Securing user equipment identifier for use external to communication network

1. An apparatus comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:

receive, at a network entity of a core network of a communication system with which user equipment has a subscription, a request for identification information for the user equipment from an entity external to the communication system, the external entity comprising an application function outside the communication system, the application function being managed by a third party different than a network operator of the communication system with which the user equipment has the subscription;

generate, at the network entity of the core network of the communication system, a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment, the public subscription identifier being distinct from a corresponding subscription permanent identifier of the user equipment, wherein the encrypted form of the public subscription identifier associated with the user equipment is generated based at least in part on an identifier of the external entity, wherein the public subscription identifier comprises an external identifier that identifies a subscription associated to an International Mobile Subscriber Identity (IMSI), wherein the IMSI is a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN),

wherein generating the secure identifier for the user equipment further comprises:

generating a hash value by hashing the public subscription identifier with the identifier of the external entity and one or more of a time duration for which the secure identifier remains valid and a random number; and encrypting the hash value with a cryptographic key corresponding to a key identifier;

send, from the network entity of the core network of the communication system, the secure identifier to the external entity;

receive, at the network entity of the core network of the communication system, the secure identifier in a subsequent request from the external entity; and

utilize, at the network entity of the core network of the communication system, the received secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the apparatus sends the key identifier and time duration along with the secure identifier to the external entity,

wherein the apparatus receives the key identifier and time duration along with the secure identifier from the external entity together with the subsequent request,

wherein the apparatus utilizes the key identifier and time duration along with the secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the network entity of the core network of the communication system operates in:

a stateless manner by storing the cryptographic key corresponding to the key identifier; or a stateful manner by storing a mapping for the secure identifier comprising an association between the public subscription identifier, the identifier of the external entity, and the time duration, and wherein the network entity of the core network of the communication system comprises a network exposure function, and

wherein, in response to storing the mapping, the apparatus sends the secure identifier to the external entity, receives the secure identifier from the external entity in accordance with the subsequent request, and utilizes the received secure identifier to consult the mapping to confirm the received secure identifier corresponds to the user equipment.

2. The apparatus of claim 1 , wherein the communication system comprises a 5G communication system, and wherein the public subscription identifier comprises a Generic Public Subscription Identifier (GPSI).

3. The apparatus of claim 1 wherein the communication network comprises a 5G core network, and wherein the application function resides on a server which is part of an edge computing network external to the 5G core network.

4. A method comprising:

receiving, at a network entity of a core network of a communication system with which user equipment has a subscription, a request for identification information for the user equipment from an entity external to the communication system, the external entity comprising an application function outside the communication system, the application function being managed by a third party different than a network operator of the communication system with which the user equipment has the subscription;

generating, at the network entity of the core network of the communication system, a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment, the public subscription identifier being distinct from a corresponding subscription permanent identifier of the user equipment, wherein the encrypted form of the public subscription identifier associated with the user equipment is generated based at least in part on an identifier of the external entity wherein the public subscription identifier comprises an external identifier that identifies a subscription associated to an International Mobile Subscriber Identity (IMSI), wherein the IMSI is a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN),

wherein generating the secure identifier for the user equipment further comprises:

generating a hash value by hashing the public subscription identifier with the identifier of the external entity and one or more of a time duration for which the secure identifier remains valid and a random number; and encrypting the hash value with a cryptographic key corresponding to a key identifier;

sending, from the network entity of the core network of the communication system, the secure identifier to the external entity;

receiving, at the network entity of the core network of the communication system, the secure identifier in a subsequent request from the external entity; and

utilizing, at the network entity of the core network of the communication system, the received secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the user equipment sends the key identifier and time duration along with the secure identifier to the external entity,

wherein the user equipment receives the key identifier and time duration along with the secure identifier from the external entity together with the subsequent request,

wherein the user equipment utilizes the key identifier and time duration along with the secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the network entity of the core network of the communication system operates in:

a stateless manner by storing the cryptographic key corresponding to the key identifier; or a stateful manner by storing a mapping for the secure identifier comprising an association between the public subscription identifier, the identifier of the external entity, and the time duration, and wherein the network entity of the core network of the communication system comprises a network exposure function, and

wherein, in response to storing the mapping, the user equipment sends the secure identifier to the external entity, receives the secure identifier from the external entity in accordance with the subsequent request, and utilizes the received secure identifier to consult the mapping to confirm the received secure identifier corresponds to the user equipment.

5. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor to perform the steps of:

receiving, at a network entity of a core network of a communication system with which user equipment has a subscription, a request for identification information for the user equipment from an entity external to the communication system, the external entity comprising an application function outside the communication system, the application function being managed by a third party different than a network operator of the communication system with which the user equipment has the subscription;

generating, at the network entity of the core network of the communication system, a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment, the public subscription identifier being distinct from a corresponding subscription permanent identifier of the user equipment, wherein the encrypted form of the public subscription identifier associated with the user equipment is generated based at least in part on an identifier of the external entity wherein the public subscription identifier comprises an external identifier that identifies a subscription associated to an International Mobile Subscriber Identity (IMSI), wherein the IMSI is a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN),

wherein generating the secure identifier for the user equipment further comprises:

generating a hash value by hashing the public subscription identifier with the identifier of the external entity and one or more of a time duration for which the secure identifier remains valid and a random number; and

encrypting the hash value with a cryptographic key corresponding to a key identifier;

sending, from the network entity of the core network of the communication system, the secure identifier to the external entity;

receiving, at the network entity of the core network of the communication system, the secure identifier in a subsequent request from the external entity; and

utilizing, at the network entity of the core network of the communication system, the received secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the user equipment sends the key identifier and time duration along with the secure identifier to the external entity,

wherein the user equipment receives the key identifier and time duration along with the secure identifier from the external entity together with the subsequent request,

wherein the user equipment utilizes the key identifier and time duration along with the secure identifier to confirm the received secure identifier corresponds to the user equipment,

wherein the network entity of the core network of the communication system operates in:

a stateless manner by storing the cryptographic key corresponding to the key identifier, or a stateful manner by storing a mapping for the secure identifier comprising an association between the public subscription identifier, the identifier of the external entity, and the time duration, and wherein the network entity of the core network of the communication system comprises a network exposure function, and

wherein, in response to storing the mapping, the user equipment sends the secure identifier to the external entity, receives the secure identifier from the external entity in accordance with the subsequent request, and utilizes the received secure identifier to consult the mapping to confirm the received secure identifier corresponds to the user equipment.