Patent ID: 7370194

Claim:
A method, implemented in a security gateway to provide an online service, the method comprising: receiving a data packet from a game console at the security gateway which communicatively links the game console and a private network that includes one or more servers configured to provide online services to the game console; checking whether the data packet is authenticated as being from the game console; and if the data packet is authenticated, then the security gateway: identifying a security key corresponding to the game console, decrypting data in the data packet using the security key, checking a type of the data packet, and handling the data packet based on the type of the data packet to request a service from at least one of the servers within the private network, generation of the requested service being abstracted from the authentication and decryption performed by the security gateway, wherein the security key is the result of: receiving a key exchange initiator packet from the game console, the packet including at least key exchange initiation message, a Kerberos authenticator, and a Kerberos security ticket, the authenticator is encrypted using a first key and the security ticket is encrypted using a second key, and the first key is different than the second key, the initiation message includes a NonceInit value generated by a game consol, a first Diffie-Hellman value, and a first Security Parameters Index value; authenticating the game console using the security gateway by verifying that the Kerberos security ticket is not stale, by checking a timestamp in the Kerberos authenticator, by comparing the a hash of the key exchange initiation message calculated by the security gateway with a hash of the key exchange initiation message found in the Kerberos authenticator, by checking to see if the Kerberos authenticator has be replayed; transmitting from the security gateway a key exchange response packet in response to the key exchange initiator packet, the response packet including a response message and an encrypted reply message, the response message including at least the NonceInit value, a NonceResp value generated by the security gateway, a second Diffie-Hellman value, and a second Security Parameters Index value, the encrypted reply message including at least the time stamp from the Kerberos authenticator, at least the time stamp authenticating the security gateway to the game console; and establishing the security key to be used by the security gateway and the game console to encrypt information to be sent to one another, the security key being based on at least portions of the security ticket, the NonceInit value, and the NonceResp value.