TLS tunneling

• US 20030226017A1
• Filed: 05/30/2002
• Published: 12/04/2003
• Est. Priority Date: 05/30/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Simon, Daniel R., Ayyagari, Arun, Palekar, Ashwin
• Granted Patent: US 7,529,933 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

An authentication protocol can be used to establish a secure method of communication between two devices on a network. Once established, the secure communication can be used to authenticate a client through various authentication methods, providing security in environments where intermediate devices cannot be trusted, such as wireless networks, or foreign network access points. Additionally, the caching of session keys and other relevant information can enable the two securely communicating endpoints to quickly resume their communication despite interruptions, such as when one endpoint changes the access point through which it is connected to the network. Also, the secure communication between the two devices can enable users to roam off of their home network, providing a mechanism by which access through foreign networks can be granted, while allowing the foreign network to monitor and control the use of its bandwidth.

Claims

1. A method of authenticating a client computing device comprising:

authenticating a server computing device;

establishing a secure communication tunnel with the server computing device;

transmitting an identity information to the server computing device through the secure communication tunnel; and

transmitting an authentication information, according to an extensible authentication protocol, to the server computing device through the secure communication tunnel.

2. The method of claim 1, wherein the establishing the secure communication tunnel comprises:

transmitting a set of possible cryptographic mechanisms;

receiving a selected cryptographic mechanism from the set of possible cryptographic mechanisms;

deriving cryptographic keys for the selected cryptographic mechanism; and

implementing the selected cryptographic mechanism with the derived cryptographic keys.

3. The method of claim 2, wherein the deriving cryptographic keys includes deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

4. The method of claim 1, wherein the establishing the secure communication tunnel includes transmitting an alias as a user identification, and wherein the transmitting identity information includes transmitting a true user identification.

5. The method of claim 1, wherein the establishing the secure communication tunnel includes transmitting less than all of a user identification, and wherein the transmitting identity information includes transmitting all of the user identification.

6. The method of claim 1 further comprising:

receiving, from the server computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon the authentication mechanism; and

transmitting, to the server computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism.

7. The method of claim 1 farther comprising transmitting, to the server computing device, a request for re-authentication, the request comprising an identifier from a previous authentication session.

8. The method of claim 1, wherein the transmitting the authentication information to the server computing device comprises transmitting information contained in name/value pairs

9. The method of claim 1, wherein the transmitting the identity information to the server computing device comprises transmitting a human user identity information and a client computing device identity information;

and wherein the transmitting the authentication information comprises transmitting a human user authentication information and a client computing device authentication information.

10. The method of claim 1 further comprising:

authenticating, through the secure communication tunnel a second server computing device connected to the server computing device;

establishing, through the secure communication tunnel, an inner secure communication tunnel with the second server computing device;

transmitting a second identity information to the second server computing device through the inner secure communication tunnel; and

transmitting a second authentication information to the second server computing device through the inner secure communication tunnel.

11. A method of authenticating a client computing device comprising:

transmitting authentication information to the client computing device;

establishing a secure connection tunnel with the client computing device;

receiving an identity information from the client computing device through the secure communication tunnel; and

receiving an authentication information, according to an extensible authentication protocol, from the client computing device through the secure communication tunnel.

12. The method of claim 11, wherein the establishing the secure communication tunnel comprises:

receiving a set of possible cryptographic mechanisms;

selecting a selected cryptographic mechanism from the set of possible cryptographic mechanisms;

transmitting the selected cryptographic mechanism to the client computing device;

deriving cryptographic keys for the selected cryptographic mechanism; and

implementing the selected cryptographic mechanism with the derived cryptographic keys.

13. The method of claim 12, further comprising:

transmitting the derived cryptographic keys to an intermediate access point, the intermediate access point receiving transmissions from the client computing device.

14. The method of claim 12, wherein the deriving cryptographic keys includes deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

15. The method of claim 11 further comprising:

transmitting, to the client computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon the authentication mechanism; and

receiving, from the client computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism.

16. The method of claim 11 further comprising:

caching, in a session cache, session information for establishing the secure connection tunnel with the client computing device; and

re-authenticating the client computing device, wherein the re-authenticating comprises;

receiving a session identifier from the client computing device;

searching the session cache to locate a corresponding session information, corresponding to the session identifier; and

if the corresponding session information is found, establishing a secure connection tunnel with the client computing device using the corresponding session information.

17. The method of claim 16, wherein the caching session information only caches session information if the authentication information received from the client computing device authenticated the client computing device, the method further comprising authenticating the client computing device if the corresponding session information is found.

18. The method of claim 11 further comprising:

transmitting the identity information from the client computing device to a server computing device;

transmitting the authentication information from the client computing device to the server computing device;

receiving, from the server computing device, a client authentication message; and

authenticating the client computing device based on the client authentication message.

19. The method of claim 11, wherein:

the transmitting authentication information to the client computing device includes receiving the authentication information from a server computing device;

the establishing a secure connection tunnel with the client computing device includes forwarding encrypted packets, representing the secure connection tunnel, to and from the client computing device and the server computing device;

the receiving an identity information from the client computing device through the secure communication tunnel includes passing the identity information on to the server computing device; and

the receiving an authentication information from the client computing device through the secure communication tunnel includes passing the authentication information on to the server computing device.

20. The method of claim 11, further comprising transmitting an authentication response to the client computing device, in response to the authentication information received form the client computing device, the authentication response comprising name/value pairs.

21. The method of claim 11, wherein the receiving the identity information from the client computing device comprises receiving a human user identity information and a client computing device identity information;

and wherein the receiving the authentication information from the client computing device comprises receiving a human user authentication information and a client computing device authentication information.

22. The method of claim 21 further comprising determining a client computing device configuration based on the client computing device identity information and the client computing device authentication information.

23. A computer-readable medium having computer-executable instructions for authenticating a client computing device, the computer-executable instructions performing steps comprising:

authenticating a server computing device;

establishing a secure communication tunnel with the server computing device;

transmitting an identity information to the server computing device through the secure communication tunnel; and

transmitting an authentication information, according to an extensible authentication protocol, to the server computing device through the secure communication tunnel.

24. The computer readable-medium of claim 23, wherein the computer-executable instructions for establishing the secure communication tunnel comprise computer-executable instructions for:

transmitting a set of possible cryptographic mechanisms;

receiving a selected cryptographic mechanism from the set of possible cryptographic mechanisms;

deriving cryptographic keys for the selected cryptographic mechanism; and

implementing the selected cryptographic mechanism with the derived cryptographic keys.

25. The computer-readable medium of claim 23, wherein the computer-executable instructions for deriving cryptographic keys include computer-executable instructions for deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

26. The computer-readable medium of claim 23, wherein the computer-executable instructions for establishing the secure communication tunnel include computer-executable instructions for transmitting an alias as a user identification, and wherein the computer-executable instructions for transmitting identity information include computer-executable instructions for transmitting a true user identification.

27. The computer-readable medium of claim 23, wherein the computer-executable instructions for establishing the secure communication tunnel include computer-executable instructions for transmitting less than all of a user identification, and wherein the computer-executable instructions for transmitting identity information include computer-executable instructions for transmitting all of the user identification.

28. The computer-readable medium of claim 23 further comprising computer-executable instructions for:

receiving, from the server computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon the authentication mechanism; and

transmitting, to the server computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism.

29. The computer-readable medium of claim 23 further comprising computer-executable instructions for transmitting, to the server computing device, a request for re-authentication, the request comprising an identifier from a previous authentication session.

30. The computer-readable medium of claim 23, wherein the computer-executable instructions for transmitting the authentication information to the server computing device comprise computer-executable instructions for transmitting information contained in name/value pairs.

31. The computer-readable medium of claim 23, wherein the computer-executable instructions for transmitting the identity information comprise computer-executable instructions for transmitting a human user identity information and a client computing device identity information;

and wherein the computer-executable instructions for transmitting the authentication information comprise transmitting a human user authentication information and a client computing device authentication information.

32. The computer-readable medium of claim 23 comprising further computer-executable instructions for:

authenticating, through the secure communication tunnel, a second server computing device connected to the server computing device;

establishing, through the secure communication tunnel, an inner secure communication tunnel with the second server computing device;

transmitting a second identity information to the second server computing device through the inner secure communication tunnel; and

transmitting a second authentication information to the second server computing device through the inner secure communication tunnel.

33. A computer-readable medium having computer-executable instructions for authenticating a client computing device, the computer-executable instructions performing steps comprising:

transmitting authentication information to the client computing device;

establishing a secure connection tunnel with the client computing device;

receiving an identity information from the client computing device through the secure communication tunnel; and

receiving an authentication information, according to an extensible authentication protocol, from the client computing device through the secure communication tunnel.

34. The computer-readable medium of claim 33, wherein the computer-executable instructions for establishing the secure communication tunnel comprise computer-executable instructions for:

receiving a set of possible cryptographic mechanisms;

selecting a selected cryptographic mechanism from the set of possible cryptographic mechanisms;

transmitting the selected cryptographic mechanism to the client computing device;

deriving cryptographic keys for the selected cryptographic mechanism; and

implementing the selected cryptographic mechanism with the derived cryptographic keys.

35. The computer-readable medium of claim 34, further comprising computer-executable instructions for:

transmitting the derived cryptographic keys to an intermediate access point, the intermediate access point receiving transmissions from the client computing device.

36. The computer-readable medium of claim 34, wherein the computer-executable instructions for deriving cryptographic keys include computer-executable instructions for deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

37. The computer-readable medium of claim 33 further comprising computer-executable instructions for:

transmitting, to the client computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon the authentication mechanism; and

receiving, from the client computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism.

38. The computer-readable medium of claim 33 further comprising computer-executable instructions for:

caching, in a session cache, session information for establishing the secure connection tunnel with the client computing device; and

re-authenticating the client computing device, wherein the computer-executable instructions for re-authenticating comprise computer-executable instructions for;

receiving a session identifier from the client computing device;

searching the session cache to locate a corresponding session information, corresponding to the session identifier; and

if the corresponding session information is found, establishing a secure connection tunnel with the client computing device using the corresponding session information.

39. The computer-readable medium of claim 38, wherein the computer-executable instructions for caching session information only cache session information if the authentication information received from the client computing device authenticated the client computing device, the computer-readable medium further comprising computer-executable instructions for authenticating the client computing device if the corresponding session information is found.

40. The computer-readable medium of claim 38 further comprising computer-executable instructions for preventing re-authentication based on a client connection mechanism through which the client computing device receives network communications.

41. The computer-readable medium of claim 33 further comprising computer-executable instructions for:

transmitting the identity information from the client computing device to a server computing device;

transmitting the authentication information from the client computing device to the server computing device;

receiving, from the server computing device, a client authentication message; and

authenticating the client computing device based on the client authentication message.

42. The computer-readable medium of claim 33, wherein:

the computer-executable instructions for transmitting authentication information to the client computing device include computer-executable instructions for receiving the authentication information from a server computing device;

the computer-executable instructions for establishing a secure connection tunnel with the client computing device include computer-executable instructions for forwarding encrypted packets, representing the secure connection tunnel, to and from the client computing device and the server computing device;

the computer-executable instructions for receiving an identity information from the client computing device through the secure communication tunnel include computer-executable instructions for passing the identity information on to the server computing device; and

the computer-executable instructions for receiving an authentication information from the client computing device through the secure communication tunnel include computer-executable instructions for passing the authentication information on to the server computing device.

43. The computer-readable medium of claim 33 further comprising computer-executable instructions for transmitting an authentication response to the client computing device, in response to the authentication information received from the client computing device, the authentication response comprising name/value pairs.

44. The computer-readable medium of claim 43, wherein the authentication response relates to the configuration of the client computing device.

45. The computer-readable medium of claim 33, wherein the computer-executable instructions for receiving the identity information from the client computing device comprise computer-executable instructions for receiving a human user identity information and a client computing device identity information;

and wherein the computer-executable instructions for receiving the authentication information from the client computing device comprise computer-executable instructions for receiving a human user authentication information and a client computing device authentication information.

46. The computer-readable medium of claim 45 further comprising computer-executable instructions for granting access to restricted network information based on whether a human user authentication was successful, a client computing device authentication was successful, or whether both the human user authentication and the client computing device authentication were successful.

47. The computer-readable medium of claim 45 further comprising computer-executable instructions for determining a client computing device configuration based on the client computing device identity information and the client computing device authentication information.

48. The computer-readable medium of claim 47 further comprising computer-executable instructions for granting access to restricted network information based on the client computing device configuration.

49. A client computing device comprising:

a processing unit performing steps comprising;

authenticating a server computing device; and

establishing a secure communication tunnel with the server computing device; and

a network interface performing steps comprising;

transmitting an identity information to the server computing device through the secure communication tunnel; and

transmitting an authentication information, according to an extensible authentication protocol, to the server computing device through the secure communication tunnel.

50. The client computing device of claim 49, wherein the network interface performs further steps comprising:

transmitting a set of possible cryptographic mechanisms; and

receiving a selected cryptographic mechanism from the set of possible cryptographic mechanisms; and

wherein the processing unit performs additional steps comprising;

deriving cryptographic keys for the selected cryptographic mechanism; and

implementing the selected cryptographic mechanism with the derived cryptographic keys.

51. The client computing device of claim 50, wherein the processing unit performs further steps comprising:

deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

52. The client computing device of claim 49, wherein the network interface performs further steps comprising:

transmitting an alias as a user identification when establishing the secure communication tunnel with the server computing device; and

transmitting a true user identification when transmitting the identity information.

53. The client computing device of claim 49, wherein the network interface performs further steps comprising:

transmitting less than all of a user identification when establishing the secure communication tunnel with the server computing device; and

transmitting all of the user identification when transmitting the identity information.

54. The client computing device of claim 49, wherein the network interface performs further steps comprising:

receiving, from the server computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon an authentication mechanism;

transmitting, to the server computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism; and

transmitting authentication information according to the authentication mechanism.

55. The client computing device of claim 49, wherein the network interface performs further steps comprising:

transmitting an identifier from a previous authentication session to the server computing device to re-authenticate the client computing device.

56. The client computing device of claim 49, wherein the network interface performs further steps comprising transmitting information contained in name/value pairs.

57. The client computing device of claim 49, wherein the network interface performed step of transmitting the identity information comprises transmitting a human user identity information and a client computing device identity information;

and wherein the network interface performed step of transmitting the authentication information comprises transmitting a human user authentication information and a client computing device authentication information.

58. The client computing device of claim 49, wherein the processing unit performs further steps comprising:

authenticating, through the secure communication tunnel, a second server computing device; and

establishing, through the secure communication tunnel, an inner secure communication tunnel with the second server computing device; and

wherein the network interface performs further steps comprising;

transmitting a second identity information to the second server computing device through the inner secure communication tunnel; and

transmitting a second authentication information to the second server computing device through the inner secure communication tunnel.

59. A server computing device comprising:

a processing unit performing steps comprising;

establishing a secure connection tunnel with a client computing device; and

a network interface performing steps comprising;

transmitting authentication information to the client computing device;

receiving an identity information from the client computing device through the secure communication tunnel; and

receiving an authentication information, according to an extensible authentication protocol, from the client computing device through the secure communication tunnel.

60. The server computing device of claim 59, wherein the processing unit performs further steps comprising:

selecting a selected cryptographic mechanism from a set of possible cryptographic mechanisms; and

deriving cryptographic keys for the selected cryptographic mechanism; and

wherein the network interface performs further steps comprising;

receiving the set of possible cryptographic mechanisms from the client computing device;

transmitting the selected cryptographic mechanism to the client computing device;

implementing the selected cryptographic mechanism with the derived cryptographic keys.

61. The server computing device of claim 60, wherein the processing unit performs further steps comprising:

deriving additional cryptographic keys from the derived cryptographic keys for use in place of authentication cryptographic keys obtained from the authentication information in a link layer cryptographic mechanism.

62. The server computing device of claim 59, wherein the network interface performs further steps comprising:

transmitting, to the client computing device, through the secure communication tunnel, a request, according to the extensible authentication protocol, to agree upon an authentication mechanism;

receiving, from the client computing device, an agreement, according to the extensible authentication protocol, to the request to agree upon the authentication mechanism; and

receiving, from the client computing device, authentication information according to the authentication mechanism.

63. The server computing device of claim 59, wherein the processing unit performs further steps comprising:

caching, in a session cache, session information for establishing the secure connection tunnel with the client computing device;

searching the session cache to locate a corresponding session information, corresponding to a session identifier; and

if the corresponding session information is found, establishing a secure connection tunnel with the client computing device using the corresponding session information; and

wherein the network interface performs further steps comprising;

receiving a session identifier from the client computing device.

64. The server computing device of claim 59, wherein the processing unit only caches session information if the authentication information received from the client computing device authenticated the client computing device;

and wherein the processing unit further performs steps comprising;

authenticating the client computing device if the corresponding session information is found.

65. The server computing device of claim 59, wherein the network interface performs further steps comprising:

receiving authentication information from a second server computing device;

receiving encrypted packets, representing the secure connection tunnel, from the client computing device and the second server computing device; and

transmitting the encrypted packets, representing the secure connection tunnel, to the client computing device and the second server computing device.

66. The server computing device of claim 59, wherein the network interface performs further steps comprising:

transmitting an authentication response to the client computing device, in response to the authentication information received from the client computing device, the authentication response comprising name/value pairs.

67. The server computing device of claim 59, wherein the network interface performed step of receiving the identity information from the client computing device comprises receiving a human user identity information and a client computing device identity information;

and wherein the network interface performed step of receiving the authentication information from the client computing device comprises receiving a human user authentication information and a client computing device authentication information.

68. The server computing device of claim 68 wherein the processing unit performs further steps comprising:

determining a client computing device configuration based on the client computing device identity information and the client computing device authentication information.

69. An access point comprising a network interface, the network interface performing steps comprising:

receiving authentication information from a server computing device;

transmitting the authentication information to a client computing device;

transmitting encrypted packets, representing a secure connection tunnel, to and from the client computing device and the server computing device;

receiving an identity information encrypted packet from the client computing device;

transmitting the identity information encrypted packet to the server computing device;

receiving an authentication information encrypted packet from the client computing device; and

transmitting the authentication information encrypted packet to the server computing device.

70. The access point of claim 69, wherein the network interface performs further steps comprising:

receiving cryptographic keys from the server computing device.

71. A computer-readable medium having computer-executable instructions for providing access to a secure network, the computer-executable instructions performing steps comprising:

establishing a secure communication tunnel;

selecting an authentication mechanism using an extensible authentication protocol through the secure communication tunnel;

transmitting authentication information according to the selected authentication mechanism through the secure communication tunnel; and

providing access to an appropriate amount of the secure network based on the authentication information.

72. The computer-readable medium of claim 71, wherein the steps are performed through a wireless connection.

73. The computer-readable medium of claim 71, wherein the computer-executable instructions for transmitting authentication information according to the selected authentication mechanism comprise computer-executable instructions for transmitting a human user authentication information and a user computing device authentication information;

and wherein the computer-executable instructions for providing access to the appropriate amount of the secure network based on the authentication information comprise computer-executable instructions for providing access to the appropriate amount of the secure network based on the human user authentication information and the user computing device authentication information.

74. The computer-readable medium of claim 71, wherein the computer-executable instructions for providing access to the appropriate amount of the secure network based on the authentication information comprise computer-executable instructions for providing access to the appropriate amount of the secure network based on an inner authentication information;

the computer-readable medium having further computer-executable instructions for performing steps comprising;

establishing an inner secure communication tunnel within the secure communication tunnel;

selecting an inner authentication mechanism using an inner extensible authentication protocol through the inner secure communication tunnel; and

transmitting the inner authentication information according to the selected inner authentication mechanism through the inner secure communication tunnel.

75. A packet of computer-readable information comprising:

a mandatory field comprising data indicating whether the packet contains mandatory information;

a reserved field comprising data indicating whether the packet is reserved;

a type field comprising data indicating a type of an attribute contained in a value field;

a length field comprising data indicating a length of the packet; and

the value field comprising the attribute, wherein the attribute is used with a protected extensible authentication protocol.