Authentication associated suite discovery and negotiation method

• US 8,625,801 B2
• Filed: 12/08/2009
• Issued: 01/07/2014
• Est. Priority Date: 12/09/2008
• Status: Expired due to Fees

• Current Assignee: China Iwncomm Co., Ltd
• Original Assignee: China Iwncomm Co., Ltd
• Inventors: Hu, Yanan, Cao, Jun, Xiao, Yuelei, Tie, Manxia, Huang, Zhenhai, Lai, Xiaolong
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/133,890
• Publication Number:
  US 20110243330A1
• Time in Patent Office: 1,491 Days
• Field of Search: 380/278
• US Class Current: 380/278
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

An authentication associated suite discovery and negotiation method for ultra wide band network. The method includes the following steps of: 1) adding a pairwise temporal key PTK establishment IE and a group temporal key GTK distribution IE in an information element IE list of an initiator and a responder, and setting a corresponding information element identifier ID, and 2) an authentication associated process based on the authentication associated suite discovery and negotiation method. The authentication associated suite discovery and negotiation method for ultra wide band network provided by the present invention can provide the discovery and negotiation functions of a security solution to the network so as to satisfy all kinds of application requirements better when multiple pairwise temporal key PTK establishing plans or multiple group temporal key GTK distributing plans co-exist.

Claims

1. A method for discovering and negotiating about an authentication and association suite, comprising:

dependent upon an authentication and association process in the method for discovering and negotiating about an authentication and association suite, when an initiating device and a responding device are required to discover and negotiate about an authentication and association suite, performing passive scanning in which the responding device waits for reception of information of a beacon frame transmitted from the initiating device and transmits to the initiating device a probe request frame after reception of the information of the beacon frame or active scanning in which the responding device transmits to the initiating device a probe request frame requesting for relevant information; and

during the passive scanning or the active scanning, the responding device adding, in a list of Information Elements (IEs) of a probe request frame transmitted to the initiating device, a full field of Pairwise Temporal Key (PTK) Creation mechanism IE or Group Temporal Key (GTK) Distribution mechanism IE to declare a list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

the initiating device constructing and transmitting to the responding device a probe response frame according to the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in a received probe request frame by adding, in a list of IEs of the probe response frame, a full field of PTK Creation mechanism IE or GTK Distribution mechanism IE to declare an initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK.

2. The method for discovering and negotiating about an authentication and association suite according to claim 1, wherein:

an indicator of whether to support discovery of and negotiation about a mechanism for creating a PTK and an indicator of whether to support discovery of and negotiation about a mechanism for distributing a GTK are added in the beacon frame transmitted from the initiating device; and

an indicator of whether to support a process of discovering and negotiating about an authentication and association suite is added in the probe response frame transmitted from the initiating device and the probe request frame transmitted from the responding device.

3. The method for discovering and negotiating about an authentication and association suite according to claim 2, wherein:

when it is not required to discover and negotiate about a mechanism for creating a PTK and a mechanism for distributing a GTK, or a default security mechanism is used for both of the initiating device and the responding device, the indicator of whether to support discovery of and negotiation about a mechanism for creating a PTK and the indicator of whether to support discovery of and negotiation about a mechanism for distributing a GTK, both of which are newly added in the beacon frame transmitted from the initiating device, shall be configured to indicate that discovery of and negotiation about a mechanism for creating a PTK and a mechanism for distributing a GTK is not supported, and the indicator of whether to support a process of discovering and negotiating about an authentication and association suite, which is added in the probe response frame transmitted from the initiating device and the probe request frame transmitted from the responding device, shall be configured to indicate that the process of discovering and negotiating about an authentication and association suite is not supported.

4. The method for discovering and negotiating about an authentication and association suite according to claim 2, wherein the passive scanning comprises:

1) the initiating device broadcasting relevant IEs about the initiating device in the beacon frame periodically;

2) upon reception of the beacon frame transmitted from the initiating device, the responding device determining a process of discovering and negotiating about an authentication and association suite to be performed and transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the responding device checking whether the beacon frame transmitted form the initiating device comprises all of IEs required for the authentication and association process, and when the beacon frame transmitted form the initiating device does not comprise all of IEs required for the authentication and association process, the probe request frame transmitted to the initiating device further comprising the ID of an IE requested by the responding device from the initiating device;

3) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

4) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     5); and

5) the responding device initiating a negotiated mechanism for creating or updating a PTK between Ultra Wideband (UWB) devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

5. The method for discovering and negotiating about an authentication and association suite according to claim 2, wherein the active scanning comprises:

1) when the responding device receives no beacon frame transmitted from the initiating device, then the responding device transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the probe request frame further comprises the ID of an IE requested by the responding device from the initiating device;

2) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

3) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     4); and

4) the responding device initiating a negotiated mechanism for creating or updating a PTK between UWB devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

6. The method for discovering and negotiating about an authentication and association suite according to claim 3, wherein the passive scanning comprises:

1) the initiating device broadcasting relevant IEs about the initiating device in the beacon frame periodically;

2) upon reception of the beacon frame transmitted from the initiating device, the responding device determining a process of discovering and negotiating about an authentication and association suite to be performed and transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the responding device checking whether the beacon frame transmitted form the initiating device comprises all of IEs required for the authentication and association process, and when the beacon frame transmitted form the initiating device does not comprise all of IEs required for the authentication and association process, the probe request frame transmitted to the initiating device further comprising the ID of an IE requested by the responding device from the initiating device;

3) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

4) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     5); and

5) the responding device initiating a negotiated mechanism for creating or updating a PTK between Ultra Wideband (UWB) devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB, devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

7. The method for discovering and negotiating about an authentication and association suite according to claim 3, wherein the active scanning comprises:

1) when the responding device receives no beacon frame transmitted from the initiating device, the responding device transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the probe request frame further comprises the ID of an I, requested by the responding device from the initiating device;

2) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

3) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     4); and

4) the responding device initiating a negotiated mechanism for creating or updating a PTK between UWB devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

8. The method for discovering and negotiating about an authentication and association suite according to claim 1, wherein the PTK Creation mechanism IE includes:

a field of an information element identifier (ID);

a field of the length of the PTK Creation mechanism IE;

a field of the number of PTK creation mechanisms;

fields of PTK creation mechanism 1 to PTK creation mechanism n; and

a field of a PTK creation mechanism selected for use;

wherein;

the number of PTK creation mechanisms represents the number of sending device supportable mechanisms for creating a PTK;

the fields of PTK creation mechanism 1 to PTK creation mechanism n list the IDs of respective sending device supportable mechanisms for creating a PTK; and

the field of a PTK creation mechanism selected for use represents the ID of a PTK creation mechanism selected by the sending device.

9. The method for discovering and negotiating about an authentication and association suite according to claim 8, wherein the passive scanning comprises:

1) the initiating device broadcasting relevant IEs about the initiating device in the beacon frame periodically;

2) upon reception of the beacon frame transmitted from the initiating device, the responding device determining a process of discovering and negotiating about an authentication and association suite to be performed and transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the responding device checking whether the beacon frame transmitted form the initiating device comprises all of IEs required for the authentication and association process, and when the beacon frame transmitted form the initiating device does not comprise all of IEs required for the authentication and association process, the probe request frame transmitted to the initiating device further comprising the ID of an IE requested by the responding device from the initiating device;

3) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

4) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     5); and

5) the responding device initiating a negotiated mechanism for creating or updating a PTK, between Ultra Wideband (UWB) devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

10. The method for discovering and negotiating about an authentication and association suite according to claim 8, wherein the active scanning comprises:

1) when the responding device receives no beacon frame transmitted from the initiating device, the responding device transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the probe request frame further comprises the ID of an IE requested by the responding device from the initiating device;

2) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

3) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     4); and

4) the responding device initiating a negotiated mechanism for creating or updating a PTK between UWB devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

11. The method for discovering and negotiating about an authentication and association suite according to claim 1, wherein the GTK Distribution mechanism IE includes:

a field of an information element identifier (ID);

a field of the length of the GTK Distribution mechanism IE;

a field of the number of GTK distribution mechanisms;

fields of GTK distribution mechanism 1 to GTK distribution mechanism n; and

a field of a GTK distribution mechanism selected for use;

wherein;

the number of GTK distribution mechanisms represents the number of sending device supportable mechanisms for distributing a GTK;

the fields of GTK distribution mechanism 1 to GTK distribution mechanism n list the IDs of respective sending device supportable mechanisms for distributing a GTK; and

the field of a GTK distribution mechanism selected for use represents the ID of a GTK distribution mechanism selected by the sending device.

12. The method for discovering and negotiating about an authentication and association suite according to claim 11, wherein the passive scanning comprises:

1) the initiating device broadcasting relevant IEs about the initiating device in the beacon frame periodically;

2) upon reception of the beacon frame transmitted from the initiating device, the responding device determining a process of discovering and negotiating about an authentication and association suite to be performed and transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the responding device checking whether the beacon frame transmitted form the initiating device comprises all of IEs required for the authentication and association process, and when the beacon frame transmitted form the initiating device does not comprise all of IEs required for the authentication and association process, the probe request frame transmitted to the initiating device further comprising the ID of an IE requested by the responding device from the initiating device;

3) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

4) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     5); and

5) the responding device initiating a negotiated mechanism for creating or updating a PTK between Ultra Wideband (UWB) devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

13. The method for discovering and negotiating about an authentication and association suite according to claim 11, wherein the active scanning comprises:

1) when the responding device receives no beacon frame transmitted from the initiating device, then the responding device transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the probe request frame further comprises the ID of an IE requested by the responding device from the initiating device;

2) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

3) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     4); and

4) the responding device initiating a negotiated mechanism for creating or updating a PTK between UWB devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

14. The method for discovering and negotiating about an authentication and association suite according to claim 1, wherein the passive scanning comprises:

1) the initiating device broadcasting relevant IEs about the initiating device in the beacon frame periodically;

2) upon reception of the beacon frame transmitted from the initiating device, the responding device determining a process of discovering and negotiating about an authentication and association suite to be performed and transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the responding device checking whether the beacon frame transmitted form the initiating device comprises all of IEs required for the authentication and association process, and when the beacon frame transmitted form the initiating device does not comprise all of IEs required for the authentication and association process, the probe request frame transmitted to the initiating device further comprising the ID of an IE requested by the responding device from the initiating device;

3) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

4) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     5); and

5) the responding device initiating a negotiated mechanism for creating or updating a PTK between Ultra Wideband (UWB) devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.

15. The method for discovering and negotiating about an authentication and association suite according to claim 1, wherein the active scanning comprises:

1) when the responding device receives no beacon frame transmitted from the initiating device, the responding device transmitting to the initiating device the probe request frame in which the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs to declare the list of responding device supportable mechanisms for creating a PTK or mechanisms for distributing a GTK; and

furthermore, the probe request frame further comprises the ID of an IE requested by the responding device from the initiating device;

2) upon reception of the probe request frame transmitted from the responding device, the initiating device constructing and transmitting to the responding device the probe response frame according to the ID of the IE as requested and the contents of the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE in the probe request frame, wherein the full field of PTK Creation mechanism IE or GTK Distribution mechanism IE is comprised in the list of IEs of the probe response frame to declare the initiating device selected mechanism for creating a PTK or mechanism for distributing a GTK; and

the probe response frame further comprises the IE requested by the responding device from the initiating device;

3) upon reception of the probe response frame transmitted from the initiating device, the responding device determining an authentication and association suite commonly used for both of the initiating device and the responding device and checking whether the contents of IEs other than the authentication and association suite comply with required authentication and association, and if not so, then failing to perform the authentication and association process;

otherwise, performing an operation of

     4); and

4) the responding device initiating a negotiated mechanism for creating or updating a PTK between UWB devices or mechanism for creating or updating a GTK between the UWB devices after a PTK between the UWB devices has been created successfully, and the initiating device and the responding device finishing the authentication and association process after both of them have created successfully a PTK and a GTK.