Authentication of mobile users

Internetworks of the future will allow and promote universal access. Network users will be able to access the network at a multitude of access points separated by significant geographic distance and many administrative boundaries. Without a single central authority, a new set of inter-domain security mechanisms is needed to allow users to venture into remote domains while inheriting privileges from their home domain. Solutions addressing this issue must take into account a somewhat contradictory security constraint that calls for strict separation of security domains in order to avoid sharing sensitive security information among them. In this paper, we propose a generic approach for authenticating mobile users in remote domains that satisfies the domain separation constraint. The protocols described herein can be applied in different mobile-user environments including wireless networks and mobile user services on traditional wireline networks.