Next Generation Broadband Access Networks (NGBAN), the next evolutionary step of current broadband access, have experienced a great evolution in the last few years. The NGBAN architecture is based on the reference model introduced by the Broadband Forum in TR-144, while the Next Generation Services (NGS) are based on the Ethernet Services defined by the Metro Ethernet Forum in its 6.1 technical specification. In this context, network convergence means that the same network must be capable of transporting all the existent telecommunication services (voice, video and data). This paper introduces Carrier-Grade Ethernet as transport technology to achieve convergence in provider networks. A new approach for network convergence is also presented, the bridging virtualization, which uses the concept of instances to deal with service requests. Then, a secure instantiation mechanism for NGBAN is explained, which is based on the EAPoL protocol (IEEE 802.1X). Finally, a profile-based configuration service is introduced, which defines the services through XML profiles inspired on the MEF specifications (UNI, EVC per UNI and EVC).

Broadband access networks have experienced a significant evolution in the last few years, in terms of convergence, QoS, security or ubiquity. In this context, Carrier Ethernet has appeared as a technology which claims to address all this aspects, and whose deployment is supported by the Metro Ethernet Forum and Broadband Forum. Nowadays, providers tend to offer multi-play services (voice, video and data) over the same network and service delivery is shifting from traditional scenarios to new ones, in which services are provided by third-party entities. A new secure and dynamic scenario is presented, in which end users can access simultaneously a variable number of services. These users are authenticated and authorized per service before access is granted to them. Extensions to IEEE 802.1X standard are introduced: the service port and EAPoM protocol are the two main contributions to this new scenario. Furthermore, a profile based configuration procedure allows the secure configuration of nodes. The main restriction of 802.1X is that the access control is done by user instead of by service. This proposal introduces the service port as the basic element for policy enforcement of access control that enables the operation of the EAPoM protocol. This splits the logical port into new ports, each of which has its own associated AAA process that rules the access to each service. This multiplicity of authentication processes is supported by EAPoM, which is able to differentiate multiple EAP processes from the same customer. A working prototype has been implemented in a Linux-based environment.

Currently, research community efforts are being carried out to develop new generation wireless mobile networks that provide broadband data communication in the high speed vehicular scenario. ITU-R (International Telecommunication Union, Radiocommunication Section) has proposed the IMT-Advanced (International Mobile Telecommunications) technical requirements for supporting such usage scenarios. IMT- Advanced identifies those mobile communication systems with capabilities which go further than those of IMT-2000. The IEEE 802.16 standard, supported under the WiMAX network, has evolved from a fixed scenario, in IEEE 802.16d, towards a mobile typical vehicular (up to 120 km/h) with IEEE 802.16e. In the near future, the IEEE 802.16m specification will cover the mobility classes and scenarios supported by the IMT-Advanced, including the high-speed vehicular scenario (up to 350 km or even up to 500 km/h). IEEE802.16 initial standards adopted DOCSIS (Data Over Cable Service Interface Specification) QoS (Quality of Service) mechanisms. Similarly, the IEEE802.16 MAC (Medium Access Control) Security Sublayer, responsible for providing security mechanisms such as privacy, authentication, and encryption over the air link, was also based on DOCSIS standard. However, DOCSIS is a wired based technology and QoS mechanisms in fixed wireless technologies, while sharing many details with QoS mechanisms for wired technologies, faces some extra limitations including: bandwidth limitations, longer end to end delays and higher packet losses due to channel-induced bit errors. Additionally, QoS mechanisms in mobile broadband wireless technologies represent a step further in complexity. The time variability and unpredictability of the channel become more acute and the main challenge arises from the need to hand over sessions from one cell to another as the user moves across their coverage boundaries. During this handover process, it is still necessary to provide session continuity and to offer the previously negotiated end-to-end QoS and security levels.

Recent widespread of small electronic devices with a low capacity microprocessor and wireless communication capabilities integrated, has given place to the emergence of new communication scenarios, mainly characterized by their heterogeneity and ubiquity. As an example, in the near future, it will be very common for users to access and control electrical appliances or high performance sensors in remote locations just by using their mobile phone or PDA. However, for these environments to achieve the expected success they must probe to be secure and reliable. The security algorithms and mechanisms used to date are meant for powerful workstations and not suitable for small devices with specific constraints regarding energy and processing power. Therefore, in this paper we present a lightweight authentication and authorization solution based on the Kerberos symmetric key protocol, and we propose an extension of its functionalities in order to add authorization support.