Motorola Solutions, Inc.

Motorola Corporation

George Popovich

Vidya Narayanan

Anthony R Metke

Adam Cory Lewis

Christophe Janneteau

Shanthi E Thomas

Tyrone D Bekiares

Michael F Korus

Matthew C Keller

Katrin Reitsma

Steven D Upp

Randy L Ekl

Alejandro G Blanco

John W Maher

Aparna Pandey

Mario Frank DeRango

Thomas J Senese

Narayanan Venkitaraman

Robert D LoGalbo

Peter E Thomas

Shmuel Silverman

Erwin Himawan

Alexandru Petrescu

Narayanan Vidya

Dan McDonald

Mike Korus

Anthony E Metke

Method and system for authenticating a session on a communication device. One method includes determining a use context of the communication device and an authentication status of the communication device. The method further includes determining a predetermined period of time based on at least one of the use context and the authentication status. The method further includes generating biometric templates based on at least one of the use context and the authentication status. The method further includes selecting a matching threshold for the biometric templates based on at least one of the use context and the authentication status. The method further includes comparing a match score of each of the biometric templates to the matching threshold to determine a passing amount of biometric templates with match scores that meet or exceed the matching threshold. The method further includes authenticating the session on the communication device.

Method and system for authenticating a session on a communication device

A method and apparatus for providing a lifetime extension to an identity assertion is provided herein. During operation a user will authenticate to an identity management server (also known as an authorization server or an authentication server) to obtain an identity assertion. An identity assertion will be provided upon successful authentication. The lifetime of the identity assertion will be based on whether or not biometric information of the user will be used by the device to which the assertion is being issued to identify the user prior to allowing the use of the identity assertion.

Identity assertion based on biometric information

A first communication device having a secure access to a security module establishes a collaborative network by forming a collaborative security association with a second communication device associated with a user of the first communication device. The first communication device (a) sends an advertisement of services associated with the security module to the second communication device and receives an advertisement response from the second communication device or (b) receives a solicitation request for services associated with the security module from the second communication device. Responsive to receiving one of the advertisement response and the solicitation request, the first communication device determines whether the second communication device is authorized to access the security module. The first communication device processes and forwards security service messages between the second communication device and the security module, in response to determining that the second communication device is authorized to access the security module.

Apparatus and method for sharing a hardware security module interface in a collaborative network

An apparatus for, and method of, single sign-on collaboration among a plurality of mobile devices, includes a server for issuing a first identity token to subsequently authenticate a user of a first of the mobile devices to a service provider, and for generating and sending a collaboration key to the first device based on the first identity token or user authentication. The first device generates and sends a collaboration credential based on the collaboration key to a second device paired with the first device. The server also issues a second identity token to subsequently authenticate to the service provider the user of the second device based on the collaboration credential received from the first device, to support single sign-on collaboration for the user across the plurality of mobile devices.

Method and apparatus for single sign-on collaboraton among mobile devices

A method and apparatus for attaching a wireless device to a foreign wireless domain of a 3GPP communication system using an alternative authentication mechanism, wherein wireless device performs the method, which includes: sending a first attach request message to an infrastructure device in the foreign wireless domain; receiving an attach reject message from the infrastructure device upon an unsuccessful attempt to obtain authentication credentials for the wireless device from a home wireless domain of the wireless device using a standard 3GPP authentication mechanism; responsive to the attach reject message sending a second attach request message to the infrastructure device, wherein the second attach request message indicates an alternative authentication mechanism to the standard 3GPP authentication mechanism; and receiving an attach accept message from the infrastructure device when the wireless device is successfully authenticated using the alternative authentication mechanism.

Method and apparatus for attaching a wireless device to a foreign 3GPP wireless domain using alternative authentication mechanisms

A system for, and method of, single sign-on collaboration among a plurality of mobile devices, includes a server for issuing a first identity token to subsequently authenticate a user of a first of the mobile devices to a service provider, and for generating and sending a collaboration credential to the first device based on the first identity token or user authentication. The first device sends the collaboration credential generated by the server to a second device paired with the first device. The server also issues a second identity token to subsequently authenticate to the service provider the user of the second device based on the collaboration credential received from the first device, to support single sign-on collaboration for the user across the plurality of mobile devices.

Method and apparatus for single sign-on collaboration among mobile devices

Methods for establishing secure point-to-point communications in a trunked radio system include receiving, at a trunking controller, a request from a source endpoint for a traffic channel for confidential communications between the source endpoint and a destination endpoint using a shared unique first symmetric key. The trunking controller provides keying material related to the symmetric key over the secured control channel to at least one of the source or destination endpoints and assigns a traffic channel. Moreover, in response to the request, the controller assigns a traffic channel. The keying material enables the unique first symmetric key to be securely established between the source and destination endpoints.

Methods for establishing a secure point-to-point call on a trunked network

A method for obtaining authentication credentials for attaching a wireless device to a foreign wireless domain in a 3rd Generation Partnership Project (3GPP) communication system, which includes: receiving an attach request message from the wireless device; and responsive to the attach request message, authenticating the wireless device and retrieving a set of authentication vectors, wherein the authentication vectors are for authenticating the wireless device to the foreign wireless domain. The method further includes encrypting the set of authentication vectors using a first security key of a home wireless domain of the wireless device. In addition, the method includes encrypting the first security key using a second security key of the foreign wireless domain and sending the encrypted set of authentication vectors and the encrypted first security key to the wireless device.

Methods for obtaining authentication credentials for attaching a wireless device to a foreign 3GPP wireless domain

Techniques are provided for enabling application steering/blocking in a secure network which includes a network entity, and a first tunnel endpoint coupled to the network entity over an encrypted tunnel. The first tunnel endpoint associates at least a first Security Parameter Index (SPI) to a first application identifier to generate first mapping information (MI), communicates the first MI to the network entity, and transmits an encrypted message to the network entity over the encrypted tunnel. The encrypted message includes an encrypted packet and an unencrypted header including the first SPI. The network entity determines the first SPI from the unencrypted header, determines the first application identifier based on the first SPI and the first MI, and identifies a first application associated with the first application identifier. The network entity can still perform application steering/blocking even though traffic passing through the tunnel is encrypted.

Application steering and application blocking over a secure tunnel

A method () of communicating an IPv6 packet () over an IPv4 based network (). The method can include receiving the IPv6 packet to be communicated to a remote unit (), encapsulating the IPv6 packet in an IPv4 transition packet (), and communicating the IPv4 transition packet to an IPv4 MVPN () server configured to communicate the packet to the remote unit via infrastructure of an IPv4 radio access network. Another aspect of the present invention relates to a method of processing an IPv6 packet received over an IPv4 based network. The method can include receiving from an MVPN server an IPv4 formatted packet that is being communicated to a remote unit, and removing from the packet at least one IPv4 header to result in the packet being formatted in accordance with IPv6.

Combining mobile VPN and internet protocol

The disclosure relates to techniques and technologies for providing mobile wireless broadband coverage. In one implementation, Wireless Wide Area Broadband (WWAB) network elements are provided in a Vehicular Area Network (VAN) that also includes a Mobile Network Controller (MNC). The WWAB network elements in the VAN include at least one WWAB base station (BS). A mobility protocol tunnel is provided between a Mobility Management Server (MMS) and the MNC to make mobility of the WWAB network elements in the VAN transparent to the WWAB network elements in the fixed infrastructure. The WWAB BS and the MNC can allow a WWAB-enabled mobile station (MS) to connect to WWAB network elements in the fixed infrastructure.

Wireless wide area broadband coverage in a vehicular area network (VAN)

A method for minimizing tunnels in a network, apparatus and computer-readable storage medium having computer readable code stored thereon for programming a computer to perform the method. The method includes the steps of: obtaining state information associated with a first node connected to a mobile network behind a mobile node; receiving a first message sent between the first node and a correspondent node, wherein a first header was removed from the first message prior to sending the first message; recreating, in one of the mobile node and a mobility agent, the first header using the state information; and sending the first message with the first header.

Optimized tunneling methods in a network

A method as provided enables mutual authentication of nodes in a wireless communication network. The method includes processing at a first node a beacon message received from a second node, wherein the beacon message comprises a first nonce value (step). An association request message comprising a certificate of the first node, a first signed block of authentication data, and a second nonce value is then transmitted from the first node to the second node (step). The second node can then verify a signature of the certificate of the first node and verify a signature of the first signed block of authentication data. An association reply message received from the second node is then processed at the first node (step), whereby the first node verifies a signature of a certificate of the second node and verifies a signature of a second signed block of authentication data.

Method and system for mutual authentication of nodes in a wireless communication network

A method for is disclosed in which a first message is received from a first device. Upon receipt of the first message, a registration request is transmitted via the first device to a home agent for pre-registration of a co-located care-of address associated with a second device. The registration request includes the co-located care-of address associated with the second device. If the first message is received again from the first device prior to attaching to the second device, the registration request is re-transmitted via the first device.

Method for improving the reliability of low latency handoffs

System and method are provided for establishing internet protocol (IP) communication between a mobile node (MN) and one or more mobile networks. The method includes receiving () a request from a MN when the MN joins a first mobile network, creating () routing information indicating a home address of the MN, and announcing () the home address to the nodes of the mobile network(s). The request indicates the home address of the MN.

Growing community of inventors

Palatine, IL, United States of America

George Popovich