Method and system for pre-authentication

• US 7,451,316 B2
• Filed: 07/15/2004
• Issued: 11/11/2008
• Est. Priority Date: 07/15/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Meier, Robert C., Cam Winget, Nancy, Halasz, David E.
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US10/891,924
• Publication Number:
  US 20060013398A1
• Time in Patent Office: 1,580 Days
• Field of Search: None
• US Class Current: 713/171
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A wireless station prepares to roam by pre-authenticating itself with a neighboring access point. The wireless station sends a rekey request, which can include an incremented rekey number. The wireless station receives a rekey response. The rekey response can include the incremented rekey number. Because the wireless station is pre-authenticated, after it roams it only needs to perform a two-way handshake with a new access point to establish secure communications with the new access point. The two-way handshake starts by the wireless station sending a reassociation request to the neighboring access point, the reassociation request comprising the incremented rekey number established during pre-authentication. The wireless station receives a reassociation response from the neighboring access point. To protect against replay attacks, the neighboring access point can verify the rekey number sent in the reassociation request matches the rekey number sent in the rekey response.

Claims

1. A method for roaming from a parent access point to a neighboring access point by a wireless station, comprising:

pre-authenticating with the neighboring access point while associated with the parent access point, the pre-authenticating comprises;

sending a rekey request to the neighboring access point, the rekey request comprises an incremented rekey number, and

receiving a rekey response to the rekey request, the rekey response comprises a one time ticket that includes the incremented rekey number; and

roaming to the neighboring access point after pre-authenticating using a two-way handshake with the neighboring access point, the two-way handshake comprises;

sending a reassociation request to the neighboring access point, the reassociation request comprising the one time ticket, and

receiving a reassociation response from the neighboring access point.

2. The method of claim 1, further comprising detecting the neighboring access point.

3. The method of claim 1, further comprising selecting the neighboring access point from a plurality of access points.

4. The method of claim 1, further comprising incrementing the rekey number after establishing a new secure session with the neighboring access point.

5. The method of claim 1, further comprising determining a set of neighboring access points by at least one of monitoring beacon frames, monitoring probe frames and receiving a list of neighboring access points from the parent access point.

6. The method of claim 1, further comprising:

comparing the rekey number sent with the reassociation request with the incremented rekey number sent with the rekey request; and

sending the reassociation response when the rekey number, sent during the sending a reassociation request, if the rekey number matches the incremented rekey number sent during the rekey request.

7. The method of claim 1, further comprising:

requesting a context server to transfer context information to the neighboring access point while the wireless station is still associated with the parent access point.

8. The method of claim 1, further sending a rekey request further comprises:

sending the rekey request to the parent access point

wherein the rekey request further comprises the basic service set identifier of the neighboring access point.

9. The method of claim 8, the sending a rekey request further comprising:

forwarding the rekey request from the parent access point to an authentication server;

authenticating the rekey request by the authentication server; and

sending a context request message to the neighboring access point;

wherein the context request messages comprises the incremented rekey number.

10. The method of claim 9, the receiving a rekey response further comprising:

creating a rekey response by the neighbor access point, the rekey response comprising the one time ticket that is encrypted and authenticated with a secret key known only by the neighbor access point, the one time ticket containing the rekey number, an authenticator value, and the 802.11 address of the wireless station;

sending the rekey response to the parent access point via the authentication server; and

sending the rekey response to the wireless station by the parent access point.

11. The method of claim 10, the sending a reassociation request by the wireless station to the neighboring access point further comprising:

receiving the reassociation request having the one time ticket by the neighbor access point;

the neighboring access point decrypting and authenticating the reassociation request one time ticket with the secret key; and

verifying the incremented rekey value matches the incremented rekey value sent in the rekey request.

12. The method in claim 9 further comprising registering a plurality of access points in a wireless domain with an authentication server for the wireless domain, the registration information provided by each access point includes access point identifiers, a wireless station includes at least one of the registered identifiers for the neighboring access point in the rekey request, and the authentication server identifies the neighboring access point by the identifier included in the rekey request.

13. The method in claim 12 further comprising each access point in the wireless domain establishing a secret key with the authentication server, wherein the secret key is known only by the access point and the authentication server.

14. The method as in claim 13 wherein rekey messages exchanged by the authentication server and the parent access point are authenticated with the secret key shared by the parent access point and the authentication server.

15. The method as in claim 13 wherein context messages exchanged by the authentication server and the neighboring access point are authenticated with the secret key shared by the neighboring access point and the authentication server.

16. The method as in claim 12 further comprising a method where the neighboring access point identifier contained in a rekey request generated by a wireless station is an 802.11 Basic Service Set Identifier (BSSID) of the neighboring access point.

17. The method as in claim 9 further wherein the parent access point and the neighbor access point are on different Internet Protocol (IP) subnets, the further comprising relaying pre-authentication information between the access points on different subnets by an intermediate authentication server.

18. The methods as in claim 17, wherein the registration information provided by each access point includes an IP address.

19. The method as in claim 7, further comprising a wireless station requesting that context information is forwarded to at least one neighboring access points of a the wireless station'"'"'s parent access point, while the wireless station is still associated with the parent access point.

20. The method as in claim 19, wherein the set of neighboring access points is restricted to those access points to which the wireless station has an acceptable communications link.

21. The method of claim 1, wherein the rekey request is sent to the neighboring access point and includes the basic service set identifier of the neighboring access point, the method further comprising;

receiving the rekey request by the neighboring access point;

sending a pre-registration request to an authentication server by the neighboring access point;

receiving a pre-registration reply from the authentication server by the neighboring access point, the pre-registration reply including the incremented rekey number.

22. The method of claim 21, the receiving a rekey response further comprising:

creating a rekey response by the neighbor access point, the rekey response comprising the one time ticket that is encrypted and authenticated with a secret key known only by the neighbor access point, the one time ticket containing the rekey number, an authenticator value, and the 802.11 address of the wireless station;

sending the rekey response to the parent access point via the authentication server; and

sending the rekey response to the wireless station by the parent access point.

23. The method of claim 22, the sending a reassociation request further comprising:

receiving the reassociation request having the one time ticket by the neighbor access point;

decrypting and authenticating the reassociation request one time ticket with the secret key; and

verifying the incremented rekey value matches the incremented rekey value sent in the rekey request.

24. A system comprising:

an authentication server, the authentication server configured to maintain rekey data for a wireless station;

a parent access point; and

a neighboring access point;

wherein the wireless station is assigned to the parent access point and can communicate with the neighboring access point;

wherein the wireless station configured to pre-authenticate with the neighboring access point while associated with the parent access point by sending a rekey request, the rekey request comprising an incremented rekey number;

wherein the rekey request is received by one of the parent access point and the neighboring access point, and the rekey request is forwarded to the authentication server for authentication by comparing he incremented rekey number with the rekey data;

wherein the neighboring access point is responsive to the authentication server to create a rekey response, the rekey response comprises a one time ticket that includes the incremented rekey number, the rekey response being sent to the wireless station via the authentication server and the parent access point;

wherein the wireless station is further configured to roam to the neighboring access point after pre-authentication using a two-way handshake with the neighboring access point, the two-way handshake comprising;

sending a reassociation request to the neighboring access point, the reassociation request containing the one time ticket; and

receiving a reassociation response from the neighboring access point; and

wherein the neighboring access point is further configured to verify the reassociation request contains the one time ticket with the incremented rekey number and to send a reassociation response responsive to verifying the one time ticket sent in the reassociation request has the correct rekey number.

25. The system of claim 24, wherein the wireless station is configured to select the neighboring access point from a plurality of access points.

26. The system of claim 24, further comprising:

the wireless station adapted to determine a set of neighboring access points by at least one of monitoring beacon frames, monitoring probe frames and receiving a list of neighboring access points from the parent access point.

27. The system of claim 24, further comprising:

the neighboring access point is further configured to forward the reassociation request to the authentication server when the rekey number sent during the reassociation request does not match the incremented rekey number sent during the rekey request.

28. A wireless station, comprising

means for communicating with a parent access point;

means for detecting a neighboring access point;

means for pre-authenticating with the neighboring access point while associated to the parent access point by sending a rekey message directed to the neighboring access point, the rekey message containing an incremented rekey number;

means for receiving a rekey response comprising a one time ticket that contains the incremented rekey number;

means for roaming to the neighboring access point after pre-authentication using a two way handshake with the neighboring access point, the two way handshake comprising;

means for sending a reassociation request to the neighboring access point, the reassociation request comprising the one time ticket; and

means for receiving a reassociation response from the neighboring access point.

29. The wireless station of claim 28, wherein the means for pre-authenticating sends the rekey message to one of the group consisting of the parent access point and the neighboring access point.

30. The method of claim 28, further comprising means for selecting the neighboring access point from a plurality of access points.