Method and apparatus for communicating credential information within a network device authentication conversation

• US 7,793,336 B2
• Filed: 01/09/2007
• Issued: 09/07/2010
• Est. Priority Date: 05/29/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gossman, William, Salowey, Joseph
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/651,742
• Publication Number:
  US 20070180229A1
• Time in Patent Office: 1,337 Days
• Field of Search: 726 1- 5, 726/10, 713/168, 713/175, 713155-156, 713/176, 713/170
• US Class Current: 726/2
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method is disclosed for communicating a security credential within a network device authentication conversation. An authenticator that is coupled to a supplicant through a network performs a first message conversation resulting in creating a security context that is known to the authenticator and the supplicant. A second message conversation is initiated. The second message conversation is cryptographically protected using the same security context. A security credential is provided to the supplicant in the second message conversation. The second message conversation and first message conversation are then concluded. Specific embodiments can bootstrap digital certificates, public/private key pairs, and other credentials to supplicants, in-band, within an EAP-SIM or EAP-AKA conversation and without initiating a new session or exchanging special-purpose keys to protect distribution of the credentials.

Claims

1. An apparatus for communicating a security credential within a network device authentication conversation, comprising:

a network interface that is configured to be coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

performing, at an authenticator that is communicatively coupled to a supplicant through a network, a first message conversation resulting in creating a security context that is known to the authenticator and the supplicant;

initiating a second message conversation between the authenticator and the supplicant, wherein the second message conversation is cryptographically protected using the same security context that was created in the first message conversation;

providing a security credential to the supplicant in the second message conversation; and

concluding the second message conversation and the first message conversation.

2. An apparatus as recited in claim 1 wherein the first message conversation is an extensible authentication protocol (EAP) authentication conversation.

3. An apparatus as recited in claim 1, wherein the first message conversation is an EAP-SIM conversation.

4. An apparatus as recited in claim 1, wherein the security credential is a root digital certificate of an authentication server associated with the authenticator.

5. An apparatus as recited in claim 1, wherein the security credential is a public/private key pair for the supplicant.

6. An apparatus as recited in claim 1, wherein the security credential is a digital certificate that is requested for the supplicant from a third party.

7. An apparatus as recited in claim 1, wherein the security credential is provided to the supplicant in an EAP-Response message, wherein the EAP-Response message includes the security credential, and a message authentication code attribute containing a message authentication code that is generated based on the security credential.

8. An apparatus as recited in claim 1, wherein the supplicant further performs the computer-implemented steps of:

sending an EAP response message that requests a digital certificate from an authentication server associated with the authenticator;

receiving an EAP response message that contains a digital certificate and a message authentication code based on the digital certificate;

verifying the message authentication code with respect to the digital certificate;

when verification is successful, sending an EAP response message that indicates successful verification.

9. An apparatus as recited in claim 1, wherein the security credential is provided in a protected type-length-value (TLV) attribute of an EAP response message.

10. An apparatus as recited in claim 1, wherein the second message conversation is initiated by the supplicant using a generic EAP-method, wherein the second message conversation further comprises issuing a query to the supplicant about whether a certificate or a key pair is requested, and wherein the second message conversation further comprises providing either a certificate or a key pair to the supplicant based on a response to the query.

11. An apparatus for communicating a security credential within a network device authentication conversation, comprising:

a processor;

means for performing, at an authenticator that is configured to be communicatively coupled to a supplicant through a network, a first message conversation resulting in creating a security context that is known to the authenticator and the supplicant;

means for initiating a second message conversation between the authenticator and the supplicant, wherein the second message conversation is cryptographically protected using the same security context that was created in the first message conversation;

means for providing a security credential to the supplicant in the second message conversation; and

means for concluding the second message conversation and the first message conversation.

12. An apparatus as recited in claim 11 wherein the first message conversation is an extensible authentication protocol (EAP) authentication conversation.

13. An apparatus as recited in claim 11, wherein the first message conversation is an EAP-AKA conversation.

14. An apparatus as recited in claim 11, wherein the security credential is a root digital certificate of an authentication server associated with the authenticator.

15. An apparatus as recited in claim 11, wherein the security credential is a public/private key pair for the supplicant.

16. An apparatus as recited in claim 11, wherein the security credential is a digital certificate that is requested for the supplicant from a third party.

17. An apparatus as recited in claim 11, wherein the security credential is provided to the supplicant in an EAP-Response message, wherein the EAP-Response message includes the security credential, and a message authentication code attribute containing a message authentication code that is generated based on the security credential.

18. An apparatus as recited in claim 11, wherein the supplicant further comprises:

means for sending an EAP response message that requests a digital certificate from an authentication server associated with the authenticator;

means for receiving an EAP response message that contains a digital certificate and a message authentication code based on the digital certificate;

means for verifying the message authentication code with respect to the digital certificate;

means for sending, when verification is successful, an EAP response message that indicates successful verification.

19. An apparatus as recited in claim 11, wherein the security credential is provided in a protected type-length-value (TLV) attribute of an EAP response message.

20. An apparatus as recited in claim 11, wherein the second message conversation is initiated by the supplicant using a generic EAP-method, wherein the second message conversation further comprises issuing a query to the supplicant about whether a certificate or a key pair is requested, and wherein the second message conversation further comprises providing either a certificate or a key pair to the supplicant based on a response to the query.