Loading patent…
AssigneeMotorola Mobility LLC
InventorsMadjid F. Nakhjiri, Katrin Hoeper, Alexander Medvinsky
Estimating the term…
A method of authentication and authorization over a communication system is provided. The method performs a first authentication of a device based on a set of device identity and credentials. The first authentication includes creation of a first set of keying material. The method also includes performing a second authentication of a subscriber based on a set of subscriber identity and credentials. The second authentication includes creation of a second set of keying material. A set of compound key material is created with a key derivation mechanism that uses the first set of keying material and the second set of keying material. A binding token is created by cryptographically signing at least the device identity authenticated in the first authentication and the subscriber identity authenticated in the second authentication using the set of compound keying material. The signed binding token is exchanged for verification with an authenticating and authorizing party.
A method of authentication and authorization over a communication system, comprising:
The method of claim of 8 further comprising generating master session keys for derivation of application specific keys.
The method of claim of 8 further comprising generating session resumption keys for expediting future resumption of service for a previously authenticated subscriber and device pair.
The method of claim of 7 further comprising authorizing the subscriber by issuing a signed service token for consumption by at least one of the device and an external third party, wherein the signed service token includes at least one of an authenticated device identity and a subscriber identity.
The method of claim of 12 wherein the service token is signed with an authorizing server public key so that the signed service token can be verified by third party servers.
A network-enabled device for use in a communication system, comprising:
An authentication and authorization arrangement, comprising:
The authentication and authorization arrangement of claim of 35 wherein the second authentication server is further configured to authorize the subscriber by issuing a signed service token for consumption by at least one of the device and an external third party, wherein the signed service token includes at least one of an authenticated device identity and a subscriber identity.
The authentication and authorization arrangement of claim of 38 wherein the service token is signed with an authorizing server public key so that the signed service token can be verified by third party servers.
Dependencies are inferred from the claim text.