naged by the network or the mobile. I.3.1. Mutual authentication Mutual authentication is performed between the mobile and the AAA (Authentication, Authorization and Accounting) server. It uses the AKA mechanism adapted to the EAP-Method protocol: - the HSS entity provides the AAA server with the authentication vector (RAND, AUTN, RES); - the AAA server provides the mobile with the random number (RAND) and the seal (AUTN) of the network; - the mobile calculates the seals (AUTN, RES) from its key Ki stored in the USIM module of its UICC card and compares the received seal (AUTN) with that calculated; xxxii Wi-Fi Integration to the 4G Mobile Network - the mobile transmits its seal (RES) to the AAA server, which compares it with that received from the HSS entity. The EAP-AKA' protocol is an evolution of the EAP-AKA method, which concerns the key derivation mechanism. I.3.2. Architecture based on the S2a interface The architecture based on the S2a interface corresponds to trusted Wi-Fi access and network-based mobility. The mobile stream travels through the Wi-Fi radio interface and tunnel S2a, built between the access point and the PGW entity, to access the PDN (Figure I.5). The S2a interface supports several mechanisms for establishing the tunnel: - the PMIPv6 (Proxy Mobile IP version 6) mechanism relies on the signaling provided by the mobility extension of the IPv6 header exchanged between the Wi-Fi access and the PGW entity and on the GRE (Generic Routing Encapsulation) tunnel for the mobile stream; - the MIPv4 FA (Mobile IP version 4 Foreign Agent) mechanism is based on the MIPv4 signaling and the IP tunnel in IP for the mobile stream; - the GTPv2 (GPRS Tunneling Protocol version 2) mechanism relies on the GTPv2-C signaling exchanged between the trusted Wi-Fi access and the PGW entity and on the GTP-U tunnel for the mobile stream. S2a Tunnel Wi-Fi GRE / IP over IP / GTP-U Access Mobility / MIPv4/GTP-C Figure I.5. Session establishment - Architecture based on S2a interface Introduction xxxiii I.3.3. Architecture