Methods and Systems for Bootstrapping an End-to-End Application Layer Session Security Keyset Based on a Subscriber Identity Master Security Credential

A method comprising:

• determining, by a security key bootstrapping system, an application layer session security keyset uniquely associated with a client device and based on a subscriber identity master security credential, the subscriber identity master security credential permanently stored within a removable Subscriber Identity Module (“SIM”) installed in the client device and stored on a Home Subscriber Server (“HSS”) associated with a Long Term Evolution (“LTE”) network and configured to store profile data representative of a plurality of subscribers to the LTE network, the LTE network configured to provide data service to the plurality of subscribers via an Evolved Packet Core (“EPC”) framework that includes the HSS and communicatively coupling the client device with an application server system, the determining of the application layer session security keyset including:
• receiving a first authentication vector associated with a first key derivation function of an Evolved Packet System-Authorization and Key Agreement (“EPS-AKA”) algorithm, the first authentication vector associated with providing ciphering and integrity protection security for a connection between the client device and one or more network elements of the provider network,
• receiving a second authentication vector associated with a second key derivation function of the EPS-AKA algorithm, the second authentication vector associated with providing end-to-end security for an application layer session between the client device and the application server system, and
• computing, based on the second authentication vector and further based on the subscriber identity master security credential, the application layer session security keyset;
• and
• using, by the security key bootstrapping system, the application layer session security keyset as a credential to provide end-to-end security for the application layer session between the client device and the application server system over the LTE network;
• wherein neither the SIM installed in the client device nor the HSS obtains the subscriber identity master security credential from an exchange of the subscriber identity master security credential over the LTE network.

A system comprising:

• at least one physical computing device that:
• determines an application layer session security keyset uniquely associated with a client device and based on a subscriber identity master security credential permanently stored within a component of the client device and stored on a subscriber identity management server by:
• receiving a first authentication vector associated with a first key derivation function of an Evolved Packet System-Authorization and Key Agreement (“EPS-AKA”) algorithm, the first authentication vector associated with providing ciphering and integrity protection security for a connection between the client device and one or more network elements of a provider network associated with the subscriber identity management server and by which the client device is communicatively coupled with an application server system,
• receiving a second authentication vector associated with a second key derivation function of the EPS-AKA algorithm, the second authentication vector associated with providing end-to-end security for an application layer session between the client device and the application server system, and
• computing, based on the second authentication vector and further based on the subscriber identity master security credential, the application layer session security keyset;
• and
• uses the application layer session security keyset as a credential to provide the end-to-end security for the application layer session between the client device and the application server system over the provider network;
• wherein neither the component of the client device nor the subscriber identity management server obtains the subscriber identity master security credential from an exchange of the subscriber identity master security credential over the provider network.