e new SKEYSEED key is computed from the old key SK_d, the secret key D-H and the random numbers Ni and Nr. SKEYSEED = PRF (old SK d, D-H key | Ni | Nr) To renew the ESP/AH SA key, the messages transmitted by the initiator and the responder are similar to the ones used in the creation of the security association. The initiator's request contains an N block (REKEY SA) containing the SPI value of the new security association (Figure 7.11). HDR, SK {N(REKEY_: SA), SA, Ni, [KEi], TSi, TSr} Initiator HDR, SK {SA, Nr, [KEr], TSi, TSr} Responder Figure 7.11. CREATE CHILD SA exchange renewal of ESP/AH SA key Wi-Fi Integration to the 4G Mobile Network 7.2. Application to the 4G mobile network 7.2.1. SWu tunnel establishment procedure The IPSec mechanism is implemented for the establishment of the SWu tunnel, at the end of the authentication phase using the 802. 1x mechanism described in Chapter 6, the mobile acting as the initiator and the evolved packet data gateway (ePDG) of the responder (Figure 7.12). IKE SA INIT server IKE SA INIT IKE AUTH Request DIAMETER AAR DIAMETER AIR DIAMETER AIA EAP Request EAP-Method AKA Challenge DIAMETER AAA EAP Request EAP-Method AKA Challenge IKE AUTH Response EAP Response EAP-Method AKA Challenge IKE AUTH Request EAP Response EAP-Method AKA' Challenge DIAMETER AAR DIAMETER SAR DIAMETER SAA EAP Success DIAMETER AAA EAP Success IKE_AUTH Response IKE AUTH Request IKE AUTH Response Figure 7.12. SWu tunnel establishment procedure 1) and 2) The two IKE SA INIT messages are used to negotiate the IKEv2 security association algorithms and to exchange D-H public values and random numbers (Nonce). SWu Tunnel Establishment 3) The mobile transmits the first message Request of the IKE AUTH phase containing SWu tunnel configuration proposals in the SA block, its identity in the IDi block and access point name (APN) information in the IDr block. The mobile does not transmit the AUTH block in order to warn the ePDG entity that it wishes to use the IKEv2 message to transport the EAP-AKA method. The identit