Authentication and encryption method and apparatus for a wireless local access network

• US 20040215957A1
• Filed: 11/27/2002
• Published: 10/28/2004
• Est. Priority Date: 04/09/2001
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Laroche, Stephane, Trudeau, Pierre, Moineau, Gilbert
• Granted Patent: US 7,797,530 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

This invention pertains to the field of Wireless Local Area Network (WLAN). This invention allows a secure connection of a user client station to a base unit. The secure connection comprises the use of authentication and encryption means. The base unit comprises a switching unit, at least one firewall, an authentication/encryption unit and at least one port device. The invention also provides a secure roaming scheme when a roaming is performed by a wireless user.

Claims

1. An apparatus for secure communication between at least one user client station via at least one port device and a network, said apparatus comprising:

at least one firewall, each of said at least one firewall being connected to one of said at least one port device;

an authentication/encryption unit having a configuration data path connected to each of said at least one firewall,

a switching unit for transmitting data connected to each of said at least one firewall and to said authentication/encryption unit;

wherein a new user client station has permission at said at least one firewall to access only an authentication function of said authentication/encryption unit until said authentication/encryption unit communicates a permission profile for said new user over said configuration data path.

2. The apparatus as claimed in claim 1, wherein said communication is encrypted using said authentication/encryption unit.

3. The apparatus as claimed in claim 2, wherein:

said apparatus is in communication with another of said apparatus;

communication received at said firewall addressed to an authentication/encryption unit of said other apparatus is allowed to pass through said firewall and said switching unit to said authentication/encryption unit of said other apparatus;

whereby roaming between said apparatus and another of said other in a secure way as encryption as well as authentication is performed.

4. The apparatus as claimed in claim 3, wherein said communication is performed using a wireless transmission.

5. The apparatus as claimed in claim 4, wherein said other authentication/encryption unit is a general authentication/encryption unit, said general authentication/encryption unit comprising each of said authentication/encryption unit of each of said apparatus.

6. The apparatus as claimed in claim 1, wherein said switching unit creates a first link between said authentication/encryption unit and one of said at least one firewall to which at least one of said at least one user client station is connected via one of said port device of said at least one port device and a second link between said authentication/encryption unit and one of said at least one firewall to which another user client station is connected via one of said port device;

said first and second link being secure as a result of encryption by said authentication/encryption unit and by filtering said at least one firewall.

7. The apparatus as claimed in claim 1, further comprising a database unit, said database unit having security profiles, said database unit being connected to said authentication/encryption unit, said database enabling said authentication/encryption unit to manage said firewalls for each of said user client stations.

8. The apparatus as claimed in claim 6, further comprising a database unit, said database unit having security profiles for more than two users, said database unit being connected to said authentication/encryption unit, said database enabling said authentication/encryption unit to manage said firewalls for each of said user client stations.

9. The apparatus as claimed in claim 1, wherein said authentication/encryption unit is a VPN server.

10. The apparatus as claimed in claim 9, wherein said VPN server uses PPTP protocol.

11. The apparatus as claimed in claim 9, wherein said VPN server uses IPSec standard.

12. The apparatus as claimed in claim 9, wherein said VPN server uses L2TP protocol.

13. The apparatus as claimed in claim 6, wherein said authentication/encryption unit is a VPN server.

14. The apparatus as claimed in claim 13, wherein said VPN server uses PPTP protocol.

15. The apparatus as claimed in claim 13, wherein said VPN server uses IPSec standard.

16. The apparatus as claimed in claim 13, wherein said VPN server uses L2TP protocol.

17. The apparatus as claimed in claim 7, wherein said database unit is a Radius authentication server.

18. The apparatus as claimed in claim 7, wherein said security profiles are stored using a Lightweight Directory Access Protocol (LDAP).

19. The apparatus as claimed in claim 8, wherein said database unit is a Radius authentication server.

20. The apparatus as claimed in claim 8, wherein said security profiles are stored using a Lightweight Directory Access Protocol (LDAP).

21. The apparatus as claimed in claim 6, wherein one of said at least one port device is a wireless port.

22. The apparatus as claimed in claim 1, wherein one of said at least one port device is a local area network port, said local area network port allowing another apparatus to be connected to said apparatus.

23. The apparatus as claimed in claim 6, wherein one of said at least one port device is a local area network port, said local area network port allowing another apparatus to be connected to said apparatus.

24. The apparatus as claimed in claim 1, wherein one of said port device is connected to a wide area network.

25. The apparatus as claimed in claim 6, wherein one of said port device is connected to a wide area network.

26. The apparatus as claimed in claim 1, further comprising a database unit, said database unit having security profiles, said database unit being connected to said authentication/encryption unit via a wide area network.

27. The apparatus as claimed in claim 6, further comprising a database unit, said database unit having security profiles, said database unit being connected to said authentication/encryption unit via a wide area network.

28. A method for secure communication between at least one user client station via at least one port device and a network, each of said at least one port device being connected to a firewall, said firewall being connected to a switching unit and to an authentication/encryption unit using a configuration path, said method comprising the steps of:

establishing an authentication link between at least one of said at least one user client station and said authentication/encryption unit;

authenticating said at least one of said at least one user client stations and retrieving a profile;

applying said profile configuration to said at least one of said firewall using said configuration path; and

allowing said at least one user client station to communicate according to said profile configuration, if said authentication is successful.

29. The method as claimed in claim 28, further comprising the step of detecting a disconnection of one of said at least one user client stations.

30. The method as claimed in claim 29, further comprising the step of removing said profile configuration from said at least one firewall using said configuration path.

31. The method as claimed in claim 28, further comprising the step of encrypting the communication between each of said at least one user client station using said authentication/encryption unit.

32. A method for allowing a user to roam from a first to a second access point, each of said first and second access point comprising at least one port device to which a user might communicate, each of said at least one port device being connected to a firewall, said firewall being connected to a switching unit and to an authentication/encryption unit using a configuration path, said method comprising the steps of:

establishing a secure communication between at least one of said user client station and a network via said first access point according to one of claims 28 to 31;

establishing a link between said at least one user client station and said port device of said second access point, said link comprising a request to transfer data;

transmitting said request to transfer data from said at least one user client station of said second access point to said authentication/encryption unit of said first access point;

authenticating said at least one user client station using said authentication/encryption unit of said first access point;

applying a profile configuration to said at least one of said firewall of said first access point using said configuration path of said first access point; and

allowing said at least one user client station to communicate according to said profile configuration, if said authentication is successful.

33. The method as claimed in claim 32, further comprising the step of encrypting said communication using said authentication/encryption unit of said first access point.

34. The method as claimed in claim 32, further comprising the step of encrypting said communication using said authentication/encryption unit of said second access point.

35. The method as claimed in claim 32, further comprising the step of applying said profile configuration to said at least one of said firewall of said second unit using a link between said authentication/encryption unit of said first unit and said at least one of said firewall of said second unit.

36. The method as claimed in claim 35, wherein said link is created between said first and second unit using a local area network (LAN) between one port device of said first unit and one port device of said second unit.

37. The method as claimed in claim 32, further comprising the step of detecting a disconnect.

38. The method as claimed in claim 32, further comprising the step of dynamically changing said profile configuration of said at least one of said firewall of said first unit.