Shared network access using different access keys

• US 7,607,015 B2
• Filed: 10/07/2003
• Issued: 10/20/2009
• Est. Priority Date: 10/08/2002
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): ARMOUCHE, HADI S
• Application Number:
  US10/679,268
• Publication Number:
  US 20040068653A1
• Time in Patent Office: 2,205 Days
• Field of Search: 713/155, 713/168, 713/171, 709/203, 709/229
• US Class Current: 713/171
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 84/04 Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A system and method for consistent authentication and security mechanism to enable a client device to easily roam from one network to another without requiring the client to manually change network configurations is disclosed. In one embodiment, a client device listens for a “beacon frame” broadcast from a Wi-Fi access point. The beacon frame identifies the basic service set identifier (BSSID) of the access point. A tamper-resistant token, or client key, installed at the client device stores a set of authentication parameters, e.g., cryptographic keys, for each Wi-Fi network the client is permitted to access. Each set of authentication parameters is associated with a particular BSSID. Using the BSSID received from the access point, the client device identifies and implements the appropriate set of authentication parameters necessary to authenticate the client device according to an authentication process generally accepted by all the Wi-Fi networks potentially servicing the client.

Claims

1. A method of authenticating a client to one or more computing devices at an edge of one or more communications networks, the method comprising the steps of:

obtaining, by the client, a computing device identifier associated with a computing device;

selecting, at said client, a set of authentication parameters associated with said computing device identifier, said authentication parameters being stored in a tamper-resistant physical token operatively coupled to said client, said tamper-resistant physical token further permanently storing a unique identifier associated with said client, said tamper resistant physical token further storing a first cryptographic key; and

implementing an authentication process employing said set of authentication parameters, the authentication process comprising the steps of;

transmitting, by the client to the computing device, a first challenge, wherein said first challenge comprises an encrypted first random number and said unique identifier associated with said client, said first random number being generated inside said tamper-resistant physical token, said encrypted first random number being encrypted with said first cryptographic key;

receiving, by the client from the computing device, a second challenge, wherein said second challenge comprises an encrypted second random number, said second random number generated at said computing device and encrypted with a second cryptographic key, said second cryptographic key being obtained by said computing device and associated with said computing device identifier; and

permitting, at said client, said client to access said communications network via said computing device if said authentication process results in a successful authentication of said client.

2. The method of claim 1, wherein said computing device identifier is a basic service set identifier (BSSID).

3. The method of claim 1, further comprising the step of installing said tamper-resistant physical token at said client.

4. The method of claim 3, wherein said tamper-resistant physical token is adapted to be inserted into a communications port at said client.

5. The method of claim 1, wherein said tamper-resistant physical token further comprises one or more additional sets of authentication parameters, wherein each of the one or more additional sets of authentication parameters is associated with a unique computing device identifier.

6. The method of claim 5, wherein each of said unique computing device identifier is stored in said tamper-resistant physical token and in relation to an associated set of authentication parameters.

7. The method of claim 1, wherein said unique identifier is a serial number of said tamper-resistant physical token.

8. The method of claim 1, wherein said set of authentication parameters further comprises:

a network receive cryptographic key, and

a network send cryptographic key.

9. The method of claim 8, further comprising the steps of:

encrypting, by the client, said first challenge with said network send cryptographic key; and

decrypting, by the client, said second challenge with said network receive cryptographic key.

10. A system for authenticating a client to one or more computing devices at an edge of one or more communications networks, the system comprising:

one or more computing devices,

a client, wherein the client is operatively coupled to a unique tamper-resistant physical token, the tamper-resistant physical token comprising;

one or more unique sets of authentication parameters, wherein each set of authentication parameters is associated with one or more of said one or more computing devices;

a first cryptographic key, wherein said first cryptographic key is permanently stored in said tamper-resistant physical token;

a random number generator; and

a unique identifier, wherein said unique identifier is permanently stored in said tamper-resistant physical token; and

software installed in said client configured to cause said client to;

obtain a unique identifier of one of said one or more computing devices;

select a set of authentication parameters from said one or more unique sets of authentication parameters associated with the one of said one or more computing devices;

transmit, by the client to the one of said one or more computing devices, a first challenge, wherein the first challenge comprises an encrypted first random number and said unique identifier, wherein the first random number is generated by said random number generator within said unique tamper-resistant physical token, wherein said encrypted first random number is encrypted using the first cryptographic key;

receive, by the client from the one of said one or more computing devices, a second challenge, wherein the second challenge comprises an encrypted second random number, said second random number generated at the one of said one or more computing devices and encrypted using a second cryptographic key, said second cryptographic key being obtained by the one of said one or more computing devices and associated with the one of said one or more computing devices; and

permit, at said client, said client to access said communications network via the one of said one or more computing devices if the one of said one or more computing devices successfully responds to the first challenge and the client successfully responds to the second challenge.

11. The system of claim 10, wherein each client device further includes a wireless communications transceiver to communicate with one of said one or more computing devices via a wireless channel.

12. The system of claim 11, wherein said wireless channel is in the range of 2.4 GHz and 5 GHz.

13. The system of claim 10, wherein one or more computing devices are Wi-Fi access points.

14. The system of claim 13, wherein at least two Wi-Fi access points are associated with different Wi-Fi networks.

15. The system of claim 14, wherein each of said one or more unique sets of authentication parameters is associated with an access point identifier.

16. The system of claim 15, wherein said access point identifier is a basic service set identifier (BSSID).

17. The system of claim 10, wherein each tamper-resistant physical token is adapted to be installed via a communications port at said client.