Method for establishing a secure ad hoc wireless LAN

1. A method of authenticating an authenticating client to an authenticated client in an network comprising:

periodically and in response to receiving an start packet from the authenticating client, broadcasting an advertise packet;

receiving a packet from the authenticating client wherein if the authenticating client is an unauthenticated client, attempting to authenticate the authenticating client, attempting to authenticate the authenticating client comprising:

if the authenticating client attempts authentication using the same encryption type as the authenticated client, sending authentication packets;

if the authenticating client attempts authentication using a larger encryption type than the authenticated client, sending a cancel packet; and

if the authenticating client attempts authentication using a lower encryption type, sending authentication packets, if authentication is successful, configuring the authenticated client for secure communications, and if authentication is not successful, continuing to use encryption values in use prior to attempting to authenticate.

2. The method of claim 1 , wherein configuring the authenticated client for secure communication further comprises:

creating a random encryption key;

communicating to a LAN device at the authenticated client to start using the created random encryption key;

sending the authenticating client the random encryption key and a Unicast key;

resetting a timer value, the timer value specifying the length of time an encryption key has been in use; and

broadcasting an advertise packet.

3. The method of claim 1 wherein the advertise packet comprises an identity request, encryption types supported by the authenticating client, encryption type used by the authenticating client, a timer value indicating the length of time an encryption key has been used by the authenticating client, and a signature derived from the authentication key, the method further comprising:

examining at least one of the signature, timer value, and encryption type used by the authenticating client;

if the encryption type used by the authenticating client is a lower encryption type than the encryption type used by the authenticated client, attempting to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client; and

if attempting to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client succeeds:

changing to an encryption key, and encryption key index specified by a broadcast key;

communicating to a LAN device at the authenticated client to start using the encryption key;

resetting a timer value wherein the timer values specifies the length of time a particular encryption key has been in use; and

broadcasting an advertise packet.

4. The method of claim 3 further comprising if attempting to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client fails, causing the authenticated client to continue using encryption values used by the authenticated client before attempting to authenticate.

5. The method of claim 1 wherein the advertise packet comprises an identity request, encryption types supported by the authenticating client, encryption type used by the authenticating client, a timer value indicating the length of time an encryption key has been used by the authenticating client, and a signature derived from the authentication key, the method further comprising:

examining the signature and the timer value; and

if the advertise packet has a different signature than a signature being used by the authenticated client and the advertise packet has a smaller timer value than a timer value being used by the authenticated client, attempting to authenticate the authenticating client using the largest encryption type supported by both the authenticated client and the authenticating client that is no larger than the encryption type used by the authenticating client prior to attempting to authenticate the authenticating client; and

if attempting to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client that is no larger than the encryption type used by the authenticating client prior to attempting to authenticate the authenticating client succeeds:

changing to an encryption key and encryption key index specified by a broadcast key;

communicating to a LAN device at the authenticated client to start using the encryption key;

resetting a timer value wherein the timer values specifies the length of time a particular encryption key has been in use; and

broadcasting an advertise packet.

6. The method of claim 1 wherein the authenticated client is an unauthenticated client switched into authenticated mode in response to receiving an advertise packet and switching to authenticated mode.

7. The method of claim 1 further comprising re-keying on the passing of a certain amount of time or if a certain amount of data has been sent and received, re-keying comprising:

sending a start packet;

collecting any advertise packets received in response to the start packet;

determining the largest encryption type that is supported by the authenticated client and all clients sending advertise packets;

selecting an encryption type;

assigning a new encryption key, encryption index and signature of the selected encryption type;

communicating to a LAN device at the authenticated client to start using the new encryption key; and

broadcasting an advertise packet.

8. The method of claim 7 , wherein if the largest encryption type supported by any of the clients that advertise packets are received from is smaller than an encryption type currently being used by the authenticated client, selecting comprises continuing to use the current encryption type.

9. The method of claim 7 further comprising broadcasting start packets and collecting responses to the start packets to determine if other clients in the network are using the new encryption key.

10. A non-transitory computer readable medium on which is embedded a computer program, said computer program implementing a method of authenticating an authenticating client to an authenticated client in a network, said computer program comprising computer executable code to:

periodically and in response to receipt of a start packet from the authenticating client, broadcast an advertise packet;

receive a packet from the authenticating client wherein if the authenticating client is an unauthenticated client and attempt to authenticate the authenticating client, wherein the attempt to authenticate the authenticating client includes code to:

if the authenticating client attempts authentication using the same encryption type as the authenticated client, send authentication packets;

if the authenticating client attempts authentication using a larger encryption type than the authenticated client, send a cancel packet; and

if the authenticating client attempts authentication using a lower encryption type, send authentication packets, if authentication is successful, configure the authenticated client for secure communications, and if the authentication is not successful, continue to use encryption values in use prior to attempting to authenticate.

11. The non-transitory computer readable medium according to claim 10 , said computer executable code further comprising code to:

create a random encryption key;

communicate to a LAN device at the authenticated client to start using the created random encryption key;

send the authenticating client the random encryption key and a Unicast key;

reset a timer value, the timer value specifying the length of time an encryption key has been in use; and

broadcast an advertise packet.

12. The non-transitory computer readable medium according to claim 10 , wherein the advertise packet comprises an identity request, encryption types supported by the authenticating client, encryption type used by the authenticating client, a timer value indicating the length of time an encryption key has been used by the authenticating client, and a signature derived from the authentication key, the computer executable code further comprising code to:

examine at least one of the signature, timer value, and encryption type used by the authenticating client;

if the encryption type used by the authenticating client is a lower encryption type than the encryption type used by the authenticated client, attempt to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client; and

if an attempt to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client succeeds:

change to an encryption key, and encryption key index specified by a broadcast key;

communicate to a LAN device at the authenticated client to start using the encryption key;

reset a timer value wherein the timer values specifies the length of time a particular encryption key has been in use; and

broadcast an advertise packet.

13. The non-transitory computer readable medium according to claim 12 , the computer executable code further comprising code to:

if an attempt to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client fails, cause the authenticated client to continue using encryption values used by the authenticated client before the attempt to authenticate.

14. The non-transitory computer readable medium according to claim 10 , wherein the advertise packet comprises an identity request, encryption types supported by the authenticating client, encryption type used by the authenticating client, a timer value indicating the length of time an encryption key has been used by the authenticating client, and a signature derived from the authentication key, the computer executable code further comprising code to:

examine the signature and the timer value; and

if the advertise packet has a different signature than a signature being used by the authenticated client and the advertise packet has a smaller timer value than a timer value being used by the authenticated client, attempt to authenticate the authenticating client using the largest encryption type supported by both the authenticated client and the authenticating client that is no larger than the encryption type used by the authenticating client prior to attempting to authenticate the authenticating client; and

if an attempt to authenticate the authenticating client using the largest encryption type supported by both the authenticating client and the authenticated client that is no larger than the encryption type used by the authenticating client prior to the attempt to authenticate the authenticating client succeeds:

change to an encryption key and encryption key index specified by a broadcast key;

communicate to a LAN device at the authenticated client to start using the encryption key;

reset a timer value wherein the timer values specifies the length of time a particular encryption key has been in use; and

broadcast an advertise packet.

15. The non-transitory computer readable medium according to claim 10 , wherein the authenticated client is an unauthenticated client switched into authenticated mode in response to receiving an advertise packet and switching to authenticated mode.

16. The non-transitory computer readable medium according to claim 10 , the computer executable code further comprising code to:

re-key on the passing of a certain amount of time or if a certain amount of data has been sent and received by:

sending a start packet;

collecting any advertise packets received in response to the start packet;

determining the largest encryption type that is supported by the authenticated client and all clients sending advertise packets;

selecting an encryption type;

assigning a new encryption key, encryption index and signature of the selected encryption type;

communicating to a LAN device at the authenticated client to start using the new encryption key; and

broadcasting an advertise packet.

17. The non-transitory computer readable medium according to claim 16 , wherein if the largest encryption type supported by any of the clients that advertise packets are received from is smaller than an encryption type currently being used by the authenticated client, selecting comprises continuing to use the current encryption type.

18. The non-transitory computer readable medium according to claim 16 , the computer executable code further comprising code to:

broadcast start packets and collect responses to the start packets to determine if other clients in the network are using the new encryption key.