System, method and computer program product for updating security criteria in wireless networks

• US 7,606,370 B2
• Filed: 02/21/2006
• Issued: 10/20/2009
• Est. Priority Date: 04/05/2005
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Wiedmann, Christian, Lillie, Terrance L., Sneiderman, Richard P., Zeljko, Robert, Wiedmann, Ulrich, Lynch, Sean R., Chu, Gigi C.
• Primary Examiner(s): COLIN, CARL G
• Application Number:
  US11/359,119
• Publication Number:
  US 20060251258A1
• Time in Patent Office: 1,337 Days
• Field of Search: 713/155, 713/166, 713/168, 713/153, 713/163, 713/167, 713/171, 726/3, 726/14, 726/15, 726/2, 380/277, 380/278, 380/247, 380/255
• US Class Current: 380/278
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/10 Small scale networks; Flat hierarchical networks
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A system, method and computer program product are provided. In use, a key is distributed to a plurality of nodes of a wireless network for use in securing the nodes during use of the wireless network. Further, the key is automatically updated at the nodes in the wireless network based on predetermined criteria.

Claims

1. A method, comprising:

distributing a key to a plurality of nodes of a wireless network for use in securing the nodes during use of the wireless network; and

automatically updating the key at the nodes in the wireless network based on predetermined criteria;

wherein the key is updated utilizing a software application downloaded by;

advertising a peer-to-peer wireless network utilizing a granting node;

allowing connection to the peer-to-peer wireless network utilizing a requesting node;

in response to any request received from the requesting node, automatically redirecting the requesting node to a portal including a captive portal; and

downloading the software application to the requesting node via the peer-to-peer wireless network utilizing the portal, the key being updated utilizing the downloaded software application;

wherein the portal includes a graphical user interface;

wherein the graphical user interface allows a user of the requesting node to download the software application;

wherein the software application is downloaded to the requesting node in response to the user selection of a button displayed as part of the graphical user interface;

wherein the portal includes a web page stored at the granting node;

wherein the software application carries out a process including;

exchanging a first key between the granting node and the requesting node via another peer-to-peer wireless network;

generating a human-perceptible hash at the granting node and the requesting node, utilizing the first key;

comparing the human-perceptible hashes via an out-of-band communication channel; and

transmitting a second key to the requesting node for providing access to a centrally-based wireless network based on the comparison.

2. The method as recited in claim 1, wherein the wireless network includes a 802.11 wireless network.

3. The method as recited in claim 1, wherein the securing includes authenticating the nodes.

4. The method as recited in claim 1, wherein the securing includes encrypting communications between a plurality of the nodes.

5. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated with a new key.

6. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated based on rotation of a plurality of predetermined keys.

7. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated based on a predetermined schedule.

8. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated periodically.

9. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated based on a random number.

10. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated based on a pseudo-random number.

11. The method as recited in claim 10, wherein the pseudo-random number is generated utilizing a pseudo-random process capable of being carried out utilizing each of the nodes.

12. The method as recited in claim 11, wherein the pseudo-random process utilizes a seed value distributed to each of the nodes.

13. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated in response to an instruction.

14. The method as recited in claim 13, wherein the instruction is received from an access point.

15. The method as recited in claim 1, wherein the predetermined criteria requires that the key be automatically updated utilizing a hint.

16. The method as recited in claim 15, wherein the hint includes a service set identifier.

17. The method as recited in claim 1, wherein the key includes a wireless equivalency privacy (WEP) key.

18. The method as recited in claim 1, wherein the redirecting occurs in response to an opening of a network browser utilizing the requesting node.

19. The method as recited in claim 1, wherein the redirecting is carried out in response to the request from the requesting node to access the centrally-based wireless network.

20. The method as recited in claim 19, wherein the centrally-based wireless network includes a network operating in an infrastructure mode.

21. The method as recited in claim 19, wherein the centrally-based wireless network requires that the software application be installed on the requesting node for allowing the access thereto.

22. The method as recited in claim 21, wherein the human-perceptible hash has less precision than the first key and can be traced back to the first key to determine that the first key is identical for the granting node and the requesting node.

23. The method as recited in claim 1, wherein the granting node redirects the requesting node to the portal.

24. The method as recited in claim 1, wherein the software application includes an applet.

25. The method as recited in claim 1, wherein the software application requires a separate installation process on the requesting node.

26. The method as recited in claim 1, wherein the portal includes another web page stored at an access point.

27. A computer program product embodied on a computer readable medium, comprising:

computer code for distributing a key to a plurality of nodes of a 802.11 wireless network for use in securing the nodes during use of the 802.11 wireless network; and

computer code for automatically updating the key at the nodes in the 802.11 wireless network based on predetermined criteria;

wherein the key is updated utilizing computer code for a software application downloaded utilizing;

computer code for advertising a peer-to-peer wireless network utilizing a granting node;

computer code for connecting to the peer-to-peer wireless network utilizing a requesting node;

computer code for automatically redirecting the requesting node to a portal including a captive portal, in response to any request received from the requesting node; and

computer code for downloading the software application to the requesting node via the peer-to-peer wireless network utilizing the portal, the key being updated utilizing the downloaded software application;

wherein the portal includes a graphical user interface;

wherein the graphical user interface allows a user of the requesting node to download the software application;

wherein the software application is downloaded to the requesting node in response to the user selection of a button displayed as part of the graphical user interface;

wherein the portal includes a web page stored at the granting node;

wherein the software application carries out a process including;

exchanging a first key between the granting node and the requesting node via another peer-to-peer wireless network;

generating a human-perceptible hash at the granting node and the requesting node, utilizing the first key;

comparing the human-perceptible hashes via an out-of-band communication channel; and

transmitting a second key to the requesting node for providing access to a centrally-based wireless network based on the comparison.

28. A system, comprising:

a processor for distributing a key to a plurality of nodes of a 802.11 wireless network for use in securing the nodes during use of the 802.11 wireless network;

wherein the key is automatically updated at the nodes in the 802.11 wireless network;

wherein the key is updated utilizing a software application downloaded by;

advertising a peer-to-peer wireless network utilizing a granting node;

connecting to the peer-to-peer wireless network utilizing a requesting node;

in response to any request received from the requesting node, automatically redirecting the requesting node to a portal including a captive portal; and

downloading the software application to the requesting node via the peer-to-peer wireless network utilizing the portal, the key being updated utilizing the downloaded software application;

wherein the portal includes a graphical user interface;

wherein the graphical user interface allows a user of the requesting node to download the software application;

wherein the software application is downloaded to the requesting node in response to the user selection of a button displayed as part of the graphical user interface;

wherein the portal includes a web page stored at the granting node;

wherein the software application carries out a process including;

exchanging a first key between the granting node and the requesting node via another peer-to-peer wireless network;

generating a human-perceptible hash at the granting node and the requesting node, utilizing the first key;

comparing the human-perceptible hashes via an out-of-band communication channel; and

transmitting a second key to the requesting node for providing access to a centrally-based wireless network based on the comparison.