Method for establishing a secure Ad Hoc wireless LAN

• US 7,660,990 B1
• Filed: 04/27/2004
• Issued: 02/09/2010
• Est. Priority Date: 04/27/2004
• Status: Expired due to Fees

• Current Assignee: Meizu Technology Company Limited
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Thomsen, Brant D., Wheeler, Thomas M., Beachem, Brent R.
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Paliwal; Yogesh
• Application Number:
  US10/832,698
• Time in Patent Office: 2,114 Days
• Field of Search: 713/153, 713/171
• US Class Current: 713/171
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Secure communications on a network. An unauthenticated client on an network sends start packets to locate other clients. The unauthenticated client receives responses to the start packets from other clients on the network. The responses may be advertise packets that are from advertising clients that may be authenticated clients or other unauthenticated clients in authenticated mode. The unauthenticated client prioritizes the received packets so that authentication can be performed with the most desirable advertising client. Authentication packets are sent and received between the unauthenticated client and the advertising client in an attempt to authenticate.

Claims

1. A method of configuring an unauthenticated client in a network for secure communications the method comprising:

periodically broadcasting, from an access point, a start packet;

waiting for advertise packets from advertising clients;

prioritizing, based on at least one encryption algorithm supported by the unauthenticated client, any advertise packets that are received at the access point;

attempting to authenticate with an advertising client corresponding to the highest priority advertise packet that is received if any; and

if attempting to authenticate results in the unauthenticated client becoming an authenticated client, configuring the authenticated client for secure communications using information from the advertise packet and information obtained from attempting to authenticate.

2. The method of claim 1 further comprising checking to see if any advertise packets have been received and if no advertise packets have been received continuing to periodically broadcast a start packet and wait for advertise packets from advertising clients.

3. The method of claim 1 further comprising checking to see if advertise packets have been received from advertising clients with security supported by the unauthenticated client and if no advertise packets have been received form advertising clients with security supported by the unauthenticated client, continuing to periodically broadcast a start packet and wait for advertise packets from advertising clients.

4. The method of claim 1 wherein advertise packets comprise:

an identity request;

encryption types supported by the advertising client sending the advertise packet;

optionally, an encryption type used by the advertising client sending the advertise packet;

optionally, a timer value for an encryption key currently being used by the advertising client sending the advertise packet indicating how long the encryption key has been in use; and

optionally, a signature derived from the encryption key.

5. The method of claim 4 further comprising determining that an advertise packet has been received by an authenticated client if the advertise packet comprises at least one of:

encryption types used by the advertising client sending the advertise packet, a timer value for an encryption key currently being used by the advertising client sending the advertise packet indicating how long the encryption key has been in use, and a signature derived from the encryption key.

6. The method of claim 1 wherein attempting to authenticate with a client corresponding to the highest priority advertise packet comprises:

getting an authentication type from the unauthenticated client;

sending an identity response packet including an identity of the unauthenticated client and the authentication type to the advertising client corresponding to the highest priority advertise packet; and

sending and receiving other packets for authentication.

7. The method of claim 6 wherein the authentication type comprises at least one of a password and optionally a username, a digital certificate, a digital certificate stored on a smart card, public keys, one-time passwords, and biometric authentication types.

8. The method of claim 6 wherein the identity response packet is a select encryption packet that comprises a unique code.

9. The method of claim 6 wherein if attempting to authenticate does not result in the unauthenticated client becoming authenticated the method further comprising:

adding the advertising client to which authentication was attempted to an ignore list, the ignore list comprising an enumeration of advertising clients whose advertising packets are disregarded by the unauthenticated client;

prompting a user at the unauthenticated client for a new authentication type;

if a new authentication type is entered, clearing the ignore list and attempting to authenticate with the authenticated client corresponding to the highest priority advertise packet again with the new authentication type; and

if a new authentication type is not entered, continuing to periodically broadcast a start packet and wait for advertise packets from advertising clients.

10. The method of claim 9 wherein prompting the user at the unauthenticated client for a new authentication type is performed after the unauthenticated client has unsuccessfully attempted to authenticate with other advertising clients.

11. The method of claim 1 wherein configuring the unauthenticated client for security comprises:

resetting a timer value wherein the timer values specifies the length of time a particular encryption key has been in use;

changing the encryption key used by the unauthenticated client;

communicating to a LAN device at the unauthenticated client to start using the encryption key; and

broadcasting an advertise packet.

12. The method of claim 1 wherein the period for periodically broadcasting a start packet is correlated to an awake period in a power saving mode.

13. The method of claim 1 wherein prioritizing any advertise packets that are received comprises ranking advertising clients using the following criteria, the following criteria organized according to highest priority:

(a) advertising clients that are using encryption with an encryption algorithm supported by the unauthenticated client, wherein the advertising clients are currently authenticated;

(i) the advertising clients using encryption with an encryption algorithm supported by the unauthenticated client are further prioritized by the encryption type the advertising client is using where clients with smaller encryption types are prioritized higher than clients with larger encryption types;

(ii) the advertising clients using encryption with an encryption algorithm supported by the unauthenticated client are further prioritized by timer values wherein a timer value indicating that an encryption key has been used for a lesser period of time is prioritized higher than an encryption key that has a timer value that indicates that the encryption key has been used for a greater period of time;

(b) advertising clients that are not using encryption and support one or more encryption algorithms supported by the unauthenticated client where the advertising clients are not currently authenticated;

(i) the advertising clients that are not using encryption are further prioritized by the encryption types they have in common with the unauthenticated client where advertising clients with larger encryption types are prioritized higher than clients with smaller encryption types;

(c) advertising clients that are using encryption and are using an encryption algorithm not supported by the unauthenticated client but that also support one or more encryption algorithms supported by the unauthenticated client;

(i) the advertising clients using an encryption algorithm not supported by the unauthenticated client but that also support one or more encryption algorithms supported by the unauthenticated client further being prioritized by the encryption types that they have in common with the unauthenticated client where advertising clients with larger encryption types are prioritized higher than advertising clients with smaller encryption types

(ii) the advertising clients using an encryption algorithm not supported by the unauthenticated client but that also support one or more encryption algorithms supported by the unauthenticated client further being prioritized by timer values wherein a timer value indicating that an encryption key has been used for a lesser period of time is prioritized higher than an encryption key that has a time value that indicates that the encryption key has been used for greater period of time;

(d) advertising clients that do not support any of the encryption algorithms supported by the unauthenticated client wherein the unauthenticated client does not authenticate with the advertising clients that do not support any of the encryption algorithms supported by the unauthenticated client.

14. The method of claim 1 further comprising:

receiving a start packet from another unauthenticated client;

switching the unauthenticated client to an authenticated mode; and

allowing the other unauthenticated client to attempt to authenticate with the unauthenticated client in authenticated mode.

15. The method of claim 14 wherein if the attempt to authenticate results in the other unauthenticated client becoming an other authenticated client, the method further comprising:

creating a random encryption key, random encryption key index, and encryption signature;

communicating to a LAN device at the unauthenticated client in authenticated mode to start using the encryption key;

sending the other authenticated client the random encryption key and a Unicast key;

resetting a timer value wherein the timer values specifies the length of time a particular encryption key has been in use; and

broadcasting an advertise packet.

16. The method of claim 14 wherein if the attempt to authenticate is not successful, the method further comprising reverting back to an unauthenticated state.

17. A computer readable medium with computer executable instructions for performing the method of claim 1.