Subscription identifier concealment in a communication network

1 . A method performed by communication equipment, the method comprising:

generating an inner subscription concealed identifier, generating the inner subscription concealed identifier including concealing at least a part of a subscription identifier using cryptographic key material associated with a first communication network, the subscription identifier identifying a subscription to the first communication network, the inner subscription concealed identifier comprising a first inner field and a second inner field, the first inner field identifying the first communication network and not concealed using the cryptographic key material associated with the first communication network, and the second inner field including the at least a part of the subscription identifier as concealed using the cryptographic key material associated with the first communication network;

generating an outer subscription concealed identifier, generating the outer subscription concealed identifier including concealing the inner subscription concealed identifier using cryptographic key material associated with a second communication network; and

transmitting the outer subscription concealed identifier.

2 . The method of claim 1 , wherein the outer subscription concealed identifier comprises a first outer field and a second outer field, wherein the first outer field identifies the second communication network and is not concealed using the cryptographic key material associated with the second communication network, and wherein the second outer field includes the inner subscription concealed identifier and is concealed using the cryptographic key material associated with the second communication network.

3 . The method of claim 1 , wherein the cryptographic key material associated with the first communication network is a public and private key pair associated with the first communication network, and/or wherein the cryptographic key material associated with the second communication network is a public and private key pair associated with the second communication network.

4 . The method of claim 1 , wherein the second communication network provides an access network for the first communication network.

5 . The method of claim 1 , wherein transmitting the outer subscription concealed identifier comprises transmitting the outer subscription concealed identifier from the communication equipment to a visited network, wherein the visited network is different from the second communication network.

6 . The method of claim 1 , wherein the communication equipment comprises an integrated circuit card, and wherein transmitting the outer subscription concealed identifier comprises transmitting the outer subscription concealed identifier from the integrated circuit card to a mobile equipment, wherein the integrated circuit card is either embedded or integrated within the mobile equipment or is configured to be removably inserted into the mobile equipment.

7 . The method of claim 1 , further comprising performing a procedure for registering with and/or authenticating with the first communication network via the second communication network and via a visited network different than the second communication network, wherein transmitting the outer subscription concealed identifier is performed as part of the procedure.

8 . The method of claim 1 , further comprising scanning for the second communication network and/or any allowed visited network included in a list of one or more allowed visited networks, wherein each of the one or more allowed visited networks is a roaming partner of the second communication network.

9 . A method performed by a network node, the method comprising:

receiving an outer subscription concealed identifier that conceals an inner subscription concealed identifier;

obtaining the inner subscription concealed identifier by de-concealing the outer subscription concealed identifier, the inner subscription concealed identifier concealing at least a part of a subscription identifier which identifies a subscription to a first communication network, the network node a network node in a second communication network, the inner subscription concealed identifier comprising a first inner field and a second inner field, the first inner field identifying the first communication network and not concealed, and the second inner field including the at least a part of the subscription identifier as concealed; and

transmitting the inner subscription concealed identifier to the first communication network.

10 . The method of claim 9 , wherein the outer subscription concealed identifier is received from a visited network that is different than the second communication network.

11 . The method of claim 9 , wherein the outer subscription concealed identifier is received from a communication device.

12 . The method of claim 9 , wherein said obtaining comprises obtaining the inner subscription concealed identifier by de-concealing the outer subscription concealed identifier using cryptographic key material associated with the second communication network.

13 . The method of claim 9 , wherein said obtaining is performed based on the outer subscription concealed identifier indicating that the outer subscription concealed identifier conceals a subscription identifier which identifies a subscription to the second communication network, and wherein said transmitting is performed based on the inner subscription concealed identifier indicating that the inner subscription concealed identifier conceals a subscription identifier which identifies a subscription to the first communication network.

14 . The method of claim 9 , wherein the outer subscription concealed identifier comprises a first outer field and a second outer field, wherein the first outer field identifies the second communication network and is not concealed, and wherein the second outer field includes the inner subscription concealed identifier and is concealed.

15 . The method of claim 9 , wherein the outer subscription concealed identifier is received in a message as part of a procedure for communication equipment to register with and/or authenticate with the first communication network via the second communication network, and wherein said transmitting comprises forwarding the message to the first communication network with the inner subscription concealed identifier in place of the outer subscription concealed identifier.

16 . The method of claim 9 , wherein the second communication network provides an access network for the first communication network.

17 . Communication equipment comprising:

communication circuitry; and

processing circuitry configured to:

generate an inner subscription concealed identifier, wherein generating the inner subscription concealed identifier includes concealing at least a part of a subscription identifier using cryptographic key material associated with a first communication network, wherein the subscription identifier identifies a subscription to the first communication network, the inner subscription concealed identifier comprising a first inner field and a second inner field, the first inner field identifying the first communication network and not concealed using the cryptographic key material associated with the first communication network, and the second inner field including the at least a part of the subscription identifier as concealed using the cryptographic key material associated with the first communication network;

generate an outer subscription concealed identifier, generating the outer subscription concealed identifier including concealing the inner subscription concealed identifier using cryptographic key material associated with a second communication network; and

transmit the outer subscription concealed identifier.

18 . A network node, the network node comprising:

communication circuitry; and

processing circuitry configured to:

receive an outer subscription concealed identifier that conceals an inner subscription concealed identifier;

obtain the inner subscription concealed identifier by de-concealing the outer subscription concealed identifier, the inner subscription concealed identifier concealing at least a part of a subscription identifier which identifies a subscription to a first communication network, the network node a network node in a second communication network, the inner subscription concealed identifier comprising a first inner field and a second inner field, the first inner field identifying the first communication network and not concealed, and the second inner field including the at least a part of the subscription identifier as concealed; and

transmit the inner subscription concealed identifier to the first communication network.