Subscriber service validation using SUCI cleartext
Subscriber service validation using subscription concealed identifier (SUCI) cleartext is disclosed. When a user equipment (UE) attempts to register with a wireless network, it sends its SUCI which has an encrypted subscription permanent identifier (SUPI), but also a routing indicator in cleartext (unencrypted). This is available to the base station. By formulating a list of routing indicators associated with roaming partners (along with its own routing indicator), the base station is able to identify UEs that should be approved for registration. This precludes the need for the access and mobility function (AMF) to involve the authentication server function (AUSF) and unified data management (UDM) in decrypting the SUPI for unauthorized UEs, thereby reducing network traffic. Identification of the public key, associated with the private key used to encrypt the SUPI, is also within the SUCI in cleartext, and so may be used in place of the routing indicator.
1 . A method of wireless communication, the method comprising:
receiving, by a cellular base station in a wireless network, a subscription concealed identifier (SUCI) from a user equipment (UE), the SUCI including an encrypted subscription permanent identifier (SUPI) and a routing indicator;
determining, by the cellular base station, that the routing indicator is on a list of approved UE routing indicators; and
registering the UE with the wireless network, without decrypting the encrypted SUPI, based on the routing indicator being on the list of approved UE routing indicators.
2 . The method of claim 1 , further comprising:
based on at least registering the UE with the wireless network, hosting a protocol data unit (PDU) session for the UE.
3 . A system comprising:
a processor; and
a computer-readable medium storing programming instructions for execution by the processor, the programming instructions, upon execution by the processor, causing the system to perform the following operations:
receiving, by a cellular base station in a wireless network, a subscription concealed identifier (SUCI) from a user equipment (UE), the SUCI including an encrypted subscription permanent identifier (SUPI) and a routing indicator;
determining, by the cellular base station, that the routing indicator is on a list of approved UE routing indicators; and
registering the UE with the wireless network, without decrypting the encrypted SUPI, based on the routing indicator being on the list of approved UE routing indicators.
4 . The system of claim 3 , wherein the programming instructions further cause the system to perform the following operations:
based on at least registering the UE with the wireless network, host a protocol data unit (PDU) session for the UE.
5 . One or more computer storage devices having programming instructions stored thereon, which, upon execution by a processor of a system computer, cause the system to perform the following operations:
receiving, by a cellular base station in a wireless network, a subscription concealed identifier (SUCI) from a user equipment (UE), the SUCI including an encrypted subscription permanent identifier (SUPI) and a routing indicator;
determining, by the cellular base station, that the routing indicator is on a list of approved UE routing indicators; and
registering the UE with the wireless network, without decrypting the encrypted SUPI, based on the routing indicator being on the list of approved UE routing indicators.
6 . The one or more computer storage devices of claim 5 , wherein the programming instructions further cause the system to perform the following operations:
based on at least registering the UE with the wireless network, hosting a protocol data unit (PDU) session for the UE.
7 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the encrypted SUPI to a unified data management (UDM) of the wireless network.
8 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the encrypted SUPI to an authentication server function (AUSF) of the wireless network.
9 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the encrypted SUPI to a mobility device of the wireless network.
10 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the encrypted SUPI to an access and mobility function (AMF) of the wireless network.
11 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the SUCI to a unified data management (UDM) of the wireless network.
12 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the SUCI to an authentication server function (AUSF) of the wireless network.
13 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the SUCI to a mobility device of the wireless network.
14 . The method of claim 1 , wherein the UE is registered with the wireless network without forwarding the SUCI to an access and mobility function (AMF) of the wireless network.
15 . The method of claim 1 , wherein the list of approved UE routing indicators include routing indicators assigned to home subscriber UEs of the wireless network.
16 . The method of claim 15 , wherein the list of approved UE routing indicators further includes routing indicators assigned to roaming partner UEs of the wireless network.