may relate to 6G, similar concepts can be applied to any next-generation or future-generation network other than 5G, 5.5G, advanced 5G, or 5G.

[0048] Figure 5 This is a block diagram of a system 500 for providing security management in an illustrative embodiment. More specifically, Figure 5System 500 includes at least one 6G device 406, at least one 6G RAN node 504, and multiple 6G network elements / functions 405 (i.e., first network element / function 405-1 and second network element / function 405-N). It should be understood that the 6G device 406, 6G RAN node 504, and network elements / functions 405 are configured to interact to provide security management (also known as protection management). Examples of network elements / functions 405 (typically referred to as core NFs) may include, but are not limited to, 6G MM NF 412, 6G AUS NF 410, and 6G UDM NF 418. The 6G RAN node 504 is an access network element / function configured to provide the 6G device 406 with access to the 6G core network 404, such as via 3GPP access or non-3GPP access. Therefore, the 6G RAN node 504 is configured to be communicatively coupled to the 6G device 406 via an air interface. An example of the 6G RAN node 504 is a 6G NB 408.

[0049] Network element / function 405-1 includes a processor 522-1 coupled to memory 526-1 and interface circuitry 520-1. The processor 522-1 of network element / function 405-1 includes a security management processing module 524-1, which can be implemented at least partially in the form of software executed by the processor 522-1. The security management processing module 524-1 performs security management as described in conjunction with the following figures and other methods herein. Memory 526-1 includes a security management storage module 528-1 storing data generated or otherwise used during security management operations.

[0050] Network element / function 405-N includes a processor 522-N coupled to memory 526-N and interface circuitry 520-N. The processor 522-N of network element / function 405-N includes a security management processing module 524-N, which can be implemented at least partially in the form of software executed by the processor 522-N. The security management processing module 524-N performs security management as described in conjunction with the following figures and other methods herein. Memory 526-N includes a security management storage module 528-N storing data generated or otherwise used during security management operations.

[0051] The processors 522-1 and 522-N of the corresponding network elements / functions 405-1 and 405-N may include, for example, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or other types of processing devices or integrated circuits, as well as portions or combinations of these elements. Such integrated circuit devices and portions or combinations thereof are examples of the "circuit system" used herein. Various other arrangements of hardware and associated software or firmware may be used in implementing the illustrative embodiments.

[0052] The memories 526-1 and 526-N of the corresponding network elements / functions 405-1 and 405-N can be used to store one or more software programs executed by the corresponding processors 522-1 and 522-N to implement at least a portion of the functions described herein. For example, security management operations and other functions, in conjunction with the following figures and otherwise described herein, can be implemented directly using software code executed by processors 522-1 and 522-N.

[0053] Therefore, a given memory in memories 526-1 and 526-N can be considered as an example of content more generally referred to herein as a computer program product, or more generally as a processor-readable storage medium in which executable program code is embodied. Other examples of processor-readable storage media may include any combination of magnetic disks or other types of magnetic or optical media. Illustrative embodiments may include articles of manufacture including such computer program products or other processor-readable storage media.

[0054] For example, memories 526-1 and 526-N may more specifically include electronic random access memory (RAM), such as static RAM (SRAM), dynamic RAM (DRAM), or other types of volatile or non-volatile electronic memory. The latter may include, for example, non-volatile memory, such as flash memory, magnetic RAM (MRAM), phase-change RAM (PC-RAM), or ferroelectric RAM (FRAM). The term "memory" as used herein is intended to be interpreted broadly and may additionally or alternatively include, for example, read-only memory (ROM), disk-based memory, or other types of storage devices, and portions or combinations thereof.

[0055] The interface circuitry systems 520-1 and 520-N of the corresponding network elements / functions 405-1 and 405-N illustratively include transceivers or other communication hardware or firmware, application programming interfaces (APIs), etc., which allow associated system elements to communicate with each other in the manner described herein.

[0056] Network element / function 405-1 is configured to communicate with network element / function 405-N via its respective interface circuit systems 520-1 and 520-N, and vice versa. This communication involves network element / function 405-1 sending data to network element / function 405-N, and network element / function 405-N sending data to network element / function 405-1. However, in alternative embodiments, other network elements may be operatively coupled between network elements / functions 405-1 and 405-N. The term "data" as used herein is intended to be interpreted broadly to encompass any type of information that may be sent between network elements or functions (and between 6G device 406 and 6G core network 404), including but not limited to messages, identifiers, keys, indicators, user data, control data, etc.

[0057] The 6G RAN node 504 includes a processor 512 coupled to a memory 516 and an interface circuitry 510. The processor 512 of the 6G RAN node 504 includes a security management processing module 514, which can be implemented at least partially in the form of software executed by the processor 512. The security management processing module 514 performs security management as described in conjunction with the following figures and other methods herein. The memory 516 includes a security management storage module 518 storing data generated or otherwise used during security management operations. The 6G RAN node 504 is configured to communicate with one or more 6G devices 406 and one or more network elements / functions 405 via the interface circuitry 510. For example, the interface circuitry 510 may be configured to communicate wirelessly with the 6G devices 406 via an air interface and may be configured to perform backhaul communication with one or more network elements / functions 405 of the 6G core network 404.

[0058] The 6G device 406 includes a processor 532 coupled to a memory 536 and an interface circuitry 530. The processor 532 of the 6G device 406 includes a security management processing module 534, which can be implemented at least partially in the form of software executed by the processor 532. The security management processing module 534 performs security management as described in conjunction with the following figures and other methods herein. The memory 536 includes a security management storage module 538 storing data generated or otherwise used during security management operations. The 6G device 406 is configured to communicate with one or more 6G RAN nodes 504 via the interface circuitry 530. For example, the interface circuitry 530 may be configured to communicate wirelessly with the 6G RAN nodes 504 via an air interface.

[0059] It should be understood that Figure 5The specific arrangement of the components shown is an example, and many alternative configurations can be used in other embodiments. For example, any given network element / function can be configured to include additional or alternative components and support other communication protocols.

[0060] Other system components can also be configured to include components such as processors, memory, and network interfaces. These components do not need to be implemented on separate, independent processing platforms, but can represent different functional parts of a single general-purpose processing platform.

[0061] An example of the 6G device 406 described in this article is a User Equipment (UE), which may be referred to as a 6G UE. A User Equipment (UE) is a communication device that an end user uses directly for communication. Figure 6 This is a block diagram of UE 600 in an illustrative embodiment. From a functional perspective, UE 600 comprises at least two parts: a mobile device (ME) 601 and a subscriber identity module (SIM) 660. ME 601 includes hardware such as a wireless interface component 602, one or more processors 604, and memory 606, and may also include a user interface component 608. UE 600 may also include a battery 610. The wireless interface component 602 is an example of an interface circuitry system and is a hardware component or device representing the UE 600's local wireless resources, such as a radio frequency (RF) unit 620 (e.g., one or more wireless transceivers) and one or more antennas 622. The wireless interface component 602 can be configured for 6G radio, 5G New Radio (NR), Long Term Evolution (LTE), WiFi, Bluetooth, etc. Processor 604 represents the internal circuitry, logic, hardware, components, etc., that provide the functionality of UE 600. Processor 604 can be configured to execute instructions 640 of software loaded into memory 606. Processor 604 may execute an operating system (OS) 634 for the UE 600 that manages hardware and software resources, and one or more application clients 635 for the applications(s). Processor 604 may also execute a security controller 636, which includes components or parts for implementing security mechanisms within the UE 600, such as authentication mechanisms, integrity protection mechanisms, and / or encryption mechanisms. Memory 606 may store the ME identifier or identifier (ID) of ME 601, such as the International Mobile Equipment Identity (IMEI) 642. User interface component 608 is a hardware component for interacting with an end user. For example, user interface component 608 may include a display 650, a screen, a touchscreen, etc. (e.g., a liquid crystal display (LCD), a light-emitting diode (LED) display, etc.). User interface component 608 may include a keyboard or keypad, a tracking device (e.g., a trackball or trackpad), a speaker, a microphone, etc.

[0062] SIM 660 is a secure, tamper-proof element protecting network access. SIM 660 can be enabled for 5G, 6G, and other functions. In one embodiment, SIM 660 may include a Universal Subscriber Identity Module (USIM) 662, such as a 6G USIM, implemented on a Universal Integrated Circuit Card (UICC) 664. UICC 664 is a smart card that serves as a platform for various applications, such as USIM 662. USIM 662 is used for managing authentication, storing network configurations, facilitating secure communication with the network, etc. In one embodiment, SIM 660 may include an embedded SIM (eSIM) 666, such as a 6G eSIM, mounted on an embedded UICC (eUICC) 668. eSIM 666 is directly embedded in the device as software installed on eUICC 668. SIM 660 includes or is supplied with a subscription profile 670 associated with a subscriber's subscription. Subscription profile 670 may include various information and / or subscription certificates used to uniquely identify the subscription, mutually authenticate UE 600 and the network, such as a Subscription Permanent Identifier (SUPI) 672 or another type of identifier, one or more long-term keys or keys, etc. UE 600 may include... Figure 6 Various other components not specifically illustrated.

[0063] Security mechanisms known as authentication are used to authenticate communication devices before authorizing access to a network (e.g., the home network). Figure 7 The illustration depicts an authentication process 750 between a 6G device 406 and its home network 704 in an illustrative embodiment. The authentication process 750 enables mutual authentication between the 6G device 406 and its home network 704. The home network 704 (e.g., HPLMN) represents an operator network or carrier network through which subscribers subscribe to services. The home network 704 (also referred to as the 6G home network) includes one or more authentication entities 720. Authentication entities include circuit systems, logic, servers, network functions, components, etc., configured to perform one or more authentication processes 750. In the home network 704, authentication entity 720 (also referred to as the home network authentication entity) may include or be implemented in a UDM NF 418, AUS NF 410, and / or other types of NFs. Similarly, the 6G device 406 includes one or more authentication entities 710. In the 6G device 406, authentication entity 710 may include or be implemented in an ME 601 and / or SIM 660.

[0064] For general authentication, the serving network 706 (e.g., MM NF 412) sends an authentication data request 741 (also referred to herein as an authentication acquisition request or authentication request) about the 6G device 406 to the home network 704. The serving network 706 is a network that allows 6G devices to connect to its home network 704 and may have a wireless access device capable of communicating with the 6G device via radio signals. The authentication entity 720 at the home network 704 generates an authentication vector 730 (or an array of authentication vectors), which is the authentication data or parameter set used in the authentication process. One or more parameters of the authentication vector 730 are referred to as authentication challenges (CHAL) 732, which are data or information that challenge the 6G device 406 to prove possession of a shared secret, to provide a valid response based on the value or parameters of the challenge, etc. The authentication entity 720 at the home network 704 sends an authentication data response 742 (also referred to herein as an authentication acquisition response or authentication response) containing the authentication vector 730 to the serving network 706. The serving network 706 sends a device (or UE) authentication request 743 (also referred to herein as an authentication request) containing authentication data (such as authentication challenge 732) to the 6G device 406. The authentication entity 710 at the 6G device 406 generates or calculates a challenge response 736 (RES) to the authentication challenge 732 and sends a device authentication response 744 (also referred to herein as an authentication response) containing the challenge response 736 to the serving network 706. The serving network 706 may verify the challenge response 736, and / or may send an authentication request 745 to the home network 704 to verify the challenge response 736. The steps performed for the authentication process 750 and / or the data generated may depend on the authentication method 752 selected for authentication.

[0065] In one embodiment, authentication entities 710 and 720 are configured or enabled for homomorphic encryption 712 (and decryption). Homomorphic encryption 712 is a form of encryption in which data (i.e., plaintext or plaintext) is transformed into ciphertext and can be computed on the ciphertext without compromising encryption (i.e., as if the data were still in its original plaintext form). In mathematics, homomorphism refers to transforming data in a first set into a second set, in which operations or relationships between members or elements of the first set are preserved. Because the data in homomorphic encryption 712 maintains the same structure, the same mathematical operations will provide equivalent results whether operations are performed on the encrypted or decrypted data. Typically, types of homomorphic encryption 712 can include partially homomorphic encryption, where defined operations can be performed on the ciphertext an unlimited number of times; partially homomorphic encryption (where a finite number of additions or multiplications can be performed on the ciphertext); and fully homomorphic encryption (where an unlimited number of additions or multiplications can be performed on the ciphertext). Homomorphic encryption 712 as described herein can be of different types, such as fully homomorphic encryption.

[0066] When generating the authentication vector 730 at the home network 704, the authentication entity 720 can generate or compute an authentication challenge 732 encrypted using homomorphic encryption 712, referred to as the homomorphically encrypted authentication challenge 734 (HENC_CHAL). Homomorphic encryption can be abbreviated as "HENC" in this document. When generating the challenge response 736 at the 6G device 406, the authentication entity 710 can generate or compute the challenge response 736, where computation or processing is performed directly on the homomorphically encrypted authentication challenge 734 (i.e., without prior decryption), referred to as the homomorphically encrypted challenge response 738 (HENC_RES). One technical advantage of using homomorphic encryption 712 is that computation can be performed on encrypted data without first decrypting the data. This saves processing resources in the 6G device used for the authentication process 750 and protects the privacy of the data being exchanged and / or processed.

[0067] Figure 8 This is a message diagram 800 illustrating the authentication process 750 between a 6G device 406 and its home network 704 in an illustrative embodiment. The authentication process 750 may be referred to as 6G primary authentication. Primary authentication is typically described in 3GPP TS 33.501 (Release 19) (which is incorporated herein by reference as if fully included herein), and the concepts described below can be used to enhance primary authentication as described in 3GPP TS 33.501.

[0068] Figure 9 This is a flowchart illustrating a method 900 for performing an authentication process 750 in an illustrative embodiment. The steps of method 900 will be described with reference to the authentication entity 720 of the home network 704 (e.g., UDM NF 418 and / or AUS NF 410), but it should be understood that the method can be performed in other devices, components, functions, systems, etc. Figure 10 This is a flowchart illustrating a method 1000 for performing an authentication process 750 in an illustrative embodiment. The steps of method 1000 will be described with reference to the authentication entity 710 of a 6G device 406 (e.g., ME 601 and / or SIM 660), but it should be understood that the method can be performed in other devices, components, functions, systems, etc. The steps in the flowchart described herein are not inclusive, but may include other steps not shown, and these steps may be performed in an alternative order.

[0069] exist Figure 8 In this context, the MM NF 412 of the serving network 706 can initiate authentication by sending an authentication request message 832 to the home network 704, thereby invoking the authentication service for the home network 704 (e.g., HPLMN) to authenticate the 6G device 406. For example, the UDM NF 418 receives or initiates authentication request message 832 regarding or for authentication of the 6G device 406 (see [link to UDM NF 412]). Figure 9 (Step 902 in the process). After receiving the authentication request message 832, the UDM NF 418 can select an authentication method 752 for the authentication process 750. In one embodiment, the authentication method 752 includes homomorphic encryption 712. The authentication method 752 using homomorphic encryption 712 can be a variant of the Authentication and Key Agreement (AKA) or Extensible Authentication Protocol AKA Prime (EAP-AKA`) described in 3GPP TS 33.501, or it can be a newly defined authentication method 752. As part of the authentication, the UDM NF 418 generates an authentication vector 730 (see step 902 in the process). Figure 9 In step 904), this vector is also known as the Home Environment (HE) Authentication Vector (AV). For authentication vector 730, UDM NF 418 calculates or generates a homomorphic encrypted authentication challenge 734 used to authenticate 6G device 406 (see step 904). Figure 9 (Step 906 in the process). More specifically, a homomorphically encrypted authentication challenge 734 is generated to authenticate the ME 601 and / or SIM 660 of the 6G device 406.

[0070] Figure 11A The illustration depicts an authentication entity 720 of home network 704 in an illustrative embodiment. (For example, UDM NF 418) Authentication entity 720 may implement or use homomorphic encryption algorithm 1120 to compute or generate a homomorphically encrypted authentication challenge 734 (HENC_CHAL). Homomorphic encryption algorithm 1120 uses the public key 1102 (HN_PK) of home network 704 to encrypt one or more input parameters 1104 to generate the homomorphically encrypted authentication challenge 734. Therefore, the homomorphically encrypted authentication challenge 734 is a function of at least the public key 1102 of home network 704. One technical advantage is that the response entity (e.g., ME 601 or SIM 660) is able to compute a challenge response to encrypted data without requiring an access private key.

[0071] UDM NF 418 then transmits or sends an authentication response message 833 to the serving network 706, the authentication response message 833 including, including, or containing a homomorphically encrypted authentication challenge 734 (see [link to UDM NF 418]). Figure 9 In step 908 (as described above), the authentication challenge is encrypted using homomorphic encryption 712. Note that the authentication response message 833 may include, contain, or include other information, such as other parameters of the authentication vector 730, the home network public key identifier (ID) 818 (HN_PK ID) for the home network public key 1102, etc. The MM NF 412 receives the authentication response message 833 from the UDM NF 418 and sends or forwards the homomorphically encrypted authentication challenge 734 along with other expected information to the 6G device 406, such as in the authentication request message 834.

[0072] 6G device 406 receives authentication request message 834 containing authentication challenge 734 with homomorphic encryption calculated by home network 704 (see [link]). Figure 10 Step 1002 in the process. The authentication entity 710 at 6G device 406 calculates or generates a homomorphically encrypted challenge response 738 based on the homomorphic encryption authentication challenge 734 (see step 1002 in the process). Figure 10 Step 1004 in the process. Figure 11B The illustration shows the authentication entity 710 of a 6G device 406 in an illustrative embodiment. The authentication entity 710 implements or uses a homomorphic encryption evaluation function 1124 to compute or generate a homomorphic encrypted challenge response 738 (HENC_RES). The homomorphic encrypted challenge response 738 is a function of at least the homomorphic encrypted authentication challenge 734 and the public key 1102 (HN_PK) of the home network 704. In one embodiment, the authentication entity 710 may input at least the public key 1102 and the homomorphic encrypted authentication challenge 734 into the homomorphic encryption evaluation function 1124 to compute the homomorphic encrypted challenge response 738 (see [link to documentation]). Figure 10 (Optional step 1006). The 6G device 406 may then send or transmit an authentication response message 835 to the serving network 706, the authentication response message 835 including, including, or containing a homomorphically encrypted challenge response 738 (see [link]). Figure 10 (Step 1008 in the process). One technical advantage is that when computing the homomorphic encrypted challenge response 738, the authentication entity 710 can directly perform the computation on the homomorphic encrypted authentication challenge 734 without first decrypting the authentication challenge.

[0073] MM NF 412 receives authentication response message 835 from 6G device 406 and forwards or sends a homomorphically encrypted challenge response 738 to home network 704 in authentication request message 836. UDM NF 418 receives authentication request message 836, which includes, contains, or includes a homomorphically encrypted challenge response 738 calculated by 6G device 406 (see [link to UDM NF 412]). Figure 9 Step 910 in the process, such as the homomorphically encrypted challenge response computed by ME 601 or SIM 660 in response to the homomorphically encrypted authentication challenge 734. UDM NF 418 then performs verification of the homomorphically encrypted challenge response 738 (see step 910 in the process). Figure 9 Step 912 in the process. In order to execute Figure 9 In the verification, for example, UDM NF 418 calculates the expected challenge response 824 (XRES) (see... Figure 9 (Step 914 in the original text), decrypting the homomorphically encrypted challenge response 738 computed by 6G device 406 (see step 914 in the original text). Figure 9 Step 916), and compare the decrypted challenge response with the expected challenge response 824 (see step 916). Figure 9 Step 918 in the text). For example, in Figure 11A In this context, the authentication entity 720 (e.g., UDM NF418) can implement or use the homomorphic decryption algorithm 1122 to compute or generate the decrypted challenge response 1112 (RES). The homomorphic decryption algorithm 1122 uses the key 1110 (HN_SK) of the home network 704 to decrypt the homomorphically encrypted challenge response 738 and generate the decrypted challenge response 1112.

[0074] When the decrypted challenge response 1112 matches the expected challenge response 824, UDM NF 418 determines that the 6G device 406 has been successfully authenticated (see [link]). Figure 9 (Step 920 in the text). When the decrypted challenge response 1112 does not match the expected challenge response 824, UDM NF 418 determines that the authentication of 6G device 406 has failed (see step 920 in the text). Figure 9 (Step 922 in the document). One technical advantage is that authentication using homomorphic encryption 712 is more resistant to attacks. Many homomorphic schemes are resistant to quantum attacks, providing long-term security advantages. Because the authentication process occurs on encrypted data, keylogging, memory dumping, and other side-channel attacks can be prevented. Furthermore, 6G devices 406 can authenticate without disclosing security certificates or other sensitive information. Another technical advantage of the enhanced authentication process 750 described herein is that it uses a public-key or asymmetric scheme, while existing authentication techniques use symmetric-key schemes. The public-key structure in a homomorphic scheme can be optimized to efficiently enable homomorphic operations or computations, and entities can perform computations on encrypted data without needing access to the private key.

[0075] In the following examples, other processes, systems, and methods may be described within the context of authentication process 750, such as in a 6G environment. The processes, systems, and methods described in these examples may be incorporated into the embodiments described above as needed.

[0076] In one embodiment, both the ME 601 and SIM 660 of the communication device can be authenticated during the authentication process 750. In conventional authentication processes (e.g., 5G AKA or EAP AKA), the SIM 660 of the communication device is authenticated via a challenge from the network, but the ME 601 is not authenticated. This can lead to vulnerabilities for certain attacks. For example, when the SIM 660 is authenticated but the ME 601 is not, an attacker could clone or copy SIM information (e.g., authentication keys) to a new, unauthorized ME. In another example, when the SIM 660 is authenticated but the ME 601 is not, an attacker could use a different ME 601 (e.g., a stolen device) that contains a legitimate SIM, and the network would not be aware that the ME 601 is different from the legitimate ME. In yet another example, the SIM 660 typically contains critical information for authenticating and authorizing access to mobile network services. When the ME 601 is not authenticated, an attacker gaining control of the SIM 660 could gain unauthorized access to these services. To address these and other issues, the authentication process 750 described herein authenticates both the ME 601 and SIM 660 communication devices.

[0077] Figure 12 This is a message diagram 1200 showing the authentication process 750 between the 6G device 406 and the home network 704 in an illustrative embodiment. Figures 13A-13B This is a flowchart illustrating a method 1300 for performing an authentication process 750 in an illustrative embodiment. The steps of method 1300 will be described with reference to one or more authentication entities 720 of the home network 704 (e.g., at UDM NF 418 and / or AUS NF 410), but it should be understood that the method may be performed in other devices, components, functions, systems, etc. Figures 14A-14B This is a flowchart of a method 1400 for performing authentication process 750 in an illustrative embodiment. Figure 14A The steps of method 1400 will be described with reference to ME 601 of 6G device 406, and Figure 14B The steps of method 1400 will be described with reference to SIM 660 of 6G device 406, but it should be understood that the method can be performed in other devices, components, functions, systems, etc.

[0078] exist Figure 12In this context, the network can initiate an authentication process 750 with the 6G device 406 during any process of establishing a signaling connection with the 6G device 406. The 6G device 406 can send or transmit an N1 message or an initial NAS message to the MM NF 412 of the serving network 706. An example of an initial NAS message is a registration request. The 6G device 406 registers with the network (i.e., through a registration process) to obtain authorization to receive services that require registration. Therefore, the ME 601 of the 6G device 406 can send an N1 message or an initial NAS message to the serving network 706 (see...). Figure 14A In step 1402 (such as sending or transmitting registration request message 1231 to MM NF 412), SIM 660 and / or ME 601 may perform SUCI hiding using SUPI 672 associated with SIM 660 and IMEI 642 associated with ME 601 (see step 1402). Figure 14B (Optional step 1432). For example, ME 601 can send a GET IDENTITY request and IMEI 642 to SIM 660. SIM 660 can hide SUPI 672 and IMEI 642 in a Subscription Hidden Identifier (SUCI) and provide the SUCI to ME 601. Alternatively, SUCI hiding can be supported by ME 601. ME 601 can send a registration request message 1231 containing SUPI 672 and IMEI 642 hidden in the SUCI (see step 1432). Figure 14A (Optional step 1404 in the example). Although the registration request message 1231 is disclosed in this example, it should be noted that the authentication process 750 can be triggered in response to other types of messages.

[0079] For example, in response to registration request message 1231, MM NF 412 of serving network 706 can initiate authentication by sending authentication request message 1232 to home network 704, thereby invoking the authentication service toward home network 704 (e.g., HPLMN). Authentication request message 1232 may include, contain, or include SUCI and the service network name (SN name or SNN) of serving network 706. After receiving authentication request message 1232, AUS NF 410 can check whether the requesting MM NF 412 in serving network 706 is authorized to use the service network name in authentication request message 1232 by comparing the service network name with the expected service network name. When serving network 706 is authorized to use the service network name, AUS NF 410 can send authentication acquisition request message 1233 to UDM NF 418 of home network 704. Authentication acquisition request message 1233 may include SUCI and the service network name.

[0080] UDM NF 418 receives an authentication request message 1233 (also commonly referred to as an authentication request or authentication request message) regarding the authentication of 6G device 406 (see [link]). Figure 13A (Step 1302 in the previous section). After receiving the authentication acquisition request message 1233, the UDM NF 418 (i.e., through the authentication entity 720) identifies the SUPI 672 of the 6G device 406 (if received) and can select or choose the authentication method 752 for authentication based on the SUPI 672. When the SUPI 672 is hidden in the SUCI, the UDMNF 418 (or the associated Subscription Identifier De-hiding Function (SIDF)) de-hids the SUPI 672 from the SUCI (see step 1302 in the previous section). Figure 13A (Optional step 1304). As described above, SUCI can hide SUPI 672 and IMEI 642 associated with 6G device 406, so UDM NF 418 can unhide SUPI 672 and IMEI 642 from SUCI. UDM NF 418 can link SUPI 672 and IMEI 642 for use in authentication process 750 (see 1304). Figure 13A (Optional step 1306 in the process).

[0081] For the selected authentication method 752, UDM NF 418 generates authentication vector 730 (see...). Figure 13A (Step 1308 in the previous section). Authentication vector 730 includes authentication challenges for SIM 660 and authentication challenges for ME 601. Therefore, UDM NF 418 generates or computes SIM authentication challenge 1222 (SIM_CHAL) for authenticating SIM 660 (see step 1308 in the previous section). Figure 13A Step 1310 in the process). UDM NF 418 uses homomorphic encryption 712 to generate or compute the homomorphic ME authentication challenge 1220 (HENC_ME_CHAL) used to authenticate ME 601 (see step 1310 in the process). Figure 13A Step 1312 in the middle.

[0082] Figure 15AThe generation of authentication vector 730 in an illustrative embodiment is illustrated. The process of generating authentication vector 730 at authentication entity 720 can be similar to the process described in 3GPP TS 33.102 (version 18), which is incorporated herein by reference as if fully included herein. Authentication entity 720 (e.g., UDM NF 418) can begin by generating a new sequence number (SQN) 1502 and generating or selecting an unpredictable network challenge that includes a random number (RAND) 1504. Authentication entity 720 can use function f1 (also known as the MAC function) to compute the Message Authentication Code (MAC), which takes a long-term key (K), an authentication management field (AMF), and sequence number 1502 as input. The authentication management field (AMF) is a value (e.g., 16 bits) that indicates the valid time period used for one or more keys (e.g., CK and IK). Sequence number 1502 is used to prevent replay attacks. The home network 704 generates a new SQN value for each authentication process 750, and the communication device is expected to include the same SQN value in its response. The SIM and home network 704 each track the SQN counter. MS and SQN HE To support authentication. Serial number SQN HE It is an individual counter for each user, and the serial number is SQN. MS This indicates the highest sequence number that the SIM has accepted. Authentication entity 720 can use function f2 to calculate the expected response (XRES) (XRES = f2). K (RAND)), where f2 is the (potentially truncated) message authentication function. Authenticating entity 720 can utilize function f3 (CK=f3). K (RAND) calculates the cryptographic key (CK), where f3 is the key generation function. Authenticating entity 720 can use function f4 (IK=f4) to calculate the key. K (RAND) calculates the integrity key (IK), where f4 is the key generation function. Authenticating entity 720 can use function f5 (AK=f5) to calculate the integrity key (IK). K (RAND) calculates the anonymous key, where f5 is the key generation function. The SIM authentication token 1514 (SIM_AUTN) can be defined as SIM_AUTN:=SQN⨁AK||AMF||MAC. The SIM authentication challenge 1222 may include the SIM authentication token 1514, RAND 1504, and / or other parameter combinations. Figure 15A The illustration shows one way to generate authentication vector 730, and alternative generation processes or functions are considered in this paper.

[0083] Figure 16AThe illustration depicts the authentication entity 720 of the home network 704 in an illustrative embodiment. The authentication entity 720 (e.g., of UDM NF 418) may implement or use homomorphic encryption algorithm 1620 to compute or generate a homomorphically encrypted ME authentication challenge 1220 (HENC_ME_CHAL). The homomorphically encrypted ME authentication challenge 1220 is a function of at least the SIM authentication challenge 1222 (or a portion thereof, such as the SIM authentication token 1514 (SIM_AUTN)) and the public key 1102 (HN_PK) of the home network 704. In one embodiment, the authentication entity 720 may input at least the public key 1102, the SIM authentication challenge 1222 (or a portion thereof, such as the SIM authentication token 1514), and the IMEI 642 (also known as the ME identifier or ME ID) of the ME 601 into the homomorphic encryption algorithm 1620 to compute the homomorphically encrypted ME authentication challenge 1220 (see [link to documentation]). Figure 13A (Optional step 1314). However, other input parameters can be used in homomorphic encryption algorithm 1620. One technical advantage is that the homomorphic encryption ME authentication challenge 1220 is based on SIM authentication challenge 1222 and IMEI 642, so these parameters are linked together for authentication.

[0084] exist Figure 12 In this process, UDM NF 418 sends an authentication acquisition response message 1234 and authentication vector information to AUS NF 410 for authentication. More specifically, UDM NF 418 sends the authentication acquisition response message 1234, which includes, or contains homomorphically encrypted ME authentication challenge 1220 and SIM authentication challenge 1222 (see [link to relevant documentation]). Figure 13A (Step 1316 in the process). UDM NF 418 can also provide the home network public key ID 818 (HN_PKID) in the authentication acquisition response message 1234. If SUCI is included in the authentication acquisition request message 1233, UDM NF 418 can include SUPI 672 in the authentication acquisition response message 1234 after dehisting SUPI 672 from SUCI.

[0085] In response to the authentication response message 1234, the AUS NF 410 may temporarily store the expected response (XRES) along with the received SUCI or SUPI. The AUS NF 410 transmits or sends an authentication response message 1235 to the MM NF 412. This authentication response message 1235 includes, has, or contains authentication vector information, such as a homomorphically encrypted ME authentication challenge 1220 (HENC_ME_CHAL), a SIM authentication challenge 1222 (SIM_CHAL), and the home network public key ID 818. In response to the authentication response message 1235, the MM NF 412 transmits or sends an authentication request message 1236 to the 6G device 406. This authentication request message 1236 includes, has, or contains a homomorphically encrypted ME authentication challenge 1220, a SIM authentication challenge 1222, the home network public key ID 818, and other information.

[0086] The ME 601 of the 6G device 406 receives an authentication request message 1236 containing at least a homomorphically encrypted ME authentication challenge 1220 and a SIM authentication challenge 1222 calculated by the home network 704 (see [link]). Figure 14A (Step 1408 in the previous section). ME 601 stores the homomorphically encrypted ME authentication challenge 1220 and forwards the SIM authentication challenge 1222 to SIM 660 (see step 1408 in the previous section). Figure 14A Step 1410 in the process). ME 601 can also forward the home network public key ID 818 to SIM 660 (see step 1410 in the process). Figure 14A (Optional step 1412). For example, ME 601 may forward, provide, or send an authentication request message 1237 to SIM 660, which includes, contains, or includes SIM authentication challenge 1222, home network public key ID 818, and / or other information for authentication.

[0087] SIM 660 receives SIM authentication challenge 1222 provided by ME 601 (see...) Figure 14B (Step 1434 in the previous section). SIM 660 can verify the freshness of the received value (e.g., verify the MAC, check the SQN, etc.) by checking whether the SIM authentication challenge 1222 is acceptable. If so, SIM 660 (i.e., through authentication entity 710) generates or computes a SIM challenge response 1224 (SIM_RES) to the SIM authentication challenge 1222 (see step 1434 in the previous section). Figure 14B Step 1436 in the process. Then, SIM 660 sends or provides a SIM challenge response to ME601 (see step 1436 in the process). Figure 14B Step 1438 in the middle.

[0088] Figure 15BThe illustration shows the generation of the SIM challenge response 1224 in the illustrative embodiment. The authentication entity 710 at SIM 660 parses the SIM authentication token 1514 (SIM_AUTN) from the SIM authentication challenge 1222 to extract the sequence number 1502 (SQN) generated by the home network 704 and the XOR of the anonymous key (AK), AMF, and MAC. The authentication entity 710 at SIM 660 utilizes function f2 (RES=f2). K (RAND) calculates the SIM challenge response 1224 (SIM_RES), and uses the function f3 (CK=f3) to calculate the SIM challenge response 1224 (SIM_RES). K (RAND) calculates the cryptographic key (CK), using the function f4(IK=f4). K (RAND) calculates the integrity key (IK) and uses the function f5 (AK=f5) K (RAND) calculates the anonymous key. Figure 15B The diagram illustrates one way to generate the SIM challenge response 1224, and alternative generation processes or functions are considered in this paper.

[0089] SIM 660 can also receive home network public key ID 818 from ME 601 (see...) Figure 14B (Optional step 1440). In response to the home network public key ID 818, SIM 660 can retrieve or identify the home network 704's public key 1102, and provide or send the home network 704's public key 1102 to ME 601 (see optional step 1440). Figure 14B (Optional step 1442). SIM 660 may provide or send other information about authentication to ME 601. For example, SIM 660 may forward, provide, or send authentication response message 1238 to ME 601, which includes, contains, or includes SIM challenge response 1224, public key 1102 of home network 704, and / or other authentication information.

[0090] ME 601 receives SIM challenge response 1224 from SIM 660 (see...) Figure 14A Step 1414 in the process). ME 601 can also receive the public key 1102 of the home network 704 from SIM 660 (see step 1414 in the process). Figure 14A Optional step 1416). ME 601 calculates the homomorphically encrypted ME challenge response 1226 based on the homomorphically encrypted ME authentication challenge 1220 generated by the home network 704 (see 1416). Figure 14A Step 1418 in the middle. Figure 16BThe illustration shows the authentication entity 710 of the 6G device 406 in an illustrative embodiment. The authentication entity 710 at ME 601 implements or uses a homomorphically encrypted evaluation function 1624 to compute or generate a homomorphically encrypted ME challenge response 1226 (HENC_ME_RES). The homomorphically encrypted ME challenge response 1226 is a function of at least the homomorphically encrypted ME authentication challenge 1220 and the public key 1102 (HN_PK) of the home network 704. In one embodiment, the authentication entity 710 may input at least the public key 1102, the homomorphically encrypted ME authentication challenge 1220, and the IMEI 642 into the homomorphically encrypted evaluation function 1624 to compute the homomorphically encrypted ME challenge response 1226 (see [link to documentation]). Figure 14A (Optional step 1420 in the process). The homomorphic encryption evaluation function 1624 can also be a specific computation, such as an XOR operation on the homomorphically encrypted ME authentication challenge 1220, the public key 1102, and the IMEI 642. However, other operations can also be used, such as basic operations (e.g., addition, multiplication, subtraction, negation, etc.), Boolean operations (e.g., AND, OR, NOT, etc.), or advanced operations (e.g., comparison (less than, equal to, greater than), division (via inverse multiplication), polynomial operations, dot product, exponentiation, modular arithmetic, etc.). One technical advantage is that when computing the homomorphically encrypted ME challenge response 1226, the authentication entity 710 can directly perform the computation on the homomorphically encrypted ME authentication challenge 1220 without first decrypting the authentication challenge.

[0091] Then, ME 601 sends or transmits authentication response message 1239, which includes, includes, or contains homomorphically encrypted ME challenge response 1226 and SIM challenge response 1224 (see...). Figure 14A (Step 1422 in the original text). The MM NF412 receives the authentication response message 1239 from the ME 601 and can perform a service network-level evaluation of the SIM challenge response 1224. If successful, the MM NF 412 transmits or sends an authentication request message 1240 to the home network 704, which includes, includes, or contains homomorphically encrypted ME challenge response 1226 and SIM challenge response 1224.

[0092] The AUS NF 410 receives an authentication request message 1240 containing a homomorphic ME challenge response 1226 and a SIM challenge response 1224 (see [link]). Figure 13A Step 1318 in the process. After receiving authentication request message 1240, authentication entity 720 at AUS NF 410 can perform verification of SIM challenge response 1224 (see step 1318 in the process). Figure 13B(Step 1320 in the previous section). To perform verification, for example, the authentication entity 720 at AUS NF 410 compares the SIM challenge response 1224 with the previously calculated expected SIM challenge response (XRES) (see step 1320 in the previous section). Figure 13B Step 1322 in the process. When the SIM challenge response 1224 matches the expected SIM challenge response, the authentication entity 720 at AUS NF 410 determines that the SIM 660 has been successfully authenticated from the perspective of the home network (see step 1322 in the process). Figure 13B Step 1324 in the process. When the SIM challenge response 1224 does not match the expected SIM challenge response, the authentication entity 720 at AUS NF 410 determines that the authentication of SIM 660 has failed (see step 1324 in the process). Figure 13B Step 1326 in the middle.

[0093] AUS NF 410 sends or transmits an authentication acquisition request message 1241 to UDM NF 418 of home network 704. This authentication acquisition request message 1241 includes, contains, or includes a homomorphically encrypted ME challenge response 1226. The authentication acquisition request message 1241 can indicate the success / failure of authentication for SIM 660. The authentication entity 720 at UDM NF 418 performs verification of the homomorphically encrypted ME challenge response 1226 (see [link to documentation]). Figure 13B Step 1328 in [the document]. To perform verification, for example, the authentication entity 720 at UDM NF 418 calculates the expected ME challenge response (see [reference]). Figure 13B (Step 1330 in the text), decrypting the homomorphically encrypted ME challenge response 1226 computed by ME 601 (see step 1330 in the text). Figure 13B Step 1332 in the process, and compare the decrypted ME challenge response with the expected ME challenge response (see step 1332 in the process). Figure 13B Step 1336 in the text). For example, in Figure 16A In this context, the authentication entity 720 (e.g., UDM NF 418) can implement or use the homomorphic decryption algorithm 1622 to compute or generate the decrypted ME challenge response 1628 (ME_RES). In one embodiment, the authentication entity 720 can input at least the secret key 1110 (HN_SK) of the home network 704, the homomorphically encrypted ME challenge response 1226 (HENC_ME_RES), and the IMEI 642 of ME 601 into the homomorphic decryption algorithm 1622 to generate the decrypted ME challenge response 1628 (see [link to documentation]). Figure 13B (Optional step 1334). When the decrypted ME challenge response 1628 matches the expected ME challenge response (XRES), the authentication entity 720 at UDM NF 418 determines that the ME601 has been successfully authenticated from the perspective of the home network (see [link]). Figure 13BStep 1338 in the process. When the decrypted ME challenge response 1628 does not match the expected ME challenge response, the authentication entity 720 at UDM NF 418 determines that the authentication of ME 601 was unsuccessful (see step 1338 in the process). Figure 13B (Step 1340 in the process). UDM NF 418 can send an authentication acquisition response message 1242 to AUS NF 410 indicating the success / failure of ME 601's authentication. One technical advantage is that both ME 601 and SIM 660 of 6G device 406 are authenticated according to authentication process 750.

[0094] In one embodiment, 6G device 406 (e.g., ME 601) may send or provide a support indicator 1218 indicating whether 6G device 406 supports homomorphic encryption 712 (see [link to documentation]). Figure 14A (Optional step 1406 in the process). For example, ME 601 may include a support indicator 1218 in the registration request message 1231, indicating that 6G device 406 supports homomorphic encryption 712. UDM NF 418 receives and stores the support indicator 1218 for 6G device 406 or ME 601 (see [link to relevant documentation]). Figure 13A (Optional step 1303). UDM NF 418 can select authentication method 752 based on support indicator 1218. One technical advantage is that 6G device 406 is able to notify home network 704 of its ability to authenticate using homomorphic encryption 712.

[0095] In the above embodiments, SIM 660 and / or ME 601 can perform SUCI hiding using SUPI 672 associated with SIM 660 and IMEI 642 associated with ME 601 (see...). Figure 14B (Optional step 1432). Figure 17The illustration shows a SUCI 1700 in an illustrative embodiment. A SUCI is a privacy-protected identifier that contains a hidden SUPI. SUCI 1700 includes a SUPI type 1702 identifying the type of SUPI hidden within the SUCI 1700 and a Home Network Identifier (ID) 1704 identifying the subscriber's Home Network 704. SUCI 1700 also includes a routing indicator 1706 (e.g., one to four decimal digits) assigned by the Home Network operator and supplied in the SIM, which allows network signaling with SUCI 1700, along with the Home Network Identifier 1704, to be routed to AUSF and UDM instances capable of serving the subscriber. SUCI 1700 also includes a protection scheme identifier 1708 (e.g., a value in the range of "0 to 15") and a home network public key ID 1710 (e.g., a value in the range of "0 to 255" representing a public key supplied by an HPLMN or Independent Non-Public Network (SNPN) and used to identify the key used for SUPI protection). SUCI 1700 also includes a scheme output 1712, which comprises a string of variable-length or hexadecimal numbers, depending on the protection scheme used. Scheme output 1712 represents the output of a protection scheme (e.g., a public key protection scheme) that is an encrypted or cryptographically protected SUPI. Scheme output 1712 may consist of a temporary public key 1714, a ciphertext value 1716, and a MAC tag value 1718. In one embodiment, the ciphertext value 1716 includes more information than the encrypted information in a conventional SUCI. In a conventional SUCI, the ciphertext value is the encrypted SUPI. In the embodiments described herein, the ciphertext value 1716 may include at least SUPI 672 associated with SIM 660 and IMEI 642 associated with ME 601. However, other data may be encrypted in the ciphertext value 1716 as needed.

[0096] Figures 18A-18B The SUPI hiding and unhiding in the illustrative embodiments are illustrated separately. For example, in Figure 18AIn this implementation, SIM 660 uses key pair generation primitives to generate a key pair (temporary public key 1714 and private key 1832). Based on Diffie-Hellman primitives, a shared secret key 1836 is derived from the network entity's public key 1834 and the generated temporary private key 1832. Subsequently, a key derivation function (KDF) is used to generate key data K, which includes an encryption key (EK), an initial counter block (ICB) key, and a MAC key. Using the derived keys EK and ICB, symmetric encryption is performed to encrypt plaintext block 1802 to generate ciphertext value 1716. The MAC scheme's tagging operation is used to calculate the MAC tag value 1718 for encrypting the text using the generated MAC key. In conventional SUCI, only SUPI 672 will be included in the encrypted plaintext block 1802. In this embodiment, SUPI 672 and IMEI 642 are included in the plaintext block 1802 and encrypted to generate ciphertext value 1716.

[0097] For example, in Figure 18B In this process, the de-hiding function (e.g., in UDM NF 418) uses the received temporary public key 1714 and the network entity's private key 1838 to generate a temporary shared key 1836. A KDF is used to generate key data K, which includes a decryption key (DK), an ICB key, and a MAC key. The generated DK and ICB keys are used to decrypt the ciphertext value 1716 using symmetric decryption. A temporary MAC key is used on the encrypted text to generate a MAC tag value 1718 (i.e., the expected MAC), which is compared with the received MAC to verify the integrity of SUPI 672 and IMEI 642. Therefore, only the entity possessing the network entity's private key 1838 can decrypt the ciphertext value 1716 and de-hide SUPI 672 and IMEI 642. One technical advantage is that SUPI 672 and IMEI 642 can be hidden together in SUCI 1700 and provided to the home network 704. Therefore, after the SUCI 1700 is dehidden, SUPI 672 and IMEI 642 can be linked together in the home network 704 for authentication, which can prevent attacks by malicious entities.

[0098] In one embodiment, authentication of SIM 660 may be adapted to use homomorphic encryption 712. In this embodiment, the home network 704 may choose authentication method 752 using homomorphic encryption 712, or choose authentication method without homomorphic encryption 712 (e.g., ...). Figures 15A-15BThe SIM 660 uses a set of MILENAGE algorithms (functions f1 to f5) to create authentication challenges. The home network 704 can dynamically change or select the authentication method 752 for each authentication process. The SIM 660 can run different authentication processes 750 or authentication methods 752 depending on the method selected by the home network 704.

[0099] Figure 19 This is a message diagram 1900 showing the authentication process 750 between the 6G device 406 and the home network 704 in an illustrative embodiment. Figures 20A-20C This is a flowchart illustrating a method 2000 for performing an authentication process 750 in an illustrative embodiment. The steps of method 2000 will be described with reference to one or more authentication entities 720 of home network 704 (e.g., at UDM NF 418), but it should be understood that the method may be performed in other devices, components, functions, systems, etc. Figures 21A-21B This is a flowchart of a method 2100 for performing an authentication process 750 in an illustrative embodiment. Figure 21A The steps of method 2100 will be described with reference to ME 601 of 6G device 406, and Figure 21B The steps of method 2100 will be described with reference to SIM 660 of 6G device 406, but it should be understood that the method can be performed in other devices, components, functions, systems, etc.

[0100] exist Figure 19 In this process, the network can initiate an authentication process 750 with the 6G device 406 during any procedure in which a signaling connection is established with the 6G device 406. For example, ME 601 of the 6G device 406 can send or transmit a registration request message 1931 (see MM NF 412) to the serving network 706. Figure 21A Step 2102 in the document). Before sending the registration request message 1931, SIM 660 and / or ME 601 can perform SUCI hiding using SUPI 672 associated with SIM 660 and IMEI 642 associated with ME 601 (see step 2102 in the document). Figure 21B (Optional step 2132). ME 601 can send a registration request message 1931 containing SUPI 672 and IMEI 642 hidden in SUCI 1700 (see 1931). Figure 21A (Optional step 2104 in the example). Although the registration request message 1931 is disclosed in this example, it should be noted that the authentication process 750 can be triggered in response to other types of messages.

[0101] For example, in response to registration request message 1931, MM NF 412 of serving network 706 can initiate authentication by sending authentication request message 1932 to home network 704, thereby invoking the authentication service toward home network 704 (e.g., HPLMN). Authentication request message 1932 may include, contain, or include SUCI 1700 and the service network name of serving network 706. After receiving authentication request message 1932, AUS NF 410 can check whether the requesting MM NF 412 in serving network 706 is authorized to use the service network name in authentication request message 193 by comparing the service network name with the expected service network name. When serving network 706 is authorized to use the service network name, AUS NF 410 can send authentication acquisition request message 1933 to UDM NF 418 of home network 704. Authentication acquisition request message 1933 may include SUCI 1700 and the service network name.

[0102] UDM NF 418 receives Authentication Acquisition Request Message 1933 (often also called Authentication Request or Authentication Request Message) regarding the authentication of 6G device 406 (see [link]). Figure 20A (Step 2002 in the process). After receiving the authentication acquisition request message 1933, UDM NF 418 (i.e., via authentication entity 720) identifies SUPI 672 of 6G device 406 (if received). When SUPI 672 is hidden in SUCI 1700, UDM NF 418 (or the associated SIDF) unhides SUPI 672 from SUCI 1700 (see step 2002 in the process). Figure 20A (Optional step 2004). As described above, SUCI 1700 can hide SUPI 672 and IMEI 642 associated with 6G device 406, so UDM NF 418 can unhide SUPI 672 and IMEI 642 from SUCI 1700. UDM NF 418 can link SUPI 672 and IMEI 642 for use in authentication process 750 (see Optional step 2004). Figure 20A Optional steps in 2006).

[0103] UDM NF 418 Select or choose the authentication method for authentication 752 (see Figure 20A(Step 2008 in the original text). For example, UDM NF 418 can determine the capabilities of 6G device 406 based on SUPI 672 and / or other information, such as whether 6G device 406 supports homomorphic encryption 712. Therefore, UDM NF 418 can choose between authentication method 752 using homomorphic encryption 712 and authentication method 752 not using homomorphic encryption 712 (e.g., the MILENAGE algorithm set traditionally used to generate authentication vectors). UDM NF 418 then generates authentication vector 730 based on the selected authentication method 752 (see step 2008 in the original text). Figure 20A (Step 2010 in the text). When the selected authentication method 752 uses homomorphic encryption 712, UDM NF 418 uses homomorphic encryption 712 to generate or compute the homomorphic SIM authentication challenge 1920 (HENC_SIM_CHAL) used to authenticate SIM 660 (see step 2010 in the text). Figure 20A (Step 2012 in the original text). UDM NF 418 sends an authentication acquisition response message 1934 and authentication vector information to be used for authentication to AUS NF 410. More specifically, UDM NF 418 sends an authentication acquisition response message 1934, which includes, includes, or contains an authentication challenge 1920 with homomorphic encryption SIM (see step 2012 in the original text). Figure 20A Step 2016), as follows Figure 19 As shown. The UDM NF418 can also provide the home network public key ID 818 (HN_PK ID) in the authentication acquisition response message 1934. If SUCI 1700 is included in the authentication acquisition request message 1933, the UDM NF 418 can include SUPI 672 in the authentication acquisition response message 1934 after dehiscing SUPI 672 from SUCI 1700.

[0104] Figure 22A The illustration shows the authentication entity 720 of the home network 704 in an illustrative embodiment. (For example, UDM NF 418) The authentication entity 720 may implement or use homomorphic encryption algorithm 2220 to compute or generate a homomorphically encrypted SIM authentication challenge 1920 (HENC_SIM_CHAL). The homomorphically encrypted SIM authentication challenge 1920 is a function of at least the following: the public key 1102 (HN_PK) of the home network 704, the SUPI 672 associated with SIM 660, and the IMEI 642 associated with ME 601. In one embodiment, the authentication entity 720 may input at least the public key 1102, the serial number 1502 (SQN), the SUPI 672 associated with SIM 660, and the IMEI 642 of ME 601 into the homomorphic encryption algorithm 2220 to compute the homomorphically encrypted SIM authentication challenge 1920 (see [link to documentation]). Figure 20A (Optional step 2014). However, other input parameters can be used in homomorphic encryption algorithm 2220. The authentication entity 720 can encrypt or ciphertext the serial number 1502 (SQN) before inputting it into the homomorphic encryption algorithm 2220, such as based on a long-term key (K). Furthermore, the authentication entity 720 may not increment the serial number 1502. One technical advantage is that the homomorphically encrypted SIM authentication challenge 1920 is based on SUPI 672 and IMEI 642, thus these parameters are linked together for authentication.

[0105] When the selected authentication method 752 does not use homomorphic encryption 712, UDM NF 418 generates or calculates the SIM authentication challenge 1222 (SIM_CHAL) used to authenticate the SIM 660 (see...). Figure 20A In step 2018), the SIM authentication challenge is not encrypted using homomorphic encryption 712. The UDM NF 418 can then send an authentication acquisition response message and the authentication vector information to be used for authentication to the AUS NF 410. More specifically, the UDM NF 418 sends an authentication acquisition response message that includes, contains, or includes the SIM authentication challenge 1222 (see step 2018). Figure 20A Step 2020), which is in Figure 19 Not shown in the image.

[0106] In response to the authentication acquisition response message 1934, AUS NF 410 transmits or sends an authentication response message 1935 to MM NF 412. This authentication response message 1935 includes, has, or contains authentication vector information, such as a homomorphically encrypted SIM authentication challenge 1920 (HENC_SIM_CHAL) and the home network public key ID 818. In response to the authentication response message 1935, MM NF 412 transmits or sends an authentication request message 1936 to 6G device 406. This authentication request message 1936 includes, has, or contains the homomorphically encrypted SIM authentication challenge 1920, the home network public key ID 818, and / or other information.

[0107] The ME 601 of the 6G device 406 receives an authentication request message 1936, which includes at least a homomorphically encrypted SIM authentication challenge 1920 calculated by the home network 704 (see [link]). Figure 21A Step 2106 in the process). ME 601 forwards the homomorphically encrypted SIM authentication challenge 1920 to SIM 660 (see step 2106 in the process). Figure 21A (Step 2108 in the original text). ME 601 can also forward the home network public key ID 818 to SIM 660 (see step 2108 in the original text). Figure 21A(Optional step 2110 in the process). For example, ME 601 may forward, provide, or send an authentication request message 1937 to SIM 660, which includes, includes, or contains a homomorphic encryption IM authentication challenge 1920, home network public key ID 818, and / or other information used for authentication.

[0108] SIM 660 receives SIM authentication challenge 1920 (see ME 601) with homomorphic encryption. Figure 21B Step 2134 in the process. SIM 660 can also receive home network public key ID 818 provided by ME 601 (see step 2134 in the process). Figure 21B Optional step 2136 in the process. SIM 660 (i.e., via authentication entity 710) generates or computes a homomorphically encrypted SIM challenge response 1924 (HENC_SIM_RES) to the homomorphically encrypted SIM authentication challenge 1920 (see 2136 in the process). Figure 21B Step 2138). Figure 22B The illustration shows the authentication entity 710 of the 6G device 406 in an illustrative embodiment. The authentication entity 710 at SIM 660 implements or uses a homomorphic encryption evaluation function 2224 to compute or generate a homomorphically encrypted SIM challenge response 1924 (HENC_SIM_RES). The homomorphically encrypted SIM challenge response 1924 is a function of at least the homomorphically encrypted SIM authentication challenge 1920 and the public key 1102 (HN_PK) of the home network 704. In one embodiment, the authentication entity 710 may input at least the public key 1102 and the homomorphically encrypted SIM authentication challenge 1920 into the homomorphic encryption evaluation function 2224 to compute the homomorphically encrypted SIM challenge response 1924 (see [link to documentation]). Figure 21B (Optional step 2140). The homomorphic encryption evaluation function 2224 can also be a specific computation, such as an XOR operation on the homomorphically encrypted SIM authentication challenge 1920 and the public key 1102. However, other operations can also be used, such as basic operations (e.g., addition, multiplication, subtraction, negation, etc.), Boolean operations (e.g., AND, OR, NOT, etc.), or advanced operations (e.g., comparison (less than, equal to, greater than), division (via inverse multiplication), polynomial operations, dot product, exponentiation, modular arithmetic, etc.). One technical advantage is that when computing the homomorphically encrypted SIM challenge response 1924, the authentication entity 710 can directly perform the computation on the homomorphically encrypted SIM authentication challenge 1920 without first decrypting the authentication challenge.

[0109] Then, SIM 660 sends or provides a homomorphically encrypted SIM challenge response 1924 to ME 601 (see...). Figure 21B(Step 2142 in the process). For example, SIM 660 may forward, provide, or send an authentication response message 1938 to ME 601, which includes, contains, or contains a homomorphically encrypted SIM challenge response 1924 and / or other authentication information.

[0110] ME 601 receives homomorphically encrypted SIM challenge response 1924 from SIM 660 (see...) Figure 21A (Step 2112 in the text). Then, ME 601 sends or transmits authentication response message 1939, which includes, includes, or contains homomorphically encrypted SIM challenge response 1924 (see step 2112 in the text). Figure 21A (Step 2114 in the original text). MM NF 412 receives authentication response message 1939 from ME 601 and transmits or sends authentication request message 1940 to home network 704, which includes, has, or contains a homomorphically encrypted SIM challenge response 1924. AUS NF 410 receives authentication request message 1940 from MM NF 412 and transmits or sends authentication acquisition request message 1941 to UDM NF 418, which includes, has, or contains a homomorphically encrypted SIM challenge response 1924.

[0111] UDM NF 418 receives authentication acquisition request message 1941. When homomorphic encryption 712 is enabled for authentication process 750, the authentication acquisition request message 1941 received at UDM NF 418 contains a homomorphically encrypted SIM challenge response 1924 (see [link to UDM NF 418]). Figure 20B Step 2022 in the process). The authentication entity 720 at UDM NF 418 performs verification of the homomorphically encrypted SIM challenge response 1924 (see step 2022 in the process). Figure 20B (Step 2024 in the document). To perform verification, for example, the authentication entity 720 at UDM NF 418 calculates the expected SIM challenge response (see step 2024 in the document). Figure 20B (Step 2026 in the original text), decrypting the homomorphically encrypted SIM challenge response 1924 computed by SIM 660 (see step 2026 in the original text). Figure 20A Step 2028 in the document, and compare the decrypted SIM challenge response with the expected SIM challenge response (see step 2028 in the document). Figure 20B Step 2032 in the process. For example, in Figure 22AIn this context, the authentication entity 720 (e.g., UDM NF 418) can implement or use the homomorphic decryption algorithm 2222 to compute or generate the decrypted SIM challenge response 2228 (SIM_RES). In one embodiment, the authentication entity 720 can input at least the home network 704 key 1110 (HN_SK) and the homomorphically encrypted SIM challenge response 1924 (HENC_SIM_RES) into the homomorphic decryption algorithm 2222 to generate the decrypted SIM challenge response 2228 (see [link to documentation]). Figure 20B (Optional step 2030). When the decrypted SIM challenge response 2228 matches the expected SIM challenge response (XRES), the authentication entity 720 at UDMNF 418 determines that SIM 660 has been successfully authenticated from the perspective of the home network (see [link]). Figure 20B Step 2034 in the document. When the decrypted SIM challenge response 2228 does not match the expected SIM challenge response, the authentication entity 720 at UDM NF 418 determines that the authentication of SIM 660 has failed (see step 2034 in the document). Figure 20B (Step 2036 in the process). UDM NF 418 can send an authentication acquisition response message 1942 to AUS NF 410 indicating the success / failure of SIM 660's authentication. One technical advantage is that the authentication challenge and corresponding challenge response can be encrypted using homomorphic encryption 712 to prevent attacks. For example, sensitive data (such as serial numbers) remains encrypted throughout the process, which reduces the exposure of sensitive data. Another technical advantage is that SIM 660 of 6G device 406 can use data associated with ME 601 (e.g., IMEI 642) for authentication, and thus SIM 660 and ME 601 are linked to each other for authentication. Simultaneously, encrypted data facilitates secure collaboration between SIM 660 and ME 601 without exposing potentially sensitive data.

[0112] When homomorphic encryption 712 is not enabled for authentication process 750, the authentication request message received at home network 704 contains a SIM challenge response 1224 that is not encrypted using homomorphic encryption 712 (see [link]). Figure 20C Step 2038 in the document). The authentication entity 720 at AUSNF 410 or UDM NF 418 can perform verification of the SIM challenge response 1224 (see step 2038 in the document). Figure 20C (Step 2040 in the previous section). To perform verification, for example, authentication entity 720 compares SIM challenge response 1224 with the previously calculated expected SIM challenge response (XRES) (see step 2040 in the previous section). Figure 20C (Step 2042 in the text). When the SIM challenge response 1224 matches the expected SIM challenge response, the authentication entity 720 determines from the home network's perspective that the SIM 660 has been successfully authenticated (see step 2042 in the text). Figure 20C Step 2044 in the process. When the SIM challenge response 1224 does not match the expected SIM challenge response, the authentication entity 720 determines that the authentication of SIM 660 has failed (see step 2044 in the process). Figure 20C Step 2046 in the middle.

[0113] In the above embodiments, the authentication vector 730 calculated by the home network 704 may include a random challenge (RAND), an expected response (XRES), and one or more keys (e.g., K derived from UDM NF 418). AUSF Keys) and authentication tokens (AUTN), such as Figure 15A As shown. Annex A.2 of 3GPP TS 33.501 describes the traditional K... AUSF Derivation of the key. In one embodiment, K AUSF The key can be enhanced to include IMEI 642 of ME 601. Figure 23 This is a block diagram of a key derivation function (KDF) 2300 in an illustrative embodiment, which is used to generate or derive K. AUSF Key 2310. K AUSF Key 2310 is used to derive other keys and can be referred to as the root key or root session key. The input parameters of KDF 2300 and their lengths are concatenated into a string S, as follows: S = FC||P0||L0||P1||L1||P2||L2||P3||L3||……||Pn||Ln. FC is used to distinguish different instances of the algorithm. P0……Pn is the encoding of n+1 input parameters, and L0……Ln is a two-byte representation of the length of the corresponding input parameter encoding P0… …Pn. When K is derived… AUSF When using key 2310, the following input parameters can be used to form the string S 2304 input to KDF 2300: - FC=0x6A, - P0 = Service network name, - L0 = Length of the service network name, - P1 = SQN⨁AK, - The length of L1=SQN⨁AK (i.e., 0x00 0x06). - L2 = Mobile Equipment Identifier (IMEI) - P2 = Length of the mobile device identifier.

[0114] The XOR of the serial number (SQN) and the anonymous key (AK) is sent as part of the authentication token (AUTN). Input key 2306 is a concatenation of CK and IK, CK||IK.

[0115] During the certification process 750, KDF 2300 can be used in UDM NF 418 and ME 601. Figure 24 This is a flowchart illustrating additional steps of method 900 in an illustrative embodiment. The authentication entity 720 can derive the root key (e.g., K) based on IMEI 642 used for ME 601. AUSF Key 2310 (step 2402). For example, UDM NF 418 can input the XOR of the Service Network Name (SNN) 2308, the Serial Number (SQN), and the Anonymous Key (AK), along with the IMEI 642 for ME 601, into KDF2300 to obtain K. AUSF Key 2310, such as when generating authentication vector 730. SNN 2308 is the name or identifier of the serving network 706, such as 6G: the PLMN-ID used for serving the PLMN, although other network identifiers are considered in this paper. One technical advantage is K AUSF Key 2310 can be derived as a function of IMEI 642, therefore IMEI 642 of ME 601 is associated with the authentication of SIM 660.

[0116] Any of the various elements or modules shown in the figures or described herein can be implemented as hardware, software, firmware, or some combination thereof. For example, an element can be implemented as dedicated hardware. A dedicated hardware element can be referred to as a “processor,” a “controller,” or some similar term. When provided by a processor, functionality can be provided by a single dedicated processor, a single shared processor, or multiple individual processors, some of which may be shared. Furthermore, the explicit use of the terms “processor” or “controller” should not be construed as referring only to hardware capable of executing software, but may implicitly include, but is not limited to, digital signal processor (DSP) hardware, network processors, application-specific integrated circuits (ASICs) or other circuit systems, field-programmable gate arrays (FPGAs), read-only memory (ROM) for storing software, random access memory (RAM), non-volatile memory, logic, or some other physical hardware component or module.

[0117] Furthermore, an element can be implemented as instructions executable by a processor or computer to perform the element's functions. Some examples of instructions are software, program code, and firmware. When executed by a processor, instructions are operable to instruct the processor to perform the element's functions. Instructions can be stored on a processor-readable storage device. Some examples of storage devices are digital or solid-state memories, magnetic storage media such as disks and tapes, hard disk drives, or optically readable digital data storage media.

[0118] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Hardware circuit implementation only (such as implementation in analog and / or digital circuit systems only); (b) A combination of hardware circuitry and software, such as (if applicable): (i) A combination of (multiple) analog and / or digital hardware circuits with software / firmware; and (ii) Any part of a hardware processor (including digital signal processors), software, and memory (including multiple memory) that works together to enable a device such as a mobile phone or server to perform various functions; and (c) (Multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or a portion thereof, which require software (e.g., firmware) to function, but may be absent when not in use.

[0119] This definition of circuit system applies to all uses of the term in this application, including in any claim. As another example, as used in this application, the term circuit system also covers only hardware circuitry or a processor (or multiple processors) or a portion of hardware circuitry or a processor and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuit also covers baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices, or other computing or network devices.

[0120] Although specific embodiments have been described herein, the scope of this disclosure is not limited to these specific embodiments. The scope of this disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A communication device, comprising: Subscriber Identity Module (SIM); as well as A mobile device includes at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, cause the mobile device to perform at least the following: Send a registration request to the home network of the communication device; Receive an authentication request message, the authentication request message containing a homomorphically encrypted SIM authentication challenge calculated by the home network using homomorphic encryption to authenticate the SIM; as well as Provide the homomorphically encrypted SIM authentication challenge to the SIM; The SIM is configured to compute a homomorphically encrypted SIM challenge response based on the homomorphically encrypted SIM authentication challenge; When executed by the at least one processor, the instructions also cause the mobile device to perform at least the following: Receive the homomorphically encrypted SIM challenge response computed by the SIM; and Send an authentication response message containing the homomorphic encrypted SIM challenge response.

2. The communication device according to claim 1, wherein: The homomorphic encrypted SIM authentication challenge is a function of at least the following: the encrypted serial number, the public key of the home network, the subscription permalink associated with the SIM, and the mobile device identifier of the mobile device.

3. The communication device according to claim 1, wherein: The SIM is configured to compute the homomorphically encrypted SIM challenge response by inputting at least the home network's public key and the homomorphically encrypted SIM authentication challenge into a homomorphic encryption evaluation function.

4. The communication device according to claim 3, wherein: When the instructions are executed by the at least one processor, the mobile device causes at least the following to be performed: Receive the home network public key identifier sent by the home network; as well as Provide the home network public key identifier to the SIM; and The SIM is configured to identify the public key of the home network based on the home network public key identifier.

5. The communication device according to claim 1, wherein sending the registration request includes: Send the registration request containing the following: a subscription permalink associated with the SIM, and a mobile device identifier of the mobile device hidden in a subscription hidden identifier.

6. A method for communication, comprising: In communication devices that include a subscriber identity module (SIM) and mobile devices, Send a registration request to the home network of the communication device; At the mobile device, an authentication request message is received, the authentication request message containing a homomorphically encrypted SIM authentication challenge calculated by the home network using homomorphic encryption to authenticate the SIM; At the mobile device, the homomorphic encrypted SIM authentication challenge is provided to the SIM; At the SIM, the homomorphically encrypted SIM challenge response is calculated based on the homomorphically encrypted SIM authentication challenge; At the mobile device, the homomorphically encrypted SIM challenge response calculated by the SIM is received; as well as Send an authentication response message containing the homomorphic encrypted SIM challenge response.

7. The method according to claim 6, wherein: The homomorphic encrypted SIM authentication challenge is a function of at least the following: the encrypted serial number, the public key of the home network, the subscription permalink associated with the SIM, and the mobile device identifier of the mobile device.

8. The method of claim 6, wherein the calculation of the homomorphically encrypted SIM challenge response comprises: At least the public key of the home network and the homomorphically encrypted SIM authentication challenge are input into the homomorphic encryption evaluation function.

9. The method according to claim 8, further comprising: At the mobile device, a home network public key identifier sent by the home network is received; At the mobile device, the home network public key identifier is provided to the SIM; as well as At the SIM, the public key of the home network is identified based on the home network public key identifier.

10. The method of claim 6, wherein sending the registration request comprises: Send the registration request containing the following: a subscription permalink associated with the SIM, and a mobile device identifier of the mobile device hidden in a subscription hidden identifier.

11. An apparatus for communication, comprising a home network authentication entity in the home network of a communication device, wherein the communication device includes a mobile device and a subscriber identity module (SIM), the apparatus comprising: At least one processor; as well as At least one memory stores instructions that, when executed by the at least one processor, cause the home network authentication entity to perform at least the following: Receive a first authentication request message regarding the registration of the communication device with the home network; Homomorphic encryption is used to compute a homomorphic SIM authentication challenge for the SIM used to authenticate the communication device; as well as Send a first authentication response message containing the homomorphic encryption SIM authentication challenge.

12. The apparatus according to claim 11, wherein: The homomorphic encryption SIM authentication challenge is a function of the following: the subscription permanent identifier associated with the SIM, and the mobile device identifier of the mobile device.

13. The apparatus of claim 12, wherein the calculation of the homomorphic encrypted SIM authentication challenge comprises: At least the encrypted serial number, the home network's public key, the subscription permanent identifier, and the mobile device identifier are input into the homomorphic encryption algorithm to calculate the homomorphically encrypted SIM authentication challenge.

14. The apparatus of claim 13, wherein the instructions, when executed by the at least one processor, cause the home network authentication entity to perform at least: The encrypted serial number is generated by encrypting the serial number using a long-term key.

15. The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, cause the home network authentication entity to perform at least: Receive a second authentication request message, the second authentication request message including a homomorphically encrypted SIM challenge response calculated by the SIM in response to the homomorphically encrypted SIM authentication challenge; and Perform verification of the homomorphically encrypted SIM challenge response, which is calculated by the SIM in response to the homomorphically encrypted SIM authentication challenge.

16. The apparatus of claim 15, wherein the verification of the SIM challenge response performing the homomorphic encryption includes: Calculate the expected challenge response from the SIM; The homomorphic encrypted SIM challenge response is decrypted using a homomorphic decryption algorithm to calculate the decrypted challenge response; as well as The decrypted challenge response is compared with the expected challenge response.

17. The apparatus of claim 16, wherein the decryption of the homomorphically encrypted SIM challenge response comprises: The home network key and the homomorphically encrypted SIM challenge response are input into the homomorphic decryption algorithm to calculate the decrypted challenge response.

18. The apparatus of claim 11, wherein receiving the first authentication request message comprises: Receive a first authentication request message containing the following: a subscription permanent identifier associated with the SIM, and a mobile device identifier of the mobile device hidden in a subscription hidden identifier.

19. The apparatus of claim 18, wherein the instructions, when executed by the at least one processor, cause the home network authentication entity to perform at least: Unhide the subscription hidden identifier; and Link the subscription permanent identifier and the mobile device identifier.

20. The apparatus of claim 18, wherein the instructions, when executed by the at least one processor, cause the home network authentication entity to perform at least: The authentication method is selected based on whether the communication device supports homomorphic encryption, indicated by the subscription permanent identifier.

Images