Patent ID: 8863236

Claim:
A method for establishing a communication session between a first endpoint and a second endpoint in a packet-switched communication network in which a first access device provides access for the first endpoint to the network and a second access device provides access for the second endpoint to the network, the method comprising the steps of: receiving at the first access device, a request from the first endpoint to establish the communication session with the second endpoint, wherein the first and second endpoints are either fixed or mobile endpoints, and communicate utilizing a communication protocol supporting fixed and mobile endpoints; conducting a secure key exchange between the first and second endpoints, wherein a shared secret key is generated; executing by the first and second access devices, a prefix reachability detection (PRD) protocol to determine whether the first endpoint is topologically legitimate, comprising the steps of: receiving by the second access device, a neighbor discovery message from the second endpoint; sending a Prefix Request Test Initialization (PRTI) message from the second access device to the first access device requesting a Neighbor Reachability Discovery for the first endpoint, the PRTI message including a signature of the second access device; verifying by the first access device that the PRTI message was sent by the second access device by retrieving a public key of the second access device and utilizing the public key to check the signature of the second access device: sending a discovery message from the first access device to the first endpoint; receiving by the first access device from the first endpoint, a response to the discovery message; determining by the first access device, whether the response includes a correct hash of the shared secret key; upon determining that the response includes the correct hash of the shared secret key, sending from the first access device to the second access device, a PRTI message response indicating the first endpoint is topologically legitimate; and upon determining that the response does not include the correct hash of the shared secret key, sending from the first access device to the second access device, a PRTI message response indicating the first endpoint is not topologically legitimate.