Security authentication and key management within an infrastructure-based wireless multi-hop network
View Patent ↗A system and method of security authentication and key management scheme in a multi-hop wireless network is provided herein with a hop-by-hop security model. The scheme adapts the 802.11r key hierarchy into the meshed AP network. In this approach, a top key holder (R0KH) derives and holds the top Pairwise Master Key (PMK — 0 ) for each supplicant wireless device after the authentication process. All authenticator AP take the level one key holder (R 1 KH) role and receive the next level Pairwise Master Key (PMK — 1 ) from R 0 KH. The link level data protection key is derived from PMK — 1 via the 802.11i 4-way handshaking.
1. A method of security authentication and key management within an infrastructure-based wireless multi-hop network, the method comprising:
initially authenticating a supplicant including determining one or more authenticated supplicant role attributes with an authentication server;
obtaining one or more authorization attributes from the authentication server by a top level key holder;
determining whether the authenticated supplicant role attribute is a level one key holder by the top level key holder;
initiating a four-way handshaking between the top level key holder and the supplicant with a pair-wise master key (PMK)_ 0 to derive a Key Distribution Key (KDK) when the authenticated supplicant role attribute is a level one key holder; and
when the authenticated supplicant role attribute is not a level one key holder:
communicating a level one pair-wise master key (PMK)_ 1 from the top level key holder to a level one key holder,
initiating a four-way handshaking between the level one key holder and the supplicant with the level one pair-wise master key (PMK)_ 1 to generate a secure communication link between the supplicant and the level one key holder, and
communicating on the secure link between the level one key holder and the supplicant.
2. A method of security authentication and key management within an infrastructure-based wireless multi-hop network as claimed in claim 1 , wherein the four way handshaking between the top level key holder and the level one key holder comprises a 802.11i style four way handshaking to derive a KDK between the top level key holder and the level one key holder; and further wherein the four way handshaking between the level one key holder and the supplicant comprises a 802.11i style four way handshaking to derive a pair-wise transient key (PTK) between the level one key holder and the supplicant.
3. A method of security authentication and key management within an infrastructure-based wireless multi-hop network as claimed in claim 1 , wherein the KDK is derived as:
KDK=KDF-KDKLen(PMK — 0, “KDK Key derivation”, SNonce∥Anonce∥AA∥SPA)
where:
KDF-256 is a predefined number,
SNonce is a random number generated by the supplicant,
ANonce is a random number generated by the top level key holder,
the two random numbers are exchanged during the first two messages of the four-way handshaking,
AA is the top level key holder MAC address, and
SPA is supplicant MAC address.
4. A method of security authentication and key management within an infrastructure-based wireless multi-hop network as claimed in claim 1 , wherein the initial authentication step includes communication of a final “authentication success” message, and further wherein the one or more authorization attributes are obtained from the final “authentication success” message.
5. A method of secure authentication of a node within an infrastructure-based wireless multi-hop network as claimed in claim 1 , the method comprising further comprising:
initiating a re-authentication with an other level one key holder -by the supplicant, wherein the other level one key holder has been authenticated and connected to the top level key holder within a same mobility domain wherein the re-authentication comprises:
communicating a message using a fast handoff process from the supplicant to the other level one key holder;
communicating the level one pair-wise master key (PMK)_ 1 from the top level key holder to the other level one key holder;
completing a fast handoff between the other level one key holder and the supplicant using the level one pair-wise master key (PMK)_ 1 to generate a secure communication link between the supplicant and the other level one key holder; and
communicating on the secure link between the other level one key holder and the supplicant.