Method, apparatus and computer program

Abstract

There is provided a method, apparatus, and computer program for causing the following to be performed: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.

Description

METHOD, APPARATUS AND COMPUTER PROGRAMTECHNICAL FIELD

[0001] Various example embodiments of this disclosure relate to a method, apparatus, system and computer program and in particular but not exclusively to subscription identifier values computed by a subscriber identity module, such as a subscription concealed identifier.BACKGROUND

[0002] A communication network can be seen as a facility that enables communications between two or more communication devices, or provides communication devices access to a data network. A mobile or wireless communication network is one example of a communication network. A communication device may be provided with a service by an application server.

[0003] Such communication networks operate in according with standards such as those provided by 3GPP (Third Generation Partnership Project) or ETSI (European Telecommunications Standards Institute). Examples of standards are the so-called 5G (5th Generation) standards and 6G (6th Generation) standards provided by 3GPP.SUMMARY

[0004] Some example embodiments of this disclosure will be described with respect to certain aspects. These aspects are not intended to indicate key or essential features of the embodiments of this disclosure, nor are they intended to be used to limit the scope of thereof. Other features, aspects, and elements will be readily apparent to a person skilled in the art in view of this disclosure.

[0005] According to a first aspect, there is provided an apparatus comprising means for: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.

[0006] According to a second aspect, there is provided an apparatus comprising: at least one processor; and at least one memory comprising code that, when executed by the at least one processor, causes the apparatus to perform: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, arequest for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.

[0007] According to a third aspect, there is provided a method for an apparatus, the method comprising: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.

[0008] According to a fourth aspect, there is provided an apparatus comprising: providing circuitry for providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining circuitry for obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing circuitry for providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.

[0009] The following may apply in respect of any (e.g., one or more, including all) of the above first to fourth aspects.

[0010] The first information may comprise further information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the SIM and / or which of said plurality of parameters are either not configured at the SIM or configured incorrectly at the SIM.

[0011] The further information may comprise a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the SIM or is either not configured at the SIM or configured incorrectly at the user equipment.

[0012] The providing the second information may comprise providing the second information using a 5G mobility management status message.

[0013] The providing the second information may comprise providing the second information with an identifier of the user equipment that was previously allocated to the user equipment by the first network node.

[0014] The identifier of the user equipment that was previously allocated to the user equipment by the first network node may be a globally unique temporary identifier.

[0015] The apparatus may be caused to perform: autonomously determining, at the apparatus, to obtain the first information from the SIM for obtaining a service from a first network and / or registering with a first network; and providing the request for the SUCI to the SIM based on the autonomously determining.

[0016] The apparatus may be caused to perform: obtaining, from a second network node subsequent to providing the first information, one or more parameters for calculating the SUCI at the apparatus; and configuring the one or more parameters at the SIM.

[0017] The obtaining the one or more parameters may comprise receiving the one or more parameters via an over-the-air signalling procedure and / or via a user parameter update signalling procedure.

[0018] The SIM may comprise at least one of: a universal SIM, an embedded SIM, or an integrated SIM.

[0019] The first network node may comprise an access and mobility function and / or a mobility management entity.

[0020] According to a fifth aspect, there is provided an apparatus comprising means for: obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment; determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information.

[0021] According to a sixth aspect, there is provided an apparatus comprising: at least one processor; and at least one memory comprising code that, when executed by the at least one processor, causes the apparatus to perform: obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment; determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information.

[0022] According to a seventh aspect, there is provided a method for an apparatus, the method comprising: obtaining, from a user equipment, second information indicating thata subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment; determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information.

[0023] According to an eighth aspect, there is provided an apparatus comprising: obtaining circuitry for obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing circuitry for providing, to a second network node, third information indicating that the SUCI is not available at the user equipment; determining circuitry for determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing circuitry for providing the SUPI to the second network node with the third information.

[0024] The following may apply in respect of any (e.g., one or more, including all) of the above fifth to eighth aspects.

[0025] The obtaining the second information may comprise obtaining the second information using a 5G mobility management status message.

[0026] The apparatus may be caused to perform: forming the third information by selecting at least part of the information comprised in second information to insert into the third information based on a signalling format to be used for providing the third information to the second network node.

[0027] The following may apply in respect of any (e.g., one or more, including all) of the above first to eighth aspects.

[0028] The second information may comprise additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.

[0029] The additional information may comprise a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0030] According to a ninth aspect, there is provided an apparatus comprising means for: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.

[0031] According to a tenth aspect, there is provided an apparatus comprising: at least one processor; and at least one memory comprising code that, when executed by the at least one processor, causes the apparatus to perform: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.

[0032] According to an eleventh aspect, there is provided a method for an apparatus, the method comprising: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.

[0033] According to a twelfth aspect, there is provided an apparatus comprising: obtaining circuitry for obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining circuitry for obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining circuitry for determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring circuitry for configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.

[0034] The following may apply in respect of any (e.g., one or more, including all) of the above ninth to twelfth aspects.

[0035] The configuring may comprise configuring the one or more parameters using an over-the-air signalling message or a user parameter update signalling message.

[0036] The following may apply in respect of any (e.g., one or more, including all) of the above fifth to twelfth aspects.

[0037] The third information may comprise additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.

[0038] The additional information may comprise a bitmap, each entry in the bitmap corresponds to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each value indicates whether that respective parameter is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0039] According to an aspect, there is provided a non-transitory computer readable medium comprising program instructions that, when executed by an apparatus, cause the apparatus to perform at least the method according to any of the preceding aspects.

[0040] In the above, many different embodiments have been described. It should be appreciated that further embodiments may be provided by the combination of any two or more of the embodiments described above.DESCRIPTION OF FIGURES

[0041] Some example embodiments will now be described, by way of non-limiting and illustrative example only, with reference to the accompanying Figures in which:

[0042] Figures 1A and 1 B shows a representation of a communication system;

[0043] Figure 2 shows a representation of an apparatus for the communication system of Figures 1A and 1 B according to some example embodiments;

[0044] Figure 3 shows a representation of an apparatus according to some example embodiments;

[0045] Figure 4 shows example signalling;

[0046] Figures 5 to 11 illustrate example signalling between apparatus described herein; and

[0047] Figures 12 to 17 illustrate example methods that may be performed by apparatus described herein.DETAILED DESCRIPTION

[0048] The following relates to methods that may be performed by apparatus when a subscriber identity module (SIM) is unable to compute (e.g., generate) a temporarysubscription identifier (such as a subscription concealed identifier (SUCI). For example, the SIM may be unable to compute a SUCI or the like during at least the following two scenarios: 1 ) the SIM does not comprise all of the parameters needed to compute a SUCI, or 2) one or more of the parameters needed to compute a SUCI has been misconfigured.

[0049] Although these concepts will be illustrated more fully below, the following provides an example of a communication environment in which the presently described techniques may be deployed. It is understood that this communication environment is not limiting, and is merely being used to provide at least one example for describing where such techniques may be deployed.

[0050] Stated differently, in the following various example embodiments are explained with reference to communication devices capable of communication with a communication system. Before explaining in detail the embodiments of the methods and apparatuses of the present disclosure, a 5thgeneration communication system (5GS), an access network and a core network (5GC) thereof, and communication devices are briefly explained with reference to Figures 1 A, 1 B, 2 and 3.

[0051] Figure 1A shows a schematic representation of a 5G communication system (5GS). The 5GS may comprise a user equipment (UE), an access network such as a 5G radio access network (5G-RAN) or next generation radio access network (NG-RAN), a 5G core network (5GC), and one or more application functions. An application function may be deployed in the 5GS as trusted application function or may be deployed or host on one or more application servers of the data network. Such application functions are untrusted application functions. The 5GS connects the UE to a data network the access network and the 5GC (e.g., a UPF of the 5GC).

[0052] The 5G-RAN may comprise one or more radio access nodes, such as gNodeB (gNB). A gNB may include one or more gNodeB distributed units connected to one or more gNodeB centralized units. The 5G-RAN may be as illustrated below in Figure 1 B.

[0053] The 5GC may comprise the following network functions: Network Slice Selection Function (NSSF); Network Exposure Function; Network Repository Function (NRF); Policy Control Function (PCF); Unified Data Management (UDM); Application Function (AF); Authentication Server Function (AUSF); an Access and Mobility Management Function (AMF); and Session Management Function (SMF), and a user plane function (UPF). Figure 1A also shows the various interfaces (N1 , N2 etc.) that may be implemented between the various elements of the system.

[0054] The term “terminal device” refers to any end device that may be capable of wireless communication. By way of example rather than limitation, a terminal device may also bereferred to as a communication device, user equipment (UE), a Subscriber Station (SS), a Portable Subscriber Station, a mobile device, a Mobile Station (MS), or an Access Terminal (AT). The terminal device may include, but not limited to, a mobile phone, a cellular phone, a smart phone, voice over IP (VoIP) phones, wireless local loop phones, a tablet, a wearable terminal device, a personal digital assistant (PDA), portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, wireless endpoints, mobile stations, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), USB dongles, smart devices, wireless customer-premises equipment (CPE), a machine-type communications (MTC) device, an Internet of Things (loT) device, a watch or other wearable, a head-mounted display (HMD), a vehicle, a drone, a medical device and applications (e.g., remote surgery), an industrial device and applications (e.g., a robot and / or other wireless devices operating in an industrial and / or an automated processing chain contexts), a data consumer electronics device, a device operating on commercial and / or industrial wireless networks, and the like. The terminal device may also correspond to a Mobile Termination (MT) part of an Integrated Access and Backhaul (IAB) node (e.g., a relay node). In the following description, the terms “terminal device”, “communication device”, “terminal”, “user device”, “user equipment” and “UE” may be used interchangeably.

[0055] As used herein, the term “network device” is used interchangeably with “network access node”, and refers to a node in a communication network via which a terminal device accesses the network and receives services therefrom. The network device may refer to a base station (BS) or an access point (AP), for example, a node B (NodeB or NB), an evolved NodeB (eNodeB or eNB), an NR NB (also referred to as a gNB), a Remote Radio Unit (RRU), a radio header (RH), a remote radio head (RRH), a relay, an Integrated Access and Backhaul node, a low power node such as a femto, a pico, a nonterrestrial network (NTN) or non-ground network device such as a satellite network device, a low earth orbit (LEO) satellite and a geosynchronous earth orbit (GEO) satellite, an aircraft network device, and so forth, depending on the applied terminology and technology. In some example embodiments, radio access network (RAN) split architecture comprises a Centralized Unit (CU) and a Distributed Unit (DU) at an IAB donor node. An IAB node comprises a Mobile Terminal (IAB-MT) part that behaves like a UE toward the parent node, and a DU part of an IAB node behaves like a base station toward the next-hop IAB node.

[0056] In some example embodiments, a link from the network device 120 to the user device 110 or 115 is referred to as a DL, while a link from the user device 110 or 115 to the network device 120 is referred to as a UL. Links are also referred to herein as “channels”. In DL, the network device 120 is a Tx device (or a transmitter), and the user device 110 or 115 is a Rx device (or a receiver). In UL, the user device 110 or 115 is a Tx device (or a transmitter), and the network device 120 is a Rx device (or a receiver). A link between the user device 110 and another user device (not shown) is referred to as a sidelink (SL). In SL, one of the user devices is a Tx device (or a transmitter), and the other of the user devices is a Rx device (or a receiver).

[0057] Communications in the communication environment 100 may be implemented according to any proper communication protocol(s), comprising, but not limited to, cellular communication protocols of the first generation (1 G), the second generation (2G), the third generation (3G), the fourth generation (4G), the fifth generation (5G), the sixth generation (6G), and the like, wireless local network communication protocols such as Institute for Electrical and Electronics Engineers (IEEE) 802.11 and the like, and / or any other protocols currently known or to be developed in the future. Moreover, the communication may utilize any proper wireless communication technology, comprising but not limited to: Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Frequency Division Duplex (FDD), Time Division Duplex (TDD), Multiple-Input Multiple-Output (MIMO), Orthogonal Frequency Division Multiple (OFDM), Discrete Fourier Transform spread OFDM (DFT-s- OFDM) and / or any other technologies currently known or to be developed in the future.

[0058] Figure 2 illustrates an example of a control apparatus 200 for controlling a function of the access network (e.g., a 5G-RAN or the NG-RAN illustrated in Figures 1 A and 1 B) illustrated on Figures 1A and 1 B. The control apparatus 200 may comprise at least one random access memory (RAM) 211 a, at least on read only memory (ROM) 211 b, at least one processor 212, 213 and a network interface 214. The at least one processor 212, 213 may be coupled to the RAM 211 a and the ROM 211 b. The at least one processor 212, 213 may be configured to execute an appropriate software code 215. Execution of the software code 215 may for example may cause the apparatus to perform operations for controlling a function of the access network. The software code 215 may be stored in the ROM 211 b. The control apparatus 200 may be interconnected with another control apparatus 200 for controlling another function of the 5G-RAN or the NG-RAN. In some embodiments, each function of the 5G-RAN or the NG-RAN is deployed or hosted on acontrol apparatus 200. In alternative embodiments, two or more functions of the 5G-RAN or the NG-RAN may share a control apparatus.

[0059] Figure 3 illustrates an example of a communication device 300, such as the UE illustrated on Figures 1 A and 1 B. The communication device 300 may be provided by any device capable of sending and receiving radio signals. Non-limiting examples of a communication device 300 comprise a user equipment, a mobile station (MS) or mobile device such as a mobile phone or what is known as a ’smart phone’, a computer provided with a wireless interface card or other wireless interface facility (e.g., USB dongle), a personal data assistant (PDA) or a tablet provided with wireless communication capabilities, a machine-type communications (MTC) device, an Internet of things (loT) type communication device or any combinations of these or the like. The communication device 300 may comprise a transceiver for transmitting and / or receiving, for example, wireless signals carrying communications, for example radio signals. The communications may be one or more of voice, electronic mail (email), text messages, multimedia data, machine data and so on.

[0060] The communication device 300 may receive wireless signals (e.g., radio signals) over an air or radio interface 307 via appropriate apparatus for receiving and may transmit wireless signals via appropriate apparatus for transmitting radio signals. In Figure 3 transceiver is designated schematically by block 306. The transceiver 306 may comprise, for example, a radio part and associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device and may comprise one or more antenna elements. The antenna arrangement may be a multi-input multi-output (MIMO) antenna.

[0061] The communication device 300 may be provided with at least one processor 301 , memory 302 comprising at least one memory ROM 302a, at least one RAM 302b and other possible components 303 for use in software and hardware aided execution of tasks it is designed to perform, including control of access to and communications with access networks (e.g., the 5G-RAN or NG-RAN illustrated in Figures 1A and 1 B) and other communication devices. The at least one processor 301 is coupled to the RAM 302b and the ROM 302a. The at least one processor 301 may be configured to execute an appropriate software code 308. The software code 308 may for example allow to perform one or more operations of the communication device. The software code 308 may be stored in the ROM 302a.

[0062] The processor, the ROM, and the RAM, the transceiver and other circuitry of the communication device (e.g., a modem) can be provided on a circuit board, in chipsets, orin a system on chip. The circuit board, chipsets or system on chip is denoted by reference304. The communication device 300 may optionally have a user interface such as keypad305, touch sensitive screen or pad, combinations thereof or the like. Optionally one or more of a display, a speaker and a microphone may be provided depending on the type of communication device.

[0063] In one illustrative embodiment, the communication device 300 is comprised of a Universal Integrated Circuit Card (UICC) part and a Mobile Equipment (ME) part. The UICC is a subscriber-dependent part of the UE and contains at least one Universal Subscriber Identity Module (USIM). The USIM securely stores a permanent subscription identifier and its related key, which are used to uniquely identify and authenticate subscribers to access networks. The ME is a subscriber-independent part of the UE and comprises terminal equipment (TE) functions and various mobile termination (MT) functions. Alternative illustrative embodiments may not use UICC-based authentication, e.g., a Non-Public (Private) Network (NPN).

[0064] A USIM (or some other entity that provides a specific secure part for identifying a subscriber) may be associated with a permanent identifier that has been allocated by a network operator to identify a subscriber of the network provided by the network operator. For example, the subscriber permanent identifier is a permanent identifier allocated to a SIM card by a 5G network operator to identify a subscriber of the network provided by the network operator. In 4G systems, a permanent identifier allocated to a SIM card by a 4G network operator to identify a subscriber of the network provided by the 4G network operator is known as an International Mobile Subscriber Identity (IMS I).

[0065] 5G standards cover a range of different scenarios. In some of these scenarios, a UE is configured to use a temporary identifier in order to provide greater security. This may be useful in order to avoid risking exposure of a permanent UE identifier.

[0066] One of these temporary identifiers is known as the subscription concealed identifier (SUCI).

[0067] SUCI is a privacy preserving identifier that comprises a concealed permanent identifier (e.g., a subscription permanent identifier (SUPI)).

[0068] Each subscriber is allocated one 5G Subscription Permanent Identifier (SUPI) for use within the 3GPP system. Each UE accessing the 5G System is assigned a Permanent Equipment ID (PEI). The SUPI that is allocated to each USIM is not normally transmitted over the air. Instead, the SUPI is encrypted into the form of SUCI, and SUCI is transmitted over the air interface for security.

[0069] A UE generates a SUCI using a protection scheme with the home network public key that was securely provisioned to the UE in control of the home network. The home network (e.g., a UDM) can then derive the SUPI from the SUCI by using the home network’s private key.

[0070] The UE determines (e.g., computes) a SUCI as described in 3GPP TS 33.501.

[0071] In more detail, a UE (specifically a USIM part of the UE) generates a SUCI using the following parameters that are configured in the USIM:Home network identifier: The home network identifier may comprise, for example, a mobile country code (MCC) and Mobile Network Code (MNC) when the SUPI Type is IMSI or a domain name when the SUPI Type is Network Specific Identifier, Global Line Identifier or Global Cable Identifier. When the SUPI type is a Network Access Identifier, the Home Network Identifier comprises a string of characters with a variable length representing a domain name. e.g. user@techno.com. Stated differently, the value of the home network identifier represents MCC and MNC when SUPI Type is IMSI, or represents a domain name when SUPI Type is Network Specific Identifier, Global Line Identifier or Global Cable Identifier.Routing indicator: This is 1 to 4 decimal digits assigned by the home network operator and provisioned within the USIM.Home network public key: This parameter comprises a public key used for communication with the subscriber’s home network.Home network public key identifier: This parameter is a value in the range 0 to 255. It represents a public key provisioned by the subscriber’s home network and it is used to identify the key used for SUPI protection. In case of a null-scheme being used, this data field will be set to the value as 0.Protection scheme identifier: This is a value in the range of 0 to 15 and represented with 4 bits o null-scheme 0x0 o Profile 0x1 o Profile 0x2SUPI: SUPI is a unique identifier used to represent a subscriber's permanent identity in a 5G network. A SUPI is usually a string of 15 decimal digits. The first three digits represent the Mobile Country Code (MCC), the next two or three represent the Mobile Network Code (MNC) identifying the network operator. The remainder represents the Mobile Subscriber identification number (MSIN). Itrepresents the individual user of that particular operator. SUPI is equivalent to IMSI which uniquely identifies the ME, which is a string of 15 digits.

[0072] Throughout the following, the above parameters that are configured at (or to be configured) at the USIM for determining a SUCI will be referred to as SUCI parameters and / or SUCI configuration parameters.

[0073] As mentioned above, the SUCI comprises at least part of the SUPI in an obscured form, and at least part of the SUPI in a plaintext form.

[0074] In more detail, the SUCI returned to the ME from the USIM comprises the concatenation of the following information (as described in 3GPP TS 23.003):• SUPI Type: This is a value in the range 0 to 7, and is used to identify the type of the SUPI concealed in the SUCI. The following values for the SUPI type are currently defined: o 0: IMSI o 1 : Network Access Identifier (NAI) o 2 to 7: spare values for future use.• Home Network Identifier• Routing Indicator• Protection Scheme Identifier• Home Network Public Key Identifier• Protection Scheme Output: This comprises a string of characters with a variable length or hexadecimal digits, dependent on the used protection scheme.

[0075] The SUCI is designed for one-time use. However, the freshness and randomness of SUCI returned upon each call of the command depends on the protection scheme configured. There is also provided a special case of the SUCI, in which the protection scheme used is called “null-scheme”. In this special case, the SUCI contains an unconcealed version of the SUPI. When the home network public key is not provisioned in the USIM, the SUCI is determined using this null-scheme irrespective of the protection scheme stored in the USIM.

[0076] Figure 4 illustrates an example in which the USIM is unable to generate a SUCI. This may be, for example, as a result of one or more of the parameters mentioned above being absent from the USIM, and / or as a result of one or more of the parameters mentioned above being misconfigured at the USIM.

[0077] Figure 4 shows signalling that may be performed between a USIM 401 comprised in a terminal and an ME 402 comprised in the terminal.

[0078] During 4001 , the ME 402 signals the USIM 401. This signalling may be a request to receive the SUCI from the USIM. For example, this signalling may comprise a “GET IDENTITY” service operation, with an identifier requesting of a “SUCI context” comprised therein. This signalling may be performed by the ME in response to the fulfilment of one or more trigger conditions. One trigger condition may be, for example, a determination to register with a network for receiving one or more services. Another trigger condition may be, for example, receipt of a request for an identity of the subscriber of the terminal from a network node (e.g., an AMF).

[0079] During 4002, the USIM 401 determines that a SUCI cannot be generated. As mentioned above, this may be, for example, as a result of one or more of the parameters mentioned above being absent from the USIM, and / or as a result of one or more of the parameters mentioned above being misconfigured at the USIM.

[0080] During 4003, the USIM 401 signals the ME 402. This signalling may comprise a response to the signalling of 4001. This signalling may comprise an indication that SUCI could not be obtained. Stated differently, this signalling may comprise an indication of an error in obtaining the SUCI.

[0081] It is currently undefined how the ME 402 should react to the signalling of 4003.

[0082] In particular, it is likely that the request for the SUCI in Figure 4 was sent by the ME in response to some trigger condition for requesting the SUCI being met. This implies that the ME has some use for the SUCI, such as providing the SUCI in an authentication, authorisation and / or registration procedure in order to more securely identify a subscriber using the terminal to a network node than by using an unobscured identifier of the subscriber. It is therefore currently unclear how an ME is to perform the desired action (e.g., connecting with a 5G network) when the USIM is unable to determine the SUCI.

[0083] The following aims to address one or more of the above-mentioned issues.

[0084] In particular, there are provided seven examples of ways in which the ME may proceed with a SUCI-dependent service operation without receiving a SUCI from the USIM, with several of these examples sharing similar special technical features.

[0085] The following presents these seven examples with reference to Figures 5 to 11 , with Figures 12 to 17 illustrating one or more features from these examples. These seven examples illustrate different methods of signalling with one or more networks, and further illustrate different trigger conditions that may be used for initiating an ME to attempt a retrieval of a SUCI from the USIM.

[0086] For brevity and clarity, the following uses terminology and examples in reference to 5G and 4G networks. However, it is understood that the presently described techniquesare not limited to such networks, and may be applied in respect of other types of networks. For example, references to 5G entities (e.g., UE configured to operate in a 5G mode and / or 5G network nodes) and 5G networks may be replaced by 6G (and beyond) network nodes (e.g., UE configured to operate in a 6G (and beyond) mode and / or 6G (and beyond) network nodes) and networks without any loss of generality. In such a case, references to a 4G entities and networks may be replaced by references to any of 5G (and beyond) entities and networks, and / or be left as 4G entities and networks.

[0087] Further, references in the following to a 4G network may be replaced by any other network through which the ME may receive a service and further communicate with one or more network nodes in a 5G (or beyond) network.

[0088] It is also understood in the following that references to a UDM in the following may be replaced by a reference to any other network core function that utilises a SUCI for one or more operations. For example, any references to a UDM in the following may be replaced by an Authentication Server Function (AUSF) or the like.

[0089] The first to fifth examples (illustrated with respect to Figures 5 to 9) show examples in which the ME is configured to communicate an absence of a SUCI to a 5G home network node directly through other 5G network nodes, while the sixth to seventh examples (illustrated with respect to Figures 10 to 11 ) illustrate examples in which the ME is configured to communicate an absence of a SUCI configuration parameters to a 5G home network node indirectly (e.g., through a network node of another technology network, such as a 4G network via 3GPP or non 3GPP access).

[0090] Figure 5 illustrates an example signalling diagram in accordance with a first example.

[0091] Figure 5 illustrates signalling that may be performed between a USIM 501 , an ME 502, an AMF 503, and a UDM 504.

[0092] 5001 corresponds to the signalling of 4001 , and 5002 corresponds to 4002.

[0093] During 5003, the USIM 501 signals the ME 502. This signalling may comprise a response to the signalling of 5001 . This signalling may comprise an indication that SUCI could not be obtained. Stated differently, this signalling may comprise an indication of an error in obtaining the SUCI.

[0094] In addition, the signalling of 5003 may optionally comprise an indication that provides further information indicating why the SUCI generation of 5002 failed. For example, this information may comprise, for one or more of the above-mentioned SUCI parameters used in generating the SUCI, an indication of whether that parameter is available at the USIM for generation of the SUCI.

[0095] For example, there may be provided a bitmap, where each entry in the bitmap corresponds to a specific one of the above-mentioned SUCI parameters. A value used in said entry may be used to indicate whether that SUCI parameter is available in the USIM for generation of the SUCI. For example, a value of “1” in an entry of the bitmap may indicate that that parameter is available in the USIM for generation of the SUCI when a value of “0” indicates that a particular SUCI parameter is not available in the USIM for generation of the SUCI. Similarly, a value of “0” in an entry of the bitmap may indicate that particular SUCI parameter is available in the USIM for generation of the SUCI when a value of “1” indicates that particular parameter is not available in the USIM for generation of the SUCI.

[0096] During 5004, the ME 502 signals the AMF 503. This signalling may provide an indication to the AMF 503 that the SUCI could not be generated. Stated differently, this signalling may comprise a value representing an error cause corresponding to the SUCI not being generated.

[0097] This is illustrated in the following example in which the signalling of 5004 is a 5G mobility management (5GMM) status service operation.

[0098] 5GMM is a framework used for mobility management, and describes signalling that may be used during at least one or more of the following procedures: registration, deregistration, connected mode procedures (e.g., primary authentication, key agreement, security mode, generic UE configuration update, UE-initiated NAS transport, identification), or connection management procedures (e.g., service requests, paging, notification, etc.).

[0099] 5GMM status is a signalling defined by 5GMM for one or more of these procedures, and is described in 3GPP TS 24.501. The 5GMM status service operation may be sent from a UE to an AMF, or from an AMF to a UE, and receipt of a 5GMM status service operation does not cause any reconfiguration of a UE’s state and / or radio interface.

[0100] Table 1 illustrates information elements currently comprised in the 5GMM message and their current definitions:Table 1 5GMM STATUS message content

[0101] In the present example, the 5GMM cause value may be extended to also comprise a value that can indicate that SUCI could not be generated. Stated differently, the signalling of 5004 may comprise a 5GMM cause value that corresponds to an error reason of “SUCI concealment insufficient configuration”.

[0102] This is illustrated below in Table 2, which replicates some example cause values from Table 9.11 .3.2.1 of TS 24.501 , and further comprises the presently disclosed “SUCI concealment insufficient configuration” cause value.Cause value (octet 2)

[0103] Further, in an example in which the ME 502 is provided with an indication of which of the SUCI parameters used in generating SUCI are not configured at the USIM (e.g., the using a bitmap), the signalling of 5004 may further comprise an indication of which of the SUCI parameters used in generating SUCI are not configured at the USIM. It is understood that, in another example, this indication of which of the SUCI parameters used in generating SUCI are not configured at the USIM may be provided via alternative signalling (e.g., in response to a request for this information from the AMF, and / or autonomously by the ME in other signalling).

[0104] The signalling of 5004 may comprise at least one other identifier of the terminal. For example, assuming the terminal is already authenticated by the 5G network of AMF 503 and UDM 504 and in a 5GMM registered state, the identifier comprised in the signalling of 5004 may comprise a globally unique temporary identifier (GUTI). A GUTI is an identifier of a UE (e.g., the terminal) that is allocated to the UE by an AMF during registration of the UE with the AMF. The AMF maintains a mapping of GUTI to SUPI. Consequently, being provided with a UE’s GUTI enables the AMF to determine a corresponding SUPI of the UE using the mapping.

[0105] During 5005, the AMF 503 signals the UDM 504. This signalling may comprise an indication that the terminal was unable to generate a SUCI. This signalling may comprise the SUPI that corresponds to the identifier comprised in the signalling of 5004. It is understood that the indication comprised in the signalling of 5005 may be in a different format to the indication comprised in the signalling of 5004. The signalling of 5005 may comprise an Nudm_Notification service operation.

[0106] In an example, the AMF may provide an indication of which of the above- mentioned SUCI parameters are incorrectly configured at the USIM (e.g., which of the above-mentioned SUCI parameters for generating a SUCI is unavailable at the USIM).

[0107] During 5006, the UDM 504 configures the USIM 501 with at least part of a SUCI configuration. Stated differently, the UDM 504 configures the USIM with one or more SUCI parameters that can be used by the USIM 501 to generate at least part of a SUCI.

[0108] The signalling of 5006 may be provided by an over-the-air (OTA) procedure signalling and / or via a user parameter update (UPU) procedure signalling. These options are illustrated further below with reference to Figure 7.

[0109] Although the configuring of 5006 may provide all of the above-mentioned SUCI parameters for use by the USIM in generating a SUCI, in an example, the configuring of 5006 may provide less than all of the above-mentioned SUCI parameters for use by the USIM in generating the SUCI. For example, when an indication is provide to the UDM that identifies which of those above-mentioned SUCI parameters are not configured at the USIM, the UDM may only configure those identified above-mentioned SUCI parameters that are not configured at the USIM. This may help both improve security (e.g., as the SUCI will not be able to be generated by any party that intercepts the signalling) and further reduce signalling overhead associated with configuring SUCI parameters at the USIM.

[0110] This first example of Figure 5 may be considered to relate to a scenario in which the terminal comprising USIM 501 and the ME 502 is already authenticated with the 5G network that comprises the AMF 503 and the UDM 504.

[0111] In more detail, in such a scenario, a UE context is available in both the UE and the 5G network. In this state, if for any reason, SUCI computation is attempted and a SUCI computation error is hit in the USIM, the USIM returns an error status word to the ME (e.g., as described in Section 7.3.2 of TS 31.102). To come out of the error status, the ME will send a new error cause “SUCI computation error” to the AMF using a 5GMM Status message. The AMF will forward the error message along with a subscription identifier for that terminal (SUPI) to the UDM (e.g., or some other function, such as an AUSF) for further processing and error mitigation methods. The UDM will initiate error mitigation by reconfiguration of the parameters necessary for SUCI computation in the USIM.

[0112] Figure 6 illustrates a second example signalling procedure in which a network node triggers an ME to retrieve a SUCI from the USIM.

[0113] Figure 6 illustrates signalling that may be performed between a USIM 601 , an ME 602, an AMF 603, and a UDM 604.

[0114] During 6001 , the AMF 603 signals the ME 602. This signalling may cause at least one of the above-mentioned trigger conditions to be fulfilled. For example, this signalling may comprise a request for an identity of the subscriber. Stated differently, this signalling of 6001 may comprise an identity request service operation that identities SUCI as being the identity being requested.

[0115] 6002 corresponds to the signalling of 4001 , and 6003 corresponds to 4002.

[0116] During 6004, the USIM 601 signals the ME 602. This signalling may comprise a response to the signalling of 6001. This signalling may comprise an indication that SUCI could not be obtained. Stated differently, this signalling may comprise an indication of an error in obtaining the SUCI. This signalling of 6004 may be as described above in relation to 5003.

[0117] During 6005, the ME 602 signals the AMF 603. This signalling may provide an indication to the AMF 603 that the SUCI could not be generated. Stated differently, this signalling may comprise a value representing an error cause corresponding to the SUCI not being generated. This signalling of 6005 may be comprised in a response to the identity request of 6001 . Stated differently, the signalling of 6005 may comprise an identity response service operation. The identity response service operation is defined in clause 8.2.22 of TS 24.501 , and is reproduced below in relation to Table 3, with an additional information element of 5GMM cause.Table 3 IDENTITY RESPONSE message content

[0118] As can be seen in Table 3, the identity response message comprises a 5GMM cause information element. This may be as described above in relation to 5004.

[0119] Further, the signalling of 6005 may comprise information identifying which of the above-mentioned SUCI parameters are not correctly configured at the USIM. This may be as described above in relation to 5004, including the above-mentioned bitmap.

[0120] During 6006, the AMF 603 signals the UDM 604. This signalling may be as described above in relation to 5005.

[0121] During 6007, the UDM 604 configures the USIM 601 with at least part of a SUCI configuration. This may be as described above in relation to 5006.

[0122] This second example of Figure 6 may be considered to relate to a scenario in which the terminal comprising USIM 601 and the ME 602 is already authenticated with the 5G network that comprises the AMF 603 and the UDM 604.

[0123] In particular, Figure 6 illustrates an example in which a UE is sent a request for the SUCI in an Identity request message. A new error cause (“SUCI computation error”) is sent from the USIM to the ME, and the ME will send an indication of this “SUCI computation error” to AMF in the Identity response message to indicate that SUCI computation in the USIM has failed and that the requested SUCI identity is not available. In the example of Figure 6, the AMF already has the SUPI of the UE from the UE context. The AMF then forwards the error message along with subscription identifier SUPI to a core network function (e.g., a UDM and / or an AUSF) for further processing and error mitigation. The core network function may subsequently initiate error mitigation by causing reconfiguration, in the USIM, of the parameters necessary for SUCI determination (e.g., computation).

[0124] Figure 7 illustrates a third example signalling diagram in which a USIM receives (and subsequently reconfigures) values for one or more SUCI parameters for use by the USIM in determining a SUCI, where the values are such that the USIM is unable to determine a SUCI. In particular, Figure 7 illustrates an example of signalling a UDM using a user parameter update (UPU) message and / or using an over-the-air (OTA) signalling.

[0125] Figure 7 illustrates signalling that may be performed between a USIM 701 , an ME 702, an AMF 703, and a UDM 704.

[0126] During 7001 , the UE (comprising the USIM 701 and ME 702) is registered and authenticated with the AMF 703.

[0127] During 7002, the UDM reconfigures one or more values corresponding to at least one SUCI parameter that is maintained at the USIM 701 for determining a SUCI. This reconfiguration may be performed using, for example, a UPU message and / or an OTA message.

[0128] During 7003, the USIM 701 determines whether a SUCI can be determined using the reconfigured values by creating a sample SUCI.

[0129] When the USIM 701 determines during 7003 that a SUCI can be determined using the reconfigured values, the USIM 701 takes no further action in respect of these reconfigured values.

[0130] When the USIM 701 determines during 7003 that a SUCI cannot be determined during the reconfigured values, the USIM determines to send an indication of this determination error to the ME 702 during 7004.

[0131] The USIM may further determine to set an error flag at the USIM that indicates that the USIM is currently in a SUCI computation error state in which a SUCI cannot be generated by the USIM. When the flag is set, the USIM may abstain from determining aSlICI. For example, when the USIM receives a request for a SUCI from the ME when the flag is set, the USIM may simply return an error message to the ME without attempting to determine the requested SUCI. This may be useful to make the overall procedure more efficient as time is not wasted in attempting to generate a SUCI. When the flag is not set, the USIM may attempt to generate a SUCI in response to (e.g., based on receipt of) a request for a SUCI from the ME.

[0132] During 7004, the USIM 701 signals the ME 702. This signalling may indicate that there is an error in determining the SUCI. This may be as described above in relation to 4003 and / or 5003.

[0133] Optionally, the ME 702 may set a similar error flag at the ME as the USIM sets at the USIM during 7003 based on this signalling of 7004. This may be useful, for example, when the ME receives a request for a SUCI, as the ME does not need to query the USIM for a SUCI when this error flag is set because the ME already knows that the USIM is unable to determine a SIM. This means that the request may be responded to more quickly, which may result in a faster subsequent reconfiguration of the SUCI parameter values than methods that involve querying a USIM for a SUCI. As another example, the ME may be configured to not autonomously determine to request a SUCI from the USIM. For both of these examples, the ME may be configured to abstain from requesting a SUCI from the USIM when the error flag is set in the ME.

[0134] During 7005, the ME 702 signals the AMF 703. This signalling may comprise an indication that there was an error in generating a SUCI at the USIM. This signalling may be as described above in relation to 5004, except the signalling may be provided in a UPU acknowledgement message (e.g., for a UPU signalling procedure) and / or a 5GMM Statue message (e.g., for an OTA signalling procedure).

[0135] As mentioned above, this signalling of 7005 may comprise another identifier of the UE (e.g., a GUTI). As another example mentioned above, this signalling of 7005 may provide further information on which SUCI parameter is incorrectly configured at the USIM.

[0136] During 7006, the AMF 703 signals the UDM 704. This signalling may be as described in relation to any of 5005 and / or 6006. This signalling may be formed as described above in relation to any of 5005 and / or 6006.

[0137] During 7007, the UDM 704 reconfigures, at the USIM, one or more values of one of more SUCI parameters for determining the SUCI. This may be as described above in relation to any of 5006 and / or 6007.

[0138] In this example of Figure 7, during an error phase at USIM (e.g., when the USIM determines that a SUCI cannot be generated by the USIM), the USIM will report a misconfiguration of the SUCI parameters configured at the USIM during an OTA or a UPU procedure. Further, a SUCI computation Error flag is set in the USIM configuration file. For UPU procedure, the error message provided to the UDM via the AMF is sent using an UPU ack sent to the AMF. For the OTA procedure, the error message provided to the UDM via the AMF is sent using a 5GMM status message sent to the AMF.

[0139] Figure 8 illustrates a fourth example signalling. In this example signalling of Figure 8, the UE uses a “null-scheme” for SUCI computation (e.g., where the subscriber identifier provided to the AMF is an unobscured SUPI). Figure 8 further illustrates an example in which the above-mentioned flag of Figure 7 is first set, and then subsequently cleared. Stated differently, Figure 8 illustrates potential methods that may be performed by apparatus described herein when at least one of the flags is reset. It is understood that these potential methods are not limited to only these examples.

[0140] Figure 8 illustrates signalling that may be performed between a USIM 801 , an ME 802, an AMF 803, and a UDM 804.

[0141] During 8001 , the ME 802 signals the USIM 801 to request a SUCI. This signalling may be as described above with respect to 5001 .

[0142] During 8002, the USIM 801 determines whether a SUCI can be determined. This may be as described above in relation to any of 5002, and / or 6003.

[0143] When the USIM 801 determines during 8004 that a SUCI can be determined using the reconfigured values of the SUCI parameters, the USIM 801 determines the SUCI and provides the determined SUCI to the ME 802.

[0144] When the USIM 801 determines during 8003 that a SUCI cannot be determined, the USIM determines to send an indication of this SUCI determination error to the ME 802 during 8004.

[0145] During 8003, the USIM sets an error flag at the USIM that indicates that the USIM is currently in a SUCI computation error state in which a SUCI cannot be generated by the USIM. When the flag is set, the USIM may abstain from determining a SUCI. For example, when the USIM receives a request for a SUCI from the ME when the flag is set, the USIM may simply return an error message to the ME without attempting to determine the requested SUCI. This may be useful to make the overall procedure more efficient as time is not wasted in attempting to generate a SUCI. When the flag is not set, the USIM may attempt to generate a SUCI in response to (e.g., based on receipt of) a request for a SUCI from the ME.

[0146] During 8004, the USIM 801 signals the ME 802. This signalling may indicate that there is an error in determining the SlICI. This may be as described above in relation to 5003, 6004, and / or 7004. This signalling may additionally comprise an indication of a SLICI in plain text (e.g., a SLICI produced in accordance with the Null scheme).

[0147] During 8005, the ME 802 sets a similar error flag at the ME as USIM sets at the USIM during 8003 based on this signalling of 8004. This may be useful, for example, when the ME receives a request for a SUCI, as the ME does not need to query the USIM for a SUCI when this error flag is set because the ME already knows that the USIM is unable to determine a SIM. This means that the request may be responded to more quickly, which may result in a faster subsequent reconfiguration of the SUCI parameter values than methods that involve querying a USIM for a SUCI. As another example, the ME may be configured to not autonomously determine to request a SUCI from the USIM. For both of these examples, the ME may be configured to abstain from requesting a SUCI from the USIM when the error flag is set in the ME.

[0148] During 8006, the ME 802 performs a registration with the AMF and the UDM using the above-mentioned null-scheme (e.g., without using an encrypted SUCI).

[0149] After the ME 802 is successful registered with the AMF and the UDM, the ME 802 signals the AMF 803 during 8007. This signalling may comprise an indication that there was an error in generating a SUCI at the USIM. This indication may be as described above in relation to 5004 and / or 7005.

[0150] As mentioned above, this signalling of 8007 may comprise another identifier of the UE (e.g., a GUTI). As another example mentioned above, this signalling of 8005 may provide further information on which SUCI parameter is incorrectly configured at the USIM.

[0151] During 8008, the AMF 803 signals the UDM 804. This signalling may be as described in relation to any of 5005 and / or 6006 and / or 7006. This signalling may be formed as described above in relation to any of 5005 and / or 6006 and / or 7006.

[0152] During 8009, the UDM 704 reconfigures, at the USIM, one or more values of one of more SUCI parameters for determining the SUCI. This may be as described above in relation to any of 5006 and / or 6007 and / or 7007.

[0153] During 8010, the USIM 801 determines that the SUCI is correctly configured with values for the parameters used for determining a SUCI. Based on this determination of 8010, the USIM resets the error flag of 8003. Stated differently, based on 8010, the error flag of 8003 is no longer set. The error flag after 8010 therefore indicates that the SUCI is able to be determined by the USIM.

[0154] During 8011 , the USIM 801 signals the ME 802. This signalling indicates that the SUCI may be determined by the USIM. For example, this signalling may indicate that the SUCI configuration error is in a false state. This signalling may be comprised in a Notification service operation.

[0155] During 8012, the ME 802 resets the error flag of 8005 based on the signalling of 8010. Stated differently, based on 8011 , the error flag of 8005 is no longer set. The error flag after 8012 therefore indicates that the SUCI is able to be determined by the USIM.

[0156] During 8013, the ME 802 re-registers with the AMF and the UDM using a SUCI generated by the USIM.

[0157] In this example of Figure 8, when a “SUCI computation error” is identified in the USIM and a SUCI computation Error flag is set in the USIM configuration file, the UE uses a "null-scheme" for SUCI computation and performs registration to the 5G network using this null-scheme instead of normal registration (e.g., with a correctly determined SUCI). Once registration is completed and UE is connected to the network, the ‘SUCI computation error’ is indicated to 5G core network (5GC). A UDM in the 5GC may subsequently initiate error mitigation by reconfiguring the USIM with the values for one or more SUCI parameters in the USIM using, for example, an OTA or a UPU procedure. After a successful SUCI configuration is completed in USIM, the SUCI computation Error flag is cleared and UE switches back to a “normal” mode of operation in which a determined SUCI is used for obtaining a service for a network (including, for example, registration and / or authentication).

[0158] Figure 9 illustrates a fifth example. In this fifth example, the ME is configured to register with the network using another type of identifier when the SUCI is not able to be determined at the USIM. This may be, for example, in the case of emergency registration. Stated differently, in the example of Figure 9, the ME is configured to use an emergency registration procedure to register with a network when the SUCI is unavailable. The ME may be configured to inform the network about the lack of SUCI at the USIM after the emergency registration has been performed in order to trigger the network to configure parameters for determining SUCI at the USIM. The ME may reregister with the network when the USIM has been successfully reconfigured with correct parameters for determining a SUCI. This may be useful, for example, as not all services may be available to a UE when that UE is registered via an emergency registration procedure compared to a SUCI-based registration.

[0159] Figure 9 illustrates signalling that may be performed between a USIM 901 , an ME 902, an AMF 903, and a UDM 904.

[0160] During 9001 , the ME 902 signals the USIM 901 to request a SlICI. This signalling may be as described above with respect to 5001 .

[0161] During 9002, the USIM 901 determines whether a SUCI can be determined. This may be as described above in relation to any of 5002, and / or 6003.

[0162] When the USIM 901 determines during 9004 that a SUCI can be determined using the reconfigured values of the SUCI parameters, the USIM 901 determines the SUCI and provides the determined SUCI to the ME 902.

[0163] When the USIM 901 determines during 9003 that a SUCI cannot be determined, the USIM determines to send an indication of this determination error to the ME 902 during 9004.

[0164] During 9003, the USIM sets an error flag at the USIM that indicates that the USIM is currently in a SUCI computation error state in which a SUCI cannot be generated by the USIM. When the flag is set, the USIM may abstain from determining a SUCI. For example, when the USIM receives a request for a SUCI from the ME when the flag is set, the USIM may simply return an error message to the ME without attempting to determine the requested SUCI. This may be useful to make the overall procedure more efficient as time is not wasted in attempting to generate a SUCI. When the flag is not set, the USIM may attempt to generate a SUCI in response to (e.g., based on receipt of) a request for a SUCI from the ME.

[0165] During 9004, the USIM 901 signals the ME 902. This signalling may indicate that there is an error in determining the SUCI. This may be as described above in relation to 5003, 6004, and / or 7004.

[0166] During 9005, the ME 902 sets a similar error flag at the ME as USIM sets at the USIM during 9003 based on this signalling of 9004. This may be useful, for example, when the ME receives a request for a SUCI, as the ME does not need to query the USIM for a SUCI when this error flag is set because the ME already knows that the USIM is unable to determine a SIM. This means that the request may be responded to more quickly, which may result in a faster subsequent reconfiguration of the SUCI parameter values than methods that involve querying a USIM for a SUCI. As another example, the ME may be configured to not autonomously determine to request a SUCI from the USIM. For both of these examples, the ME may be configured to abstain from requesting a SUCI from the USIM when the error flag is set in the ME. During 9005, the ME further determines to use an emergency registration procedure for registering with the network comprising the AMF and the UDM.

[0167] During 9006, the ME 902 performs an emergency registration with the AMF and the UDM. This registration may use an identifier of the UE, such as, for example, a permanent equipment identifier (PEI).

[0168] After the ME 902 is successfully registered with the AMF and the UDM, the ME 902 signals the AMF 903 during 9007. This signalling may comprise an indication that there was an error in generating a SUCI at the USIM. This indication may be as described above in relation to 5004 and / or 7005.

[0169] As mentioned above, this signalling of 9007 may comprise another identifier of the UE (e.g., a GUTI). As another example mentioned above, this signalling of 9005 may provide further information on which SUCI parameter is incorrectly configured at the USIM.

[0170] During 9008, the AMF 903 signals the UDM 904. This signalling may be as described in relation to any of 5005 and / or 6006 and / or 7006. This signalling may be formed as described above in relation to any of 5005 and / or 6006 and / or 7006.

[0171] During 9009, the UDM 704 reconfigures, at the USIM, one or more values of one of more SUCI parameters for determining the SUCI. This may be as described above in relation to any of 5006 and / or 6007 and / or 7007.

[0172] During 9010, the USIM 901 determines that the SUCI is correctly configured with values for the SUCI parameters used for determining a SUCI. Based on this determination of 9010, the USIM resets the error flag of 9003. Stated differently, based on 9010, the error flag of 9003 is no longer set. The error flag after 9009 therefore indicates that the SUCI is able to be determined by the USIM.

[0173] During 9011 , the USIM 901 signals the ME 902. This signalling indicates that the SUCI may be determined by the USIM. For example, this signalling may indicate that the SUCI configuration error is in a false state. This signalling may be comprised in a Notification service operation.

[0174] During 9012, the ME 902 resets the error flag of 9005 based on the signalling of 9010. Stated differently, based on 9011 , the error flag of 9005 is no longer set. The error flag after 9012 therefore indicates that the SUCI is able to be determined by the USIM.

[0175] During 9013, the ME 902 re-registers with the AMF and the UDM using a SUCI generated by the USIM.

[0176] This example of Figure 9 only differs from the example of Figure 8 in that an emergency registration procedure is used during Figure 9 when a SUCI cannot be correctly determined, while the example of Figure 8 uses an unencrypted form of the SUCI when a SUCI cannot be correctly determined.

[0177] The examples of Figures 10 and 11 relate to examples in which a UE is configured to connect to another network instead of the 5G network when a SUCI cannot be correctly determined by the USIM. As mentioned above, the another network is shown in the present examples as being an LTE network. However, as discussed above, it is understood that the present references to a LTE network and a 5G network are not limiting.

[0178] Figure 10 illustrates a sixth example signalling method. In the example of Figure 10, the ME is configured to connect to an LTE network when a SUCI is not able to be correctly determined by a USIM.

[0179] Figure 10 illustrates signalling that may be performed between a USIM 1001 , an ME 1002, a mobility management entity (MME) 1003, a home subscriber system (HSS) 1004, and a UDM 1005. The MME and HSS are deployed in an LTE network. The UDM is deployed in a 5G network. Although not shown, the MME and / or HSS may communicated with the UDM via an interface between the LTE and 5G networks, such as a network exposure function.

[0180] 10001 corresponds to the signalling of 4001 , while 10002 corresponds to 4002.

[0181] During 10003, the USIM sets a SUCI computation error flag based on the determination of 10002. This may be as described above in relation to any of Figures 7 to 9.

[0182] During 10004, the USIM 1001 signals the ME 1002. This signalling may comprise a response to the signalling of 10001. This signalling may comprise an indication that SUCI could not be obtained. Stated differently, this signalling may comprise an indication of an error in obtaining the SUCI. This signalling of 10004 may be as described above in relation to 5003.

[0183] During 10005, the ME 1002 determines to register with an LTE network until the SUCI determination configuration error is resolved. As discussed above in relation to any of Figures 7 to 9, the ME 1002 may further set a flag at the ME indicating that the USIM cannot correctly determine the SUCI.

[0184] During 10006, the ME 1002 registers with the LTE network. This registration may be performed based on a determination that the flag is set at the ME.

[0185] During 10007, the UDM 1005 configures at least part of a SUCI configuration at the USIM 1001. This may be performed using an OTA-based procedure. This signalling may be provided via the LTE network.

[0186] During 10008, the USIM 1001 determines that the SUCI can be correctly determined, based on the configuration received during 10007. As a result of thisdetermination, the flag of 10003 may be reset, and the signalling of 10009 may be performed. The reset of the flag of 10003 may be as described above in relation to the reset of the USIM flags of 8010 and 9010 of Figures 8 and / or 9.

[0187] During 10009, the USIM 1001 signals the ME 1002. This signalling may comprise a notification message. This signalling may comprise an indication that the SUCI can be determined at the USIM. Stated differently, this signalling may indicate that the SUCI configuration error is now in a false state. This signalling may be as described above in relation to any of 8011 and / or 9011 .

[0188] During 10010, the ME 1002 resets its flag of 10005. This may be as described above in relation to any of 8011 and / or 9011 .

[0189] During 10011 , the ME 1002 registers with the 5G network. Stated differently, in the example of Figure 10, the flag functions as a mechanism that stops a UE from connecting to a 5G network when the flag is set, and that allows a UE to connect to a 5G network when the flag is not set.

[0190] In this example of Figure 10, when a “SUCI computation error” is identified in the USIM, a SUCI computation Error flag is set in the USIM configuration file. Whenever this flag is set, a UE will not try to attach to 5G network. Instead, when the flag is set, the UE will fallback into a 4G UE mode and behave like a 4G UE. The UE will consequently connect to LTE network and report the error to an MME (e.g., via non access stratum (NAS) signalling methods). The MME forwards the report of this error to the HSS. The HSS may call the service based interface (SBI) interface of the UDM (Uhhd) to communicate this SUCI mis-configuration error to the UDM. The receipt of this indication from the HSS may trigger the UDM to configure the SUCI parameters correctly at the USIM.

[0191] Figure 11 illustrates a seventh example signalling method. In the example of Figure 11 , the ME is configured to connect to an LTE network when a SUCI is not able to be correctly determined by a USIM. Further, the ME maintains its connection with the LTE network regardless of whether a SUCI is subsequently correctly configured at the USIM. Stated differently, in the example of Figure 11 , the UE is not triggered to change from the LTE network to a 5G network on receipt of a correctly configured SUCI configuration at the USIM of that UE.

[0192] Figure 11 illustrates signalling that may be performed between a USIM 1101 , an ME 1102, a mobility management entity (MME) 1103, a home subscriber system (HSS) 1104, and a UDM 1105. The MME and HSS are deployed in an LTE network. The UDM is deployed in a 5G network. Although not shown, the MME and / or HSS maycommunicated with the UDM via an interface between the LTE and 5G networks, such as a network exposure function.

[0193] 11001 corresponds to the signalling of 4001 , while 11002 corresponds to 4002.

[0194] During 11003, the USIM sets a SUCI computation error flag based on the determination of 11002. This may be as described above in relation to any of Figures 7 to 10.

[0195] During 11004, the USIM 1101 signals the ME 1102. This signalling may comprise a response to the signalling of 8001 . This signalling may comprise an indication that SUCI could not be obtained. Stated differently, this signalling may comprise an indication of an error in obtaining the SUCI. This signalling of 8004 may be as described above in relation to 5003.

[0196] During 10005, the ME 1102 registers with the LTE network, and / or the ME 1102 determines that the UE is already connected with the LTE network. This registration and / or determination may be performed based on a determination that the flag is set at the ME. As discussed above in relation to any of Figures 7 to 10, the ME 1102 may further set a flag at the ME indicating that the USIM cannot correctly determine the SUCI. While the flag is set in this example, the ME may not directly connect to a 5G network.

[0197] During 11006, the ME 1102 signals the MME 1103. This signalling may comprise an indication of the SUCI parameters being misconfigured at the USIM. This signalling may comprise a bitmap, as described above. This signalling may be comprised in NAS signalling.

[0198] During 11007, the MME forwards the indication of the SUCI parameters being misconfigured to the HSS, which in turn provides these to the HSS 1104. The HSS 1104 may subsequently signal an indication of the SUCI parameters being misconfigured (with an identifier of the subscriber, such as the SUPI) to the UDM 1105. This signalling may be performed using an Nudm_Notification signalling procedure.

[0199] During 11007, the UDM 1105 configures at least part of a SUCI configuration at the USIM 1101. This may be performed using an OTA-based procedure. This signalling may be provided via the LTE network.

[0200] In this example of Figure 11 , when a “SUCI computation error” is identified in the USIM and a SUCI computation Error flag is set in the USIM configuration file, the UE moves into an LTE mode to avoid SUCI computation, and will not try to connect to 5G network again (and / or will not try to connect to a 5G network again until a predetermined timer has expired).

[0201] Figures 12 to 17 illustrate features of the above implementation examples of Figures 5 to 11 . It is therefore understood that one or more terms or expressions used in the following may be better understood with reference to the above-described implementation examples.

[0202] Figures 12 to 14 illustrate features from a plurality of the above-mentioned examples, while Figures 15 to 17 illustrate features from the first implementation example of Figure 5.

[0203] Figure 12 illustrates features that may be performed by an apparatus. The apparatus may comprise a user equipment. The apparatus may comprise only part of a user equipment (e.g., a mobile equipment part of a UE). The apparatus may be as described above in reference to Figure 3. The user equipment may comprise a mobile equipment part and a SIM part, such as described above. It is understood that references herein to a SIM part may refer to any type of identification part of an apparatus that is used to provide a temporary subscriber identifier (such as a SUCI). It is further understood that references in the following to a SUCI may apply in respect of one or more temporary subscriber identifiers that are to be generated (e.g., computed) at or by a SIM part of a user equipment.

[0204] During 1201 , the apparatus obtains, at a mobile equipment of a user equipment from a Subscriber Identity Module (SIM) of the user equipment, first information indicating that the SIM cannot provide the apparatus with a subscription concealed identifier, SUCI.

[0205] Stated differently, during 1201 , the apparatus obtains, at a mobile equipment part of a UE from a SIM part of the user equipment, first information indicating that there was a compute error at the SIM when generating the SUCI. Stated differently, the first information may indicate that a SUCI generation computation executed by the SIM resulted in an error (e.g., an error state at the SIM).

[0206] During 1202, the apparatus provides, to a first network node, second information indicating that a SUCI is not available at the user equipment.

[0207] The second information may indicate that there was a compute error when generating the SUCI.

[0208] The first network node may be as described below in relation to Figure 13. The first network node may be comprised in and / or comprise a mobility function, such as a mobility management entity and / or an access and mobility function.

[0209] The SUCI may be for use in a first network while the first network node is deployed in a second network. As another example, the SUCI may be for use in a first network while the first network node is deployed in the first network .

[0210] As discussed in the above implementation examples, the first information may comprise further information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the SIM and / or which of said plurality of parameters are either not configured at the SIM or configured incorrectly at the SIM.

[0211] Throughout the following examples of Figures 12 to 17, a parameter may be considered to be configured incorrectly at the SIM when that parameter is configured with a value that results in an error for a computed value of SUCI when the SIM performs a SUCI computation procedure.

[0212] Throughout the following examples of Figures 12 to 17, the parameters may be the above-mentioned SUCI parameters. Stated differently, the parameters may be parameters that are used by the SIM when generating a SUCI. At least one of the parameters may be a parameter that was previously configured at the SIM (e.g., by a UDM, AUSF, or similar).

[0213] The further information may comprise a bitmap as described in the above implementation examples. For example, the further information may comprise a bitmap, wherein each entry in the bitmap may correspond to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the SIM or is either not configured at the SIM or is configured incorrectly at the SIM.

[0214] The providing the second information may comprise for providing the second information using at least one of: a 5G mobility management status message , an identity response message , a user parameter update acknowledgement message , or a non access stratum message over a long term evolution network.

[0215] The apparatus of Figure 5 may autonomously determine, at the apparatus, to obtain the first information from the SIM for obtaining a service from a first network and / or registering with a first network. Stated differently, the obtaining the SUCI may be ME- initiated. The service may be, for example, at least one of: a registration procedure, an authentication procedure, or an authorisation procedure. The apparatus may provide a request for an identity of a subscriber of the apparatus to the SIM based on the autonomously determining. Stated differently, the apparatus (e.g., an ME part of the apparatus) may determine that a condition has been fulfilled for performing a signalling procedure with a network (e.g., a registration signalling procedure, an authentication signalling procedure and / or an authorisation signalling procedure), and request (from the SIM) an identity (e.g., the SUCI identity) in response to (e.g., based on and / or in dependence on) that determination. The condition may be, for example, a result of aconfiguration of the apparatus, an input being received from a user input to the apparatus, a change of state of the apparatus (e.g., out of an airplane mode), a power-on state of the apparatus, etc.

[0216] Instead of and / or in addition to the autonomous determining, the apparatus may request the SUCI in response to (e.g., based on) receiving a request for this identifier from a network node (e.g., network-initiated obtaining of the SUCI). Stated differently, the apparatus may obtain, from the first network node, a request for an identity of a subscriber of the apparatus, and provide a request for an identity of a subscriber of the apparatus to the SIM based on the obtaining the request.

[0217] As discussed above, the obtaining may additionally and / or alternatively be performed in response to a reconfiguration of SUCI parameters previously stored at the SIM (e.g., SIM-initiated providing of the SUCI). In this example, the apparatus may obtain, from a second network node prior to obtaining the first information, one or more parameters for calculating the SUCI at the apparatus, and configure the one or more parameters at the SIM, wherein the first information is obtained in response to the configuring. The second network node may be as described below in relation to Figure 14. The second network node may comprise or be comprised in a UDM and / or an AUSG.

[0218] In relation to this, the apparatus may obtain, from a second network node subsequent to providing the first information, one or more parameters for calculating the SUCI at the apparatus, and configuring the one or more parameters at the SIM. The obtaining the one or more parameters may comprise receiving the one or more parameters via an over-the-air signalling procedure and / or via a user parameter update signalling procedure.

[0219] The apparatus may further be configured to apply the above-mentioned flags (e.g., error flags) at at least one of the SIM and the mobile equipment.

[0220] For example, prior to providing the first information to the mobile equipment, the apparatus may set a flag at a configuration file of the SIM based on determining at the SIM that a SUCI generation computation resulted in error. When the flag is set at the SIM, the SIM is configured to abstain from performing a computation of the SUCI and returns a SUCI error computation message (e.g., an indication that the SUCI is not available at the SIM) in response to any request for the SUCI from the mobile equipment. When the flag is not set at the SIM, the SIM is configured to perform a computation of the SUCI based on receipt of a request for the SUCI from the mobile equipment.

[0221] As another example, based on obtaining the first information, the apparatus may set a flag at the mobile equipment. When the flag is set at the mobile equipment, themobile equipment is configured to abstain from requesting the SUCI from the SIM when at least one condition for requesting the SUCI from the SIM is met. When the flag is not set at the mobile equipment, the mobile equipment is configured to request the SUCI from the SIM when the at least one condition for requesting the SUCI is met.

[0222] When the first network comprises a 5G network, the second network comprises a 4G network, the SUCI is for use in the first network, and first network node is deployed in the second network, the apparatus may connect to the second network when at least one of the flag or the configuration flag is set, and / or abstain from connecting to the first network when at least one of the flag or the configuration flag is set.

[0223] Throughout the following examples of Figures 12 to 17, the SIM may comprise at least one of: a universal SIM, an embedded SIM, or an integrated SIM.

[0224] Figure 13 illustrates methods that may be performed by an apparatus. The apparatus may comprise a network node. For example, the apparatus may comprise and / or be comprised in a mobility function, such as an access and mobility function and / or a mobility management entity. The apparatus may comprise and / or be comprised in the first network node mentioned in relation to Figure 12. The apparatus may be as described above in relation to Figure 2.

[0225] During 1301 , the apparatus obtains, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment. The second information may be as described above in relation to Figure 12. For example, the second information may indicate that there was a compute error when generating the SUCI.

[0226] During 1302, the apparatus provides, to a second network node, third information indicating that the SUCI is not available at the user equipment. Stated differently, the third information may indicate that there was a compute error when generating the SUCI. The second network node may be as described in relation to Figure 13.

[0227] The apparatus may obtain the second information using at least one of: a 5G mobility management status message, an identity response message, a user parameter update acknowledgement message, or a non access stratum message over a long term evolution network .

[0228] The apparatus may form the third information by selecting at least part of the information comprised in second information to insert into the third information based on a signalling format to be used for providing the third information to the second network node. In an example, when the apparatus of Figure 13 is deployed in the same network as the second network node (e.g., the apparatus of Figure 13 comprises an AMF), thesignalling format and / or service operation used for providing the third information may comprise and / or be compliant with the format of an Nudm_notification message.

[0229] In an example in which the first network node is deployed in a second network and the second network node is deployed in a first network, the third information may be provided to the second network node using a service based interface and / or a network exposure function interfacing between at least two nodes of the first and second networks.

[0230] As discussed above, the second information may comprise further information that provides detail on why the SUCI is not available at the user equipment (e.g., that provides the above-mentioned bitmap or some other appropriate signalling). Stated differently, the second information may comprise additional information that indicates, for each of a plurality of SUCI parameters, which of said plurality of SUCI parameters are configured at the user equipment and / or which of said plurality of SUCI parameters are either not configured at the user equipment or configured incorrectly at the user equipment. This may be as described above in relation to Figure 12.

[0231] The additional information may comprise a bitmap, each entry in the bitmap corresponding to a respective SUCI parameter of said plurality of SUCI parameters, and wherein a respective value comprised in each entry indicates whether the respective SUCI parameter corresponding to that entry is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0232] The apparatus of Figure 13 may maintain a mapping at the apparatus between an identifier of the user equipment assigned by the apparatus and a subscription permanent identifier (SUPI) of the user equipment. The apparatus of Figure 13 may receive (e.g., extract) the identifier assigned by the apparatus in (from) the second information. The apparatus may use the received / extracted identifier with the mapping to determine the SUPI assigned by the apparatus. The apparatus may insert the determined SUPI into the third information.

[0233] Figure 14 illustrates methods that may be performed by an apparatus. The apparatus may comprise a network node. For example, the apparatus may comprise and / or be comprised in a USM, an AUSF, etc. The apparatus may comprise and / or be comprised in the second network node mentioned in relation to any of Figures 12 and / or 13. The apparatus may be as described above in relation to Figure 2.

[0234] During 1401 , the apparatus obtains, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment. The first network node may correspond to the apparatus of Figure 13. Stateddifferently, the third information may indicate that there was a compute error when generating the SlICI. The third information may correspond to the third information of Figure 13.

[0235] During 1402, the apparatus configures, based on the third information, the user equipment with one or more parameters for calculating the SLICI at the apparatus.

[0236] The apparatus of Figure 14 may obtain a subscription permanent identifier, SUPI, of the user equipment with (e.g., from) the third information. The apparatus may further determine the one or more parameters to be configured at the user equipment using the SUPI. Stated differently, the apparatus may determine subscription information of the user equipment (e.g. of a user of that user equipment) that corresponds to the SUPI, and determine configuration information based on (e.g., corresponding to) that determined subscription information.

[0237] The apparatus may configure the one or more parameters using an over-the-air signalling message and / or a user parameter update signalling message.

[0238] When the first network node is deployed in a second network, the second network node is deployed in a first network, the third information may be obtained by the second network node using a service based interface and / or a network exposure function interfacing between at least two nodes of the first and second networks.

[0239] As illustrated in the above examples, the third information may comprise additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.

[0240] For example, the additional information may comprises a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0241] The following applies in respect of at least Figures 13 and 14.

[0242] When the SUCI is for use in a first network, the second network node may be deployed in the first network, and the first network node may be deployed in a second network.

[0243] When the SUCI is for use in a first network, the second network node may be deployed in the first network, and the first network node may be deployed in the first network.

[0244] Figures 15 to 17 illustrate features, methods and / or signalling of the implementation example of Figure 5.

[0245] Figure 15 illustrates methods that may be performed by an apparatus. The apparatus may comprise a user equipment. The apparatus may comprise only part of a user equipment (e.g., a mobile equipment part of a UE). The apparatus may be as described above in reference to Figure 3. The user equipment may comprise a mobile equipment part and a SIM part, such as described above. It is understood that references herein to a SIM part may refer to any type of identification part of an apparatus that is used to provide a temporary subscriber identifier (such as a SUCI). It is further understood that references in the following to a SUCI may apply in respect of one or more temporary subscriber identifiers that are to be generated (e.g., computed) at or by a SIM part of a user equipment.

[0246] During 1501 , the apparatus provides, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI.

[0247] During 1502, the apparatus obtains, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI. This may be as described above in relation to 1201 . For example, the first information may indicate that there was a SUCI compute error when calculating (e.g., generating) the SUCI.

[0248] During 1503, the apparatus provides, to a first network node, second information indicating that a SUCI is not available at the user equipment. The first network node may be as described below in relation to Figure 16. The second information may be as described above in relation to Figure 12.

[0249] As discussed above in relation to Figure 12, the first information may comprise further information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the SIM and / or which of said plurality of parameters are either not configured at the SIM or configured incorrectly at the SIM. This may be as described above in relation to Figure 12.

[0250] For example, the further information may comprise a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the SIM or is either not configured at the SIM or configured incorrectly at the user equipment.

[0251] The providing the second information may be performed using a 5G mobility management status message.

[0252] The providing the second information may comprise providing the second information with an identifier of the user equipment that was previously allocated to the user equipment by the first network node. The identifier of the user equipment that was previously allocated to the user equipment by the first network node may comprise a globally unique temporary identifier (e.g., when the first network node comprises an AMF).

[0253] As mentioned above in relation to Figure 12, the generation of the first information may be performed based on at least one of being: triggered autonomously by the mobile equipment, triggered by the mobile equipment following signalling from the first network node, and / or triggered by the SIM receiving reconfigured SUCI parameters.

[0254] For example, the apparatus may autonomously determine, at the apparatus, to obtain the first information from the SIM for obtaining a service from a first network and / or registering with a first network, and provide the request for the SUCI to the SIM based on the autonomously determining.

[0255] As another example, the apparatus may obtain, from a second network node subsequent to providing the first information, one or more parameters for calculating the SUCI at the apparatus, and configure the one or more parameters at the SIM.

[0256] The obtaining the one or more parameters may comprise receiving the one or more parameters via an over-the-air signalling procedure and / or via a user parameter update signalling procedure.

[0257] The SIM may comprise at least one of: a universal SIM, an embedded SIM, or an integrated SIM.

[0258] Figure 16 illustrates methods that may be performed by an apparatus. The apparatus may comprise a network node. For example, the apparatus may comprise and / or be comprised in a mobility function, such as an access and mobility function and / or a mobility management entity. The apparatus may comprise and / or be comprised in the first network node mentioned in relation to Figure 15. The apparatus may be as described above in relation to Figure 2.

[0259] During 1601 , the apparatus obtains, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment. The second information may be as described above in relation to any of Figures 12, 13 and / or 15. Stated differently, the second information may indicate that there was a compute error at the user equipment when generating the SUCI.

[0260] During 1602, the apparatus provides, to a second network node, third information indicating that the SUCI is not available at the user equipment. The third information may be as described above in relation to Figure 13. Stated differently, the third informationmay indicate that there was a compute error at the user equipment when generating the SUCI.

[0261] During 1603, the apparatus determines, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information.

[0262] During 1604, the apparatus providing the SUPI to the second network node with the third information.

[0263] The obtaining the second information may comprise obtaining the second information using a 5G mobility management status message.

[0264] The apparatus may form the third information by selecting at least part of the information comprised in second information to insert into the third information based on a signalling format to be used for providing the third information to the second network node. This may be as discussed above in Figure 13.

[0265] As discussed above in relation to Figure 13, the second information may comprise additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.

[0266] For example, when the additional information comprises a bitmap, each entry in the bitmap may correspond to a respective parameter of said plurality of parameters, wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0267] Figure 17 illustrates methods that may be performed by an apparatus. The apparatus may comprise a network node. For example, the apparatus may comprise and / or be comprised in a USM, an AUSF, etc. The apparatus may comprise and / or be comprised in the second network node mentioned in relation to any of Figures 15 and / or 16. The apparatus may be as described above in relation to Figure 2.

[0268] During 1701 , the apparatus obtains, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment. The third information may be as discussed above in relation to any of Figures 13, 14 or 16. Stated differently, the third information may indicate that there was a compute error when generating the SUCI.

[0269] During 1702, the apparatus obtains a subscription permanent identifier, SUPI, of the user equipment with the third information. For example, during 1702, the apparatus extracts a SUPI corresponding to the user equipment from the third information.

[0270] During 1703, the apparatus determining the one or more parameters to be configured at the user equipment based on the SUPI (e.g., by using the SUPI to retrieve subscription information corresponding to that SUPI, and determining the one or more parameters to be compliant with the retrieved subscription information).

[0271] During 1704, the apparatus configures, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus. This may be as described above in relation to any of Figures 12, 14 and / or 15. The parameters may be SUCI parameters, as described above (it is understood that any of the parameters referred to in relation to any of Figures 12 to 17 may be SUCI parameters).

[0272] The apparatus may configure the one or more parameters using an over-the-air signalling message or a user parameter update signalling message.

[0273] The third information of any of Figures 16 and / or 17 may be as described above in relation to any of Figures 13 and / or 14. For example, the third information may comprise additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.

[0274] Further, the additional information may comprise a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each value indicates whether that respective parameter is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.

[0275] It is understood that references in the above to various network functions (e.g., to an AMF, an SMF, TNF etc.) may comprise apparatus that perform at least some of the functionality associated with those network functions. Further, an apparatus comprising a network function may comprise a virtual network function instance of that network function.

[0276] It should be understood that the apparatuses may comprise or be coupled to other units or modules etc., such as radio parts or radio heads, used in or for transmission and / or reception. Although the apparatuses have been described as one entity, different modules and memory may be implemented in one or more physical or logical entities.

[0277] It is noted that whilst some embodiments have been described in relation to 5G networks, similar principles can be applied in relation to other networks and communication systems. Therefore, although certain embodiments were described above by way of example with reference to certain example architectures for wireless networks, technologies and standards, embodiments may be applied to any other suitable forms of communication systems than those illustrated and described herein.

[0278] It is also noted herein that while the above describes example embodiments, there are several variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0279] As used herein, “at least one of the following: ” and “at least one of ” and similar wording, where the list of two or more elements are joined by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.

[0280] In general, the various embodiments may be implemented in hardware or special purpose circuitry, software, logic or any combination thereof. Some aspects of the disclosure may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the disclosure is not limited thereto. While various aspects of the disclosure may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0281] As used herein, the term “circuitry” may refer to one or more or all of the following:(a) hardware-only circuit implementations (such as implementations in only analog and / or digital circuitry) and(b) combinations of hardware circuits and software, such as (as applicable):(i) a combination of analog and / or digital hardware circuit(s) with software / firmware and(ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions) and(c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.”

[0282] This definition of circuitry applies to all uses of this term herein, including in any claims. As a further example, as used herein, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

[0283] The embodiments of this disclosure may be implemented by computer software executable by a data processor of the mobile device, such as in the processor entity, or by hardware, or by a combination of software and hardware. Computer software or program, also called program product, including software routines, applets and / or macros, may be stored in any apparatus-readable data storage medium and they comprise program instructions to perform particular tasks. A computer program product may comprise one or more computer-executable components which, when the program is run, are configured to carry out embodiments. The one or more computer-executable components may be at least one software code or portions of it.

[0284] Further in this regard it should be noted that any blocks of the logic flow as in the Figures may represent program steps, or interconnected logic circuits, blocks and functions, or a combination of program steps and logic circuits, blocks and functions. The software may be stored on such physical media as memory chips, or memory blocks implemented within the processor, magnetic media such as hard disk or floppy disks, and optical media such as for example DVD and the data variants thereof, CD. The physical media is a non-transitory media.

[0285] The term “non-transitory,” as used herein, is a limitation of the medium itself (i.e., tangible, not a signal) as opposed to a limitation on data storage persistency (e.g., RAM vs. ROM).

[0286] The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductorbased memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors may be of any type suitable to the local technical environment, and may comprise one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASIC), FPGA, gate levelcircuits and processors based on multi core processor architecture, as non-limiting examples.

[0287] Various example embodiments of the disclosure may be practiced in various components such as integrated circuit modules. The design of integrated circuits is by and large a highly automated process. Complex and powerful software tools are available for converting a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate.

[0288] The scope of protection sought for various example embodiments of the disclosure is set out by the independent claims. The example embodiments and features thereof, if any, described in this disclosure that do not fall under the scope of the independent claims are to be interpreted as examples useful for understanding various example embodiments of the disclosure.

[0289] The foregoing description has provided, by way of non-limiting and illustrative examples, a full and informative description of the various example embodiments of this disclosure. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings and the claims. However, all such and similar modifications of the teachings will still fall within the various example embodiments of the disclosure as set forth in the claims. By way of non-limiting and illustrative example, there is a further example embodiment comprising a combination of one or more example embodiments with any of the other example embodiments previously discussed.

Claims

CLAIMS1 ) An apparatus comprising means for: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.2) An apparatus as claimed in any preceding claim, wherein the first information comprises further information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the SIM and / or which of said plurality of parameters are either not configured at the SIM or configured incorrectly at the SIM.3) An apparatus as claimed in claim 2, wherein the further information comprises a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the SIM or is either not configured at the SIM or configured incorrectly at the user equipment.4) An apparatus as claimed in any preceding claim, wherein the means for providing the second information comprises means for providing the second information using a 5G mobility management status message.5) An apparatus as claimed in claim 4, wherein the means for providing the second information comprises means for providing the second information with an identifier of the user equipment that was previously allocated to the user equipment by the first network node.476) An apparatus as claimed in claim 5, wherein the identifier of the user equipment that was previously allocated to the user equipment by the first network node comprises a globally unique temporary identifier.7) An apparatus as claimed in any preceding claim, wherein the apparatus comprises means for: autonomously determining, at the apparatus, to obtain the first information from the SIM for obtaining a service from a first network and / or registering with a first network; and providing the request for the SUCI to the SIM based on the autonomously determining.8) An apparatus as claimed in any preceding claim, comprising means for: obtaining, from a second network node subsequent to providing the first information, one or more parameters for calculating the SUCI at the apparatus; and configuring the one or more parameters at the SIM.9) An apparatus as claimed in claim 8, wherein the obtaining the one or more parameters comprises receiving the one or more parameters via an over-the-air signalling procedure and / or via a user parameter update signalling procedure.10)An apparatus as claimed in any preceding claim, wherein the SIM comprises at least one of: a universal SIM, an embedded SIM, or an integrated SIM.11 )An apparatus as claimed in any preceding claim, wherein the first network node comprises an access and mobility function and / or a mobility management entity.12)An apparatus comprising means for: obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment;determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information.13)An apparatus as claimed in any claim 12, wherein the means for obtaining the second information comprises means for obtaining the second information using a 5G mobility management status message.14)An apparatus as claimed in any of claims 12 to 13, comprising means for: forming the third information by selecting at least part of the information comprised in second information to insert into the third information based on a signalling format to be used for providing the third information to the second network node.15)An apparatus as claimed in any preceding claim, wherein the second information comprises additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.16)An apparatus as claimed in claim 15, wherein the additional information comprises a bitmap, each entry in the bitmap corresponding to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each entry indicates whether the respective parameter corresponding to that entry is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.17)An apparatus comprising means for: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; andconfiguring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.18)An apparatus as claimed in claim 17, wherein the means for configuring comprises means for configuring the one or more parameters using an over-the-air signalling message or a user parameter update signalling message.19)An apparatus as claimed in any of claims 13 or 17, or any preceding claim when dependent on claim 13 or claim 17, wherein the third information comprises additional information that indicates, for each of a plurality of parameters, which of said plurality of parameters are configured at the user equipment and / or which of said plurality of parameters are either not configured at the user equipment or configured incorrectly at the user equipment.20)An apparatus as claimed in claim 19, wherein the additional information comprises a bitmap, each entry in the bitmap corresponds to a respective parameter of said plurality of parameters, and wherein a respective value comprised in each value indicates whether that respective parameter is configured at the user equipment or is either not configured at the user equipment or configured incorrectly at the user equipment.21 )A method for an apparatus, the method comprising: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment.22)A method for an apparatus, the method comprising: obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment;determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information. )A method for an apparatus, the method comprising: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUPI, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus. )A computer program comprising instructions which, when the program is executed by a computer of an apparatus, cause the apparatus to carry out: providing, at a mobile equipment of a user equipment to a Subscriber Identity Module, SIM, of the user equipment, a request for a subscription concealed identifier, SUCI; obtaining, at the mobile equipment from the SIM, first information indicating that the SIM cannot provide the apparatus with a SUCI; and providing, to a first network node, second information indicating that a SUCI is not available at the user equipment. )A computer program comprising instructions which, when the program is executed by a computer of an apparatus, cause the apparatus to carry out: obtaining, from a user equipment, second information indicating that a subscription concealed identifier, SUCI, is not available at the user equipment; providing, to a second network node, third information indicating that the SUCI is not available at the user equipment; determining, via mapping maintained at the first apparatus, a subscription permanent identifier, SUPI, of the user equipment using an identifier of the user equipment comprised in the second information; and providing the SUPI to the second network node with the third information.)A computer program comprising instructions which, when the program is executed by a computer of an apparatus, cause the apparatus to carry out: obtaining, from a first network node, third information indicating that a subscription concealed identifier, SUCI, is not available to a user equipment; obtaining a subscription permanent identifier, SUP I, of the user equipment with the third information; determining the one or more parameters to be configured at the user equipment using the SUPI; and configuring, based on the third information, the user equipment with one or more parameters for calculating the SUCI at the apparatus.

Images