Abstract: Persistent communication layer credentials generated on a persistent communication layer at one network may be leveraged to perform authentication on another. For example, the persistent communication layer credentials may include application-layer credentials derived on an application layer. The application-layer credentials may be used to establish authentication credentials for authenticating a mobile device for access to services at a network server. The authentication credentials may be derived from the application-layer credentials of another network to enable a seamless handoff from one network to another. The authentication credentials may be derived from the application-layer credentials using reverse bootstrapping or other key derivation functions. The mobile device and/or network entity to which the mobile device is being authenticated may enable communication of authentication information between the communication layers to enable authentication of a device using multiple communication layers.

Abstract: Systems, methods and apparatus embodiments are described herein for authenticating a user and/or a user equipment (UE). For example, a user and/or UE may request access to a service controlled by a service provider (SP). The user may be authenticated by an identity provider (IdP), producing a result. A user assertion may be provided to the SP, and the user assertion may comprise the user authentication result. The UE may be authenticated with another IdP, producing an associated result. A device assertion may be provided to the SP and may comprise the device authentication result. A master IdP may bind the assertions together and a consolidated assertion may be provided to the SP so that the user/UE can receive access to a service that is provided by the SP.

Abstract: A user equipment (UE, 301) comprises communication circuitry that establishes communication with a network, at least one processor, a plurality of security modules (104), a plurality of cryptographic function modules (304), and a cryptographic framework module (302). The security modules (104) may each implement a different security method for securely communicating or authenticating with the network. Each different security method may require execution of one or more of a plurality of different cryptographic functions (302). Each of the cryptographic function modules may execute one or more of the plurality of different cryptographic functions. For example, the cryptographic framework module (302) may receive a request from a select one security module (104).

Abstract: Wireless telecommunications networks may implement various forms of authentication. There are a variety of different user and device authentication protocols that follow a similar network architecture, involving various network entities such as a user equipment (UE), a service provider (SP), and an authentication endpoint (AEP). To select an acceptable authentication protocol or credential for authenticating a user or UE, authentication protocol negotiations may take place between various network entities. For example, negotiations may take place in networks implementing a single-sign on (SSO) architecture and/or networks implementing a Generic Bootstrapping Architecture (GBA).

Abstract: Persistent communication layer credentials generated on a persistent communication layer at one network may be leveraged to perform authentication on another. For example, the persistent communication layer credentials may include application-layer credentials derived on an application layer. The application-layer credentials may be used to establish authentication credentials for authenticating a mobile device for access to services at a network server. The authentication credentials may be derived from the application-layer credentials of another network to enable a seamless handoff from one network to another. The authentication credentials may be derived from the application-layer credentials using reverse bootstrapping or other key derivation functions. The mobile device and/or network entity to which the mobile device is being authenticated may enable communication of authentication information between the communication layers to enable authentication of a device using multiple communication layers.

Abstract: Wireless telecommunications networks may implement various forms of authentication. There are a variety of different user and device authentication protocols that follow a similar network architecture, involving various network entities such as a user equipment (UE), a service provider (SP), and an authentication endpoint (AEP). To select an acceptable authentication protocol or credential for authenticating a user or UE, authentication protocol negotiations may take place between various network entities. For example, negotiations may take place in networks implementing a single-sign on (SSO) architecture and/or networks implementing a Generic Bootstrapping Architecture (GBA).

Abstract: WTRUs, ARSs, APs, WLG/AAA proxies, networks, and methods thereon are disclosed for fast security setup on a multi-RAT WTRU. Methods of sharing security associations between RATs on a multi-RAT WTRU are disclosed. Methods of caching security associations are disclosed. Methods are disclosed for alerting an ANDSF server of an AP that should be considered for association. Enhancements to advertisements from an AP are disclosed where the advertisements may include SSID with a FQDN, a HESSID type information, or TAI type information. Methods of resolving AP identities to a reachable address are disclosed. An address resolution protocol is disclosed for resolving AP identities. ARSs are disclosed that may resolve a BSSID to a network routable address. Protocols for carrying AP identities and security parameters are disclosed. Methods are disclosed of using ANDSF to provide the WTRU with security information and parameters of an AP. An RSN may indicate security capabilities.

Abstract: A method for use in a wireless station includes receiving a fast initial link setup discovery (FD) frame from an access point (AP) between instances of a full beacon frame and determining whether to associate with the AP based on the received FD frame. The FD frame includes FD frame contents and a FD frame control field. The FD frame control field includes a service set identifier (SSID) length field, corresponding to a length of a variable length SSID field in the FD frame contents; and any one or more of: a capability presence indicator, an access network options presence indicator, a security presence indicator, an AP configuration change count presence indicator, or an AP next target beacon transmission time presence indicator. Each of the presence indicators is used to indicate whether a corresponding field is present in the FD frame contents.

Abstract: Wireless telecommunications networks may implement various forms of authentication. There are a variety of different user and device authentication protocols that follow a similar network architecture, involving various network entities such as a user equipment (UE), a service provider (SP), and an authentication endpoint (AEP). To select an acceptable authentication protocol or credential for authenticating a user or UE, authentication protocol negotiations may take place between various network entities. For example, negotiations may take place in networks implementing a single-sign on (SSO) architecture and/or networks implementing a Generic Bootstrapping Architecture (GBA).

Abstract: A method and apparatus for interworking between a mobile network operator and an application provider are disclosed. A network application function (NAF) may be co-located with an OpenID provider such that an application server may communicate with the NAF to access a home subscriber server (HSS) via a bootstrapping server function (BSF). The interfaces between BSF and HSS, and between BSF and NAF may be enhanced to carry information that is available through Sh interface between the application server and the HSS. When the WTRU is roaming in a visited network, the application server may communicate with the visited network for charging and policing for serving the service request from the WTRU. The application server may be co-located with an NAF, and may authenticate the WTRU using Generic Bootstrapping Architecture, and may communicate with a BSF in a home network via an eZn-proxy function to access an HSS.

Abstract: Persistent communication layer credentials generated on a persistent communication layer at one network may be leveraged to perform authentication on another. For example, the persistent communication layer credentials may include application-layer credentials derived on an application layer. The application-layer credentials may be used to establish authentication credentials for authenticating a mobile device for access to services at a network server. The authentication credentials may be derived from the application-layer credentials of another network to enable a seamless handoff from one network to another. The authentication credentials may be derived from the application-layer credentials using reverse bootstrapping or other key derivation functions. The mobile device and/or network entity to which the mobile device is being authenticated may enable communication of authentication information between the communication layers to enable authentication of a device using multiple communication layers.

Abstract: At least data link information generated at a medium access control layer or physical link information generated at a physical layer is used to send information to a media independent handover layer.

Abstract: At least one trigger at a point-to-point protocol layer indicating a status of a point-to-point link is generated and sent to a media independent handover entity.