Secure wireless local area network (WLAN) for data and control traffic

• US 8,880,869 B1
• Filed: 11/22/2010
• Issued: 11/04/2014
• Est. Priority Date: 11/22/2010
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Shah, Sandip, Pochop, Jeffrey L Jr.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): NGUYEN, TRONG H
• Application Number:
  US12/951,497
• Time in Patent Office: 1,443 Days
• Field of Search: 713150-153, 726 2- 3, 726 26- 30
• US Class Current: 713/151
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/14 Direct-mode setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A device receives capability information associated with a next hop device of a wireless local area network (WLAN). The device also determines, based on the capability information, whether the next hop device is capable of implementing security for traffic, where the security includes a media access control (MAC) security standard and a layer 2 link security standard. The device further creates, via the MAC security standard, a secure channel with the next hop device when the next hop device is capable of providing security for traffic.

Claims

1. A method comprising:

receiving, by a computing device, capability information associated with a next hop device of a wireless local area network (WLAN);

determining, by the computing device and based on the capability information, that the next hop device is capable of implementing a media access control (MAC) security standard and a layer 2 link security standard;

creating, by the computing device and via the MAC security standard, a secure channel with the next hop device after determining that the next hop device is capable of implementing the MAC security standard and the layer 2 link security standard; and

transmitting, by the computing device and after creating the secure channel, an encrypted packet to the next hop device via the secure channel.

2. The method of claim 1, where the MAC security standard includes a MACSec standard set forth in IEEE 802.1ae.

3. The method of claim 1, where the layer 2 link security standard includes a standard for exchanging encryption keys.

4. The method of claim 1, further comprising:

receiving, via the secure channel and from the next hope device, a key that is to be used for encryption;

receiving a packet; and

encrypting the packet by using the key to obtain the encrypted packet.

5. The method of claim 1, further comprising:

determining whether a packet is valid based on an integrity check;

encrypting the packet to obtain another encrypted packet when the packet is valid;

forwarding the other encrypted packet to the next hop device when the packet is valid; and

handling the packet according to a preset policy when the packet is invalid.

6. The method of claim 5, where determining whether the packet is valid based on the integrity check includes:

determining a determined integrity check value (ICV) for the packet,

determining whether the determined ICV matches an ICV included within the packet,

determining that the packet is valid when the determined ICV matches the ICV included within the packet, and

determining that the packet is invalid when the determined ICV does not match the ICV included within the packet.

7. The method of claim 5, where handling the packet according to the preset policy includes:

discarding the packet.

8. The method of claim 1, where each of the computing device and the next hop device includes one of:

an access point,

an access device provided in an access network of the WLAN,

an aggregation device provided in an aggregation network of the WLAN, or

a WLAN controller.

9. The method of claim 1,

where the secure channel includes one of:

a secure data traffic tunnel that is to be used to securely exchange data traffic between the computing device and the next hop device, or

a secure control traffic tunnel that is to be used to securely exchange control traffic between the computing device and the next hop device, and where the packet includes one of the data traffic or the control traffic.

10. A device comprising:

a memory to store a plurality of instructions; and

a processor to execute one or more of the plurality of the instructions to;

receive capability information associated with a next hop device of a wireless local area network (WLAN),

determine, based on the capability information, that the next hop device is capable of implementing a media access control (MAC) security standard and a layer 2 link security standard,

create, via the MAC security standard, a secure channel with the next hop device after determining that the next hop device is capable of implementing the MAC security standard and the layer 2 link security standard, and

transmit, to the next hop device and via the secure channel, an encrypted packet after creating the secure channel.

11. The device of claim 10, where each of the device and the next hop device includes one of:

an access point,

an access device provided in an access network of the WLAN,

an aggregation device provided in an aggregation network of the WLAN, or

a WLAN controller.

12. The device of claim 10,

where the secure channel enables the device and the next hop device to securely exchange data traffic or control traffic, and

where the packet includes one of the data traffic or the control traffic.

13. The device of claim 10, where the MAC security standard includes a MACSec standard set forth in IEEE 802.1ae.

14. The device of claim 10, where the layer 2 link security standard includes a standard for exchanging encryption keys.

15. The device of claim 10, where the processor is further to execute the one or more of the plurality of instructions to:

receive, via the secure channel, a key from the next hop device,

receive a packet, and

encrypt the packet by using the key to obtain the encrypted packet.

16. The device of claim 10, where the processor is further to execute the one or more of the plurality of instructions to:

determine whether a packet is valid based on an integrity check,

encrypt the packet to obtain another encrypted packet when the packet is valid,

forward the other encrypted packet to the next hop device when the packet is valid, and

handle the packet based on a preset policy when the packet is invalid.

17. The device of claim 16, where, when determining whether the packet is valid based on the integrity check, the processor is to:

determine a determined integrity check value (ICV) for the packet,

determine whether the determined ICV matches an ICV included within the packet,

determine that the packet is valid when the determined ICV matches the ICV included within the packet, and

determine that the packet is invalid when the determined ICV does not match the ICV included within the packet.

18. The method of claim 16, where, when handling the packet based on the preset policy, the processor is to:

discard the packet.

19. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by at least one processor, cause the at least one processor to;

receive capability information associated with a next hop device of a wireless local area network (WLAN);

determine, based on the capability information, whether the next hop device is capable of implementing a media access control (MAC) security standard and a layer 2 link security standard;

create, via the MAC security standard, a secure channel with the next hop device after determining that the next hop device is capable of implementing the MAC security standard and the layer 2 link security standard; and

transmit, to the next hop device and via the secure channel, an encrypted packet after creating the secure channel.

20. The non-transitory computer-readable medium of claim 19, where the instructions further comprise:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

receive, via the secure channel, a key from the next hop device;

receive a packet;

determine that the packet is valid based on an integrity check; and

encrypt the packet with the key to obtain the encrypted packet after determining that the packet is valid.