# US 2014/0153722 A1 · Restricting use of mobile subscriptions to authorized mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0153722 A1 - Document ID: US20140153722A1 - Status: Published application - Kind: A1 - Application number: 13/839,585 - Filed: 2013-03-15 - Published: 2014-06-05 - Earliest claimed: 2012-12-03 - Inventors: Semyon Mizikovsky - Web page: https://patentgrep.com/patent/US20140153722A1 ## CPC - H04L 9/3271: {using challenge-response} - H04W 12/06: Authentication - H04W 12/12: Detection or prevention of fraud - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An authentication capability is depicted and described. A user device (UD) attempts to attach to a network. The UD includes a mobile equipment (ME) portion and a network authentication module (NAM) having a mobile subscription associated therewith. The network has a network device associated therewith. Cryptographic processing of an authentication challenge parameter is performed on both the network device and the ME of the UD in order to generate a modified authentication challenge parameter. The network device uses the modified authentication challenge parameter to compute one or more parameters related to authentication. The ME of the UD provides the modified authentication challenge parameter to the NAM of the UD, which uses the modified authentication challenge parameter to compute one or more parameters related to authentication. The authentication capability supports authentication of the mobile subscription of the NAM of the UD when the UD attempts to attach to the network. ## Claims ### Claim 1 An apparatus configured to support an authentication procedure, the apparatus comprising: a processor and a memory communicatively connected to the processor, the processor configured to: process an authentication challenge parameter based on a cryptographic function to form a modified authentication challenge parameter; and generate one or more authentication parameters based on the modified authentication challenge parameter. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the processor is configured to process the authentication challenge parameter based on the cryptographic function using a device-specific secret key. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the device-specific secret key is associated with a mobile equipment portion of a user device. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the processor is configured to retrieve the device-specific secret key from the memory based on a mapping of the device-specific secret key to a subscriber identity associated with a network authentication module of the user device. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the cryptographic function comprises a hash function or a cipher. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the processor is configured to: propagate the authentication challenge parameter toward an access network. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the processor is configured to: generate an authentication vector comprising the authentication challenge parameter; and propagate the authentication vector toward an access network. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the one or more authentication parameters comprises a challenge response parameter. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the apparatus is a network device configured for association with an access network or a user device configured to access an access network. ### Claim 10 A method, comprising: using a processor and a memory for processing an authentication challenge parameter based on a cryptographic function to form a modified authentication challenge parameter; and generating one or more authentication parameters based on the modified authentication challenge parameter. ### Claim 11 An apparatus, comprising: a first module comprising a processor and a memory, the first module configured to process an authentication challenge parameter based on a cryptographic function to form a modified authentication challenge parameter; and a second module configured to generate one or more authentication parameters based on the modified authentication challenge parameter. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the first module is configured to receive the authentication challenge parameter from an access network. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the processor is configured to process the authentication challenge parameter based on the cryptographic function using a device-specific secret key. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the device-specific secret key is associated with a mobile equipment (ME) portion of the apparatus. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein the first module is configured to propagate the modified authentication challenge parameter to the second module. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein the first module is a mobile equipment (ME) portion of the apparatus and the second module is a network authentication module (NAM) of the apparatus. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the NAM comprises a Universal Integrated Circuit Card (UICC). ### Claim 18 (depends on 11) The apparatus of claim 11, wherein the second module is configured to provide at least one of the one or more authentication parameters to the first module. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the first module is configured to: receive the at least one of the one or more authentication parameters from the second module; and propagate the at least one of the one or more authentication parameters toward an access network.