Wireless Linked Computer Communications

• US 20080141360A1
• Filed: 10/21/2005
• Published: 06/12/2008
• Est. Priority Date: 11/03/2004
• Status: Abandoned Application

• Current Assignee: Qinetiq Limited (QinetiQ Group PLC)
• Original Assignee: Qinetiq Limited (QinetiQ Group PLC)
• Inventors: Hicks, Richard, Case, Richard Anthony
• Application Number:
  US11/666,805
• Publication Number:
  US 20080141360A1
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Computer communications with security marked information use a wireless link between a receiving network (RN) and a computer (WLT1) each running VPN wire-link security software and wireless-link security software. A physical LAN in the network (RN) is subdivided into logical management and communications LANs. The management LAN manages a switch (L3S), access point (AP), RADIUS server (RS) and Certificate server (CS). The access point (AP) is managed only by management LAN items. The switch (L3S) ensures message traffic from management LAN ports goes only to other such ports; it and the access point (AP) are managed only by the RADIUS server via SSH. The access point (AP) contacts the RADIUS server (RS) to authenticate user certificates and receives SSH traffic only. The management LAN is synchronized to an NTP server. The communications LAN allows an authenticated computer (WLT1) to communicate with a classified WAN (N1). Message traffic does not go to the RADIUS server (RS) or Certificate server (CS).

Claims

1. A method for computer communications having the steps of:

a) establishing a wireless link between computer apparatus and a receiving network implementing two protocols at least one of which is for encrypting messages, one of the two protocols being a virtual private network (VPN) protocol suitable for securing wire-linked communications and the other of the other two protocols being a wireless-linking protocol of a kind suitable for securing wireless-linked communications;

b) applying both protocols to a message to render it doubly secured;

c) sending the doubly secured message over the wireless link; and

d) processing the doubly secured message to recover the message.

2. A method according to claim 1 wherein step b) of applying both protocols comprises applying the VPN protocol to a message to render it VPN-secured and applying the wireless-linking protocol to the VPN-secured message to render it doubly secured.

3. A method according to claim 1 wherein the receiving network has a logical LAN configuration protecting it against unauthorised access.

4. A method according to claim 3 wherein:

a) the logical LAN configuration has a first logical LAN and a second logical LANs;

b) the first logical LAN;

i) has elements which cannot be remotely managed except by at least one other element of that LAN,

ii) has ports from which message traffic is constrained to go only to other ports on that LAN, and

iii) implements a wireless authentication process and secure communication within that LAN; and

c) the second logical LAN enables the computer apparatus when authenticated to communicate with a classified network or an unclassified network, and has firewall functionality configured to avoid message traffic to and from the computer apparatus affecting the first logical LAN.

5. A method according to claim 4 wherein the first logical LAN includes:

a) an access point for communication with wireless-linked computer apparatus;

b) a switch to constrain message traffic from first logical LAN ports to go only to other first logical LAN ports; and

c) a RADIUS server for implementation of the wireless-linking protocol which provides an authentication process.

6. A method according to claim 5 wherein the first logical LAN is associated with firewall functionality configured to monitor data flow within and to and from that LAN but excluded from management of elements of that LAN.

7. A method according to claim 1 wherein the wireless-linking protocol involves certificate-based authentication and is implemented by means of a RADIUS server.

8. A method according to claim 1 wherein the wireless-linking protocol is implemented by means of a pre-shared key (PSK).

9. A method according to claim 1 wherein the wireless-linking protocol involves authentication by EAP-TLS, EAP-TTLS, PEAP or LEAP as herein defined.

10. A method according to claim 1 wherein step b) of applying both protocols involves producing secured status by encryption to produce a VPN-encrypted message and to provide for the doubly secured message to be doubly encrypted, and step d) of processing the doubly secured message to recover the message involves double decryption.

11. A method according to claim 1 wherein the receiving network has classified and unclassified virtual networks, and the method includes allowing the doubly secured message access to the classified virtual network and also allowing wireless messages access to the unclassified virtual network if such messages are secured by the wireless-linking protocol but not the VPN Protocol.

12. A method according to claim 11 wherein the receiving network is associated with offline and root certificate servers and the method includes authenticating wireless messages using certificates from such servers.

13. A method according to claim 11 wherein the receiving network has an unclassified RADIUS server and the method includes authenticating wireless messages using certificates from that server.

14. A method according to claim 11 wherein the receiving network has an unclassified certificate server arranged to supply certificates marked to indicate use by wireless only and the method includes authenticating messages by wireless using certificates so marked from that server.

15. A method according to claim 1 including the step of counteracting a security threat posed by potential computer theft by arranging for the computer apparatus to be screen locked when it becomes unattended by authorised personnel.

16. Apparatus for computer communications incorporating:

a) wireless linking apparatus for establishing a wireless link between computer apparatus and a receiving network implementing two protocols at least one of which is for encrypting messages, one of the two protocols being a VPN protocol suitable for securing wire-linked communications and the other of the two protocols being a wireless-linking protocol of a kind suitable for securing wireless-linked communications;

b) means for applying both protocols to a message to render it doubly secured;

c) means for sending the doubly secured message over the wireless link; and

d) means for processing the doubly secured message to recover the message.

17. Apparatus according to claim 16 wherein the means for applying both protocols is arranged to apply the VPN protocol to a message to render it VPN-secured and to apply the wireless-linking protocol to the VPN-secured message to render it doubly secured.

18. Apparatus according to claim 16 wherein the receiving network has a logical LAN configuration protecting it against unauthorised access.

19. Apparatus according to claim 18 wherein:

a) the logical LAN configuration has a first logical LAN and a second logical LAN;

b) the first logical LAN;

i) has elements which cannot be remotely managed except by at least one other element of that LAN,

ii) has ports from which message traffic is constrained to go only to other ports on that LAN, and

iii) implements a wireless authentication process and secure communication within that LAN; and

c) the second logical LAN enables the computer apparatus when authenticated to communicate with a classified network or an unclassified network, and has firewall functionality configured to avoid message traffic to and from the computer apparatus affecting the first logical LAN.

20. Apparatus according to claim 19 wherein the first logical LAN includes:

a) an access point for communication with wireless-linked computer apparatus;

b) a switch to constrain message traffic from first logical LAN ports to go only to other first logical LAN ports; and

c) a RADIUS server for implementation of the wireless-linking protocol which provides an authentication process.

21. Apparatus according to claim 20 wherein the first logical LAN is associated with firewall functionality configured to monitor data flow within and to and from that LAN but excluded from management of elements of that LAN.

22. Apparatus according to claim 16 including a RADIUS server arranged to implement the wireless-linking protocol, the wireless-linking protocol involving certificate-based authentication.

23. Apparatus according to claim 16 including means for implementing a pre-shared key (PSK) to provide the wireless-linking protocol.

24. Apparatus according to claim 16 including means for implementing authentication by EAP-TLS, EAP-TTLS, PEAP or LEAP to provide the wireless-linking protocol.

25. Apparatus according to claim 16 wherein the means for applying both protocols is arranged to provide a VPN-encrypted message and to provide for the doubly secured message to be doubly encrypted, and the means for processing the doubly secured message to recover the message is arranged to provide double decryption.

26. Apparatus according to claim 16 wherein the receiving network has classified and unclassified virtual networks, and the apparatus is arranged to allow the doubly secured message access to the classified virtual network and also to allow wireless messages access to the unclassified virtual network if such messages are secured by the wireless-linking protocol but not the VPN protocol.

27. Apparatus according to claim 26 wherein the receiving network is associated with offline and root certificate servers and the apparatus is arranged to authenticate wireless messages using certificates from such servers.

28. Apparatus according to claim 26 wherein the receiving network has an unclassified RADIUS server and provides for the apparatus to authenticate wireless messages using certificates from that server.

29. Apparatus according to claim 26 wherein the receiving network has an unclassified certificate server for supplying certificates marked to indicate use by wireless only providing for the apparatus to authenticate messages by wireless using certificates so marked from that server.

30. Apparatus according to claim 16 for counteracting a security threat posed by potential computer theft by providing for the computer apparatus to become screen locked when unattended by authorised personnel.

31. A computer program product for computer communications and comprising a computer-readable medium embodying program code instructions for execution by a computer processor wherein the instructions are for controlling a computerised communications network to execute the steps of:

a) establishing a wireless link between computer apparatus and a receiving network implementing two protocols at least one of which is for encrypting messages, one of the two protocols being a VPN protocol suitable for securing wire-linked communications and the other of the two protocols being a wireless-linking protocol of a kind suitable for securing wireless-linked communications;

b) applying both protocols to a message to render it doubly secured;

c) sending the doubly secured message over the wireless link; and

d) processing the doubly secured message to recover the message.

32. A computer program product according to claim 31 wherein the instructions are also for implementing application of both protocols by applying the VPN protocol to a message to render it VPN-secured and applying the wireless-linking protocol to the VPN-secured message to render it doubly secured.

33. A computer program product according to claim 31 wherein the instructions are also for implementing a logical LAN configuration protecting the receiving network against unauthorised access.

34. A computer program product according to claim 33 wherein:

a) the logical LAN configuration has first and second logical LANs;

b) the first logical LAN;

i) has elements which cannot be remotely managed except by at least one other element of that LAN,

ii) has ports from which message traffic is constrained to go only to other ports on that LAN, and

iii) implements a wireless authentication process and secure communication within that LAN; and

c) the second logical LAN enables the computer apparatus when authenticated to communicate with a classified network or an unclassified network, and has firewall functionality configured to avoid message traffic to and from the computer apparatus affecting the first logical LAN.

35. A computer program product according to claim 34 wherein the first logical LAN includes:

a) an access point for communication with wireless-linked computer apparatus;

b) a switch to constrain message traffic from first logical LAN ports to go only to other first logical LAN ports; and

c) a RADIUS server for implementation of the wireless-linking protocol which provides an authentication process.

36. A computer program product according to claim 35 wherein the first logical LAN is associated with firewall functionality configured to monitor data flow within and to and from that LAN but excluded from management of elements of that LAN.

37. A computer program product according to claim 34 wherein the instructions are also for implementing the wireless-linking protocol by certificate-based authentication using a RADIUS server.

38. A computer program product according to claim 34 wherein the instructions are also for implementing the wireless-linking protocol by means of a pre-shared key (PSK)

39. A computer program product according to claim 34 wherein the instructions are also for implementing the wireless-linking protocol by means of authentication using EAP-TLS, EAP-TTLS, PEAP or LEAP.

40. A computer program product according to claim 34 wherein the instructions are also for implementing:

a) application of both protocols by encryption to provide a VPN-encrypted message and to provide for the doubly secured message to be doubly encrypted, and

b) processing of the doubly secured message to recover it by double decryption.

41. A computer program product according to claim 34 wherein the receiving network has a classified virtual network, and an unclassified virtual network, and the instructions are also for implementing access of the doubly secured message to the classified virtual network and also access of wireless messages to the unclassified virtual network if such messages are secured by the wireless-linking protocol but not the VPN protocol.

42. A computer program product according to claim 41 wherein the receiving network is associated with offline and root certificate servers and the instructions are also for authenticating wireless messages using certificates from such servers.

43. A computer program product according to claim 41 wherein the receiving network has an unclassified RADIUS server and the instructions are also for authenticating wireless messages using certificates from that server.

44. A computer program product according to claim 41 wherein the receiving network has an unclassified certificate server arranged to supply certificates marked to indicate use by wireless only and instructions are also for wireless authentication using certificates so marked from that server.

45. A computer program product according to claim 31 wherein the instructions are also for counteracting a security threat posed by potential computer theft by providing for the computer apparatus to be screen locked when it becomes unattended by authorised personnel.