Abstract: Persistent communication layer credentials generated on a persistent communication layer at one network may be leveraged to perform authentication on another. For example, the persistent communication layer credentials may include application-layer credentials derived on an application layer. The application-layer credentials may be used to establish authentication credentials for authenticating a mobile device for access to services at a network server. The authentication credentials may be derived from the application-layer credentials of another network to enable a seamless handoff from one network to another. The authentication credentials may be derived from the application-layer credentials using reverse bootstrapping or other key derivation functions. The mobile device and/or network entity to which the mobile device is being authenticated may enable communication of authentication information between the communication layers to enable authentication of a device using multiple communication layers.

Abstract: A constrained network entity may determine, via an authentication procedure with a core network entity, the trustworthiness of an endpoint attempting to establish a secure channel with the constrained network entity. The constrained network entity may receive a certificate from the endpoint attempting to establish the secure channel and the constrained network entity may send the certificate asserted by the endpoint to a core network entity for validation. The core network entity may receive the certificate during a key exchange with the constrained network entity and the core network entity may indicate to the constrained network entity the validity of the certificate. The constrained network entity may determine whether to establish the secure channel with the endpoint based on the validity of the certificate.

Abstract: A wireless communications device may be configured to perform integrity checking and interrogation with a network entity to isolate a portion of a failed component on the wireless network device for remediation. Once an integrity failure is determined on a component of the device, the device may identify a functionality associated with the component and indicate the failed functionality to the network entity. Both the wireless network device and the network entity may identify the failed functionality and/or failed component using a component-to-functionality map. After receiving an indication of an integrity failure at the device, the network entity may determine that one or more additional iterations of integrity checking may be performed at the device to narrow the scope of the integrity failure on the failed component. Once the integrity failure is isolated, the network entity may remediate a portion of the failed component on the wireless communications device.

Abstract: Systems, methods, and instrumentalities are disclosed to provide secure operations in an M2M device. An M2M device may receive an indication that an operation to be performed is security sensitive. The M2M device may determine that the operation is to be performed in a secure environment on the M2M device. The secure environment may be a logically distinct portion of the M2M device. The determination may be made in in accordance with a policy. For example, the M2M device may determine that the operation meets a requirement specified in the policy indicating that the operation is to be performed in the secure environment. The M2M device may perform the operation in the secure environment on the M2M device. The M2M device may store a result relating to the operation in the secure environment.

Abstract: Systems, methods, and apparatus are disclosed for coordinating enforcement of policies on a network and/or a wireless transmit/receive unit. The policies may include stakeholder-specific policies of one or more stakeholders that provide services on a user equipment. Enforcement of the stakeholder-specific policies may be securely coordinated using a policy coordination function. Systems, methods, and apparatus are also disclosed that include a network policy coordination function (NPCF) that coordinates service control policies and access control policies. The NPCF may coordinate enforcement of the service control policies for one or more service control entities and the access control policies for one or more access control entities.

Abstract: Systems, methods, and instrumentalities are disclosed that provide for a gateway outside of a network domain to provide services to a plurality of devices. For example, the gateway may act as a management entity or as a proxy for the network domain. As a management entity, the gateway may perform a security function relating to each of the plurality of devices. The gateway may perform the security function without the network domain participating or having knowledge of the particular devices. As a proxy for the network, the gateway may receive a command from the network domain to perform a security function relating to each of a plurality of devices. The network may know the identity of each of the plurality of devices. The gateway may perform the security function for each of the plurality of devices and aggregate related information before sending the information to the network domain.

Abstract: Integrity validation of a network device may be performed. A network device comprising a secure hardware module, may receive a root key. The secure hardware module may also receive a first code measurement. The secure hardware module may provide a first key based on the root key and the first code measurement. The secure hardware module may receive a second code measurement and provide a second key based on the first key and the second code measurement. The release of keys based on code measurements may provide authentication in stages.

Abstract: Methods, components and apparatus for implementing platform validation and management (PVM) are disclosed. PVM provides the functionality and operations of a platform validation entity with remote management of devices by device management components and systems such as a home node-B management system or component. Example PVM operations bring devices into a secure target state before allowing connectivity and access to a core network.

Abstract: A processor, scan controller, and method for protecting sensitive information from electronic hacking is disclosed. To maintain the security of the sensitive data present in a processor, the scan controller denies access to the scan chain until data is cleared from scan-observable portions of the processor, then clears the scan chain again prior to exiting test mode and resuming normal operation. Clearing or otherwise modifying data stored in the scan-observable portions of a processor when transitioning to and/or from a test mode will prevent unauthorized personnel from simply shifting secure data out of the scan chain, and from pre-loading data into the scan chain prior to normal operation in an attempt to set sensitive state information.

Abstract: A processor, scan controller, and method for protecting sensitive information from electronic hacking is disclosed. To maintain the security of the sensitive data present in a processor, the scan controller denies access to the scan chain until data is cleared from scan-observable portions of the processor, then clears the scan chain again prior to exiting test mode and resuming normal operation. Clearing or otherwise modifying data stored in the scan-observable portions of a processor when transitioning to and/or from a test mode will prevent unauthorized personnel from simply shifting secure data out of the scan chain, and from pre-loading data into the scan chain prior to normal operation in an attempt to set sensitive state information.

Abstract: A processor, scan controller, and method for protecting sensitive information from electronic hacking is disclosed. To maintain the security of the sensitive data present in a processor, the scan controller denies access to the scan chain until data is cleared from scan-observable portions of the processor, then clears the scan chain again prior to exiting test mode and resuming normal operation. Clearing or otherwise modifying data stored in the scan-observable portions of a processor when transitioning to and/or from a test mode will prevent unauthorized personnel from simply shifting secure data out of the scan chain, and from pre-loading data into the scan chain prior to normal operation in an attempt to set sensitive state information.

Abstract: Methods and apparatus are provided for an electronic device having an autonomous memory checker for runtime security assurance. The autonomous memory checker comprises a controller, a memory reference file coupled to the controller, and an authentication engine coupled to the controller. A check is performed during runtime operation of the electronic device. The autonomous memory checker generates runtime reference values corresponding to trusted information stored in memory. The runtime reference values are compared against memory reference values stored in the memory reference file. The memory reference values are generated from the trusted information stored in memory. An error signal is generated when the runtime reference values are not identical to the memory reference values thereby indicating that the trusted information has been modified.

Abstract: A processor, scan controller, and method for protecting sensitive information from electronic hacking is disclosed. To maintain the security of the sensitive data present in a processor, the scan controller denies access to the scan chain until data is cleared from scan-observable portions of the processor, then clears the scan chain again prior to exiting test mode and resuming normal operation. Clearing or otherwise modifying data stored in the scan-observable portions of a processor when transitioning to and/or from a test mode will prevent unauthorized personnel from simply shifting secure data out of the scan chain, and from pre-loading data into the scan chain prior to normal operation in an attempt to set sensitive state information.