KR20050065130A - A session key issuing method - Google Patents

Abstract

The present invention is to issue an effective and reliable session key when roaming a mobile node in mobile IPv6. To this end, public key infrastructure (PKI) technology is applied to the diameter protocol to define the method of issuing session keys through asymmetric keys as well as existing symmetric keys. It characterized in that to provide.

According to the present invention, the mobile node is issued a public key certificate from a certificate authority, so that a session key can be securely issued without a special end-to-end security association (SA) between existing diameter nodes. In addition, the public key certificate of the mobile node can be used in place of the existing AAA key of the symmetric key type, through which the session key can be issued by the AAA authentication server of the visited network, thereby providing an effective method for issuing a local session key. .

As a result, by eliminating the risk that the key is exposed to intermediate nodes in the key delivery process between the key generator and the key user, the reliability of the key issuance process can be improved, and the network traffic between the diameter nodes is reduced. Can be provided.

Description

A session key issuing method}

The present invention relates to a method for defining a reliable key distribution mechanism through an AAA authentication server in an AAA system based on a diameter protocol and providing an authentication and authorization mechanism optimized for Mobile IP Version 6 (MIPv6).

Meanwhile, a diameter-based AAA protocol has been proposed as a system for providing a service to a user in a mobile communication network in a mobile communication network of another provider besides the mobile communication provider to which the mobile communication network belongs.

The present invention applies a public key infrastructure to such a system, supports issuance and renewal of an existing AAA key, extends the public key infrastructure from an existing AAA entity to a mobile node, and distributes keys through a key wrapping mechanism. To provide confidentiality.

Diameter-based AAA systems provide authentication, authorization, and accounting services to users based on the diameter.

1 is a schematic diagram of an end-to-end security system model through a public key infrastructure (PKI) in a mobile IP protocol environment with AAA authentication according to the prior art.

Referring to FIG. 1, the system model includes an AAA Server in Foreign Domain (AAAF) 10, a Foreign Agent (FA) 12, and an AAA Authentication Server (AAA) in a home network. Server in Home Domain (AAAH) 11, Home Agent (HA) 13, Certificate Authority (CA) 14 for issuing certificates, and Mobile Node (MN) And (15).

The AAA authentication server (AAAF) 10 of the visited network and the AAA authentication server (AAAH) 11 of the home network provide a basis for mutual authentication and confidentiality through the DSA (Diameter Security Association). For this process, the certification authority (CA) 14 issues public key certificates to the AAA authentication server 10 of the visiting network and the AAA authentication server 11 of the home network, respectively, and through this, AAAF (10) and AAAH (11). DSA (Diameter Security Association) is established.

The foreign agent 12 must perform authentication on the mobile node 15 to verify the mobile node 15's service usage rights. However, since the external agent 12 cannot know the authentication information for the mobile node 15, it requests the AAA authentication server 11 in the home network to authenticate the mobile node through the AAA authentication server 10 of the visiting network. By being informed of the result, authentication of the mobile node is performed.

In this process, the AAA authentication server 11 of the home network generates and distributes a required key among the entities participating in the authentication process. In this process, there is a possibility that the key is exposed to an entity other than the key user.

FIG. 2 is a message flow diagram illustrating a method of applying a transport layer security (TLS) technology as an end-to-end security providing method proposed by the IETF according to the related art. That is, the method illustrated in FIG. 2 is a solution using a Transport Layer Security (TLS) technology among the MIP / AAA end-to-end security models that are proposed to compensate for vulnerabilities that may appear in the system model illustrated in FIG. 1.

The mobile node 20 requests the external agent FA 21 through a Registration ReQuest (RRQ) message to assign a home agent to the visited network while moving to the visited network (202). Accordingly, the FA 21 generates an AA Mobile Node Request (AMR) message and delivers it to the AAA authentication server AAAF 23 of the visited network (203). The AAA authentication server AAAF 23 of the next visited network sends an AMR message to the AAA authentication server AAAH 24 of the home network 204 to request authentication and authorization of the mobile node. The AAA authentication server AAAH 24 of the home network performs authentication and authority verification of the mobile node, and transmits a HAR message containing the result to the AAA authentication server AAAF 23 of the visiting network (205). The AAA authentication server AAAF 23 of the visited network allocates a home agent to the mobile node by transmitting a Home Agent MIP Request (HAR) message (206).

The assigned home agent 22 establishes a TLS session with the AAA authentication server AAAH 24 of the home network to share the session key with the mobile node (207), requests the session key (208), and issues it ( 209).

The FA 21 also establishes a TLS session with the AAA authentication server AAAH 24 of the home network (215), requests a session key (216) and receives it (217).

The foreign agent FA 21 then responds (218) to the mobile node 20 via the RRP message that the home agent is assigned to the mobile node 20 in the visited network.

As such, a direct TLS session (AAAH-FA session, AAAH-HA session) is established between the nodes 21 and 22 receiving the key and the AAA authentication server AAAH 24 of the home network, and a new key request command is added. By passing the key directly to the destination through the established TLS session, we eliminate the risk of exposing the key to an undesired node.

However, in the TLS solution, additional TLS sessions must be established in addition to the default TLS sessions between each node. Therefore, the overhead of handshake and record message exchange required in setting up a single TLS is increased. After the TLS session is established, the amount of communication due to the exchange of additional commands for key request is increased.

Therefore, the present invention has an object to compensate for the problems of the aforementioned end-to-end security (E2E Security) model. In addition, by applying a public key infrastructure (PKI) to support a stable and efficient AAA system, it minimizes the round trip of messages between diameter nodes and mobile nodes, and eliminates unnecessary key exposure during key distribution. The purpose is to ensure.

In order to achieve the above object, the present invention extends the issue range of public key certificate from an existing AAA entity to a mobile node in a method of applying a public key infrastructure technology in a MIPv6 / AAAv6 (Mobile IP Version 6 / AAA version 6) environment.

According to one aspect of the present invention, there is provided a method for issuing a session key according to roaming of a mobile node, comprising: issuing a public key certificate to an AAA authentication server of a mobile node and a home network, and using the public key certificate to generate a session AAA key. Encrypting.

According to another aspect of the present invention, in the method for issuing a session key, a key user of an access router and a home agent generates a session AAA key when a request for issuing a session key is performed, and the session AAA key is transmitted through a key-wrap AVP. And forwarding to the AAA authentication server of the home network.

Here, preferably, when using an existing symmetric key type AAA key, when the key user requests the session key from the AAA authentication server of the home network, generating a session AAA key having a 128-bit random number; do.

Another aspect of the present invention provides a method for generating a session key, comprising generating a required session key in an AAA authentication server of a visited network, encrypting the session key with a public key certificate of a mobile node, and transmitting the same.

The present invention will now be described in detail with reference to the accompanying drawings.

3 is a schematic diagram of a system model applying a public key infrastructure in a next-generation Mobile IPv6 environment with AAA authentication to which the present invention is applied.

Referring to FIG. 3, the system model includes the AAA authentication server AAAv 30 of the visiting network, the AAA authentication server AAAh 31 of the home network, the AAA client AAAc 32, the home agent HA 33, and the authentication. An engine CA 34 and a mobile node 35 are included.

AAA client AAAc 32 is an AAA client module in an access router of Mobile IPv6. The AAA client AAAc 32 receives a service request message from the mobile node 35 and delivers the service request message to the AAA authentication server AAAv 30 of the visited network and vice versa. The AAA authentication server AAAv 30 of the visited network transmits its authentication and authorization verification information to the AAA authentication server AAAh 31 of the home network according to the authentication and authorization verification request of the MN 35 of the AAA client AAAc 32. . The AAA authentication server AAAh 31 of the home network inquires the authentication and authorization information of the mobile node and informs the AAA authentication server AAAv 30 of the visited network accordingly. The mobile node 35 and the AAA authentication server AAAv 30 of the home network receive a public key certificate from the same certification authority, and the public node certificate of the mobile node may be used in place of the existing symmetric key type AAA key. The existing AAA key is a 128-bit secret key issued by the AAA authentication server AAAh 31 of the home network to the mobile node, whereby the AAA authentication server AAAh 31 of the home network performs authentication and authorization of the mobile node. However, the present invention provides the confidentiality and efficiency in the process of issuing a session key using the public node's public key certificate as the AAA key.

When issuing a session key, each key usage entity such as an access router and a home agent uses a key wrapping mechanism to maintain a logical secret channel with the key issuer, thereby ensuring the confidentiality of the key. Issuance of the AAA key through the public key infrastructure compensates for the conventional disadvantage of requiring the registration of the pre-private key between the mobile node and the home network's AAA authentication server, thereby providing an efficient regeneration and distribution mechanism of the AAA key. have. In addition, by defining a key issuing mechanism of the AAA authentication server (AAAv) of the visited network, the AAA authentication server of the visited network directly issues a key required when assigning a home agent (HA) in the visited network so that traffic between diameter nodes ( It is a system that reduces traffic.

To do this, add a message from the MIPv6 Key Request (MIPv6-Key-Request, MKR), the MIPv6 Key Response (MIPv6-Key-Answer, MKA), and key wrap AVP with the Session AAA Key. (Atribute-Value-Pair) was added.

Each key user for receiving a key generates a 128-bit session AAA key. The session AAA key is constructed using the random number generated by the key user and the address of the key user. The key user is a public key of the AAA authentication server of the home network, and generates a key wrapping AVP by encrypting the generated session AAA key. The AAA authentication server of the home network, which receives the key wrapping AVP from each user, decrypts the key wrapping AVP using its private key and obtains the session AAA key. The key delivery process to each user is protected by the session AAA key of each user obtained by the AAA authentication server of the home network. As shown in [Equation 1], each user extracts the relevant session key by using the session AAA key and the key material generated by the home AAA authentication server.

[Equation 1]

Key = HMAC-MD5 (Session AAA Key, {Key Material | Home Address})

4 is a message flow diagram illustrating a process of issuing a session key through a public key of a mobile node when a home agent (HA) is allocated in a home network according to a first aspect of the present invention. In the first aspect of the present invention shown in Figure 4 authentication and key delivery for the mobile node is based on the mobile node's public key certificate, the generation and distribution of the key is performed by the AAA authentication server 43 of the home network (MN -AR / MN-HA session key). In addition, the key user generates the key through the key material generated by the session AAA key and the home network AAA authentication server.

Referring to FIG. 4, first, the mobile node 40 generates authentication data using the mobile node's private key, and transmits a data authentication / authorization request to the AAA client AAAc 41 (Extensible Authentication Protocol, EAP). (402). Upon receiving this, the AAA client AAAc 41 transmits an authentication / authorization reservation request (ARR) based on the request (403). At this time, the AAA client AAAc 41 generates a session AAA key, encrypts it with the AAA authentication server public key of the home network, and delivers the session AAA key to the visited network AAA authentication server AAAv 42 (403). Upon receiving this, the AAAV 42 forwards the authentication / authorization reservation request to the AAA authentication server AAAh 43 of the home network (404).

The AAA authentication server AAAh 43 of the home network that receives the authentication / authorization reservation request authenticates the mobile node using the public node's public key certificate and generates a session key between the mobile node and the home agent. Next, the AAA authentication server AAAh 43 of the home network sends a home agent move IPv6 request (Home-Agent-MIPv6-Request, HOR) to the newly assigned home agent 44 (405), and the home agent 44 It receives and stores session key between mobile node and home agent in HOR message.

The newly assigned home agent 44 sends a home agent move IPv6 response (Home-Agent-MIPv6-Answer, HOA) to the AAA Authentication Server AAAh (43) of the home network after a Binding Update (406). The AAA authentication server AAAh (43) of the received home network decrypts the session AAA key, generates a key material between the mobile node and the access router to pass to the access router, and uses the public key of the mobile node to transfer the mobile node to the mobile node. It encrypts the key between the mobile node-access router and the mobile node-home agent and transmits an authentication / authorization response to the AAA authentication server AAAv 42 of the visited network (407).

The AAA authentication server AAAv 42 of the visiting network receives the authentication / authorization response to the AAA client AAAc 41 (408), and the AAA client AAAc (41) transmits the key material and the key material delivered through the authentication / authorization response. After generating the key between the mobile node and the access router by using the session AAA key generated by the self, it sends an authentication / authorization response to the mobile node 40 (409). The mobile node 40 receiving the authentication / authorization response decrypts the session key between the mobile node and the access router and between the mobile node and the home agent by using the private key of the mobile node.

5 is a message flow diagram illustrating a process of issuing a session key through a key through a public key of a mobile node when a home agent is allocated in a visited network according to a second aspect of the present invention.

In the second aspect of the invention shown in Figure 5, authentication and key delivery for the mobile node are based on the mobile node's public key certificate, and generation and distribution of keys (MN-AR and MN-HA keys) AAA authentication server 53 performs. As the public key infrastructure (PKI) is applied to the mobile node, the AAA authentication server of the visited network can securely transfer the session key generated by obtaining the public key certificate of the mobile node to the mobile node.

Referring to FIG. 5, when the mobile node 50 transmits a data authentication / authorization request (Extensible Authentication Protocol, EAP) to the AAA client AAAc 51 (502), the AAA client AAAc 51 performs the visited network AAA authentication. The authentication / authority reservation request is sent to the server AAAv 53 (503). The visited network AAA authentication server AAAv 53 receives the authentication / authority reservation request to the AAA authentication server AAAh 54 of the home network (504), and the AAA authentication server AAAh (54) of the home network is AAA authentication. The server AAAv 53 sends a home agent move IPv6 request (Home-Agent-MIPv6-Request, HOR) (503).

At this time, the AAA authentication server AAAv 53 of the visiting network generates a session node-to-home agent session key and transmits it to the newly assigned home agent 52, and requests the newly assigned home agent 52 a home agent move IPv6 request. (Home-Agent-MIPv6-Request, HOR) is transmitted (506). The newly assigned home agent 52 extracts the session key between the mobile node and the home agent, and sends a home agent move IPv6 response to the AAA authentication server AAAv 53 of the visiting network (Home-Agent-MIPv6-Answer, HOA). (507). The AAA Authentication Server AAAv (53) of the visiting network forwards the home agent mobile IPv6 response to the AAA Authentication Server of the home network (508), and the AAA Authentication Server AAAh (54) of the home network is forwarded to the AAA Authentication Server AAAv (53) of the visiting network. An authentication / authorization reservation response (AA Registration Answer, ARA) is sent (509).

The AAA authentication server AAAv 53 of the visited network that receives the authentication / authorization reservation response encrypts the session key between the mobile node and the home agent by using the mobile node's public key, and generates the session key between the mobile node and the access router. The session key between the mobile node and the access router is encrypted using the public node's public key. The mobile node-to-router key to be passed to the AAA client AAAc (51) is based on the hop-by-hop security mechanism provided by the Diameter by the AAA Authentication Server-AAA Client-to-AAA session session. Because it is guaranteed, it can be safely delivered to the AAA client AAAc 51. Thereafter, the AAA authentication server AAAv 53 of the visited network sends an authentication / authorization reservation response (AA Registration Answer, ARA) to the AAA client AAAC 51 (510). The AAA client AAAC 51 receives the extracted key between the mobile node and the access router, and then sends an authentication / authorization response to the mobile node 50 (511). The mobile node 50 receiving the authentication / authorization response decrypts the key between the mobile node-access router (MN-AR) and the mobile node-home agent (MN-HA) using the private key.

6 is a message flow diagram illustrating a session key issuing process through an AAA key using a symmetric key between a mobile node and an AAA authentication server (AAAh) of a home network when a home agent is allocated in a home network according to a third aspect of the present invention.

In the third aspect of the present invention shown in Figure 6, authentication and key delivery for the mobile node is based on the Long-Term Secret Key between the AAA authentication servers of the mobile node-home network, the key (MN-AR) And MN-HA key) generation and distribution are performed by the AAA authentication server of the home network. The session AAA key also protects the key passing process down to the keying subject.

Referring to FIG. 6, when the mobile node 60 sends an Extensible Authentication Protocol (EAP) to the AAA client AAAc 61 (602), the AAA client AAAC 61 generates a session AAA key. After encrypting it with the AAA authentication server public key of the home network, the authentication / authority reservation request is transmitted to the AAA authentication server AAAv 62 of the visited network (603). The AAA authentication server AAAv (62) of the visited network receives it to the AAA authentication server AAAh (63) of the home network (604), and the AAA authentication server AAAh (63) of the home network uses a longterm security key. After authenticating the mobile node, the mobile terminal generates a session key between the mobile node and the home agent, and transmits a home agent move IPv6 request (Home-Agent-MIPv6-Request, HOR) to the newly assigned home agent 64 (605). ). Upon receiving this request, the newly assigned home agent 64 extracts and stores the key between the mobile node and the home agent, and sends the home agent mobile IPv6 response to the AAA authentication server AAAh (63) of the home network (Home-Agent-MIPv6-Answer, HOA) is transmitted (606). The AAA authentication server AAAh (63) of the home network receives the decrypted session AAA key and generates a key material between the mobile node and the access router to be delivered to the AAA client. At the same time, it generates a mobile node-home agent key material to be delivered to the mobile node and sends an authentication / authorization reservation response (AA) to the AAA authentication server AAAv (62) of the visiting network (607). The AAA authentication server AAAv 62 of the received visited network sends an authentication / authorization reservation response to the AAA client 61 (608). The AAA client 61 extracts the session key between the mobile node and the access router using the key material and its session AAA key, and sends an authentication / authorization response to the mobile node (609). The mobile node 60 generates a key between the mobile node-access router and the mobile node-home agent from the key material between the mobile node-access routers and the mobile node-home agent based on the long term security key.

7 is a message flow diagram illustrating a session key issuing process through an AAA key using a symmetric key between a mobile node and an AAA authentication server of a home network when a home agent is allocated in a visited network according to a fourth aspect of the present invention.

In the fourth aspect of the present invention shown in Fig. 7, the authentication and key delivery for the mobile node is based on the long term security key between the AAA authentication servers of the mobile node-home network, and the key (MN-AR and MN-HA keys) Generation and distribution are performed by the AAA authentication server of the home network. In addition, a new Mobile IPv6 Key Request (MIPv6-Key-Request, MKA) 707 message and a Mobile IPv6 Key Response (MKA) 710 message are added to the home agent of the visited network. The session key is then passed directly to the destination node via the session AAA key.

Referring to FIG. 7, when the mobile node 70 transmits a data authentication / authorization request (Extensible Authentication Protocol, EAP) to the AAA client AAAc 71 (702), the AAA client AAAc 71 sends a session AAA key. After generation, it is encrypted with the AAA authentication server public key of the home network, and the authentication / authority reservation request is transmitted to the visited network AAA authentication server AAAv (73). The visited network AAA authentication server AAAv (73) receives it to the AAA authentication server 74 of the home network (704), and the AAA authentication server AAAh (74) of the home network is home to the AAA authentication server AAAv (73) of the visiting network. Send an Agent Mobile IPv6 Request (Home-Agent-MIPv6-Request, HOR) 705.

The AAA authentication server AAAv (73) of the visited network receives this information to the newly assigned home agent (72), and the newly assigned home agent (72) generates a session AAA session key and uses it as the public key of the home network. It encrypts the data and sends MIPv6-Key-Request to the AAA authentication server AAAv 73 of the visited network again (707). The AAA authentication server AAAv (73) of the visiting network passes this to the AAA authentication server AAAh (74) of the home network, and the AAA authentication server AAAh (74) of the home network generates key data between the mobile node and the home agent. The MIPv6-Key-Answer is sent to the visiting network AAA authentication server AAAv 73 (709).

AAA authentication server AAAv (73) of the visited network delivers it to the newly assigned home agent (72), which receives the home agent (72) using the key material to extract the session key between the mobile node and the home agent. The home agent moves IPv6 response (Home-Agent-MIPv6-Answer, HOA) to the AAA authentication server AAAv 73 of 711. Then, the AAA authentication server AAAv (73) of the visiting network delivers it to the AAA authentication server AAAh (74) of the home network (712), and the AAA authentication server AAAh (74) of the receiving home network receives the session AAA key generated by the AAA client. AAA authentication server AAAv of the visited network by decrypting with its own private key, generating mobile node-access router key material to be delivered to AAA client 71, and generating mobile node-home agent key material to be delivered to mobile node. 73, an authentication / authorization reservation response (AA Registration Answer, ARA) is transmitted (713). The AAA authentication server AAAv 73 of the visited network that receives this sends an authentication / authority reservation response to the AAA client AAAc 71 (714).

After receiving the authentication / authorization response, the AAA client AAAc (71) generates a session key between the mobile node and the access router using the key material, and then sends the authentication / authorization response to the mobile node 70 (715). The mobile node 70 generates a key between the mobile node-access router and the mobile node-home agent from the key material between the mobile node-access router and the mobile node-home agent based on the long term security key.

Through the above process, a base for secret communication and mutual authentication between mobile node-access routers and mobile node-home agents is provided.

 Command ABNF notation

MIPv6-Key-Request (MKR) :: = **** <Diameter Header: xxx, REQ> <Session-ID> {Auth-Application-Id} {Destination-Realm} {Origin-Host} {Origin-Realm} {Key-Wrap AVP} [Expected-Signed-AVP] [Proxy -Info] [Route-Record] [AVP] MIPv6-Key-Request (MKR) :: = **** <Diameter Header: xxx, ANS> <Session-ID> {Auth-Application-Id} {Origin-Realm} {Result-Code} {Security Key} {Expected-Signed-AVP} [Error-Message] [Proxy-Info ] [Route-Record] [AVP]

As described above, the present invention guarantees confidentiality in the key distribution process by allowing the key user to transfer the session AAA key to the key generator through a key wrapping mechanism, thereby publicly registering the AAA key that was previously registered only offline. By providing an environment that can replace AAA key through infrastructure, AAA Certificate Server (AAAv) of visit network directly issues key required when assigning home agent (HA) in visiting network. It is effective to let.

Therefore, the AAA authentication server (AAAh) of the home network performs the generation / distribution of keys between the mobile node-access router (MN-AR) and the mobile node-home agent (MN-HA) by applying the present invention. By reducing the communication between diameter nodes and preventing unnecessary exposure of the key to unrelated nodes, it is possible to build a safer and more efficient system than the existing system to which the present invention is not applied. have.

1 is a schematic diagram of an end-to-end security system model through a public key infrastructure (PKI) in a mobile IP protocol environment with AAA authentication according to the prior art;

2 is a message flow diagram of a method applying TLS (Transport Layer Security) technology to provide end-to-end security proposed by the IETF according to the prior art;

3 is a schematic diagram of a system model applying a public key infrastructure in a next-generation Mobile IPv6 environment with AAA authentication to which the present invention is applied;

4 is a message flow diagram of a session key issuing process through a public key of a mobile node when a home agent (HA) is allocated in a home network according to a first aspect of the present invention;

5 is a message flow diagram illustrating a process of issuing a session key through a key through a public key of a mobile node when a home agent is allocated in a visited network according to a second aspect of the present invention;

6 is a message flow diagram of a session key issuing process through an AAA key of a symmetric key type between a mobile node and an AAA authentication server (AAAh) of a home network when a home agent is allocated in a home network according to a third aspect of the present invention;

7 is a message flow diagram of a session key issuing process through a symmetric key type AAA key between a mobile node and an AAA authentication server of a home network when a home agent is allocated in a visited network according to a fourth aspect of the present invention.

Claims (9)

In the method for issuing a session key according to roaming of a mobile node, Issuing a public key certificate to the AAA authentication server of the mobile node and the home network; Encrypting a session AAA key using the public key certificate. In the session key issuing method, Generating a session AAA key when a key user of an access router and a home agent requests issuance of a session key; And transmitting the session AAA key to an AAA authentication server of a home network through a Key-Wrap AVP. The method of claim 1, In the case of using the existing symmetric key type AAA key, when the key user requests the session key from the AAA authentication server of the home network, the method further comprises generating a session AAA key having a 128-bit random number. How to issue a session key. The method of claim 1, And encrypting the session AAA key generated by the key usage entity with the public key of the AAA authentication server of the home network, to generate a Key-Wrap AVP. The method of claim 1, When the home agent is assigned to the mobile node from the AAA authentication server of the visited network through the existing symmetric key type AAA key, it generates a MIPv6-Key-Request message, and through this, the Key-Wrap AVP is sent to the AAA authentication server of the home network. Session key issuing method further comprising the step of passing. The method of claim 1, When the home agent is assigned to the mobile node in the AAA authentication server of the visited network through the existing symmetric key, the AAA authentication server of the home network that receives the MIPv6-Key-Request receives the MIPv6-Key-Answer message to generate the session key. Session key issuing method, characterized in that it further comprises the step of delivering the key material. The method of claim 1, In response to the request for issuing the session key, the AAA authentication server of the home network generates the key material and delivers the key material to the key user. Session key issuing method further comprising the step of extracting. In the method for generating a session key, And generating a required session key from the AAA authentication server of the visited network, encrypting it with the public key certificate of the mobile node, and transmitting the encrypted session key. The method of claim 8, When the mobile node requests a home agent assignment from the visiting network's AAA authentication server, the visiting network's AAA authentication server directly generates session keys and encrypts it with the mobile node's public key certificate. How to generate a session key.