Handoff of a secure connection among gateways

A method comprising:

• establishing security associations between a client device and a first security gateway that is associated with a service provider that provides service to the client device;
• receiving, at the client device, a message from the first security gateway indicating that a security association address needs to be updated, the message including an address of a second security gateway, the updating of the security association address being initiated by the first security gateway and without being prompted by the client device, and
• at the client device, encrypting and decrypting messages transmitted to and received from the second security gateway without exchanging security keys with the second security gateway, the messages being encrypted or decrypted using security information previously used for encrypting or decrypting messages transmitted to or received from the first security gateway.

A method comprising:

• transferring a first end point of a secure tunnel from a first device to a second device by sending a first message from the first device to a third device, the third device located at a second end point of the secure tunnel, the message indicating that a security association address needs to be updated, the message including an address of the second device, the updating of the security association address being initiated by the first device and without being prompted by the third device, and
• sending a second message from the first device to the second device, the second message including security information used by the first device to encrypt and decrypt messages sent to and received from the third device through the secure tunnel.

A method comprising:

• transferring a first end point of a secure connection among a plurality of security gateways, the secure connection having a second end point that is maintained at a client device while the first end point is transferred among the plurality of security gateways, the transferring of the first end point among the plurality of security gateways being initiated by the security gateways and without being prompted by the client device,
• wherein transferring the first end point of the secure connection among the plurality of security gateways comprises transferring security information among the plurality of security gateways, the security information defining parameters of the secure connection.

A system comprising:

• a client device configured to establish security associations with a first security gateway by exchanging security keys with the first security gateway, the client device receiving service from a service provider associated with the first security gateway,
• wherein the client device is configured to recognize a message from the first security gateway indicating that a security association address needs to be updated, the message including an address of a second security gateway, the updating of the security association address being initiated by the first security gateway and without being prompted by the client device, and
• the client device is also configured to send encrypted messages to the second security gateway using the address included in the message, the client device encrypting the messages using security information previously used to encrypt messages sent to the first security gateway.

A system comprising:

• a plurality of security gateways that are configured to transfer a first end point of a secure connection among the plurality of security gateways, the secure connection having a second end point that is maintained at a client device while the first end point is transferred among the plurality of security gateways, the transferring of the first end point among the plurality of security gateways being initiated by the security gateways and without being prompted by the client device,
• wherein the plurality of security gateways are configured to transfer security information associated with the secure connection from a first one of the plurality of the security gateways to a second one of the plurality of security gateways when transferring the first end point of the secure connection from the first security gateway to the second security gateway.