Key exchange for a network architecture
AssigneeMicrosoft Technology Licensing, LLC
InventorsMohamed Khalil, Raja P. Narayanan, Haseeb Akhtar, Emad A. Qaddoura
Life of this patent
Estimating the term…
Abstract
Provided is a method of providing secure communication between an initiator and a responder in a communication network. The method includes providing an encryption key for securing communications between an initiator and a responder in a communications network that includes the initiator generating an initiator Diffie-Hellman computed value, the initiator transmitting the initiator Diffie-Hellman computed value to the responder, the responder generating the encryption key and a responder Diffie-Hellman computed value, the responder transmitting the responder Diffie-Hellman computed value to the initiator, and the initiator generating the encryption key.
Claims20
An apparatus for a mobile node, the apparatus comprising:
- a processor;
- and
- a memory comprising instructions executable by the processor to configure the mobile node to provide secure communication with a home domain while roaming over a foreign domain, the instructions configuring the mobile node to:
- transmit a registration request to a home agent in the home domain, the registration request including an identity of a user of the mobile node in an encrypted form and network routing information in a non-encrypted form, to enable the home agent to authenticate the registration request from the mobile node;
- receive a registration reply from the home agent, the registration reply comprising a plurality of encryption keys for encrypting messages communicated between and among the mobile node, the home agent, and a foreign agent in the foreign domain, the plurality of encryption keys comprising a first encryption key corresponding to messages communicated between the mobile node and the home agent, a second encryption key corresponding to messages communicated between the home agent and the foreign agent, and a third encryption key corresponding to messages communicated between the mobile node and the foreign agent.
An apparatus for a home agent, the apparatus comprising:
- a processor;
- and
- a memory comprising instructions executable by the processor to configure the home agent in a home domain to provide secure communication with a mobile node roaming over a foreign domain, the instructions configuring the home agent to:
- receive a registration request from the mobile node, the registration request including an identity of a user of the mobile node in an encrypted form and network routing information in a non-encrypted form;
- authenticate the registration request based on the encrypted identity of the user of the mobile node;
- generate a registration reply comprising a plurality of encryption keys for encrypting messages communicated between and among the mobile node, the home agent, and a foreign agent in the foreign domain, the plurality of encryption keys comprising a first encryption key corresponding to messages communicated between the mobile node and the home agent, a second encryption key corresponding to messages communicated between the home agent and the foreign agent, and a third encryption key corresponding to messages communicated between the mobile node and the foreign agent;
- and
- transmit the registration reply to the mobile node.
An apparatus for a foreign agent, the apparatus comprising:
- a processor;
- and
- a memory comprising instructions executable by the processor to provide secure communication between a mobile node roaming over a foreign domain and a home agent in a home domain, the instructions configuring the foreign agent to:
- generating an advertisement of services;
- receive, in response to the advertisement, a registration request from the mobile node, the registration request including an identity of a user of the mobile node in an encrypted form and network routing information in a non-encrypted form;
- relay the registration request to the home agent;
- in response to relay of the registration request, receive, based on the home agent authenticating the user of the mobile node, the foreign agent, and the foreign domain, a registration response comprising a plurality of encryption keys for encrypting messages communicated between and among the mobile node, the home agent, and the foreign agent in the foreign domain, the plurality of encryption keys comprising a first encryption key corresponding to messages communicated between the mobile node and the home agent, a second encryption key corresponding to messages communicated between the home agent and the foreign agent, and a third encryption key corresponding to messages communicated between the mobile node and the foreign agent;
- and
- extract a first set of encryption keys from the plurality of encryption keys in the registration reply;
- and
- forward the registration reply to the mobile node.
Dependencies are inferred from the claim text.