Granted Patent B2

US 9,198,033 · App. 11/862,561 · Granted Nov 24, 2015

Abstract

Claims (51)

1. A method for authenticating a wireless node requesting to join a wireless network, the method comprising:

receiving, at an authentication server node, an authentication request from the wireless node;

negotiating at least one authentication parameter with the wireless node;

receiving, from the wireless node, a first encryption key derived using the at least one authentication parameter;

deriving a second encryption key using the first encryption key and the at least one authentication parameter, wherein the second encryption key is independently derived at the wireless node;

encrypting a third encryption key using the second encryption key to form an encrypted third encryption key; and

propagating the encrypted third encryption key toward the wireless node.

2. The method of claim 1 , wherein the second encryption key comprises an Extensible Authentication Protocol (EAP) Pairwise Master Key (PMK).

3. The method of claim 1 , wherein the third encryption key comprises one of a unicast encryption key, a multicast encryption key, and a broadcast encryption key.

4. The method of claim 1 , wherein negotiating the at least one authentication parameter with the wireless node is performed using an Extensible Authentication Protocol (EAP) method.

5. The method of claim 1 , further comprising:

after receiving the authentication request and prior to negotiating the at least one authentication parameter, establishing a secure tunnel between the wireless node and the authentication server node; and

negotiating the at least one authentication parameter with the wireless node using the secure tunnel.

6. The method of claim 5 , wherein the secure tunnel is established using one of Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS) or Protected Extensible Authentication Protocol (PEAP).

7. The method of claim 1 , wherein the wireless node comprises an access node portion and a supplicant node portion, wherein the supplicant node portion is adapted to derive the second encryption key for use in decrypting the encrypted third encryption key.

8. An apparatus for authenticating a wireless node requesting to join a wireless network, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to:

receive, at an authentication server node, an authentication request from the wireless node;

negotiate at least one authentication parameter with the wireless node;

receive, from the wireless node, a first encryption key derived using the at least one authentication parameter;

derive a second encryption key using the first encryption key and the at least one authentication parameter, wherein the second encryption key is independently derived at the wireless node;

encrypt a third encryption key using the second encryption key to form an encrypted third encryption key; and

propagate the encrypted third encryption key toward the wireless node.

9. A method for authenticating a wireless node requesting to join a wireless network, comprising:

negotiating at least one authentication parameter with an authentication server node;

providing, from the wireless node toward the authentication server node, a first encryption key derived using the at least one authentication parameter;

deriving, at the wireless node, a second encryption key using the first encryption key and the at least one authentication parameter, wherein the second encryption key is independently derived at the authentication server node; and

receiving, at the wireless node from the authentication server node, a message including an encrypted third encryption key, wherein the encrypted third encryption key is an encrypted version of a third encryption key, wherein the third encryption key is encrypted using the second encryption key to form the encrypted third encryption key, wherein the third encryption key is adapted for use by the wireless node in communicating with at least one other node of the wireless network.

10. The method of claim 9 , further comprising:

receiving a packet from a wireless user device;

retrieving the third encryption key from the memory;

encrypting the packet using the third encryption key to form an encrypted packet; and

transmitting the encrypted packet toward another node.

11. The method of claim 9 , further comprising:

receiving an encrypted packet from another node;

retrieving the third encryption key from the memory;

decrypting the encrypted packet using the third encryption key to recover a packet; and

transmitting the packet toward a wireless user device for which the packet is intended.

12. The method of claim 9 , wherein the second encryption key comprises an Extensible Authentication Protocol (EAP) Pairwise Master Key (PMK).

13. The method of claim 9 , wherein the third encryption key comprises one of a unicast encryption key, a multicast encryption key, and a broadcast encryption key.

14. The method of claim 9 , wherein negotiating the at least one authentication parameter with the authentication node is performed using an Extensible Authentication Protocol (EAP) method.

15. The method of claim 9 , further comprising:

prior to negotiating the at least one authentication parameter with the authentication server node, establishing a secure tunnel between the wireless node and the authentication server node; and

negotiating the at least one authentication parameter with the authentication server node using the secure tunnel.

16. The method of claim 15 , wherein the secure tunnel is established using one of Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS) or Protected Extensible Authentication Protocol (PEAP).

17. An apparatus for authenticating a wireless node requesting to join a wireless network, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to:

negotiate at least one authentication parameter with an authentication server node;

provide, from the wireless node toward the authentication server node, a first encryption key derived using the at least one authentication parameter;

derive, at the wireless node, a second encryption key using the first encryption key and the at least one authentication parameter, wherein the second encryption key is independently derived at the authentication server node; and

receive, at the wireless node from the authentication server node, a message including an encrypted third encryption key, wherein the encrypted third encryption key is an encrypted version of a third encryption key, wherein the third encryption key is encrypted using the second encryption key to form the encrypted third encryption key, wherein the third encryption key is adapted for use by the wireless node in communicating with at least one other node of the wireless network.

Assignments (13)