Patent ID: 11863663
Assignee: TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 9:
10. A method comprising:
an authentication server receiving a first message transmitted by a network node, wherein the first message comprises an identity module challenge that the network node received from a communication device, and wherein the authentication server establishes a secure connection with the network node before receiving the first message;
the authentication server verifying that at least one public key identifier of an identity module included in the first message is trusted by the authentication server, wherein the at least one public key identifier is used for a remote subscription profile download to the identity module;
the authentication server transmitting a second message towards the communication device in response to verifying the at least one public key identifier of the identity module is trusted by the authentication server, wherein the second message comprises an ephemeral public key of the authentication server, an authentication server challenge, and an authentication server signature, and wherein the authentication server signature is based on the ephemeral public key of the authentication server, the authentication server challenge, and the identity module challenge and follows a format used for handling the remote subscription profile download to the identity module;
the authentication server receiving a third message transmitted by the network node in response to the second message, wherein the third message comprises an ephemeral public key of the communication device and an identity module signature, and wherein the identity module signature is based on identity module credentials used for the remote subscription profile download to the identity module and is based on the ephemeral public key of the communication device and the authentication server challenge and follows the format used for the remote subscription profile download to the identity module;
the authentication server verifying identity of the communication device by matching an identifier of the communication device received in the third message with a list of identifiers, wherein an initial network access is granted only when a match is found in the list of identifiers;
the authentication server establishing a secret using the ephemeral public key of the communication device and a private key corresponding to the ephemeral public key of the authentication server;
the authentication server generating a master session key (MSK) using the established secret, wherein the MSK is associated with the ephemeral public key of the communication device and the private key of the authentication server;
and the authentication server providing the MSK to the network node for the network node to use the MSK when establishing secure communications with the communication device located remotely from the network node.