Wireless device and method for rekeying with reduced packet loss for high-throughput wireless communications

• US 9,231,760 B2
• Filed: 01/13/2014
• Issued: 01/05/2016
• Est. Priority Date: 12/21/2009
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Qi, Emily H., Walker, Jesse R., Stacey, Robert J., Liondas, Herbert, Jalfon, Marc
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US14/153,440
• Publication Number:
  US 20140126722A1
• Time in Patent Office: 722 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Embodiments of a wireless device and methods for rekeying with reduced packet loss in a wireless network are generally described herein. In some embodiments, during rekeying operations a new key for reception may be installed early (i.e., prior to receipt of a rekeying confirmation message). The use of the new key for transmission may be delayed until after receipt of the rekeying confirmation message. The early installation of the new key for reception may allow both the new key and old key to be active at the same time for use decrypting received packets to reduce packet loss during rekeying operations. The rekeying confirmation message may be the fourth message of a four-way handshake for rekeying. In some embodiments, two key identifiers may be alternated between four-way handshakes to prevent deletion of the old key.

Claims

1. A wireless communications device comprising:

processing circuitry, memory, and physical-layer circuitry, the wireless communications device configured to

transmit, in a rekeying initiation response message of a four-way handshake, a robust security network (RSN) information element (IE) with an extended key ID field containing a 0 or a 1 to indicate whether the device supports use of a proposed extended key ID in unicast communication;

receive, in a response validation message of the four-way handshake, a key ID key data encapsulation (KDE); and

transmit, in a rekeying confirmation message of the four-way handshake, the key ID KDE to indicate agreement to use the proposed extended key ID.

2. The wireless communications device of claim 1, wherein the memory is configured to store a plurality of unicast keys for use in encrypting and decrypting packets comprising unicast traffic.

3. The wireless communications device of claim 2, wherein the plurality of unicast keys includes a key derived from a previous four-way handshake.

4. The wireless communications device of claim 1, wherein the four-way handshake comprises an Extensible Authentication Protocol over Local area network (EAPOL) key frame.

5. The wireless communications device of claim 1, wherein the device further comprises at least two antennas.

6. A method of wireless communication, comprising:

Transmitting by a wireless communication device, in a rekeying initiation response message of a four-way handshake, a robust security network (RSN) information element (IE) with an extended key ID field containing a 0 or a 1 to indicate whether the device supports use of a proposed extended key ID in unicast communication;

receiving, in a response validation message of the four-way handshake, a key ID key data encapsulation (KDE); and

transmitting, in a rekeying confirmation message of the four-way handshake, the key ID KDE to indicate agreement to use the proposed extended key ID.

7. The method of claim 6, further comprising storing a plurality of unicast keys for use in encrypting and decrypting packets comprising unicast traffic.

8. The method of claim 7, wherein the plurality of unicast keys includes a key derived from a previous four-way handshake.

9. The method of claim 6, wherein the four-way handshake comprises an Extensible Authentication Protocol over Local area network (EAPOL) key frame.

10. A first wireless communications device comprising:

processing circuitry, memory, and physical-layer circuitry, the wireless communications device configured to

receive from a second wireless communications device, in a rekeying initiation response message of a four-way handshake, a robust security network (RSN) information element (IE) with an extended key ID field containing a 0 or a 1 to indicate whether the second device supports use of a proposed extended key ID in unicast communication;

transmit to the second wireless communications device, in a response validation message of the four-way handshake, a key ID key data encapsulation (KDE); and

receive from the second wireless communications device, in a rekeying confirmation message of the four-way handshake, the key ID KDE to indicate agreement to use the proposed extended key ID.

11. The first wireless communications device of claim 10, wherein the memory is configured to store a plurality of unicast keys for use in encrypting and decrypting packets comprising unicast traffic.

12. The first wireless communications device of claim 11, wherein the plurality of unicast keys includes a key derived from a previous four-way handshake.

13. The first wireless communications device of claim 10, wherein the four-way handshake comprises an Extensible Authentication Protocol over Local area network (EAPOL) key frame.

14. The first wireless communications device of claim 10, further comprising at least two antennas.

15. A method of wireless communication, comprising:

receiving from a wireless communication device, in a rekeying initiation response message of a four-way handshake, a robust security network (RSN) information element (IE) with an extended key ID field containing a 0 or a 1 to indicate whether the device supports use of a proposed extended key ID in unicast communication;

transmitting, in a response validation message of the four-way handshake, a key ID key data encapsulation (KDE); and

receiving, in a rekeying confirmation message of the four-way handshake, the key ID KDE to indicate agreement to use the proposed extended key ID.

16. The method of claim 15, further comprising storing a plurality of unicast keys for use in encrypting and decrypting packets comprising unicast traffic.

17. The method of claim 16, wherein the plurality of unicast keys includes a key derived from a previous four-way handshake.

18. The method of claim 15, wherein the four-way handshake comprises an Extensible Authentication Protocol over Local area network (EAPOL) key frame.