Security authentication and key management within an infrastructure based wireless multi-hop network
View Patent ↗A system and method of security authentication and key management scheme in a multi-hop wireless network is provided herein with a hop-by-hop security model. The scheme adapts the 802.11r key hierarchy into the meshed AP network. In this approach, a top key holder (R 0 KH) derives and holds the top Pairwise Master Key (PMK — 0 ) for each supplicant wireless device after the authentication process. All authenticator AP take the level one key holder (R 1 KH) role and receive the next level Pairwise Master Key (PMK — 1 ) from R 0 KH. The link level data protection key is derived from PMK — 1 via the 802.11i 4-way handshaking.
1. A method for communicating between a top level key holder and a level one key holder for security authentication and key management within an infrastructure-based wireless multi-hop network, comprising:
communicating a message having a message format comprising:
a Media Access Control (MAC) header containing a source and a destination MAC addresses of at least one hop;
an Ad Hoc Routing (AHR) header containing:
a source and a destination MAC addresses of the level one key holder and the top level key holder, and
a protocol identification representing an extensible authentication protocol over local area network (EAPOL) proxy packet;
a supplicant MAC address;
an i/r flag which is an indicator of 802.11i or 802.11r standard; and
a service set identifier (SSID).
2. A method as claimed in claim 1 , wherein the supplicant MAC address identifies which supplicant device to bind a pair-wise master key_ 0 (PMK_ 0 ) and a PMK_ 1 .
3. A method as claimed in claim 1 , wherein the i/r flag indicating a 802.11i supplicant identifies that the PMK is derived based on a 802.11i standard and the PMK is to be delivered to a R 1 KH.
4. A method as claimed in claim 1 , wherein the i/r flag indicating a 802.11r supplicant identifies that the PMK_ 0 and PMK_ 1 are derived based on a 802.11r key hierarchy and the PMK_ 1 is to be delivered to the authenticator.
5. A method as claimed in claim 1 , wherein the SSID is used for PMK_ 0 and PMK_ 1 derivation for a virtual access point, and further wherein a supplicant selects an SSID from a plurality of available SSIDs.
6. A method as claimed in claim 1 , wherein the message is transported on a communication layer selected from a group comprising a layer 2 and a layer 3 , and
further wherein when the message format is placed in the internet protocol (IP) packet payload, a R 1 KH MAC address is added into a message contents.