Apparatus, method and computer program

Abstract

There is provided an apparatus comprising means for generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

Description

[0001] APPARATUS, METHOD AND COMPUTER PROGRAM

[0002] Field

[0003] The present application relates to a method, apparatus, system and computer program and in particular but not exclusively to mobile equipment SoR UPU counter link to KAUSF key.

[0004] Background

[0005] A communication system can be seen as a facility that enables communication sessions between two or more entities such as user terminals, base stations and / or other nodes by providing carriers between the various entities involved in the communications path. A communication system can be provided for example by means of a communication network and one or more compatible communication devices. The communication sessions may comprise, for example, communication of data for carrying communications such as voice, video, electronic mail (email), text message, multimedia and / or content data and so on. Non-limiting examples of services provided comprise two-way or multi-way calls, data communication or multimedia services and access to a data network system, such as the Internet.

[0006] In a wireless communication system at least a part of a communication session between at least two stations occurs over a wireless link. Examples of wireless systems comprise public land mobile networks (PLMN), satellite based communication systems and different wireless local networks, for example wireless local area networks (WLAN). Some wireless systems can be divided into cells, and are therefore often referred to as cellular systems.

[0007] A user can access the communication system by means of an appropriate communication device or terminal. A communication device of a user may be referred to as user equipment (UE) or user device. A communication device is provided with an appropriate signal receiving and transmitting apparatus for enabling communications, for example enabling access to a communication network or communications directly with other users. The communication device may access a carrier provided by a station, for example a base station of a cell, and transmit and / or receive communications on the carrier.

[0008] The communication system and associated devices typically operate in accordance with a given standard or specification which sets out what the various entities associated with the system are permitted to do and how that should be achieved. Communication protocols and / or parameters which shall be used for the connection are also typically defined. One example of a communications system is Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN) (3G radio). Other examples of communication systems are the long-term evolution (LTE) of the Universal Mobile Telecommunications System (UMTS) radio-access technology and so-called 5G or New Radio (NR) networks. NR is being standardized by the 3rd Generation Partnership Project (3GPP). Other examples of communication systems include 5G-Advanced (NR Rel-18 and beyond) and 6G.

[0009] Summary

[0010] In a first aspect there is provided an apparatus comprising means for generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

[0011] The apparatus may comprise means for determining that at least one counter stored at the mobile equipment is invalid based on the comparing.

[0012] The at least one counter may be stored in a non-volatile memory of the mobile equipment. The at least one counter may comprise at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

[0013] The apparatus may comprise means for generating the first identifier and the second identifier based on at least one of the following: a fixed string and the length of the fixed string.

[0014] The apparatus may comprise means for generating the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier associated with the mobile equipment and the length of the permanent equipment identifier associated with the mobile equipment.

[0015] The apparatus may comprise means for generating the first identifier and the second identifier based on at least one of the following: a medium access control address associated with the mobile equipment and the length of the medium access control address associated with the mobile equipment.

[0016] In a second aspect there is provided a method comprising generating, on insertion of a universal subscriber identity module, IISIM, in a mobile equipment, a first identifier based on a first authentication key stored at the IISIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

[0017] The method may comprise determining that at least one counter stored at the mobile equipment is invalid based on the comparing.

[0018] The at least one counter may be stored in a non-volatile memory of the mobile equipment. The at least one counter may comprise at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

[0019] The method may comprise generating the first identifier and the second identifier based on at least one of the following: a fixed string and the length of the fixed string.

[0020] The method may comprise generating the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier associated with the mobile equipment and the length of the permanent equipment identifier associated with the mobile equipment.

[0021] The method may comprise generating the first identifier and the second identifier based on at least one of the following: a medium access control address associated with the mobile equipment and the length of the medium access control address associated with the mobile equipment.

[0022] In a third aspect there is provided a computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to perform at least the following generating, on insertion of a universal subscriber identity module, IISIM, in a mobile equipment, a first identifier based on a first authentication key stored at the IISIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

[0023] The apparatus may be caused to perform determining that at least one counter stored at the mobile equipment is invalid based on the comparing.

[0024] The at least one counter may be stored in a non-volatile memory of the mobile equipment. The at least one counter may comprise at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

[0025] The apparatus may be caused to perform generating the first identifier and the second identifier based on at least one of the following: a fixed string and the length of the fixed string.

[0026] The apparatus may be caused to perform generating the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier associated with the mobile equipment and the length of the permanent equipment identifier associated with the mobile equipment.

[0027] The apparatus may be caused to perform generating the first identifier and the second identifier based on at least one of the following: a medium access control address associated with the mobile equipment and the length of the medium access control address associated with the mobile equipment.

[0028] In a fourth aspect there is provided an apparatus, comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to generating, on insertion of a universal subscriber identity module, IISIM, in a mobile equipment, a first identifier based on a first authentication key stored at the IISIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key; and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

[0029] The apparatus may be caused to determine that at least one counter stored at the mobile equipment is invalid based on the comparing.

[0030] The at least one counter may be stored in a non-volatile memory of the mobile equipment. The at least one counter may comprise at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

[0031] The apparatus may be caused to generate the first identifier and the second identifier based on at least one of the following: a fixed string and the length of the fixed string.

[0032] The apparatus may be caused to generate the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier associated with the mobile equipment and the length of the permanent equipment identifier associated with the mobile equipment.

[0033] The apparatus may be caused to generate the first identifier and the second identifier based on at least one of the following: a medium access control address associated with the mobile equipment and the length of the medium access control address associated with the mobile equipment.

[0034] In a fifth aspect there is provided a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform at least the method according to the second aspect.

[0035] In the above, many different embodiments have been described. It should be appreciated that further embodiments may be provided by the combination of any two or more of the embodiments described above.

[0036] Description of Figures

[0037] Embodiments will now be described, by way of example only, with reference to the accompanying Figures in which:

[0038] Figure 1 shows a schematic diagram of an example 5GS communication system; Figure 2 shows a schematic diagram of an example mobile communication device;

[0039] Figure 3 shows a schematic diagram of an example control apparatus;

[0040] Figure 4 shows a schematic diagram of a UE;

[0041] Figure 5 shows a schematic diagram of key storage at a UE;

[0042] Figure 6 shows a schematic diagram of counter storage at a UE;

[0043] Figure 7 shows a signalling diagram for a scenario where a USIM is removed from a ME1 and inserted into ME2;

[0044] Figure 8 shows a flowchart of a method according to an example embodiment;

[0045] Figure 9 shows a schematic diagram of generating an identifier;

[0046] Figure 10 shows a schematic diagram of generating an identifier;

[0047] Figure 11 shows a schematic diagram of generating an identifier;

[0048] Figure 12 shows a schematic diagram of generating an identifier.

[0049] Detailed description

[0050] Before explaining in detail the examples, certain general principles of a wireless communication system and mobile communication devices are briefly explained with reference to Figure 1 , Figure 2 and Figure 3 to assist in understanding the technology underlying the described examples.

[0051] An example of a suitable communications system is the 5G or NR concept. Network architecture in NR may be similar to that of LTE-advanced. Base stations of NR systems may be known as next generation NodeBs (gNBs). Changes to the network architecture may depend on the need to support various radio technologies and finer Quality of Service (QoS) support, and some on-demand requirements for e.g. QoS levels to support Quality of Experience (QoE) for a user. Also network aware services and applications, and service and application aware networks may bring changes to the architecture. Those are related to Information Centric Network (ICN) and User-Centric Content Delivery Network (UC-CDN) approaches. NR may use Multiple Input - Multiple Output (MIMO) antennas, many more base stations or nodes than the LTE (a so-called small cell concept), including macro sites operating in co-operation with smaller stations and perhaps also employing a variety of radio technologies for better coverage and enhanced data rates.

[0052] Future networks may utilise network functions virtualization (NFV) which is a network architecture concept that proposes virtualizing network node functions into “building blocks” or entities that may be operationally connected or linked together to provide services. A virtualized network function (VNF) may comprise one or more virtual machines running computer program codes using standard or general type servers instead of customized hardware. Cloud computing or data storage may also be utilized. In radio communications this may mean node operations to be carried out, at least partly, in a server, host or node operationally coupled to a remote radio head. It is also possible that node operations will be distributed among a plurality of servers, nodes or hosts. It should also be understood that the distribution of labour between core network operations and base station operations may differ from that of the LTE or even be non-existent.

[0053] Figure 1 shows a schematic representation of a 5G system (5GS) 100. The 5GS may comprise a user equipment (UE) 102 (which may also be referred to as a communication device or a terminal), a 5G radio access network (5G RAN) 104, a 5G core network (5G CN) 106, one or more internal or external application functions (AF) 108 and one or more data networks (DN) 110.

[0054] An example 5G core network (CN) comprises functional entities. The 5GCN 106 may comprise one or more Access and mobility Management Functions (AMF) 112, one or more Session Management Functions (SMF) 114, an Authentication Server Function (AUSF) 116, a Unified Data Management (UDM) 118, one or more user plane functions (UPF) 120, a Unified Data Repository (UDR) 122 and / or a Network Exposure Function (NEF) 124. The UPF is controlled by the SMF (Session Management Function) that receives policies from a PCF (Policy Control Function).

[0055] The CN is connected to a UE via the Radio Access Network (RAN). The 5GRAN may comprise one or more gNodeB (gNB) Distributed Unit(DU) functions connected to one or more gNodeB (gNB) Centralized Unit(CU) functions. The RAN may comprise one or more access nodes.

[0056] A User Plane Function (UPF) referred to as PDU Session Anchor (PSA) may be responsible for forwarding frames back and forth between the DN and the tunnels established over the 5G towards the UE(s) exchanging traffic with the DN.

[0057] A possible mobile communication device will now be described in more detail with reference to Figure 2 showing a schematic, partially sectioned view of a communication device 200. Such a communication device is often referred to as user equipment (UE) or terminal. An appropriate mobile communication device may be provided by any device capable of sending and receiving radio signals. Non-limiting examples comprise a mobile station (MS) or mobile device such as a mobile phone or what is known as a ’smart phone’, a computer provided with a wireless interface card or other wireless interface facility (e.g., USB dongle), personal data assistant (PDA) or a tablet provided with wireless communication capabilities, voice over IP (VoIP) phones, portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, wireless endpoints, mobile stations, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), smart devices, wireless customer-premises equipment (CPE), or any combinations of these or the like. A mobile communication device may provide, for example, communication of data for carrying communications such as voice, electronic mail (email), text message, multimedia and so on. Users may thus be offered and provided numerous services via their communication devices. Non-limiting examples of these services comprise two-way or multi-way calls, data communication or multimedia services or simply an access to a data communications network system, such as the Internet. Users may also be provided broadcast or multicast data. Non-limiting examples of the content comprise downloads, television and radio programs, videos, advertisements, various alerts, and other information.

[0058] A mobile device is typically provided with at least one data processing entity 201 , at least one memory 202 and other possible components 203 for use in software and hardware aided execution of tasks it is designed to perform, including control of access to and communications with access systems and other communication devices. The data processing, storage and other relevant components can be provided on an appropriate circuit board and / or in chipsets. This feature is denoted by reference 204. The user may control the operation of the mobile device by means of a suitable user interface such as key pad 205, voice commands, touch sensitive screen or pad, combinations thereof or the like. A display 208, a speaker and a microphone can be also provided. Furthermore, a mobile communication device may comprise appropriate connectors (either wired or wireless) to other devices and / or for connecting external accessories, for example hands-free equipment, thereto.

[0059] The mobile device 200 may receive signals over an air or radio interface 207 via appropriate apparatus for receiving and may transmit signals via appropriate apparatus for transmitting radio signals. In Figure 2 transceiver apparatus is designated schematically by block 206. The transceiver apparatus 206 may be provided for example by means of a radio part and associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0060] Figure 3 shows an example of a control apparatus 300 for a communication system, for example to be coupled to and / or for controlling a station of an access system, such as a RAN node, e.g. a base station, eNB or gNB, a relay node or a core network node such as an MME or Serving Gateway (S-GW) or Packet Data Network Gateway (P-GW), or a core network function such as AMF / SMF, or a server or host. The method may be implemented in a single control apparatus or across more than one control apparatus. The control apparatus may be integrated with or external to a node or module of a core network or RAN. In some embodiments, base stations comprise a separate control apparatus unit or module. In other embodiments, the control apparatus can be another network element such as a radio network controller or a spectrum controller. In some embodiments, each base station may have such a control apparatus as well as a control apparatus being provided in a radio network controller. The control apparatus 300 can be arranged to provide control on communications in the service area of the system. The control apparatus 300 comprises at least one memory 301 , at least one data processing unit 302, 303 and an input / output interface 304. Via the interface the control apparatus can be coupled to a receiver and a transmitter of the base station. The receiver and / or the transmitter may be implemented as a radio front end or a remote radio head.

[0061] A user equipment may comprise a mobile equipment (ME) and a universal subscriber identity module (IISIM) which is inserted in the ME. The ME may comprise a non-volatile memory (NVM). Figure 4 shows a block diagram of a UE 400 including a ME 401 , a USIM 402 and a NVM 403.

[0062] The following 5G mobility management (5GMM) parameters shall be stored on the USIM if the corresponding file is present: 5G-Globally Unique Temporary Identifier (GUTI), last visited registered Tracking Area Identifier (TAI), 5GS update status, 5G Non-Access Stratum (NAS) security context parameters from a full native 5G NAS security context, KAUSF and KSEAF, steering of roaming (SOR) counter; and UE parameter update (UPU) counter.

[0063] The UE may support multiple records of NAS security context storage for multiple registration. If the UE supports multiple records of NAS security context storage for multiple registration, the first 5G security context of one access shall be stored in record 1 of the 5G NAS Security Context USIM file for that access and the second 5G security context of that access shall be stored in record 2 of the same file. The presence and format of corresponding files on the USIM is specified in 3GPP standards. If the corresponding file is not present on the IISIM, these 5GMM parameters are stored in a non-volatile memory in the ME together with the SlIPI from the IISIM. These 5GMM parameters can only be used if the SLIPI from the IISIM matches the SLIPI stored in the non-volatile memory; else the UE shall delete the 5GMM parameters.

[0064] The following 5GMM parameters shall be stored in a non-volatile memory in the ME together with the Subscription Permanent Identifier (SLIPI) from the IISIM, configured Network Slice Selection Assistance Information (NSSAI(s)), Network Slice Simultaneous Registration Group (NSSRG) information, NSSAI inclusion mode(s), Multimedia Priority Service (MPS) Indicator, Modulation and Coding Scheme (MCS) indicator, operator-defined access category definitions, network- assigned UE radio capability IDs, CAG information list" (if the UE supports CAG), signalled URSP, SOR-CMCI one or more lists of type "list of PLMN(s) to be used in disaster condition" (if the UE supports MINT), disaster roaming wait range, if the UE supports MINT, disaster return wait range, if the UE supports MINT, indication of whether disaster roaming is enabled in the UE and indication of 'applicability of "lists of Public Land Mobile Networks (PLMN(s)) to be used in disaster condition" provided by a visited PLMN (VPLMN)'.

[0065] The following 5GMM parameters should be stored in a non-volatile memory in the ME together with the SUPI from the USIM: allowed NSSAI(s).

[0066] Each configured NSSAI consists of S-NSSAI(s) stored together with a PLMN identity, if it is associated with a PLMN. The UE shall store the S-NSSAI(s) of the HPLMN. If the UE is in the VPLMN, the UE shall also store the configured NSSAI for the current PLMN and any necessary mapped S-NSSAI(s). The configured NSSAI(s) can only be used if the SUPI from the USIM matches the SUPI stored in the non-volatile memory of the ME, otherwise the UE shall delete the configured NSSAI(s). A configured NSSAI may be associated with NSSRG information.

[0067] That is, parameters stored on USIM and / or on non-volatile memory (NVM) of the ME may comprise the following: SUPI, KAUSF, SOR counter or UPU counter. Figure 5 shows a schematic diagram of key storage on a UE. For KAUSF key storage, if Service n°123 is "available" in EFUST on the IISIM, then the ALISF Key KAUSF is stored in Elementary File of 5G Authentication keys EFSGAUTHKEYS on the IISIM otherwise the KAUSF is stored in non-volatile memory (NVM) of the ME.

[0068] Figure 6 shows a schematic diagram of storage on a UE for SoR and UPU counters. If Service n°123 and Service n°133 are "available" in Elementary File of User Service Description EFUST on the USIM, then the SOR counter and the UE parameter update counter are stored in EFSGAUTHKEYS on the USIM otherwise the SOR counter and the UE parameter update counter are stored in NVM of the ME.

[0069] If the KAUSF is stored on the USIM and the SOR counter and the UE parameter update counter are not present on the USIM, then the SOR counter and the UE parameter update counter stored in NVM are considered as valid after power up, if the SUPI stored in NVM of the ME is equal to the SUPI of the inserted USIM.

[0070] However, the USIM could have been used in a different ME-2 in the meantime and a new authentication could have been triggered in the ME-2. In this case if the USIM is re-inserted in ME-1 , ME-1 would apply the outdated previously stored counters, i.e. , the counters stored in the NVM of ME-1 related to the previous KAUSF might be higher than the counters used in the context of the new KAUSF. In consequence new SOR messages would be ignored due to outdated counter values store in NVM of ME-1.

[0071] Figure 7 shows a signaling diagram of a scenario where a USIM is reinserted in ME-1 after being inserted in ME-2.

[0072] In part A, the USIM is inserted in ME#1.

[0073] In step 1 , primary authentication is successful with USIM via ME#1 and UDM.

[0074] In step 2a, the Key KAUSF#I is generated and stored at the USIM. In step 2b, SoR counter#1 and UPU counter#1 is stored in the NVM of ME#1.

[0075] In part B, the IISIM is inserted in ME#2.

[0076] In step 3, the IISIM is removed from ME#1 and inserted into ME#2.

[0077] In step 4, primary authentication is successful with IISIM via ME#2 and UDM.

[0078] In step 5a, a new key KAUSF#2 is generated and stored in IISIM.

[0079] In step 5b, SoR counter#2 and UPU counter#2 is stored in NVM of ME#2.

[0080] In part C, the USIM is reinserted into ME#1.

[0081] In step 6, the SUPI on USIM and ME#1 is the same so it continues to work as normal. However, in step 7, KAUSF is new but the UPU and SoR counters are older and the older context shouldn’t be used.

[0082] Figure 8 shows a flowchart of a method according to an example embodiment. The method may be performed at UE such as that described with reference to Figure 2. The UE may be a mobile equipment comprising a USIM. The method may be performed at e.g., the USIM of the UE.

[0083] In 801 the method comprises generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM.

[0084] In 802, the method comprises comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key.

[0085] In 803, the method comprises, based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network. The method may comprise determining that at least one counter stored at the mobile equipment is invalid based on the comparing. The at least one counter may be stored in a non-volatile memory of the mobile equipment. The at least one counter may comprise at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

[0086] The first identifier and second identifier may be generated at a key distribution function (KDF) at the IISIM.

[0087] An authentication key (an example of which is KAUSF) is generated when a IISIM performs an authentication procedure with a core network via a ME. The authentication key may be stored at the IISIM.

[0088] In an example embodiment, an identifier is generated and stored at the mobile equipment (ME). When the IISIM is reinserted into the ME following removal (i.e., switched between ME#1 and ME#2) and, if SlIPI matches, the identifier is also generated with KAUSF in IISIM . If the identifier generated in IISIM and the identifier stored in the ME does not match, then ME will trigger re-authentication. If it is matching, then the existing KAUSF can be used for SoR or UPU procedure.

[0089] For example, ME#1 will generate an identifier using KAUSF in USIM and store in ME#1 (this is an example of the second identifier stored at the ME). ME#2 will also generate an identifier using newly generated KAUSF in USIM and store it in ME#2. When USIM changes from ME#2 to ME#1 a new KAUSF generated and stored in USIM. When a SoR packet is received, then ME#1 will newly generate an identifier using updated key KAUSF in USIM (this is an example of the first identifier) and compare it to previously stored ME#1 identifier. If this mismatches, then SoR packet is ignored and re-authentication is triggered. The comparing of identifiers may be done at any time, not be only when SoR packet is received.

[0090] The method may comprise generating the first identifier and the second identifier based on at least one of the following: the length of a first string and the first string. ME_AND_KEY_ID is an example of a first string. AUSF_KEY_ID is an alternative example of a first string.

[0091] The method may comprise generating the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier (PEI) associated with the mobile equipment and the length of the PEI associated with the mobile equipment.

[0092] The method may comprise generating the first identifier based on at least one of the following: a medium access control (MAC) address associated with the mobile equipment and the length of the MAC address associated with the mobile equipment.

[0093] FC may be used to distinguish between different instances of the algorithm used for generating the identifier. FC may either be a single octet or consists of two octets of the form FC11| FC2 where FC1 = OxFF and FC2 is a single octet.

[0094] Figure 9 shows a schematic diagram of an example embodiment for generating an identifier (which may be the first identifier or second identifier) based on the PEI of the ME and the length of the PEI of the ME. In this example embodiment, the identifier is referred to as ME_AND_KEY_ID and the authentication key as KAUSF. In the example embodiment, the identifier is generated at a key distribution function (KDF) of the IISIM. In this example embodiment, when generating the ME_AND_KEY_ID from KAUSF, the following parameters shall be used to form the input S to the KDF:

[0095] FC = OxWX;

[0096] P0 = PEI;

[0097] LO = length of PEI.

[0098] The input key KEY shall be KAUSF.

[0099] Figure 10 shows a schematic diagram of an example embodiment for generating an identifier (which may be the first identifier or the second identifier) based on the PEI of the ME and the length of the PEI of the ME, a first string (wherein the string is “ME_AND_KEY_ID”) and the length of the first string. In this example embodiment, the identifier is referred to as ME_AND_KEY_ID and the authentication key, referred to as KAUSF. In the example embodiment, the identifier is generated at a key distribution function (KDF) of a IISIM. In this example embodiment, when generating the ME_AND_KEY_ID from KAUSF, the following parameters shall be used to form the input S to the KDF:

[0100] FC = OxWX;

[0101] PO = “ME_AND_KEY_ID”;

[0102] LO = Length of “ME_AND_KEY_ID”; (i.e. 0x00 Oxc)

[0103] P1 = PEI;

[0104] L1 = length of PEI;

[0105] The input key KEY shall be KAUSF.

[0106] Figure 11 shows a schematic diagram of an example embodiment for generating an identifier (which may be the first identifier or the second identifier based on a first string and the length of the first string (wherein the string is “ALISF KEY ID”). In this example embodiment, the identifier is referred to as ALISF KEY ID and the authentication key as KAUSF. In the example embodiment, the identifier is generated at a key distribution function (KDF) at a IISIM. In this example embodiment, when generating the ALISF KEY ID from KAUSF, the following parameters shall be used to form the input S to the KDF:

[0107] FC = 0x8C;

[0108] PO = "ALISF KEY ID";

[0109] LO = length of "AUSF KEY ID "; (i.e. 0x00 0x0b);

[0110] The input key KEY shall be KAUSF.

[0111] Figure 12 shows a schematic diagram of an example embodiment for generating an identifier (which may be the first identifier or the second identifier) based on a first string and the length of the first string (wherein the string is “AUSF KEY ID”), a medium access control (MAC) address associated with the mobile equipment and the length of the MAC address associated with the mobile equipment. In this example embodiment, the identifier is referred to as AUSF_KEY_ID and the authentication key as KAUSF. In this example embodiment, the identifier is generated at a key distribution function (KDF) of a USIM. In this example embodiment, when generating the ALISF KEY ID from KAUSF, the following parameters shall be used to form the input S to the KDF:

[0112] FC = 0x8C;

[0113] PO = "ALISF KEY ID";

[0114] LO = length of "AUSF KEY ID (i.e. 0x00 0x0b);

[0115] P1 = MAC Address;

[0116] L1 = length of MAC Address;

[0117] The input key KEY shall be KAUSF.

[0118] The examples described above are applicable not only for SoR counter but also for UPU counters also.

[0119] An apparatus may comprise means for generating, on insertion of a universal subscriber identity module, IISIM, in a mobile equipment, a first identifier based on a first authentication key stored at the IISIM, comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

[0120] The apparatus may comprise a user equipment, such as a mobile phone or mobile equipment, be the user equipment or be comprised in the user equipment or a chipset for performing at least some actions of / for the user equipment.

[0121] It should be understood that the apparatuses may comprise or be coupled to other units or modules etc., such as radio parts or radio heads, used in or for transmission and / or reception. Although the apparatuses have been described as one entity, different modules and memory may be implemented in one or more physical or logical entities.

[0122] It is noted that whilst some embodiments have been described in relation to 5G networks, similar principles can be applied in relation to other networks and communication systems such as 6G networks or 5G-Advanced networks. Therefore, although certain embodiments were described above by way of example with reference to certain example architectures for wireless networks, technologies and standards, embodiments may be applied to any other suitable forms of communication systems than those illustrated and described herein.

[0123] It is also noted herein that while the above describes example embodiments, there are several variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0124] As used herein, “at least one of the following: ” and “at least one of ” and similar wording, where the list of two or more elements are joined by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.

[0125] In general, the various embodiments may be implemented in hardware or special purpose circuitry, software, logic or any combination thereof. Some aspects of the disclosure may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the disclosure is not limited thereto. While various aspects of the disclosure may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0126] As used in this application, the term “circuitry” may refer to one or more or all of the following:

[0127] (a) hardware-only circuit implementations (such as implementations in only analog and / or digital circuitry) and

[0128] (b) combinations of hardware circuits and software, such as (as applicable):

[0129] (i) a combination of analog and / or digital hardware circuit(s) with software / firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions) and

[0130] I hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.”

[0131] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

[0132] The embodiments of this disclosure may be implemented by computer software executable by a data processor of the mobile device, such as in the processor entity, or by hardware, or by a combination of software and hardware. Computer software or program, also called program product, including software routines, applets and / or macros, may be stored in any apparatus-readable data storage medium and they comprise program instructions to perform particular tasks. A computer program product may comprise one or more computer-executable components which, when the program is run, are configured to carry out embodiments. The one or more computer-executable components may be at least one software code or portions of it.

[0133] Further in this regard it should be noted that any blocks of the logic flow as in the Figures may represent program steps, or interconnected logic circuits, blocks and functions, or a combination of program steps and logic circuits, blocks and functions. The software may be stored on such physical media as memory chips, or memory blocks implemented within the processor, magnetic media such as hard disk or floppy disks, and optical media such as for example DVD and the data variants thereof, CD. The physical media is a non-transitory media. The term “non- transitory,” as used herein, is a limitation of the medium itself (i.e., tangible, not a signal) as opposed to a limitation on data storage persistency (e.g., RAM vs. ROM).

[0134] The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors may be of any type suitable to the local technical environment, and may comprise one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASIC), FPGA, gate level circuits and processors based on multi core processor architecture, as non-limiting examples.

[0135] Embodiments of the disclosure may be practiced in various components such as integrated circuit modules. The design of integrated circuits is by and large a highly automated process. Complex and powerful software tools are available for converting a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate.

[0136] The scope of protection sought for various embodiments of the disclosure is set out by the independent claims. The embodiments and features, if any, described in this specification that do not fall under the scope of the independent claims are to be interpreted as examples useful for understanding various embodiments of the disclosure.

[0137] The foregoing description has provided by way of non-limiting examples a full and informative description of the exemplary embodiment of this disclosure. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications of the teachings of this disclosure will still fall within the scope of this invention as defined in the appended claims. Indeed, there is a further embodiment comprising a combination of one or more embodiments with any of the other embodiments previously discussed.

Claims

1 . An apparatus comprising means for: generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM; comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key; and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

2. The apparatus according to claim 1 , comprising means for determining that at least one counter stored at the mobile equipment is invalid based on the comparing.

3. The apparatus according to claim 2, wherein the at least one counter is stored in a non-volatile memory of the mobile equipment.

4. The apparatus according to claim 2 or claim 3, wherein the at least one counter comprises at least one of the following: a user equipment parameter update, UPU, counter and a steering of roaming, SOR, counter.

5. The apparatus according to any of claims 1 to 4, comprising means for generating the first identifier and the second identifier based on at least one of the following: a fixed string and the length of the fixed string.

6. The apparatus according to any of claims 1 to 5, comprising means for generating the first identifier and the second identifier based on at least one of the following: a permanent equipment identifier associated with the mobile equipment and the length of the permanent equipment identifier associated with the mobile equipment.

7. The apparatus according to claim 5, comprising means for generating the first identifier and the second identifier based on at least one of the following: a medium access control address associated with the mobile equipment and the length of the medium access control address associated with the mobile equipment.

8. A method comprising: generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM; comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key; and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

9. A computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to perform at least the following: generating, on insertion of a universal subscriber identity module, USIM, in a mobile equipment, a first identifier based on a first authentication key stored at the USIM; comparing the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key; and based on the comparing, providing an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

10. An apparatus, comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:generate, on insertion of a universal subscriber identity module, IISIM, in a mobile equipment, a first identifier based on a first authentication key stored at the IISIM; compare the first identifier with a second identifier stored at the mobile equipment, wherein the second identifier is generated based on a second authentication key; and based on the comparing, provide an indication to a core network to cause an authentication procedure between the mobile equipment and the core network.

Images