Wireless router assisted security handoff (WRASH) in a multi-hop wireless network
A wireless router assisted security handoff method ( 300 ) includes an efficient layer 2 security handoff for an infrastructure-based mobile multi-hop wireless network. The handoff is assisted with a wireless router ( 311 ) which is the first hop from the mobile station ( 301 ) to the new access point ( 307 ). The security context from the old access point ( 303 ) is first delivered to the mobile station ( 301 ) in a secure manner. The first handoff message ( 309 ) from mobile station ( 301 ) to the new access point ( 307 ) has three roles namely, re-association request, security context delivery and new session key generation handshaking. The first hop wireless router ( 311 ) vouches the freshness of the message contents and tunnels the message securely to the new access point ( 307 ). The second message ( 315 ) from the new access point ( 307 ) to the mobile station ( 301 ) completes the handoff process.
1. A method for a wireless router assisted security handoff in a multi-hop communications network comprising:
at a mobile station:
selecting a wireless router which is a first hop to an access point for assisting in a secure handoff;
retrieving a sequence number (SN) of the wireless router and an access point media access control (MAC) address (AA) of the access point from a hello message received from the wireless router;
generating a pairwise transient key (PTK) using the SN and the AA;
sending a first handoff message including a re-association request from the mobile station to the wireless router;
at the wireless router:
tunneling the first handoff message securely to the access point;
at the access point:
receiving the first handoff message from the wireless router;
generating the pairwise transient key (PTK) using the SN and the AA;
validating a message integrity of the first handoff message using the PTK;
generating a second handoff message including a re-association response using the PTK;
sending the second handoff message to the wireless router; and
at the wireless router:
tunneling the second handoff message securely to the mobile station; and
at the mobile station:
validating a message integrity of the second handoff message using the PTK; and establishing communications between the mobile station and the access point.
2. A method for a wireless router assisted security handoff as in claim 1 , wherein the first handoff message comprises one or more of a message identification (MID), a protected security context (PSC) of the mobile station, the sequence number (SN) of the wireless router, a MS_Nonce, the AA of the access point, a media access control (MAC) address of the mobile station (SPA), a wireless router address (WRA) and a message integrity code (MIC).
3. A method for a wireless router assisted security handoff as claimed in claim 1 , further comprising:
configuring a security context encryption key (SCEK) at all the network access points including the access point; and
decrypting the first handoff message received at the access point using the SCEK.
4. A method for a wireless router assisted security handoff as in claim 3 , wherein the access node is preconfigured with the SCEK.
5. A method for a wireless router assisted security handoff as in claim 1 , wherein a plurality of wireless routers are connected to form the multi-hop communication network.
6. A method for a wireless router assisted security handoff as in claim 1 , further comprising prior to the selecting step:
providing a security association between the wireless router and the access node when the wireless router joins the network.
7. A method for a wireless router assisted security handoff as in claim 1 , wherein the wireless router maintains information regarding the access node.
8. A method for a wireless router assisted security handoff as in claim 7 , wherein the information is comprised of a sequence number (SN), a broadcast SN, and a media access control (MAC) address.
9. A method for a wireless router assisted security handoff as in claim 7 , wherein the information is a hello message of the access node.
10. A method for a wireless router assisted security handoff as in claim 1 , wherein the validating by the mobile station of the second handoff message further comprises using the a sequence number (SN) and the media access control (MAC) address of the mobile station.
11. A method for a wireless router assisted security handoff as claimed in claim 1 , further comprising prior to the selecting step:
generating a handoff pairwise master key (PMK) at both a first access point and the mobile station during an initial mobile station authentication;
generating protected security context (PSC) data at the first access point by encrypting the handoff PMK and a media access control (MAC) address of the mobile station;
transmitting the PSC from the first access point to the mobile station during the initial mobile station authentication; and
transmitting the handoff PMK in the PSC data from the first access point to the access point via the mobile station after establishing communication between the mobile station and the access point.
12. A method for a wireless router assisted security handoff as in claim 11 , wherein the master key PMK is created with an initial PMK and the mobile station media access control (MAC) address.
13. A method for a wireless router assisted security handoff as in claim 11 , wherein the initial mobile station authentication includes the key management process.
14. A method for a wireless router assisted security handoff as in claim 11 , wherein the PTK is a secured re-association request message.
15. A method for a wireless router assisted security handoff as in claim 14 , wherein the secured re-association request message includes the PSC data and supplemental information for generating the PTK.
16. A method for a wireless router assisted security handoff as in claim 11 , wherein the age of the re-association request message is validated based on its sequence number.