Key derivation for communication

A method performed by a network node in a subscribed communication network to which a communication device has a subscription, the method comprising:

• generating a cryptographic key as a function of information bound to an intermediate communication network via which the communication device authenticates the subscription to the subscribed communication network, wherein the communication device is served by a serving communication network that differs from the intermediate communication network;
• and
• sending the cryptographic key to the intermediate communication network;
• wherein each of the intermediate communication network, the subscribed communication network, and the serving communication network comprise a core network;
• wherein the cryptographic key is, or is generated as a function of, a key shared between the communication device and an authentication server in the subscribed communication network.

A method performed by a network node in an intermediate communication network, the method comprising:

• receiving, from a serving communication network serving a communication device, a first authentication request message requesting authentication of a subscription of the communication device to a subscribed communication network;
• and
• responsive to receiving the first authentication request message, transmitting, to the subscribed communication network, a second authentication request message requesting authentication of the subscription of the communication device to the subscribed communication network, wherein the second authentication request message includes information bound to the intermediate communication network;
• wherein each of the intermediate communication network, the subscribed communication network, and the serving communication network comprise a core network;
• the method further comprising receiving, from the subscribed communication network, an authentication response message that includes a cryptographic key which is based on the information.

A communication device comprising:

• communication circuitry;
• and
• processing circuitry configured to:
• generate a cryptographic key as a function of information bound to an intermediate communication network via which the communication device authenticates a subscription to a subscribed communication network, wherein the communication device is served by a serving communication network that differs from the intermediate communication network;
• and
• protect communication for the communication device based on the generated cryptographic key;
• wherein each of the intermediate communication network, the subscribed communication network, and the serving communication network comprise a core network;
• wherein the cryptographic key is, or is generated also as a function of, a key shared between the communication device and an authentication server in the subscribed communication network.