# US 8,788,821 B2 · Method and apparatus for securing communication between a mobile node and a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,821 B2
- Document ID: US8788821B2
- Status: Granted
- Kind: B2
- Application number: 13/622,413
- Filed: 2012-09-19
- Published: 2013-01-24
- Granted: 2014-07-22
- Earliest claimed: 2003-11-26
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Kuntal Chowdhury
- Web page: https://patentgrep.com/patent/US8788821B2

## CPC

- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/10: Integrity
- H04W 12/50: Secure pairing of devices
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 2463/062: applying encryption of the keys
- H04W 12/06: Authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

In accordance with the teachings of the present invention, a method and apparatus is presented for securely negotiating a session key between a mobile node and a network node, such as a first hop IP router. A session key is encoded using asymmetric encryption. The encrypted session key is then communicated to the first hop IP router for later use. In accordance with another teaching of the present invention, the session key is then used by the mobile node and a first hop IP router to authenticate a message. Lastly, in accordance with the third teaching of the present invention, a standardized protocol is used to securely negotiate the session key between the mobile node and the first hop IP router.

## Claims

### Claim 1

A method of generating a message comprising the steps of:
a device accessing a message;
the device generating a checksum of the message;
the device accessing a session key, wherein the session key is negotiated prior to the accessing by:
initiating a communication session using a protocol;
receiving a public key within a vendor specific packet of the protocol, wherein the vendor specific packet includes a field indicating that the packet includes data in a format specified by a vendor;
generating a session key from the public key; and
communicating the session key within an initial request message (RRQ) of the protocol;
the device generating an authentication code by performing a one-way hash function on the checksum using the session key; and
the device generating an output message that includes the message and the authentication code, wherein the output message is intended for a first hop IP router.

### Claim 2 (depends on 1)

The method of claim 1,
wherein the device is a mobile node and the communication session is initiated with a router in a network; and
wherein initiating the communication session includes registering or authenticating the mobile node within the network using the protocol.

### Claim 3 (depends on 1)

The method of claim 1, wherein said generating the output message comprises encoding the authentication code with the message.

### Claim 4 (depends on 1)

A method of generating a message as set forth in claim 1, wherein the device comprises a mobile node.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
the device wirelessly transmitting the output message to a base station.

### Claim 6 (depends on 1)

The method of claim 1, wherein said generating the output message comprises combining the authentication code and the message.

### Claim 7

A mobile device, comprising:
wireless communication circuitry for performing wireless communication;
processing hardware coupled to the wireless communication circuitry, wherein the processing hardware is configured to:
access a message;
generate a checksum of the message;
access a session key, wherein the processing hardware is configured to negotiate the session key prior to accessing the message by:
initiating a communication session using a protocol;
receiving a public key within a vendor specific packet of the protocol, wherein the vendor specific packet includes a field indicating that the packet includes data in a format specified by a vendor;
generating a session key from the public key; and
communicating the session key within an initial request message (RRQ) of the protocol;
generate an authentication code by performing a one-way hash function on the checksum using the session key;
generate an output message that includes the message and the authentication code; and
transmit the output message via the wireless communication circuitry, wherein the output message is intended for a first hop IP router.

### Claim 8 (depends on 7)

The mobile device of claim 7, wherein the processing hardware comprises a memory medium storing program instructions and a processor coupled to the memory medium and configured to execute the program instructions.

### Claim 9 (depends on 7)

The mobile device of claim 7, wherein generating the output message includes combining the authentication code and the message.

### Claim 10 (depends on 7)

The mobile device of claim 7, wherein generating the output message includes appending the authentication code to the message.

### Claim 11 (depends on 7)

The mobile device of claim 7, wherein generating the output message includes encoding the authentication code with the message.

### Claim 12 (depends on 7)

The mobile device of claim 7, wherein the mobile device is configured to transmit the output message to a base station.

### Claim 13

A non-transitory, computer accessible memory medium comprising program instructions, wherein the program instructions are executable by a mobile device to:
access a message;
generate a checksum of the message;
access a session key, wherein the program instructions are executable to negotiate the session key prior to the accessing the message by:
initiating a communication session using a protocol;
receiving a public key within a vendor specific packet of the protocol, wherein the vendor specific packet includes a field indicating that the packet includes data in a format specified by a vendor;
generating a session key from the public key; and
communicating the session key within an initial request message (RRQ) of the protocol;
generate an authentication code by performing a one-way hash function on the checksum using the session key; and
generate an output message that includes the message and authentication code, wherein the output message is intended for a first hop IP router.

### Claim 14 (depends on 13)

The non-transitory, computer accessible memory medium of claim 13, wherein generating the output message includes appending the authentication code to the message.