Systems and methods for mutual authentication of network nodes

• US 7,760,882 B2
• Filed: 06/16/2005
• Issued: 07/20/2010
• Est. Priority Date: 06/28/2004
• Status: Active Grant

• Current Assignee: Japan Communications Inc.
• Original Assignee: Japan Communications Inc.
• Inventors: Fukuda, Naohisa, Tidwell, Justin Owen
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Abyaneh; Ali S
• Application Number:
  US11/154,800
• Publication Number:
  US 20060064588A1
• Time in Patent Office: 1,860 Days
• Field of Search: 726/5, 380/247, 380/270
• US Class Current: 380/270
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5016 based on statistics of service availability, e.g. in percentage or over a given time
• CPC Class Codes: H04L 41/5067 Customer-centric QoS measurements
• CPC Class Codes: H04L 41/509 wherein the managed service relates to media content delivery, e.g. audio, video or TV
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 : for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 : the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/162 : at the data link layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 : specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/61 : taking into account QoS or priority requirements
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3273 : for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/088 : using filters or firewalls
• CPC Class Codes: H04W 48/18 : Selecting a network or a communication service

Abstract

Systems and methods for mutual encryption of network nodes are described. One described method includes transmitting a communication from a client to a server, the communication associated with a credential, the credential having a user identifier and a first token and receiving the communication at the server. The method further includes determining a second token associated with the user identifier on the server and on the client and generating an encryption key based at least in part on the second token on the server and on the client. The method further includes generating and encrypting an encrypted authentication request on the client; transmitting the encrypted authentication request to the server; receiving the encrypted authentication request on the server; decrypting the encrypted authentication request using the encryption key on the server; generating and encrypting an encrypted authentication response on the server; and transmitting the encrypted authentication response to the client.

Claims

1. A method comprising:

receiving, at an authentication server, a communication from a client, the communication having been sent wirelessly from the client to an access point and from the access point to the authentication server, the communication associated with a credential, the credential having a user identifier and a first token;

determining, at the authentication server, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

generating, at the authentication server, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

receiving, at the authentication server, an authentication message from the client, wherein the authentication message was encrypted at the client using the encryption key, wherein the encryption key was generated at the client using the second token;

decrypting, at the authentication server, the authentication message using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client; and

transmitting, from the authentication server to the client, an authentication reply encrypted using the encryption key, wherein the authentication reply encrypted using the encryption key allows the client to authenticate the authentication server.

2. The method of claim 1, further comprising:

receiving a second communication encrypted using the encryption key from the client; and

decrypting the second communication using the encryption key.

3. A method comprising:

transmitting from a client a communication, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly via a first communication channel from the client to an access point and via a second communication channel from the access point to an authentication server;

determining, at the client, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

generating, at the client, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

transmitting an authentication message from the client to the authentication server, wherein the authentication message was encrypted using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client;

receiving, at the client, from the authentication server an authentication response encrypted using the encryption key, wherein the encryption key on the authentication server was generated on the authentication server using the second token; and

decrypting, at the client, the authentication response using the encryption key, wherein the authentication response encrypted using the encryption key allows the client to authenticate the authentication server.

4. The method of claim 3, wherein the first communication channel comprises a wireless network channel and the second communication channel comprises a wired network channel.

5. The method of claim 3, further comprising

encrypting a second communication using the encryption key;

and

transmitting the second communication.

6. The method of claim 3, wherein the authentication response further comprises a verification message associated with the access point.

7. The method of claim 6, further comprising determining whether the verification message is valid.

8. The method of claim 6, further comprising continuing communication if the verification message is valid.

9. The method of claim 6, further comprising discontinuing communication if the verification message is not valid.

10. A method comprising:

transmitting a communication from a client to an authentication server, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly from the client to an access point and from the access point to an authentication server;

receiving the communication at the authentication server;

determining a second token associated with the user identifier on the authentication server and on the client, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

generating an encryption key based at least in part on the second token on the authentication server and on the client, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

generating and encrypting an encrypted authentication request using the encryption key on the client;

transmitting the encrypted authentication request from the client to the authentication server;

receiving the encrypted authentication request on the authentication server;

decrypting the encrypted authentication request using the encryption key on the authentication server, wherein the authentication request encrypted using the encryption key allows the authentication server to authenticate the client;

generating and encrypting an encrypted authentication response using the encryption key on the authentication server; and

transmitting the encrypted authentication response to the client, wherein the authentication response encrypted using the encryption key allows the client to authenticate the authentication server.

11. A non-transitory computer-readable medium on which is encoded program code, the program code comprising:

program code for receiving at an authentication server, a communication from a client, the communication having been sent wirelessly from the client to an access point and from the access point to the authentication server, the communication associated with a credential, the credential having a user identifier and a first token;

program code for determining, at the authentication server, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

program code for generating, at the authentication server, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

program code for receiving, at the authentication server, an authentication message from the client, wherein the authentication message was encrypted at the client using the encryption key, wherein the encryption key was generated on the client using the second token;

program code for decrypting, at the authentication server, the authentication message using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client; and

program code for transmitting, at the authentication server to the client, an authentication reply encrypted using the encryption key, wherein the authentication reply encrypted using the encryption key allows the client to authenticate the authentication server.

12. The computer-readable medium of claim 11, further comprising:

program code for receiving at the authentication server a second communication encrypted using the encryption key from the client; and

program code for decrypting the second communication using the encryption key.

13. A non-transitory computer-readable medium on which is encoded program code, the program code comprising:

program code for transmitting from a client a communication, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly via a first communication channel from the client to an access point and via a second communication channel from the access point to an authentication server;

program code for determining, at the client, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

program code for generating, at the client, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

program code for transmitting an authentication message from the client to the authentication server, wherein the authentication message was encrypted using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client;

program code for receiving, at the client, from the authentication server an authentication response encrypted using the encryption key, wherein the encryption key on the authentication server was generated on the authentication server using the second token; and

program code for decrypting, at the client, the authentication response using the encryption key, wherein the authentication response encrypted using the encryption key allows the client to authenticate the authentication server.

14. The computer-readable medium of claim 13, further comprising

program code for encrypting a second communication using the encryption key;

and

program code for transmitting the second communication.

15. The computer-readable medium of claim 13, wherein the authentication response further comprises a verification message associated with the access point, further comprising program code for determining whether the verification message is valid.

16. The computer-readable medium of claim 15, further comprising program code for continuing communication if the verification message is valid.

17. The computer-readable medium of claim 15, further comprising program code for discontinuing communication if the verification message is not valid.

18. A non-transitory computer-readable medium on which is encoded program code, the program code comprising:

program code for transmitting a communication from a client to an authentication server, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly from the client to an access point and from the access point to an authentication server;

program code for receiving the communication at the authentication server;

program code for determining a second token associated with the user identifier on the authentication server and on the client, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

program code for generating an encryption key based at least in part on the second token on the authentication server and on the client, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

program code for generating and encrypting an encrypted authentication request using the encryption key on the client;

program code for transmitting the encrypted authentication request from the client to the authentication server;

program code for receiving the encrypted authentication request on the authentication server;

program code for decrypting the encrypted authentication request using the encryption key on the authentication server, wherein the authentication request encrypted using the encryption key allows the authentication server to authenticate the client;

program code for generating and encrypting an encrypted authentication response using the encryption key on the authentication server; and

program code for transmitting the encrypted authentication response to the client, wherein the authentication response encrypted using the encryption key allows the client to authenticate the authentication server.

19. A system comprising:

an authentication server operable to;

receive, at the authentication server, a communication from a client, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly from the client to an access point and from the access point to the authentication server;

determine a second token associated with the user identifier on the authentication server, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

generate an encryption key based at least in part on the second token on the authentication server, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

receive, at the authentication server, an authentication message from the client, wherein the authentication message was encrypted at the client using the encryption key, wherein the encryption key was generated on the client using the second token;

decrypt, at the authentication server, the authentication message using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client; and

transmit, from the authentication server, an authentication reply encrypted using the encryption key to the client, wherein the authentication reply encrypted using the encryption key allows the client to authenticate the authentication server.

20. The system of claim 19, wherein the authentication server is further operable to:

receive a second communication encrypted using the encryption key from the client; and

decrypt the second communication using the encryption key.

21. A system comprising:

a client device operable to;

transmit to an authentication server a communication, the communication associated with a credential, the credential having a user identifier and a first token, wherein the communication is sent wirelessly via a first communication channel from the client to an access point and via a second communication channel from the access point to an authentication server;

determine, at the client, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server;

;

generate, at the client, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token;

transmit an authentication message from the client to the authentication server, wherein the authentication message was encrypted using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client;

receive, at the client, from the authentication server an authentication response encrypted using the encryption key, wherein the encryption key on the authentication server was generated on the authentication server using the second token; and

decrypt, at the client, the authentication response using the encryption key, wherein the authentication response encrypted using the encryption key allows the client to authenticate the authentication server.

22. The system of claim 21, wherein the client device is further operable to:

encrypt a second communication using the encryption key; and

transmit the second communication.

23. The system of claim 21, wherein the authentication response further comprises a verification message associated with the access point.

24. The system of claim 23, wherein the client device is further operable to determine whether the verification message is valid.

25. The system of claim 23, wherein the client device is further operable to continue communication if the verification message is valid.

26. The system of claim 23, wherein the client device is further operable to discontinue communication if the verification message is not valid.