Session Key Generation and Distribution with Multiple Security Associations per Protocol Instance

An apparatus comprising:

• user equipment configured for communication with an access network of a communication system;
• the user equipment being operative to execute a designated portion of a single instance of a session key generation protocol in order to generate a plurality of security associations between the user equipment and a first network element of the communication system;
• wherein the user equipment utilizes a first one of the security associations to secure data sent between the user equipment and the first network element in an ongoing communication;
• and
• wherein in conjunction with a handoff of the ongoing communication from the first network element to a second network element, the user equipment selects another one of the security associations, and utilizes the selected other one of the security associations to secure data sent between the user equipment and the second network element in the ongoing communication.

A method comprising:

• executing in a network element of a communication system a designated portion of a single instance of a session key generation protocol in order to generate a plurality of security associations between the network element and user equipment of the communication system;
• selecting one of the security associations to utilize for data security in an ongoing communication involving the user equipment;
• and
• responsive to a handoff request, selecting another one of the security associations to utilize for data security in the ongoing communication.

An apparatus comprising:

• a network element configured for communication with user equipment of a communication system;
• the network element being operative to execute a designated portion of a single instance of a session key generation protocol in order to generate a plurality of security associations between the network element and the user equipment;
• wherein the network element is configured to select one of the security associations to utilize for data security in an ongoing communication involving the user equipment;
• and
• wherein responsive to a handoff request another one of the security associations is selected to utilize for data security in the ongoing communication.