Patent ID: 8625787

Claim:
A method, comprising: in a communication system wherein a first computing device is configured to perform a key management function for first user equipment and a second computing device is configured to perform a key management function for second user equipment, wherein the first user equipment seeks to initiate communication with the second user equipment, wherein the first computing device and the second computing device do not have a pre-existing security association there between, and wherein a third computing device is configured to perform a key management function and has a pre-existing security association with the first computing device and a pre-existing security association with the second computing device, the third computing device performing steps of: receiving a request from one of the first computing device and the second computing device; in response to the request, facilitating establishment of a first security association between the first computing device and the second computing device such that the first computing device and the second computing device then facilitate establishment of a second security association different than the first security association between the first user equipment and the second user equipment; and sending cryptographic information and a data item comprising a ticket or voucher to the first computing device, the first computing device and the second computing device being on a lower level of a key management hierarchy and the third computing device being on a higher level of the hierarchy.