Patent ID: 8817990

Claim:
A method for media-independent handover key management for secure key distribution among a Key Distribution Center, a target authenticator, and a mobile node using Kerberized Handover Keying in a reactive mode employing ticket delivery after handover, the method comprising: a) transmitting by the mobile node an Authentication Server Request (AS-REQ) message to the Key Distribution Center, and receiving by the mobile node an Authentication Server Reply (AS-REP) message from the Key Distribution Center comprising a Ticket Granting Ticket (TGT), wherein the Ticket Granting Ticket (TGT) contains information required to establish a security association between the mobile node and the target authenticator; b) in response to a handover of the mobile node from an initial point of attachment to the target authenticator and the mobile node receiving the Ticket Granting Ticket (TGT), (i) sending by the mobile node a trigger message to the target authenticator and (ii) configuring the mobile node and the target authenticator to perform reversed Kerberos roles such that the mobile node functions as a Kerberos server and the target authenticator functions as a Kerberos client; c) after step b), transmitting, by the target authenticator functioning as the Kerberos client, a Ticket Granting Service Request (TGS-REQ) message to the Key Distribution Center, and receiving by the target authenticator a Ticket Granting Service Reply (TGS-REP) message from the Key Distribution Center in order to obtain a per-authenticator ticket (T) for the mobile node, wherein the per-authenticator ticket (T) includes a session key; d) after step c), transmitting by the target authenticator a Access Point Request (AP-REQ) to the mobile node functioning as the Kerberos server, and having the mobile node transmit an Access Point Reply (AP-REP) to the target authenticator in order to authenticate the mobile node and to establish the security association between the mobile node and the target authenticator by using the session key included in the per-authenticator ticket (T); wherein the target authenticator is an access point to an access network, and wherein the initial point of attachment is an Extensible Authentication Protocol (EAP) authenticator that provides initial network access for the mobile node by authenticating the mobile node using an EAP method, and wherein the secure key distribution using Kerberized Handover Keying is employed when the mobile node hands over from the EAP authenticator to the target authenticator; and wherein the Kerberized Handover Keying is employed such that all re-authentication signaling using Extensible Authentication Protocol (EAP) and Authentication, Authorization and Accounting (AAA) by the mobile node is eliminated after handover of the mobile node from the the initial point of attachment.