UICC SUCI Generation via Pre-computed ECC Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The processing time for ECC key pair generation and ECDH Ephemeral key derivation in 5G UICC is considerable, making it challenging for hardware chips with moderate performance to meet the requirement of outputting the SUCI within a preset timeframe after receiving the GET IDENTITY command.
Innovation Solution
Triggering the generation of ECC public/private key pairs and ECDH Ephemeral shared keys by a deterministic event instead of directly by the GET IDENTITY command, allowing these keys to be pre-generated and stored in the UICC's key memory, which can then be retrieved quickly when needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ECC key pair generation and ECDH Ephemeral key derivation are performed directly upon receiving the GET IDENTITY command, then the SUCI can be generated with current security requirements, but the processing time becomes considerable and exceeds the preset timeframe for hardware chips with moderate performance
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing ECC public/private key pairs and ECDH Ephemeral shared keys in the UICC's key memory before the GET IDENTITY command is received. This allows the heavy cryptographic operations to be performed in advance, so that when the command arrives, only lightweight operations are needed to retrieve and use the pre-computed keys, thereby reducing processing time while maintaining security requirements.
2Reliability
If ECC key pair generation and ECDH Ephemeral key derivation are performed directly upon receiving the GET IDENTITY command, then the SUCI can be generated with current security requirements, but the hardware chip performance requirement becomes high and is not easily fulfillable for chips with moderate performance
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing ECC public/private key pairs and ECDH Ephemeral shared keys in the UICC's key memory before the GET IDENTITY command is received. This allows the heavy cryptographic operations to be performed in advance, so that when the command arrives, only lightweight operations are needed to retrieve and use the pre-computed keys, thereby reducing processing time while maintaining security requirements.
3Productivity
If the SUCI generation is performed quickly to meet preset timeframe requirements, then the hardware chip with moderate performance can fulfill the requirement, but the processing time for ECC key pair generation and ECDH Ephemeral key derivation becomes a challenge
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing ECC public/private key pairs and ECDH Ephemeral shared keys in the UICC's key memory before the GET IDENTITY command is received. This allows the heavy cryptographic operations to be performed in advance, so that when the command arrives, only lightweight operations are needed to retrieve and use the pre-computed keys, thereby reducing processing time while maintaining security requirements.
Data Source
AI summary
A method is for generating, in a UICC, a 5G subscriber concealed identifier, SUCI, for a 5G mobile communication network. The method includes the steps executed in a processing entity comprised in the UICC: (1) generation of a public/private key pair or an ECC public/private key pair; (2) DH or ECDH derivation of an Ephemeral shared key from the generated or ECC public/private key pair; (3) derivation of a symmetric encryption key from the Ephemeral shared key; (4) concealment of at least a part of a subscriber permanent identifier, SUPI, with the generated symmetric key to compute the SUCI. Steps (1, 2) are triggered by a deterministic event at the UICC, and storing the generated or ECC public/private key pair and Ephemeral shared key to a key memory provided in the UICC; and subsequently steps (3, 4) are triggered by receipt of a GET IDENTITY command.