# US 2021/0344657 A1 · Generating a device identification key from a base key for authentication with a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344657 A1 - Document ID: US20210344657A1 - Status: Published application - Kind: A1 - Application number: 17/306,526 - Filed: 2021-05-03 - Published: 2021-11-04 - Earliest claimed: 2014-08-28 - Assignees: Cryptography Research, Inc. - Applicants: Cryptography Research, Inc. - Inventors: Philippe Alain Martineau; Ambuj Kumar; William Craig Rawlings - Web page: https://patentgrep.com/patent/US20210344657A1 ## CPC - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/3271: {using challenge-response} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04W 12/50: Secure pairing of devices - H04L 2209/80: Wireless - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A base key that is stored at a device may be received. A network identification may further be received. A device identification key may be generated based on a combination of the network identification and the base key. Furthermore, the device identification key may be used to authenticate the device with a network that corresponds to the network identification. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A method comprising: receiving a base key being stored at a device; receiving a mobile communications network identification; generating, by a processing device, a device identification key based on a combination of the mobile communications network identification and the base key; and using the device identification key to authenticate the device with a mobile communications network corresponding to the mobile communications network identification. ### Claim 22 (depends on 21) The method of claim 21, wherein the using of the device identification key to authenticate the device with the mobile communications network corresponding to the mobile communications network identification comprises: generating a device proof based on a combination of the device identification key and a value received from the mobile communications network corresponding to the mobile communications network identification; and transmitting the device proof to the mobile communications network corresponding to the mobile communications network identification. ### Claim 23 (depends on 21) The method of claim 21, further comprising: receiving a cryptographic nonce value; and receiving a device identification, wherein the generating of the device identification key is further based on the device identification and the cryptographic nonce value. ### Claim 24 (depends on 21) The method of claim 21, further comprising: transmitting the device identification key from the device to the mobile communications network via a side channel, wherein the device identification key is used by the mobile communications network to generate a mobile communications network proof that is compared with a device proof that is transmitted from the device to the mobile communications network. ### Claim 25 (depends on 21) The method of claim 21, further comprising: in response to a request to authenticate the device with a second mobile communications network, receiving a second mobile communications network identification corresponding to the second mobile communications network; generating a second device identification key based on a combination of the second mobile communications network identification and the same base key that is used to generate the first device identification key; and using the second device identification key to authenticate the device with the second mobile communications network corresponding to the second mobile communications network identification. ### Claim 26 (depends on 21) The method of claim 21, wherein the device identification key is associated with a subscriber identity module (SIM) functionality. ### Claim 27 (depends on 21) The method of claim 21, wherein the device identification key is not stored in memory. ### Claim 28 A system comprising: a memory to store a base key; and a processing device coupled with the memory to: retrieve the base key being stored at the memory; receive an identification of the mobile communications network; and generate a device key based on the base key and the identification of the mobile communications network, wherein the device key is associated with authenticating the device for use with a mobile communications network corresponding to the mobile communications network identification. ### Claim 29 (depends on 28) The system of claim 28, wherein the generating of the device key based on the base key and the identification of the mobile communications network comprises: generating a device proof based on a combination of the device key and a value received from the mobile communications network; and transmitting the device proof to the mobile communications network. ### Claim 30 (depends on 28) The system of claim 28, wherein the processing device is further to: receive a nonce value; and receive an identification of the device, wherein the generating of the device key is further based on the identification of the device and the nonce value. ### Claim 31 (depends on 28) The system of claim 28, wherein the processing device is further to: transmit the device key from the device to the mobile communications network via a side channel, wherein the device key is used by the mobile communications network to generate a mobile communications network proof that is compared with a device proof that is transmitted from the device to the mobile communications network. ### Claim 32 (depends on 28) The system of claim 28, wherein the processing device is further to: transmit the device key from the device to the mobile communications network via a side channel; receive, from the mobile communications network, a mobile communications network proof based on the transmitted device key, wherein the mobile communications network proof is compared with a device proof generated by the device to authenticate the mobile communications network. ### Claim 33 (depends on 28) The system of claim 28, wherein the processing device is further to: in response to a request to authenticate the device for use with an additional mobile communications network, receive an identification of the additional mobile communications network; generate an additional device key based on a combination of the identification of the additional mobile communications network and the same base key that is used to generate the device key; and use the additional device key to authenticate the device for use with the additional mobile communications network. ### Claim 34 (depends on 28) The system of claim 28, wherein the device key is associated with a subscriber identity module (SIM) functionality. ### Claim 35 (depends on 28) The system of claim 28, wherein the device key is not stored in memory. ### Claim 36 A non-transitory computer readable medium including data that, when accessed by a processing device, cause the processing device to perform operations comprising: receiving a base key being stored at a device; receiving a mobile communications network identification; generating a device identification key based on a combination of the mobile communications network identification and the base key; and using the device identification key to authenticate the device with a mobile communications network corresponding to the mobile communications network identification. ### Claim 37 (depends on 36) The non-transitory computer readable medium of claim 36, wherein the using of the device identification key to authenticate the device with the mobile communications network corresponding to the mobile communications network identification comprises: generating a device proof based on a combination of the device identification key and a value received from the mobile communications network corresponding to the mobile communications network identification; and transmitting the device proof to the mobile communications network corresponding to the mobile communications network identification. ### Claim 38 (depends on 36) The non-transitory computer readable medium of claim 36, the operations further comprising: receiving a cryptographic nonce value; and receiving a device identification, wherein the generating of the device identification key is further based on the cryptographic nonce value and the device identification. ### Claim 39 (depends on 36) The non-transitory computer readable medium of claim 36, the operations further comprising: transmitting the device identification key from the device to the mobile communications network via a side channel, wherein the device identification key is used by the mobile communications network to generate a mobile communications network proof that is compared with a device proof that is transmitted from the device to the mobile communications network. ### Claim 40 (depends on 36) The non-transitory computer readable medium of claim 36, the operations further comprising: in response to a request to authenticate the device with a second mobile communications network, receiving a second mobile communications network identification corresponding to the second mobile communications network; generating a second device identification key based on a combination of the second mobile communications network identification and the same base key that is used to generate the first device identification key; and using the second device identification key to authenticate the device with the second mobile communications network corresponding to the second mobile communications network identification.