Secure Element Data Transfer During 5G Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for establishing initial connectivity in 5G standalone networks with non-removable secure elements like integrated UICCs face challenges in securely transmitting necessary data such as 5G SUCI encryption keys, Ki, and profile download activation codes, which are not addressed by existing protocols.
Innovation Solution
Utilizing a standard protocol to send additional data like 5G SUCI encryption keys, Ki, and profile download activation codes through a secured packet during the 5G attachment procedure, leveraging the 3GPP TS 33.501 V17.5.0 protocol for user equipment steering in visited PLMN registration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional initial connectivity procedures are used in 5G standalone networks, then basic authentication can be established, but essential data such as 5G SUCI encryption keys, Ki, and profile download activation codes cannot be securely transmitted to the secure element
Solution Approach 1:
The patent introduces a dedicated data transmission procedure that acts as an intermediary mechanism between the server and the secure element. This procedure uses secured packets with authentication parameters (RAND, AUTN) to safely convey essential data like 5G SUCI encryption keys, Ki, and activation codes. The intermediary protocol ensures both completeness of data transmission and maintains security through cryptographic authentication, resolving the contradiction between transmitting all necessary data and maintaining secure communication.
Solution Approach 2:
The patent implements preliminary authentication and key exchange actions before the actual data transmission. By establishing authentication parameters (RAND, AUTN) and security context in advance through the initial attach procedure, the system creates a secure foundation that enables subsequent transmission of sensitive data. This preliminary setup ensures that when essential data is transmitted, it can be done securely without compromising either completeness or security.
2Adaptability or versatility
If unencrypted SUCI is used for initial connectivity, then compatibility with all MNOs is achieved, but security is compromised and MNOs that reject unencrypted SUCI cannot be served
Solution Approach 1:
The patent implements a dynamic approach where the system can adapt its behavior based on network conditions and MNO requirements. The procedure allows the network to dynamically determine whether encrypted or unencrypted SUCI should be used, and to dynamically transmit the appropriate encryption keys and parameters to the secure element. This dynamic flexibility enables the system to serve both MNOs that accept unencrypted SUCI and those that require encrypted SUCI, resolving the contradiction between versatility and security.
Solution Approach 2:
The patent changes the parameter state of SUCI encryption based on network requirements. By transmitting encryption keys and authentication parameters to the secure element, the system can change from using unencrypted SUCI to using encrypted SUCI when needed. This parameter change capability allows the system to adapt to different MNO security requirements while maintaining backward compatibility, thus resolving the contradiction between MNO compatibility and security.
3Ease of operation
If secure element stores all credentials locally, then self-sufficiency is achieved, but device complexity and memory requirements increase
Solution Approach 1:
The patent uses preliminary action by transmitting essential credentials and data to the secure element during the initial attach procedure before the user needs to use the service. The secure element receives and stores the necessary data (5G SUCI encryption keys, Ki, activation codes) in advance, enabling self-sufficiency during actual usage. This preliminary loading of data reduces the need for complex local storage solutions while maintaining ease of operation, as the secure element has all needed credentials readily available.
Solution Approach 2:
The patent extracts essential credentials and data from the server and transfers them to the secure element during the initial setup. By taking out the critical data (encryption keys, authentication parameters) and placing them in the secure element beforehand, the system enables the secure element to operate independently during service usage. This extraction approach reduces the need for continuous complex communication and storage solutions, achieving self-sufficiency with minimal ongoing complexity.
Data Source
AI summary
Provided is a method for sending data to a user equipment (10) cooperating with a secure element, said method comprising exchanging in signaling messages information between said secure element and a server acting as an AUSF/UDM in order to transmit to said secure element a temporary IMSI, wherein in consist in using the procedure for steering of user equipment in VPLMN during registration as defined by 3GPP TS 33.501 V17.5.0 (2022-03) entitled “3rd Generation Partnership Project, Technical Specification Group Services and System Aspects, Security architecture and procedures for 5G system (Release 17) in order to send from said server (11) to said secure element said data.