Method and device for protecting privacy in wireless communication system

1 . A method performed by a first network entity in a wireless communication system, the method comprising:

receiving, from a second network entity, an authentication acquisition response message including a subscription permanent identifier (SUPI) of a user equipment (UE);

generating a temporary identifier for the UE based on the SUPI; and

transmitting, to a third network entity, an authentication response message including the temporary identifier,

wherein the temporary identifier includes a random variable which is generated as based on the SUPI,

wherein the first network entity and the second network entity are included in a home public land mobile network (HPLMN), and

wherein the third network entity is included in a visited public land mobile network (VPLMN).

2 . The method of claim 1 ,

wherein the temporary identifier includes a mobile country code (MCC) field and a mobile network code (MNC) field,

wherein the random variable is generated by a Hash function, and

wherein a number of digits for the random variable is set to a predetermined number of digits.

3 . The method of claim 1 ,

wherein the temporary identifier includes at least one of a region identifier field for a fourth network entity, a set identifier field for the fourth network entity, an identifier field of the fourth network entity, or a variable field,

wherein the variable field is generated by a Hash function or as a random variable, and

wherein the fourth network entity includes an access and mobility management function (AMF) entity or a security anchor function (SEAF) entity.

4 . The method of claim 1 ,

wherein the first network entity includes an authentication server function (AUSF) entity,

wherein the second network entity includes a unified data manager (UDM) entity, and

wherein the third network entity includes a security anchor function (SEAF) entity.

5 . The method of claim 1 , further comprising:

generating authentication information based on the temporary identifier;

performing authentication based on the temporary identifier;

generating an authentication key based on the temporary identifier and the authentication information; and

transmitting, to the third network entity, the generated authentication key.

6 . A method performed by a second network entity in a wireless communication system, the method comprising:

receiving, from a first network entity, an authentication acquisition request message including a subscription concealed identifier (SUCI) of a user equipment (UE);

identifying a subscription permanent identifier (SUPI) by de-concealing the SUCI;

generating a temporary identifier for the UE based on the SUPI, the temporary identifier being configured for generating an authentication key in a third network entity; and

transmitting, to the first network entity, an authentication acquisition response message including the temporary identifier,

wherein the temporary identifier includes a random variable which is generated based on the SUPI,

wherein the first network entity and the second network entity are included in a home public land mobile network (HPLMN), and

wherein the third network entity is included in a visited public land mobile network (VPLMN).

7 . The method of claim 6 ,

wherein the temporary identifier includes a mobile country code (MCC) field and a mobile network code (MNC) field,

wherein the random variable is generated by a Hash function, and

wherein a number of digits for the random variable is set to a predetermined number of digits.

8 . The method of claim 6 ,

wherein the temporary identifier includes at least one of a region identifier field for a fourth network entity, a set identifier field for the fourth network entity, an identifier field of the fourth network entity, or a variable field,

wherein the variable field is generated by a Hash function or as a random variable, and

wherein the fourth network entity is an access and mobility management function (AMF) entity or a security anchor function (SEAF) entity.

9 . The method of claim 6 ,

wherein the first network entity includes an authentication server function (AUSF) entity, and

wherein the second network entity includes a unified data manager (UDM) entity.

10 . The method of claim 6 , further comprising:

generating authentication information based on the temporary identifier;

performing authentication based on the temporary identifier;

generating an authentication key based on the temporary identifier and the authentication information; and

transmitting, to the first network entity, the generated authentication key.

11 . A first network entity in a wireless communication system, the first network entity comprising:

a transceiver; and

at least one processor coupled to the transceiver and configured to:

receive, from a second network entity, an authentication acquisition response message including a subscription permanent identifier (SUPI) of a user equipment (UE),

generate a temporary identifier for the UE based on the SUPI, and

transmit, to a third network entity, an authentication response message including the temporary identifier,

wherein the temporary identifier includes a random variable which is generated based on the SUPI,

wherein the first network entity and the second network entity are included in a home public land mobile network (HPLMN), and

wherein the third network entity is included in a visited public land mobile network (VPLMN).

12 . The first network entity of claim 11 ,

wherein the temporary identifier includes a mobile country code (MCC) field and a mobile network code (MNC) field,

wherein the random variable is generated by a Hash function, and

wherein a number of digits for the random variable is set to a predetermined number of digits.

13 . The first network entity of claim 11 ,

wherein the temporary identifier includes at least one of a region identifier field for a fourth network entity, a set identifier field for the fourth network entity, or an identifier field of the fourth network entity,

wherein the random variable is generated by a Hash function or as a random variable, and

wherein the fourth network entity is an access and mobility management function (AMF) entity or a security anchor function (SEAF) entity.

14 . The first network entity of claim 11 ,

wherein the first network entity includes an authentication server function (AUSF) entity,

wherein the second network entity includes a unified data manager (UDM) entity, and

wherein the third network entity includes a security anchor function (SEAF) entity.

15 . The first network entity of claim 11 , wherein the at least one processor is further configured to:

generate authentication information based on the temporary identifier,

perform authentication based on the temporary identifier,

generate an authentication key based on the temporary identifier and the authentication information, and

transmit, to the third network entity, the generated authentication key.

16 . A second network entity in a wireless communication system, comprising:

a transceiver; and

at least one processor coupled to the transceiver and configured to:

receive, from a first network entity, an authentication acquisition request message including a subscription concealed identifier (SUCI) of a user equipment (UE),

identify a subscription permanent identifier (SUPI) by de-concealing the SUCI,

generate a temporary identifier for the UE based on the SUPI, the temporary identifier being configured for generating an authentication key in a third network entity, and

transmit, to the first network entity, an authentication acquisition response message including the temporary identifier,

wherein the temporary identifier includes a random variable which is generated based on the SUPI,

wherein the first network entity and the second network entity are included in a home public land mobile network (HPLMN), and

wherein the third network entity is included in a visited public land mobile network (VPLMN).

17 . The second network entity of claim 16 ,

wherein the temporary identifier includes a mobile country code (MCC) field and a mobile network code (MNC) field,

wherein the random variable is generated by a Hash function, and

wherein a number of digits for the random variable is set to a predetermined number of digits.

18 . The second network entity of claim 16 ,

wherein the temporary identifier includes at least one of a region identifier field for a fourth network entity, a set identifier field for the fourth network entity, or an identifier field of the fourth network entity,

wherein the variable field is generated by a Hash function or as a random variable, and

wherein the fourth network entity is an access and mobility management function (AMF) entity or a security anchor function (SEAF) entity.

19 . The second network entity of claim 16 ,

wherein the first network entity includes an authentication server function (AUSF) entity, and

wherein the second network entity includes a unified data manager (UDM) entity.

20 . The second network entity of claim 16 , wherein the at least one processor is further configured to:

generate authentication information based on the temporary identifier,

perform authentication based on the temporary identifier,

generate an authentication key based on the temporary identifier and the authentication information, and

transmit, to the first network entity, the generated authentication key.