Method and apparatus for maintaining local area network("LAN") and wireless LAN ("WLAN") security associations

• US 20070239875A1
• Filed: 03/29/2006
• Published: 10/11/2007
• Est. Priority Date: 03/29/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sood, Kapil, Walker, Jesse, Grewal, Karanvir
• Granted Patent: US 7,882,255 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 52/0254 detecting a user operation or a tactile contact or a motion of the device
• CPC Class Codes: H04W 52/0258 controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

Cooperating entities share a signaling interface. Each entity establishes a security association between itself and an endpoint, and one of the entities transmits keepalive messages over a channel associated with the security association. Chipsets and systems to implement related methods are also described and claimed.

Claims

1. A method comprising:

sharing a signaling interface between a first entity with a first power control profile and a second entity with a second, independent power control profile;

establishing a first security association between the first entity and an endpoint;

establishing a second security association between the second entity and the endpoint; and

transmitting a keepalive message over a communication channel associated with the second security association.

2. The method of claim 1 wherein establishing a security association comprises performing a transaction according to an 802.1X protocol.

3. The method of claim 1 wherein establishing the second security association comprises obtaining security information established by the first security association.

4. The method of claim 1 wherein the signaling interface is a wired or wireless local area network interface.

5. The method of claim 1, further comprising:

postponing the transmitting operation until a predetermined period of time has passed without a transmission over the communication channel.

6. The method of claim 1, further comprising:

altering the first power control profile; and

occasionally repeating the transmitting operation while the first power control profile is in a low-power state.

7. A chipset comprising:

bus control logic to communicate with a network interface device;

contention avoidance logic to share the network interface device with a device driver;

access control logic to perform a network access protocol transaction; and

keepalive logic to transmit a keepalive message over the network interface device.

8. The chipset of claim 7 wherein the network interface device is a wired or wireless local area network device.

9. The chipset of claim 7 wherein the network access protocol transaction is an 802.1X transaction.

10. The chipset of claim 7, further comprising:

system management logic to receive commands from a network operations center (“

NOC”

) and to report system information to the NOC.

11. The chipset of claim 7, further comprising:

power control logic to alter an operational state of a system;

timer logic to measure elapsed time; and

gating logic to trigger the keepalive logic if the operational state of the system is a low power state or a predetermined period has elapsed without traffic over the network interface device.

12. The chipset of claim 7 wherein the access control logic is to establish an independent security association with a communication peer.

13. The chipset of claim 7 wherein the access control logic is to use a pre-established security association with a communication peer.

14. The chipset of claim 7 wherein the keepalive message is a gratuitous address resolution protocol (“

GARP”

) message or other idempotent protocol messages.

15. A system comprising:

a programmable processor;

a memory;

a wireless network interface; and

platform management logic, wherein

the platform management logic is to transmit a keepalive message to maintain a security association between the wireless network interface and a direct communication peer.

16. The system of claim 15, further comprising:

access control logic to establish a first security association between the network interface and the direct communication peer; and

programmable instructions to cause the programmable processor to establish a second security association between the network interface and the direct communication peer.

17. The system of claim 15, further comprising:

power control logic to adjust a power utilization of the system, wherein

the platform management logic is to transmit the keepalive message if the system is in a low-power state.

18. The system of claim 15, further comprising:

programmable instructions to cause the programmable processor to establish a security association between the network interface and the direct communication peer;

wherein

the platform management logic is to use security information from the security association to maintain the security association between the wireless network interface and the direct communication peer.

19. A machine-readable medium containing instructions to cause a programmable logic device to perform operations comprising:

establishing a security association between a system and a communication endpoint, the security association to be shared between a first entity and a second entity;

placing the first entity in a suspended state; and

transmitting a keepalive message from the second entity to the communication entity while the first entity is suspended.

20. The machine-readable medium of claim 19, containing additional instructions to cause the programmable logic device to perform operations comprising:

waking the first entity from the suspended state; and

transmitting a message from the first entity to the communication endpoint using the security association.

21. The machine-readable medium of claim 19 wherein establishing the security association comprises executing a transaction according to an 802.1X protocol.