Security policy distribution to communication terminals

A method of providing security for a communication terminal having an association with a first communication network but being present in a second communication network, the method comprising the following steps being executed by a communication network entity in the second communication network:

• receiving a first security policy vector Ph associated with the first communication network from the first communication network, the first security policy vector Ph comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• generating a second security policy vector Pv associated with the second communication network, the second security vector Pv comprising the same predefined number of values as the first security policy vector Ph, the values also relating to at least one of a security algorithm and a security function;
• transmitting the first security policy vector Ph and the second security vector Pv to the communication terminal;
• generating a third security policy vector P, comprising values relating to at least one of a security algorithm and a security function by combining the first security policy vector Ph and the second security policy vector Pv;
• and
• transmitting the third security policy vector P to another communication network entity.

A method of providing security for a communication terminal having an association with a first communication network but being present in a second communication network, the method comprising the following steps being executed by a communication network entity in the first communication network:

• generating a first security policy vector Ph associated with the first communication network, the first security policy vector Ph comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• generating a first and a second key;
• generating a first integrity protection tag PhA, the first integrity protection tag PhA being dependent on at least the first security algorithm vector Ph and the first key;
• and
• transmitting the first security policy vector Ph, the first integrity protection tag PhA, and the second key to the second communication network.

A method of providing security for a communication terminal having an association with a first communication network but being present in a second communication network, the method comprising the following steps being executed in the communication terminal:

• receiving a first security policy vector Ph associated with the first communication network, and a second security policy vector Pv associated with the second communication network, the security policy vectors each comprising values relating to at least one of a security algorithm and a security function;
• receiving information from the second communication network identifying at least one security algorithm or at least one security function that has been selected and should be applied;
• and
• verifying, in accordance with the first security policy vector Ph and the second security policy vector Pv, the selected security algorithms or selected security functions.

A communication network entity for providing security for a communication terminal having an association with a first communication network but being present in a second communication network, the entity comprising:

• a first communication unit adapted to receive a first security policy vector Ph from the first communication network, the first security policy vector Ph comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• a generation unit adapted to generate a second security policy vector Pv, the second security policy vector Pv comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• a combination unit adapted to combine the first security policy vector Ph and the second security policy vector Pv into a combined security policy vector P;
• a selection unit adapted to select at least one security algorithm and/or at least one security function;
• and
• a second communication unit, adapted to transmit to a communication terminal a first security policy vector Ph and a second security policy vector Pv, and further adapted to transmit the output from the selection unit to the communication terminal.

A communication network entity for providing security for a communication terminal having an association with a first communication network but being present in a second communication network, the entity comprising:

• a first communication unit adapted to receive a first security policy vector Ph from the first communication network, the first security policy vector Ph comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• a generation unit adapted to generate a second security policy vector Pv, the second security policy vector Pv comprising a predefined number of values relating to at least one of a security algorithm and a security function;
• a combination unit adapted to combine the first security policy vector Ph and the second security policy vector Pv into a combined security policy vector P;
• and
• a second communication unit adapted to transmit the combined security policy vector P to a radio base station.