Network architecture and security with encrypted network reachability contexts

A network device, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• establish a security context for a connection with a client device, wherein the security context includes at least an encryption algorithm, an encryption key, an integrity protection algorithm, or an integrity protection key;
• generate a context for the client device, the context including network state information associated with the client device, the network state information including at least the encryption algorithm, the encryption key, the integrity protection algorithm, or the integrity protection key;
• generate one or more encrypted network reachability contexts based on the context;
• and
• transmit the one or more encrypted network reachability contexts to a network entity, wherein the one or more encrypted network reachability contexts serve to reduce an amount of the context maintained at the network device and enable reconstruction of the context for the client device when the network device receives, from the network entity, a message that includes both a packet to be delivered to the client device and the one or more encrypted network reachability contexts.

A method for a network device comprising:

• receiving, from a network entity, a message that includes both a data packet to be delivered to a client device and one or more encrypted network reachability contexts associated with the client device;
• obtaining a key for the one or more encrypted network reachability contexts;
• decrypting the one or more encrypted network reachability contexts using the key to obtain network state information included in the one or more encrypted network reachability contexts, the network state information including at least an encryption algorithm, an encryption key, an integrity protection algorithm, an integrity protection key, or combinations thereof;
• protecting the data packet based on at least one of the encryption algorithm, the encryption key, the integrity protection algorithm, the integrity protection key, or combinations thereof;
• and
• transmitting a message including the data packet to the client device.

A network device comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• receive, from a network entity, a message that includes both a data packet to be delivered to a client device and one or more encrypted network reachability contexts associated with the client device;
• obtain a key for the one or more encrypted network reachability contexts;
• decrypt the one or more encrypted network reachability contexts using the key to obtain network state information included in the one or more encrypted network reachability contexts, the network state information including at least an encryption algorithm, an encryption key, an integrity protection algorithm, or an integrity protection key;
• protect the data packet based on at least one of the encryption algorithm, the encryption key, the integrity protection algorithm, or the integrity protection key;
• and
• transmit a message including the data packet to the client device.

A method for a network entity comprising:

• receiving one or more encrypted network reachability contexts for a client device from a network device;
• generating a message for the client device, the message including both a packet to be delivered to the client device and the one or more encrypted network reachability contexts;
• and
• transmitting the message to the client device, wherein the one or more encrypted network reachability contexts includes network state information that enables the network entity to reach the client device.

A network entity, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• receive one or more encrypted network reachability contexts for a client device from a network device;
• generate a message for the client device, the message including both a packet to be delivered to the client device and the one or more encrypted network reachability contexts;
• and
• transmit the message to the client device, wherein the one or more encrypted network reachability contexts include network state information that enables the network entity to reach the client device.

A method for a first network device comprising:

• receiving a control packet from a client device;
• requesting a context for the client device from a second network device;
• receiving the context for the client device from the second network device;
• generating one or more encrypted network reachability contexts based on the context received from the second network device;
• and
• transmitting the one or more encrypted network reachability contexts to a network entity.

A first network device comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• receive a control packet from a client device;
• request a context for a client device from a second network device;
• receive the context for the client device from the second network device;
• generate one or more encrypted network reachability contexts based on the context received from the second network device;
• and
• transmit the one or more encrypted network reachability contexts to a network entity.