Patent ID: 8539559

Claim:
A method of separating authentication and authorization services in a communications system, comprising the steps of: authenticating a client node via an authenticating server; receiving, by an authorizing server, a service request from the client node, wherein the service request is signed by using a token key generated by the client node; forwarding, by the authorizing server, the service request and usage data for the requested service to the authenticating server, and receiving a confirmation and a service usage specific root key (USRK) from the authenticating server, wherein the USRK is generated based upon the usage data; and authorizing, by the authorizing server, the client node for the requested service based upon the confirmation and the USRK, wherein an Extensible Authentication Protocol (EAP) master session key (EMSK) is generated, wherein the token key or the USRK is generated based on the EMSK.