A method is provided for securing a PMIP tunnel between a serving gateway and a new access node through which an access terminal communicates. A PMIP key hierarchy unique to each access terminal is maintained by the gateway. The gateway uses a first node key to secure PMIP tunnels when authentication of the access terminal has been performed. A PMIP key is generated based on the first node key and the PMIP key is sent to the new access node to assist in establishing and securing a PMIP tunnel between the gateway and the new access node. Otherwise, when authentication of the access terminal has not been performed, the gateway generates a second node key and sends it to an intermediary network node which then generates and sends a PMIP key to the new access node. This second key is then used to secure the PMIP tunnel.
Drawings
Claims66
A method operational on an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, the method comprising:
receiving, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generating a first node key at the access gateway of the serving network;
and
sending the first node key from the access gateway of the serving network to an intermediary network node of an access network that can generate and provide a first PMIP key to the second access node.
1 more element
An access gateway of a serving network equipped to relay communications among one or more access networks and a home network, comprising:
a network interface;
a processing circuit communicatively coupled to the network interface and adapted to facilitate communications to and from a wireless access device, the processing circuit configured to
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network,
generate a first node key at the access gateway of the serving network, and
send the first node key from the access gateway of the serving network to an intermediary network node of an access network that can generate and provide a first PMIP key to the second access node.
2 more elements
An access gateway of a serving network equipped to relay communications among one or more access networks and a home network, comprising:
means for receiving, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
means for generating a first node key at the access gateway of the serving network;
and
means for sending the first node key from the access gateway of the serving network to an intermediary network node of an access network that can generate and provide a first PMIP key to the second access node.
1 more element
A circuit operational in an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, wherein the circuit is adapted to:
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generate a first node key at the access gateway of the serving network;
and
send the first node key from the access gateway of the serving network to an intermediary network node of an access network that can generate and provide a first PMIP key to the second access node.
1 more element
A non-transitory machine-readable medium comprising instructions for operating an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, which when executed by a processor causes the processor to:
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generate a first node key at the access gateway of the serving network;
and
send the first node key from the access gateway of the serving network to an intermediary network node of an access network that can generate and provide a first PMIP key to the second access node.
1 more element
A method operational in an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, comprising:
receiving, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generating a first node key at the access gateway of the serving network;
generating a first PMIP key at the access gateway of the serving network as a function of the first node key;
and
sending the first PMIP key from the access gateway of the serving network to the second access node.
2 more elements
An access gateway of a serving network equipped to relay communications among one or more access networks and a home network, comprising:
a network interface;
a processing circuit communicatively coupled to the network interface and adapted to facilitate communications to and from a wireless access device, the processing circuit configured to
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network,
generate a first node key at the access gateway of the serving network,
generate a first PMIP key at the access gateway of the serving network as a function of the first node key, and
send the first PMIP key from the access gateway of the serving network to the second access node.
3 more elements
An access gateway of a serving network equipped to relay communications among one or more access networks and a home network, comprising:
means for receiving, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
means for generating a first node key at the access gateway of the serving network;
means for generating a first PMIP key at the access gateway of the serving network as a function of the first node key;
and
means for sending the first PMIP key from the access gateway of the serving network to the second access node.
2 more elements
A circuit operational in an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, wherein the circuit is adapted to:
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generate a first node key at the access gateway of the serving network;
generate a first PMIP key at the access gateway of the serving network as a function of the first node key;
and
send the first PMIP key from the access gateway of the serving network to the second access node.
2 more elements
A non-transitory machine-readable medium comprising instructions for operating an access gateway of a serving network equipped to relay communications among one or more access networks and a home network, which when executed by a processor causes the processor to:
receive, at the access gateway of the serving network, a request to change a Proxy Mobile Internet Protocol (PMIP) tunnel binding for an access terminal associated with a home network from a first access node to a second access node where the access terminal is connected to the serving network via an access network;
generate a first node key at the access gateway of the serving network;
generate a first PMIP key at the access gateway of the serving network as a function of the first node key;
and
send the first PMIP key from the access gateway of the serving network to the second access node.
12/131,039Filed 31 May 2008 · us provisional application
Priority
31 May 2007
Published
US 2008/0298595 A14 Dec 2008
Granted
1 Jul 2014
Term ends
22 Aug 2031Estimated · howhide20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 1,178 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.
Using a trusted network node as an anchor: key distribution or pre-distribution; Key agreement
Life of this patent
About 4 years 10 months of term left · ends 22 Aug 2031 (estimated)
Priority31 May 2007
Filed31 May 2008
Granted1 Jul 2014
Today12 Oct 2026
Term ends22 Aug 2031
Priority31 May 2007
Granted1 Jul 2014
Term ends22 Aug 2031
Priority claimedParent application 60/941,256
Application filedUS 12/131,039
Assigned to Qualcomm Incorporatedassignment of assignor's interest
PublishedUS 2008/0298595 A1
GrantedUS 8,769,611 B2
TodayWithin its term
Term endsEstimated, includes 1,178 days of adjustment
Description8,519 words
Summary1,178 words
#The present Application for Patent claims priority to U.S. Provisional Application No. 60/941,256 entitled “Methods and Apparatus for Providing Key Hierarchy and Computation in Wireless Communication Networks” filed May 31, 2007, and assigned to the assignee hereof and hereby expressly incorporated by reference herein.
#At least one feature relates to communication systems, and, more particularly, to a method for facilitating secure proxy mobile IP (PMIP) key generation and distribution within a wireless network.
Brief description of the drawings10 figures
#Various features, nature, and advantages may become apparent from the detailed description set forth below when taken in conjunction with the drawings in which like reference characters identify correspondingly throughout.
#FIG. 1 is a block diagram of a UMB network in which one or more features of secure PMIP key distribution may be implemented according to one example.
#FIG. 2 is a diagram illustrating a secondary (PMIP) key hierarchy that may be maintained by a gateway for verifying handoff transfer requests according to one example.
Detailed description7,020 words
#In the following description, specific details are given to provide a thorough understanding of the configurations. However, it will be understood by one of ordinary skill in the art that the configurations may be practiced without these specific detail. For example, circuits may be shown in block diagrams in order not to obscure the configurations in unnecessary detail. In other instances, well-known circuits, structures and techniques may be shown in detail in order not to obscure the configurations.
#Also, it is noted that the configurations may be described as a process that is depicted as a flowchart, a flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination corresponds to a return of the function to the calling function or the main function.
#In one or more examples and/or configurations, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code means in the form of instructions or data structures and that can be accessed by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also be included within the scope of computer-readable media.