Technique to establish wireless session keys suitable for roaming

[0001] This invention relates to authentication technologies generally and particularly to authentication techniques in a wireless network.

[0002] A wireless network is a flexible data communication medium implemented as an extension for, or as an alternative to, a wired network. By using radio frequency (RF) technology, wireless networks transmit and receive data over air, minimizing the need and the cost typically associated with wired connections. Moreover, wireless networks offer mobility and flexibility for users. For example, doctors and nurses in hospitals are able to use hand-held devices or notebook computers to access patient information from a server through wireless networks without having to search for a physical jack to plug their devices or computers into.

[0003] FIG. 1 demonstrates a prior art wireless network configuration. Specifically, the network configuration comprises wireless stations 108 and 110, wireless medium 106 and access points 100, 102 and 104. Wireless stations 108 and 110 communicate with access points 100, 102 and 104 through electromagnetic airwaves 106. Access points 100, 102 and 104 are also connected to wired network 112 and have access to the network resources of wired network 112 such as, server 114, network printer 116 or other devices coupled to wired network 112. It should be noted that wireless stations 108 and 110 are not stationary and do not have to communicate with particular multiple access points. For instance, wireless station 108 may seamlessly move from the coverage area of access point 100 to the coverage area of access point 104 and still maintain its data connections with the access points.

[0004] Despite the portability and the convenience that wireless technology offers, there still lacks a comprehensive security scheme to ensure privacy and integrity of the data on wireless networks. For instance, one existing approach is to utilize static keys to encrypt data on a wireless link. Such encrypted data are vulnerable to attack, because the probability of deciphering them is much greater than if the data were encrypted with constantly changing keys. Another approach involves a wireless station sharing a group key with an access point. Thus, when any one device on a wireless network falls into the hands of an attacker, the security of every system in the network is compromised. Yet another approach has every wireless station share one key. As a result, any wireless station is capable of decrypting the traffic of any other wireless.

[0005] As has been demonstrated, an improved method and an apparatus are needed to enhance the security of a wireless network.

[0013] A method and an apparatus for establishing secured roaming are disclosed. In the following description, numerous specific details are set forth, such as Kerberos protocol, etc. in order to provide a thorough understanding of the present invention. However, it will be apparent to one of ordinary skill in the art that the invention may be practiced without these particular details. In other instances, well-known elements and theories such as cryptography systems, etc. have not been discussed in special details in order to avoid obscuring the present invention.

[0014] In addition, the term, “wireless station”, is used throughout the following discussion to refer to any network device that uses some wireless Local Area Network (hereinafter LAN) technology to communicate with a wired network. It can be either an end system or a switching element. Also, a “secured” session refers to information exchanges between two networking devices, where some form of security measures safeguard such exchanges. A “replay attack” describes one form of an attack on a security system. Specifically, a perpetrator who launches such an attack intercepts messages destined for a recipient and replays those intercepted messages back to the recipient.

[0015] Unless specifically stated otherwise, the term, “Kerberos protocol”, refers to Kerberos Version 5, released on May 5, 1995. It is an authentication protocol that allows entities to authenticate their identities to one another over physically insecure networks and at the same time still prevents eavesdropping and replay attacks. It also incorporates cryptography systems to further provide for data stream integrity (such as detection of modification) and secrecy (such as preventing authorized reading). The Kerberos protocol operates within the Kerberos infrastructure, which comprises, but not limited to, the following:

• [0016] 1) Key Distribution Center (KDC): maintains and controls the distribution of session keys. A KDC is also considered as a special type of an authentication server in the following discussions.
• [0017] 2) Session key: information that enables two systems to establish a secured session. Session keys have limited life span. Thus, if a secured session is not established within a certain period of time, a new session key is needed.
• [0018] 3) Kerberos client: initiates key distribution from the KDC and then uses the distributed session key to initiate a session with a peer.
• [0019] 4) Kerberos server: the peer system with which the Kerberos client wishes to establish a secured session.
• [0020] 5) Ticket: a Kerberos data structure that grants access of the Kerberos client to the Kerberos server.
• [0021] 6) Authenticator: a Kerberos data structure that Kerberos client uses to authenticate itself to a Kerberos server and also to challenge the Kerberos server to authenticate itself to the Kerberos client.
• [0022] 7) Response: a Kerberos data structure that the Kerberos server uses to authenticate itself to the Kerberos client.

[0023] FIG. 2 illustrates one embodiment of the present invention or secured wireless roaming system (hereinafter SWRS) 200. SWRS 200 comprises one or more specially configured wireless stations, such as wireless station 202, at least two specially configured access points, such as access points 206 and 208 and authentication server 210. Access points 206 and 208 are coupled to authentication server 210 via wired network 212 and are further coupled to wireless station 202 via wireless network 204. Authentication server 212 is responsible for maintaining and providing security information and safeguarding the integrity of wired network 212 and wireless network 204. The interactions among access points 206 and 208, wireless station 202 and authentication server 210 for creating a secured roaming environment will be discussed with examples in the subsequent section that details the operations of SWRS 200.

[0024] FIG. 3(a) illustrates a block diagram of one embodiment of wireless station 202. Wireless station 202 comprises control unit 300, transmitter 302, receiver 304, filter 306 and antenna 308. Control unit 300 is mainly responsible for, but not limited to, preparing data for transmission and consuming received data. One embodiment of control unit 300 includes two functional blocks: encryption/decryption engine 314 and authentication protocol engine 316. An alternative embodiment of control unit 300 may also incorporate a frequency channel selector to dynamically choose an appropriate frequency channel for wireless station 202. Encryption/decryption engine 314 encrypts data that wireless station 202 transmits and decrypts data that wireless station 202 receives with appropriate keys. Additionally, authentication protocol engine 316 contains procedures for wireless station 202 to adhere to in order to further protect the overall integrity of wireless network 204 and wired network 212. Specific examples of the mentioned authentication procedures will be provided in the subsequent section.

[0025] Transmitter 302 and receiver 304 share antenna 308. On receive path 310, filter 306 filters out signals received by antenna 308 that are outside of a predetermined frequency range. Receiver 304 is then responsible for extracting data from the filtered signals and passing the resulting data to control unit 300. On transmit path 312, control unit 300 sends prepared data to transmitter 302. Transmitter 302 modulates the prepared data with a carrier of proper frequency and sends the modulated signal to filter 306. Filter 306 again eliminates spurious signal outside of the desired frequency range before transmitting the final filtered signal through antenna 308.

[0026] FIG. 3(b) demonstrates a block diagram of one embodiment of access point 206 (or access point 208). Similar to wireless station 202, access point 206 also has control unit 318, transmitter 320, receiver 322, filter 324 and antenna 326. Its control unit 318 has encryption/decryption engine 324 and authentication protocol engine 326 that perform the same functions for access point 206 as encryption/decryption engine 314 and authentication protocol engine 316 do for wireless station 202. In addition, access point 206 has wired-network connection interface 328 to communicate with wired network 212 as shown in FIG. 2.

[0027] One specific embodiment of SWRS 200 mainly applies the Kerberos protocol to secure communications among wireless station 202 and access points 206 and 208. In other words, authentication protocol engine 316 (FIG. 3(a)) of wireless station 202 and authentication protocol engine 336 (FIG. 3(b)) of access points 206 and 208 are specially configured to execute authentication procedures and to handle data structures specified by the Kerberos protocol. However, these mentioned authentication protocol engines 316 and 336 also perform tasks that are either absent or distinct from the Kerberos protocol.

[0028] FIG. 4 describes a flow chart of one process that one embodiment of wireless station 202 follows. This figure assumes the following: 1) authentication server 210 as shown in FIG. 2 is the KDC; 2) wireless station 202 does not yet have the session key to set up a secured session with access point 206, or session_key₂₀₆; 3) wireless station 202 is currently in the coverage area of access point 206 and will “roam” in the coverage area of access point 208; 4) access points 206 and 208 share one group identification, ID_g; and 5) the session key for wireless station 202 to establish a secured session with access point 208 is denoted as session_key₂₀₈.

[0029] In conjunction with FIGS. 2 and 3, instead of acting like a Kerberos client as in a typical application of the Kerberos protocol, authentication protocol engine 316 instructs wireless station 202 to behave as a Kerberos server and provides access point 208 with its identity information in block 400. Then authentication protocol engine 316 waits to respond to access point 206's attempt to establish a secured session using the newly obtained session_key₂₀₆ in block 402. A session is considered secured when wireless station 202 and access point 206 complete their mutual authentication within the lifetime of session_key₂₀₆. After authentication protocol engine 316 confirms that a secured session has been established in block 404, wireless station 202 obtains ID_g from access point 206 in block 406. ID_g enables wireless station 202 to access all the access points that share the same ID_g, such as access point 208.

[0030] However, wireless station 202 cannot proceed to establish a secured session with access point 208 unless it has another valid session key, or session_key₂₀₈. As wireless station 202 moves into the coverage area of access point 208, authentication protocol engine 316 switches wireless station 202's role back to being a Kerberos client and requests for session_key₂₀₈ from authentication server 210 in block 408. It is important to note that in a typical application of the Kerberos protocol, a Kerberos client needs to have the identity information of a peer system prior to initiating a session with such a system. In contrast, one embodiment of wireless station 202 simply uses session_key₂₀₈ and ID_g to initiate a session with access point 208 in block 410.

[0031] FIG. 5 illustrates a flow chart of one process that one embodiment of access point 206 (FIG. 2) follows. This figure also relies on the same five assumptions described above. In parallel to the discussion for wireless station 202 above, authentication protocol engine 336 instructs access point 206 to behave as a Kerberos client instead of a Kerberos server. Thus, access point 206 initiates session key distribution from authentication server 210 and attempts to establish a secured session with wireless station 202 using session_key₂₀₆ in block 500. After a secured session has been established in block 502, authentication protocol engine 336 provides wireless station 202 with ID_g in block 504.

[0032] Authentication protocol engine 336 then dictates access point 206 to serve as a proxy, or a relay agent, for wireless station 202. As a result, when access point 206 receives a session key request message, such as a ticket request message, from wireless station 202, encryption/decryption engine 334 decrypts the message and authentication protocol engine 336 relays the decrypted message to authentication server 210 in block 506. Similarly, authentication protocol engine 336 also relays session_key₂₀₈ from authentication server 210 to wireless station 202 after the session key becomes available. However, before the actual relay occurs, authentication protocol engine 336 appends certain information to session_key₂₀₈ to set the lifetime of the session key in block 508. In one embodiment, authentication protocol engine 336 selects and appends the current time of day, T, and a random number, N, to the session key.

[0033] In addition to the block diagrams as shown in FIGS. 2, 3(a) and 3(b) and flow charts as shown in FIGS. 4 and 5, the following tables further demonstrate implementation details of one embodiment of SWRS 200. Phase 1 corresponds to blocks 400, 402 and 404 as illustrated in FIG. 4 and blocks 500, 502 and 504 as illustrated in FIG. 5. Phase 2 corresponds to blocks 408, 506 and 508. At last, phase 3 corresponds to block 410.

[0034]

Phase 1:
Actions	Explanations
Wireless station 202 →	Wireless station 202 sends its identity
access point 206: IDw	information to access point 206.
Access point 206 → KDC:	In addition to the identity information of
IDap 206, IDw, Nap 206	access point 206 and wireless station 202,
	access point 206 also creates and sends a
	randomly generated number, Nap 206, to
	KDC. This message that access point 206
	sends to KDC is also referred to as the
	ticket request message.
KDC → access point 206:	After KDC generates session key, K206,
E(Kw; K206, IDap 206,	KDC encrypts the session key with
Lap 206), E(Kap; K206,	encryption keys of wireless station 202, Kw,
Nap 206, Lap 206, IDw)	and of access point 206, Kap, and sends the
Note 1: The notation, E(K,	encrypted messages to access point 206.
***), means that *** is	These messages are also referred to as the
encrypted using encryption	ticket granting message.
key K.	Encryption/decryption engine 334 of access
Note 2: Session key, K206,	point 206 deciphers part of the ticket
has a lifetime of Lap 206.	granting message using the encryption key,
	Kap, that it already has knowledge of and
	passes on the decrypted message to
	authentication protocol engine 336.
	Authentication protocol engine 336
	proceeds to verify the value of Nap 206 to
	ensure that the integrity of the information
	from KDC has not been compromised.
Access point 206 →	Authentication protocol engine 336 of
wireless station 202: E(Kw;	access point 206, as has been discussed
K206, IDap 206, Lap 206),	before, has access point 206 act as a
E(K206; IDap 206, T1)	Kerberos client and sends its targeted
Note: T1 represents the time	Kerberos server, wireless station 202, a
that access point 206 issues	challenge message. A challenge message
this challenge message.	includes a ticket and an authenticator. In
	this case, the ticket is E(Kw; K206, IDap 206,
	Lap 206), and the authenticator is E(K206;
	IDap 206, T1).
Wireless station 202 →	Wireless station 202 has from time T1 to T1 +
access point 206: E(K206;	Lap 206 to authenticate itself to access
T1)	point 206 by sending this response
	message, E(K206; T1), to access point 206.
Access point 206 →	Access point 206 shares the group identity
wireless station 202:	information with wireless station 202.
E(K206; IDg)

[0035]

Phase 2
Actions	Explanations
Wireless station 202 → access point 206:	As has been mentioned in
E(K206; IDw, IDg, Nw)	prior sections, wireless
Note: Nw is a random number that wireless	station 202 has changed
station 202 generates.	back to being a Kerberos
	client. It generates and
	sends a ticket request
	message to access point
	206 secured by session key,
	K206.
Access point 206 → KDC: IDw, IDg, Nw	Access point 206 serves as
	a proxy for wireless station
	202.
KDC → access point 206: E(Kg; K208, IDw,	KDC responds to the ticket
Lap 208), E(Kw; K208, Nw, Lap 208, IDg)	request message with a
Note: KDC creates a second session key,	ticket granting message.
K208, to allow wireless station 202 to
establish a secured session with access
point 208. It is important to emphasize that
wireless station 202 relies on IDg and does
not need to depend on the identity
information of access point 208 to set up
the secured session. As a result, wireless
station 202 avoids executing the same
authentication sequences with access point
208 as it does with access point 206 and
shortens the time required to establish the
secured session with access point 208.
Access point 206 → KDC: E(K206; E(Kg;	Access point 206 selects a
K208, IDw, Lap 208), E(Kw; K208, Nw, Lap 208,	time to be T2, selects a
IDg), T2, E(Kg; N, IDw, T2))	random number N and
Note: Wireless station 202 may execute	appends T2 and E(Kg; N,
the phase 2 protocol at any moment during	IDw, T2) to the ticket
the time from T1 to T1 + L206.	granting message in order
	to enforce the lifetime of
	session_key208. This
	prevents wireless station
	202 from specifying an
	unauthorized value for T2.

[0036]

Phase 3
Actions	Explanations
Wireless station 202 → access	With the information that access point 208
point 208: IDw, E(Kw; K208,	receives, it can verify the identity of
Nw, L208, IDg), E(K208; IDw,	wireless station 202 and determine the
T2), E(Kg; N, IDw, T2)	validity period of session_key208 (i.e.
	from T2 to T2 + L208).
Access point 208 → wireless	The encrypted payload, E(K208; N', IDw),
station 202: E(K208; IDg),	protects wired network 212 against replay
E(K208; N', IDw)	attacks. In other words, because access
	point 208 keeps generating new N's,
	wireless station 202 could rely on the
	varying N's to detect attempts to replay
	messages from access point 208.
Wireless station 202 → access	Wireless station 202 proves that it indeed
point 208: E(K208; N')	has session_key208.

[0037] Thus, a method and an apparatus for establishing secured roaming have been disclosed. Although the secured wireless roaming system has been described particularly with reference to the figures, one with ordinary skill in the art may further divide or combine the functionality of its functional blocks. For example, an ordinarily skilled artisan may combine encryption/decryption engine 314 and authentication protocol engine 316 into one integrated component. Finally, despite the detailed discussion on Kerberos protocol, one of ordinary skill in the art could employ other authentication protocols without departing from the spirit and scope of the present invention.