Inter subnet roaming system and method

• US 7,624,270 B2
• Filed: 02/18/2005
• Issued: 11/24/2009
• Est. Priority Date: 11/26/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Meier, Robert Charles, Leung, Patrick Pak-Chiu, Pathan, Arnavkumar M., Winget, Nancy Cam, Wakerly, John F.
• Primary Examiner(s): Nalven; Andrew L
• Assistant Examiner(s): RAHIM, MONJUR
• Application Number:
  US11/060,923
• Publication Number:
  US 20050143065A1
• Time in Patent Office: 1,740 Days
• Field of Search: 380/247, 455/435, 455/422, 455/432, 455/436, 709/223, 370/345, 713/171, 713/176, 713/185, 713/182
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

The present invention communication network system and method facilitates authentication and registration in a communication network as mobile nodes move from one geographical region to another. Multiple wireless domain services (WDSs) share client authentication information permitting relatively seamless roaming between subnets with minimal interruptions and delays. In one embodiment, a wireless domain service network communication method is performed utilizing partial authentication processes. A mobile node engages in an authentication protocol with a first wireless domain service (WDS) access point in a first subnet. The authentication credentials are forwarded to a second wireless domain service in a second subnet if the authentication protocol is successfully completed. The forwarded authentication credentials are utilized to authenticate the client entering the service area of the second wireless domain service in the second subnet. The authentication credentials can be “pushed” or “pulled” from the first wireless domain service to the second wireless domain service.

Claims

1. A method comprising:

receiving, with a first wireless domain service device, authentication information of a mobile device from a second wireless domain service device, wherein the first wireless domain service device is configured to provide network access to mobile devices located in a first geographical area, wherein the second wireless domain service device is configured to provide network access to mobile devices located in a second geographical area, and wherein the authentication information is configured to indicate that the second wireless domain service device previously authenticated the mobile device for communication over a network;

receiving a request for the mobile device to communicate over a network through the first wireless domain service device; and

authenticating the mobile device according to the authentication information received from the second wireless domain service device utilizing a reduced authentication process responsive to the request, wherein the mobile device, once authenticated by the first wireless domain service device, is capable of communicating over the network through the first wireless domain service device.

2. The method of claim 1 further comprising forwarding the authentication information to a third wireless domain service device having geographical area that neighbors the first wireless domain service device.

3. The method of claim 2 wherein the authentication information is pushed to the third wireless domain service device from the first wireless domain service device.

4. The method of claim 1 further comprising:

detecting the mobile device enters into the first geographical area; and

sending a query regarding whether another wireless domain service device includes the authentication information of the mobile device.

5. The method of claim 1 wherein receiving the authentication information of the mobile device from the second wireless domain service device further comprises pulling the authentication information from the first wireless domain service device responsive to the detecting of the mobile device entering the first geographical area.

6. The method of claim 1 wherein each of the wireless domain service devices operate to provide network access over Internet Protocol compliant subnets.

7. The method of claim 1 wherein each of the wireless domain service devices cover unique geographical areas.

8. A network communication system comprising:

a communication component for transmitting and receiving information to and from a mobile device; and

a wireless domain service device for implementing a wireless domain service including inter subnet fast roaming authentication and registration of the mobile device, wherein the wireless domain service device is configured to receive authentication information of the mobile device from a neighboring wireless domain service device, wherein the authentication information is configured to indicate that the neighboring wireless domain service device previously authenticated the mobile device for communication over the network, wherein the wireless domain service device is configured to authenticate the mobile device according to the authentication information received from the neighboring wireless domain service device utilizing a reduced authentication process, and wherein the mobile device, once authenticated by the wireless domain service device, is capable of communicating over the network via the wireless domain service device.

9. The network communication system claim 8 wherein the wireless domain service device participates in peer authentication by distributing and receiving authentication information to and from one or more neighboring wireless domain service devices associated with other subnets.

10. The network communication system claim 9 wherein authentication information is pushed to the wireless domain service device from the neighboring wireless domain service devices.

11. The network communication system claim 9 wherein the authentication information is pulled by the wireless domain service device from the neighboring wireless domain service devices.

12. The network communication system of claim 8 wherein the wireless domain service device provides authentication credentials of the mobile device to a root device when the inter subnet fast roaming authentication is successful.

13. The network communication system of claim 8 wherein the inter subnet fast roaming authentication included a peer authentication portion and a direct client partial authentication portion.

14. The network communication system of claim 13 wherein information associated with the peer authentication portion is received from peer wireless domain devices.

15. A computer readable medium for storing computer readable code including instruction for directing a processor in the performance of a communication network roaming authentication process comprising:

directing operations associated with communication of client authentication information of a mobile device to and from one or more wireless domain service devices, wherein the wireless domain service devices are configured to provide network access to mobile devices located in different geographical areas, and wherein the client authentication information is configured to indicate that at least one of the wireless domain service devices previously authenticated the mobile device for communication over a network;

receiving a request for the mobile device to communicate over a network through the first wireless domain service device; and

authenticating the mobile device according to the client authentication information received from at least one of the wireless domain service devices utilizing a reduced authentication process responsive to the request, wherein the mobile device, once authenticated, is capable of communicating over the network through the first wireless domain service device.

16. The computer-readable medium for storing computer readable code including instruction for directing the processor in the performance of the communication network roaming authentication process of claim 15 further comprising forwarding the client authentication information to another wireless domain service device having a neighboring geographical area.

17. The computer-readable medium for storing computer readable code including instruction for directing the processor in the performance of the communication network roaming authentication process of claim 15 further comprising receiving the client authentication information from at least one of the wireless domain service devices.

18. The computer-readable medium for storing computer readable code including instruction for directing the processor in the performance of the communication network roaming authentication process of claim 15 wherein access points and mobile nodes authenticate with at least one of the wireless domain service devices.

19. The computer-readable medium for storing computer readable code including instruction for directing the processor in the performance of the communication network roaming authentication process of claim 15 wherein the client authentication information is communicated in a Wireless LAN Context Control Protocol (WLCCP).

20. A system comprising:

means for receiving, with a first wireless domain service device, authentication information of a mobile device from a second wireless domain service device, wherein the first wireless domain service device is configured to provide network access to mobile devices located in a first geographical area, wherein the second wireless domain service device is configured to provide network access to mobile devices located in a second geographical area, and wherein the authentication information is configured to indicate that the second wireless domain service device previously authenticated the mobile device for communication over a network;

means for receiving a request for the mobile device to communicate over a network through the first wireless domain service device; and

means for authenticating the mobile device according to the authentication information received from the second wireless domain service device utilizing a reduced authentication process responsive to the request, wherein the mobile device, once authenticated by the first wireless domain service device, is capable of communicating over the network through the first wireless domain service device.