# US 2019/0246271 A1 · Network nodes and methods performed by network node for selecting authentication mechanism

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0246271 A1
- Document ID: US20190246271A1
- Status: Published application
- Kind: A1
- Application number: 16/318,692
- Filed: 2017-05-05
- Published: 2019-08-08
- Earliest claimed: 2016-07-18
- Assignees: Telefonaktiebolaget LM Ericsson (publ)
- Applicants: Telefonaktiebolaget LM Ericsson (publ)
- Inventors: Vesa TORVINEN; Antonio ALONSO ALARCON; David CASTELLANOS ZAMORA; Cheng WANG
- Web page: https://patentgrep.com/patent/US20190246271A1

## CPC

- H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols}
- H04L 63/162: {at the data link layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 8/24: Transfer of terminal data
- H04W 12/069: using certificates or pre-shared keys
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Methods and network nodes of a wireless communications network are disclosed. The network nodes are operable to initiate a plurality of authentication mechanisms. Responsive to receipt of a request for authentication transmitted by a terminal device of the wireless communications network, the network nodes are configured to select an authentication mechanism from the plurality of authentication mechanisms; and are further configured to initiate the selected authentication mechanism to authenticate the terminal device with the wireless communications network.

## Claims

### Claim 1

A method for initiating authentication, the method being performed by a network node located in a core network of a home mobile network and comprising:
responsive to receipt of a request transmitted from a visited mobile network for authentication of a terminal device having a subscription in the home mobile network, selecting an authentication mechanism from a plurality of authentication mechanisms which the network node is operable to initiate, wherein each authentication mechanism comprises an authentication method and a network location in which the authentication method is to be carried out and which network location is either the home mobile network or the visited mobile network, and
initiating the selected authentication mechanism to authenticate the terminal device.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the request for authentication comprises at least one of: an identity of the terminal device; an authentication mechanism requested by the terminal device; and an authentication capability of the terminal device, and
wherein selecting the authentication mechanism comprises selecting the authentication mechanism in dependence on the at least one of the identity of the terminal device; the authentication mechanism requested by the terminal device; and the authentication capability of the terminal device.

### Claim 3 (depends on 1)

The method according to claim 1, wherein selecting the authentication mechanism comprises selecting the authentication mechanism in dependence on at least one of: authentication capability of the visited mobile network; subscription information for the terminal device; and at least one operator-defined policies.

### Claim 4 (depends on 1)

The method according to claim 1, further comprising:
receiving a request for authentication from a core network control node, the request for authentication from the core network control node comprising at least one of: the identity of the terminal device; the authentication mechanism requested by the terminal device; and the authentication capability of the terminal device.

### Claim 5 (depends on 1)

The method according to claim 1, wherein selecting the authentication mechanism comprises selecting the authentication mechanism in dependence on at least one of: authentication capability of the visited mobile network; and the network type of the visited mobile network.

### Claim 6 (depends on 5)

The method according to claim 5, further comprising:
receiving a request for authentication from a second network node of the visited mobile network, the request for authentication from the second network node of the visited mobile network comprising at least one of: the identity of the terminal device; the authentication mechanism requested by the terminal device; the authentication capability of the terminal device; the authentication capability of the visited mobile network; and the network type of the visited mobile network.

### Claim 7 (depends on 1)

The method according to claim 1, wherein each authentication mechanism comprises an authentication framework in which the authentication method is to be carried out, and wherein the authentication framework comprises a 3GPP framework and a non-3GPP framework.

### Claim 8

(canceled)

### Claim 9 (depends on 1)

The method according to claim 1, wherein the authentication methods comprise at least one of: evolved packet system authentication and key agreement (EPS-AKA); extensible authentication protocol for universal mobile telecommunications system authentication and key agreement (EAP-AKA); EAP-AKA′; extensible authentication protocol transport layer security (EAP-TLS); and EAP tunnelled TLS (EAP-TTLS).

### Claim 10

(canceled)

### Claim 11

(canceled)

### Claim 12

(canceled)

### Claim 13 (depends on 1)

The method according to claim 1, wherein the network node is an authentication, authorization and accounting server.

### Claim 14

A network node for initiating authentication, comprising processor circuitry and a computer-readable storage medium, the computer-readable storage medium storing instructions that are executable by the processor circuitry whereby the network node is located in a core network of a home mobile network and is operative to:
responsive to receipt of a request for authentication transmitted from a visited mobile network for authentication of a terminal device having a subscription in the home mobile network, select an authentication mechanism from a plurality of authentication mechanisms which the network node is operable to initiate, wherein each authentication mechanism comprises an authentication method and a network location in which the authentication method is to be carried out and which network location is either the home mobile network or the visited mobile network; and
initiate the selected authentication mechanism to authenticate the terminal device.

### Claim 15 (depends on 14)

The network node according to claim 14, wherein the request for authentication comprises at least one of: an identity of the terminal device; an authentication mechanism requested by the terminal device; and an authentication capability of the terminal device, and
wherein the computer-readable storage medium stores instructions that are executable by the processor circuitry whereby the network node is further operative to select the authentication mechanism by selecting the authentication mechanism in dependence on the at least one of the identity of the terminal device; the authentication mechanism requested by the terminal device; and the authentication capability of the terminal device.

### Claim 16 (depends on 14)

The network node according to claim 14, wherein the computer-readable storage medium stores instructions that are executable by the processor circuitry whereby the network node is further operative to select the authentication mechanism by selecting the authentication mechanism in dependence on at least one of: authentication capability of the visited mobile network; subscription information for the terminal device; and at least one operator-defined policies.

### Claim 17 (depends on 14)

The network node according to claim 14, wherein the computer-readable storage medium stores instructions that are executable by the processor circuitry whereby the network node is further operative to:
receive a request for authentication from a core network control node, the request for authentication from the core network control node comprising at least one of: the identity of the terminal device; the authentication mechanism requested by the terminal device; and the authentication capability of the terminal device.

### Claim 18 (depends on 17)

The network node according to claim 17, wherein the computer-readable storage medium stores instructions that are executable by the processor circuitry whereby the network node is further operative to select the authentication mechanism by selecting the authentication mechanism in dependence on at least one of: authentication capability of the visited mobile network; and the network type of the visited mobile network.

### Claim 19 (depends on 17)

The network node according to claim 17, wherein the computer-readable storage medium stores instructions that are executable by the processor circuitry whereby the network node is further operative to:
receive a request for authentication from a second network node of the visited mobile network, the request for authentication from the second network node of the visited mobile network comprising at least one of: the identity of the terminal device; the authentication mechanism requested by the terminal device; the authentication capability of the terminal device; the authentication capability of the visited mobile network; and the network type of the visited mobile network.

### Claim 20 (depends on 14)

The network node according to claim 14, wherein each authentication mechanism comprises an authentication framework in which the authentication method is to be carried out, and wherein the authentication framework comprises a 3GPP framework and a non-3GPP framework.

### Claim 21

(canceled)

### Claim 22 (depends on 14)

The network node according to claim 14, wherein the authentication methods comprise at least one of: evolved packet system authentication and key agreement (EPS-AKA); extensible authentication protocol for universal mobile telecommunications system authentication and key agreement (EAP-AKA); EAP-AKA′; extensible authentication protocol transport layer security (EAP-TLS); and EAP tunnelled TLS (EAP-TTLS).

### Claim 23

(canceled)

### Claim 24 (depends on 14)

The network node according to claim 14, wherein the request for authentication transmitted by the terminal device forms part of a request to connect to the visited mobile network.

### Claim 25

(canceled)

### Claim 26 (depends on 14)

The network node according to claim 14, wherein the network node is an authentication, authorization and accounting server.

### Claim at position 27

-57. (canceled)