# US 12,604,186 B2 · Methods and systems for network authentication using a unique authentication identifier > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,604,186 B2 - Document ID: US12604186B2 - Status: Granted - Kind: B2 - Application number: 18/304,237 - Filed: 2023-04-20 - Published: 2024-10-24 - Granted: 2026-04-14 - Earliest claimed: 2023-04-20 - Assignees: T-Mobile Innovations LLC - Applicants: T-Mobile Innovations LLC - Inventors: Marouane Balmakhtar; Galip Murat Karabulut; Lyle W. Paczkowski - Web page: https://patentgrep.com/patent/US12604186B2 ## CPC - H04W 12/06: Authentication - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04W 12/08: Access security - H04W 12/71: Hardware identity - H04L 2209/80: Wireless - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A core network comprises a data store is configured to store a record associated with a wireless communication device, wherein the record comprises a plurality of pre-provisioned security parameters related to the wireless communication device. A core authentication application at the core network is configured to receive an authentication request comprising at least one security parameter stored at both the wireless communication device and in a record at the data store, obtain a registration identifier in response to inputting the at least one security parameter received in the authentication request into a first security application, obtain a network-side authentication identifier in response to inputting the registration identifier into a second security application, and determine whether the wireless communication device is authenticated and authorized to access the carrier network when a device-side authentication identifier matches the network-side authentication identifier. ## Claims ### Claim 1 A method performed by a system for authenticating a wireless communication device with a carrier network to access the carrier network, wherein the method comprises: maintaining, in a data store accessible by a core network of the carrier network, a ledger comprising a plurality of records corresponding to different wireless communication devices registered with the carrier network, wherein the plurality of records comprise a record associated with the wireless communication device, wherein the record comprises a plurality of pre-provisioned security parameters related to the wireless communication device; maintaining, in a memory of the wireless communication device, the plurality of pre-provisioned security parameters related to the wireless communication device; transmitting, by the wireless communication device to the core network, an authentication request for access to the carrier network, the authentication request comprising at least one security parameter stored at both the wireless communication device and in the record at the data store; receiving, at the core network from the wireless communication device, the authentication request; inputting, by a core authentication application of the core network to a first security application in the core network, the at least one security parameter in the authentication request received from the wireless communication device; outputting, by the first security application in response to the input of the at least one security parameter, a registration identifier; transmitting, to the wireless communication device by the core authentication application of the core network, an authentication information message comprising the registration identifier; receiving, at the wireless communication device, the authentication information message; inputting, by a device authentication application of the wireless communication device to a second security application in the wireless communication device, the registration identifier in the authentication information message received from the core authentication application; outputting, by the second security application in response to the input of the registration identifier, a device-side authentication identifier; transmitting, to the core network by the device authentication application, the device-side authentication identifier; inputting, by the core authentication application to a third security application in the core network, the registration identifier; outputting, by the third security application in response to the input of the registration identifier, a network-side authentication identifier; determining, by the core authentication application of the core network, whether the device-side authentication identifier matches the network-side authentication identifier; authenticating and authorizing, by the core authentication application of the core network, the wireless communication device to access the carrier network when the device-side authentication identifier is determined to match the network-side authentication identifier; and accessing, by the wireless communication device, the carrier network in accordance with the authentication and authorization. ### Claim 2 (depends on 1) The method of claim 1, wherein the security parameters comprise at least one of identification data identifying the wireless communication device, software and hardware data describing software features and hardware features of the wireless communication device, one or more keys used for authenticating the wireless communication device, or capability data describing one or more capabilities of the wireless communication device. ### Claim 3 (depends on 1) The method of claim 1, wherein the at least one security parameter in the authentication request is a device serial identifier of the wireless communication device allocated by a manufacturer of the wireless communication device. ### Claim 4 (depends on 1) The method of claim 1, wherein the first security application receives the at least one security parameter from the authentication request and a key from the pre-provisioned security parameters stored in the record as input, and wherein an output of the first security application comprises the registration identifier. ### Claim 5 (depends on 1) The method of claim 1, wherein the second security application and the third security application comprise a common security algorithm. ### Claim 6 (depends on 1) The method of claim 1, wherein the device-side authentication identifier is obtained in response to inputting the registration identifier and one or more other security parameters into the second security application, and wherein the network-side authentication identifier is obtained in response to inputting the registration identifier and the one or more other security parameters into the third security application. ### Claim 7 A system comprising: a wireless communication device; and a core network comprising: at least one first processor; at least one first non-transitory memory; a data store configured to store a ledger comprising a plurality of records corresponding to different wireless communication devices registered with a carrier network in association with a subscriber, wherein the plurality of records comprise a record associated with the wireless communication device, wherein the record comprises a plurality of pre-provisioned security parameters related to the wireless communication device; and a core authentication application, stored in the at least one first non-transitory memory, which when executed by the at least one first processor, causes the at least one first processor to be configured to: receive, from the wireless communication device, an authentication request comprising at least one security parameter previously stored in a record at the data store; obtain a registration identifier in response to inputting the at least one security parameter received in the authentication request into a first security application; obtain a network-side authentication identifier in response to inputting the registration identifier into a second security application; transmit, to the wireless communication device, an authentication information message comprising the registration identifier; receive, from the wireless communication device, a device-side authentication identifier derived from the registration identifier according to a third security application; determine whether the device-side authentication identifier matches the network-side authentication identifier; authenticate and authorize the wireless communication device to access the carrier network when the device-side authentication identifier is determined to match the network-side authentication identifier; and enable the wireless communication device to access the carrier network in accordance with the authentication and authorization, wherein the wireless communication device comprises: at least one second processor; at least one second non-transitory memory; a database configured to maintain the plurality of pre-provisioned security parameters related to the wireless communication device; and the device authentication application, stored in the at least one second non-transitory memory, which, when executed by the at least one second processor, causes the at least one second processor to be configured to: transmit, by the wireless communication device to the core network, the authentication request for access, the authentication request comprising the at least one security parameter; receive, at the wireless communication device, the authentication information message; input, to the third security application in the wireless communication device, the registration identifier in the authentication information message received from the core authentication application; receive, from the third security application in response to the input of the registration identifier, the device-side authentication identifier; transmit, to the core network by the device authentication application, the device-side authentication identifier; and access, by the wireless communication device, the carrier network in accordance with the authentication and authorization. ### Claim 8 (depends on 7) The system of claim 7, wherein the ledger is a blockchain, and wherein a first block of the block chain comprises a device serial identifier identifying the wireless communication device. ### Claim 9 (depends on 7) The system of claim 7, wherein the security parameters comprise at least one of identification data identifying the wireless communication device, software and hardware data describing software features and hardware features of the wireless communication device, one or more keys used for authenticating the wireless communication device, or capability data describing one or more capabilities of the wireless communication device. ### Claim 10 (depends on 7) The system of claim 7, wherein the at least one security parameter in the authentication request is a device serial identifier of the wireless communication device allocated by a manufacturer of the wireless communication device. ### Claim 11 (depends on 7) The system of claim 7, wherein the first security application receives the at least one security parameter from the authentication request and a key from the pre-provisioned security parameters stored in the record as input, and wherein an output of the first security application comprises the registration identifier. ### Claim 12 (depends on 7) The system of claim 7, wherein the network-side authentication identifier is obtained in response to inputting the registration identifier and one or more other security parameters into the second security application. ### Claim 13 (depends on 7) The system of claim 7, wherein the first security application and the second security application are different security algorithms.