System and method for providing WLAN security through synchronized update and rotation of WEP keys
View Patent ↗A system and method are disclosed that overcome deficiencies of prior art IEEE 802.11 WEP key management schemes. Preferred embodiments of the present system and method update WEP keys and rotate transmission key indices in a synchronized manner and on a frequent basis making it impractical for a hacker to gather sufficient network traffic using any one WEP key to decrypt that key and without disrupting communications. Preferred embodiments of the present system and method do not require changes in access point or mobile unit hardware, radio drivers, or firmware and are therefore compatible with existing or legacy network infrastructure or components. The disclosed system and method may be used to facilitate secure communications between one or more access points and one or more mobile units and/or groups of two or more mobile units engaging in peer-to-peer associations.
1. A system for improved security for wireless local area networks, and comprised of: a wireless local area network conforming to the IEEE 802.11 family of specifications, the wireless local area network providing wireless communications links for the transmission of data between the two or more communicating entities; one or more generators for creating pseudorandom WEP encryption keys for the communicating entities; and one or more controllers for synchronously selecting a transmission encryption key index for each communicating entity on a rotating basis from one or more sets of active WEP keys, and updating the one or more sets of active WEP keys.
2. The system of claim 1 , wherein the communicating entities comprise: one or more access points associating with one or more wired sub-networks; and one or more mobile units.
3. The system of claim 1 , wherein the communicating entities comprise two or more mobile units associating on a peer-to-peer basis.
4. The system of claim 2 , wherein the encryption keys are generated for and synchronized between one or more access points and one or more mobile units engaged in associations.
5. The system of claim 3 , wherein the encryption keys are generated for and synchronized between two or more mobile units engaging in peer-to-peer associations.
6. The system of claim 1 , wherein the controller selecting the active encryption keys for the one or more mobile units is on the mobile units.
7. The system of claim 1 , wherein the controller selecting the active encryption keys for the one or more access points is on one or more servers on the one or more sub-networks.
8. The system of claim 1 , wherein the controller selecting the active encryption keys for the one or more access points is on the access points.
9. The system of claim 1 , wherein a server generates a list of two or more encryption keys, which are distributed to the two or more communicating entities.
10. The system of claim 9 , wherein the active keys for the transmitting entities are selected from the list by the controllers in a staggered pattern, so that the encryption keys are different in each transmission direction, and where errors in time synchronization of up to one half of a key change time interval do not disrupt regular communications.
11. The system of claim 1 , wherein a server generates key generation information, which is distributed to the two or more communicating entities.
12. The system of claim 11 , wherein the active keys for the communicating entities are selected by the one or more controllers in a staggered pattern, so that the encryption keys are different in each transmission direction, and where errors in time synchronization of up to one half key change time interval do not disrupt regular communications.
13. The system of claim 1 , wherein the encryption key updates for the communicating entities are performed at specific dates and times.
14. The system of claim 1 , wherein the encryption key updates for the communicating entities are performed at regular time intervals.
15. The system of claim 1 , wherein the one or more controllers use time offsets to synchronize the key updates in time between the communicating entities.
16. The system of claim 1 , wherein a mobile unit reconnecting to the wireless network can determine the correct encryption keys to use based on the time.
17. The system of claim 1 , wherein a mobile unit reconnecting to the wireless network and unable to synchronize encryption keys is adapted to perform a systematic search for the correct keys based on a key update and rotation algorithm.
18. The system of claim 1 , wherein a mobile unit that has lost synchronization with the changes in encryption keys is adapted to connect to a wired network to regain synchronization.
19. A method for providing improved security for wireless local area networks, comprising: creating pseudorandom WEP encryption keys for a plurality of communicating entities adapted to communicate via a wireless local area network conforming to the IEEE 802.11 family of specifications; synchronously selecting a transmission encryption key index for each communicating entity on a rotating basis from one or more sets of active WEP keys; and synchronously updating the one or more sets of active WEP keys.