An authentication protocol can be used to establish a secure method of communication between two devices on a network. Once established, the secure communication can be used to authenticate a client through various authentication methods, providing security in environments where intermediate devices cannot be trusted, such as wireless networks, or foreign network access points. Additionally, the caching of session keys and other relevant information can enable the two securely communicating endpoints to quickly resume their communication despite interruptions, such as when one endpoint changes the access point through which it is connected to the network. Also, the secure communication between the two devices can enable users to roam off of their home network, providing a mechanism by which access through foreign networks can be granted, while allowing the foreign network to monitor and control the use of its bandwidth.
1. A method of authenticating a mobile user to a wireless network using a Transport Layer Security (TLS) tunneling protocol, the method comprising:
receiving at a client from a server a request to use a protected extensible authentication protocol for authentication;
sending by the client afirst response packet formatted according to the TLS tunneling protocol and the protected extensible authentication protocol to the server, the first response packet providing a user alias to protect the user's identity and for establishing a secure communication tunnel, the first response packet including a session identifier identifying a previous authentication session including a previous user authentication by the server;
receiving a second request packet from the with server information for establishing the secure communication tunnel, wherein the second request packet includes information for authenticating the server to the client;
transmitting a second response packet to the server, wherein the second response packet establishes the secure communication tunnel;
receiving a success packet from the server, the success packet proposing a fast reconnect wherein the fast reconnect uses the previous user authentication to allow the wireless connection to quickly resume services when the mobile user is roaming and connecting to different wireless access points;
transmitting a success response packet agreeing to the fast reconnect; and
after successful fast reconnect, encrypting subsequent communications using stored keys.
2. The method of claim 1 , wherein the steps are performed through a wireless connection.
3. The method of claim 1 , further comprising the use of a transport layer security protocol for establishing the secure communication tunnel.
4. The method of claim 1 , further comprising:
receiving a request from the server for an initial client identity; and
transmitting a portion of a user identification in response to the request for an initial client identity.
5. The method of claim 1 , further comprising
receiving a request from the server for an initial client identity; and
transmitting the user alias in response to the request for an initial client identity.
6. The method of claim 1 , wherein the server uses the session identifier to identify the client and retrieve cached information regarding the previous user authentication.
7. The method of claim 1 , further comprising:
after the receiving the request to use a protected extensible authentication protocol for authentication from the server, transmitting a set of possible cryptographic mechanisms to the server;
receiving from the server, a selected cryptographic mechanism from the set of possible cryptographic mechanisms;
deriving cryptographic keys for the selected cryptographic mechanism; and implementing the selected cryptographic mechanism with the derived cryptographic keys.
8. A method of authenticating a mobile user to a wireless network using a Transport Layer Security (TLS) tunneling protocol, the method comprising:
transmitting by a server a request to a client to use a protected extensible authentication protocol for authentication;
receiving a first response packet formatted according to the TLS tunneling protocol and the protected extensible authentication protocol, the first response packet including a user alias to protect the user's identity and for establishing a secure communication tunnel and including a session identifier identifying a previous authentication session and a previous user authentication;
transmitting a second request packet to the client with server information for establishing a secure communication tunnel, wherein the second request packet includes information for authenticating the server to the client;
receiving a second response packet from the client, wherein the second response packet establishes the secure communication tunnel;
transmitting a success packet to the client, the success packet proposing a fast reconnect wherein the fast reconnect uses the previous user authentication to allow the wireless connection to quickly resume services when the mobile user is roaming and connecting to different wireless access points;
receiving from the client a success response packet agreeing to the fast Reconnect; and
after successful fast reconnect, encrypting subsequent communications using stored keys.
9. The method of claim 8 , wherein the steps are performed through a wireless connection.
10. The method of claim 8 , further comprising the use of a transport layer security protocol for establishing the secure communication tunnel.
11. The method of claim 8 , further comprising:
transmitting a request to the client for an initial client identity; and
receiving a portion of a user identification in response to the request for an initial client identity.
12. The method of claim 8 , further comprising:
transmitting a request to the client for an initial client identity; and
receiving the user alias in response to the request for an initial client identity.
13. The method of claim 8 , further comprising:
using the session identifier to identity, the client and retrieve cached information regarding the previous user authentication.
14. The method of claim 8 , further comprising:
after the transmitting the request to use a protected extensible authentication protocol for authentication to the client, receiving a set of possible cryptographic mechanisms from the client; and
transmitting to the client, a selected cryptographic mechanism from the set of possible cryptographic mechanisms.
15. A system for authenticating a user of authentication, the system comprising:
one or more processors configured to execute computer readable instructions; and
one or more computer storage media storing computer executable instructions that when executed by the one or more processors perform a method comprising:
transmitting a request to a client to use a protected extensible authentication protocol for authentication;
receiving a first response packet formatted according to the protected extensible authentication protocol, the first response packet including client information for establishing a secure communication tunnel and including a session identifier identifying a previous secure communication tunnel and a previous user authentication established for a user at the client;
transmitting a second request packet to the client with server information for establishing a secure communication tunnel, wherein the second request packet includes information for authenticating the server to the client;
receiving a second response packet from the client, wherein the second response packet establishes the secure communication tunnel;
transmitting a success packet to the client, the success packet proposing a fast reconnect, wherein the fast reconnect uses the previous user authentication; and
receiving from the client a success response packet agreeing to the fast reconnect.
16. The system of claim 15 , wherein the one or more computer storage media store additional instructions that when executed perform the steps of:
transmitting a request to the client for an initial client identity;
receiving a user alias in response to the request for an initial client identity.