Identifier-based access control in mobile networks
A network terminal, e.g., LTE or 5G, can connect to a home network via a serving network. The terminal can have a terminal identifier (TID), such as an IMEI or other PEI, and a network subscriber can have a subscriber identifier (SID), such as an IMSI or other SUPI. In some nonlimiting examples, a network node can determine that a SID and a TID are authorized for joint use and, in response, transmit authorization information. In some nonlimiting examples, a network node can receive an attach request having verification data and encrypted identification data. The network node can receive decrypted identity data and determine that the identity data corresponds with the verification data. In some nonlimiting examples, the terminal can send an attach request comprising encrypted SID and TID data, and a cryptographic hash, to a network node.
1. A first network node associated with an access network, the first network node comprising:
a communications interface; and
a control unit configured to perform operations comprising:
receiving, from a network terminal, an attach request comprising identification data and verification data;
transmitting, to a second network node, the identification data;
receiving, from the second network node, identity data associated with the network terminal, wherein the identity data comprises at least one of a subscriber identifier (SID) and a terminal identifier (TID);
determining that the identity data corresponds with the verification data; and
in response, transmitting an authentication request to the network terminal.
2. The first network node according to claim 1 , wherein:
the identification data comprises encrypted data; and
the identity data comprises at least one of:
the SID including a Subscriber Permanent Identifier (SUPI); or
the TID including a Permanent Equipment Identifier (PEI).
3. The first network node according to claim 1 , wherein:
the verification data comprises a first cryptographic hash; and
the operations for determining comprise:
computing a second cryptographic hash of at least the identity data; and
determining that the second cryptographic hash matches the first cryptographic hash.
4. The first network node according to claim 3 , the operations further comprising:
receiving, from the second network node, a transaction-specific value (TSV) associated with the identification data; and
computing the second cryptographic hash further of at least the TSV.
5. The first network node according to claim 4 , the operations further comprising:
receiving, from the network terminal, second verification data;
receiving, from the second network node, second identity data associated with the network terminal; and
determining that the second identity data corresponds with the second verification data.
6. The first network node according to claim 5 , wherein:
the second verification data comprises a third cryptographic hash; and
the operations for determining that the second identity data corresponds with the second verification data comprise:
computing a fourth cryptographic hash of at least the second identity data; and
determining that the fourth cryptographic hash matches the third cryptographic hash.
7. The first network node according to claim 6 , the operations further comprising computing the fourth cryptographic hash further of at least the TSV.
8. The first network node according to claim 6 , the operations further comprising:
receiving, from the second network node, a second, different TSV associated with the second identity data; and
computing the fourth cryptographic hash further of at least the second TSV.
9. The first network node according to claim 4 , the operations further comprising:
receiving, from the second network node, second identity data associated with the network terminal; and
computing the second cryptographic hash further of at least the second identity data.
10. A system, comprising:
an access-network node associated with an access network, the access-network node comprising:
a first communications interface; and
a first control unit configured to perform first operations comprising:
receiving, from a network terminal, an attach request comprising identification data and verification data;
transmitting, to a second network node, the identification data;
receiving, from the second network node, identity data associated with the network terminal, wherein the identity data comprises at least one of a subscriber identifier (SID) and a terminal identifier (TID);
determining that the identity data corresponds with the verification data; and
in response, transmitting an authentication request to the network terminal.