Patent ID: 8707416

Claim:
A method, comprising: causing a mobile device to bootstrap Kerberos from EAP including: employing EAP for initial network access authentication of the mobile device and Kerberos for provisioning session keys to multiple different protocols to support multiple network applications, including: a) configuring the mobile node with an EAP peer that negotiates with an EAP server on capabilities regarding an EAP extended functionality pertaining to Kerberos, including employing an EAP extension method (EAP-EXT) that provides capabilities exchange between the EAP server and the EAP peer regarding Kerberos functionality, including: i) the EAP peer receiving a request message transmitted from the EAP server having a new capability bit (K) in a capabilities field related to Kerberos functionality; and ii) having the EAP peer transmit a response message with a new capability bit (K) in a capabilities field related to the Kerberos functionality, wherein an initial authentication for network access in a visited domain is employed to provision session keys to multiple different protocols used within the domain, including link-layer and application-layer protocols, whereby link-layer handover performance is optimized by eliminating EAP signaling for handover within the domain, including intra-authenticator and inter-authenticator handovers.