Patent ID: 8667151

Claim:
A method of establishing secure communications between two or more nodes of a network, comprising: establishing a first security association (SA) between a client and a network server, the first SA being an access-layer SA; at each of the client and the network server, deriving a secondary key from a key corresponding to the first SA; at a first network node, obtaining the secondary key from the network server; establishing a second SA between the first network node and the client using the secondary key, wherein the step of establishing the second SA comprises: executing a key exchange protocol between the first network node and the client to generate a seed key at each of the client and the first network node, wherein, at the first network node, the seed key is generated prior to the step of obtaining the secondary key from the network server; at the first network node, authenticating identity of the client upon receiving from the client a message having a first payload signed with the secondary key and by verifying the first payload using the secondary key; upon successful verification of the first payload using the secondary key, sending to the client a message having a second payload signed with the secondary key to enable the client to authenticate identity of the first network node by verifying the second payload using the secondary key; and deriving a session key for the second SA from the seed key; and at the client, deriving the session key from the seed key upon successful verification of the second payload using the secondary key; and securing one or more messages transmitted between the first network node and the client using said session key.