Method and system for authentication in wireless LAN system

• US 20020196764A1
• Filed: 06/24/2002
• Published: 12/26/2002
• Est. Priority Date: 06/25/2001
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Shimizu, Megumi
• Application Number:
  US10/177,019
• Publication Number:
  US 20020196764A1
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

An STA retrieves an AP data management table held in it to check whether the MAC address of an AP it intends to make wireless communication with is in the table. When the MAC address is not present in the table, the STA makes a public key authentication request to the AP. When the MAC address is present in the table, the STA public key re-authentication request to the AP.

Claims

1. An authentication method in a wireless LAN system, wherein an STA (mobile terminal station) retrieves an AP data management table held in the STA for checking whether the MAC address of an AP (base station), which the STA intends to make communication with, is present in the AP data management table, and when the MAC address is not present in the AP data management table, makes a public key authentication request to the AP, when the public key authentication request is proper, the AP effects authentication for the STA, when the MAC address is present in the AP data management table, the STA makes a public key re-authentication request to the AP, and when the public key re-authentication request is proper, the AP makes authentication of the STA.

2. The authentication method in a wireless LAN system according to claim 1, wherein in the AP data management table the STA holds MAC addresses of APs having public key authentication completion result in the order of newer authentication completion results by making public key authentication requests.

3. The authentication method in a wireless LAN system according to one of claims 1 and 2, wherein the AP holds an AP confidential key as its own confidential key, an AP public key as a public key corresponding to the AP confidential key and an AP user certificate as its own user certificate with the AP public key attached thereto, and the STA holds an STA confidential key as its own confidential key, an STA public key as a public key corresponding to the STA confidential key and an STA user certificate as its own user certificate with the STA public key attached thereto.

4. The authentication method in wireless LAN system according to claim 3, wherein the step of the public key authentication request from the STA to the AP is constituted by a public key authentication procedure, the public key authentication procedure comprising a step authentication request from the STA to the AP, a step of transmitting the AP user certificate from the AP having received the authentication request to the STA, a step, in which the STA having received the AP user certificate checks the AP user certificate, then produces a ciphered STA user certificate by ciphering the STA user certificate by using the AP public key attached to the AP user certificate and then transmits the ciphered STA user certificate, and a step, in which the AP having received the ciphered STA user certificate reproduces the STA user certificate by deciphering the ciphered STA user certificate with the AP confidential key, then checks the reproduced STA user certificate, then produces a ciphered shared key by ciphering the shared key produced by the AP by using the STA public key attached to the STA user certificate and notifying the authentication permission to the STA, wherein the STA having received the ciphered shared key reproduces the shared key by deciphering the ciphered shared key with the STA confidential key and uses the reproduced shared key for subsequent encryption frame transmission.

5. The authentication method in a wireless LAN system according to claim 4, wherein the algorithm number of a frame body part in the MAC frame that is transmitted and received when the STA requests the public key authentication to the AP is number “

n”

other than “

0” and

“

1”

.

6. The authentication method in a wireless LAN system according to claim 5, wherein the AP holds a public key management table, and in the public key management table MAC addresses of STAs which the AP has past authentication permission notification results to, the STA public keys of the STAs and shared keys which the AP has generated and issued at the time of authentication permission of the STAs are held in the order of newer authentication permissions.

7. The authentication method in a wireless LAN system according to claim 6, wherein the public key re-authentication request from the STA to the AP is a public key re-authentication procedure, the re-authentication procedure comprising a step, in which the STA makes a re-authentication request to the AP, and a step, in which the AP having received the re-authentication request retrieves the public key management table held in the AP to check whether the MAC address of the STA having transmitted the public key management request is present in the table, and when it is found as a result of the check that the MAC address of the STA is present in the public key management table and also that the STA public key as public key corresponding to the MAC address is held in the table, the AP generates a new shared key as a new shared key designated with respect to the STA, generates a ciphered new shared key by ciphering the new shared key with the STA public key and notifying authentication permission to the STA by transmitting the ciphered new shared key thereto, and the STA having received the ciphered new shared key reproduces the new shared key by deciphering the ciphered new shared key with the STA confidential key for using the new shared key for subsequent encryption frame communication.

8. The authentication method in a wireless LAN system according to claim 7, wherein the algorithm number of frame body part of the MAC frame received at the time the public key re-authentication request from the STA to the AP is a given number “

m”

other than “

0”

, “

1” and

“

n”

.

9. An authentication system in a wireless LAN system comprising, an STA (mobile terminal station) which retrieves an AP data management table held in the STA for checking whether the MAC address of an AP (base station), which the STA intends to make communication with, is present in the AP data management table, and when the MAC address is not present in the AP data management table, makes a public key authentication request to the AP, when the MAC address is present in the AP data management table, makes a public key re-authentication request to the AP, and the AP which makes authentication of the STA when the public key re-authentication request is proper.

10. The authentication system in a wireless LAN system according to claim 9, wherein in the AP data management table the STA holds MAC addresses of APs having public key authentication completion result in the order of newer authentication completion results by making public key authentication requests.

11. The authentication system in a wireless LAN system according to one of claims 9 and 10, wherein the AP holds an AP confidential key as its own confidential key, an AP public key as a public key corresponding to the AP confidential key and an AP user certificate as its own user certificate with the AP public key attached thereto, and the STA holds an STA confidential key as its own confidential key, an STA public key as a public key corresponding to the STA confidential key and an STA user certificate as its own user certificate with the STA public key attached thereto.

12. The authentication system in wireless LAN system according to claim 11, wherein in the step of the public key authentication request from the STA to the AP, an authentication request is made from the STA to the AP, the AP user certificate is transmitted from the AP having received the authentication request to the STA, the STA having received the AP user certificate checks the AP user certificate, then produces a ciphered STA user certificate by ciphering the STA user certificate by using the AP public key attached to the AP user certificate and then transmits the ciphered STA user certificate to the AP, the AP having received the ciphered STA user certificate reproduces the STA user certificate by deciphering the ciphered STA user certificate with the AP confidential key, then checks the reproduced STA user certificate, then produces a ciphered shared key by ciphering the shared key produced by the AP by using the STA public key attached to the STA user certificate and notifying the authentication permission to the STA, and the STA having received the ciphered shared key reproduces the shared key by deciphering the ciphered shared key with the STA confidential key and uses the reproduced shared key for subsequent encryption frame transmission.

13. The authentication system in a wireless LAN system according to claim 12, wherein the algorithm number of a frame body part in the MAC frame that is transmitted and received when the STA requests the public key authentication to the AP is number “

n”

other than “

0” and

“

1”

.

14. The authentication system in a wireless LAN system according to claim 13, wherein the AP holds a public key management table, and in the public key management table MAC addresses of STAs which the AP has past authentication permission notification results to, the STA public keys of the STAs and shared keys which the AP has generated and issued at the time of authentication permission of the STAs are held in the order of newer authentication permissions.

15. The authentication system in a wireless LAN system according to claim 14, wherein the public key re-authentication request from the STA to the AP is a public key re-authentication procedure, the re-authentication procedure comprising a step, in which the STA makes a re-authentication request to the AP, and a step, in which the AP having received the re-authentication request retrieves the public key management table held in the AP to check whether the MAC address of the STA having transmitted the public key management request is present in the table, and when it is found as a result of the check that the MAC address of the STA is present in the public key management table and also that the STA public key as public key corresponding to the MAC address is held in the table, the AP generates a new shared key as a new shared key designated with respect to the STA, generates a ciphered new shared key by ciphering the new shared key with the STA public key and notifying authentication permission to the STA by transmitting the ciphered new shared key thereto, and the STA having received the ciphered new shared key reproduces the new shared key by deciphering the ciphered new shared key with the STA confidential key for using the new shared key for subsequent encryption frame communication.

16. The authentication system in a wireless LAN system according to claim 15, wherein the algorithm number of a frame body part in the MAC frame that is transmitted and received when the STA requests the public key authentication to the AP is number “

m”

other than “

0”

, “

1” and

“

n”

.