Remote secure authorization

• US 7,827,409 B2
• Filed: 12/02/2004
• Issued: 11/02/2010
• Est. Priority Date: 10/07/2003
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): TABOR, AMARE F
• Application Number:
  US11/001,084
• Publication Number:
  US 20050102509A1
• Time in Patent Office: 2,161 Days
• Field of Search: 713/165, 713/171, 380/284
• US Class Current: 713/171
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

The present invention discloses a technique provisioning network cryptographic keys to a client when direct physical transfer is not feasible. In an embodiment of the invention, a client token generates a temporary key encrypted with a first secret key known only in a master token database and passes this on to an enterprise network token of a network to which service is requested. The enterprise network token then further encrypts the encrypted temporary key with a second secret key and passes that on to the master token database. Since the second secret key is also known by the master token database, the originally encrypted temporary key can be securely decoded only by a master token coupled to the master token database. The decrypted temporary key can then be re-encrypted with a key known only by the enterprise network token and the master token, and returned to the enterprise network token. This allows the enterprise network token to gain secure access to the temporary key of the client token, thereby allowing the enterprise network token to securely provision the remote client token with the appropriate enterprise Network Keys.

Claims

1. A method of distributing at least one network cryptographic key to a client attempting to access a network via an edge device of said network, the method comprising the steps of:

receiving first information from a client,

encrypting said first information with a network secret cryptographic key to generate a first cipher, said network secret cryptographic key being known to an edge device of a network and an authentication server but not to said client,

sending said first cipher and a network identifier associated with said edge device of said network to said authentication server,

receiving a second cipher from said authentication server,

decrypting said second cipher with said network secret cryptographic key to obtain a client cryptographic key,

encrypting at least one network cryptographic key with said client cryptographic key to generate a third cipher, and

forwarding said third cipher to said client.

2. The method of claim 1, wherein said first information comprises a fourth cipher and a client identifier associated with said client, said fourth cipher including said client cryptographic key encrypted using a cryptographic key known only to said client and said authentication server.

3. The method of claim 2, wherein said client identifier is a first unique serial number corresponding to a first individual token associated with said client and said network identifier is a second unique serial number corresponding to a second individual token associated with said edge device.

4. The method of claim 3, wherein said cryptographic key is known only to said client and resides in said token associated with said client.

5. The method of claim 2, wherein said authentication server performs the steps of:

identifying said network secret cryptographic key associated with said network identifier,

decrypting said first cipher using network secret cryptographic key to obtain said first information,

identifying said cryptographic key known only to said client and said authentication server using said client identifier,

decrypting said fourth cipher using said cryptographic key known only to said client and said authentication server to obtain said client cryptographic key, and

encrypting said client cryptographic key using said network cryptographic key to generate said second cipher.

6. The method of claim 2, wherein said client performs the steps of:

generating said client cryptographic key,

encrypting said client cryptographic key using said cryptographic key known only to said client and said authentication server to generate said fourth cipher, and

decrypting said third cipher using said client cryptographic key to obtain said at least one network cryptographic key.

7. The method of claim 6, wherein said client cryptographic key is a random number.

8. The method of claim 1, wherein said edge device is an access point and said network is a 802.11x network.

9. A method of authenticating a client attempting to access a network via an edge device of said network, said method comprising the steps of:

receiving information from an edge device of a network, said information comprising a network identifier associated with said edge device of said network and a first cipher,

identifying a network secret cryptographic key associated with said network identifier, the network secret cryptographic key being known to said edge device and an authentication server but not to said client,

decrypting said first cipher using said network secret cryptographic key to obtain a second cipher and a client identifier associated with said client,

determining whether a match exists between said client identifier and at least one of a number of stored identifiers, and if a match does exist,

identifying a cryptographic key known only to said client and said authentication server corresponding to said client identifier,

decrypting said second cipher using said cryptographic key known only to said client and said authentication server to obtain a client cryptographic key,

encrypting said client cryptographic key using said network secret cryptographic key to generate a third cipher, and

forwarding said third cipher to said edge device of said network.

10. The method of claim 9, wherein said edge device of said network performs the steps of:

decrypting said third cipher with said network secret cryptographic key to obtain said client cryptographic key,

encrypting at least one network cryptographic key with said client cryptographic key to generate a fourth cipher, and

forwarding said fourth cipher to said client.

11. The method of claim 9, wherein said client identifier is a unique serial number corresponding to a token associated with said client.