Methods and devices for establishing security associations and performing handoff authentication in communications systems

A first relay station for providing secure communications in a communication network, the first relay station comprising:

• at least one memory to store data and instructions;
• and
• at least one processor configured to access the memory and configured to, when executing the instructions:
• authenticate, in response to a signaling message received from a mobile station, the mobile station using an unsolicited security key received through a direct link from a base station, wherein the unsolicited security key received from the base station was generated from a prior authentication of the mobile station using signals transmitted through a second relay station from which the mobile station was handed off to the first relay station;
• wherein the security key is a master key and an authentication key (AK).

A system for providing secure communications, the system comprising:

• a base station configured to provide access to a communication network, authenticate a mobile station over the network, receive at least one security key, and pre-distribute the at least one security key;
• and
• a first relay station in communication with the base station through a direct link, for receiving the pre-distributed at least one security key unsolicited, and for providing secure data transmissions to the authenticated mobile station using the security key,
• wherein the unsolicited security key received from the base station comprises a master key, and was generated from a prior authentication of the mobile station using signals transmitted through a second relay station from which the mobile station was handed off to the first relay station;
• and
• the master key is an authentication key (AK).

A method of providing secure communications between a base station, a first relay station, and a mobile station in a communication network, the method comprising:

• performing, by the base station, key pre-distribution to distribute an unsolicited verification key corresponding to the mobile station to the first relay station through a direct link between the base station and the first relay station, wherein the unsolicited verification key distributed from the base station was generated from a prior authentication of the mobile station using signals transmitted through a second relay station from which the mobile station was handed off to the first relay station;
• performing key verification, by the first relay station, to identify the mobile station;
• and
• performing key verification, by the mobile station, to identify the first relay station.