Wireless Authentication Methods and Apparatus

• US 20070186105A1
• Filed: 02/05/2007
• Published: 08/09/2007
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Juels, Ari, Bailey, Daniel, Kaliski, Burton, Brainard, John
• Granted Patent: US 9,137,012 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices

Abstract

A first processing device, which may be, for example, a wireless authentication token or an RFID tag, transmits information in a wireless network in a manner that emulates standard communications of an access point of the wireless network, although the first processing device is not configured to operate as an actual access point of the wireless network. A second processing device, which may be, for example, a computer or other station of the wireless network, receives the transmitted information and is able to determine therefrom that the information originates from an emulated access point rather than an actual access point. The second processing device responds to this condition by utilizing the transmitted information in a manner distinct from its utilization of similar information received from the actual access point of the wireless network.

Claims

1. A first processing device for use in a wireless network, the wireless network comprising at least one access point and one or more stations, the first processing device comprising:

a memory;

a processor coupled to the memory; and

network interface circuitry coupled to the processor;

the processor being operative to control the transmission of information via the network interface circuitry in a manner that emulates standard communications of an access point of the wireless network although the first processing device is not configured to operate as an actual access point of the wireless network;

wherein a second processing device receiving the transmitted information is able to determine therefrom that the transmitted information originates from an emulated access point rather than an actual access point, the second processing device responding to such a condition by utilizing the transmitted information in a manner distinct from its utilization of similar information received from the actual access point of the wireless network.

2. The first processing device of claim 1 wherein the transmitted information comprises authentication information.

3. The first processing device of claim 1 wherein said first processing device comprises a handheld wireless authentication token.

4. The first processing device of claim 1 wherein said first processing device comprises an RFID tag.

5. The first processing device of claim 2 wherein the authentication information comprises a one-time password.

6. The first processing device of claim 1 wherein the wireless network comprises a wireless network operating in accordance with an 802.11 standard and the transmitted information is transmitted in a manner compliant with the 802.11 standard.

7. The first processing device of claim 6 wherein the transmitted information comprises at least one of an 802.11 beacon frame and an 802.11 probe response frame.

8. The first processing device of claim 7 wherein the transmitted information comprises authentication information carried at least in part in an SSID field of said at least one frame.

9. The first processing device of claim 1 wherein the transmitted information is transmitted by the first processing device responsive to a user command.

10. The first processing device of claim 1 wherein the transmitted information is transmitted by the first processing device periodically or continuously without user intervention.

11. The first processing device of claim 1 wherein at least a portion of the transmitted information is configured prior to transmission responsive to its relation to a particular time interval of a set of predetermined time intervals.

12. The first processing device of claim 1 wherein at least a portion of the transmitted information is configured prior to transmission responsive to a user command.

13. The first processing device of claim 2 wherein the authentication information comprises a sequence of values corresponding to images of a hash chain.

14. The first processing device of claim 2 wherein the authentication information is encrypted prior to transmission using a key established through a pairing protocol carried out between the first and second processing devices.

15. The first processing device of claim 14 wherein the pairing protocol supports key confirmation by allowing a user to compare a confirmation code produced by the first processing device with a confirmation code produced by the second processing device.

16. The first processing device of claim 14 wherein the pairing protocol utilizes a trusted server to authorize pairing of the first processing device with the second processing device.

17. The first processing device of claim 2 wherein the authentication information is utilizable by the second processing device in conjunction with supplementary information to generate combined authentication information of the first and second processing devices, said combined authentication information being presented to at least one server for joint authentication of the first and second processing devices.

18. The first processing device of claim 17 wherein the authentication information comprises a sequence of values corresponding to images of a hash chain, and said second processing device generates said combined authentication information using the hash chain images and a private key of a certificate held by the second processing device.

19. The first processing device of claim 2 wherein the authentication information is determined at least in part utilizing a base point on an elliptic curve.

20. The first processing device of claim 1 wherein the transmitted information comprises information that is utilizable by the second processing device to perform at least one of an encryption operation and a decryption operation.

21. The first processing device of claim 1 wherein the transmitted information comprises information that is utilizable by the second processing device to generate a joint digital signature on behalf of both the first and second processing devices.

22. A method for use in a first processing device in a wireless network, the wireless network comprising at least one access point and one or more stations, the method comprising the steps of:

generating information in the first processing device; and

transmitting the information from the first processing device in a manner that emulates standard communications of an access point of the wireless network although the first processing device is not configured to operate as an actual access point of the wireless network;

wherein a second processing device receiving the transmitted information is able to determine therefrom that the transmitted information originates from an emulated access point rather than an actual access point, the second processing device responding to such a condition by utilizing the transmitted information in a manner distinct from its utilization of similar information received from the actual access point of the wireless network.

23. An article of manufacture comprising a computer-readable storage medium storing one or more software programs which when executed by a processor implement the steps of the method of claim 22.

24. A processing device for use in a wireless network, the wireless network comprising at least one access point and one or more stations, the processing device comprising:

a memory;

a processor coupled to the memory; and

network interface circuitry coupled to the processor;

the processor being operative to control the reception of information via the network interface circuitry, the received information being transmitted by another processing device in a manner that emulates standard communications of an access point of the wireless network although the other processing device is not configured to operate as an actual access point of the wireless network;

wherein the processor is further operative to determine from the received information that said information originates from an emulated access point rather than an actual access point and to respond to such a condition by utilizing the received information in a manner distinct from its utilization of similar information received from the actual access point of the wireless network.

25. The processing device of claim 24 wherein said processing device having said processor, memory and network interface circuitry comprises a given one of the stations of the wireless network.

26. The processing device of claim 25 wherein the given station responds to the condition by extracting authentication information from the transmitted information and initiating an authentication process using the authentication information.

27. The processing device of claim 24 wherein said processing device having said processor, memory and network interface circuitry comprises a computer.

28. A method for use in a processing device in a wireless network, the wireless network comprising at least one access point and one or more stations, the method comprising the steps of:

receiving information transmitted by another processing device, the information being transmitted in a manner that emulates standard communications of an access point of the wireless network although the other processing device is not configured to operate as an actual access point of the wireless network;

determining from the received information that said information originates from an emulated access point rather than an actual access point; and

responding to such a condition by utilizing the received information in a manner distinct from its utilization of similar information received from the actual access point of the wireless network.

29. An article of manufacture comprising a computer-readable storage medium storing one or more software programs which when executed by a processor implement the steps of the method of claim 28.