Patent ID: 6920559
Filing Date: 2005-07-19
Classification: H04L,H04W

Abstract:
1. A method of authenticating a client electronic system (client) to allow access to a network having a plurality of network access point electronic systems, said method comprising the steps of: a) performing a primary authentication protocol involving said client and a first network access point electronic system (first AP) such that a first encryption key is established between said client and said first AP; b) if said primary authentication protocol is successful, generating a key lease and a first encryption message of a second encryption key using said first encryption key, wherein said key lease comprises a data structure having a first identifier associated with said client, said first encryption key, said second encryption key for performing a secondary authentication protocol, a key lease period for indicating a length of time in which said key lease is valid, integrity function data for determining an unauthorized change to a first portion of said key lease, and a second identifier associated with a particular network access point electronic system group of a plurality of network access point electronic system groups, and further wherein a second portion of said key lease is encrypted using a third encryption key; c) transmitting via said network to said client said first encryption message and said key lease; d) if a second network access point electronic system (second AP) requests to authenticate said client, transmitting said first identifier and said key lease to said second AP; e) if said second AP is associated with said second identifier, retrieving said third encryption key corresponding to the second identifier; f) decrypting said second portion of said key lease using said third encryption key; and g) if said first identifier transmitted by said client matches said first identifier decrypted from said key lease, if said integrity function data decrypted from said key lease matches an integrity function performed on said first portion of said key lease, and if said key lease period has not expired, performing said secondary authentication protocol involving said client and said second AP, wherein said second encryption key is used for encrypting communications between said client and said second AP during said secondary authentication protocol.