# US 12,015,917 B2 · Delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment over extensible authentication protocol (EAP) > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,917 B2 - Document ID: US12015917B2 - Status: Granted - Kind: B2 - Application number: 18/358,569 - Filed: 2023-07-25 - Published: 2023-11-16 - Granted: 2024-06-18 - Earliest claimed: 2020-08-18 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Srinath Gundavelli; Indermeet Singh Gandhi; Timothy Peter Stammers; Vimal Srivastava - Web page: https://patentgrep.com/patent/US12015917B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/06: Authentication - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/069: using certificates or pre-shared keys - H04W 12/40: Security arrangements using identity modules - H04W 84/042: {Public Land Mobile systems, e.g. cellular systems} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Presented herein are techniques to facilitate delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment (UE) using an Extensible Authentication Protocol (EAP) process. In one example, a method may include determining, by an authentication server of an enterprise, that a UE for the enterprise is to receive credentials to enable the UE to connect to a SNPN of the enterprise in which the determining is performed based, at least in part, on connection of the UE to an access network that is different than the SNPN for the enterprise; and performing an authentication process with the UE by the authentication server in which the authentication process includes providing the credentials to the UE via a first authentication message and obtaining confirmation from the UE via a second authentication message that indicates successful provisioning of the credentials for the UE. ## Claims ### Claim 1 A method comprising: determining, by an authentication server of an enterprise, that a user equipment (UE) for the enterprise is to receive credentials to enable the UE to connect to a wireless wide area (WWA) access network of a standalone non-public network (SNPN) of the enterprise, wherein the determining is performed through connection of the UE to an access network that is different than the WWA access network of the SNPN of the enterprise; performing a first authentication process between the authentication server and the UE to obtain a first authentication response from the UE to initiate a credential management procedure with the UE; upon obtaining the first authentication response from the UE, communicating, by the authentication server, a request to a credential manager of the enterprise that includes a location of the UE and indication of whether electronic Subscriber Identity Module (eSIM) credentials or non-SIM credentials are to be generated for the UE to obtain a signed credentials object including the credentials from the credential manager; and performing a second authentication process between the authentication server and the UE to send the signed credentials object to the UE and obtain a second authentication response from the UE that includes an indication of successful provisioning of the credentials. ### Claim 2 (depends on 1) The method of claim 1, wherein the access network that is different than the WWA access network of the SNPN of the enterprise is one of: a wireless wide area access network or a wireless local area access network not operated by the enterprise; or a wireless local area access network of the enterprise. ### Claim 3 (depends on 1) The method of claim 1, wherein the WWA access network of the SNPN of the enterprise is one or more of: a 3rd Generation Partnership Project (3GPP) Fourth Generation (4G) access network of the enterprise; a 3rd Generation Partnership Project (3GPP) Fifth Generation (5G) access network of the enterprise; a 3rd Generation Partnership Project (3GPP) next Generation (nG) access network of the enterprise; or a Citizens Broadband Radio Service (CBRS) access network of the enterprise. ### Claim 4 (depends on 1) The method of claim 1, wherein the first authentication process is a first Extensible Authentication Protocol (EAP) process and the second authentication process is a second EAP process. ### Claim 5 (depends on 4) The method of claim 4, wherein performing the second authentication process includes sending an EAP request to the UE that includes the signed credentials object and further includes a credential type indicator indicating one of an eSIM profile for the UE or non-SIM credentials for the UE and an operation type indicator that are generated via the credential manager of the enterprise. ### Claim 6 (depends on 1) The method of claim 1, wherein the second authentication response from the UE further includes a signed key identifying the credentials. ### Claim 7 (depends on 6) The method of claim 6, further comprising: providing an indication to the UE to delete or disable the credentials via an authentication request that includes the signed key identifying the credentials. ### Claim 8 (depends on 1) The method of claim 1, further comprising generating the credentials via the credential manager of the enterprise to enable the UE to connect to the WWA access network of the SNPN of the enterprise based on one or more of: a location of the UE; or a service set identifier (SSID) associated with a wireless local area access network determined based on a location of the UE. ### Claim 9 (depends on 1) The method of claim 1, wherein the determining by the authentication server that the UE is to receive the credentials is based on one or more of: a device identifier for the UE; a Roaming Consortium Organizational Identifier (RCOI) associated with the access network to which the UE is connected; or a public wireless wide area access network identifier associated with the access network to which the UE is connected. ### Claim 10 One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations, comprising: determining, by an authentication server of an enterprise, that a user equipment (UE) for the enterprise is to receive credentials to enable the UE to connect to a wireless wide area (WWA) access network of a standalone non-public network (SNPN) of the enterprise, wherein the determining is performed through connection of the UE to an access network that is different than the WWA access network of the SNPN of the enterprise; performing a first authentication process between the authentication server and the UE to obtain a first authentication response from the UE to initiate a credential management procedure with the UE; upon obtaining the first authentication response from the UE, communicating, by the authentication server, a request to a credential manager of the enterprise that includes a location of the UE and indication of whether electronic Subscriber Identity Module (eSIM) credentials or non-SIM credentials are to be generated for the UE to obtain a signed credentials object including the credentials from the credential manager; and performing a second authentication process between the authentication server and the UE to send the signed credentials object to the UE and obtain a second authentication response from the UE that includes an indication of successful provisioning of the credentials. ### Claim 11 (depends on 10) The media of claim 10, wherein the first authentication process is a first Extensible Authentication Protocol (EAP) process and the second authentication process is a second EAP process. ### Claim 12 (depends on 11) The media of claim 11, wherein performing the second authentication process includes sending an EAP request to the UE that includes the signed credentials object and further includes a credential type indicator indicating one of an eSIM profile for the UE or non-SIM credentials for the UE and an operation type indicator that are generated via the credential manager of the enterprise. ### Claim 13 (depends on 10) The media of claim 10, wherein the second authentication response from the UE further includes a signed key identifying the credentials. ### Claim 14 (depends on 13) The media of claim 13, further comprising instructions that, when executed by the processor, cause the processor to perform further operations, comprising: providing an indication to the UE to delete or disable the credentials via an authentication request that includes the signed key identifying the credentials. ### Claim 15 An authentication server of an enterprise, comprising: at least one memory element for storing data; and at least one processor for executing instructions associated with the data, wherein executing the instructions causes the authentication server to perform operations, comprising: determining, by an authentication server of an enterprise, that a user equipment (UE) for the enterprise is to receive credentials to enable the UE to connect to a wireless wide area (WWA) access network of a standalone non-public network (SNPN) of the enterprise, wherein the determining is performed through connection of the UE to an access network that is different than the WWA access network of the SNPN of the enterprise; performing a first authentication process between the authentication server and the UE to obtain a first authentication response from the UE to initiate a credential management procedure with the UE; upon obtaining the first authentication response from the UE, communicating, by the authentication server, a request to a credential manager of the enterprise that includes a location of the UE and indication of whether electronic Subscriber Identity Module (eSIM) credentials or non-SIM credentials are to be generated for the UE to obtain a signed credentials object including the credentials from the credential manager; and performing a second authentication process between the authentication server and the UE to send the signed credentials object to the UE and obtain a second authentication response from the UE that includes an indication of successful provisioning of the credentials. ### Claim 16 (depends on 15) The authentication server of claim 15, wherein the access network is one of: a wireless wide area access network or a wireless local area access network not operated by the enterprise; or a wireless local area access network of the enterprise. ### Claim 17 (depends on 15) The authentication server of claim 15, wherein the SNPN of the enterprise is one or more of: a 3rd Generation Partnership Project (3GPP) Fourth Generation (4G) access network of the enterprise; a 3rd Generation Partnership Project (3GPP) Fifth Generation (5G) access network of the enterprise; a 3rd Generation Partnership Project (3GPP) next Generation (nG) access network of the enterprise; or a Citizens Broadband Radio Service (CBRS) access network of the enterprise. ### Claim 18 (depends on 15) The authentication server of claim 15, wherein the first authentication process is a first Extensible Authentication Protocol (EAP) process and the second authentication process is a second EAP process. ### Claim 19 (depends on 18) The authentication server of claim 18, wherein performing the second authentication process includes sending an EAP request to the UE that includes the signed credentials object and further includes a credential type indicator indicating one of an eSIM profile for the UE or non-SIM credentials for the UE and an operation type indicator that are generated via the credential manager of the enterprise. ### Claim 20 (depends on 19) The authentication server of claim 19, wherein executing the instructions causes the authentication server to perform further comprising: providing an indication to the UE to delete or disable the credentials via an authentication request that includes a signed key identifying the credentials.