Scheme for authentication and dynamic key exchange

• US 20030014646A1
• Filed: 07/03/2002
• Published: 01/16/2003
• Est. Priority Date: 07/05/2001
• Status: Active Grant

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Buddhikot, Milind M., Miller, Scott C., Salgarelli, Luca
• Granted Patent: US 7,231,521 B2
• Time in Patent Office: Days
• US Class Current: 713/184
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A scheme for authentication, dynamic key generation and exchange provides means for authentication of mobile nodes (22) and generation of per session, per node, encryption keys for encrypting/decrypting communications between a mobile node (22) and an access point (24) in wireless local area networks (50). The scheme utilizes the same infrastructure and authentication information for both data link layers (layer 2) and network layers (layer 3). This scheme is particularly applicable to networks adhering to the IEEE 802 LAN family of standards.

Claims

1. A method for generating a security key for a mobile node, said method comprising the steps of:

generating an authenticator as a function of a first random number; and

generating said security key for said mobile node as a function of a second random number indicative of a validity of said authenticator.

2. A method in accordance with claim 1, further comprising the step of:

receiving a signal indicative of said first random number;

receiving a signal indicative of said second random number; and

providing a signal indicative of said authenticator;

3. A method in accordance with claim 1, wherein said authenticator is generated further as a function of a network access identifier for said mobile node and a predetermined security key.

4. A method in accordance with claim 3, said second random number being indicative of a match between said authenticator and a second authenticator, wherein:

said second authenticator is a function of a provided version of said first random number, a provided version of said network access identifier, and said predetermined security key.

5. A method in accordance claim 1, further comprising the steps of:

receiving a signal indicative of a request for identification; and

providing a signal indicative of a network access identifier for said mobile node in response to said request for identification.

6. A method in accordance claim 1, wherein said security key is configured to encrypt and decrypt communications with said mobile node for a current session.

7. A method for generating a security key for an access point, said method comprising the steps of:

generating a first random number;

providing a signal indicative of said first random number;

receiving a signal indicative of an authenticator being a function of said first random number;

providing a signal indicative of said authenticator and said first random number;

receiving a signal indicative of a second random number and said security key, wherein;

said second random number is indicative of a validity of said authenticator; and

said security key is a function of said second random number; and

providing a signal indicative of said second random number.

8. A method in accordance with claim 7, further comprising the steps of:

providing a signal indicative of a request for identification; and

receiving a signal indicative of a network access identifier in response to said request for identification.

9. A method in accordance with claim 7, wherein said security key is an encryption key configured to encrypt and decrypt communications with said access point for a current session.

10. A method in accordance claim 7, wherein said authenticator is a function of said first random number, a network access identifier, and a predetermined security key.

11. A method in accordance claim 8, said second random number being indicative of a match between said authenticator and a second authenticator, wherein:

said second authenticator is a function of a provided version of said first random number, a provided version of said network access identifier, and said predetermined security key.

13. A method in accordance with claim 12, wherein said first authenticator is a function of said first random number, said network access identifier, and said predetermined security key.

15. A method in accordance with claim 14, further comprising the steps of:

receiving, at said mobile node, a signal indicative of a request for identification; and

conveying a signal indicative of said mobile node network access identifier from said mobile to said network in response to said request for identification.

19. A system in accordance with claim 17, wherein:

said mobile node further comprises;

a mobile node memory portion configured to store;

a mobile node network access identifier, and

a predetermined security key;

a mobile node identification processor configured to provide said mobile node network access identifier in response to a request for identification; and

said network further comprises;

a network identification processor configured to;

generate said request for identification; and

acknowledge a response to said request for identification;

a network random number generator configured to generate said first and second random numbers; and

a network memory portion configured to store;

said mobile node network access identifier, and

said predetermined security key.

12. A method for generating a security key for a network, said method comprising the steps of:

receiving a signal indicative of a first authenticator, a first random number, and a network access identifier;

generating a second authenticator as a function of said first random number and said network access identifier as obtained from said signal, and a predetermined security key;

comparing said first authenticator with said second authenticator; and

if said first authenticator matches said second authenticator,

generating a second random number;

generating said security key as a function of said second random number, said network access identifier as obtained from said signal, and said predetermined security key; and

providing a signal indicative of said second random number and said predetermined security key.

14. A method for authenticating a mobile node and establishing a data link layer security association between said mobile node and a network, said method comprising the steps of:

generating a first random number;

conveying a signal indicative of said first random number from said network to said mobile node;

generating a first authenticator as a function of said first random number, a mobile node network access identifier, and a predetermined security key;

conveying a signal indicative of said first authenticator from said mobile node to said network;

generating a second authenticator as a function of said first random number, said mobile node network access identifier, and said predetermined security key;

comparing said first authenticator with said second authenticator;

if said first authenticator matches said second authenticator,

generating a second random number;

generating a security key at said network, wherein;

said security key is generated as a function of said second random number, said network access identifier, and said predetermined security key; and

said security key is configured to encrypt and decrypt communications between said mobile node and said network for a current session;

conveying a signal indicative of said second random number from said network to said mobile node; and

generating said security key at said mobile node.

16. A mobile node for generating a security key, said mobile node comprising:

a mobile node transmitter/receiver portion configured to;

receive at least one signal indicative of at least one of a first random number and a second random number; and

provide a signal indicative of a first authenticator;

a mobile node authenticator processor configured to generate said first authenticator as a function of said first random number, a network access identifier for said mobile node, and a predetermined security key; and

a mobile node key generator configured to generate said security key as a function of said second random number, said network access identifier, and said predetermined security key.

17. A network for generating a security key, said network comprising:

a network transmitter/receiver portion configured to;

receive a signal indicative of a first authenticator being a function of a first random number, a network access identifier, and a predetermined security key, and

provide at least one signal respectively indicative of at least one of said first random number and a second random number;

a network authenticator processor configured to;

generate a second authenticator as a function of said first random number, said network access identifier, and said predetermined security key; and

compare said first authenticator with said second authenticator; and

a network key generator configured to generate said security key as a function of said second random number, said network access identifier, and said predetermined security key for a current session.

18. A system for authenticating a mobile node and establishing a data link layer security association between said mobile node and a network, said system comprising:

a mobile node comprising;

a mobile node transmitter/receiver portion configured to;

receive at least one signal indicative of at least one of a first random number and a second random number; and

provide a signal indicative of a first authenticator;

a mobile node authenticator processor configured to generate said first authenticator as a function of said first random number; and

a mobile node key generator configured to generate a security key as a function of said second random number; and

a network comprising;

a network transmitter/receiver portion configured to;

receive a signal indicative of said first authenticator, and

provide at least one signal respectively indicative of at least one of said first random number and said second random number;

a network authenticator processor configured to;

generate a second authenticator as a function of said first random number; and

compare said first authenticator with said second authenticator; and

a network key generator configured to generate said security key as a function of said second random number for a current session.

20. A computer readable medium encoded with a computer program code for directing a processor to generate a security key for a mobile node, said program code comprising:

a first code segment for causing said processor to receive a signal indicative of a first random number;

a second code segment for causing said processor to generate an authenticator as a function of said first random number;

a third code segment for causing said processor to provide a signal indicative of said authenticator;

a fourth code segment for causing said processor to receive a signal indicative of a second random number indicative of a validity of said authenticator; and

a fifth code segment for causing said processor to generate said security key for said mobile node as a function of said second random number.

21. A computer readable medium encoded with a computer program code for directing a processor to generate a security key for a network, said program code comprising:

a first code segment for causing said processor to generate a first random number;

a second code segment for causing said processor to provide a signal indicative of said first random number;

a third code segment for causing said processor to receive a signal indicative of an authenticator being a function of said first random number;

a fourth code segment for causing said processor to provide a signal indicative of said authenticator and said first random number;

a fifth code segment for causing said processor to receive a signal indicative of a second random number and said security key, wherein;

said second random number is indicative of a validity of said authenticator; and

said security key is a function of said second random number; and

a sixth code segment for causing said processor to provide a signal indicative of said second random number.

22. A computer readable medium encoded with a computer program code for directing a processor to generate a security key for a network, said program code comprising:

a first code segment for causing said processor to receive a signal indicative of a first authenticator, a first random number, and a network access identifier;

a second code segment for causing said processor to generate a second authenticator as a function of said first random number and said network access identifier as obtained from said signal, and a predetermined security key;

a third code segment for causing said processor to compare said authenticator with said second authenticator;

a fourth code segment for causing said processor to generate a second random number, if said first authenticator matches said second authenticator;

a fifth code segment for causing said processor to generate said first security key as a function of said second random number, said network access identifier as obtained from said signal, and said predetermined security key, if said first authenticator matches said second authenticator; and

a sixth code segment for causing said processor to provide a signal indicative of said second random number and said predetermined security key if said first authenticator matches said second authenticator.

23. A computer readable medium encoded with a computer program code for directing a processor to authenticate a mobile node and establish a data link layer security association between said mobile node and a network, said program code comprising:

a first code segment for causing said processor to generate a first random number;

a second code segment for causing said processor to convey a signal indicative of said first random number from said network to said mobile node;

a third code segment for causing said processor to generate a first authenticator as a function of said first random number;

a fourth code segment for causing said processor to convey a signal indicative of said first authenticator from said mobile node to said network;

a fifth code segment for causing said processor to generate a second authenticator as a function of said first random number, a mobile node network access identifier, and a predetermined security key;

a sixth code segment for causing said processor to compare said first authenticator with said second authenticator;

a seventh code segment for causing said processor to generate a second random number if said first authenticator matches said second authenticator;

an eighth code segment for causing said processor to generate an encryption key at said mobile node if said first authenticator matches said second authenticator, wherein;

said encryption key is generated as a function of said second random number, said network access identifier, and said predetermined security key; and

said encryption key is configured to encrypt and decrypt communications between said mobile node and said network for a current session;

a ninth code segment for causing said processor to convey a signal indicative of said second random number from said network to said mobile node if said first authenticator matches said second authenticator; and

a tenth code segment for causing said processor to generate said encryption key at said mobile node if said first authenticator matches said second authenticator.