WIRELESS LOCAL AREA NETWORK AND METHODS FOR SECURE RESOURCE RESERVATIONS FOR FAST ROAMING

• US 20070266244A1
• Filed: 05/11/2006
• Published: 11/15/2007
• Est. Priority Date: 05/11/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sood, Kapil, Walker, Jesse, Zhao, Meiyuan
• Granted Patent: US 7,702,333 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 28/26 Resource reservation
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Embodiments of an authorization server and method for securely reserving resources in a wireless network are generally described herein. Other embodiments may be described and claimed. In some embodiments, access points reserve bandwidth thereon through the verification of reservation tokens received from the mobile station.

Claims

1. An authorization server comprising:

network interface circuitry to receive a resource reservation request from a target access point; and

processing circuitry to verify a reservation token received from a mobile station and to authorize the target access point to reserve bandwidth thereon when the reservation token is verified,

wherein the reservation token is received within the resource reservation request and is provided to the authorization server by the target access point.

2. The authorization server of claim 1 further comprising:

a random number generator to generate a challenge value for use by the mobile station in generating a hash chain comprising a predetermined number of reservation tokens; and

processing circuitry to verify the reservation tokens by computing and verifying a hash on a received reservation token concatenated with the challenge value,

wherein the authorization server establishes a source-authenticated and forgery-protected channel with the access points.

3. The authorization server of claim 2 wherein the mobile station generates the hash chain in response to receipt of an acquire response message by:

initially generating a hash chain root using a random number generator of the mobile station; and

generating each subsequent reservation token of the hash chain by performing a hash iteratively on a concatenation of a prior generated reservation token and the challenge value, and

wherein the hash chain root is an initial one of the reservation tokens and is used to generate a next one of the reservation tokens.

4. The authorization server of claim 3 wherein a last-generated of the reservation tokens comprises a commitment value,

wherein the mobile station sends the commitment value to the authorization server within an acquire confirm message, and

wherein the authorization server authorizes the mobile station to reserve bandwidth on a number of target access points corresponding to the predetermined number of reservation tokens of the hash chain when the acquire confirm message is verified.

5. The authorization server of claim 2 wherein the authorization server denies the resource reservation request when a hash of the received reservation token concatenated with the challenge value is not equal to the commitment value,

wherein the authorization server also denies the resource reservation request when a hash of the received reservation token concatenated with the challenge value is equal to a prior received reservation token, and

wherein the authorization server permits the resource reservation request when it is not denied and when a hash of the received reservation token concatenated with the challenge value is equal to the commitment value.

6. The authorization server of claim 2 wherein in response to the resource reservation request received from the mobile station, the target access point is to send an authorization request message to the authorization server to request authorization for the mobile station to reserve bandwidth,

wherein the authorization server is to either permit or deny the request and provide an authorization response message to the target access point, and

wherein the target access point provides a reservation response message to the mobile station to indicate that the mobile station is either permitted to reserve bandwidth or not permitted to reserve bandwidth.

7. A wireless network comprising:

a plurality of access points to receive resource reservation requests from a mobile station; and

an authorization server to authorize the access points to reserve bandwidth thereon for roaming by verifying reservation tokens received from the mobile station in the resource reservation requests.

8. The wireless network of claim 7 wherein a source-authenticated and forgery-protected channel is established between the access points and the authorization server, and

wherein the mobile station generates a hash chain from a challenge value provided by the authorization server, the hash chain comprising a predetermined number of reservation tokens, each reservation token to reserve bandwidth on one access point.

9. The wireless network of claim 8 wherein the authorization server comprises a random number generator to generate the challenge value in response to an acquire request message received from the mobile station, and

wherein the authorization server sends the challenge value as part of an acquire response message to the mobile station, the acquire response message being secured with a message authentication code.

10. The wireless network of claim 9 wherein the acquire request message includes a station identifier and a random number generated by the mobile station, and

wherein the acquire response message includes the station identifier, the random number generated by the mobile station, the challenge value generated by the authorization server, and the message authentication code.

11. The wireless network of claim 8 wherein the mobile station generates the hash chain in response to receipt of an acquire response message by:

initially generating a hash chain root using a random number generator of the mobile station; and

generating each subsequent reservation token of the hash chain by performing a hash iteratively on a concatenation of a prior generated reservation token and the challenge value, and

wherein the hash chain root is an initial one of the reservation tokens and is used to generate a next one of the reservation tokens.

12. The wireless network of claim 11 wherein a last-generated of the reservation tokens comprises a commitment value,

wherein the mobile station sends the commitment value to the authorization server within an acquire confirm message, and

wherein the authorization server authorizes the mobile station to reserve bandwidth on a number of target access points corresponding to the predetermined number of reservation tokens of the hash chain when the acquire confirm message is verified.

13. The wireless network of claim 8 wherein a resource reservation request is authorized by the authorization server by computing and verifying a hash on a received reservation token concatenated with the challenge value.

14. The wireless network of claim 8 wherein the resource reservation request is denied when a hash of a received reservation token concatenated with the challenge value is not equal to the commitment value,

wherein the resource reservation request is also denied when a hash of the received reservation token concatenated with the challenge value is equal to a prior received reservation token, and

wherein the resource reservation request is permitted when it is not denied and when a hash of the received reservation token concatenated with the challenge value is equal to the commitment value.

15. The wireless network of claim 14 wherein in response to the resource reservation request received from the mobile station through a target access point, the target access point is to send an authorization request message to the authorization server to request authorization for the mobile station to reserve bandwidth,

wherein the authorization server either permits or denies the request and provides an authorization response message to the target access point, and

wherein the target access point provides a reservation response message to the mobile station to indicate that the mobile station is either permitted to reserve bandwidth or not permitted to reserve bandwidth.

16. A method for securely reserving bandwidth on access points for fast roaming in a wireless network comprising authorizing the access points to reserve bandwidth thereon by verifying reservation tokens received from a mobile station through the access points in resource reservation requests.

17. The method of claim 16 further comprising:

providing a challenge value for use by the mobile station in generating a hash chain from the challenge value, the hash chain comprising a predetermined number of the reservation tokens; and

verifying the reservation tokens by computing and verifying a hash on a received reservation token concatenated with the challenge value.

18. The method of claim 17 wherein a source-authenticated and forgery-protected channel is established between the access points and the authorization server and

wherein the method further comprises:

using a random number generator to generate the challenge value in response to an acquire request message received from the mobile station; and

sending the challenge value as part of an acquire response message to the mobile station, the acquire response message being secured with a message authentication code.

19. The method of claim 18 wherein the acquire request message includes a station identifier and a random number generated by the mobile station, and

wherein the acquire response message includes the station identifier, the random number generated by the mobile station, the challenge value generated by the authorization server and the message authentication code.

20. The method of claim 17 wherein the mobile station generates the hash chain in response to receipt of an acquire response message by:

initially generating a hash chain root using a random number generator of the mobile station; and

generating each subsequent reservation token of the hash chain by performing a hash iteratively on a concatenation of a prior generated reservation token and the challenge value,

wherein the hash chain root is an initial one of the reservation tokens and is used to generate a next one of the reservation tokens.

21. The method of claim 20 wherein a last generated reservation token comprises a commitment value,

wherein the mobile station sends the commitment value to the authorization server within an acquire confirm message, and

wherein the method further comprises authorizing the mobile station to reserve bandwidth on a number of target access points corresponding to the predetermined number of reservation tokens of the hash chain when the acquire confirm message is verified.

22. The method of claim 17 further comprising:

denying the resource reservation request when a hash of a received reservation token concatenated with the challenge value is not equal to the commitment value;

denying the resource reservation request when a hash of the received reservation token concatenated with the challenge value is equal to a prior received reservation token; and

permitting the resource reservation request when it is not denied and when a hash of the received reservation token concatenated with the challenge value is equal to the commitment value.

23. The wireless network of claim 22 further comprising:

receiving from a target access point an authorization request message to request authorization for the mobile station to reserve bandwidth; and

permitting or denying the request and providing an authorization response message to the target access point,

wherein the target access point to provide a reservation response message to the mobile station to indicate that the mobile station is either permitted to reserve bandwidth or not permitted to reserve bandwidth.

24. A system comprising:

a substantially omnidirectional antenna; and

an authorization server coupled to the antenna to receive a resource reservation request from a target access point, and processing circuitry to verify a reservation token received from a mobile station through the target access point within the resource reservation request to authorize the target access point to reserve bandwidth thereon when the reservation token is verified.

25. The system of claim 24 wherein the authorization server further comprises:

a random number generator to generate a challenge value for use by the mobile station in generating a hash chain comprising a predetermined number of the reservation tokens; and

processing circuitry to verify the reservation tokens by computing and verifying a hash on a received reservation token concatenated with the challenge value,

wherein the authorization server establishes a source-authenticated and forgery-protected channel with the access points.

26. The system of claim 25 wherein the mobile station generates the hash chain in response to receipt of an acquire response message by:

initially generating a hash chain root using a random number generator of the mobile station; and

generating each subsequent reservation token of the hash chain by performing a hash iteratively on a concatenation of a prior generated reservation token and the challenge value, and

wherein the hash chain root is an initial one of the reservation tokens and is used to generate a next one of the reservation tokens.

27. A machine-accessible medium that provides instructions, which when accessed, cause a machine to perform operations for securely reserving bandwidth on access points for fast roaming in a wireless network, the operations comprising authorizing the access points to reserve bandwidth thereon by verifying reservation tokens received from a mobile station through one of the access points in resource reservation requests.

28. The machine-accessible medium of claim 27 wherein the instructions, when further accessed, cause the machine to perform operations further comprising:

providing a challenge value for use by the mobile station in generating a hash chain from the challenge value, the hash chain comprising a predetermined number of the reservation tokens; and

verifying the reservation tokens by computing and verifying a hash on a received reservation token concatenated with the challenge value.

29. The machine-accessible medium of claim 28 wherein a source-authenticated and forgery-protected channel is established between the access points and the authorization server, and

wherein the instructions, when further accessed, cause the machine to perform operations further comprising:

generating the challenge value in response to an acquire request message received from the mobile station; and

sending the challenge value as part of an acquire response message to the mobile station, the acquire response message being secured with a message authentication code.