Enhancement to authentication protocol that uses a key lease

• US 7,480,939 B1
• Filed: 07/06/2001
• Issued: 01/20/2009
• Est. Priority Date: 04/28/2000
• Status: Expired due to Term

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Nessett, Danny M., Young, Albert
• Primary Examiner(s): Revak, Christopher A
• Assistant Examiner(s): Moorthy, Aravind K
• Application Number:
  US09/900,617
• Time in Patent Office: 2,755 Days
• Field of Search: 713/200, 713/168, 713/171, 713/201
• US Class Current: 726/22
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/50 Secure pairing of devices

Abstract

A method and system for using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed is described. In one embodiment, the primary authentication protocol comprises a strong, secure, computationally complex authentication protocol. Moreover, the secondary authentication protocol comprises a less complex (compared to the primary authentication protocol) and less secure (compared to the primary authentication protocol) authentication protocol which can be performed in a length of time that is shorter than a length of time required to perform the primary authentication protocol. In an embodiment, the key lease includes context information. Moreover, a new session encryption key is computed after each time a quick re-authentication is performed by executing the secondary authentication protocol using the key lease, whereas the session encryption key is used for encrypting communication traffic, providing a solution to the potential communication traffic replay threat.

Claims

1. A method of re-authenticating and protecting wireless communication security comprising the steps of:

a) performing a secondary authentication protocol between a wireless client electronic system (client) and a wireless network access point electronic system (AP) using a key lease generated by performance of a primary authentication protocol, wherein said key lease includes a key lease period for indicating a length of time in which said key lease is valid for using said secondary authentication protocol instead of said primary authentication protocol, and wherein the secondary authentication protocol includes the steps of;

a(i) transmitting said key lease from said client to said AP;

a(ii) generating a first random number associated with said client and a second random number associated with said AP, wherein said key lease includes an encryption key for use in said secondary authentication protocol; and

a(iii) transmitting said first random number to said AP and said second random number to said client; and

b) if said secondary authentication protocol is successful, generating a session encryption key for encrypting communication traffic between said client and said AP, wherein the generating comprises;

b(i) applying a hash function and said encryption key to said first random number and said second random number to determine said session encryption key.

2. A method as recited in claim 1 wherein said hash function is a HMAC-MD5 algorithm and wherein said hash function and encryption key are applied to a concatenation of said first random number and said second random number to determine said session encryption key.

3. A method as recited in claim 1 wherein said hash function is a HMAC-SHA-1 algorithm and wherein said hash function and encryption key are applied to a concatenation of said first random number and said second random number to determine said session encryption key.

4. A method as recited in claim 1 wherein said step b) includes:

generating a first session encryption key for encrypting communication traffic from said client to said AP; and

generating a second session encryption key for encrypting communication traffic from said AP to said client.

5. A method as recited in claim 4 wherein said step b) includes:

using said encryption key, said first random number, said second random number, a first media access control (MAC) address associated with said client, a second media access control (MAC) address associated with said AP, and the hash function to determine said first and second session encryption keys.

6. A method as recited in claim 5 wherein said hash function is a HMAC-MDS algorithm and wherein said hash function and said encryption key are applied to a concatenation of said first random number, said second random number, said first media access control (MAC) address associated with said client, and said second media access control (MAC) address associated with said AP to determine said first session encryption key.

7. A method as recited in claim 5 wherein said hash function is a HMAC-SHA-1 algorithm and wherein said hash function and said encryption key are applied to a concatenation of said first random number, said second random number, said first media access control (MAC) address associated with said client, and said second media access control (MAC) address associated with said AP to determine said first session encryption key.

8. A method as recited in claim 5 wherein said hash function is a HMAC-MD5 algorithm and said hash function and said encryption key are applied to a concatenation of said first random number, said second random number, said second media access control (MAC) address associated with said AP, and said first media access control (MAC) address associated with said client to determine said second session encryption key.

9. A method as recited in claim 5 wherein said hash function is a HMAC-SHA-1 algorithm and said hash function and said encryption key are applied to a concatenation of said first random number, said second random number, said second media access control (MAC) address associated with said AP, and said first media access control (MAC) address associated with said client to determine said second session encryption key.