System and method for providing WLAN security through synchronized update and rotation of WEP keys

• US 20060078124A1
• Filed: 11/15/2005
• Published: 04/13/2006
• Est. Priority Date: 05/21/2002
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Wavelink Corporation (Ivanti Software, Inc.)
• Inventors: Whelan, Robert, Morris, Roy, Van Wagenen, Lamar, Wellisch, Gilbert
• Granted Patent: US 7,133,526 B2
• Time in Patent Office: Days
• US Class Current: 380/273
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A system and method are disclosed that overcome deficiencies of prior art IEEE 802.11 WEP key management schemes. Preferred embodiments of the present system and method update WEP keys and rotate transmission key indices in a synchronized manner and on a frequent basis making it impractical for a hacker to gather sufficient network traffic using any one WEP key to decrypt that key and without disrupting communications. Preferred embodiments of the present system and method do not require changes in access point or mobile unit hardware, radio drivers, or firmware and are therefore compatible with existing or legacy network infrastructure or components. The disclosed system and method may be used to facilitate secure communications between one or more access points and one or more mobile units and/or groups of two or more mobile units engaging in peer-to-peer associations.

Claims

1. A system for improved security for wireless local area networks, and comprised of:

a wireless local area network providing wireless communications links for the transmission of data between the two or more communicating entities;

one or more generators for creating pseudorandom encryption keys for the communicating entities; and

one or more controllers for selecting a transmission encryption key index on a rotating basis to point to a pseudorandom encryption key from a set of active pseudorandom encryption keys, and updating the set of active pseudorandom encryption keys for each communicating entity;

wherein the step of selecting the transmission encryption key index and the step of updating are not required to be precisely synchronous.

2. The system of claim 1, wherein the communicating entities comprise two or more mobile units associating on a peer-to-peer basis.

3. The system of claim 2, wherein the communicating entities comprising one or more access points associating with one or more wired sub-networks;

and one or more mobile units select encryption keys for transmission in a staggered manner.

4. The system of claim 1, wherein a reconnecting mobile unit performs a systematic search to identify correct encryption keys based on a key update and rotation algorithm.

5. The system of claim 4, wherein the reconnecting mobile unit performs the systematic search based on time.

6. The system of claim 5, wherein synchronization is maintained by one or more of (i) time stamp messages;

(ii) a time offset;

(iii) exchange of time synchronization messages;

(iv) prompts for key rotation;

(v) prompts for key generation; and

(vi) detection of the next key being in use.

7. The system of claim 1, wherein one or more of (i) a key seed file, and (ii) a list of two or more encryption keys is distributed to at least one mobile unit and at least one access point.

8. The system of claim 7, wherein the key seed file is used to generate new pseudorandom encryption keys in the set of pseudorandom encryption keys.

9. The system of claim 1, wherein an index key and key control client manages a static encryption key list and a transmission encryption key index on a mobile unit.

10. The system of claim 1, wherein an automatic key generator creates lists of pseudorandomly generated encryption keys that are then managed by an index and key scheduler.

11. A mobile unit providing improved security in communications with a wireless local area network, and comprised of:

one or more generators for creating pseudorandom encryption keys for the communicating entities; and

one or more controllers for selecting a transmission encryption key index on a rotating basis to point to a pseudorandom encryption key from a set of active pseudorandom encryption keys, and updating the set of active pseudorandom encryption keys; and

wherein the step of selecting the transmission encryption key index and the step of updating are not required to be precisely synchronous; and

wherein synchronization with the wireless local area network is maintained by one or more of (i) time stamp messages;

(ii) a time offset;

(iii) exchange of time synchronization messages;

(iv) prompts for key rotation;

(v) prompts for key generation; and

(vi) detection of the next key being in use.

12. A method for providing improved security for wireless local area networks, comprising:

creating pseudorandom encryption keys for at least one of a plurality of communicating entities adapted to communicate via a wireless local area network;

selecting a transmission encryption key index on a rotating basis to point to a pseudorandom encryption key from a set of active pseudorandom encryption keys for the at least one of a plurality of communicating entities; and

updating the set of active pseudorandom encryption keys; and

wherein the step of selecting the transmission encryption key index and the step of updating are not required to be precisely synchronous.

13. The method of claim 12, wherein the communicating entities comprise:

one or more access points associating with one or more wired sub-networks; and

one or more mobile units.

14. The method of claim 12, wherein the communicating entities comprise two or more mobile units associating on a peer-to-peer basis.

15. The method of claim 13 further comprising selecting encryption keys for transmission in a staggered manner.

16. The method of claim 12 further comprising systematically searching, at a mobile unit, in response to reconnecting to a network to identify correct encryption keys based on a key update and rotation algorithm.

17. The method of claim 16, wherein the systematic searching is based on time.

18. The method of claim 17 further comprising maintaining synchronization by one or more of (i) time stamp messages;

(ii) a time offset;

(iii) exchange of time synchronization messages;

(iv) prompts for key rotation;

(v) prompts for key generation; and

(vi) detection of the next key being in use.

19. The method of claim 12 further comprising distributing one or more of (i) a key seed file, and (ii) a list of two or more encryption keys.

20. The method of claim 19 further comprising generating a new encryption key in the set of pseudorandom encryption keys with the assistance of the key seed file.