as illustrated in fig1 , a wireless communication network 10 generally includes a plurality of access terminals ( also called remote stations , mobile stations , subscriber units , or user equipment ) 12 a - 12 d , a plurality of base stations ( also called base station transceivers ( btss ) or node b ). 14 a - 14 c , a base station controller ( bsc ) ( also called radio network controller or packet control function 16 ), a mobile switching center ( msc ) or switch 18 , a packet data serving node ( pdsn ) or internetworking function ( iwf ) 20 , a public switched telephone network ( pstn ) 22 ( typically a telephone company ), and a packet switched data network 24 ( typically an internet protocol ( ip ) network ). for purposes of simplicity , four access terminals 12 a - 12 d , three base stations 14 a - 14 c , one bsc 16 , one msc 18 , and one pdsn 20 are shown . it would be understood by those skilled in the art that there could be any number of access terminals 12 , base stations 14 , bscs 16 , mscs 18 , and pdsns 20 . in one embodiment the wireless communication network 10 is a packet data services network . the access terminals 12 a - 12 d may be any of a number of different types of wireless communication device such as a portable phone , a cellular telephone that is connected to a laptop computer running ip - based web - browser applications , a cellular telephone with associated hands - free car kits , a personal data assistant ( pda ) running ip - based web - browser applications , a wireless communication module incorporated into a portable computer , or a fixed : location communication module such as might be found in a wireless local loop or meter reading system . in the most general embodiment , access terminals may be any type of communication unit . the access terminals 12 a - 12 d may advantageously be configured to perform one or more wireless packet data protocols such as described in , for example , the eia / tia / is - 707 standard . in a particular embodiment , the access terminals 12 a - 12 d generate ip packets destined for the ip network 24 and encapsulates the ip packets into frames using a point - to - point protocol ( ppp ). in one embodiment the ip network 24 is coupled to the pdsn 20 , the pdsn 20 is coupled to the msc 18 , the msc is coupled to the bsc 16 and the pstn 22 , and the bsc 16 is coupled to the base stations 14 a - 14 c via wirelines configured for transmission of voice and / or data packets in accordance with any of several known protocols including , e . g ., e1 , t1 , asynchronous transfer mode ( atm ), internet protocol ( ip ), point - to - point protocol ( ppp ), frame relay , high - bit - rate digital subscriber line ( hdsl ), asymmetric digital subscriber line ( adsl ), or other generic digital subscriber line equipment and services ( xdsl ). in an alternate embodiment , the bsc 16 is coupled directly to the pdsn 20 , and the msc 18 is not coupled to the pdsn 20 . during typical operation of the wireless communication network 10 , the base stations 14 a - 14 c receive and demodulate sets of reverse link signals from various access terminals 12 a - 12 d engaged in telephone calls , web browsing , or other data communications . each reverse link signal received by a given base station 14 a - 14 c is processed within that base station 14 a - 14 c . each base station 14 a - 14 c may communicate with a plurality of access terminals 12 a - 12 d by modulating and transmitting sets of forward link signals to the access terminals 12 a - 12 d . for example , as shown in fig1 , the base station 14 a communicates with first and second access terminals 12 a , 12 b simultaneously , and the base station 14 c communicates with third and fourth access terminals 12 c , 12 d simultaneously . the resulting packets are forwarded to the bsc 16 , which provides call resource allocation and mobility management functionality including the orchestration of soft handoffs of a call for a particular access terminal 12 a - 12 d from one base station 14 a - 14 c to another base station 14 a - 14 c . for example , an access terminal 12 c is communicating with two base stations 14 b , 14 c simultaneously . eventually , when the access terminal 12 c moves far enough away from one of the base stations 14 c , the call will be handed off to the other base station 14 b . if the transmission is a conventional telephone call , the bsc 16 will route the received data to the msc 18 , which provides additional routing services for interface with the pstn 22 . if the transmission is a packet - based transmission such as a data call destined for the ip network 24 , the msc 18 will route the data packets to the pdsn 20 , which will send the packets to the ip network 24 . alternatively , the bsc 16 will route the packets directly to the pdsn 20 , which sends the packets to the ip network 24 . in a wcdma system , the terminology of the wireless communication system components differs , but the functionality is the same . for example , a base station can also be referred to as a radio network controller ( rnc ) operating in a umis terrestrial radio access network ( u - tran ). in the various existing communication systems , different nomenclature exists for the various formats in which voice and data traffic can be transmitted , such as , e . g . frames , packets , and subpackets . the scope of the embodiments described herein extends to all wireless communication systems using any of the various transmission formats . however , for the purpose of illustrative ease , the term “ packets ” will be used herein to describe both the transmission channel format in which traffic is carried and the structure of the traffic . it should be noted that the “ packets ” of the cdma system are structurally distinct from the ip “ packets ” of the packet switched data network . both are units describing the format in which data is transmitted , but one is optimized for wireless networks and the other is optimized for a packet switched data network . for example , a data packet from an ip source would contain a header portion and a data portion . however , a data packet for transmission over - the - air carries data that has been encoded and modulated , and probably subjected to symbol repetition before being packed into a packet . hence , a packet from a packet switched data network will have to be reformatted for use on the wireless network . in the embodiments described herein and in the art , the meaning of the word “ packet ” is to be inferred by the usage of the word . since the subject matter of the embodiments is directed towards mobile ip telephony , the terminology of rfc 2002 ( october 1996 ) will also be used forthwith . the protocol promulgated in this document enables a mobile wireless communication device to change the point of attachment to the internet without having to change the ip address of the device . namely , rfc 2002 describes a registration scheme that informs a home agent of the location of a mobile communication device so that the home agent can route data packets through foreign agents . a “ home agent ” is the infrastructure element that processes ip packets at the home system of the access terminal . a “ foreign agent ” is the infrastructure element that services the access terminal at a visited system . the access terminal is also referred to as a “ mobile node ” ( mn ). in reference to fig1 , the functions of a foreign agent and / or home agent can be accomplished by a pdsn 20 in a visited network or a pdsn 20 in the home network . authentication , authorization , and accounting functions are usually performed by a server , which is referred to as an accounting , authorization , and accounting ( aaa ) server . the aaa server is communicatively coupled to either a pdsn and / or a bsc . in cdma2000 1 × ev - do , hereinafter referred to as ev - do , the wireless communication system entities of fig1 are conceptually simplified to an access terminal and an access network . an access terminal ( at ) is any device that allows a user to access a packet switched data network through the ev - do wireless access network . the access network ( an ) comprises any network equipment / entity that provides data connectivity between a packet switched data network and access terminals . fig2 is a diagram of the data connectivity between an at 200 , an an 210 , an an - aaa server 220 , and a pdsn 230 . a communication session is established between the at 200 and the an 210 when the at 200 desires access to the pdsn 230 . the session is implemented according to ppp protocols and is referred to as the authentication network stream . the an 210 communicates with the an - aaa server 220 in order to determine whether to allow the at 200 access to the pdsn 230 . based upon the authentication information conveyed within the authentication network stream , the an 210 transparently passes a service network stream between the at 200 and the pdsn 230 . the pdsn 230 further communicates with the an - aaa server 220 in order to determine whether to allow the at 200 access to a packet switched data network ( not shown ). based upon the authentication information conveyed within the service network stream , the pdsn 230 allows ip traffic between the packet switched data network ( not shown ) and the at 200 . hence , in an ev - do system , an authentication procedure takes place to ensure that the at is an authorized subscriber of the wireless network and an authentication procedure takes place to ensure that the at is the owner of the radio session . typically , the at stores the authentication information and the account information required for such procedures in a secure manner . one such authentication procedure is the challenge handshake authentication protocol ( chap ). other authentication protocols may be used without undue experimentation in the described embodiments , but for illustrative ease , chap will be described herein . examples of other authentication protocols are the mobile ip authentication protocol and the password authentication protocol ( pap ). in a challenge / response authentication protocol such as the ones listed above , the user is provided an unpredictable number and is challenged with the task to encrypt the unpredictable number and return a predictable result . if the user is authorized , then the user would have the correct mechanism , either in hardware or in software , to encrypt the unpredictable number in a manner that is expected by the challenger . for example , if the user is authorized , the user and the challenger would have a shared secret key that could be used to encrypt the challenge . unauthorized users would lack the appropriate secret key to encrypt the challenge into a response that is expected by the challenger . when a device is tethered to an at in order to use the at as a modem to send and receive ip traffic , various complications arise regarding the authentication of the device tethered to the at . the use of the word “ tethered ” herein is for describing the connectivity between a device to a wireless communication device . it is envisioned that such connectivity may be through either a physical connection , such as a cable attachments or direct contact , or a nonphysical connection , such as radio connections , optical connections , or infrared connections . for optimal performance , the tethered device would enter into ppp negotiations directly with the network . however , the tethered device may not be able to perform the authentication procedures necessary for ppp negotiations with the network because the required network security information is stored within the at , not the tethered device . passing the network security information from the at to the tethered device is an option that is highly undesirable due to the potential for misuse of said security information . one solution is to perform the ppp negotiations and authentication procedures between the at and the an , and to subsequently perform the ppp negotiations between the at and the tethered device without performing the authentication procedures . however , this solution is flawed in that two ( 2 ) ppp negotiations would be performed , which introduces an unacceptable time delay . moreover , this solution is flawed in that the tethered device is not informed that authentication has occurred . it should be noted that an end - to - end ppp negotiation process requires certain procedural steps , such as in authentication , to be completed by each end before the ppp session is fully established . the embodiments that are described herein are for performing a single end - to - end ppp negotiation that enhances the security of the authentication and account information while satisfying the authentication procedures of both the tethered device and the at . in a first embodiment , hardware within an at is configured to perform a proxy authentication of the tethered device . since the at is being used as a modem for the tethered device , the terminology of the mobile ip protocol is used in fig3 , so that the at is referred to as a mobile node ( mn ). fig3 illustrates the high level procedure for the proxy authentication . at instance 300 , a tethered device and a pdsn / iwf commence a ppp session using the link control protocol ( lcp ). lcp is used to establish , configure , maintain and terminate the ppp session . the mn acts as a transparent link between the tethered device and the pdsn / iwf . at instance 310 , the pdsn / iwf sends a chap challenge to the mn . at instance 320 , the mn forwards the chap challenge to the tethered device . at instance 330 , the mn generates a chap response using a password or shared key that is already stored within the mn . note that the mn generates the chap response independently of the tethered device . at instance 340 , the mn receives a chap response from the tethered device . upon receipt of chap response from the tethered device , the mn intentionally withholds transmission of the chap response from the tethered device to the pdsn / iwf . at instance 350 , the mn receives a chap success / failure indicator from the pdsn / iwf . at instance 360 , the mn forwards the chap success / failure indicator to the tethered device . hence , in the manner described above , the first embodiment allows the mn to perform a proxy authentication of a tethered device using chap . in other aspects of the embodiment , other challenge / response authentication protocols such as pap and mobile ip authentication may be used . in another embodiment , the mn may interchange the timing of instances 320 and 330 , so that the mn may generate a response to the challenge before forwarding the challenge to the tethered device . in general , the mn acts to intercept a challenge directed to the tethered device , generates an appropriate response to the challenge without waiting for input from the tethered device , forwards the challenge to the tethered device , and ignores the challenge response generated by the tethered device . if the response generated by the mn is lost , which may occur due to the error - prone nature of the wireless environment , then subsequent challenges retransmitted from the network will ensure that the authentication procedure is completed . the hardware used to implement the events of fig3 may be processing elements and memory elements configured to execute a set of instructions , wherein the set of instructions are for performing method steps corresponding to the above events . alternatively , some events may be performed by circuitry that is specific to a given function . for example , the generation of a challenge response may be performed by linear feedback shift registers and adders configured to implement hashing functions or other encryption algorithms . those of skill in the art would appreciate that the various illustrative logical blocks , modules , circuits , and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware , computer software , or combinations of both . to clearly illustrate this interchangeability of hardware and software , various illustrative components , blocks , modules , circuits , and steps have been described above generally in terms of their functionality . whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system . skilled artisans may implement the described functionality in varying ways for each particular application , but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention . the various illustrative logical blocks , modules , and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor , a digital signal processor ( dsp ), an application specific integrated circuit ( asic ), a field programmable gate array ( fpga ) or other programmable logic device , discrete gate or transistor logic , discrete hardware components , or any combination thereof designed to perform the functions described herein . a general purpose processor may be a microprocessor , but in the alternative , the processor may be any conventional processor , controller , microcontroller , or state machine . a processor may also be implemented as a combination of computing devices , e . g ., a combination of a dsp and a microprocessor , a plurality of microprocessors , one or more microprocessors in conjunction with a dsp core , or any other such configuration . the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware , in a software module executed by a processor , or in a combination of the two . a software module may reside in ram memory , flash memory , rom memory , eprom memory , eeprom memory , registers , hard disk , a removable disk , a cd - rom , or any other form of storage medium known in the art . an exemplary storage medium is coupled to the processor such the processor can read information from , and write information to , the storage medium . in the alternative , the storage medium may be integral to the processor . the processor and the storage medium may reside in an asic . the asic may reside in a user terminal . in the alternative , the processor and the storage medium may reside as discrete components in a user terminal . the previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention . various modifications to these embodiments will be readily apparent to those skilled in the art , and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention . thus , the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein .