# US 2023/0054571 A1 · Key Change Notification for Authentication and Key Management for Applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0054571 A1 - Document ID: US20230054571A1 - Status: Published application - Kind: A1 - Application number: 17/799,960 - Filed: 2021-02-10 - Published: 2023-02-23 - Earliest claimed: 2020-02-20 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (PUBL) - Inventors: Cheng Wang; David CASTELLANOS ZAMORA; Vlasios Tsiatsis; Helena Vahidi Mazinani - Web page: https://patentgrep.com/patent/US20230054571A1 ## CPC - H04L 63/064: {Hierarchical key distribution, e.g. by multi-tier trusted parties} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/043: using a trusted network node as an anchor - H04W 12/06: Authentication - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method performed by a first network node includes transmitting a first subscription request message indicating a request to subscribe to receive notification of changes in an authentication status of a wireless device. A first notification message is received. The first notification message includes an indication of a change in the authentication status of the wireless device. ## Claims ### Claim 1 A method performed by a first network node, the method comprising: transmitting a first subscription request message indicating a request to subscribe to receive notification of changes in an authentication status of a wireless device; and receiving a first notification message comprising an indication of a change in the authentication status of the wireless device. ### Claim 2 (depends on 1) The method of claim 1, wherein the first network node is operating as an Authentication and Key Management for Applications Anchor Function, AAnF, and the first subscription request message is transmitted to a second network node operating as a Unified Data Management, UDM. ### Claim 3 (depends on 1) The method of claim 1, wherein the first notification message is received from a UDM or an Authentication Server Function, AUSF. ### Claim 4 (depends on 1) The method of claim 1, wherein the first network node is operating as an AAnF and the first subscription request message is transmitted to a second network node operating as an AUSF. ### Claim 5 (depends on 4) The method of claim 4, wherein the first notification message is received from the second network node operating as the AUSF. ### Claim 6 (depends on 4) The method of claim 4, wherein the first notification message is received from a third network node operating as a UDM via the AUSF. ### Claim 7 (depends on 4) The method of claim 4, further comprising initiating an Application Function key, KAF, refreshment procedure based on the first notification message. ### Claim 8 (depends on 1) The method of claim 1, wherein the first network node is operating as an Authentication and Key Management for Applications Application Function, AKMA AF, and the subscription request message is transmitted to a second network node operating as a AAnF. ### Claim 9 (depends on 1) The method of claim 1, wherein the first network node is operating as an AUSF and the first subscription request message is transmitted to a second network node operating as a UDM. ### Claim 10 (depends on 9) The method of claim 9 wherein the first notification message is received from the second network node operating as the UDM. ### Claim 11 (depends on 1) The method of claim 1, wherein the first subscription request message comprises a Nudm_UEAuth_ResultStatusSubscribe message, the Nudm_UEAuth_ResultStatusSubscribe comprising a UE identifier. ### Claim 12 (depends on 1) The method of claim 1, wherein the first notification message indicates that an anchor key, KAKMA, generated during a first primary authentication of the wireless device with a network has been replaced with a new KAKMA generated during a second primary authentication of the wireless device with the network. ### Claim 13 (depends on 12) The method of claim 12, wherein the first notification message comprises a new anchor key identifier, KAKMAID, that is associated with the new KAKMA generated during the second primary authentication of the wireless device with the network. ### Claim 14 (depends on 12) The method of claim 12, wherein the first notification message comprises a user equipment, UE, authentication timestamp associated with a primary authentication of the wireless device with the network. ### Claim 15 (depends on 12) The method of claim 12, further comprising transmitting a request for the new KAKMA to an AUSF indicated in the notification message. ### Claim 16 (depends on 15) The method of claim 15, further comprising receiving a response to the request for the new KAKMA from the AUSF, the response associating the new KAKMAID with the new KAKMA. ### Claim 17 (depends on 12) The method of claim 12, wherein the first notification message indicates that a KAKMA generated during a first primary authentication of the wireless device with a network is no longer valid. ### Claim at position 18 -32. (canceled) ### Claim 33 (depends on 1) A first network node comprising processing circuitry configured to perform claim 1. ### Claim 34 A method performed by a first network node, the method comprising: receiving a first subscription request message indicating a request to subscribe to receive notification of changes in an authentication status of a wireless device; and transmitting a first notification message comprising an indication of a change in the authentication status of the wireless device. ### Claim at position 21 35-53. (canceled) ### Claim 54 (depends on 34) A first network node comprising processing circuitry configured to perform any claim 34.