Subscriber identity privacy
A 5 th -Generation (5G) cellular communication device may at times be used with a legacy subscriber identifier module (SIM) that does not support 5G subscriber identity privacy features. To obtain a subscriber identifier for authentication, the device attempts to obtain or generate a concealed subscriber identifier with the support of the current SIM. If this is not possible, as may be the case with legacy, non-5G SIMs, the device determines whether the home network specified by the SIM is the network of the provisioning operator. If so, the device obtains an unconcealed subscriber identifier from the SIM, encrypts it with the provisioned home network key, and uses the resulting concealed subscriber identifier for authentication. If the home network specified by the SIM is a network other than that of the provisioning network operator, the device obtains the unconcealed subscriber identifier from the SIM and uses it for authentication.
1. A method performed by a cellular communication device with a first subscriber identity module (SIM) that specifies a first home network and an unconcealed first subscriber identifier, the method comprising:
determining that (a) a concealed first subscriber identifier is unavailable from the first SIM and (b) no encryption key for encrypting the unconcealed first subscriber identifier is available from the first SIM;
determining that a home network key of the first home network is stored in a memory of the cellular communication device;
obtaining the unconcealed first subscriber identifier from the first SIM;
obtaining the home network key of the first home network from the memory of the cellular communication device;
encrypting the unconcealed first subscriber identifier using the home network key of the first home network to create the concealed first subscriber identifier;
sending the concealed first subscriber identifier for authentication by the first home network;
determining that (c) a concealed second subscriber identifier is unavailable from a second SIM that specifies a second home network and an unconcealed second subscriber identifier and (d) no encryption key for encrypting the unconcealed second subscriber identifier is available from the second SIM;
determining that a home network key of the second home network is stored in the memory of the cellular communication device;
obtaining the unconcealed second subscriber identifier from the second SIM;
encrypting the unconcealed second subscriber identifier using the home network key of the second home network to create the concealed second subscriber identifier; and
sending the concealed second subscriber identifier for authentication by the second home network.
2. The method of claim 1 , wherein the home network key is a private cryptographic key of an asymmetrical cryptographic key pair.
3. The method of claim 1 , wherein the home network key of the first home network is stored in the memory of the cellular communication device during provisioning of the cellular communication device.
4. The method of claim 3 , wherein the provisioning of the cellular communication device is performed:
in response to the cellular communication device connecting to the first home network for a first time;
prior to a sale of the cellular communication device; or
during the sale of the cellular communication device.
5. The method of claim 1 , wherein the unconcealed first subscriber identifier comprises an international mobile subscription identity (IMSI) number.
6. The method of claim 1 , wherein the unconcealed first subscriber identifier comprises a subscription permanent identifier (SUPI).
7. The method of claim 1 , wherein the encrypting creates a subscription concealed identifier (SUCI) of a 5 th -Generation (5G) cellular communication network.
8. The method of claim 1 , wherein:
the home network key of the first home network is provisioned in the memory of the cellular communication device by a network operator of the first home network; and
determining that the home network key of the first home network is stored in the memory of the cellular communication device comprises determining that the cellular communication device was provisioned by the network operator of the first home network.
9. A method performed by a cellular communication device with a first subscriber information module (SIM) that specifies a first home network and an unconcealed first subscriber identifier, the method comprising:
determining that (a) a concealed first subscriber identifier is unavailable from the first SIM and (b) no encryption key for encrypting the unconcealed first subscriber identifier is available from the first SIM;
determining that a home network key of the first home network is not stored in a memory of the cellular communication device;
in response to determining that the home network key of the first home network is not stored in the memory of the cellular communication device, sending the unconcealed first subscriber identifier for authentication by the first home network;
determining that (c) a concealed second subscriber identifier is unavailable from a second SIM that specifies a second home network and an unconcealed second subscriber identifier and (d) no encryption key for encrypting the unconcealed second subscriber identifier is available from the second SIM;
determining that a home network key of the second home network is stored in the memory of the cellular communication device;
obtaining the unconcealed second subscriber identifier from the second SIM;
encrypting the unconcealed second subscriber identifier using the home network key of the second home network to create the concealed second subscriber identifier; and
sending the concealed second subscriber identifier for authentication by the second home network.
10. The method of claim 9 , wherein the unconcealed first subscriber identifier comprises an international mobile subscription identity (IMSI) number.
11. The method of claim 9 , wherein the unconcealed first subscriber identifier comprises a subscription permanent identifier (SUPI).
12. The method of claim 9 , wherein the home network key of the first home network is stored in the memory of the cellular communication device during provisioning of the cellular communication device.
13. A cellular communication device comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
determining that (a) a concealed first subscriber identifier is unavailable from a first subscriber information module (SIM) and (b) no encryption key for encrypting an unconcealed first subscriber identifier is available from the first SIM;
determining that (c) the first SIM specifies a first home network and (d) a home network key of the first home network is stored by the one or more non-transitory computer-readable media;
obtaining the unconcealed first subscriber identifier from the first SIM;
obtaining the home network key of the first home network from the one or more non-transitory computer-readable media;
encrypting the unconcealed first subscriber identifier using the home network key of the first home network to create the concealed first subscriber identifier;
sending the concealed first subscriber identifier for authentication by the first home network;
determining that (e) a concealed second subscriber identifier is unavailable from a second SIM that specifies a second home network and an unconcealed second subscriber identifier and (f) no encryption key for encrypting the unconcealed second subscriber identifier is available from the second SIM;
determining that a home network key of the second home network is stored by the one or more non-transitory computer-readable media;
obtaining the unconcealed second subscriber identifier from the second SIM;
encrypting the unconcealed second subscriber identifier using the home network key of the second home network to create the concealed second subscriber identifier; and
sending the concealed second subscriber identifier for authentication by the second home network.
14. The cellular communication device of claim 13 , wherein the home network key is a private cryptographic key of an asymmetrical cryptographic key pair or a symmetrical cryptographic key pair.
15. The cellular communication device of claim 13 , wherein the unconcealed first subscriber identifier comprises an international mobile subscription identity (IMSI) number.
16. The cellular communication device of claim 13 , wherein the unconcealed first subscriber identifier comprises a subscription permanent identifier (SUPI).
17. The cellular communication device of claim 13 , wherein the encrypting creates a subscription concealed identifier (SUCI) of a 5 th -Generation (5G) cellular communication network.
18. The cellular communication device of claim 13 , wherein the home network key of the first home network is stored by the one or more non-transitory computer-readable media during provisioning of the cellular communication device.
19. The cellular communication device of claim 13 , wherein:
the home network key of the first home network is provisioned in the one or more non-transitory computer-readable media by a network operator of the first home network; and
determining that the home network key of the first home network is stored by the one or more non-transitory computer-readable media comprises determining that the cellular communication device was provisioned by the network operator of the first home network.