Abstract: A method, apparatus and computer program product are provided to provide fresh security context during intersystem mobility. A method is provided which includes receiving an indication of handover of a remote device from a source system to a target system. The target system may implement a communications standard different from that of the source system. The method also includes determining a current sequence number value of a security context maintained in the source system. The method additionally includes deriving a fresh mapped security context for the target system based at least in part upon the determined sequence number value. The method further includes providing the derived fresh mapped security context to the target system.

Abstract: It is disclosed a method comprising receiving, prior to a handover operation, first key indication information, creating, prior to the handover operation, key information based on the received first key indication information, retaining the created key information, sending, after the handover operation, the received first key indication information associated with the key information created prior to the handover operation, and retrieving, after the handover operation, the retained key information based on the first key indication information; and a method comprising generating, prior to the handover operation, the first key indication information associated with key information intended to be created, sending, prior to the handover operation, the generated first key indication information, and receiving, after the handover operation, second key indication information corresponding to the generated first key indication information.

Abstract: In a non-limiting and exemplary embodiment, a method is provided for arranging authentication of mobility related signalling messages in a mobile communications system. An authentication code is generated on the basis of a previous authentication code stored in connection with a preceding authentication code generation event. The newly generated authentication code is stored for subsequent authentication code generation event. In response to change of the mobile device to an access network of the network entity, a control message comprising the authentication code is transmitted from a mobile device to a first network entity, for verifying the authentication code by the first network entity or by a second network entity of a previous access system.

Abstract: It is disclosed a method comprising receiving, prior to a handover operation, first key indication information, creating, prior to the handover operation, key information based on the received first key indication information, retaining the created key information, sending, after the handover operation, the received first key indication information associated with the key information created prior to the handover operation, and retrieving, after the handover operation, the retained key information based on the first key indication information; and a method comprising generating, prior to the handover operation, the first key indication information associated with key information intended to be created, sending, prior to the handover operation, the generated first key indication information, and receiving, after the handover operation, second key indication information corresponding to the generated first key indication information.

Abstract: A method, apparatus and computer program product are provided to provide cryptographical key separation for handovers. A method is provided which includes calculating a key based at least in part upon a previously stored first intermediary value. The method also includes calculating a second intermediary value based at least in part upon the calculated key. The method additionally includes sending a path switch acknowledgement including the second intermediary value to a target access point. The method may further include receiving a path switch message including an indication of a cell identification and calculating the encryption key based upon the indication of the cell identification. The method may further include storing the second intermediary value. The calculation of the key may further comprise calculating the key following a radio link handover. Corresponding apparatuses and computer program products are also provided.

Abstract: A method, apparatus and computer program product are provided to provide fresh security context during intersystem mobility. A method is provided which includes receiving an indication of handover of a remote device from a source system to a target system. The target system may implement a communications standard different from that of the source system. The method also includes determining a current sequence number value of a security context maintained in the source system. The method additionally includes deriving a fresh mapped security context for the target system based at least in part upon the determined sequence number value. The method further includes providing the derived fresh mapped security context to the target system.

Abstract: In a non-limiting and exemplary embodiment, a method is provided for arranging authentication of mobility related signalling messages in a mobile communications system. An authentication code is generated on the basis of a previous authentication code stored in connection with a preceding authentication code generation event. The newly generated authentication code is stored for subsequent authentication code generation event. In response to change of the mobile device to an access network of the network entity, a control message comprising the authentication code is transmitted from a mobile device to a first network entity, for verifying the authentication code by the first network entity or by a second network entity of a previous access system.

Abstract: The present invention relates to a method, tunnel protocol layer, and network device for securing a data packet on a network link. A security layer is provided in the tunneling protocol layer of the wireless network, and a secured data packet is generated by adding to the data packet a header in accordance with said security layer of the tunneling protocol. The secured data packet is then transmitted over the link by using a link layer connection.