Method and system of secured direct link set-up (DLS) for wireless networks

• US 9,380,457 B2
• Filed: 06/21/2011
• Issued: 06/28/2016
• Est. Priority Date: 11/03/2005
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Walker, Jesse, Ovadia, Shlomo, Sharma, Suman
• Primary Examiner(s): Hsu, Alpus H
• Assistant Examiner(s): Houshmand, Hooman
• Application Number:
  US13/164,989
• Publication Number:
  US 20110258448A1
• Time in Patent Office: 1,834 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 76/14 Direct-mode setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Method and system of secured direct link set-up (DLS) for wireless networks. In accordance with aspects of the method, techniques are disclosed for setting up computationally secure direct links between stations in a wireless network in a manner that is computationally secure.

Claims

1. A method, comprising:

setting up a robust security network association (RSNA) by an access point (AP) in a network with a first station (STA) and a second STA

receiving a direct link setup (DLS) request from the first STA, wherein the DLS request comprises a media access control (MAC) address of the second STA, a MAC address of the first STA, and capability information of the first STA;

receiving a DLS response from the second STA, wherein the DLS response comprises MAC address of the second STA, the MAC address of the first STA, and capability information of the second STA;

receiving a message from the first STA to deploy security measures between the first STA and the second STA;

generating a symmetric session key;

generating a key name identifier for the symmetric session key based on a hash of a first random number from the first STA, a second random number from the second STA, the MAC address of the first STA, and the MAC address of the second STA;

performing a 4-way handshake between the first STA and the second STA using the symmetric session key as a pairwise master key (PMK); and

transmitting a first security string to the first STA and a second security string to the second STA from the AP, the first and second security strings comprising the symmetric session key and the key name identifier, wherein a pairwise DLS transient key (PDTK) is derived from the PMK during the 4-way handshake by the first STA to provide a secure station-to-station link between the first STA and the second STA.

2. The method of claim 1, wherein the RSNA defines security features comprising an enhanced authentication mechanism for the STAs, a key management algorithm, and cryptographic key establishment.

3. The method of claim 1, wherein data is not sent between the first STA and the second STA until the secure station-to-station link is established using a 4-Way Handshake.

4. The method of claim 1, wherein the message comprises the first random number from the first STA, the second random number from the second STA, and a MAC address of the first STA.

5. The method of claim 1, wherein the PDTK is further derived at the second STA.

6. The method of claim 1, wherein the PDTK comprises the MAC address of the first STA and the MAC address of the second STA.

7. A method, comprising:

receiving, by a first station (STA), a request from an access point (AP) to setup up a robust security network association (RSNA) with a second STA in a network;

sending a station-to-station direct link setup (DLS) request to the AP, wherein the DLS request comprises a media access control (MAC) address of the second STA, a MAC address of the first STA, and capability information of the first STA;

receiving a DLS response from the AP, wherein the DLS response comprises the MAC address of the second STA, the MAC address of the first STA, and capability information of the second STA;

receiving a security string, by the first STA from the AP, after initiating a request to deploy security measures between the first STA and the second STA for a station-to-station link, the security string comprising a symmetric session key and a key name identifier for the symmetric session key, the key name identifier comprising a hash of a first random number from the first STA, a second random number from the second STA, the MAC address of the first STA, and the MAC address of the second STA; and

initiating a 4-Way Handshake between the first STA and the second STA using the symmetric session key as a pairwise master key (PMK), wherein a pairwise DLS transient key (PDTK) is derived from the PMK by the first STA to implement a secure station-to-station link.

8. The method of claim 7, wherein the RSNA defines security features comprising an enhanced authentication mechanism, a key management algorithm, and cryptographic key establishment.

9. The method of claim 7, wherein data is not sent between the first STA and the second STA until the security measures are established using the 4-Way Handshake.

10. The method of claim 7, wherein the network is a wireless local area network.

11. The method of claim 7, wherein the symmetric session key and the PDTK are established to secure the DLS.

12. The method of claim 11, wherein the 4-Way Handshake cannot be performed without first establishing the RSNA.

13. An access point (AP), comprising:

a radio frequency (RF) interface to transmit and receive RF signals corresponding to a wireless communications protocol;

a processor coupled to the RF interface; and

logic executed by the processor to perform operations including;

setting up a robust security network association (RSNA) in a network with a first station (STA) and a second STA

receiving a direct link setup (DLS) request from the first STA to provide a station-to-station link between the first STA and the second STA;

receiving a DLS response from the second STA in response to the DLS request made by the first STA;

receiving a message from the first STA to deploy security measures between the first STA and the second STA

generating a symmetric session key;

generating a key name identifier for the symmetric session key based on a hash of a first random number from the first STA, a second random number from the second STA, a MAC address of the first STA, and a MAC address of the second STA;

performing a 4-way handshake between the first STA and the second STA using the symmetric session key as a pairwise master key (PMK); and

transmitting a first security string to the first STA and a second security string to the second STA from the AP, the first and second security strings comprising the symmetric session key and the key name identifier, wherein a pairwise DLS transient key (PDTK) is derived from the PMK to provide a secure station-to-station link between the first STA and the second STA.

14. The AP of claim 13, wherein the logic is configured to perform operations to define security features comprising an enhanced authentication mechanism for the STAs, a key management algorithm, and cryptographic key establishment.

15. The AP of claim 13, wherein the logic is configured to not send data between the first STA and the second STA until the secure station-to-station link is established.

16. The AP of claim 13, wherein the PDTK is derived at the first STA and the second STA using the 4-Way Handshake.

17. The AP of claim 13, wherein the DLS request comprises the MAC address of the second STA, the MAC address of the first STA, and capability information of the first STA.

18. A first station (STA) configured to:

receive a request from an access point (AP) to setup up a robust security network association (RSNA) with a second STA in a network,

send a direct link setup (DLS) request to the AP, wherein the DLS request comprises a media access control (MAC) address of the second STA, a MAC address of the first STA, and capability information of the first STA,

receive a DLS response from the AP, wherein the DLS response comprises the MAC address of the second STA, the MAC address of the first STA, and capability information of the second STA,

receive a security string from the AP by the first STA after initiating a request to deploy security measures between the first STA and the second STA, the security string comprising a symmetric session key and a key name identifier for the symmetric session key, the key name identifier comprising a hash of a first random number from the first STA, a second random number from the second STA, the MAC address of the first STA, and the MAC address of the second STA, and

initiate a 4-Way Handshake between the first STA and the second STA using the symmetric session key as a pairwise master key (PMK), wherein a pairwise DLS transient key (PDTK) is derived from the PMK by the first STA for the 4-Way Handshake.

19. The first STA of claim 18, wherein the symmetric session key and the PDTK are established to secure the DLS.

20. The first STA of claim 18, wherein the 4-Way Handshake cannot be performed without first establishing the RSNA.