초록 ▼

This invention proposes an integrated process for AAA (Authentication, Authorisation, and Accounting) with the order reversed whereby L2 follows L3. The L3 process treats the wireless link as any normal IP access link, and the L3 authorisation provides L3 processing, but also includes the L2 termina

This invention proposes an integrated process for AAA (Authentication, Authorisation, and Accounting) with the order reversed whereby L2 follows L3. The L3 process treats the wireless link as any normal IP access link, and the L3 authorisation provides L3 processing, but also includes the L2 terminal authentication identifiers so that the L2 security parameters can also be returned. This means that the wireless link and the IP layer are not secured until after the L3 authorisation has completed and therefore the first IP messages that trigger authorisation are sent insecurely. This invention also provides methods to avoid these insecure messages presenting any opportunities to an attacker. Finally, the inventions include methods to enable L3 before L2 authorisation when a user is roaming in a foreign network.

대표청구항 ▼

What is claimed is: 1. A communications method for use in a communications network including a mobile node, a first security device and a second security device, said mobile node being identified in a home region of said communications network by a first identifier, said second security device being

What is claimed is: 1. A communications method for use in a communications network including a mobile node, a first security device and a second security device, said mobile node being identified in a home region of said communications network by a first identifier, said second security device being in a foreign region of said communications network, the method comprising:operating the second security device to:transmit a signal including said first identifier to the first security device, said first identifier including a first realm associated only with said home region;receive a first secret in response to said transmitted signal including said first identifier;generate a second identifier to identify said mobile node in said foreign region, said second identifier including a second realm associated only with said foreign region, wherein the second identifier further includes a username of the first identifier, and further includes the first realm; andassociate said second identifier with said first secret.