Subnet box

• US 20050091483A1
• Filed: 09/08/2004
• Published: 04/28/2005
• Est. Priority Date: 09/08/2003
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Granted Patent: US 7,934,005 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The invention provides an external in-line device (“Subnet Box”) placed between a network and an access point to achieve secure Wi-Fi communications without needing to modify the access point. The Subnet Box comprises an embedded token and will authenticate users based on pre-stored access rights. In at least one embodiment of the invention, the Subnet Box comprises: a first communications port for intercepting data packets communicated to and from a wired communications network; a second communications port for intercepting data packets communicated to and from a wireless access point, wherein the wireless access point is an edge device of the wired communications network; a database comprising a number of serial numbers each associated with a client token and a secret cryptographic key; and a processor for determining whether a computing device having a client token can access the wired communications network via the wireless access point. The processor establishes a secure tunnel between the computing device and the first communications port.

Claims

1. A method of facilitating authentication and security at an edge of a network comprising the steps of:

receiving a data packet;

determining whether a source identifier exists in said data packet; and

if said source identifier exists,

retrieving a cryptographic key from local storage associated with said source identifier,

decrypting a portion of said data packet using said identified cryptographic key, and

directing said data packet toward its recipient.

2. The method of claim 1, wherein said step of retrieving comprises the steps of:

identifying a match to said source identifier within a pre-stored list of source identifiers; and

loading a cryptographic key associated with a matching source identifier from said pre-stored list of source identifiers.

3. The method of claim 1, wherein said source identifier is a MAC address.

4. The method of claim 1, further comprising the steps of:

if said source identifier doesn'"'"'t exist,

identifying whether said data packet is a pass-through data packet, and then either

directing said data packet toward its recipient if said data packet is identified as a pass-through data packet, or

dropping said data packet if said data packet is not identified as a pass-through data packet.

5. The method of claim 1, wherein said local storage is a token.

6. An apparatus comprising:

a first communications port for intercepting data packets communicated to and from a wired communications network;

a second communications port for intercepting data packets communicated to and from a wireless access point, wherein said wireless access point is an edge device of said wired communications network;

a database comprising a number of serial numbers each associated with a client token and a secret cryptographic key; and

a processor for determining whether a computing device having a client token can access said wired communications network via said wireless access point.

7. The apparatus of claim 6, wherein said processor establishes a secure tunnel between said computing device and said first communications port.

8. The apparatus of claim 6, wherein said first and second communication ports are Ethernet ports.

9. The apparatus of claim 6, wherein said database is stored in a Smart card.

10. The apparatus of claim 6, wherein said wireless access point is an IEEE 802.11 access point.

11. The apparatus of claim 6, wherein said wired network is LAN.