Patent ID: 8335490

Claim:
A method comprising: deriving, by an authentication, authorization, and accounting (AAA) proxy (AAA-P), a first Pairwise Master Key (PMK 1 ) and a second Pairwise Master Key (PMK 2 ) from a Master Session Key (MSK); sending, by the AAA-P, the PMK 1 to a home gateway (HG) and a network access server (NAS), wherein the PMK 1 is used to establish a first tunnel between the HG and the NAS, and wherein the HG communicates wirelessly with a user equipment (UE); sending, by the AAA-P, the PMK 2 to the NAS, wherein the PMK 2 is used to establish a second tunnel between the UE and the NAS via the HG, and wherein the second tunnel comprises a secure connection between the UE and the NAS; and sending, by the UE, an encrypted communication to the NAS via the second tunnel, wherein the HG relays the encrypted communications to the NAS, wherein the HG does not have access to the PMK 2 or any encryption keys derived therefrom such that the HG cannot decrypt the encrypted communications, and wherein the PMK 2 is not distributed or otherwise made available to the HG such that the HG cannot decrypt the encrypted communications when relaying the encrypted communications from the UE to the NAS.