hod AKA' Reauthentication message containing a MAC seal. 7) Trusted Wi-Fi access transfers the EAP Response/EAP-Method AKA' Reauthentication message to the AAA server in a DER DIAMETER message. Steps 8 and 9 are identical to those described for initial authentication in Figure 6.8. 6.3.4. Application to the MIPv4 FA mechanism The MIPv4 FA (Mobile IP version 4 Foreign Agent) mechanism is an alternative for building the S2a tunnel containing the mobile stream. The MIPv4 FA mechanism defines the following three components: - the mobile node (MN) component integrated in the mobile; - the home agent (HA) component integrated in the PDN Gateway (PGW); - the foreign agent (FA) component integrated into an entity (e.g. a router) of the Wi-Fi access network, which is not necessarily the trusted Wi-Fi access. Mutual Authentication During the mutual authentication procedure, the AAA server and the mobile also generate the extended master session key (EMSK) from the two keys CK' and IK'. Two keys, MN-HA and MN-FA, are generated from the EMSK to protect the MIPv4 messages exchanged between, on the one hand, the component MN and, on the other hand, the components HA and FA. 1) The AAA server and the mobile derive the EMSK to generate the MIP-RK. 2) The AAA server and the mobile derive the MIP-RK to generate the FA-RK. The AAA server transfers the FA-RK to the trusted Wi-Fi access. 3) The AAA server and the mobile derive the key MIP-RK to generate the key MN-HA. The AAA server transfers the MN-HA key to the PGW entity. 4) The mobile and the trusted Wi-Fi access derive the FA-RK to generate the MN-FA key. Trusted Wi-Fi access transfers the MN-FA key to the FA component. SWu Tunnel Establishment 7.1. IPSec mechanism The IPSec (Internet Protocol Security) mechanism offers security services (authentication, integrity and confidentiality) in an identical way in IPv4 and IPv6. Their implementation is optional in IPv4 but mandatory in IPv6. Their use is optional. Security services are offered through the use of AH (Authentication Head