Derivation method for cached keys in wireless communication system
First Claim
1. In a system having an authentication server to generate an authentication key, a plurality of access points hierarchically arranged from the authentication server that is at hierarchy level zero, and a station that communicates with the authentication server through one or more access points of the plurality of access points to communicate information over a wireless network, and wherein the plurality of access points advertise a hierarchy depth (N) for cached keys in which N is greater than one and designates a farthest level of the hierarchy, and the access points also advertise a hierarchically ordered list of identifiers for a derivation path for derived authentication keys, an apparatus comprising:
- an authenticator management module in a particular access point of the plurality of access points that generates a transient authentication key from a derived authentication key of N−
1 hierarchy level and when the particular access point lacks a hierarchy level to generate a N−
1 level derived authentication key, the particular access point is to calculate the N−
1 level derived authentication key in order to generate a transient authentication key, so that the station is operable to mutually derive the transient authentication key to establish an authenticated connection within the wireless network through the particular access point; and
a control module coupled to the authenticator management module to control the authenticator management module.
6 Assignments
0 Petitions
Accused Products
Abstract
A method and apparatus for providing improved security and improved roaming transition times in wireless networks. The same pairwise master key (PMK) from an authentication server can be used across multiple access points and a new pairwise transition key (PTK) is derived for each association of a station to any of the access points. A plurality of access points are organized in functional hierarchical levels and are operable to advertise an indicator of the PMK cache depth supported by a group of access points (N) and an ordered list of the identifiers for the derivation path. Access points in each level in the cache hierarchy compute the derived pairwise master keys (DPMKs) for devices in the next lower level in the hierarchy and then deliver the DPMKs to those devices. An access point calculates the PTK as part of the security exchange process when the station wishes to associate to the access point. The station also computes the PTK as part of the security exchange process. The station calculates all the DMPKs in the hierarchy as part of computing the PTK. The method and apparatus allow the cache depth to vary per station, but it remains constant for a given station within a key circle.
-
Citations
11 Claims
-
1. In a system having an authentication server to generate an authentication key, a plurality of access points hierarchically arranged from the authentication server that is at hierarchy level zero, and a station that communicates with the authentication server through one or more access points of the plurality of access points to communicate information over a wireless network, and wherein the plurality of access points advertise a hierarchy depth (N) for cached keys in which N is greater than one and designates a farthest level of the hierarchy, and the access points also advertise a hierarchically ordered list of identifiers for a derivation path for derived authentication keys, an apparatus comprising:
-
an authenticator management module in a particular access point of the plurality of access points that generates a transient authentication key from a derived authentication key of N−
1 hierarchy level and when the particular access point lacks a hierarchy level to generate a N−
1 level derived authentication key, the particular access point is to calculate the N−
1 level derived authentication key in order to generate a transient authentication key, so that the station is operable to mutually derive the transient authentication key to establish an authenticated connection within the wireless network through the particular access point; anda control module coupled to the authenticator management module to control the authenticator management module. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. In a system having an authentication server to generate an authentication key, a plurality of access points hierarchically arranged from the authentication server that is at hierarchy level zero, and a station that communicates with the authentication server through one or more access points of the plurality of access points to communicate information over a wireless network, and wherein the plurality of access points advertise a hierarchy depth (N) for cached keys in which N is greater than one and designates a farthest level of the hierarchy, and the access points also advertise a hierarchically ordered list of identifiers for a derivation path for derived authentication keys, a method comprising:
-
initiating an association between the station and a particular access point, thereby causing the authentication server to generate an authentication key; storing the authentication key in a controller and generating derived authentication keys therefrom; receiving the derived authentication key in a particular access point in the plurality of access points, wherein the particular access point generates a transient authentication key for use by the station from a derived authentication key of N−
1 hierarchy level and when the particular access point lacks a hierarchy level to generate a N−
1 level derived authentication key, the particular access point is to calculate the N−
1 level derived authentication key in order to generate the transient authentication key; andassociating the station with the particular access point and receiving the transient authentication key. - View Dependent Claims (9, 10, 11)
-
Specification