Method and apparatus for providing a key for secure communications
View Patent ↗A method and apparatus for providing a key for secure communications is provided herein. During operation a node wishing to join a network, will authenticate with an authentication server and then derive a pairwise key (e.g., a Pair-wise Transient Key (PTK)) used for encryption of unicast traffic. The node will also create its own group transient key (GTK) for use in encrypting multicast or broadcast traffic. Once the GTK is generated, it will be provided to an authenticator as part of an association request message.
1. A method for mutual authentication of a first and a second node in a peer-to-peer network, the method comprising the steps of:
sending a first authentication message to the second node containing information needed to authenticate the first node;
receiving a second authentication message from the second node echoing at least some of the information transmitted in the first authentication message;
determining responsive to the contents of the received second authentication message whether authentication is needed;
deriving a pair-wise transient key (PTK) used for encryption of unicast traffic from a pair-wise master key created during authentication;
sending an association message to the second node, the association message comprising both information needed by the second node to validate the PTK, and a group transient key (GTK) used by the first node in encrypting multicast or broadcast traffic; and
receiving an association message from the second node, the association message comprising information needed by the first node to validate the PTK, and a GTK used by the second node, wherein the first authentication message comprises a nonce created by the first node and the second authentication message comprises a nonce created by the second node.
2. The method of claim 1 wherein the association message sent to the second node is an association request message.
3. The method of claim 1 wherein the association message received from the second node is an association response message.
4. The method of claim 1 wherein the first authentication message comprises information needed for the second node to authenticate the first node.
5. The method of claim 4 wherein the second authentication message comprises information needed by the first node for the first node to be authenticated by the second node.
6. The method of claim 1 wherein the information in the association message needed by the second node to validate the PTK comprises a Robust Security Network (RSN) information element identifying the pair-wise master key used for deriving the PTK, and a message integrity check value calculated using the PTK.
7. The method of claim 1 wherein the information in the association message needed by the first node to validate the PTK comprises an RSN information element identifying the pair-wise master key used for deriving the PTK, and a message integrity check value calculated using the PTK.
8. An apparatus for performing mutual authentication, the apparatus comprising:
a transmitter sending a first authentication message to a second node containing information needed to authenticate a first node;
a receiver receiving a second authentication message from the second node echoing at least some of the information transmitted in the first authentication message;
a logic unit determining responsive to the contents of the received second authentication message whether authentication is needed and deriving a pair-wise transient key (PTK) used for encryption of unicast traffic from a pair-wise master key created during authentication; and
wherein the transmitter additionally transmits an association message to the second node, the association message comprising both information needed by the second node to validate the PTK, and a group transient key (GTK) used by a first node in encrypting multicast or broadcast traffic; and
the receiver additionally receives an association message from the second node, the association message comprising information needed by the first node to validate the PTK and a GTK used by the second, wherein the first authentication message comprises a nonce created by the first node and the second authentication message comprises a nonce created by the second node.
9. The apparatus of claim 8 wherein the association message sent to the second node is an association request message.
10. The apparatus of claim 8 wherein the association message received from the second node is an association response message.
11. The apparatus of claim 8 wherein the first authentication message comprises information needed for the second node to authenticate the first node.
12. The apparatus of claim 11 wherein the second authentication message comprises information needed by the first node for the first node to be authenticated by the second node.
13. The apparatus of claim 8 wherein the information in the association message needed by the second node to validate the PTK comprises a Robust Security Network (RSN) information element identifying the pair-wise master key used for deriving the PTK, and a message integrity check value calculated using the PTK.
14. The apparatus of claim 8 wherein the information in the association message needed by the first node to validate the PTK comprises an RSN information element identifying the pair-wise master key used for deriving the PTK, and a message integrity check value calculated using the PTK.