END-TO-END SECURITY IN AN IEEE 802.11 COMMUNICATION SYSTEM

• US 20150124966A1
• Filed: 04/15/2013
• Published: 05/07/2015
• Est. Priority Date: 04/13/2012
• Status: Abandoned Application

• Current Assignee: Anyfi Networks AB
• Original Assignee: Anyfi Networks AB
• Inventors: Smedman, Bjrn, Almbladh, Johan
• Application Number:
  US14/394,386
• Publication Number:
  US 20150124966A1
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/10 adapted for operation in multiple networks, e.g. multi-mode access points

Abstract

A communication network comprises a front-end network communication device arranged to operate as a front-end access point for establishing at least one data connection, such as an IEEE 802.11 data connection, between at least one mobile communications terminal and at least one back-end network communication device, protected end-to-end with an encryption key unknown to said at least one front-end network communication device. The front-end network communication device includes a memory, a controller and a data port and the back-end network communication device includes a memory, a controller and a data port.

Claims

1. A communication network (400) comprising a front-end network communication device (100 A, 200 A) arranged to operate as a front-end access point for establishing at least one data connection (430), such as an IEEE 802.11 data connection (430), between at least one mobile communications terminal (420) and at least one back-end network communication device (100B, 200A), wherein said front-end network communication device (100A) comprises a memory (240), a controller (210) and a data port and said back-end network communication device (100B) comprises a memory (240), a controller (210) and a data port

wherein said front-end network communication device (100 A) has a primary purpose and said at least one data connections (430) is for a secondary purpose associated with said at least one back-end network communication devices (100B),

wherein said primary purpose is to provide one or more primary users with data communication services, and at least one of said primary users is in physical control of said front-end network communications device (100A), and said front-end network communications device (100 A) is arranged with access to primary encryption keys necessary for communication with said one or more primary users, and

wherein said secondary purpose is to provide one or more secondary users access to secondary service providers, and

wherein said data connection (430) is established end-to-end by:

said front-end network communications device (100 A) being configured to receive at least one 802.11 frame from said mobile communications terminal (420), said IEEE 802.11 frame comprising an information entity, and

send a corresponding message to said back-end network communications device (100B), said message comprising said information entity,

and/or

receive at least one message from said back-end network communications device (100B), said message comprising an information entity, and

send a corresponding 802.11 frame to said mobile communications terminal (420), said IEEE 802.11 comprising said information entity,

said front-end network communications device (100 A) thereby being configured to act as a forwarding relay between said at least one mobile communications terminal (420) and said at least one back-end network communications device (100B) and

wherein

said back-end network communication device (100B) is configured for;

sending and receiving messages comprising IEEE 802.11 authentication protocol data to and/or from said at least one mobile communications terminal (420); and

authenticating said mobile communication terminal (420) and deriving secondary encryption keys based on said IEEE 802.11 authentication protocol data,

wherein said back-end network communication device (100B) has access to said secondary encryption keys and

said back-end network communication device (100B) is configured to keep said secondary encryption keys secret from the front-end network communications device (100A).

2. The communication network (400) according to claim 1, further comprising network element, such as a tunnel termination gateway, wherein said network element is comprised in the data connection (430) and wherein said back-end network communication device (100B) is configured for sending said encryption keys to said network element wherein said network element is enabled to decrypt and encrypt messages sent over the data connection (430).

3. The communication network (400) according to claim 2, wherein said network element is configured to keep said secondary encryption keys secret from the front-end network communications device (100A).

4. The communication network (400) according to claim 1, wherein said front-end network communications device (100 A) is configured to operate as an access point (100A), and said primary purpose is to provide access to a local network, such as a local area network, and/or to the internet.

5. The communication network (400) according to claim 1, wherein the front-end network communications device (100 A) is configured to operate as a residential gateway, and said primary purpose is to provide access to a residential network and/or to the internet data connection (430) is established end-to-end over both a wireless and a wired interface.

6. The communication network (400) according to claim 1, wherein access to the secondary service provider is for access to a local area network.

7. The communication network (400) according to claim 1, further comprising a master server configured to send an introduction message to the back-end network communications device (100B) to introduce the front-end network communications device (100 A) to said back-end network communications device (100B).

8. The communication network (400) according to claim 1, wherein said front-end network communications device (100 A) is configured to prioritize primary users over at least one of said at least one mobile communications terminals (420).

11. A back-end network communication device (100B, 200 A) for use in a communication network (400) according to claim 1, wherein said back-end network communications device (100B) is configured to:

receive message from said front-end network communications device (100 A), said message comprising at least one 802.11 frame from said mobile communications terminal (420), said IEEE 802.11 frame comprising an information entity,

and/or

send at least one message from said back-end network communications device (100B), said message comprising an information entity, to said front-end network communications device (100A), and

sending and receiving messages comprising IEEE 802.11 authentication protocol data to and/or from said at least one mobile communications terminal (420); and

authenticating said mobile communication terminal (420) and

deriving secondary encryption keys based on said IEEE 802.11 authentication protocol data,

wherein said back-end network communication device (100B) has access to said secondary encryption keys and

said back-end network communication device (100B) is configured to keep said secondary encryption keys secret from the front-end network communications device (100A).

12. A front-end network communication device (100A, 200A) for use in a communication network (400) according to claim 1, wherein said front-end network communication device (100 A) has a primary purpose and said at least one data connections (430) is for a secondary purpose associated with said at least one back-end network communication devices (100B),

wherein said primary purpose is to provide one or more primary users with data communication services, and at least one of said primary users is in physical control of said front-end network communications device (100A), and said front-end network communications device (100 A) is arranged with access to primary encryption keys necessary for communication with said one or more primary users,

and wherein said secondary purpose is to provide one or more secondary users access to secondary service providers, and

wherein said data connection (430) is established end-to-end by:

said front-end network communications device (100 A) being configured to receive at least one 802.11 frame from said mobile communications terminal (420), said IEEE 802.11 frame comprising an information entity, and

send a corresponding message to said back-end network communications device (100B), said message comprising said information entity,

and/or

receive at least one message from said back-end network communications device (100B), said message comprising an information entity, and

send a corresponding 802.11 frame to said mobile communications terminal (420), said IEEE 802.11 comprising said information entity,

said front-end network communications device (100 A) thereby being configured to act as a forwarding relay between said at least one mobile communications terminal (420) and said at least one back-end network communications device (100B) and wherein

said sending and receiving message and corresponding 802.11 frame comprising IEEE 802.11 authentication protocol data enabling the back-end network communications device (100B) to authenticate said mobile communication terminal (420) and derive secondary encryption keys based on said IEEE 802.11 authentication protocol data,

wherein said front-end network communication device (100 A) is arranged to not have access to said secondary encryption keys.

13. A computer-readable storage medium encoded with instructions that, when executed on a processor of a back-end network communications device (100B) causes the back-end network communications device (100B) to perform as the back-end network communications device according to claim 11.

14. A computer-readable storage medium encoded with instructions that, when executed on a processor of a front-end network communications device (100 A) causes the front-end network communications device (100 A) to perform as the front-end network communications device according to claim 12.

15. The communication network (400) according to claim 4, wherein access to the secondary service provider is for access to a local area network.

16. The communication network (400) according to claim 5, wherein access to the secondary service provider is for access to a local area network.

9. A method for use in a communication network (400) comprising a front-end network communication device (100 A, 200 A) arranged to operate as a front-end access point for establishing at least one data connection (430), such as an IEEE 802.11 data connection (430), between at least one mobile communications terminal (420) and at least one back-end network communication device (100B, 200A), wherein said front-end network communication device (100A) comprises a memory (240), a controller (210) and a data port and said back-end network communication device (100B) comprises a memory (240), a controller (210) and a data port

wherein said front-end network communication device (100 A) has a primary purpose and said at least one data connections (430) is for a secondary purpose associated with said at least one back-end network communication devices (100B),

wherein said primary purpose is to provide one or more primary users with data communication services, and at least one of said primary users is in physical control of said front-end network communications device (100A), and said front-end network communications device (100 A) is arranged with access to primary encryption keys necessary for communication with said one or more primary users,

and wherein said secondary purpose is to provide one or more secondary users access to secondary service providers, and

wherein said method comprises establishing said data connection (430) end-to-end by:

in the front-end network communications device (100 A) receiving at least one 802.11 frame from said mobile communications terminal (420), said IEEE 802.11 frame comprising an information entity, and

from the front-end network communications device (100 A) sending a corresponding message to said back-end network communications device (100B), said message comprising said information entity,

and/or

in the front-end network communications device (100 A) receiving at least one message from said back-end network communications device (100B), said message comprising an information entity, and

from the front-end network communications device (100 A) send a corresponding 802.11 frame to said mobile communications terminal (420), said IEEE 802.11 comprising said information entity,

said front-end network communications device (100 A) thereby being configured to act as a forwarding relay between said at least one mobile communications terminal (420) and said at least one back-end network communications device (100B) and

wherein said method further comprising

sending and receiving messages comprising IEEE 802.11 authentication protocol data between said back-end network communication device (100B) and said at least one mobile communications terminal (420); and

authenticating said mobile communication terminal (420) and deriving secondary encryption keys based on said IEEE 802.11 authentication protocol data,

wherein said back-end network communication device (100B) has access to said secondary encryption keys and

said back-end network communication device (100B) is configured to keep said secondary encryption keys secret from the front-end network communications device (100A).

10. A computer-readable storage medium encoded with instructions that, when executed on a processor, performs the method according to claim 9.