Communication between a communication device and a network device

A communication device for communicating with a network device of a communication network, the communication device being configured to:

• receive a challenge, a first PFS parameter and a first verification code from the network device,
• forward said challenge to an identity module,
• receive at least one result parameter as response from the identity module,
• determine, based on said result parameter whether said first PFS parameter is authentic, and
• generate and send a second PFS parameter to the network device if said determination is that the first PFS parameter is authentic.

A method for a communication device in communication with a network device of a communication network, the method being performed by the communication device and comprising:

• receiving a challenge, a first PFS parameter and a first verification code from the network device,
• forwarding a derivative of said challenge to an identity module,
• receiving at least one result parameter as response from the identity module,
• determining, based on said result parameter whether said first PFS parameter is authentic, and
• generating and sending a second PFS parameter to the network device if said determination is that the first PFS parameter is authentic.

A method for a communication device in communication with a network device of a communication network, the method being performed by the communication device and comprising:

• receiving a challenge, a first PFS parameter and a first verification code from the network device,
• forwarding said challenge to an identity module,
• receiving at least one result parameter as response from the identity module,
• determining, based on said result parameter whether said first PFS parameter is authentic, and
• generating and sending a second PFS parameter to the network device if said determination is that the first PFS parameter is authentic.

A computer program product comprising a non-transitory computer-readable storage medium storing program code for a communication device in communication with a network device of a communication network, the program code, which when run in the communication device, causes the communication device to:

• receive a challenge, a first PFS parameter and a first verification code from the network device,
• forward a derivative of said challenge to an identity module,
• receive at least one result parameter as response from the identity module,
• determine, based on said result parameter whether said first PFS parameter is authentic, and
• generate and send a second PFS parameter to the network device if said determination is that the first PFS parameter is authentic.

A computer program product comprising a non-transitory computer-readable storage medium storing program code for a communication device in communication with a network device of a communication network, the program code, which when run in the communication device, causes the communication device to:

• receive a challenge, a first PFS parameter and a first verification code from the network device,
• forward said challenge to an identity module,
• receive at least one result parameter as response from the identity module,
• determine, based on said result parameter whether said first PFS parameter is authentic, and
• generate and send a second PFS parameter to the network device if said determination is that the first PFS parameter is authentic.

A first network device of a first communication network, the first network device being configured to:

• obtain a challenge,
• obtain a first PFS parameter,
• obtain a first verification code for the first PFS parameter,
• send the challenge, the first PFS parameter and the first verification code to a communication device,
• receive a second PFS parameter, a second verification code and a response parameter from the communication device,
• determine the authenticity of the response parameter, and
• verify the second PFS parameter based on the second verification code.

A method for a first network device of a first communication network, the method being performed by the first network device and comprising the steps of:

• obtaining a challenge,
• obtaining a first PFS parameter,
• obtaining a first verification code for the first PFS parameter,
• sending the challenge, the first PFS parameter and the first verification code to a communication device,
• receiving a second PFS parameter, a second verification code and a response parameter from the communication device,
• determining the authenticity of the response parameter, and
• verifying the second PFS parameter based on the second verification code.

A computer program product comprising a non-transitory computer-readable storage medium storing program code for a first network device of a first communication network, the program code, which when run in the first network device, causes the first network device to:

• obtain a challenge,
• obtain a first PFS parameter,
• obtain a first verification code for the first PFS parameter,
• send the challenge, the first PFS parameter and the first verification code to a communication device,
• receive a second PFS parameter, a second verification code and a response parameter from the communication device,
• determine the authenticity of the response parameter, and
• verify the second PFS parameter based on the second verification code.

A system comprising a first network device of a first communication network and a second network device in a second communication network,

• the second network device being configured to send a challenge to the first network device,
• the first network device being configured to:
• receive the challenge,
• obtain a first PFS parameter,
• obtain a first verification code for the first PFS parameter,
• send the challenge, the first PFS parameter and the first verification code to the communication device,
• receive a second PFS parameter, a second verification code and a response parameter from the communication device,
• determine the authenticity of the response parameter, and
• verify the second PFS parameter based on the second verification code.

A second network device for a second communication network, the second network device being configured to:

• receive, from a first network device of a first communication network, a request for authentication data related to an identity module of a communication device,
• generate a first PFS parameter,
• generate a first verification code based on at least the first PFS parameter and a key shared between the second network device and the identity module,
• send in response to the request, to the first network device, at least the first verification code and a value from which the first PFS parameter can be derived.