Multi-level encryption system for wireless network

• US 6,453,159 B1
• Filed: 02/25/1999
• Issued: 09/17/2002
• Est. Priority Date: 02/25/1999
• Status: Expired due to Term

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Telxon Corporation (Zebra Technologies Corporation)
• Inventors: Lewis, Daniel E.
• Primary Examiner(s): Maung, Nay
• Assistant Examiner(s): Gelin, Jean A
• Application Number:
  US09/257,732
• Time in Patent Office: 1,300 Days
• Field of Search: 455/410, 455/411, 380/201, 380/278, 380/277, 380/285, 380/286, 380/270, 380/30, 380/25, 380/279, 340/5.8, 340/5.2, 340/5.21, 340/5.25, 340/5.26, 713/201, 713/150, 713/160, 713/162, 709/220-222, 709/227, 370/328, 370/329, 370/345, 370/349, 370/350
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

A multi-level encryption scheme is provided for a wireless network. A first level of encryption is provided primarily for wireless communications taking place between a mobile terminal and an access point. In addition, a second, higher level of encryption is provided which is distributed beyond the wireless communications onto the system backbone itself. Through a key distribution server/access point arrangement, the second level of encryption provides a secure means for distributing the encryption scheme of the first level without compromising the integrity of the network.

Claims

1. A wireless communication system, comprising:

a system backbone;

a plurality of access points coupled to the system backbone, each of the plurality of access points having a first transceiver for communicating wirelessly;

a plurality of mobile terminals, each of the plurality of mobile terminals having a second transceiver for communicating wirelessly with the first transceiver of a respective access point in order to communicate with the system backbone; and

a key distribution server coupled to the system backbone, the key distribution server being configured to distribute a first encryption key to the plurality of mobile terminals in an encrypted format using a second encryption key different from the first key wherein each of the mobile terminals utilizes the first encryption key to encrypt its wireless communications with the respective access point, to communicate with the access points to inform the access points which of a plurality of mobile terminals are authorized to communicate on the wireless communication system and to change the first encryption key to secure communications between the plurality of access points and plurality of mobile terminals.

2. The system of claim 1, wherein each of the plurality of mobile terminals is configured to transmit initially a request to the key distribution server that the key distribution server provide the first encryption key to the mobile terminal.

3. The system of claim 2, wherein each of the plurality of mobile terminals is configured to transmit the request in an encrypted format using the second encryption key.

4. The system of claim 1, further comprising at least one basic mobile terminal which is permitted to communicate with the system backbone without encryption based on the first encryption key.

5. The system of claim 4, wherein the key distribution server includes a table which includes the network identification of the at least one basic mobile terminal.

6. The system of claim 5, wherein the key distribution server further includes in the table the network identification of each of the plurality of mobile terminals.

7. A key distribution server for use in a system including a system backbone, a plurality of access points coupled to the system backbone, each of the plurality of access points having a first transceiever for communicating wirelessly;

and a plurality of mobile terminals, each of the plurality of mobile terminals having a second transceiver for communicating wirelessly with the first transceiver of a respective access point in order to communicate with the system backbone including receiving requests from the system backbone, the key distribution server comprising;

an interface for coupling the key distribution server to the system backbone; and

operational means responsive to requests received from the mobile terminals via the system backbone so as to transmit to the mobile terminals a first encryption key to be used by the mobile terminals to encrypt wireless communications with the respective access points.

8. The key distribution server of claim 7, wherein the operational means transmits the first encryption key to the mobile terminals in an encrypted format using a second encryption key different from the first encryption key.

9. The key distribution server of claim 8, wherein the operational means further functions to periodically transmit to the access points an updated first encryption key.

10. The key distribution server of claim 8, further comprising a table of devices authorized to communicate on the system backbone, and wherein transmission of the first encryption key to the mobile terminals is conditioned upon the mobile terminals appearing in the table.

11. The key distribution server of claim 8, further comprising a table of devices authorized to communicate on the system backbone without encryption based on the first encryption key, and wherein the operational means communicates the identity of the devices to each of the access points.

12. A mobile terminal, comprising:

a transceiver for wirelessly communicating with an access point coupled to a system backbone;

input means for permitting an operator to input data;

memory means for storing the input data;

an encryption engine for encrypting messages which are to be transmitted to the access point via the transceiver, and for decrypting messages received from the access point via the transceiver;

means for selectively providing a plurality of different encryption keys to the encryption engine based upon which encryption and decryption is carried out, the means being operationally preconfigured with the encryption engine and the transceiver to transmit a request for a first encryption key to the system backbone, and wherein the request is encrypted using a second encryption key different from the first encryption key.

13. The mobile terminal of claim 12, wherein the means is configured such that subsequent transmissions following the request are carried out via the transceiver using the first encryption key to encrypt the subsequent transmissions.