Method for user identity protection

• US 6,373,949 B1
• Filed: 10/14/1999
• Issued: 04/16/2002
• Est. Priority Date: 04/16/1997
• Status: Expired due to Term

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Nokia Networks (Nokia Corporation)
• Inventors: Aura, Tuomas
• Primary Examiner(s): Chung, Phung M.
• Assistant Examiner(s): Callahan, Paul E.
• Application Number:
  US09/418,387
• Time in Patent Office: 915 Days
• Field of Search: 380/248, 380/250, 380/258, 380/259, 380/270, 380/271, 380/272, 380/44, 380/46, 455/410, 455/422, 455/432, 455/436, 455/437, 370/313
• US Class Current: 380/247
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

In the method in accordance with the present invention, the subscriber identifier to be sent to the transmission network is encrypted using a cipher key common to a specific group of subscribers, and a random number is attached to the identifier to be sent to the network. For example, a subscriber group may consist of the subscribers to a single given operator. The section of the identifier specifying the subscriber group is sent to the network in a non-encrypted format, in which case the network is able to direct the encrypted message to such a network element where it can be deciphered.

Claims

1. A method for protected transmission of user identity to the user'"'"'s home network in a data communications system that includes at least, subscribers each with a unique identifier and a home network, subscriber stations of the subscribers, at least one data communications network including network elements, and in which connections can be made between mobile stations and the data communications network, the method comprising:

dividing an identifier into a first and second section in such a way that the first section includes data necessary for identifying a subscriber group and the second section identifies a subscriber within the subscriber group

generating a random input at a subscriber station,

encrypting the second section of the subscriber'"'"'s identifier using the random input and a cipher key specific to each subscriber group,

sending a message to a network element of a data communications network, the message containing a partially encrypted identifier consisting of the first section and the encrypted second section and the random input used,

routing the message from the data communications network to the subscriber'"'"'s home network, and

deciphering the identifier in the subscriber'"'"'s home network.

2. The method in accordance with claim 1, where the subscriber identifier consists of a section specifying the subscriber'"'"'s home network and another section specifying the subscriber within the subscriber'"'"'s home network, wherein the group of subscribers consists of subscribers within a single home network and that the encrypted section of the identifier is that part of the identifier that determines the subscriber'"'"'s identity in the home network.

3. The method in accordance with claim 1, where the subscriber identifier consists of a section specifying one Home Location Register and another section specifying the subscriber within the Home Location Register, wherein the group of subscribers is a group within one Home Location Register and that the encrypted section of the identifier is that part of the identifier that determines the subscriber'"'"'s identity within the Home Location Register.

4. The method in accordance with claim 1, where the subscriber identifier consists of one section defining a group of subscribers within one Home Location Register and another section defining the subscriber within the subscriber group, wherein the subscriber group is a group of subscribers defined within one Home Location Register and that the encrypted section of the identifier is that part of the identifier that determines the subscriber'"'"'s identity within the subscriber group.

5. The method in accordance with claim 1, wherein the random input is specifically generated by means of a random number generator.

6. The method in accordance with claim 1, wherein for the random input, a random number already generated for the authentication process is used.

7. The method in accordance with claim 1, wherein the subscriber station is a mobile station operating in a mobile communications system and that the data communications network is a mobile communications network.