Abstract: This document describes an EAP method used for extending EAP functionality. The extended functionality includes channel binding and re-authentication. The EAP method also allows sequencing of multiple EAP methods inside it.

Abstract: The present invention advantageously provides several systems and methods for solving the trombone routing issues within an IMS/MMD network. These approaches avoid trombone routing, speed up handoff, and increase the efficiency of signaling and overall performance of an IMS/MMD network. These solutions can broadly be divided into the following categories. Piggy-backing SIP registration over MIP (Split at FA); Selective Reverse Tunneling and Tunneling between FA and P-CSCF; the SIP-based mobility protocol; use of CoA during SIP registration and call up in MIPv6; Piggy-backing SIP registration when HA and S-CSCF Co-exist; Using Dynamic Home Agents in MIPv4 FA-CoA; and the Interceptor-Caching Approach.

Abstract: A system for proactively authenticating includes a server having media independent access functions including media independent authentication functions that authenticates other entities attached via an interface to an end of a link specific to a media. A plurality of heterogeneous networks each having media specific access functions including authentication functions corresponding to the other entities attached via the interface to the end of the link specific to the media and mobile devices connected to the plurality of heterogeneous networks, and the server having predefined media independent handover protocols and media independent handover identities based on the media independent functions related to handover, in which the server authenticates candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks each of which belonging to the plurality of heterogeneous access networks having the link specific to the media.

Abstract: In a telecommunications network in which a mobile handset is capable of communicating in both an IP domain and a non-IP domain, the handoff of an existing communications session between the mobile handset and a fixed user is facilitated by a handoff controller implemented in a service control point. The handoff controller implements different handoff methods depending on the status of the fixed user and the transition of the mobile user. Additionally 802.21 Media Independent Handover Function in conjunction with SIP is used to facilitate handover between IP and Non-IP points in the system.

Abstract: An apparatus for providing security to media independent handover service includes a point of service for providing the media independent handover services including an independent authenticator. The independent authenticator authenticates candidate access networks prior to the handover of the mobile devices from serving access networks to the candidate access networks, where each of the serving access networks and the candidate access networks belong to a plurality of heterogeneous access networks having the specific serving media. An access controller applies an access control through an access authentication with the point of service providing the media independent handover services through an authentication server, in which when the access authentication is established between the point of service and the authentication server, the mobile devices are authorized to access the media independent handover services through the point of service for the mobile devices attached between heterogeneous media.

Abstract: A media-independent handover key management architecture is disclosed that uses Kerberos for secure key distribution among a server, an authenticator, and a mobile node. In the preferred embodiments, signaling for key distribution is based on re-keying and is decoupled from re-authentication that requires EAP (Extensible Authentication Protocol) and AAA (Authentication, Authorization and Accounting) signaling similar to initial network access authentication. In this framework, the mobile node is able to obtain master session keys required for dynamically establishing the security associations with a set of authenticators without communicating with them before handover. By separating re-key operation from re-authentication, the proposed architecture is more optimized for a proactive mode of operation. It can also be optimized for reactive mode of operation by reversing the key distribution roles between the mobile node and the target access node.

Abstract: An inventive system and method for group communication among devices in M2M networks comprises associating one or more of the devices with a gateway having a unique identifier, initiating registration of the devices at an M2M network using the unique identifier of the gateway, providing from the network a temporary identifier to the gateway and associating, in the network, the temporary identifier with the gateway, attaching the devices to the network using the temporary identifier, and communicating information between the network and the device through the gateway. In one aspect, the devices can be classified into sub-groups and each sub-group has a sub-group head that can be attached to the gateway so that the devices can communicate with the network through the sub-group head instead of the gateway. Each sub-group can be associated with a unique temporary identifier, in addition to the temporary identifier associated with the gateway.

Abstract: In a mobile ad-hoc re-routing system in which network nodes are identified by topology dissemination messages, including local “Hello” and global Topographical Control (“TC”) messages, the improvement comprises triggering topology dissemination messages based on at least one of a new neighbor determination and link loss determinations.

Abstract: A virtualized telecom system and a method for managing service continuity and mobility in a virtualized telecom system. The system comprises a plurality of execution nodes each configured to execute a network function by registering; and a manager node for registering each of the plurality of execution nodes, assigning a node identifier (Node ID) to each of the plurality of execution nodes, periodically polling each of the plurality of execution nodes for a status, and issuing control instructions to each of the plurality of execution nodes based upon the status of a respective execution node. Each of the plurality of execution node responds to the polling by transmitting its status to the manager node. The status includes runtime information and pre-configuration information.

Abstract: A solution framework is employed that includes defining of a mechanism to run multiple queries in a single message exchange, along with a priority on a per-query basis. In some embodiments, a system for facilitating handover of a mobile device across heterogeneous access networks by ensuring response to queries transmitted by the mobile device includes: a) a mobile device having a plurality of wireless network interfaces for communicating over a plurality of heterogeneous access networks, having a media independent handover (MIH) entity to facilitate handovers between the heterogeneous networks, and configured to transmit queries related to handover operation between the heterogeneous access networks to MIH entities within said heterogeneous access networks; and b) said media independent handover entity of said mobile device being configured to transmit multiple queries in a single message exchange to an MIH entity in an access network with prioritization among said multiple queries.

Abstract: A system for media independent handover using a session identifier in which a session identifier is used for identifying a media independent handover registration session across different MIH transport instances between a pair of communicating MIHFs. A point of service maintains a single registration state for a mobile node across the multiple transport instances. A session identifier is assigned by a point of service at the time of initial registration, and is valid only during the lifetime of the registration. A registration state includes local handles to transport instances that are used when sending and receiving media independent handover messages related to the registration.

Abstract: A mechanism by which handoff delay can be minimized while not compromising the IMS/MMD security and also protecting the media if required by certain applications is presented. One proactive method includes proactive authentication. Another proactive method includes proactive security association, such as transferring SA keys from old proxy to new proxy, or transferring keys through serving signal entities. Reactive methods include transferring SA keys from old proxy to new proxy, using either push or pull technology. Other reactive methods include transferring keys through serving signal entities using either push or pull technology.

Abstract: A packet data network gateway device may receive packet network data at a packet data network gateway device; filter the received packet network data to extract information associated with one or more messages in the packet network data; analyze the extracted information; and dynamically determine one or more of policy updates, rules, or thresholds based on the analyzing of the information and information associated with one or more of subscribers, location, existing policies, network operating condition and load.

Abstract: A method and system for setting up and maintaining an IMS session. The method comprising transmitting an invite message from a registered user equipment, forwarding the invite message to a selected SIP proxy (P-CSCF), forwarding the invite message to a specified SIP server (S-CSCF) and relaying said invite message to a destination. The invite message contains a header and a payload. The header includes an identifier for the load balancing node. The load balancing node is assigned to the user equipment. There are at least two load balancing node, a primary and a secondary load balancing node. The identifier for the load balancing node does not change even if there is a failure of one of a primary load balancing node, the P-CSCFs or S-CSCFs. During registration, the routing information for the load balancing node is added into both via and record-route headers in a SIP registration request.

Abstract: According to some of the preferred embodiments, a solution framework is employed that includes defining of a mechanism to run multiple queries in a single message exchange, along with a priority on a per-query basis.

Abstract: A system and method for network selection procedures for simultaneous network connectivity through multiple accesses comprises obtaining stored and registered PLMNs, determining whether PLMNs are both stored PLMN for access technology type Ai and registered PLMN, when no PLMNs are both, performing PLMN selection using a standard procedure, when only one PLMN is both, determining whether the PLMN satisfies a condition, and when the PLMN satisfies the condition, attempting to connect to the PLMN, and when more than one PLMN is both, creating a set of PLMNs, selecting one PLMN that satisfies the condition, from the set PLMN, attempting to connect to the selected PLMN, and when attempting to connect fails, removing the selected PLMN from the set, and selecting another PLMN. In one aspect, the PLMN that minimizes changes is selected. In one aspect, the PLMN that provides access to a larger number of access technologies is selected.

Abstract: A mechanism by which handoff delay can be minimized while not compromising the IMS/MMD security and also protecting the media if required by certain applications is presented. One proactive method includes proactive authentication. Another proactive method includes proactive security association, such as transferring SA keys from old proxy to new proxy, or transferring keys through serving signal entities. Reactive methods include transferring SA keys from old proxy to new proxy, using either push or pull technology. Other reactive methods include transferring keys through serving signal entities using either push or pull technology.

Abstract: According to some embodiments, a key management apparatus for deploying in a smart grid system adapted to receive metering data from smart meters connected to at least one relay via a network, includes: a key control mechanism that derives a key array of individual purpose specific keys from one master key such that the purpose specific key in the key array are each independent cryptographic keys for each specific usage in an application or for each application if there is only one specific usage in an application.

Abstract: A system and method for performing MIH pre-authentication, which includes providing support for both direct and/or indirect pre-authentication and providing support for both network-initiated and mobile-initiated pre-authentication.

Abstract: The present invention, among other things, obviates the effects of an attack on a wireless network through appropriate isolation and recovery. An aspect of the present invention can include a system and method of isolating a victim of malicious behavior in a wireless access network, and in particular WLAN networks. By having software on the victim's device, the system provides the capability of recovering the victim from the effects of the intruder, and prevents the victim from being affected by subsequent attacks by the intruder. The preferred embodiments include two key components: a local monitor and a global monitor.