Secondary device authentication proxied from authenticated primary device

Patent metadata

Field	Value
Publication number	US-11070980-B1
Application number	US-201916363581-A
Country	US
Kind code	B1
Filing date	Mar 25, 2019
Priority date	Mar 25, 2019
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

A method of authenticating a secondary communication device based on authentication of a primary mobile communication device is disclosed. Trust is established with the primary mobile communication device by a device authentication server (DAS). The DAS receives an authorization code request from a secondary application operating on the secondary communication device, and transmits an authorization code to the secondary communication device. The DAS receives the authorization code from a primary application operating on the primary mobile communication device. The DAS authorizes the secondary application based on the trust with the primary mobile communication device and the authorization code from the primary application. The DAS transmits a secondary token to the secondary application at the secondary communication device to allow initialization of a communication session from the secondary application on behalf of the primary mobile communication device.

First claim

What is claimed is:

1. A method of authenticating a secondary communication device based on authentication of a primary mobile communication device, the method comprising:
establishing trust with the primary mobile communication device by a device authentication server (DAS);
receiving, by the DAS, an authorization code request from a secondary application operating on the secondary communication device;
transmitting, by the DAS, an authorization code to the secondary communication device in response to the authorization code request;
receiving, by the DAS, the authorization code from a primary application operating on the primary mobile communication device;
authorizing, by the DAS, the secondary application based on the trust with the primary mobile communication device and the authorization code from the primary application; and
transmitting, by the DAS, a secondary token to the secondary application at the secondary communication device to allow initialization of a communication session from the secondary application.

2. The method of claim 1 , wherein the authorization code is a Quick Response (QR) code.

3. The method of claim 1 , wherein the authorization code request includes an identification token from the secondary application, and further comprising:
associating, in memory, the authorization code with the identification token from the secondary application.

4. The method of claim 3 , further comprising:
receiving, by the DAS, a secondary device name and primary token from the primary application on the primary mobile communication device along with the authorization code, the primary token evidencing the established trust with the primary mobile communication device, and the secondary device name indicating the secondary communication device;
associating, in memory, the secondary device name, the authorization code, and the identification token with the primary application in an association list; and
transmitting, by the DAS, the association list to the primary application at the primary mobile communication device.

5. The method of claim 4 , further comprising:
generating, by the DAS, a temporary access code for the secondary application;
storing, in memory, the temporary access code in the association list;
transmitting, by the DAS, the temporary access code to the secondary application on the secondary communication device; and
receiving, by the DAS, an authentication request from the secondary application on the secondary communication device, the authentication request including the temporary access code and the authorization code, wherein the authentication request is employed to authorize the secondary application based on the trust with the primary mobile communication device.

6. The method of claim 4 , wherein the primary token from the primary application on the primary mobile communication device includes a mobile directory number (MDN) of the primary mobile communication device, a device serial number of the primary mobile communication device, a timestamp, a primary flag set to true, and a label.

7. The method of claim 3 , wherein the secondary token transmitted to the secondary application includes a mobile directory number (MDN) of the primary mobile communication device, a device serial number of the primary mobile communication device, a timestamp, a primary flag set to false, a Quick Response (QR) code value, and a label.

8. The method of claim 1 , wherein trust is established with the primary mobile communication device by mobile access gateway (MAG) authentication, International Mobile Subscriber Identity (IMSI) encryption challenge, or self-identified IMSI.

Assignees

• Sprint Communications Co Lp

Inventors

• Hohler Ricky A
• Katzer Robin D
• Kota Deepthi
• Mauer Brian D

Classifications

• H04W12/40

  Security arrangements using identity modules · CPC title

• H04W12/084 Primary

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04W12/06

  Authentication · CPC title