Secure connection mechanism capable of automatically negotiating password between wireless client terminal and wireless access terminal

[0001] The present invention relates to a secure connection mechanism between a wireless client terminal and a wireless access terminal, more particularly to a secure wireless connection mechanism enabling a user to establish a wireless LAN secure connection between the wireless client terminal and the wireless access terminal merely by triggering a control button provided by an application software and turning a switch on the wireless access terminal such that a password required for the connection will be obtained automatically through negotiating therebetween.

[0002] Recently, with the rapidly developing of wireless LAN (simply referred to as WLAN) technique and increasing population of wireless LAN product, all trades and professions have been deeply experienced the following benefits brought by the wireless LAN:

[0003] (1) For mobile-worker working among offices and remote commuters desiring to contact with offices, the wireless LAN not only can save many time but also solve the problem of connecting to office's LAN in a direct access way. Thus, the connection can be established in the twinkling of an eye and the connection can be performed at any physical position within the scope of wireless LAN without looking for a network connection port or a cable, or relying on help of professionals.

[0004] (2) Workers at any location of building can hold connection at any moment through the wireless LAN and obtain on-line data so as to substantially increase efficiency and quality of work. Because of the wireless LAN, modifications of the working locations of workers and even the whole office become easier.

[0005] (3) Owing to wireless LAN, integration between new devices (such as Personal Digital Assistant (PDA) and Tablet PC) and enterprise becomes easier and more efficient. For work environments, for example, multi-story factories, warehouses, multi-story stores, sickrooms in hospitals, and restaurants, which were originally difficult to set up LANs, LAN access environments can be easily provided for them in lower cost due to the mature wireless LAN technique. The environments, for example, the outdoors, the coast, and even battlefields, will become environments that provide LAN data access while they have no LAN before.

[0006] Owing to consideration for connection security, numerous applications of wireless LAN are limited in despite of their aforementioned advantages. More especially for territories such as financial markets and government organizations that require exacting security, extremely high risk is existed if secret data are broadcasted to any person nearby through the wireless LAN. Therefore, after the problem of connection security in the first generation of wireless LAN is found, every LAN group and security institution tries to solve the problem. Institute of Electrical and Electronic Engineers (IEEE) in USA and many standard physical alliances positively try to redefine and improve security standard of wireless LAN so as to provide consumer or enterprise with higher confidence to dispose and use wireless LAN.

[0007] Thereafter, according to the standards opened by the associations, such as IEEE, IETF and Wi-Fi Alliance, Microsoft Corporation provides two wireless LAN solutions, one of which is “Securing Wireless LANs—A Window Server 2003 Certificate Services Solution” that uses public key certificate to verify user and computer that utilize the wireless LAN, and the another of which relates to “Utilizing PEAP and Password to ensure the Security of Wireless LAN” that uses simple user name and password. Although these two solutions have very similar basic schemes and both of which are based on Microsoft Windows Server 2003 and client terminal of Microsoft Windows XP and Microsoft Pocket PC 2003, they have different target groups, wherein “Securing Wireless LANs—A Window Server 2003 Certificate Services Solution” mainly aims at large-scale organizations that requires very complicated information technique. The second solution that relates to “Utilizing PEAP and Password to ensure the Security of Wireless LAN” aims at small-scale organizations, such that the small-scale organization can easily dispose wireless LAN. The aforementioned difference does not mean that large-scale organizations cannot use password for verification or verification of certificate isn't suitable for small-scale organizations. It just means that certain specific technologies can possibly apply to certain organizations. In an example of Pre-Shared Key (PSK) stipulated in a protocol namely “Wi-Fi Protected Access (WPA)” made by Wi-Fi Alliance, the technique involved therein is more suitable for family, mini scale enterprise and office.

[0008] In general, the security issue is not as important as nowadays when the first IEEE 802.11 wireless standard is formulated, and level of security threat and complexity are lower than the present. The accepting degree of the general user and enterprise just in the stage of initial trying, and the accompanying security plan for first generation of wireless LAN, which is referred to Wired Equivalent Privacy (WEP), also underestimates the complexity of wireless security, which is classified to equal to the measurement standard of wired security. Thus, it does not satisfy practical requirements. After all, modern wireless LAN security plan should be designed to aim at insecure work environment that has no clear LAN physical. In general, the dynamic resetting of WEP is still secure for most purposes, but having the following problems:

[0009] (1) WEP utilizes different static key to perform global broadcast such as broadcast packet such that hacker may find out information, for example, IP address, computer name, and user name, that relate to LAN.

[0010] (2) The LAN framework that is protected by WEP does not have completed protections such that hacker may utilize password-compiling technique to modify information in the wireless LAN framework and renew check value for integrity in the framework.

[0011] (3) With progress of transmission speed of wireless LAN and improvement of operation ability and password-compiling technique, the WEP key needs to be minutely renewed that might cause a loading that RADIUD server cannot bear.

[0012] In order to solve the aforementioned problem, IEEE develops a new wireless security standard, which is referred to as 802.11i (also named as “robust security LAN (RSN)”). The previous 802.11i version issued by Wi-Fi alliance, which is composed of leading factories of Wi-Fi territory, is compatible with WPA (Wi-Fi Protected Access) of a standard specification. WPA includes large-scale subsets and, through issuing of WPA, Wi-Fi alliance can ask all equipments, which are labeled as Wi-Fi, to comply with WPA, and allow factories of Wi-Fi LAN hardware providing standardized high security options. WPA congregates methods that are under the impression that can ensure wireless LAN security, which mainly comprises two modes. One mode utilizes 802.1X and RADIUS verifications (simply referred to as WPA). The another mode is a simpler plan that utilizes pre-shared key and is suitable for SOHO environment (simply referred to as WPA-PSK). WPA combines powerful encryption functions with enhanced verification and authorization mechanisms that comply with 802.1X. WPA is able to provide the following functions for data protection so as to eliminate the aforementioned problems of WEP.

[0013] (1) Every packet utilizes a unique encrypted key.

[0014] (2) Longer initialization vector is utilized such that an additional 128 bit key data is added to efficiently increase key space.

[0015] (3) A signed message integrity check value that cannot be easily modified and cheated is newly added.

[0016] (4) An encrypted framework counter is incorporated so as to obstruct attack during re-execution.

[0017] Since the utilized encryption algorithm is similar to WEP that is used by user, it can be applied to existed hardware. In addition, the WPA-PSK mode allows small-scale organizations and home workers for using the pre-shared key in a condition that has no static WEP loophole. WPA that mainly uses RADIUS is identical with dynamic WEP. Individual encrypted key is generated in accordance with each wireless client terminal. Pre-shared key is used as a certificate for verification. Thus, if the user owns the key, then he is authorized to use wireless LAN and receive a unique encrypted key to protect data. The pre-shared key used in WPA not only provides a fundamental structure for small organizations under very low price, but also provides a very good level of security supported by many hardware.

[0018] But, both WEP and WPA require the related setting of index, password, or the like, which is inputted by user. Since it is inconvenient and not easy for most users to memorize password and perform complicated setting procedure, numerous users cannot get faultless protection because security mechanism is not enabled due to laziness or insufficient ability after the wireless LAN is set.

[0019] In view of the aforementioned wireless LAN security mechanism which needs the complicated setting procedure, the inventor has been made sustained researches and experiments to eventually develop a secure connection mechanism capable of automatically negotiating password between a wireless client terminal and a wireless access terminal of the present invention and to solve the aforementioned drawbacks of the prior art. It is expected that the password will be obtained by automatic negotiation if the user performs the simple actuation operation on the wireless client terminal and the wireless access terminal respectively, and therefore user does not need to perform complicated setting operation such that the wireless LAN secure connection is accomplished.

[0020] One object of the present invention is to apply it to families, mini scale enterprises, and offices such that user does not need to memorize password and perform the complicated setting procedure either. User just needs to trigger a control button provided by application software and turn a switch on the wireless access terminal such that a password required for connection will be obtained by automatic negotiation between the wireless client terminal and the wireless access terminal so as to establish a wireless LAN secure connection therebetween.

[0021] Another object of the present invention is to utilize the properties of RSA (Rivest-Shamir-Adleman) to establish the encryption/decryption mechanism between at least one wireless client terminal and at least one wireless access terminal. The mechanism enables an application software to produce two keys, one of which is a public key for encryption, and the another one is a private key for decryption. Another set of public key and private key are assigned to the wireless access terminal, wherein the another private key is stored in the wireless access terminal and the another public key is stored in the wireless client terminal. Therefore, the wireless client terminal can utilize the another public key to encrypt the public key, which is then added into a request joint packet. The request joint packet is then transmitted to the wireless access terminal. At the moment, since only the wireless access terminal owns the another private key, thus only the wireless access terminal can decrypt the public key of the wireless client terminal. Therefore, without having the another private key, illegal persons cannot decrypt the public key of the wireless client terminal even if they has intercepted the request joint packet.

[0022] Still another object of the present invention is to enable the wireless access terminal to encrypt a password (such as a passphrase or a WEP key) by means of the public key of the wireless client terminal, and then transmit it back to the wireless client terminal through a confirmation packet. At the moment, since only the wireless client terminal owns the private key capable of decrypting the password, without having the private key illegal persons cannot decrypt the password even if they has intercepted the confirmation packet. On the contrary, the password required for wireless secure connection can be obtained after the wireless client terminal utilizes the private key to decrypt the password.

[0023] Still another object of the present invention is to automatically negotiate the password required for a WPA-PSK connection so as to establish a connection relationship, which is compatible with WPA-PSK.

[0024] The above and other objects, features and advantages of the present invention will become apparent from the following detailed description taken with the accompanying drawings.

[0028] Generally speaking, RSA algorithm is an asymmetric encryption and decryption algorithm, which is jointly developed by Rivest (Massachusetts Institute of Technology), Shamir (Weizmann Institute of Science, Israel) and Adleman (University of Southern California), of which the encryption technique enables a sender to use a public key to encrypt data and a receiver to use a private key to decrypt the encrypted data, wherein the public key can be opened to the public while the private key is known merely by the private key owner and stored in a hard disk of a computer so as to become a part of a system configuration after being generated. The kind of encryption and identity verification technology is extensively applied to network applications, such as e-mail and e-commerce, and ensures data privacy such that person other than the e-mail recipient cannot decrypt data. Thus, data integrity is secured to prevent data from being modified. Meanwhile, the sender cannot deny the fact that he has sent the message. Therefore, it has very high importance while it is applied to practice domains such as e-commerce and so forth.

[0029] The present invention utilizes the features of RSA algorithm to design a secure connection mechanism capable of automatically negotiating password between a wireless client terminal and a wireless access terminal. The secure connection mechanism is established on at least one wireless client terminal 20 (or 21) (such as personal computer) and at least one wireless access terminal 10 (or 11) (such as wireless access point). Referring to FIG. 1, each of these wireless client terminals 20 (or 21) has a wireless transmitting and receiving module 202 (or 212) (such as wireless LAN card) such that each client terminal 20 (or 21) is able to establish a corresponding connection with each wireless access terminal 10 (or 11) in a wireless communication way through the wireless transmitting and receiving module 202 (or 212) on the wireless client terminal so as to establish an encryption and decryption mechanism which enables each of wireless client terminal 20 (or 21) to form two keys, one of which is a public key for encryption, and the another one is a private key for decryption. Another set of public key and private key is assigned to the wireless access terminal, wherein the another private key is stored in the wireless access terminal 10 (or 11), and the another public key is stored in the wireless client terminal 20 (or 21).

[0030] It is needed to note that because the another public key and the another private key assigned to the manufacturers of the wireless access terminals 10 (or 11) are different from one another, the another set of keys can be identified as a brand name of the manufacturer. As regards the public key and the private key of the wireless client terminal 20 (or 21), they are able to be generated when necessary. Alternatively, a plurality of sets of public key and private key can be pre-generated and stored in the wireless client terminal 20 (or 21) such that one set of them can be chosen for use if necessary.

[0031] Thereby, the wireless client terminal 20 (or 21) is able to utilize the another public key to encrypt its own public key and add the encrypted public key to a request joint packet, and then transmit the request joint packet to the wireless access terminal 10 (or 11). At the moment, only the wireless access terminal 10 (or 11) can decrypt the public key of the wireless client terminal 20 (or 21) since only the wireless access terminal 10 (or 11) owns the another private key. Thereafter, the wireless access terminal 10 (or 11) utilizes the decrypted public key of the wireless client terminal 20 (or 21) to encrypt a password (such as a passphrase or a WEP key), which is then transmitted back to the wireless client terminal 20 (or 21) through a confirmation packet. At the moment, because only the wireless client terminal 20 (or 21) has the private key that can decrypt the password, the encrypted password, which are necessary for wireless LAN secure connection between each other, will be obtained only when it is decrypted by the wireless client terminal 20 (or 21) by means of the private key.

[0032] According to the above description, please refer to FIG. 1 again, it is not necessary for the user to remember password and to perform the complicated setting procedure. The user only needs to trigger a control button 204 (or 214) provided on the wireless client terminal 20 (or 21), and then turn a switch button 101 (or 111) on the wireless access terminal 10 (or 11), such that the password needed for connection can be obtained by automatic negotiation between the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11) through the above encryption/decryption mechanism. Thus, the wireless LAN secure connection between one another is rapidly established.

[0033] In one preferred embodiment of the present invention, referring to FIG. 1, the wireless client terminal 20 (or 21) is provided with an application software, the control button 204 (or 214) and an output device 203 (or 213). When the wireless client terminal 20 (or 21) is turned on and the control button 204 (or 214) is triggered, the wireless client terminal 20 (or 21) executes the application software installed therein and performs the following processing steps, as shown in FIG. 2:

[0034] (301) Firstly, determine whether the control button 204 (or 214) is triggered or not; if yes, the output device 203 (or 213) outputs a prompt to instruct user to actuate the wireless access terminal 10 (or 11) and turn the switch button 101 (or 111) to the secure connection mode so as to perform the step (302); if not, then go to the step (307) when the secure connection mechanism between the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11) is established.

[0035] (302) Search the position of an adjacent wireless access terminal 10 (or 11), and get into contact with the wireless access terminal 10 (or 11) that is in the secure connection mode.

[0036] (303) Determine whether a joint packet sent from the wireless access terminal 10 (or 11) is received, if yes, use the another public key stored in the wireless client terminal 20 (or 21) to encrypt the public key, which is then attached to a request joint packet that will be transmitted to the wireless access terminal 10 (or 11). Then, go to the step (304). Otherwise, if the joint packet sent from the wireless access terminal 10 (or 11) is not received in a predetermined period, go back to the step (302), continuing to search an adjacent wireless access terminal 10 (or 11).

[0037] (304) Determine whether a confirmation packet sent from the wireless access terminal 10 (or 11) is received, wherein the confirmation packet includes a password for secure connection. If yes, utilize the private key to decrypt an encrypted password attached in the confirmation packet for obtaining the password for wireless LAN secure connection. Thereafter, send an accept packet to the wireless access terminal 10 (or 11) so as to perform the step (305). Otherwise, if the confirmation packet sent from the wireless access terminal 10 (or 11) is not received in a predetermined period, go back to the step (302) again, continuing to search an adjacent wireless access terminal 10 (or 11).

[0038] (305) the output device 203 (or 213) outputs another prompt to instruct user to turn the switch button 101 (or 111) to the normal mode. Then, go to the following step.

[0039] (306) Determine whether the wireless access terminal 10 (or 11) has been plugged in a secure connection state and turned back to the normal mode after the wireless access terminal 10 (or 11) receives a request packet. If yes, go to the step (307). Otherwise, if the wireless access terminal 10 (or 11) rejects to plug in the secure connection state, go back to the step (302) for searching an adjacent wireless access terminal 10 (or 11).

[0040] (307) Establish a secure connection that complies with WPA-PSK or WEP between the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11).

[0041] (308) Determine whether the secure connection that complies with WPA-PSK or WEP succeeds. If yes, then store related parameters for being used in subsequent connection. Otherwise, go back to the step (307) such that the secure connection that complies with WPA-PSK or WEP between the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11) is retained.

[0042] In the preferred embodiment, when a user turns the switch button 101 (or 111) on the wireless access terminal 10 (or 11) to the secure connection mode according to the prompt outputted by the output device 203 (or 213), the wireless access terminal 10 will actuate the secure connection mechanism to connect with the wireless client terminal 20 (or 21) according to the following steps, as shown in FIG. 3.

[0043] (401) Firstly, determine whether the secure connection mechanism is actuated and is in contact with the related wireless client terminal 20 (or 21) of which the secure connection mechanism has been actuated. If the secure connection mechanism is not actuated, or a contact with the related wireless client terminal 20 (or 21) is not established within a predetermined period, the secure connection mode is terminated so as to turn the wireless access terminal 10 (or 11) back to the normal mode. Otherwise, go to the step (402).

[0044] (402) Send out a joint packet to the related wireless client terminal 20 (or 21).

[0045] (403) Determine whether a request joint packet sent from the related wireless client terminal 20 (or 21) is received. If yes, then go to the following step (404). Otherwise, determine whether the number indicating that the request joint packet is not received exceeds a predetermined number. In the preferred embodiment, the predetermined number is three. If the number does not exceed the predetermined number, go to the step (402) for continuing to send out the joint packet to the related wireless client terminal 20 (or 21). If the predetermined number is exceeded, send a response packet out to the related wireless client terminal 20 (or 21) for indicating that it is rejected to plug-in the secure connection state.

[0046] (404) Determine whether the another private key held by the wireless access terminal 10 (or 11) be able to decrypt the public key sent from the wireless client terminal 20 (or 21). If yes, then go to the step (405). Otherwise, send a response packet out to the related wireless client terminal 20 (or 21) for indicating that it is rejected to plug-in the secure connection state.

[0047] (405) utilize the another private key to decrypt the encrypted public key and obtain the public key of the wireless client terminal 20 (or 21), and then utilize the public key to encrypt a password of a secure connection and attach the encrypted password to a confirmation packet, and send the confirmation packet out to the related wireless client terminal 20 (or 21).

[0048] (406) Determine whether an accept packet sent from the related wireless client terminal 20 (or 21) is received, wherein the accept packet denotes that the related wireless client terminal 20 (or 21) has accepted the encrypted password. If yes, then go to the step (407). Otherwise, determine whether the number for indicating that the accept packet is not received exceeds a predetermined number. In the preferred embodiment, the predetermined number is three. If the number does not exceed the predetermined number, go to the step (405) for continuing to send the confirmation packet out to the related wireless client terminal 20 (or 21). If the predetermined number is exceeded, send a response packet out to the related wireless client terminal 20 (or 21) for indicating that it is rejected to plug-in the secure connection state.

[0049] (407) Determine whether it is turned back to the normal mode. If yes, send a response packet to the related wireless client terminal 20 (or 21) denoting that the secure connection state has been plugged in. Otherwise, if the normal mode is not turned back within a predetermined period, send a response packet to the related wireless client terminal 20 (or 21) for indicating that it is rejected to plug-in the secure connection state.

[0050] (408) Determine whether it is needed to reboot. If yes, then reboot. Otherwise, the operation is completed.

[0051] It is needed to specially clarify that the switch button 101 (or 111) mounted on the wireless access terminal 10 (or 11) of the aforementioned embodiment is merely one preferred embodiment of the present invention. However, in the practical application, the present invention is not limited hereto, any person who skilled in the art may modify the switch button by means of other software, hardware, or combination thereof For example, the switch button may be modified as an adapter for receiving a connector of an Ethernet line (RJ-45). Therefore, when the connector of the Ethernet line (RJ-45) is plugged out of the adapter of the wireless access terminal 10 (or 11), the wireless access terminal 10 (or 11) is set to the secure connection mode. On the contaray, when the connector of the Ethernet line is plugged into the adapter of the wireless access terminal 10 (or 11), the wireless access terminal 10 (or 11) is set to the normal mode, and the purpose of switching between different modes is achieved.

[0052] In addition, the wireless client terminal 20 (or 21) mentioned above may be a personal computer 211 having a wireless network card, a wireless LAN printer server 201 or a wireless game adapter etc. installed therein. The wireless access terminal 10 (or 11) mentioned above may be a wireless hub, a wireless access point, a wireless router or a wireless gateway etc. Therefore, in case the wireless client terminal 21 is a personal computer 211, the output device 213 should be a display, such as a liquid crystal display, and the control button 214 should be an icon or button shown on the display. In case the wireless client terminal 20 is a wireless LAN printer server 201, the output device 203 should be an illuminating element, such as a light emitting diode (LED), and the control button 204 should be a switch disposed on the printer server.

[0053] Further, in case the output device 213 is a display, the prompt shown on the display may be an information comprising words and/or drawings for instructing user to turn the switch button on the wireless access terminal to the secure connection mode, and the another prompt shown on the display may be another information for instructing user to turn the switch button back to the normal connection mode. In case the output device 203 is an illuminating element, the situation of the light illuminated from the element (such as the blinking frequency or the position thereof) can be used to indicate the status of the wireless access terminal.

[0054] As described above, between the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11) that have wireless LAN card, the secure connection mechanism provided in the present invention enables the wireless client terminal to utilize the another public key of the wireless access terminal 10 (or 11) to encrypt its own public key within the predetermined period without having the user to operate complicated setting procedure. The encrypted public key is then added to a request joint packet. The request joint packet is then transmitted to the wireless access terminal 10 (or 11). Then, after the wireless access terminal 10 (or 11) utilizes the another private key to decrypt the encrypted public key and obtain the public key of the wireless client terminal 20 (or 21), the wireless access terminal 10 (or 11) utilizes the public key to encrypt a password which is then transmitted back to the wireless LAN terminal 20 (or 11). Finally, the wireless client terminal 20 (or 21) utilizes the produced private key to decrypt the encrypted password so as to obtain the password required for connection between the wireless client terminal 20 (or 211) and the wireless access terminal 10 (or 11), such that a secure connection therebetween is therefore established rapidly. In addition, it is difficult for Internet hackers to intercept and decrypt the public key and the password and further destroy the security of the wireless LAN within a shortly predetermined period because both of the wireless client terminal 20 (or 21) and the wireless access terminal 10 (or 11) are positioned in a handy space when the present invention is applied to families, mini scale enterprises and offices to enable the user to trigger the control button key shown on the wireless client terminal 20 (or 21) and turn the switch button 101 (or 111) of the wireless access terminal 10 (or 11) within a predetermined period for establishing a secure connection between thereof Accordingly, the secure connection mechanism of the present invention provides a simple, rapid, and secure connection mechanism for families, mini scale enterprises and offices.

[0055] While the invention has been described by means of specific embodiments, numerous modifications and variations could be made thereto by those skilled in the art without departing from the scope and spirit of the invention set forth in the claims.