Fast ciphering key search for WLAN receivers

• US 8,811,618 B2
• Filed: 07/26/2004
• Issued: 08/19/2014
• Est. Priority Date: 01/30/2004
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: GlobalFoundries, Inc.
• Inventors: Kuehn, Ingo, Eckhardt, Uwe, Wachtler, Axel, Tischer, Falk
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): SCHMIDT, KARI L
• Application Number:
  US10/899,200
• Publication Number:
  US 20050169480A1
• Time in Patent Office: 3,676 Days
• Field of Search: 380/277, 713/153, 713/156, 713182-186, 726/2, 726/11
• US Class Current: 380/277
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A ciphering key management technique for use in a WLAN receiver is provided where a hash table is stored that has a first and a second table portion. The first table portion stores transmitter address data and the second table portion stores at least one cipher key. It is determined whether a transmitter address matches transmitter address data in the first table portion, and if so, a corresponding cipher key stored in the second table portion is determined for use in decrypting the received data. The hash table technique allows for a fast search for the correct cipher key. Embodiments are described that allow for dynamically adding and removing keys without blocking the search.

Claims

1. A WLAN (Wireless Local Area Network) receiver comprising:

a ciphering key management circuit configured to control use of cipher keys for decrypting received data, wherein said ciphering key management circuit comprises a memory circuit configured to store a hash table having a first and a second set of entries, said first set of entries including transmitter address data comprised of a predetermined number of lower bits of a respective transmitter address, said second set of entries including at least one cipher key, wherein said ciphering key management circuit is configured to determine whether a transmitter address obtained from an incoming data frame matches said transmitter address data in said first set of entries, and if so, determine a cipher key corresponding to the transmitter address, wherein the cipher key is included in said second set of entries and is configured for use in decrypting said received data;

wherein said transmitter address data included in said first set of entries is comprised of a number of lower bits of a respective transmitter address, wherein said first set of entries comprises a number of sub-fields, each configured to store transmitter address data of a different transmitter, wherein the ciphering key management circuit is configured to dynamically change the number of sub-fields by executing software instructions, and wherein said ciphering key management circuit is configured to reduce said number of lower bits responsive to an increase in said number of sub-fields;

wherein said second set of entries comprises a number of table entries each configured to store at least one cipher key pertaining to a different transmitter, wherein each table entry has a fixed length independent from the length of the hash table;

wherein the length of the hash table is given by the length of said first set of entries and the length of said second set of entries, said length of said second set of entries being dependent on said fixed length of said table entries and the number of table entries in said second set of entries, wherein the number of active sub-fields in said first set of entries is equal to the number of table entries in said second set of entries.

2. The WLAN receiver of claim 1, further comprising:

a data decapsulation circuit for decapsulating incoming data using said determined cipher key.

3. The WLAN receiver of claim 2, wherein said decapsulation circuit is configured to apply CCMP-AES (Counter-mode Cipher block chaining Message authentication code Protocol-Advanced Encryption Standard) procedures.

4. The WLAN receiver of claim 2, wherein said decapsulation circuit is configured to apply TKIP (Temporal Key Integrity Protocol) procedures.

5. The WLAN receiver of claim 2, wherein said decapsulation circuit is configured to apply WEP-40 (Wired Equivalent Privacy) procedures.

6. The WLAN receiver of claim 2, wherein said decapsulation circuit is configured to apply WEP-104 (Wired Equivalent Privacy) procedures.

7. The WLAN receiver of claim 2, wherein said data decapsulation circuit is configured to perform data frame decapsulation.

8. The WLAN receiver of claim 1, wherein said memory is an OCM (On-Chip Memory) configured to be controlled by software.

9. The WLAN receiver of claim 1, wherein said first set of entries is a hash line of said hash table.

10. The WLAN receiver of claim 1, wherein said ciphering key management circuit is configured to selectively mark individual sub-fields in said first set of entries active or inactive.

11. The WLAN receiver of claim 1, wherein said number of sub-fields in said first set of entries is a power-two number.

12. The WLAN receiver of claim 1, wherein said ciphering key management circuit further comprises a capacity register configured to store an integer number, wherein said number of sub-fields in said first set of entries and the maximum number of table entries in said second set of entries are given by two to the power of said integer number.

13. The WLAN receiver of claim 1, wherein each sub-field in said first set of entries relates to an individual table entry in said second set of entries.

14. The WLAN receiver of claim 1, wherein each table entry in said second set of entries is configured to store a receiver/transmitter address pair.

15. The WLAN receiver of claim 1, wherein each table entry in said second set of entries is configured to store data indicating one of at least two different cipher modes.

16. The WLAN receiver of claim 15, wherein one of said at least two cipher modes is a CCMP-AES (Counter-mode Cipher block chaining Message authentication code Protocol-Advanced Encryption Standard) cipher mode.

17. The WLAN receiver of claim 15, wherein one of said at least two cipher modes is a TKIP (Temporal Key Integrity Protocol) cipher mode.

18. The WLAN receiver of claim 15, wherein one of said at least two cipher modes is a WEP (Wired Equivalent Privacy) cipher mode.

19. The WLAN receiver of claim 1, wherein said ciphering key management circuit is further configured to compare said transmitter address with a transmitter address stored in said second set of entries, to determine said cipher key.

20. The WLAN receiver of claim 19, wherein said ciphering key management circuit is further configured to compare said transmitter address with two or more transmitter addresses stored in said second set of entries, to determine said cipher key.

21. The WLAN receiver of claim 1, wherein said hash table further has a third set of entries configured to store activation information, said activation information indicating whether transmitter address data in said first set of entries is active or not.

22. The WLAN receiver of claim 1, wherein said ciphering key management circuit is configured to add a cipher key to said second set of entries by writing said cipher key to said second set of entries, writing corresponding transmitter address data to said first set of entries, and then activating said written transmitter address data.

23. The WLAN receiver of claim 1, wherein said ciphering key management circuit is configured to add a cipher key from said second set of entries by deactivating corresponding transmitter address data, and then deleting the cipher key from said second set of entries and the transmitter address data from said first set of entries.

24. A ciphering key management circuit for controlling use of cipher keys for decrypting data received by a WLAN (Wireless Local Area Network) receiver, said ciphering key management circuit comprising:

a memory circuit configured to store a hash table having a first and a second set of entries, said first set of entries including transmitter address data comprised of a predetermined number of lower bits of a respective transmitter address, said second set of entries including at least one cipher key; and

a control circuit configured to determine whether a transmitter address obtained from an incoming data frame matches said transmitter address data in said first set of entries, and if so, determine a cipher key corresponding to the transmitter address, wherein said cipher key is included in said second set of entries and configured for use in decrypting said received data;

wherein said transmitter address data included in said first set of entries is comprised of a number of lower bits of a respective transmitter address, wherein said first set of entries comprises a number of sub-fields, each configured to store transmitter address data of a different transmitter, wherein the ciphering key management circuit is configured to dynamically change the number of sub-fields by executing software instructions, and wherein said ciphering key management circuit is configured to reduce said number of lower bits responsive to an increase in said number of sub-fields;

wherein said second set of entries comprises a number of table entries each configured to store at least one cipher key pertaining to a different transmitter, wherein each table entry has a fixed length independent from the length of the hash table;

wherein the length of the hash table is given by the length of said first set of entries and the length of said second set of entries, said length of said second set of entries being dependent on said fixed length of said table entries and the number of table entries in said second set of entries, wherein the number of active sub-fields in said first set of entries is equal to the number of table entries in said second set of entries.

25. An integrated circuit chip for use in a WLAN (Wireless Local Area Network) receiver to perform ciphering key management to control use of cipher keys for decrypting data received by said WLAN receiver, said integrated circuit chip comprising:

a memory circuit configured to store a hash table having a first and a second set of entries, said first set of entries storing transmitter address data comprised of a predetermined number of lower bits of a respective transmitter address, said second set of entries storing at least one cipher key; and

a control circuit configured to determine whether a transmitter address obtained from an incoming data frame matches said transmitter address data in said first set of entries, and if so, determine a cipher key corresponding to said transmitter address, wherein said cipher key is included in said second set of entries and configured for use in decrypting said received data;

wherein said transmitter address data included in said first set of entries is comprised of a number of lower bits of a respective transmitter address, wherein said first set of entries comprises a number of sub-fields each configured to store transmitter address data of a different transmitter, wherein the integrated circuit chip is configured to dynamically change the number of sub-fields by executing software instructions, and wherein said ciphering key management circuit is configured to reduce said number of lower bits responsive to an increase in said number of sub-fields;

wherein said second set of entries comprises a number of table entries each configured to store at least one cipher key pertaining to a different transmitter, wherein each table entry has a fixed length independent from the length of the hash table;

wherein the length of the hash table is given by the length of said first set of entries and the length of said second set of entries, said length of said second set of entries being dependent on said fixed length of said table entries and the number of table entries in said second set of entries, wherein the number of active sub-fields in said first set of entries is equal to the number of table entries in said second set of entries.

26. A method of controlling use of cipher keys for decrypting received data in a WLAN (Wireless Local Area Network) receiver, said method comprising:

accessing, by a processing circuit, a hash table having a first and a second set of entries, said first set of entries storing transmitter address data comprised of a predetermined number of lower bits of a respective transmitter address, said second set of entries storing at least one cipher key;

determining whether a transmitter address obtained from an incoming data frame matches said transmitter address data in said first set of entries; and

if so, determining a corresponding cipher key stored in said second set of entries for use in decrypting said received data;

wherein said transmitter address data stored in said first set of entries is comprised of a number of lower bits of a respective transmitter address, said first set of entries comprises a number of sub-fields each configured to store transmitter address data of a different transmitter, the number of sub-fields being dynamically changeable by software instructions executed by the WLAN receiver, and wherein the method further comprises reducing said number of lower bits responsive to an increase in said number of sub-fields;

wherein said second set of entries comprises a number of table entries each configured to store at least one cipher key pertaining to a different transmitter, wherein each table entry has a fixed length independent from the length of the hash table;

wherein the length of the hash table is given by the length of said first set of entries and the length of said second set of entries, said length of said second set of entries being dependent on said fixed length of said table entries and the number of table entries in said second set of entries, wherein the number of active sub-fields in said first set of entries is equal to the number of table entries in said second set of entries.

27. The method of claim 26, further comprising:

decapsulating incoming data using said deteiinined cipher key.

28. The method of claim 27, wherein said decapsulation applies CCMP-AES (Counter-mode Cipher block chaining Message authentication code Protocol-Advanced Encryption Standard) procedures.

29. The method of claim 27, wherein said decapsulation applies TKIP (Temporal Key Integrity Protocol) procedures.

30. The method of claim 27, wherein said decapsulation applies WEP-40 (Wired Equivalent Privacy) procedures.

31. The method of claim 27, wherein said decapsulation applies WEP-104 (Wired Equivalent Privacy) procedures.

32. The method of claim 27, wherein said decapsulation is a data frame decapsulation.

33. The method of claim 26, wherein said step of accessing said hash table comprises accessing an OCM (On-Chip Memory) circuit by performing software instructions.

34. The method of claim 26, wherein said first set of entries is a hash line of said hash table.

35. The method of claim 26, further comprising:

selectively marking individual sub-fields in said first set of entries active or inactive.

36. The method of claim 35 further comprising marking a selected subfield inactive prior to removing its corresponding hash table entry.

37. The method of claim 26, wherein said number of sub-fields in said first set of entries is a power-two number.

38. The method of claim 26, further comprising:

accessing a capacity register storing an integer number; and

setting the number of sub-fields in said first set of entries and the maximum number of table entries in said second set of entries to be two to the power of said integer number.

39. The method of claim 26, wherein each sub-field in said first set of entries relates to an individual table entry in said second set of entries.

40. The method of claim 26, wherein each table entry in said second set of entries is configured to store a receiver/transmitter address pair.

41. The method of claim 26, wherein each table entry in said second set of entries is configured to store data indicating one of at least two different cipher modes.

42. The method of claim 41, wherein one of said at least two cipher modes is a CCMP-AES (Counter-mode Cipher block chaining Message authentication code Protocol-Advanced Encryption Standard) cipher mode.

43. The method of claim 41, wherein one of said at least two cipher modes is a TKIP (Temporal Key Integrity Protocol) cipher mode.

44. The method of claim 41, wherein one of said at least two cipher modes is a WEP (Wired Equivalent Privacy) cipher mode.

45. The method of claim 26, further comprising:

comparing said transmitter address with a transmitter address stored in said second set of entries, to determine said cipher key.

46. The method of claim 45, wherein said transmitter address is compared with two or more transmitter addresses stored in said second set of entries.

47. The method of claim 26, wherein said hash table further has a third set of entries for storing activation information, said activation information indicating whether transmitter address data in said first set of entries is active or not.

48. The method of claim 26 wherein a cipher key is added to said second set of entries by performing the steps of:

writing said cipher key to said second set of entries;

writing corresponding transmitter address data to said first set of entries; and

activating said written transmitter address data in said third set of entries.

49. The method of claim 26 wherein a cipher key is removed from said second set of entries by performing the steps of:

deactivating corresponding transmitter address data; and

deleting the cipher key from said second set of entries, and the transmitter address data from said first set of entries.