# US 10,455,385 B2 · Provisioning a network subscription > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,455,385 B2 - Document ID: US10455385B2 - Status: Granted - Kind: B2 - Application number: 15/304,404 - Filed: 2015-04-14 - Published: 2017-02-09 - Granted: 2019-10-22 - Earliest claimed: 2014-04-15 - Assignees: Vodafone IP Licensing Limited - Applicants: Vodafone IP Licensing Limited - Inventors: Stephen Babbage; Nicholas Bone; Christopher Pudney; Aguibou Mountaga Barry - Web page: https://patentgrep.com/patent/US10455385B2 ## CPC - H04W 4/50: Service provisioning or reconfiguring - G06F 21/313: {using a call-back technique via a telephone network} - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 8/205: {Transfer to or from user equipment or user record carrier} - H04W 12/06: Authentication - H04W 12/08: Access security - G06F 2221/2117: User registration - H04W 12/75: Temporary identity - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Provisioning a subscriber in a network is provided by: receiving an initialisation request for access to a network on behalf of a subscriber, at an admission platform of a network operator associated with the subscriber, and assigning the subscriber limited access rights to the network, the limited access rights being configured for communication between the subscriber and a subscription manager, for reconfiguration of identity information associated with the subscriber. ## Claims ### Claim 1 A method for provisioning a subscriber in a network, comprising the steps of: receiving an initialisation request for access to a network on behalf of a subscriber linked to a subscription unit, at an admission platform of a network operator associated with the subscriber, the initialisation request indicating a subscriber identity and relating to a Visited Public Land Mobile Network (PLMN), wherein the admission platform is part of a Home PLMN of the subscriber; and assigning the subscriber limited access rights to the network in response to the received initialisation request, the limited access rights being configured for communication between the subscriber and at least one subscription manager, for reconfiguration of identity information associated with the subscriber, wherein the step of assigning the subscriber limited access rights comprises: creating an authentication vector that is generated using a placeholder authentication key in place of a real authentication key, the placeholder authentication key being either a fixed key or deterministically derived from values associated with a device of the subscriber; and communicating a location update acknowledgement message from the admission platform to the Visited PLMN subsequent to a location update message from the Visited PLMN, the location update acknowledgement message being transmitted using the placeholder authentication key and comprising an access instruction to the Visited PLMN to provide the subscriber with the limited access rights, wherein the access instruction comprises an indication of at least one Access Point Name (APN) and an instruction that the subscriber cannot obtain access other than through the indicated at least one APN, and wherein the at least one APN provides access only to the at least one subscription manager through a communication channel between the subscriber and the at least one subscription manager such that the limited access rights are provided by the access to the network being limited to access to the at least one subscription manager. ### Claim 2 (depends on 1) The method of claim 1, wherein the subscriber identity indicates the network operator associated with the subscriber and wherein the admission platform is configured for receiving initialisation requests indicating the network operator associated with the subscriber. ### Claim 3 (depends on 1) The method of claim 1, further comprising: provisioning the subscriber, by communication of instructions to reconfigure the subscriber identity from the subscription manager to the subscriber. ### Claim 4 (depends on 1) The method of claim 1, wherein the subscriber identity is an International Mobile Subscriber Identity (IMSI) comprising a Mobile Subscriber Identification Number (MSIN) the MSIN comprising a predetermined code indicating that the IMSI is a subscriber identity. ### Claim 5 (depends on 1) The method of claim 1, further comprising: generating a security vector at the admission platform, the security vector being based on the subscriber identity. ### Claim 6 (depends on 1) The method of claim 1, wherein the access instruction restricts the subscriber to use only one or both of: Unstructured Supplementary Service Data (USSD) and Short Messaging Service (SMS). ### Claim 7 (depends on 1) The method of claim 1, wherein the subscriber identity is based on one or more of: a random sequence; a fixed or predefined sequence; an International Mobile Station Equipment Identity (IMEI) for the device, which is associated with the subscriber or subscription unit; and a Media Access Control (MAC) address for the device, which is associated with the subscriber or subscription unit. ### Claim 8 (depends on 1) The method of claim 1, further comprising: communicating a cancellation message from the admission platform to the Visited PLMN subsequent to reconfiguration of the subscriber identity, so that the Visited PLMN will detach the subscriber. ### Claim 9 (depends on 1) The method of claim 1, wherein the admission platform comprises a Home Subscriber Server (HSS) or Home Location Register (HLR) of the Home PLMN. ### Claim 10 (depends on 1) The method of claim 1, wherein the limited access rights are restricted in one or more of: data volume; data rate; access time duration; and a network or Quality of Service (QoS) parameter. ### Claim 11 An admission platform for provisioning a subscriber in a network, the subscriber and admission platform being associated with a common network operator, the admission platform comprising: a network interface, configured to receive an initialisation request for access to a network on behalf of a subscriber linked to a subscription unit and to assign the subscriber limited access rights to the network, the limited access rights being configured for communication between the subscriber and at least one subscription manager, for reconfiguration of identity information associated with the subscriber; wherein the initialisation request indicates a subscriber identity and relates to access to a Visited Public Land Mobile Network (PLMN) wherein the admission platform is a part of a Home PLMN of the subscriber; and wherein assigning the subscriber the limited access rights comprises: creating an authentication vector that is generated using a placeholder authentication key in place of a real authentication key, the placeholder authentication key being either a fixed key or deterministically derived from values associated with a device of the subscriber; and communicating a location update acknowledgement message from the admission platform to the Visited PLMN subsequent to a location update message from the visited PLMN, the location update acknowledgement message being transmitted using the placeholder authentication key and comprising an access instruction to the Visited PLMN to provide the subscriber with limited access rights, wherein the access instruction comprises an indication of at least one Access Point Name (APN) and an instruction that the subscriber cannot obtain access other than through the indicated at least one APN, and wherein the at least one APN provides access only to the at least one subscription manager through a communication channel between the subscriber and the at least one subscription manager such that the limited access rights are provided by the access to the network being limited to access to the at least one subscription manager. ### Claim 12 (depends on 1) The method of claim 1, wherein the admission platform includes both a home location register (HLR) and a specially configured HLR that operates in parallel with the HLR, and wherein the method further includes: after the admission platform receives the initialisation request, the admission platform determines a range of the subscriber identity; and based on the determined range, the admission platform routes the initialisation request to the specially configured HLR as opposed to the HLR, wherein only initialisation requests whose determined range is within a preselected range are routed to the specially configured HLR.