Dynamic authentication in secured wireless networks

• US 9,131,378 B2
• Filed: 11/13/2013
• Issued: 09/08/2015
• Est. Priority Date: 04/24/2006
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: Ruckus Wireless, Inc. (CommScope Holding Company, Inc.)
• Inventors: Jou, Tyan-Shu, Sheu, Ming-Jye, Yang, Bo-Chieh, Lin, Tian-Yuan, Kuo, Ted Tsei
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/078,947
• Publication Number:
  US 20140068724A1
• Time in Patent Office: 664 Days
• Field of Search: 726 2- 4, 380/255, 380/270, 380/282, 713/171
• US Class Current: 1/1
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Abstract

Systems and methods for authentication using paired dynamic secrets in secured wireless networks are provided. Each authenticated user is assigned a random secret generated so as to be unique to the user. The secret is associated with a wireless interface belonging to the user, so that no other wireless interface may use the same secret to access the network. The secret may be updated either periodically or at the request of a network administrator, and reauthentication of the wireless network may be required.

Claims

1. A method for enabling access to a secured wireless network, the method comprising:

storing information regarding a plurality of secrets in memory, wherein each secret is unique to a user authorized to access the secured wireless network;

receiving an access request from a wireless device, the access request regarding access to the secured wireless network; and

executing instructions stored in memory, wherein execution of instructions by a processor;

authenticates a requesting user of the wireless device as authorized to access the secured wireless network,

determines that the wireless device is not associated with a security key;

determines that the requesting user is associated with a secret of the plurality of secrets, wherein the stored information indicates that one or more unassociated security keys have been derived from the secret,

associates one of the security keys with the wireless device used by the requesting user; and

processes subsequent access request from the requesting user of the wireless device, wherein the wireless device is granted access to the secured wireless network based on the associated security key.

2. The method of claim 1, wherein the plurality of security keys are derived based on the unique secret associated with the requesting user.

3. The method of claim 2, further comprising generating the plurality of security keys based on the unique secret and storing the plurality of other security keys in memory.

4. The method of claim 3, further comprising receiving another authentication request from the requesting user using another wireless device and associating the other wireless device with one of the plurality of other security keys.

5. The method of claim 2, wherein the unique secret expires and further comprising re-authentication before associating a new unique secret with the wireless device.

6. The method of claim 5, wherein the new unique secret is generated periodically.

7. The method of claim 5, wherein the new unique secret is generated in response to a request by a network administrator.

8. The method of claim 5, wherein expiration includes terminating a connection to the wireless device.

9. The system of claim 5, wherein the secret generation module generates the new unique secret periodically.

10. The method of claim 1, further comprising generating an executable for the wireless device, wherein execution of the executable at the wireless device binds the unique security key with the wireless device.

11. A system for enabling access to a secured wireless network, the system comprising:

memory that stores information regarding a plurality of secrets, wherein each secret is unique to a user authorized to access the secured wireless network;

a communication interface that receives an access request from a wireless device, the access request regarding access to the secured wireless network; and

a processor that executes instructions stored in memory, wherein execution of instructions by the processor;

authenticates a requesting user of the wireless device as authorized to access the secured wireless network,

determines that the wireless device is not associated with a security key;

determines that the requesting user is associated with a secret of the plurality of secrets, wherein the stored information indicates that one or more unassociated security keys have been derived from the secret,

associates one of the security keys with the wireless device used by the requesting user; and

processes subsequent access request from the requesting user of the wireless device, wherein the wireless device is granted access to the secured wireless network based on the associated security key.

12. The system of claim 11, further comprising a binding module for associating the wireless device with the security key.

13. The system of claim 11, wherein the unique security key is derived based on the unique secret associated with the requesting user.

14. The system of claim 13, wherein the processor further executes the secret generation module to generate a plurality of other security keys based on the unique secret and storing the plurality of other security keys in memory.

15. The system of claim 14, wherein the network interface receives another authentication request from the requesting user using another wireless device and further comprising a binding associating the other wireless device with one of the plurality of other security keys.

16. The system of claim 13, wherein the unique secret expires and wherein the authentication server requires re-authentication before associating a new unique secret with the wireless device.

17. The system of claim 16, wherein the secret generation module generates the new unique secret in response to a request by a network administrator.

18. The system of claim 16, wherein expiration includes termination of a connection to the wireless device.

19. The system of claim 11, further comprising an executable generation module for generating an executable for the wireless device, wherein execution of the executable at the wireless device binds the unique security key with the wireless device.

20. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for enabling access to a secured wireless network, the method comprising:

storing information regarding a plurality of secrets in memory, wherein each secret is unique to a user authorized to access the secured wireless network;

receiving an access request from a wireless device, the access request regarding access to the secured wireless network;

authenticating a requesting user of the wireless device as authorized to access the secured wireless network;

determining that the wireless device is not associated with a security key;

determining that the requesting user is associated with a secret of the plurality of secrets, wherein the stored information indicates that one or more unassociated security keys have been derived from the secret;

associating one of the security keys with the wireless device used by the requesting user; and

processing subsequent access request from the requesting user of the wireless device, wherein the wireless device is granted access to the secured wireless network based on the associated security key.