Inter subnet roaming system and method

• US 20050143065A1
• Filed: 02/18/2005
• Published: 06/30/2005
• Est. Priority Date: 11/26/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Meier, Robert Charles, Leung, Patrick Pak-Chiu, Pathan, Arnavkumar M., Winget, Nancy Cam, Wakerly, John F.
• Granted Patent: US 7,624,270 B2
• Time in Patent Office: Days
• US Class Current: 455/432.100
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

The present invention communication network system and method facilitates authentication and registration in a communication network as mobile nodes move from one geographical region to another. Multiple wireless domain services (WDSs) share client authentication information permitting relatively seamless roaming between subnets with minimal interruptions and delays. In one embodiment, a wireless domain service network communication method is performed utilizing partial authentication processes. A mobile node engages in an authentication protocol with a first wireless domain service (WDS) access point in a first subnet. The authentication credentials are forwarded to a second wireless domain service in a second subnet if the authentication protocol is successfully completed. The forwarded authentication credentials are utilized to authenticate the client entering the service area of the second wireless domain service in the second subnet. The authentication credentials can be “pushed” or “pulled” from the first wireless domain service to the second wireless domain service.

Claims

1. A rapid roaming compatible authentication method comprising:

checking for client authentication information in a local memory of wireless domain service;

engaging in a partial authentication process if said client authentication information is in said local memory of said wireless domain service; and

performing a full authentication process if said client authentication information is not included in said local memory of said wireless domain service.

2. The rapid roaming compatible authentication method of claim 1 further comprising forwarding said client authentication information to another wireless domain service.

3. The rapid roaming compatible authentication method of claim 2 wherein said authentication information is pushed to said other wireless domain service.

4. The rapid roaming compatible authentication method of claim 1 wherein said authentication information is received from another wireless domain service.

5. The rapid roaming compatible authentication method of claim 4 wherein authentication information is pulled from said other wireless domain service.

6. The rapid roaming compatible authentication method of claim 1 wherein said rapid roaming compatible authentication method is performed for Internet Protocol compliant subnets.

7. The rapid roaming compatible authentication method of claim 1 wherein said wireless domain service covers a unique geographical area.

8. A network communication system comprising:

a communication component for transmitting and receiving information to and from a client; and

a wireless domain service component for implementing a wireless domain service including inter subnet fast roaming authentication and registration of said client in accordance with said inter subnet fast roaming authentication, wherein said wireless domain service is associated with a first subnet.

9. The network communication system of claim 8 wherein said wireless domain service component participates in peer authentication by distributing and receiving authentication information to and from neighboring wireless domain service components associated with other subnets.

10. The network communication system of claim 9 wherein authentication information is pushed to said wireless domain service component from said peer wireless domain service servers.

11. The network communication system of claim 9 wherein said authentication information is pulled by said wireless domain service component from said peer wireless domain service servers.

12. The network communication system of claim 8 wherein said wireless domain service component provides authentication credentials of said client to a root device if said inter subnet fast roaming authentication is successful.

13. The network communication system of claim 8 wherein said inter subnet fast roaming authentication included a peer authentication portion and a direct client partial authentication portion.

14. The network communication system of claim 13 wherein information associated with said peer authentication portion is received from peer wireless domain devices.

15. A computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process comprising:

directing operations associated with communication of client authentication information to and from wireless domain services;

determining if wireless authentication information is available for a client;

performing a partial authentication process if said wireless authentication information is available for said client; and

performing a full authentication process if said wireless authentication information is not available for said client.

16. The computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process of claim 15 further comprising forwarding said client authentication information to wireless domain services.

17. The computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process of claim 15 further comprising receiving said client authentication information from wireless domain services.

18. The computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process of claim 15 wherein access points and mobile nodes authenticate with a wireless domain service.

19. The computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process of claim 15 wherein said authentication information is communicated in a Wireless LAN Context Control Protocol (WLCCP).

20. The computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process of claim 15 wherein said authentication information is pushed to said wireless domain service from peer wireless domain services.

21. A communication system comprising:

a means for implementing a wireless domain service;

a means for communicating information including authentication information between inter subnet wireless domain services; and

a means for authenticating clients including utilizing said authentication information communicated between inter subnet wireless domain services.