# US 2014/0196127 A1 · Service Access Authentication Method and System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196127 A1 - Document ID: US20140196127A1 - Status: Published application - Kind: A1 - Application number: 14/125,859 - Filed: 2012-06-13 - Published: 2014-07-10 - Earliest claimed: 2011-06-16 - Assignees: Telefonaktiebolaget L M Ericsson (publ) - Inventors: Bernard Smeets; Mats Näslund - Web page: https://patentgrep.com/patent/US20140196127A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An access authentication system for authenticating a subscriber of a service, the access authentication system comprising an operator access authentication system and one or more private access authentication systems, each private access authentication system being communicatively connectable with the operator access authentication system, the operator access authentication system being adapted to provide one or more authentication functions for facilitating authentication of subscribers of the service based on respective subscriber authentication data items associated with credentials of the subscriber; wherein each private access authentication system is adapted to communicate one or more subscriber authentication data items to said operator access authentication system; and wherein each private access authentication system is further adapted to communicate one or more verification data items indicative of the private access authentication system operating in at least one predetermined state. ## Claims ### Claim 1 An access authentication system for authenticating a subscriber of a service, the access authentication system comprising an operator access authentication system and one or more private access authentication systems, each private access authentication system being communicatively connectable with the operator access authentication system, the operator access authentication system being adapted to provide one or more authentication functions for facilitating authentication of subscribers of the service based on respective subscriber authentication data items associated with credentials of the subscriber; wherein each private access authentication system is adapted to communicate one or more subscriber authentication data items to said operator access authentication system; and wherein each private access authentication system is further adapted to communicate one or more verification data items indicative of the private access authentication system operating in at least one predetermined state. ### Claim 2 (depends on 1) The access authentication system according to claim 1, wherein each private access authentication system is securely connected to the operator access authentication system allowing verification of the private access authentication system by the operator access authentication system. ### Claim 3 (depends on 1) The access authentication system according to claim 1, wherein the private access authentication system comprises a trusted platform. ### Claim 4 (depends on 3) The access authentication system according to claim 3, wherein the trusted platform is operable to perform a secured boot operation. ### Claim 5 (depends on 4) The access authentication system according to claim 4, wherein the trusted platform is operable to restrict execution of program code to digitally signed program code. ### Claim 6 (depends on 3) The access authentication system according to any one of claim 3, wherein the verification data item comprises at least one signature of the trusted platform or at least one attestation result generated by the trusted platform. ### Claim 7 (depends on 1) The access authentication system according to claim 1, wherein the private access authentication system is adapted to communicate an authentication message comprising the subscriber authentication data item and one or more verification data items. ### Claim 8 (depends on 7) The access authentication system according to claim 7, wherein the private access authentication system is adapted to receive a request for authentication data from the operator access authentication system, and to communicate the authentication message responsive to the request for authentication data. ### Claim 9 (depends on 8) The access authentication system according to claim 8, wherein the request for authentication data comprises a nonce, and wherein the private access authentication system is adapted to include at least a digital signature over at least the received nonce in the authentication message. ### Claim 10 (depends on 8) The access authentication system according to claim 8, wherein the request for authentication data comprises a data item indicative of a type of proof requested by the operator access authentication system to indicate that the private access authentication system is operating in at least one predetermined state. ### Claim 11 (depends on 7) The access authentication system according to claim 7, wherein the authentication message comprises a digital signature. ### Claim 12 (depends on 1) The access authentication system according to claim 1, wherein the at least one predetermined state comprises the private access authentication system executing a predetermined software component trusted by the operator access authentication system. ### Claim 13 A method of facilitating, by an operator access authentication system, authentication of a subscriber device requesting access to a service, wherein the operator access authentication system is adapted to provide one or more authentication functions for facilitating authentication of subscribers of the service based on respective subscriber authentication data items, and wherein the method comprises: receiving a subscriber authentication data item from a private access authentication system communicatively connected with the operator access authentication system, said subscriber authentication data item being indicative of one or more subscriber credentials; and responsive to the received subscriber authentication data item and responsive to a verification of a state in which the private access authentication system is operated, providing one or more authentication functions for facilitating authentication of a subscriber associated to said subscriber credentials. ### Claim 14 (depends on 13) The method according to claim 13, comprising: forwarding a request for authentication data to the private authentication system; and receiving the subscriber authentication data item responsive to said request. ### Claim 15 (depends on 13) The method according to claim 13, further comprising: receiving at least one verification data item by the operator access authentication system from the private access authentication system, the verification data item being indicative of a state in which the private access authentication system is operated; determining by the operator authentication system, based on the received verification data item, whether said state is trustable by the operator access authentication system; and wherein providing one or more authentication functions is responsive to said determination. ### Claim 16 An operator access authentication system for an access authentication system the operator access authentication system being adapted to provide one or more authentication functions for facilitating authentication of subscribers of a service based on respective subscriber authentication data items, wherein the operator access authentication system is configured to: receive a subscriber authentication data item from a private access authentication system communicatively connected with the operator access authentication system, said subscriber authentication data item being indicative of one or more subscriber credentials; and responsive to the received subscriber authentication data item and responsive to a verification of a state in which the private access authentication system is operated, provide one or more authentication functions for facilitating authentication of a subscriber associated with said subscriber credentials. ### Claim 17 (depends on 16) The operator access authentication system according to claim 16, further configured to receive a service request from a subscriber device; identify, based on the received request, one of a set of private access authentication systems; and request from the identified private access authentication system the at least one verification data item indicative of a state in which the private access authentication system is operated, and the subscriber authentication data item indicative of one or more subscriber credentials associated with said subscriber device. ### Claim 18 A method of facilitating, by a private access authentication system connected to an operator access authentication system, authentication of a subscriber device requesting access to a service, wherein the operator access authentication system is adapted to provide one or more authentication functions for facilitating authentication of subscribers of the service based on respective subscriber authentication data items, and wherein the method comprises: communicating a subscriber authentication data item to the operator access authentication system, said subscriber authentication data item being indicative of one or more subscriber credentials and facilitating the operator access authentication system to selectively grant or deny a subscriber device access to the communications network; and communicating at least one verification data item indicative of a state in which the private access authentication system is operated and facilitating determination whether said state is trustable by the operator access authentication system. ### Claim 19 A private access authentication system for an access authentication system, the access authentication system comprising an operator access authentication system and at least said private access authentication systems; wherein the private access authentication system is adapted to: communicate a subscriber authentication data item to the operator access authentication system, said subscriber authentication data item being indicative of one or more subscriber credentials and facilitating the operator access authentication system to selectively grant or deny a subscriber device access to the communications network; and communicate at least one verification data item indicative of a state in which the private access authentication system is operated and facilitating determination whether said state is trustable by the operator access authentication system.