Mobile phone client application authentication through media access gateway (MAG)

A mobile communication device, comprising:

• a processor;
• a non-transitory memory;
• a cellular radio transceiver;
• and
• a client application stored in the non-transitory memory that, when executed by the processor:
• checks the non-transitory memory for a web application access token corresponding to the client application,
• determines that the non-transitory memory does not store the web application access token,
• transmits a web application access token request via the cellular radio transceiver to a Media Access Gateway (MAG), where the web application access token request comprises an identification of an Internet Protocol (IP) address allocated to the mobile communication device when authenticating into a radio access network (RAN) by the cellular radio transceiver, and wherein the MAG looks up a wireless communication service account based on the IP address, obtains a mobile directory number (MDN) of the wireless communication service account, and sends a MAG request that includes the MDN to a web application server requesting a web application access token,
• receives the web application access token created by the web application server from the MAG, wherein the web application access token comprises the MDN,
• stores the web application access token in the non-transitory memory, and
• sends a request to access a web application comprising the web application access token to a web application server, where the web application server is different from the MAG.

A method of authenticating a request from a client application on a mobile communication device to access a web application using independent verification of a wireless subscription service account, comprising:

• receiving a device request for a web application access token by a media access gateway (MAG) from a mobile communication device, wherein the device request comprises an Internet Protocol (IP) address allocated for use by the mobile communication device;
• looking up a wireless communication service account in a provisioning data store by the MAG based on the IP address received in the request for the web application access token;
• obtaining a mobile directory number (MDN) of the wireless communication service account by the MAG;
• sending a MAG request for the web application access token by the MAG to a web application server, where the MAG request comprises the MDN obtained by the MAG;
• receiving the MAG request for the web application access token by the web application server, where the web application server executes a web application;
• verifying by the web application server that the wireless communication service account associated with the MDN in the MAG request is in good standing and that the mobile communication device is provisioned for access to the web application;
• creating a web application access token by the web application server, where the web application access token comprises the MDN, an identity of the mobile communication device associated with the wireless communication service account associated with the MDN, and a time-to-live;
• transmitting the web application access token by the web application server to the MAG;
• transmitting the web application access token by the MAG to the mobile communication device;
• receiving a request to access the web application by the web application server from the mobile communication device, wherein the request to access the web application comprises the web application access token and identifies a web application account;
• validating the web application access token by the web application server by assuring the MDN is associated with the web application account identified in the request to access the web application and that the time-to-live in the web application access token is not expired;
• and
• performing a service by the web application server identified in the request to access the web application.