Broker-based interworking using hierarchical certificates

A method for Authentication Authorization and Accounting (AAA) in an interworking between at least two networks (210 and 220). The at least two networks are capable of communicating with a broker (230) and include a first network and a second network (220) to user certificate from a user device corresponding to user of the first network (210). The first network to user certificate is signed by at a first network private key and includes a broker (230) to first network certificate and a user public key. The broker (230) to first network certificate is signed by a broker (230) private key and includes a first network (210) public key. A session key is sent from the second network (220) to the user device when the broker (230) to first network (210) certificate and the first network (210) to user certificate are determined to be authentic by the second network (220) based upon the broker (230) public key and the first network (210) public key, respectively. The session key is encrypted with the user public key. The session key is for permitting the user device to access the second network.