MIH pre-authentication

1. A method for media independent handover (MIH) pre-authentication of a Mobile Node during handover from a Serving Authenticator to a Target Authenticator, comprising:

integrating media-independent handover signaling and network access authentication signaling in a single protocol;

deriving a Media-Independent PMK (MI-PMK) and a Media-Specific PMK (MS-PMK);

having an authenticator hold a Master Session Key (MSK) generated by EAP, and using said MSK for deriving the media-independent pair-wise master key (MI-PMK), and when the mobile node hands over to the target authenticator to which it has pre-authenticated, running a media-specific secure association protocol using a media-specific PMK (MS-PMK) derived from the Media-Independent PMK (MI-PMK).

2. The method of claim 1 , wherein said single protocol involves 802.21 MIH protocol.

3. The method of claim 1 , further including performing a network-initiated direct pre-authentication.

4. The method of claim 3 , wherein said performing a network-initiated direct pre-authentication, includes transmitting from a Serving Authenticator an MIH Pre-auth Initiate indication message to a Candidate Authenticator, transmitting from the Candidate Authenticator an MIH Pre-auth request message to a Mobile Node, and transmitting from the Mobile Node an MIH Pre-auth response message to the Candidate Authenticator.

5. The method of claim 1 , further including performing a mobile-initiated direct pre-authentication.

6. The method of claim 5 , wherein said performing a mobile-initiated direct pre-authentication, includes having a Mobile Node transmit an MIH Pre-auth Initiate indication to a Serving Authenticator, and having the Serving Authenticator transmit an MIH Pre-auth Initiate indication message to the Candidate Authenticator.

7. The method of claim 1 , further including performing a network-initiated indirect pre-authentication.

8. The method of claim 7 , wherein said performing a network-initiated indirect pre-authentication includes having a Candidate Authenticator transmit an MIH Pre-auth request message to the Serving Authenticator, and having the Serving Authenticator transmit an MIH Pre-auth request message to a Mobile Node.

9. The method of claim 1 , further including performing a mobile-initiated indirect pre-authentication.

10. The method of claim 9 , wherein said performing a mobile-initiated indirect pre-authentication includes having a Mobile Node transmit an MIH Pre-auth initiate indication message to a Serving Authenticator, and having the Serving Authenticator transmit an MIH Pre-auth initiate indication to a Candidate Authenticator.

11. The method of claim 1 , further including performing said media independent handover (MIH) pre-authentication for inter-technology handovers.

12. The method of claim 1 , further including employing a single authenticator to serve multiple access technologies.

13. The method of claim 1 , further including performing MIH registration of the Mobile Node with the Serving Authenticator prior to running pre-authentication.

14. The method of claim 1 , further including performing a mobile-initiated pre-authentication, and having a Serving Authenticator subscribe to the Mobile Node for a pre-auth initiate event.

15. A method for media independent handover (MIH) pre-authentication of a Mobile Node during handover from a Serving Authenticator to a Target Authenticator, comprising: having an authenticator hold a Master Session Key (MSK) an Extensible Authenticated Protocol (EAP), and using said MSK for deriving the media-independent pair-wise master key (MI-PMK), and when the mobile node hands over to the Target Authenticator to which the mobile node has pre-authenticated, running a media-specific secure association protocol using a media-specific PMK (MS-PMK) derived from the Media-Independent PMK (MI-PMK).

16. The method of claim 15 , further including integrating media-independent handover signaling and network access authentication signaling in a single protocol.

17. The method of claim 16 , wherein said single protocol involves 802.21 MIH protocol.

18. The method of claim 15 , further including performing said media independent handover (MIH) pre-authentication for inter-technology handovers.

19. The method of claim 18 , further including employing a single authenticator to serve multiple access technologies.

20. A system for media independent handover (MIH) pre-authentication of a Mobile Node during handover from a Serving Authenticator to a Target Authenticator, comprising:

a) an Authenticator configured to perform network access authentication of a Mobile Node and media independent handover of the Mobile Node using a single protocol, and to serve multiple access technologies;

b) said Authenticator being configured to hold a master session key generated during media-specific authentication or media-independent-handover pre-authentication, which master session key is used for deriving a media-independent pair-wise master key and a media-specific pair-wise master key for running a media-specific secure association.

21. The system of claim 20 , wherein said single protocol involves 802.21 MIH protocol.