Abstract: A mediation server for mediating subscription information to a communication device from a network operator providing network connectivity is provided. The server includes a management unit for managing context information of a communication device, which includes data relating to service provided by a network operator; an obtaining unit for obtaining device information of the communication device, which includes data needed to obtain subscription information from a network operator; a selecting unit for selecting, using the context information, a network operator that provides the best service to the communication device out of network operators that are able to provide network connectivity to the communication device; and a request unit for sending a request, with the obtained device information to the selected network operator, for subscription information which is to be used for the communication device to connect to the selected network operator as a home network operator.

Abstract: There is provided a mobile terminal for use in a system which includes a backend server having a first encryption key and an onboard unit (OBU). A first receiving unit receives, from the backend server, a base shared key encrypted with a second encryption key, the base shared key encrypted with the first encryption key, and a digital signature. A deriving unit decrypts the base shared key with the second encryption key and derives first authentication information based on the base shared key and a first temporary parameter. A second sending unit sends, to the OBU, the base shared key encrypted with the first encryption key, the digital signature, the first authentication information, identification information of the base shared key, and the first temporary parameter.

Abstract: There is provided an apparatus (134) for managing assignment of subscription modules (307) for a group (141) of communication devices (140a-140n). The apparatus includes a receiving unit (203) configured to receive a request for assigning a subscription module to a target communication device (140j) so that the target communication device can attach to a network managed by a network (110) operator; and a control unit (205) configured to identify a group which includes the target communication device, determine whether the number of subscription modules which are assigned to the communication devices in the identified group reaches the upper bound, and when the number of the subscription modules does not reach the upper bound, assign a subscription module to the target communication device.

Abstract: A communication device comprising a central processing unit (CPU) and a memory device is disclosed. The CPU is configured to send a first attach request including a first subscription identity (FSI) to the network apparatus, receive an authentication request including a random number and an authentication token from the network apparatus as a response to the first attach request. Further, the CPU is configured to authenticate the authentication token using the random number and a first key associated with the FSI, obtain a second key and a second subscription identity (SSI) in response to authentication of the authentication token failing, where SSI is obtained from the authentication request. The CPU is further configured to send an authentication failure to the network apparatus. The second key and SSI are stored in the memory device such that the second key is associated with SSI.

Abstract: There is provided a mobile terminal for use in a system which includes a backend server having a first encryption key and an onboard unit (OBU).A first receiving unit receives, from the backend server, a base shared key encrypted with a second encryption key, the base shared key encrypted with the first encryption key, and a digital signature. A deriving unit decrypts the base shared key with the second encryption key and derives first authentication information based on the base shared key and a first temporary parameter. A second sending unit sends, to the OBU, the base shared key encrypted with the first encryption key, the digital signature, the first authentication information, identification information of the base shared key, and the first temporary parameter.

Abstract: An operator selecting apparatus and a method for selecting a home operator for each communication device in a group. A first selecting unit of the operator selecting apparatus selects, for each quality-oriented communication device in the group, a candidate operator out of a plurality of the candidate operators that is determined based on the quality information to provide the best quality of service to the communication device. The second selecting unit of the operator selecting apparatus then selects, for each cost-oriented communication device in the group, based on the billing system and a number of quality-oriented communication devices assigned to the each candidate operator as a result of the selection by the first selecting unit, a candidate operator out of the plurality of the candidate operators such that a total cost for all the communication devices in the group becomes lowest.

Abstract: A gateway apparatus comprises a registration unit for registering a network address, a temporary address and a flag, a receiving unit for receiving data destined to a destination communication device with the network address of the destination communication device from a source communication device, a determination unit for determining whether the destination communication device is provided with the MCIM or not, based on a registered value of the flag, and transmitting unit for transmitting a bootstrap message for requesting initiation of provisioning of a predetermined identifier to the destination communication device, to a provision server, when it is determined that the destination communication device is not provided with the MCIM, wherein the transmitting unit transmits the data to the destination communication device using the assigned temporary address, when the destination communication device is provided with the MCIM.

Abstract: There is provided a Local Breakout Gateway node for use in a hierarchical mobile network. The node comprises a database, which stores a plurality of Local Breakout Policy rules. The node further comprises a receiver for receiving an IP packet from a Mobile Node attached to the network at which the node is located, the network being a visited network for the Mobile Node. The node further comprises means for selecting a Local Breakout Policy from the plurality of Local Breakout Policy rules, and means to apply the selected Local Breakout Policy to the received IP packet. The node further comprises a Network Address translation function to apply a Network Address Translation to the received IP packet, and a transmitter for sending the IP packet to a destination according to the applied Local Breakout Policy.

Abstract: The present invention relates to auto-provision of wireless devices. A wireless device (1) has a device identifier and a first private key generated from the device identifier. A registration server (5) has an operator identifier and a second private key generated from the operator identifier. The wireless device (1) transmits the device identifier to the registration server (5), and the registration server (5) transmits a subscriber identifier to the wireless device (1). The wireless device (1) generates a shared key based on the operator identifier and the first private key, and the registration server (5) generates the shared key based on the device identifier and the second private key.

Abstract: A method and apparatus for managing roaming of a Mobile Node in a Visited network. The Mobile Node is associated with a Home network. In the Visited network, a server selects a Gateway node for use by the Mobile Node based on selection criteria. The server then sends a message to an access node in the Visited network to which the Mobile Node is attached, the message identifying the selected Gateway node. This instructs the Mobile Node to communicate with its Home network via the selected Gateway Node.

Abstract: In the first embodiment, the mobile phone 20 obtains the PCID from the CCE 10, and sends the PCID and the IMSI of the USIM of the mobile phone 20 to the CAPS 50. The MCC+MNC part of the IMSI is later used as the operator identification information by the mediation server 30, which is operated by the RO, in order to identify the SHO for the CCE 10. The MSIN part of the IMSI is later used as the user identification information by the account managing server 40, which is operated by the SHO, in order to identify the user of the mobile phone 20. The mediation server 30 forwards the account request from the CCE 10 to the account managing server 40 of the SHO identified by the operator identification information. The account managing server 40 generates the MCIM that is associated with the user identified by the user identification information.

Abstract: There is provided a telephone that is capable of accessing a memory for storing subscription information that includes a phone number. The telephone comprises, among other things: a searching unit that searches the memory for second subscription information that is different from the first subscription information selected by the selecting unit; an obtaining unit that obtains a first phone number included in the first subscription information and transfer source information that enables a call transfer server of a network operator associated with the second subscription information to identify a second phone number included in the second subscription information; and a sending unit that sends, to the call transfer server, a call transfer request for requesting the network operator to transfer a call addressed to a phone number, which is identified by the call transfer server based on the transfer source information, to the first phone number.

Abstract: There is provided a mediation server. The mediation server comprises, among other things, a device identity receiving unit configured to receive, from a communication device, a device identity which enables the communication device to connect to a network operated by a network operator associated with the mediation server, a login request sending unit configured to send, to the communication device, a login request for requesting login credentials for one of at least one user identity associated with the device identity, and a login credentials receiving unit configured to receive the login credentials from the communication device. The mediation server also comprises a subscription information relaying unit configured to obtain subscription information for use by the communication device from a selected network, and forward the obtained subscription information to the communication device.

Abstract: There is provided an apparatus (134) for managing assignment of subscription modules (307) for a group (141) of communication devices (140a-140n). The apparatus includes a receiving unit (203) configured to receive a request for assigning a subscription module to a target communication device (140j) so that the target communication device can attach to a network managed by a network (110) operator; and a control unit (205) configured to identify a group which includes the target communication device, determine whether the number of subscription modules which are assigned to the communication devices in the identified group reaches the upper bound, and when the number of the subscription modules does not reach the upper bound, assign a subscription module to the target communication device.

Abstract: A method and apparatus for use in a Proxy Mobile IP communications network. An anchor point function serves at least one mobile host. The anchor point function generates an IP address for use by the mobile host, the address being generated using cryptographic materials owned by the anchor point function. The anchor point function can then perform signalling on behalf of the mobile host, using the IP address generated for the mobile host and at least part of the cryptographic materials used to generate the IP address.

Abstract: The present invention concern a methods and an apparatus for exchanging data between a user equipment and a core network via a security gateway. The invention concerns the establishment of an inactive pair of tunnel mode security associations between the UE and the security gateway, as well as the application of the pair of security associations when the UE detects attachment to or need to attach to an untrusted access network.

Abstract: There is provided an authentication server. The server includes a receiving unit configured to receive a request from a network apparatus. The request includes a subscription identity. The server further includes a determination unit configured to determine whether the received subscription identity is a predetermined subscription identity and an obtaining unit configured to obtain, when it is determined that the received subscription identity is the predetermined subscription identity, a key and a subscription identity. The key is derived by applying a key derivation function to a random number and a key associated with the predetermined subscription identity. The server further includes a storage unit configured to store the obtained key and the obtained subscription identity and a response unit configured to send a response including the random number and an authentication token to the network apparatus. The authentication token includes the obtained subscription identity.

Abstract: There is provided a service node that is capable of serving a first user node in a first network including a control node. The first network is capable of communicating with a second network including a second user node. The service node comprises: a request receiving unit that receives a first user identity that identifies the first user node and a second user identity that identifies the second user node; a determining unit that determines whether a received message includes the first user identity as a destination, or the message includes auxiliary information that corresponds to the first user identity; and a modifying unit that modifies the destination of the message to the second user identity and modifies the source of the message to the first user identity in accordance with the determination result by the determining unit.

Abstract: A method and apparatus for managing roaming of a Mobile Node in a Visited network. The Mobile Node is associated with a Home network. In the Visited network, a server selects a Gateway node for use by the Mobile Node based on selection criteria. The server then sends a message to an access node in the Visited network to which the Mobile Node is attached, the message identifying the selected Gateway node. This instructs the Mobile Node to communicate with its Home network via the selected Gateway Node.

Abstract: Apparatus for providing a gateway between a residential network and a Wide Area Network including a packet core network of a cellular telecommunication system. The apparatus comprises an IP router for routing IP packets between a user equipment attached to the residential network, and said Wide Area Network. A detector is employed to detect attachment of user equipment to said packet core network, while a tunnel establishment unit is configured, upon detection of attachment of a user equipment to said packet core network by said detector, to establish an IP packet tunnel between itself and a Broadband Network Gateway of said packet core network. Thereafter, said IP router is configured to route IP packets to and from the attached user equipment via said IP tunnel.