Open access network secure authentication systems and methods

A system for authenticating an end-user device to receive services provided by a service provider prior to establishing a connection between the end-user device and the service provider over an open access network, comprising:

• (1) a network operator authentication server (NOAS) that is configured to:
• receive credentials from a virtual subscriber ID manager (V-SIM manager), the credentials including a user ID associated with an end-user device and a provider ID of a particular service provider of a plurality of service providers that provide services over the open access network, the credentials being received before a logical network connection exists between the end-user device and the particular service provider within the open access network, the credentials representing a request from the end-user device to establish the logical network connection to thereby allow the end-user device to receive services provided by the particular service provider via the logical network connection;
• send the user ID to a service provider authentication server (SPAS) that is associated with the provider ID;
• receive an authentication vector from the SPAS, the authentication vector including a challenge and an expected response;
• and
• forward the challenge to the V-SIM manager;
• and
• (2) the V-SIM manager that is configured to:
• identify a service provider profile that is associated with the provider ID and employ the service provider profile to generate a response to the challenge;
• wherein, the NOAS is further configured to:
• receive the response to the challenge and compare the response to the expected response that was defined in the authentication vector;
• upon determining that the response matches the expected response, obtain a transaction ID to represent a logical network connection over the open access network;
• and
• send the transaction ID to the particular service provider to allow the particular service provider to request the establishment of the logical network connection between the end-user device and the particular service provider such that the logical network connection between the end-user device and the particular service provider is not established in the open access network until after the end-user device has been authenticated to receive services provided by the particular service provider.

One or more non-transitory computer storage media storing computer executable instructions which when executed in an open access network perform a method for authenticating an end-user device to receive services provided by a service provider prior to establishing a logical network connection between the end-user device and the service provider over the open access network, comprising:

• receiving, at a network operator authentication server (NOAS), credentials from a virtual subscriber ID manager (V-SIM manager), the credentials including a user ID associated with an end-user device and a provider ID of a first service provider of a plurality of service providers that provide services over the open access network, the credentials being received before a logical network connection exists between the end-user device and the first service provider within the open access network, the credentials representing a request from the end-user device to establish the logical network connection to thereby allow the end-user device to receive services provided by the first service provider via the logical network connection;
• sending the user ID to a service provider authentication server (SPAS) that is associated with the provider ID;
• receiving, at the NOAS, an authentication vector from the SPAS, the authentication vector including a challenge and an expected response;
• forwarding the challenge to the V-SIM manager;
• identifying, by the V-SIM manager, a service provider profile that is associated with the provider ID and employing the service provider profile to generate a response to the challenge;
• receiving, at the NOAS, the response to the challenge and comparing the response to the expected response that was defined in the authentication vector;
• upon determining that the response matches the expected response, obtaining a transaction ID to represent a logical network connection over the open access network;
• and
• sending the transaction ID to the first service provider to allow the first service provider to request the establishment of the logical network connection between the end-user device and the first service provider such that the logical network connection between the end-user device and the first service provider is not established in the open access network until after the end-user device has been authenticated to receive services provided by the first service provider.