Wireless security system and method

• US 7,885,410 B1
• Filed: 03/31/2008
• Issued: 02/08/2011
• Est. Priority Date: 06/04/2002
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Meier, Robert, Griswold, Victor
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Abedin; Shanto M
• Application Number:
  US12/079,994
• Time in Patent Office: 1,044 Days
• Field of Search: 380/270, 455/411, 455/410, 455/432.1, 709/223, 709/229, 713/155, 713/168, 713/169, 713/170, 726/1, 726/2, 726/4, 726/5, 726/6, 726/3
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 8/20 Transfer of user or subscriber data
• CPC Class Codes: H04W 92/20 between access points

Abstract

A method for providing private sidestream transmissions between a first and second client in a wireless network generally includes sending a location discovery request from a first client to an access point and receiving a location discovery response from the access point. The response includes a ticket encrypted with a session key of the second client and containing a sidestream key. The method further includes sending a direct communication request from the first client to the second client. The request includes the ticket and an authenticator encrypted with the sidestream key. A direct communication response including an updated authenticator is received from the second client. A method and apparatus for secure context transfer during client roaming are also disclosed.

Claims

1. A method comprising:

receiving data from a roaming client at a new access point;

transmitting a registration request to an access server from the new access point for the roaming client registered with the access server and previously in communication with an old access point;

receiving a registration reply message from the access server at the new access point, the registration reply message comprising a ticket encrypted with a session key of the old access point and a context transfer key;

transmitting a context request message from the new access point to the old access point, the context request message comprising the ticket and an authenticator;

receiving a context response message from the old access point at the new access point, the context message comprising an updated authenticator and context information for the roaming client, said context information comprising state information and address bindings; and

transmitting to the client, in response to a location discovery request, a ticket encrypted with a session key of a second client and containing a sidestream key used to provide private sidestream transmissions between the clients.

2. The method of claim 1 wherein the context transfer key is encrypted with the session key of the new and old access points.

3. The method of claim 1 wherein transmitting a context request message comprises sending a deregistration request to the old access point.

4. The method of claim 3 wherein the ticket is encrypted with the new access point'"'"'s session key.

5. The method of claim 1 wherein the access server is configured to operate as a key distribution center.

6. The method of claim 1 further comprising automatically generating the context transfer key and the ticket by the access server when a client roams.

7. The method of claim 1 wherein the sidestream key is a WEP key.

8. The method of claim 1 wherein the sidestream key is an AES key.

9. The method of claim 1 further comprising decrypting the updated authenticator with the sidestream key.

10. An apparatus comprising:

a processor configured for receiving data from a roaming client at the new access point, transmitting a registration request to an access server from the new access point for the roaming client registered with the access server and previously in communication with an old access point, receiving a registration reply message from the access server at the new access point, the registration reply message containing a ticket encrypted with a session key of the old access point and a context transfer key, transmitting a context request message from the new access point to the old access point, the context request message comprising the ticket and an authenticator, and

receiving at the new access point, a context response message from the old access point the context message comprising an updated authenticator and context information comprising state information and address bindings for the roaming client; and

memory for storing said context transfer key;

wherein the processor is further configured to generate a ticket encrypted with a session key of a second client and containing a sidestream key used to provide private sidestream transmissions between the clients upon receiving a location discovery request from the roaming client.

11. The apparatus of claim 10 wherein the ticket is encrypted with the new access point'"'"'s session key.

12. The apparatus of claim 10 wherein the access server is configured to operate as a key distribution center.

13. The apparatus of claim 10 wherein the context transfer key is encrypted with the session key of the new and old access points.

14. The apparatus of claim 10 wherein the processor is configured to send a deregistration request to the old access point.

15. The apparatus of claim 10 wherein the sidestream key is a WEP key.

16. The apparatus of claim 10 wherein the sidestream key is an AES key.

17. The apparatus of claim 10 wherein the processor is configured to decrypt the updated authenticator with the sidestream key.