Method and system for providing multiple encryption in a multi-band multi-protocol hybrid wired/wireless network

• US 8,942,375 B2
• Filed: 09/09/2003
• Issued: 01/27/2015
• Est. Priority Date: 09/17/2002
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Ed H., Martin, Richard
• Primary Examiner(s): Gelagay, Shewaye
• Assistant Examiner(s): Johnson, Carlton
• Application Number:
  US10/658,310
• Publication Number:
  US 20040053601A1
• Time in Patent Office: 4,158 Days
• Field of Search: 380/270, 726/4, 726/15
• US Class Current: 380/33
• CPC Class Codes: H04L 1/1607 Details of the supervisory signal
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2872 Termination of subscriber connections
• CPC Class Codes: H04L 12/2874 Processing of data for distribution to the subscribers
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/15 in relation to multipoint traffic arrangements for broadcast or multicast in data networks H04L12/18
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/767 after changing the attachment point, e.g. after hand-off
• CPC Class Codes: H04L 47/785 among multiple network domains, e.g. multilateral agreements
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 47/824 Applicable to portable or mobile terminals
• CPC Class Codes: H04L 47/825 Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/14 : Multichannel or multilink protocols
• CPC Class Codes: H04L 69/18 : Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/324 : in the data link layer [OSI layer 2], e.g. HDLC
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 : Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 16/16 : for PBS [Private Base Station] arrangements
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/00 : Wireless network protocols or protocol adaptations to wireless operation
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 : Access point devices

Abstract

Multiple encryption in a multi-band multi-protocol hybrid wired/wireless network may include receiving on a first PHY channel of an access point, a request for initiation of a communication session from an originating access device. The received request may be acknowledged on the first PHY channel and the originating access device may be authenticated on a second PHY channel. One or more encryption/decryption keys may be provided for use during the communication session. A third PHY channel or the first or second PHY channels may host the communication session. The authentication information may be requested and delivered to the originating access device via a second PHY channel. The encryption key may be delivered to the originating access device via the first PHY channel or the second PHY channel. Additionally, information may be tunneled over a virtual channel established between the originating and a terminating access device.

Claims

1. A method for multiple encryption in a multi-band multi-protocol hybrid wired/wireless network, the method comprising:

receiving on a first PHY channel of an access point, a request for initiation of a communication session from an originating access device;

authenticating said communication session by authenticating said originating access device using a second PHY channel; and

hosting said communication session over a third PHY channel, said third PHY channel established between said access point and said originating access device.

2. The method according to claim 1, comprising generating at least one encryption/decryption key for use during said communication session.

3. The method according to claim 2, wherein said authenticating comprises requesting authentication information from an authentication server.

4. The method according to claim 3, wherein said authenticating comprises delivering at least a portion of said authentication information received from said authentication server to said originating access device via said second PHY channel.

5. The method according to claim 4, comprising delivering said at least one encryption/decryption key to said originating access device via one of said first PHY channel or said second PHY channel.

6. The method according to claim 1, comprising receiving an identification of said originating access device by said access point.

7. The method according to claim 6, wherein said identity of said originating access device is one or more of a WEP key, a MAC address, and/or an IP address.

8. The method according to claim 1, comprising acknowledging said received request on said first PHY channel.

9. The method according to claim 1, comprising determining a type of traffic generated by said originating access device on said first PHY channel.

10. The method according to claim 9, comprising generating at least one encryption/decryption key dependent on said determined traffic type.

11. The method according to claim 10, comprising distributing said generated at least one encryption/decryption key via one or both of said second PHY channel and/or said third PHY channel.

12. The method according to claim 1, comprising establishing at least one virtual channel between said originating access device and a terminating access device.

13. The method according to claim 12, comprises tunneling information between said originating access device and said terminating access device.

14. The method according to claim 12, comprising establishing at least a portion of said at least one virtual channel over at least a portion of one of said first PHY channel, said second PHY channel or said third PHY channel.

15. A non-transitory machine-readable storage, having stored thereon, a computer program having at least one code section for providing multiple encryption in a multi-band multi-protocol hybrid wired/wireless network, the at least one code section executable by a machine for causing the machine to perform the steps comprising:

receiving on a first PHY channel of an access point, a request for initiation of a communication session from an originating access device;

authenticating said communication session by authenticating said originating access device using a second PHY channel; and

hosting said communication session over a third PHY channel, said third PHY channel established between said access point and said originating access device.

16. The non-transitory machine-readable storage according to claim 15, comprising code for generating at least one encryption/decryption key for use during said communication session.

17. The non-transitory machine-readable storage according to claim 16, wherein authenticating code comprises code for requesting authentication information from an authentication server.

18. The non-transitory machine-readable storage according to claim 17, comprising code for delivering at least a portion of said authentication information received from said authentication server to said originating access device via said second PHY channel.

19. The non-transitory machine-readable storage according to claim 18, comprising code for delivering said at least one encryption/decryption key to said originating access device via one of said first PHY channel or said second PHY channel.

20. The non-transitory machine-readable storage according to claim 15, comprising code for receiving an identification of said originating access device by said access point.

21. The non-transitory machine-readable storage according to claim 20, wherein said identity of said originating access device is one or more of a WEP key, a MAC address, and/or an IP address.

22. The non-transitory machine-readable storage according to claim 15, comprising code for acknowledging said received request on said first PHY channel.

23. The non-transitory machine-readable storage according to claim 15, comprising code for determining a type of traffic generated by said originating device on said first PHY channel.

24. The non-transitory machine-readable storage according to claim 23, comprising code for generating at least one encryption/decryption key dependent on said determined traffic type.

25. The non-transitory machine-readable storage according to claim 24, comprising code for distributing said generated at least one encryption/decryption key via one or both of said second PHY channel and/or said third PHY channel.

26. The non-transitory machine-readable storage according to claim 15, comprising code for establishing at least one virtual channel between said originating access device and a terminating access device.

27. The non-transitory machine-readable storage according to claim 26, comprises code for tunneling information between said originating access device and said terminating access device.

28. The non-transitory machine-readable storage according to claim 26, comprising code for establishing at least a portion of said at least one virtual channel over at least a portion of one of said first PHY channel, said second PHY channel or said third PHY channel.

29. A system for multiple encryption in a multi-band multi-protocol hybrid wired/wireless network, the system comprising:

at least one receiver of an access point adapted to receive on a first PHY channel, a request for initiation of a communication session from an originating access device;

at least one authenticator adapted to authenticate said communication session by authenticating said originating access device using a second PHY channel; and

a third PHY channel being adapted to facilitate hosting of said communication session, said third PHY channel established between said access point and said originating access device.

30. The system according to claim 29, wherein said at least one authenticator is adapted to generate at least one encryption/decryption key for use during said communication session.

31. The system according to claim 30, wherein said at least one authenticator is adapted to receive requests for authentication information.

32. The system according to claim 31, wherein said authenticator is adapted to deliver at least a portion of said authentication information received from said authentication server to said originating access device via said second PHY channel.

33. The system according to claim 32, wherein said at least one authenticator is adapted to deliver said at least one encryption/decryption key to said originating access device via one of said first PHY channel or said second PHY channel.

34. The system according to claim 29, wherein said at least one receiver is adapted to receive an identification of said originating access device by said access point.

35. The system according to claim 34, wherein said identity of said originating access device is one or more of a WEP key, a MAC address, and/or an IP address.

36. The system according to claim 29, wherein said at least one receiver is adapted to acknowledge said received request on said first PHY channel.

37. The system according to claim 29, wherein said at least one authenticator is adapted to determine a type of traffic generated by said originating access device on said first PHY channel.

38. The system according to claim 37, wherein said at least one authenticator is adapted to generate at least one encryption/decryption key dependent on said determined traffic type.

39. The system according to claim 38, wherein said at least one authenticator is adapted to distribute said generated at least one encryption/decryption key via one or both of said second PHY channel and/or said third PHY channel.

40. The system according to claim 29, wherein said at least one receiver is adapted to establish at least one virtual channel between said originating access device and a terminating access device.

41. The system according to claim 40, wherein said at least one receiver is adapted to tunnel information between said originating access device and said terminating access device.

42. The system according to claim 40, wherein said at least one receiver is adapted to establish at least a portion of said at least one virtual channel over at least a portion of one of said first PHY channel, said second PHY channel or said third PHY channel.