Patent ID: 8462947

Claim:
A method of operating an authentication proxy in a visited network for performing handover between access networks wherein a user has authenticated for network access in a first access network, the method comprising: receiving from a home network a first session key and an identifier, which is temporary and access independent, allocated to the user for the duration of a communication session; mapping the temporary identifier to the first session key and storing the mapped temporary identifier and key at the authentication proxy; deriving a second session key from said first session key; sending the second session key to an access network, and the identifier to a user terminal; subsequently receiving from the user terminal via a second access network, in relation to a handover request, the temporary identifier; retrieving the first session key mapped to the received temporary identifier; deriving a third session key from said first session key; sending the third session key to the second access network, wherein the temporary identifier is generated by an authorization server in the home network, and the receiving step comprises receiving an Extensible Authentication Protocol (EAP) message comprising the generated temporary identifier or an encrypted version of the generated temporary identifier.