Patent ID: 7181620
Filing Date: 2007-02-20
Classification: H04L

Abstract:
1. A method of registering a non-configured network device in a telecommunications network, the method comprising the computer-implemented steps of: providing, using a secure communication channel, information identifying a trusted device registration service to a first non-configured network packet-routing device for use in obtaining a longer-lived symmetric key; providing trusted information to the trusted device registration service that certifies that the first device is a known device within a security realm; authenticating the first device to the trusted device registration service; registering the first device in the network at the trusted device registration service, wherein the trusted device registration service establishes a longer-lived symmetric key and provides the first device with the longer-lived symmetric key, and wherein the longer-lived symmetric key is valid until a subsequent registering of the first device at the trusted registration service; receiving a message from the first device that requests network services, wherein the message from the first device contains the longer-lived symmetric key; authenticating the first device based on the longer-lived symmetric key; generating and providing a shorter-lived symmetric key to the first device based on authenticating the longer-lived symmetric key, wherein the shorter-lived symmetric key is valid no longer than a period during which the longer-lived symmetric key is valid; receiving a request from a second network packet routing device to obtain a session key for secure communications between the second device and the first device, wherein the second device sends the request in response to receiving a request from the first device to obtain a session key on behalf of both the first device and the second device; authenticating the request from the second device based on authenticating the shorter-lived symmetric key of the first device, wherein the request from the second device includes the shorter-lived symmetric key of the first device; and generating and providing a symmetric session key to the second device for use in subsequent secure peer-to-peer communications between the first device and the second device, wherein the first device obtains the symmetric session key from the second device without communication of the first device to a key management service or authoritative authentication service.