Method for establishing secure associations within a communication network
View Patent ↗A method for security authentication within a wireless network is disclosed. A method within an adhoc mesh network for two devices to quickly determine roles (i.e. which is the authenticator and which is the supplicant) while establishing a security association is provided for. The invention further provides for the inclusion of cached key information in the role negotiation process and the application of role negotiation to a shortened three-way handshake.
1. A method of operation of a mesh point for establishing secure associations within a communication network comprising:
sending a peer link open message to a neighbor node;
receiving a response message from the neighbor node in response to the peer link open message;
processing the response message using a first operation when the response message is a peer link open message;
processing the response message using a second operation when the response message is a peer link setup message;
installing a pairwise transient key (PTK) and an encrypted group temporal key (GTK) as a result of either the first operation or the second operation; and
opening a port for communication with the neighbor node.
2. A method as claimed in claim 1 , wherein the peer link open message includes a mesh security association information element (MSAIE) and a robust security network information element (RSNIE).
3. A method as claimed in claim 1 , wherein the first operation comprises:
processing the response message including verifying the response message contents;
deriving the PTK;
sending a peer link confirm message protected using the PTK;
receive a neighbor node peer link confirm message from the neighbor node;
determining whether the message integrity code (MIC) and contents of the neighbor node peer link confirm message are valid; and
continuing to the installing PTK and GTK step when the message integrity code (MIC) and contents of the peer link confirm message are valid.
4. A method as claimed in claim 1 , wherein the second operation comprises:
deriving the PTK when needed;
determining whether the message integrity code (MIC) and contents of the peer link setup message are valid; and
when the MIC and contents of the peer link set up message are valid:
sending a peer link response message protected by the PTK; and
continuing to the installing PTK and GTK step.
5. A method as claimed in claim 1 , further comprising prior to the receiving step:
waiting to receive the response message from the neighbor node for a period of time; and
sending a peer link close message to close the link when no response message is received during the period of time.
6. A method as claimed in claim 3 , wherein the processing step further comprises:
performing an 802.1x role determination including:
assigning a role of an 802.1x authenticator and a role of an 802.1x supplicant to each of the mesh point and the neighbor node based on the presence of one or more cached keys and a configuration of each of the mesh point and the neighbor node.
7. A method as claimed in claim 6 , wherein the assigning a role of an 802.1x authenticator and a role of an 802.1x supplicant to the mesh points based on the presence of one or more cached keys comprises:
assigning the role of the 802.1x authenticator to the neighbor node when a local Pairwise Master Key identification (PMKID) is valid and a peer key is not cached; and
assigning the role of the 802.1x authenticator to the mesh point when the local PMKID is not valid and the peer key is cached.
8. A method as claimed in claim 7 further comprising:
determining that the local PMKID is valid by:
examining a PMKID List received from the neighbor node in a peer link open message; and
when the PMKID List contains two entries, and an entry corresponds to a PMK-MA that was created by the mesh point during Initial EMSA Authentication, then the local PMKID is valid.
9. A method as claimed in claim 7 , wherein the mesh point determines whether the cached peer key exists by:
examining a PMKID List received from the neighbor node in a peer link open message; and
when the entry that corresponds to a Mesh Authenticator Pairwise Master Key (PMK-MA) that was created by the neighbor node during its initial efficient mesh security association (EMSA) authentication identifies a key that is locally cached at the mesh point, then the cached peer key exists.
10. A method as claimed in claim 6 , wherein the assigning a role of an 802.1x authenticator and a role of an 802.1x supplicant to the mesh points based on the configuration of each of the mesh points comprises:
assigning the 802.1x authenticator role to the mesh point when the neighbor node is not connected to a mesh key distributor (MKD) and the mesh point is connected to the MKD;
assigning the 802.1x authenticator role to the neighbor node when the neighbor node is connected to the MKD and the mesh point is not connected to the MKD;
assigning the 802.1x authenticator role to the mesh point when the neighbor node and the mesh point are connected to the MKD and the local MAC is greater than the neighbor node MAC; and
assigning the 802.1x authenticator role to the neighbor node when the neighbor node and the mesh point are connected to the MKD and the local MAC is less than the neighbor node MAC.