Methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario

Abstract

Methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario Embodiments herein is to disclose methods and systems for managing Subscription Permanent Identifier (SUPI) privacy in a Public Land Mobile Network (PLMN) hosting Non-Public Network (NPN) scenario in a wireless communication network, wherein SUPI privacy is provided using a virtual SUPI without impacting operations of a User Equipment (UE) currently being served by the wireless communication network. Embodiments herein disclose a key (K_AMF) being generated at an operator premises instead of customer premises. Embodiments herein disclose virtual SUPI being provided to a Lawful Interception (LI) framework (if required), while preserving the SUPI privacy at customer side.

Description

Methods and systems for managing SUPI privacy in a PLMN hosting NPN scenarioTECHNICAL FIELD

[0001] Embodiments disclosed herein relate to wireless communication networks, and more particularly to managing the privacy of a Subscription Permanent Identifier (SUPI) in a scenario, wherein a Public Land Mobile Network (PLMN) is hosting a Non-Public Network (NPN) in wireless communication networks.BACKGROUND

[0002] SAI working group of 3GPP has captured the scenario for Non-Public Network (NPN) security considerations in clause 8.2 of TS 22.261, where the 5G system shall enable a PLMN to host an NPN without compromising the security of that PLMN. Dedicated network entities of NPN can be deployed in customer premises that are outside the control of the PLMN operator. PLMN hosting NPN refers to the Public Land Mobile Network (PLMN) supporting NPN scenarios. This scenario describes a situation where a PLMN is configured to support and integrate with an NPN. In practical terms, it means that the PLMN allows devices or users from the NPN to connect to its infrastructure and services, even though those devices / users are part of a private, non-public network. For example, consider an enterprise that has its own internal communication system (i.e., the NPN) for employees to use within their offices. However, they also want their employees to have access to public mobile networks (PLMNs) when they are outside the office. In this case, the PLMN can be configured to support the NPN, allowing seamless connectivity and services for employees whether they are within the company premises (using the NPN) or outside (using the PLMN).

[0003] One category of the NPN is a Public Network Integrated NPN (PNI-NPN), where the NPN is deployed with the support of one or more PLMN(s). Public Network Integrated NPNs are NPNs made available via PLMNs; for example, by means of dedicated DNNs, or by one (or more) Network Slice instances allocated for the NPN. The Network Functions (NFs) may reside within PNI-NPN Network Slice instances, and may require interfaces which cross the operational domains between PNI-NPNs and PLMNs. Therefore, these interfaces require security controls to mutually protect the NFs (which reside in the PLMN operational domain and in the PNI-NPN operational domain).

[0004] FIGs. 1A and IB depict example PNI-NPNs with dedicated NFs deployed in the customer premises. In an example scenario as depicted in FIG. 1 A, a dedicated User PlaneFunction (UPF) is deployed in the customer premises, and the other NFs are deployed in the operator premises. The interface between the dedicated UPF in the customer premises and NFs in the operator premises is N4.

[0005] In an example scenario as depicted in FIG. IB, a dedicated UPF and part of CP functions are deployed in the customer premises. The interface between the dedicated NFs in the customer premises and the NFs in the operator premise is an SBA interface. Examples of dedicated CP functions that are likely to be hosted by NPN in the customer premises are AMF, and SMF.

[0006] The NFs which reside in the PNI-NPN operational domain may require interfaces which cross the trust boundary between PNI-NPN and PLMN. Therefore, these interfaces require security controls to mutually protect the NFs which reside in the PLMN operational domain and in the PNI-NPN operational domain.

[0007] Considering primary authentication and authorization procedure (as specified in clause in TS 33.501), if a Subscription Permanent Identifier (SUPI) is available in clear text to the NFs in customer premises then it may potentially lead to security threats, privacy breach, UE location tracking and targeted attacks.

[0008] Further, with the evolution of the roaming architectures (roaming hub) and Core network (NPN, Edge computing), distributed Core Network (CN) (multi-site CN), there may be no direct trust relationship between HN and SN / VPLMN / Edge network (i.e., between the different security domains). In this case, the Home Network (HN) needs to consider exposing of permanent and / or sensitive identifiers / parameter to the NFs in different security domain. An attacker can compromise NFs in customer premise and can retrieve the SUPI to launch targeted attacks. The 5G system shall support a mechanism to ensure the protection of the sensitive parameters against the risk caused by PLMN hosting NPN and vice versa.

[0009] Hence, there is a need in the art for solutions which will overcome the above mentioned drawback(s), among others.OBJECTS

[0010] The principal object of embodiments herein is to disclose methods and systems for managing Subscription Permanent Identifier (SUPI) privacy in a Public Land Mobile Network (PLMN) hosting Non-Public Network (NPN) scenario in a wireless communication network, wherein SUPI privacy is provided using a virtual SUPI without impacting operations of a User Equipment (UE) currently being served by the wireless communication network.

[0011] Another object of embodiments herein is to disclose methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario in a wireless communicationnetwork, wherein a key (K AMF) is generated at an operator premises instead of customer premises.

[0012] Another object of embodiments herein is to disclose methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario in a wireless communication network, wherein the SUPI can be provided to a Lawful Interception (LI) framework (if required), while preserving the SUPI privacy at customer side.

[0013] These and other aspects of the embodiments herein will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following descriptions, while indicating at least one embodiment and numerous specific details thereof, are given by way of illustration and not of limitation. Many changes and modifications may be made within the scope of the embodiments herein without departing from the spirit thereof, and the embodiments herein include all such modifications.BRIEF DESCRIPTION OF FIGURES

[0014] Embodiments herein are illustrated in the accompanying drawings, throughout which like reference letters indicate corresponding parts in the various figures. The embodiments herein will be better understood from the following description with reference to the following illustratory drawings. Embodiments herein are illustrated by way of examples in the accompanying drawings, and in which:

[0015] FIGs. 1A and IB depict example PNI-NPNs with dedicated NFs deployed in the customer premises, according to existing arts;

[0016] FIG. 2 depicts a wireless communication network, wherein a PLMN is hosting at least one NPN, according to embodiments as disclosed herein;

[0017] FIG. 3 is a sequence diagram depicting the process of managing SUPI privacy in a PLMN hosting NPN scenario, according to embodiments as disclosed herein;

[0018] FIG. 4 is a sequence diagram depicting the process of fulfilling LI requirements, according to embodiments as disclosed herein;

[0019] FIGs. 5 A and 5B are flowcharts depicting the process of managing SUPI privacy in a PLMN hosting NPN scenario, according to embodiments as disclosed herein;

[0020] FIG. 6 is a flowchart depicting the process of deriving the K AMF from the K SEAF and SUPI, according to embodiments as disclosed herein; and

[0021] FIG. 7 is a flowchart depicting the process of fulfilling LI requirements, according to embodiments as disclosed herein.DETAILED DESCRIPTION

[0022] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.

[0023] For the purposes of interpreting this specification, the definitions (as defined herein) will apply and whenever appropriate the terms used in singular will also include the plural and vice versa. It is to be understood that the terminology used herein is for the purposes of describing particular embodiments only and is not intended to be limiting. The terms “comprising”, “having” and “including” are to be construed as open-ended terms unless otherwise noted.

[0024] The words / phrases "exemplary", “example”, “illustration”, “in an instance”, “and the like”, “and so on”, “etc ”, “etcetera”, “e.g.,” , “i.e.,” are merely used herein to mean "serving as an example, instance, or illustration." Any embodiment or implementation of the present subject matter described herein using the words / phrases "exemplary", “example”, “illustration”, “in an instance”, “and the like”, “and so on”, “etc.”, “etcetera”, “e.g.,” , “i.e.,” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0025] Embodiments herein may be described and illustrated in terms of blocks which carry out a described function or functions. These blocks, which may be referred to herein as managers, units, modules, hardware components or the like, are physically implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by a firmware. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like. The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block. Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of thedisclosure. Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the disclosure.

[0026] It should be noted that elements in the drawings are illustrated for the purposes of this description and ease of understanding and may not have necessarily been drawn to scale. For example, the flowcharts / sequence diagrams illustrate the method in terms of the steps required for understanding of aspects of the embodiments as disclosed herein. Furthermore, in terms of the construction of the device, one or more components of the device may have been represented in the drawings by conventional symbols, and the drawings may show only those specific details that are pertinent to understanding the present embodiments so as not to obscure the drawings with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein. Furthermore, in terms of the system, one or more components / modules which comprise the system may have been represented in the drawings by conventional symbols, and the drawings may show only those specific details that are pertinent to understanding the present embodiments so as not to obscure the drawings with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

[0027] The accompanying drawings are used to help easily understand various technical features and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. As such, the present disclosure should be construed to extend to any modifications, equivalents, and substitutes in addition to those which are particularly set out in the accompanying drawings and the corresponding description. Usage of words such as first, second, third etc., to describe components / elements / steps is for the purposes of this description and should not be construed as sequential ordering / placement / occurrence unless specified otherwise.

[0028] The embodiments herein achieve methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario. Referring now to the drawings, and more particularly to FIGS. 2 through 7, where similar reference characters denote corresponding features consistently throughout the figures, there are shown embodiments.

[0029] Embodiments herein disclose methods and systems for managing Subscription Permanent Identifier (SUPI) privacy in a Public Land Mobile Network (PLMN) hosting NonPublic Network (NPN) scenario in a wireless communication network, wherein SUPI privacy is provided using a virtual SUPI without impacting operations of a User Equipment (UE) currently being served by the wireless communication network. Embodiments herein disclose a key (K AMF) being generated at an operator premises instead of customer premises.Embodiments herein disclose providing the SUPI to a Lawful Interception (LI) framework (if required), while preserving the SUPI privacy at the customer side.

[0030] FIG. 2 depicts a wireless communication network, wherein a PLMN is hosting at least one NPN. The network 200 as depicted comprises an PLMN (also referred to herein interchangeably as HN, or operator premises) 201, at least one NPN 202 (also referred to herein interchangeably as customer premises), and at least one User Equipment (UE) (103). The PLMN 201 can further comprise a Unified data management (UDM) 201 A, and an Authentication Server Function (AUSF) 201B. The NPN 202 can comprise an Access and Mobility Management Function (AMF) 202A, and at least one gNodeB (gNB) 202B, wherein the at least one gNB 202B serves one or more UEs 203. The network 200 can further comprise at least one LI framework 204. The network 200, as depicted, can use a virtual SUPI (as provided by the PLMN 201), instead of an original SUPI, without the operations of the network 200 being impacted.

[0031] On obtaining the original SUPI from a Subscription Concealed Identifier (SUCI) (wherein the SUCI has been received from the UE 203, via the gNB 202B, and the AUSF 201 A), the UDM 201 A can generate a virtual SUPI corresponding to the original SUPI. The UDM 201 A can derive the virtual SUPI using one or more cryptographic techniques, such as, but not limited to, hashing, using random numbers as a part of construction, and so on. The virtual SUPI can be a temporary and pseudonymous identifier that can be used in place of the original SUPI during communication sessions. The virtual SUPIs can be temporary in nature and can be used for specific communication sessions or transactions. The virtual SUPIs are not permanent identifiers. In an embodiment herein, the virtual SUPIs can be regenerated or changed periodically and / or one or more events occurring, thereby enhancing security. The UDM 201 A can further generate a SUPI - Virtual SUPI mapping table, wherein the SUPI - Virtual SUPI mapping table comprises a mapping of the original SUPI to the virtual SUPIs.

[0032] The UDM 201 A can randomize and generate the virtual SUPIs to ensure that they cannot be easily reverse-engineered or linked back to the original SUPI. This randomization adds an extra layer of security and privacy, making it difficult for unauthorized entities to track or identify subscribers based on the respective virtual SUPIs alone.

[0033] After the successful primary authentication procedure as mentioned in clause 6.1.3.2 of 3GPP TS 33.501, the UDM 201 A can provide the virtual SUPI and the SUPI - Virtual SUPI mapping table to the AUSF 201B.

[0034] On receiving the virtual SUPI, the AUSF 20 IB can generate the key (K AMF) using K SEAF, the original SUPI (obtained from UDM), and other specific parameters. TheAUSF 201B can derive a common anchor key (K SEAF) = KDF(K_AUSF, SNN). The AUSF 20 IB can further derive K AMF = KDF(K_SEAF, SUPI, SNN, ABBA parameter). K AUSF is key belonging to the AUSF 201B. SNN is a Serving Network Name. ABBA is an AntiBidding down Between Architectures (ABBA) parameter.

[0035] The AUSF 201B can further encrypt the SUPI - Virtual SUPI mapping table (as received from the UDM 201 A) using a public key of the respective LI frameworks. The AUSF 20 IB can store the encrypted mapping table in a suitable location (not shown).

[0036] The AUSF 201B can send the virtual SUPI, the K AMF, and the authentication response to the NPN 202. On receiving the virtual SUPI, the K AMF, and the authentication response, the AMF 202A can check the authentication response. If the authentication response is successful, the AMF 202A can generate a GUTI corresponding to the virtual SUPI and uses K AMF for further key derivation, as defined in 3GPP TS 33.501. The AMF 202A can maintain a second mapping table, wherein the second mapping table can map the virtual SUPI to the generated GUTI. The AMF 202A can then send the registration accept to the UE 203, via the gNB 202B. During communication sessions, the virtual SUPI is used instead of the original SUPI, thereby protecting the subscriber's identity and preventing potential attacks or unauthorized access.

[0037] On receiving a request from the LI framework 204, the AUSF 201B can provide the encrypted SUPI - Virtual SUPI mapping table to the LI framework 204. The LI framework 204 can then decrypt the encrypted mapping table using their respective private key.

[0038] Embodiments herein preserve the privacy of the SUPI at the NPN and also fulfil the requirements of the LI framework 204. The selection of the public key and key generation / distribution can be governed by the policy of the LI framework 204. Embodiments herein are agnostic and can accommodate any standardized public key, and key distribution mechanism.

[0039] FIG. 3 is a sequence diagram depicting the process of managing SUPI privacy in a PLMN hosting NPN scenario. The UE 203 encrypts the original SUPI to the SUCI and sends a registration request (which includes the SUCI) to the AUSF 201B, via the gNB 202B, and the AMF 201A. On receiving the registration request from the UE, 103, the AUSF 201B sends the SUCI to the UDM 201 A. The UDM 201 A decrypts the SUPI from the SUCI.

[0040] The UDM 201 A generates the virtual SUPI corresponding to the original SUPI, wherein the virtual SUPI is a temporary and pseudonymous identifier. The UDM 201A generates the virtual SUPI using one or more cryptographic techniques. The UDM 201 A generates the SUPI - Virtual SUPI mapping table, wherein the SUPI - Virtual SUPI mappingtable comprises the mapping of the original SUPI to the virtual SUPIs. The UDM 201 A further randomizes and encrypts the virtual SUPIs. After the successful primary authentication procedure as mentioned in clause 6.1.3.2 of 3GPP TS 33.501, the UDM 201A provides the virtual SUPI and the SUPI - Virtual SUPI mapping table to the AUSF 20 IB.

[0041] On receiving the virtual SUPI, the AUSF 201B generates the key (K AMF) using K SEAF, the original SUPI (obtained from UDM), and other specific parameters. The AUSF 20 IB derives K SEAF = KDF(K_AUSF, SNN). The AUSF 20 IB further derives K AMF = KDF(K_SEAF, SUPI, SNN, ABBA parameter). The AUSF 20 IB sends the virtual SUPI, the K AMF, and the authentication response to the AMF 202A.

[0042] On receiving the virtual SUPI, the K AMF, and the authentication response, the AMF 202A checks the authentication response. If the authentication response is successful, the AMF 202A generates a GUTI corresponding to the virtual SUPI and uses K AMF for further key derivation, as defined in 3GPP TS 33.501. The AMF 202A maintains the second mapping table, which maps the virtual SUPI to the generated GUTI. The AMF 202A then sends the registration accept to the UE 203, via the gNB 202B. During communication sessions, the virtual SUPI is used instead of the original SUPI, thereby protecting the subscriber's identity and preventing potential attacks or unauthorized access.

[0043] FIG. 4 is a sequence diagram depicting the process of fulfilling LI requirements. After the successful primary authentication procedure as mentioned in clause 6.1.3.2 of 3GPP TS 33.501, the UDM 201A provides the virtual SUPI and the SUPI - Virtual SUPI mapping table to the AUSF 201B. The AUSF 201B encrypts the SUPI - Virtual SUPI mapping table using the public key of the respective LI frameworks. The AUSF 201B stores the encrypted mapping table in a suitable location (not shown). The LI framework 204 sends a request to the AMF 202A. On receiving the request from the LI framework 204, the AUSF 201B provides the encrypted SUPI - Virtual SUPI mapping table to the LI framework 204. The LI framework 204 then decrypts the encrypted mapping table using their respective private key. This ensures that the privacy of the SUPI at the NPN is preserved and the requirements of the LI framework 204 are also fulfilled.

[0044] FIGs. 5A and 5B are flowcharts depicting the process of managing SUPI privacy in a PLMN hosting NPN scenario. In step 501, the UE 203 encrypts the original SUPI to the SUCI and sends a registration request (which includes the SUCI) to the AUSF 201B, via the gNB 202B, and the AMF 201 A. On receiving the registration request from the UE, 103, in step 502, the AUSF 201B sends the SUCI to the UDM 201A. In step 503, the UDM 201A decrypts the SUPI from the SUCI.

[0045] In step 504, the UDM 201A generates the virtual SUPI corresponding to the original SUPI using one or more cryptographic techniques. In step 505, the UDM 201A generates the SUPI - Virtual SUPI mapping table, wherein the SUPI - Virtual SUPI mapping table comprises the mapping of the original SUPI to the virtual SUPI. In an embodiment herein, the UDM 201 A further randomizes and encrypts the virtual SUPIs. After the successful primary authentication procedure as mentioned in clause 6.1.3.2 of 3GPP TS 33.501, in step 506, the UDM 201A provides the virtual SUPI and the SUPI - Virtual SUPI mapping table to the AUSF 20 IB. On receiving the virtual SUPI, in step 507, the AUSF 20 IB generates the key (K AMF) using K SEAF, the original SUPI (obtained from UDM), and other specific parameters. In step 508, the AUSF 201B sends the virtual SUPI, the K AMF, and the authentication response to the AMF 202A.

[0046] On receiving the virtual SUPI, the K AMF, and the authentication response and if the authentication response is successful, in step 509, the AMF 202A generates the GUTI corresponding to the virtual SUPI and uses K AMF for further key derivations, as defined in 3GPP TS 33.501 and maintains the second mapping table, which maps the virtual SUPI to the generated GUTI. In step 510, the AMF 202 A then sends the registration accept to the UE 203, via the gNB 202B. During communication sessions, the virtual SUPI is used instead of the original SUPI, thereby protecting the subscriber's identity and preventing potential attacks or unauthorized access. The various actions in method 500 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIGs. 5A and 5B may be omitted.

[0047] FIG. 6 is a flowchart depicting the process of deriving the K AMF from K SEAF and the original SUPI (obtained from UDM). In step 601, the AUSF 20 IB receives the virtual SUPI from the UDM 201 A. In step 602, the AUSF 20 IB derives K SEAF = KDF(K_AUSF, SNN). In step 603, the AUSF 201B derives K AMF = KDF(K_SEAF, SUPI, SNN, ABBA parameter). The various actions in method 600 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 6 may be omitted.

[0048] FIG. 7 is a flowchart depicting the process of fulfilling LI requirements, according to embodiments as disclosed herein. In step 701, the AUSF 201B receives the SUPI - Virtual SUPI mapping table from the UDM 201 A. In step 702, the AUSF 20 IB encrypts the SUPI - Virtual SUPI mapping table using the public key of the respective LI frameworks. In step 703, the AUSF 201B stores the encrypted mapping table in a suitable location (not shown).

[0049] On receiving a request from the LI framework 204 (step 704), in step 705, the AUSF 201B provides the encrypted SUPI - Virtual SUPI mapping table to the LI framework 204. In step 706, the LI framework 204 decrypts the encrypted mapping table using their respective private key to obtain the original SUPI from the decrypted mapping table. The various actions in method 700 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 7 may be omitted.

[0050] Embodiments herein can help in preventing the exposure of the real SUPI to unauthorized parties. By using virtual SUPIs, embodiments herein enable the network operators to add an extra layer of security and privacy to their networks, reducing the risk of identity theft or unauthorized tracking of subscribers.

[0051] The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device and performing network management functions to control the network elements. The elements include blocks which can be at least one of a hardware device, or a combination of hardware device and software module.

[0052] The embodiments disclosed herein describe methods and systems for managing SUPI privacy in a PLMN hosting NPN scenario. Therefore, it is understood that the scope of the protection is extended to such a program and in addition to a computer readable means having a message therein, such computer readable storage means contain program code means for implementation of one or more steps of the method, when the program runs on a server or mobile device or any suitable programmable device. The method is implemented in at least one embodiment through or together with a software program written in e.g., Very high speed integrated circuit Hardware Description Language (VHDL) another programming language, or implemented by one or more VHDL or several software modules being executed on at least one hardware device. The hardware device can be any kind of portable device that can be programmed. The device may also include means which could be e.g., hardware means like e.g., an ASIC, or a combination of hardware and software means, e.g., an ASIC and an FPGA, or at least one microprocessor and at least one memory with software modules located therein. The method embodiments described herein could be implemented partly in hardware and partly in software. Alternatively, the invention may be implemented on different hardware devices, e.g., using a plurality of CPUs.

[0053] The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and / or adapt for various applications such specific embodiments withoutdeparting from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of embodiments and examples, those skilled in the art will recognize that the embodiments and examples disclosed herein can be practiced with modification within the scope of the embodiments as described herein.

Claims

STATEMENT OF CLAIMSWe claim:

1. A method (500) for managing Subscription Permanent Identifier (SUPI) privacy when a Public Land Mobile Network (PLMN) (201) is hosting a Non-Public Network (NPN) (202) in a wireless communication network, the method comprising: generating, by the PLMN (201), a virtual SUPI for a User Equipment (UE) (203), wherein the virtual SUPI corresponds to original SUPI of the UE (203); generating, by the PLMN (201), a SUPI - Virtual SUPI mapping table, wherein the SUPI - Virtual SUPI mapping table comprises a mapping of the virtual SUPI to the original SUPI; generating, by the PLMN (201), a key (K_AMF) using K_SEAF and SUPI; and sending, by the PLMN (201), the virtual SUPI, and the key K_AMF to the NPN (202), wherein the virtual SUPI is used for at least one communication session instead of the original SUPI.

2. The method, as claimed in claim 1, wherein the method comprises generating, by the PLMN (201), the virtual SUPI using a cryptographic technique.

3. The method, as claimed in claim 1, wherein the method comprises randomizing and encrypting, by the PLMN (201), the virtual SUPI.

4. The method, as claimed in claim 1, wherein generating the key (K AMF) comprises: deriving, by the PLMN (201), a common anchor key (K_SEAF) using a AUSF key, and aServing Network Name (SNN); and deriving, by the PLMN (201), the key (K_AMF) using the common anchor key, the SUPI, the SNN, and an Anti-Bidding down Between Architectures (ABBA) parameter.

5. The method, as claimed in claim 1, wherein the method comprises encrypting, by the PLMN (201), the SUPI - Virtual SUPI mapping table using a public key of a Lawful Interception (LI) framework.

6. The method, as claimed in claim 5, wherein the method comprises: providing, by the PLMN (201), the encrypted SUPI - Virtual SUPI mapping table to the LI framework, on receiving a request from the LI framework, wherein the LI framework decrypts the encrypted SUPI - Virtual SUPI mapping table using a private key.

7. A Public Land Mobile Network (PLMN) (201) configured for: generating a virtual SUPI for a User Equipment (UE) (203), wherein the virtual SUPI corresponds to original SUPI of the UE (203);generating a SUPI - Virtual SUPI mapping table, wherein the SUPI - Virtual SUPI mapping table comprises a mapping of the virtual SUPI to the original SUPI; generating a key (K AMF) using K SEAF and SUPI; and sending the virtual SUPI, and the key K_AMF to the NPN (202), wherein the virtual SUPI is used for at least one communication session instead of the original SUPI, wherein the PLMN (201) is hosting a Non-Public Network (NPN) (202) in a wireless communication network8. The PLMN, as claimed in claim 7, wherein the PLMN (201) is configured to generate the virtual SUPI using a cryptographic technique.

9. The PLMN, as claimed in claim 7, wherein the PLMN (201) is configured to randomize and encrypt the virtual SUPI.

10. The PLMN, as claimed in claim 7, wherein the PLMN (201) is configured to generate the key (K_AMF) by: derive a common anchor key (K_SEAF) using an AUSF key, and a Serving Network Name (SNN); and derive the key (K_AMF) using the common anchor key, the SUPI, the SNN, and an Anti- Bidding down Between Architectures (ABBA) parameter.

11. The PLMN, as claimed in claim 7, wherein the PLMN (201) is configured to encrypt the SUPI - Virtual SUPI mapping table using a public key of a Lawful Interception (LI) framework.

12. The PLMN, as claimed in claim 11, wherein the PLMN (201) is configured to provide the encrypted SUPI - Virtual SUPI mapping table to the LI framework, on receiving a request from the LI framework.

Images