# US 2010/0166179 A1 · Methods and apparatus for bootstrapping mobile-foreign and foreign-home authentication keys in mobile ip > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2010/0166179 A1 - Document ID: US20100166179A1 - Status: Published application - Kind: A1 - Application number: 12/645,286 - Filed: 2009-12-22 - Published: 2010-07-01 - Earliest claimed: 2004-09-27 - Assignees: Cisco Technology, Inc. - Inventors: Srinath Gundavelli; Kent Leung; Alpesh Patel - Web page: https://patentgrep.com/patent/US20100166179A1 ## CPC - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys} - H04W 12/041: Key generation or derivation - H04W 12/06: Authentication - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 2209/80: Wireless - H04W 80/04: Network layer protocols, e.g. mobile IP [Internet Protocol] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and apparatus for dynamically generating authentication keys are disclosed. Specifically, a Mobile-Foreign authentication key is separately generated by both the Mobile Node and Foreign Agent. Similarly, a Foreign-Home authentication key is separately generated by the Foreign Agent and the Home Agent. In accordance with one embodiment, generation of the Mobile-Foreign authentication key and Foreign-Home authentication key are accomplished via the Diffie-Hellman key generation scheme. ## Claims ### Claim 1 A Foreign Agent supporting Mobile IP and adapted for generating an authentication key to be shared between the Foreign Agent and a Home Agent, comprising: a processor; and a memory, at least one of the processor or the memory being adapted for: receiving by the Foreign Agent supporting Mobile IP a first key material generated by the Home Agent, thereby enabling the Foreign Agent to generate a Foreign-Home authentication key shared between the Foreign Agent and the Home Agent; dynamically generating by the Foreign Agent a second key material; transmitting by the Foreign Agent the second key material such that it is received by the Home Agent, thereby enabling the Home Agent to generate a Foreign-Home authentication key shared between the Home Agent and the Foreign Agent; dynamically generating by the Foreign Agent the Foreign-Home authentication key shared between the Home Agent and the Foreign Agent from the first key material; wherein dynamically generating the second key material includes computing the value of Y=(gy)mod n, wherein y is a random integer, wherein Y is the second key material, and both g and n are group parameters that are universally known to the Mobile Node, Foreign Agent, and Home Agent; and wherein dynamically generating the Foreign-Home authentication key shared between the Home Agent and the Foreign Agent includes computing the value k=(Xy) mod n, wherein X is the first key material received from the Home Agent, wherein k is the Foreign-Home authentication key. ### Claim 2 (depends on 1) The Foreign Agent as recited in claim 1, wherein transmitting the second key material comprises transmitting the second key material to the Home Agent. ### Claim 3 (depends on 1) The Foreign Agent as recited in claim 1, wherein transmitting the second key material comprises broadcasting the second key material. ### Claim 4 A Foreign Agent supporting Mobile IP and adapted for generating an authentication key to be shared between a Mobile Node and the Foreign Agent to which the Mobile Node has roamed, comprising: a processor; and a memory, at least one of the processor or the memory being adapted for: receiving by the Foreign Agent supporting Mobile IP a first key material generated by the Mobile Node, thereby enabling the Foreign Agent to generate a Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent; dynamically generating a second key material by the Foreign Agent; transmitting the second key material by the Foreign Agent to the Mobile Node, thereby enabling the Mobile Node to generate a Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent; and dynamically generating the Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent from the first key material by the Foreign Agent; wherein dynamically generating the second key material includes computing the value of Y=(gy)mod n, wherein y is a random integer, wherein Y is the second key material, and both g and n are group parameters that are universally known to the Mobile Node, Foreign Agent, and Home Agent; and wherein dynamically generating the Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent includes computing the value k=(Xy) mod n, wherein X is the first key material received from the Mobile Node, wherein k is the Mobile-Foreign authentication key. ### Claim 5 (depends on 4) The Foreign Agent as recited in claim 4, at least one of the processor or the memory being further adapted for: determining whether the Foreign Agent shares an authentication key with the Home Agent; when the Foreign Agent does not share an authentication key with the Home Agent, transmitting a request for a Foreign-Home authentication key. ### Claim 6 (depends on 5) The Foreign Agent as recited in claim 5, at least one of the processor or the memory being further adapted for: receiving key material generated by the Home Agent; and generating a Foreign-Home authentication key from the key material generated by the Home Agent. ### Claim 7 A Foreign Agent supporting Mobile IP and adapted for generating a Mobile-Foreign authentication key to be shared between a Mobile Node and the Foreign Agent and a Foreign-Home authentication key to be shared between the Foreign Agent and a Home Agent, comprising: a processor; and a memory, at least one of the processor or the memory being adapted for: receiving by the Foreign Agent supporting Mobile IP a first key material generated by the Mobile Node, thereby enabling the Foreign Agent to generate a Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent; dynamically generating by the Foreign Agent a second key material; transmitting by the Foreign Agent the second key material to the Mobile Node, thereby enabling the Mobile Node to generate a Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent; dynamically generating by the Foreign Agent the Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent from the first key material; receiving by the Foreign Agent a third key material generated by the Home Agent, thereby enabling the Foreign Agent to generate a Foreign-Home authentication key shared between the Home Agent and the Foreign Agent; dynamically generating by the Foreign Agent a fourth key material; transmitting by the Foreign Agent the fourth key material to the Home Agent, thereby enabling the Home Agent to generate a Foreign-Home authentication key shared between the Home Agent and the Foreign Agent; and dynamically generating by the Foreign Agent the Foreign-Home authentication key shared between the Home Agent and the Foreign Agent from the third key material; wherein dynamically generating the second key material includes computing the value of Y=(gy)mod n, wherein y is a random integer, wherein Y is the second key material, and both g and n are group parameters that are universally known to the Mobile Node, Foreign Agent, and Home Agent; and wherein dynamically generating the Mobile-Foreign authentication key shared between the Mobile Node and the Foreign Agent includes computing the value k=(Xy) mod n, wherein X is the first key material received from the Mobile Node, wherein k is the Mobile-Foreign authentication key. ### Claim 8 (depends on 7) The Foreign Agent as recited in claim 7, at least one of the processor or the memory being further adapted for: generating an ICMP Router Discovery Protocol (IRDP) router advertisement message including the second key material; wherein transmitting the second key material to the Mobile Node comprises transmitting the IRDP router advertisement message to the Mobile Node. ### Claim 9 (depends on 7) The Foreign Agent as recited in claim 7, wherein the Mobile-Foreign authentication key and the Foreign-Home authentication key are generated using the Diffie-Hellman Key Exchange scheme. ### Claim 10 (depends on 7) The Foreign Agent as recited in claim 7, at least one of the processor or the memory being further adapted for: receiving a first registration request from the Mobile Node, the first registration request having a Mobile-Foreign key request extension including the first key material and indicating a request to generate a key between the Mobile Node and the Foreign Agent; sending a first registration reply to the Mobile Node, the first registration reply having a Foreign-Home key request extension including the fourth key material and indicating a request for the Home Agent to generate a key between the Foreign Agent and the Home Agent; receiving a second registration request from the Mobile Node including the Mobile-Foreign key request extension and the Foreign-Home key request extension; forwarding the second registration request to the Home Agent; receiving a second registration reply from the Home Agent, the second registration reply having a Foreign-Home key reply extension including the third key material; appending a Mobile-Foreign key reply extension including the second key material to the second registration reply; and forwarding the second registration reply to the Mobile Node. ### Claim 11 (depends on 7) The Foreign Agent as recited in claim 7, at least one of the processor or the memory being further adapted for: activating the Foreign-Home authentication key. ### Claim 12 (depends on 10) The Foreign Agent as recited in claim 10, wherein the Mobile-Foreign key request extension, the Foreign-Home key request extension, the Mobile-Foreign key reply extension and the Foreign-Home key reply extension each includes a Security Parameter Index (SPI). ### Claim 13 (depends on 10) The Foreign Agent as recited in claim 10, at least one of the processor or the memory being further adapted for: determining whether the second registration reply indicates that the Home Agent has accepted the registration of the Mobile Node with the Home Agent; when it is determined that the Home Agent has accepted the registration of the Mobile Node with the Home Agent, obtaining the Foreign-Home key reply extension from the second registration reply and obtaining the third key material from the Foreign-Home key reply extension, thereby enabling the Foreign Agent to generate the Foreign-Home authentication key. ### Claim 14 (depends on 13) The Foreign Agent as recited in claim 13, at least one of the processor or the memory being further adapted for: when it is determined that the Home Agent has accepted the registration of the Mobile Node with the Home Agent, generating the Mobile-Foreign authentication key from the third key material. ### Claim 15 A Foreign Agent supporting Mobile IP and adapted for generating a Mobile-Foreign authentication key to be shared between a Mobile Node and the Foreign Agent, comprising: means for receiving a first registration request from the Mobile Node, the first registration request having a Mobile-Foreign key request extension including key material generated by the Mobile Node and indicating a request to generate a key between the Mobile Node and the Foreign Agent; means for determining whether the Foreign Agent shares an authentication key with the Home Agent; and means for generating key material and a Foreign-Home key request extension including the key material generated by the Foreign Agent and indicating a request for the Home Agent to generate a key between the Foreign Agent and the Home Agent when it is determined that the Foreign Agent does not share an authentication key with the Home Agent, composing a first registration reply including the Foreign-Home key request extension, and sending the first registration reply to the Mobile Node. ### Claim 16 In a Home Agent supporting Mobile IP, a method of performing registration of a Mobile Node visiting a Foreign Agent, comprising: receiving by the Home Agent a registration request including a Foreign-Home key request extension and identifying a Mobile Node, the Foreign-Home key request extension including key material generated by the Foreign Agent and indicating a request for the Home Agent to generate a key between the Foreign Agent and the Home Agent; dynamically generating by the Home Agent a Foreign-Home authentication key shared between the Home Agent and the Foreign Agent from the key material obtained from the Foreign-Home key request extension, wherein generating the Foreign-Home authentication key shared between the Foreign Agent and the Home Agent from the key material obtained from the Foreign-Home key request extension is performed by computing the value k=(Yx) mod n, wherein Y is the key material obtained from the Foreign-Home key request extension, wherein k is the Foreign-Home authentication key; generating by the Home Agent key material to be provided in a Foreign-Home key reply extension by computing the value of X=(gx)mod n, wherein x is a random integer, wherein X is the key material generated by the Home Agent, and both g and n are group parameters that are universally known to the Mobile Node, Foreign Agent and the Home Agent; composing by the Home Agent a registration reply including a Foreign-Home key reply extension including the key material generated by the Home Agent; and sending by the Home Agent the registration reply to the Foreign Agent, the registration reply indicating success or failure of the registration of the Mobile Node with the Foreign Agent. ### Claim 17 (depends on 16) The method as recited in claim 16, wherein the registration request and registration reply further includes a Mobile-Foreign key request extension, the Mobile-Foreign key request extension including key material generated by the Mobile Node and indicating a request to generate a key between the Mobile Node and the Foreign Agent. ### Claim 18 (depends on 16) The method as recited in claim 16, wherein the registration request further includes a Mobile-Home Authentication Extension, the method further comprising: verifying the Mobile-Home Authentication Extension to determine whether the Foreign-Home key request extension was modified; and composing the Foreign-Home key reply extension when it is determined that the Foreign-Home key request extension was not modified. ### Claim 19 (depends on 16) The method as recited in claim 16, wherein the Foreign-Home authentication key is generated according to the Diffie-Hellman key exchange scheme. ### Claim 20 (depends on 16) The method as recited in claim 16, further comprising: generating key material; and providing the key material generated by the Home Agent in the Foreign-Home key reply extension of the registration reply. ### Claim 21 (depends on 16) The method as recited in claim 16, further comprising: generating key material according to the Diffie-Hellman key exchange scheme; and providing the key material generated by the Home Agent in the Foreign-Home key reply extension of the registration reply. ### Claim 22 (depends on 16) The method as recited in claim 16, wherein the key material in the Foreign-Home key request extension and the key material in the Foreign-Home key reply extension are generated according to the Diffie-Hellman key exchange scheme. ### Claim 23 A Home Agent supporting Mobile IP, comprising: a processor; and a memory, at least one of the processor or the memory being adapted for: receiving by the Home Agent a registration request including a Foreign-Home key request extension and identifying a Mobile Node, the Foreign-Home key request extension including key material generated by a Foreign Agent and indicating a request for the Home Agent to generate a key between the Foreign Agent and the Home Agent; dynamically generating by the Home Agent a Foreign-Home authentication key shared between the Home Agent and the Foreign Agent from the key material obtained from the Foreign-Home key request extension, wherein generating the Foreign-Home authentication key shared between the Foreign Agent and the Home Agent from the key material obtained from the Foreign-Home key request extension is performed by computing the value k=(Yx) mod n, wherein Y is the key material obtained from the Foreign-Home key request extension, wherein k is the Foreign-Home authentication key; generating by the Home Agent key material to be provided in a Foreign-Home key reply extension by computing the value of X=(gx)mod n, wherein x is a random integer, wherein X is the key material generated by the Home Agent, and both g and n are group parameters that are universally known to the Mobile Node, Foreign Agent and the Home Agent; composing by the Home Agent a registration reply including a Foreign-Home key reply extension including the key material generated by the Home Agent; and sending by the Home Agent the registration reply to the Foreign Agent, the registration reply indicating success or failure of the registration of the Mobile Node with the Foreign Agent. ### Claim 24 (depends on 23) The Home Agent as recited in claim 23, wherein the registration request and registration reply further includes a Mobile-Foreign key request extension, the Mobile-Foreign key request extension including key material generated by the Mobile Node and indicating a request to generate a key between the Mobile Node and the Foreign Agent.