Fast re-authentication with dynamic credentials

• US 7,802,091 B2
• Filed: 08/12/2008
• Issued: 09/21/2010
• Est. Priority Date: 02/26/2003
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Halasz, David E., Zorn, Glen W.
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/189,821
• Publication Number:
  US 20080301790A1
• Time in Patent Office: 770 Days
• Field of Search: None
• US Class Current: 713/155
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

A proxy server that is inserted between a plurality of network access servers, typically an access points, and an authentication server. When an original authentication request is received by a network access server, the network access server forwards the request to the proxy server which forwards the request to an authentication server. The authentication server then sends the session information to the proxy server which stores the keying material as a dynamic credentials. When the client re-authenticates with one of the plurality of access servers, the re-authentication request is handled by the proxy server using the dynamic credentials. The proxy server may re-authenticate the client using a different method than the method that was originally used. For example, the original authentication may be by Extensible Authentication Protocol—Transport Layer Security (EAP-TLS) and subsequent re-authentications may use Wi-Fi Protected Access (WPA).

Claims

1. An apparatus, comprising:

a proxy authentication server configured to be in communication with a network access server and an authentication server;

wherein the proxy authentication server is configured to intercept a first authentication request from the network access server for a supplicant;

wherein the proxy authentication server is configured to forward the first authentication request to the authentication server responsive to determining the proxy authentication server does not have authentication data for the supplicant;

wherein the proxy authentication server is configured to intercept a response to the first authentication request from the authentication server, the response comprising authentication data for the client;

wherein the proxy authentication server is configured to store the authentication data for the supplicant and to forward the authentication data for the supplicant to the network access server;

wherein the proxy authentication server is configured to intercept a second authentication request for the supplicant from a second network access server; and

wherein the proxy authentication server is configured to authenticate the second authentication request with the stored authentication data and reply to the second network access server responsive to determining the proxy authentication server has the authentication data for the supplicant.

2. The apparatus set forth in claim 1, wherein the first authentication request employs a first authentication protocol and the second authentication request employs a second authentication protocol.

3. The apparatus set forth in claim 2, wherein the first authentication protocol is an Extensible Authentication Protocol—

Transport Layer Security (EAP-TLS) compatible protocol.

4. The apparatus set forth in claim 3, wherein the second authentication protocol is Lightweight Extensible Authentication Protocol (LEAP) compatible protocol.

5. The apparatus set forth in claim 3, wherein the second authentication protocol is a WiFi Protected Access (WPA) compatible protocol.

6. The apparatus of claim 1, wherein the proxy authentication server is configured to intercept a third authentication request for the supplicant from a third network access server;

and

wherein the proxy authentication server is configured to authenticate the third authentication request with the stored authentication data and reply to the third network access server responsive to determining the proxy authentication server has the authentication data for the supplicant.

7. The apparatus set forth in claim 1, wherein the first and second network access servers are wireless access points and the supplicant is a wireless device.

8. The apparatus set forth in claim 1, wherein the authentication data for the client comprises keying material.

9. A method, comprising:

intercepting by a proxy authentication server a first request to authenticate a supplicant from a first network access server;

determining by the proxy authentication server whether authentication credentials are available for the supplicant;

forwarding by the proxy authentication server the first request to authenticate a supplicant from to an authentication server responsive to determining authentication credentials are not available for the supplicant;

intercepting by the proxy authentication server a response to the first request to authenticate from the authentication server, the response comprising authentication data;

storing the authentication data at the proxy authentication server;

forwarding by the proxy authentication server the response to the first request to the first network access server;

intercepting by the proxy authentication server a second request to authenticate the supplicant from a second network access server;

determining by the proxy authentication server whether authentication credentials are available for the supplicant; and

authenticating by the proxy authentication server the second request to authenticate and sending a reply to the second network access server responsive to determining that authentication credentials are available for the supplicant.

10. The method according to claim 9, wherein the first authentication request employs a first authentication protocol and the second authentication request employs a second authentication protocol.

11. The method according to claim 10, wherein the first authentication protocol is an Extensible Authentication Protocol—

Transport Layer Security (EAP-TLS) compatible protocol.

12. The method according to claim 11, wherein the second authentication protocol is selected from a group consisting of a Lightweight Extensible Authentication Protocol (LEAP) compatible protocol and a WiFi Protected Access (WPA) compatible protocol.

13. The method according to claim 12, further comprising:

intercepting by the proxy authentication server a third request to authenticate the supplicant from a third network access server; and

authenticating by the proxy authentication server the third request to authenticate and sending a reply to the third network access server responsive to determining that that authentication credentials are available for the supplicant.

14. An apparatus, comprising:

a proxy authentication server configured to be in communication with a network access server and an authentication server;

wherein the proxy authentication server is configured to receive a first authentication request from the network access server for a supplicant;

wherein the proxy authentication server is configured to forward the first authentication request to the authentication server responsive to determining the proxy authentication server does not have authentication data for the supplicant;

wherein the proxy authentication server is configured to receive a response to the first authentication request from the authentication server, the response comprising authentication data for the client;

wherein the proxy authentication server is configured to store the authentication data for the supplicant and to forward the authentication data for the supplicant to the network access server;

wherein the proxy authentication server is configured to receive a second authentication request from a second network access server for the supplicant for the supplicant; and

wherein the proxy authentication server is configured to authenticate the second authentication request with the stored authentication data and reply to the second network access server responsive to determining the proxy authentication server has the authentication data for the supplicant.

15. A method, comprising:

receiving by a proxy authentication server a first request to authenticate a supplicant from a first network access server;

determining by the proxy authentication server whether authentication credentials are available for the supplicant;

forwarding by the proxy authentication server the first request to authenticate a supplicant from to an authentication server responsive to determining authentication credentials are not available for the supplicant;

receiving by the proxy authentication server a response to the first request to authenticate from the authentication server, the response comprising authentication data;

storing the authentication data at the proxy authentication server;

forwarding by the proxy authentication server the response to the first request to the first network access server;

receiving a second request by the proxy authentication server to authenticate the supplicant from a second network access server;

determining by the proxy authentication server whether authentication credentials are available for the supplicant; and

authenticating the second request to authenticate by the proxy authentication server with the stored authentication credentials and sending a reply to the second network access server responsive to determining that authentication credentials are available for the supplicant.

16. The method according to claim 15, wherein the first authentication request employs a first authentication protocol and the second authentication request employs a second authentication protocol.