Encrypting network slice credentials using a public key

1. A user equipment (UE) apparatus comprising:

a processor that: registers with a mobile communication network using a first set of credentials, the mobile communication network supporting a plurality of network slices;

receives a third-party public key of a third-party authentication service provider for a network slice where slice-specific authentication is required;

encrypts a second set of credentials to conceal a user ID for the UE using a nonce generated for freshness in concealing the user ID and using the third-party public key, wherein the user ID in the second set of credentials is not decryptable except by the slice authentication server operated by the third-party service provider and is used for authentication with the network slice; and

a transceiver that sends a message to the mobile communication network, wherein the message includes the encrypted second set of credentials.

2. The apparatus of claim 1 , wherein the nonce used with the third-party public key to encrypt the second set of credentials is generated by the UE.

3. The apparatus of claim 2 , wherein the message to the mobile communication network includes the nonce.

4. The apparatus of claim 1 , wherein the message to the mobile communication network initiates slice-specific authentication of the apparatus.

5. A method for a user-equipment (UE) comprising:

registering with a mobile communication network using a first set of credentials, the mobile communication network supporting a plurality of network slices;

receiving a third-party public key of a third-party authentication service provider for a network slice where slice-specific authentication is required;

encrypting a second set of credentials comprising a user ID for the apparatus using a nonce generated for freshness in concealing the user ID and using the public key, wherein the user ID for the UE in the second set of credentials is not decryptable except by the slice authentication server operated by the third-party service provider and is used for authentication with the network slice; and

sending a message to the mobile communication network, wherein the message includes the encrypted second set of credentials.

6. A network function apparatus comprising:

a transceiver that receives a registration request from a user equipment device (“UE”), wherein the UE registers with a mobile communication network using a first set of credentials; and

a processor that: retrieves a third-party public key of a third-party authentication service provider for a network slice where slice-specific authentication is required;

encrypts a second set of credentials to conceal a user ID for the UE using a nonce generated for freshness in conceal the user ID and using the third-party public key, wherein the user ID in the second set of credentials is not decryptable except by the slice authentication server operated by the third-party service provider and is used for authentication with the network slice; and

sends a message to the slice authentication server, wherein the message includes the encrypted second set of credentials.

7. The apparatus of claim 6 , wherein the first set of credentials is received from a Unified Data Management function (“UDM”).

8. The apparatus of claim 7 , wherein the first set of credentials is received together with subscription data of the UE.

9. The apparatus of claim 6 , wherein the second set of credentials is received from the UE.

10. The apparatus of claim 6 , wherein the message to the slice authentication server operated by the third-party provider includes the nonce.

11. The apparatus of claim 6 , wherein the processor checks subscription data of the UE in response to the registration request, wherein the third-party public key is stored with the subscription data.

12. The apparatus of claim 6 , wherein the message to the slice authentication server operated by the third-party provider initiates slice-specific authentication of the UE.

13. A network function method comprising:

receiving a registration request from a user equipment device (“UE”), wherein the UE registers with a mobile communication network using a first set of credentials;

retrieving a third-party public key of a third-party authentication service provider for a network slice where slice-specific authentication is required;

encrypting a second set of credentials for concealing a user ID of the UE using a nonce generated for freshness in concealing the user ID and using the third-party public key that is not decryptable except by the slice authentication server operated by the third-party service provider, the second set of credentials used for authentication with the network slice; and

sending a message to an authentication server, wherein the message includes the encrypted second set of credentials.

14. The method of claim 13 , wherein the first set of credentials is received from a Unified Data Management function (“UDM”), wherein the first set of credentials is received together with subscription data of the UE.

15. The method of claim 13 , further comprising checking subscription data of the UE in response to the registration request, wherein the third-party public key is stored with the subscription data.

16. An apparatus for a Unified Data Management function (“UDM”) comprising:

a processor that provides network exposure services to a third-party service provider, the third-party service provider operating a slice authentication server; and

a transceiver that receives a first set of credentials from the third-party service provider, the first set of credentials comprising a third-party public key for a network slice where slice-specific authentication is required,

wherein the processor provisions the third-party public key that is not decryptable except by the slice authentication server operated by the third-party service provider to an Access and Mobility Management Function (“AMY”) as part of subscription data, wherein the subscription includes the network slice.

17. The apparatus of claim 16 , wherein the first set of credentials is received via a network exposure function (“NEF”).

18. A method for a Unified Data Management (“UDM”) function comprising:

providing network exposure services to a third-party service provider, the third-party service provider operating a slice authentication server;

receiving a first set of credentials from the third-party service provider, the first set of credentials comprising a third-party public key for a network slice where slice-specific authentication is required; and

provisioning the third-party public key that is not decryptable except by the slice authentication server operated by the third-party service provider to an Access and Mobility Management Function (“AMF”) as part of subscription data, wherein the subscription includes the network slice.