On-demand serving network authentication

An apparatus comprising:

• a wireless transceiver;
• and
• a processor coupled to the wireless transceiver, the processor configured to:
• transmit a request from the apparatus to a network function in a serving network after the serving network has been authenticated, wherein the request includes a nonce and a signature request;
• receive by the apparatus a response to the request from the network function, wherein the response includes a signature of the network function generated using a key maintained in a trusted environment in the network function, and wherein the trusted environment is inaccessible to entities external to the network function;
• and
• verify authenticity of the serving network by the apparatus based on the signature of the network function and a credential corresponding to a trusted network identified in a list of trusted networks maintained by the apparatus.

An apparatus adapted to operate as a network function in a serving network, comprising:

• secured storage adapted to store an operator-signed certificate;
• and
• a processing circuit configured to:
• receive a first message from a wireless communication device after the wireless communication device has authenticated the serving network through a secured connection with a home network, wherein the first message is directed to the network function and includes a nonce and a signature request;
• generate a signature using the operator-signed certificate maintained in the secured storage;
• and
• transmit a second message to the wireless communication device, wherein the signature is attached to the second message, wherein the wireless communication device is configured to use the signature to verify authenticity of the serving network based on a list of trusted networks maintained by the wireless communication device.