Anonymous UE Authentication via SUCI-SUPI Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication protocols like EAP-TLS disclose user identities during authentication, compromising security and preventing secure communication between terminal devices and networks.
Innovation Solution
A communication method that utilizes an authentication server function to obtain a subscription permanent identifier from a certificate, ensuring anonymous authentication by using a subscription concealed identifier, thereby maintaining user identity confidentiality and enabling secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EAP-TLS authentication protocol is used for mutual verification between client and server, then authentication security is improved, but user identity disclosure occurs during the authentication process
Solution Approach 1:
The patent introduces an authentication server function (AUSF) as an intermediary between the terminal device and the unified data management function (UDM). The AUSF receives the authentication request with SUCI, forwards it to UDM, and receives the SUPI in response. This intermediary structure allows the terminal device to authenticate without directly exposing its identity, as the UDM holds the mapping between SUCI and SUPI. The intermediary protects user identity confidentiality while maintaining authentication security.
Solution Approach 2:
The patent extracts the user identity information from the authentication request by using a subscription concealed identifier (SUCI) instead of the actual user identity. The SUCI is a concealed form of the subscription permanent identifier (SUPI) that can be used for authentication purposes without revealing the real identity. This extraction of identity information in concealed form prevents identity disclosure while enabling secure authentication.
2Loss of information
If subscription concealed identifier (SUCI) is used in authentication request to protect user identity, then identity confidentiality is improved, but the system complexity increases due to additional identifier mapping requirements
Solution Approach 1:
The patent implements self-service by having the terminal device itself perform the concealment of its identity by generating and using the SUCI instead of sending the actual SUPI. The device has the capability to convert its identity into a concealed form, eliminating the need for external services to perform this conversion. This reduces system complexity by distributing the concealment function to the device itself while maintaining identity confidentiality.
Solution Approach 2:
The patent applies preliminary action by pre-establishing the mapping relationship between SUCI and SUPI in the unified data management function (UDM) before authentication occurs. The UDM is pre-configured with the ability to resolve SUCI to SUPI, so that when authentication requests arrive, the mapping can be performed immediately without complex real-time processing. This preliminary setup simplifies the authentication process while maintaining security.
Data Source
AI summary
This application provides a communication method and a communication apparatus. The method includes: An authentication server function receives an authentication request message of a terminal device, where the authentication request message includes a subscription concealed identifier of the terminal device. The authentication server function sends a first request message to a unified data management function based on the authentication request message, where the first request message is used to obtain a subscription permanent identifier of the terminal device, and the first request message carries a certificate of the UE or carries information in the certificate of the UE. The authentication server function receives a response message from the unified data management function, where the response message includes the subscription permanent identifier corresponding to the information in the certificate of the terminal device. The authentication server function determines a security anchor function key based on the subscription permanent identifier.