Telefonaktiebolaget Lm Ericsson (publ)

Bengt Sahlin

Karl Norrman

Mats Näslund

Jari Arkko

Stefan Rommer

Vesa Lehtovirta

Rolf Blom

Ralf Keller

George Foti

Vesa Torvinen

Anna Larmo

Michael Liljenstam

Kristian Slavov

Jani Hautakorpi

Mary Amarisa Robison

Mats Naslund

A method, implemented by a security relay node in a Public Land Mobile Network, PLMN, wherein the method comprising the steps of receiving, from a Network Function, NF, within the PLMN, a control packet to be provided to a further PLMN, relaying said control packet to a remote security node for delivery of the control packet to the further PLMN, wherein the remote security node being outside of both the PLMN and being outside the further PLMN.

Distributed network edge security architecture

A communication device of a communication network receives, via a network, a challenge, generates a first Diffie Hellman, DH, parameter, a first verification code for the first DH parameter, forwards the challenge or a derivative thereof to an identity module, receives at least one result parameter as response from the identity module, determines, based on the result parameter, whether the first DH parameter is authentic, and if the first DH parameter is authentic, generates and sends a second DH parameter to the network device for session key generation based on the first DH parameter and the second DH parameter.

Communication between a communication device and a network device

A user equipment receives an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA') message, from an authentication server related to the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through an access network. The user equipment sets up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP AKA&#x2032; message indicating that the access network is untrusted.

Access through non-3GPP access networks

A first network device of a first communication network obtains a challenge, generates a first PFS parameter, obtains a first verification code for the first PFS parameter, and sends the challenge, the first PFS parameter and the first verification code to a communication device, which in turn receives the challenge, the first PFS parameter and the first verification code, forwards the challenge or a derivative thereof to an identity module, receives at least one result parameter as response from the identity module, determines, based on the result parameter, whether the first PFS parameter is authentic, and if the determination is positive generates and sends the second PFS parameter to the first network device, which in turn verifies the second PFS parameter.

When setting up communication from a user equipment UE (), such as for providing IP access for the UE in order to allow it to use some service, information or an indication of at least one network property relating to a first network, e.g. the current access network ('), is sent to the UE from a node () in a second network such as the home network () of the subscriber of the UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (&#x2032;) is trusted or not.

A method and arrangement for distributing a security policy to a communication terminal having an association with a home communication network, but being present in a visited communication network. The home communication network generates its own preferred security policy Ph and the visited communication network generates its own preferred security policy Pv. A communication network entity in the visited communication network combines the security policies and selects security algorithms and/or functions to apply from the combined security policy. By generating security policy vectors of both networks and combining them before the security algorithms are selected, both networks are able to influence the selection without requiring the use of signaling messages.

Security policy distribution to communication terminals

When setting up communication from a user equipment UE (), such as for providing IP access for the UE in order to allow it to use some service, information or an indication or at least one network properly relating to a first network, e.g. the current access network ('), is sent to the UE from a node () in a sue and network such as the home network () of the subscriber ask UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (&#x2032;) is trusted or not.

A method of authenticating a user access network to a mobile node, where the mobile node wishes to access a service via the access network, the method comprising:

Growing community of inventors

Espoo, Finland

Bengt Sahlin