# US 11,910,194 B2 · Secondary device authentication proxied from authenticated primary device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,910,194 B2 - Document ID: US11910194B2 - Status: Granted - Kind: B2 - Application number: 18/086,606 - Filed: 2022-12-21 - Published: 2023-04-27 - Granted: 2024-02-20 - Earliest claimed: 2019-03-25 - Assignees: T-Mobile Innovations LLC - Applicants: T-Mobile Innovations LLC - Inventors: Ricky A. Hohler; Robin D. Katzer; Deepthi Kota; Brian D. Mauer - Web page: https://patentgrep.com/patent/US11910194B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04W 12/06: Authentication - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/40: Security arrangements using identity modules - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method of authenticating a secondary communication device based on authentication of a primary mobile communication device is disclosed. Trust is established with the primary mobile communication device by a device authentication server (DAS). The DAS receives an authorization code request from a secondary application operating on the secondary communication device, and transmits an authorization code to the secondary communication device. The DAS receives the authorization code from a primary application operating on the primary mobile communication device. The DAS authorizes the secondary application based on the trust with the primary mobile communication device and the authorization code from the primary application. The DAS transmits a secondary token to the secondary application at the secondary communication device to allow initialization of a communication session from the secondary application on behalf of the primary mobile communication device. ## Claims ### Claim 1 A primary mobile communication device, comprising: a processor; a camera; a transceiver; a non-transitory memory, wherein the non-transitory memory stores a primary token indicating trust established between the primary mobile communication device and a device authentication server (DAS); and a primary application stored in the non-transitory memory that, when executed by the processor: activates the camera to scan a Quick Response (QR) code from a secondary application at a secondary communication device; and transmits, via the transceiver, the QR code and the primary token to the DAS to indicate a physical nexus between the primary mobile communication device and the secondary communication device and to request extending the trust to include the secondary application at the secondary communication device on behalf of the primary mobile communication device. ### Claim 2 (depends on 1) The primary mobile communication device of claim 1, wherein the primary application, when executed by the processor, further: receives a secondary device name for the secondary communication device as input after scanning the QR code; and transmits the secondary device name to the DAS along with the QR code and the primary token. ### Claim 3 (depends on 2) The primary mobile communication device of claim 2, further comprising a display, wherein the primary application, when executed by the processor, further: receives, via the transceiver, an application association list for the primary application from the DAS, the application association list indicating the secondary communication device is associated with the primary mobile communication device; and displays, via the display, an indication that the secondary communication device is associated with the primary mobile communication device. ### Claim 4 (depends on 3) The primary mobile communication device of claim 3, wherein the application association list is created by the DAS in response to authenticating the primary token. ### Claim 5 (depends on 1) The primary mobile communication device of claim 1, wherein the primary token stored in non-transitory memory includes a mobile directory number (MDN) of the primary mobile communication device, a device serial number of the primary mobile communication device, a timestamp, a primary flag set to true, and a label. ### Claim 6 (depends on 1) The primary mobile communication device of claim 1, wherein trust is established with the DAS by mobile access gateway (MAG) authentication, International Mobile Subscriber Identity (IMSI) encryption challenge, or self-identified IMSI. ### Claim 7 (depends on 1) The primary mobile communication device of claim 1, wherein the primary token provides the primary application access to a particular user's account associated with the primary mobile communication device. ### Claim 8 (depends on 1) The primary mobile communication device of claim 1, wherein the primary token comprises a specified time to live. ### Claim 9 (depends on 8) The primary mobile communication device of claim 8, wherein trust is reestablished between the primary mobile communication device and the DAS in response to the specified time to live expiring. ### Claim 10 (depends on 1) The primary mobile communication device of claim 1, wherein once trust is extended, the secondary application of the secondary communication device initiates a communication session with a network on behalf of the primary mobile communication device based on a secondary token. ### Claim 11 A method, comprising: storing, in a non-transitory memory of a primary mobile communication device, a primary token indicating trust established between the primary mobile communication device and a device authentication server (DAS); activating, by a primary application stored in the non-transitory memory and executed by a processor of the primary mobile communication device, a camera of the primary mobile communication device to scan a Quick Response (QR) code from a secondary application at a secondary communication device; and transmitting, by the primary application via a transceiver of the primary mobile communication device, the QR code and the primary token to the DAS to indicate a physical nexus between the primary mobile communication device and the secondary communication device and to request extending the trust to include the secondary application at the secondary communication device on behalf of the primary mobile communication device. ### Claim 12 (depends on 11) The method of claim 11, further comprising: receiving, by the primary application, a secondary device name for the secondary communication device as input after scanning the QR code; and transmitting, by the primary application, the secondary device name to the DAS along with the QR code and the primary token. ### Claim 13 (depends on 12) The method of claim 12, further comprising: receiving, by the primary application via the transceiver, an application association list for the primary application from the DAS, the application association list indicating the secondary communication device is associated with the primary mobile communication device; and displaying, by the primary application via a display of the primary mobile communication device, an indication that the secondary communication device is associated with the primary mobile communication device. ### Claim 14 (depends on 13) The method of claim 13, wherein the application association list is created by the DAS in response to authenticating the primary token. ### Claim 15 (depends on 11) The method of claim 11, wherein the primary token stored in non-transitory memory includes a mobile directory number (MDN) of the primary mobile communication device, a device serial number of the primary mobile communication device, a timestamp, a primary flag set to true, and a label. ### Claim 16 (depends on 11) The method of claim 11, wherein trust is established with the DAS by mobile access gateway (MAG) authentication, International Mobile Subscriber Identity (IMSI) encryption challenge, or self-identified IMSI. ### Claim 17 (depends on 11) The method of claim 11, wherein the primary token provides the primary application access to a particular user's account associated with the primary mobile communication device. ### Claim 18 (depends on 11) The method of claim 11, wherein the primary token comprises a specified time to live. ### Claim 19 (depends on 18) The method of claim 18, wherein trust is reestablished between the primary mobile communication device and the DAS in response to the specified time to live expiring. ### Claim 20 (depends on 11) The method of claim 11, wherein once trust is extended, the secondary application of the secondary communication device initiates a communication session with a network on behalf of the primary mobile communication device based on a secondary token.