Source: http://www.google.com/patents/US8126145?dq=4316055
Timestamp: 2014-03-16 21:32:11
Document Index: 485093927

Matched Legal Cases: ['Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'art 11', 'art 2', 'art 11', 'art 11', 'art 11', 'art 11', 'art 2', 'art 11', 'art 11', 'art 11', 'art 11']

Patent US8126145 - Enhanced association for access points - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsThe invention relates to a method for associating a client with an access point using a security protocol. The method may include initiating a handshake and exchanging operational information between the access point and the client, establishing an encrypted operational key if the operational information...http://www.google.com/patents/US8126145?utm_source=gb-gplus-sharePatent US8126145 - Enhanced association for access pointsAdvanced Patent SearchPublication numberUS8126145 B1Publication typeGrantApplication numberUS 11/359,944Publication dateFeb 28, 2012Filing dateFeb 21, 2006Priority dateMay 4, 2005Publication number11359944, 359944, US 8126145 B1, US 8126145B1, US-B1-8126145, US8126145 B1, US8126145B1InventorsClaudius Tewari, Brian Bosso, Chor-Teck Law, Heng-Jui H. Hsu, James Chieh-Tsung Chen, James Chih-Shi YeeOriginal AssigneeMarvell International Ltd.Export CitationBiBTeX, EndNote, RefManPatent Citations (44), Non-Patent Citations (26), Referenced by (14), Classifications (14), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetEnhanced association for access pointsUS 8126145 B1Abstract The invention relates to a method for associating a client with an access point using a security protocol. The method may include initiating a handshake and exchanging operational information between the access point and the client, establishing an encrypted operational key if the operational information is validated and entering an operational phase using the operational key and an unique service set identifier if valid.
What is claimed is: 1. A method to authenticate an access point with a client, the method comprising:
CROSS-REFERENCE TO RELATED APPLICATIONS This present application claims priority to U.S. Provisional Patent Application No. 60/678,269, filed on May 4, 2005, U.S. Provisional Patent Application No. 60/684,365, filed on May 25, 2005, U.S. Provisional Patent Application No. 60/693,459, filed on Jun. 22, 2005, and U.S. Provisional Patent Application No. 60/709,977, filed Aug. 19, 2005, each of which is incorporated herein by reference in its entirety.
TECHNICAL FIELD The invention relates to communication systems and methods.
BACKGROUND OF THE INVENTION The recent explosion of wireless networks in residential and enterprise environments demands advanced security methods and standards. In a conventional wireless local area network (WLAN), an access point (AP) connects users to other users within a given network through a series of encryption and decryption schemes.
SUMMARY OF THE INVENTION According to one aspect, a method is disclosed to automatically associate a client with an access point using a security protocol. The method includes initializing a communication request by one of an access point and a client, generating a key and transmitting the key and a unique service set identifier identifying the access point to the client. The client associates with the access point using at least one of the key and the unique service set identifier, and initiates a handshake request from the client. Upon receiving the handshake request, the access point participates in a handshake, exchanging operational information during a key exchange between the access point and the client. The access point establishes an encrypted operational key if the key exchange is authenticated, and enters an operational phase using the operational key and the unique service set identifier.
DESCRIPTION OF DRAWINGS The accompanying drawings, which are incorporated into and form a part of the specification, illustrate several aspects and implementations of the present invention and, together with the general description given above and detailed description given below, serve to explain the principles of the invention. The drawings are only for the purpose of illustrating preferred embodiments of the invention and are not to be construed as limiting the invention. In the drawings:
Usage Models The flexibility and security of the process allows the system to support a wide range of Home/SOHO usage models, which may include, but are not limited to, home and SOHO Wi-Fi network, WPA-personal or WPA-2 personal, auto-link-capable stations or legacy stations, open and WEP-only modes, and guest access. The process can advantageously be used in infrastructure mode IEEE 802.11 networks, and may also be extended to function in ad-hoc networks.
Initiation of the Association Process The process begins with an initiation process. In one implementation, the client includes a button or other activation device, in hardware or software, or combination thereof. In one implementation, only the client can initiate an association. A user can activate the button in a predetermined pattern to signal the initiation to the AP.
Operation Association between an AP and an client occurs in several phases, as illustrated in FIG. 3 including an initialization phase 302, a passport control phase 304, a passport authenticate phase 306 and an operation phase 308. In one implementation, in the initial passport control phase 304, association is initialized using a pair-specific Lifeline key (sometimes referred to herein as the VISA key) and an AP-specific SSID (ASSID) as is discussed below. If Simple Access is chosen, an unauthenticated Simple Handshake is performed. Alternatively, if Authenticated Access is selected, a Secure Handshake with Password-based Authenticated Key Exchange (PAKE) is, by default, executed during the passport authenticate phase 306. After a successful handshake (either authenticated or otherwise), an operational key is established for use in the operational phase 308, in which association is authenticated using the operational key and the ASSID.
Authenticated Access FIG. 5A is a flow diagram of an exemplary Authenticated Access process for associating an AP with a client. Specifics with respect to the AP and the client will be discussed in FIGS. 5B and 5C, respectively.
H i ⁡ ( � ) = ( h ⁡ ( i , � , i ) ) p - 1 q mod p or Hi(�)=ζh i (i,�,i) mod p, where h(�) is a strong one way hash and ζ is another generator of Gq. Let ACCEPTABLE(�) denote an acceptable function which may return true if its pre-image satisfies the given security properties.
C→S:C,gxγAfter or before sending a first message, the client C computes γ′ and the user's amplified password such that ω=u−1(x+m)mod q by obtaining u=h1(C,π), while waiting for a second message.
S→C:νy,h2(C,S,m,μ,β,γ′)After or before sending a second message, the server S computes k′2=h3(C,S,m,μ,β,γ′) while waiting for a third message. The server S aborts if the message times out.
Guest Access The association process may allow guest access using, in one implementation, multiple SSIDs. A guest SSID may be established in addition to any existing SSID, and a separate VISA key may be generated for the passport control phase based on the guest SSID. A guest operational key different from that used in the Simple Access process or the Authenticated Access process may be employed in the operational phase. The Guest SSID may be used when the process cannot be activated on the default SSID, in order to limit access to certain subnets, with a virtual local area network (VLAN), applications or AP ports, in association with timing constraints under which guest access expires or limitations related to resource utilization (e.g., bandwidth).
Example A Consumer Electronics: Game Console and Peripheral Connecting a Game Console and a Controller Using Simple Access Process To securely associate a game console with a controller, the process may include, but not be limited to, connecting a game console with a controller using the Simple Access process; powering up the game console (AP) and its peripherals (e.g., enrollee and client); pressing buttons on both game console and controller; observing LED on the controller to indicate that the association is successful. (e.g., to indicate that the game console has been configured, and settings have been transferred to the controller); and using the controller to access the game console to perform functions such as selecting games/modes, sending physical coordinates, and sending/receiving audio/video. In order to add a second controller after purchasing controller, a user presses buttons on both the game console and controller, and waits for the LED to indicate that the association is successful. (e.g., the game console has successfully transferred all required settings to the controller).
Example B Home Network: AP and PC Client Setting up/Connecting an Access Point or Wireless Home Gateway/Router using Authenticated Access Mode For home network, configuring a router using Authenticated Access may include, but not be limited to, locating a WiFi label on the router indicating that it supports Authenticated Access; powering up the router; pressing a button on the router and a client card; the client card prompting the user to enter an Access Code located on the router; visually acquiring the Access Code and entering the Access Code via the client card utility GUI; and observing the LED to indicate that the router has been configured successfully. In this example, the configuration settings, including self-generated SSID, operational key, and other operational parameters, also can be transferred from the AP to the client card during the association.
Example C Consumer Electronics: VoIP Handset and Base Unit Setup/Connecting Wireless Voice Base Unit and Handsets in Authenticated Access Mode (Wifi Telephony) Typically, a cordless/WiFi phone contains a base unit and handset. Alternatively, the base unit and the handset can be sold separately. An association between the base unit and the handset can be configured in one of two ways. First, the manufacturer may provide an Access Code label (e.g., unique 10-digit alphanumeric pass-phrase followed by a # sign: �SKYPE12345#�) attached to the base unit and manuals documenting simple instructions requesting a user to enter the pass-phrase when prompted.
Example D Home/SOHO Network: Multi-Function AP with Guest Network A conventional home gateway/router device may generally support both the Simple Access process and the Authenticated Access process through the use of 2 separate BSSs. The Simple Access process can be used for a guest network, which provides an express way to use a general internet connection, printer sharing, or media streaming. However, unlike the Authenticated Access process which allows devices to have complete privacy on a private network, devices connected to a guest network may have limited access and may be isolated from the private network.
Security In the association process, it is advantageous in some implementations to use only existing security mechanisms for the Home/SOHO wireless network; namely, WPA-PSK and WPA2-PSK. When used properly, these mechanisms are sufficient to secure the intended applications. This not only allows the process to be employed on existing hardware, it also does not hinder the development of enhanced security mechanisms.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5886699 *Jul 21, 1997Mar 23, 1999Microsoft CorporationMethod and system for transferring data to common destinations using a common destination listUS7096500 *Dec 21, 2001Aug 22, 2006Mcafee, Inc.Predictive malware scanning of internet dataUS7236471Feb 18, 2004Jun 26, 2007Autocell Laboratories IncProgram for associating access points with stations in a wireless networkUS20040165549Feb 18, 2004Aug 26, 2004Floyd BackesProgram for associating access points with stations in a wireless networkUS20040165556Feb 18, 2004Aug 26, 2004Floyd BackesDistance determination method for use by devices in a wireless networkUS20040165557Feb 18, 2004Aug 26, 2004Floyd BackesWireless channel selection method including scanning logicUS20040166837Feb 18, 2004Aug 26, 2004Floyd BackesProgram for associating access points with stations using bid techniquesUS20040166844Feb 18, 2004Aug 26, 2004Floyd BackesMethod for self-adjusting power at a wireless station to reduce inter-channel interferenceUS20040166845Feb 18, 2004Aug 26, 2004Floyd BackesWireless station protocol programUS20040166846Feb 18, 2004Aug 26, 2004Floyd BackesProgram for adjusting channel interference between access points in a wireless networkUS20040166847Feb 18, 2004Aug 26, 2004Floyd BackesProgram for adjusting channel interference between devices in a wireless networkUS20040166848Feb 18, 2004Aug 26, 2004Floyd BackesMethod for selecting an optimum access point in a wireless network on a common channelUS20040166850Feb 18, 2004Aug 26, 2004Floyd BackesWireless station protocol apparatusUS20040166851Feb 18, 2004Aug 26, 2004Floyd BackesMethod for adjusting channel interference between access points in a wireless networkUS20040166866Feb 18, 2004Aug 26, 2004Floyd BackesApparatus for selecting an optimum access point in a wireless networkUS20040166868Feb 18, 2004Aug 26, 2004Floyd BackesWireless channel selection apparatus including scanning logicUS20040166870Feb 18, 2004Aug 26, 2004Floyd BackesDistributed protocol for use in a wireless networkUS20040166871Feb 18, 2004Aug 26, 2004Floyd BackesApparatus for self-adjusting power at a wireless station to reduce inter-channel interferenceUS20040170140Feb 18, 2004Sep 2, 2004Floyd BackesMethod for selecting an optimum access point in a wireless networkUS20040190470Feb 18, 2004Sep 30, 2004Floyd BackesWireless station protocol methodUS20040190478Feb 18, 2004Sep 30, 2004Floyd BackesApparatus for selecting an optimum access point in a wireless network on a common channelUS20040192278Feb 18, 2004Sep 30, 2004Floyd BackesProgram for selecting an optimum access point in a wireless network on a common channelUS20040192279Feb 18, 2004Sep 30, 2004Floyd BackesProgram for scanning radio frequency channelsUS20040192300Feb 18, 2004Sep 30, 2004Floyd BackesTransmission channel selection methodUS20040192325Feb 18, 2004Sep 30, 2004Floyd BackesWireless network apparatus and systemUS20040202122Feb 18, 2004Oct 14, 2004Floyd BackesWireless access point protocol programUS20040202130Feb 18, 2004Oct 14, 2004Floyd BackesApparatus for associating access points with stations in a wireless networkUS20040203688Feb 18, 2004Oct 14, 2004Floyd BackesApparatus for adjusting channel interference between access points in a wireless networkUS20040203689Feb 18, 2004Oct 14, 2004Floyd BackesProgram for self-adjusting power at a wireless station to reduce inter-channel interferenceUS20040248580Feb 18, 2004Dec 9, 2004Floyd BackesTransmission channel selection apparatusUS20050020266Feb 18, 2004Jan 27, 2005Floyd BackesDistance determination apparatus for use by devices in a wireless networkUS20050026610Feb 18, 2004Feb 3, 2005Floyd BackesMethod for scanning radio frequency channelsUS20050026611Feb 18, 2004Feb 3, 2005Floyd BackesWireless access point protocol methodUS20050070264Feb 18, 2004Mar 31, 2005Floyd BackesDistance determination program for use by devices in a wireless networkUS20050090241Feb 18, 2004Apr 28, 2005Floyd BackesWireless network architectureUS20050090250Feb 18, 2004Apr 28, 2005Floyd BackesApparatus for associating access points with stations using bid techniquesUS20060070130 *Sep 27, 2004Mar 30, 2006Microsoft CorporationSystem and method of identifying the source of an attack on a computer networkUS20060075500 *Oct 1, 2004Apr 6, 2006Bertman Justin RSystem and method for locating malwareUS20060101282 *Nov 8, 2004May 11, 2006Microsoft CorporationSystem and method of aggregating the knowledge base of antivirus software applicationsUS20060130141 *Dec 15, 2004Jun 15, 2006Microsoft CorporationSystem and method of efficiently identifying and removing active malware from a computerUS20060165103 *Jan 26, 2005Jul 27, 2006Colubris Networks, Inc.Configurable quality-of-service support per virtual access point (vap) in a wireless lan (wlan) access deviceUS20060218393 *Mar 23, 2005Sep 28, 2006Hernandez Hendrich MSystems and methods for adaptive authenticationWO2004077711A2Feb 18, 2004Sep 10, 2004William R HaweSystem, method and apparatus for ascertaining a dynamic attribute of a systemWO2004077851A1Feb 18, 2004Sep 10, 2004Floyd BackesWireless access protocol system and method* Cited by examinerNon-Patent CitationsReference1"Draft Standard Specifications for Password-based Public Key Cryptographic Techniques," Mar. 28, 2005, IEEE 1363.2, 162 pages.2"Draft Supplement to Standard [for] Information Technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements-Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Further Higher Data Rate Extension in the 2.4 GHz Band", IEEE 802.11g, 2003.3"Draft Supplement to-Information Technology Telecommunications and Information Exchange Between Systems-Local Area Networks-Media Access Control (MAC) Bridges-Supplement for Support of IEEE 802.11", May 1998, LAN MAN Standard Committee of the IEEE Computer Society, P802.11c, 8 pages.4"IEEE Standard for Information technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements; Part 2: Logical Link Control," 1998, IEEE 802.2, 253 pages.5"Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Amendment 5: Spectrum and Transmit Power Management Extensions in the 6 GHz band in Europe" IEEE Std. 802.11h, 2003.6"Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Higher-Speed Physical Layer Extension in the 2.4 GHz Band", 1999, IEEE Std 802.11a, 91 pages.7"Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications; Amendment 3: Specification for Operation in Additional Regulatory Domains", 2001, IEEE Standard 802.11d, 34 pages.8"Part II: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Higher-Speed Physical Layer Extension in the 2.4 GHz Band", IEEE Std. 802.11b, 1999.9"Standard Specifications for Public Key Cryptography: Identity Based Key Agreement Scheme (IBKAS)", Jan. 29, 2008, IEEE 1363.3, 9 pages.10"TGn Sync Proposal Technical Specification", May 2005, IEEE Std. 802.11n, 131 pages.11"Draft Supplement to Standard [for] Information Technology�Telecommunications and information exchange between systems�Local and metropolitan area networks-Specific requirements�Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications: Further Higher Data Rate Extension in the 2.4 GHz Band", IEEE 802.11g, 2003.12"Draft Supplement to-Information Technology Telecommunications and Information Exchange Between Systems�Local Area Networks�Media Access Control (MAC) Bridges-Supplement for Support of IEEE 802.11", May 1998, LAN MAN Standard Committee of the IEEE Computer Society, P802.11c, 8 pages.13"IEEE Standard for Information technology�Telecommunications and information exchange between systems�Local and metropolitan area networks�Specific requirements; Part 2: Logical Link Control," 1998, IEEE 802.2, 253 pages.14Abdalla, Michel, et al. "DHIES: An Encryption Scheme Based on the Diffie-Hellman Problem", Sep. 18, 2001.15Diffie, Whitfield, et al., "New Directions in Cryptography", Jun. 3, 1976.16El Gamal, Taher, "A Pubic Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms", Advances in Cryptology-CRYPTO 84, LNCS 196, pp. 10-18, 1985.17El Gamal, Taher, "A Pubic Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms", Advances in Cryptology�CRYPTO 84, LNCS 196, pp. 10-18, 1985.18Harkins, et al., "The Internet Key Exchange (IKE)," The Internet Society, Nov. 1998.19IEEE Computer Society, "IEEE Standard for Information Technology-Telecommunications and Information Exchange Between Systems-Local and Metropolitan Area Networks-Specific Requirements-Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Amendment 6: Medium Access Control (MAC) Security Enhancements", IEEE Std 802.11i-2004.20IEEE Computer Society, "IEEE Standard for Information Technology�Telecommunications and Information Exchange Between Systems�Local and Metropolitan Area Networks�Specific Requirements�Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Amendment 6: Medium Access Control (MAC) Security Enhancements", IEEE Std 802.11i�2004.21IEEE Trial-Use Recommended Practice for Multi-Vendor Access Point Interoperability via an Inter-Access Point Protocol Across Distribution Systems Supporting IEEE 802.11 Operation, Jul. 14, 2003, IEEE Computer Society, 802.11f, 78 pages.22Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications-Amendment 8: Medium Access Control (MAC) Quality of Service Enhancements, IEEE Std. 802.11e, 2005.23Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications�Amendment 8: Medium Access Control (MAC) Quality of Service Enhancements, IEEE Std. 802.11e, 2005.24RSA Laboratories, PKCS #5 v2.0: Password-Based Cryptography Standard, Mar. 25, 1999.25Schaad, et al., "Advanced Encryption Standard (AES) Key Wrap Algorithm," The Internet Society, Sep. 2002.26Schneier, Bruce, Applied Cryptography, Second Ed., 1996, pp. 476-479.Referenced byCiting PatentFiling datePublication dateApplicantTitleUS8224256Jan 21, 2010Jul 17, 2012Fisher-Rosemont Systems, Inc.Wireless field maintenance adapterUS8537716 *Jul 28, 2006Sep 17, 2013Ca, Inc.Method and system for synchronizing access points in a wireless networkUS8644272 *Jul 14, 2008Feb 4, 2014Cradlepoint, Inc.Initiating router functionsUS20080025321 *Jul 28, 2006Jan 31, 2008Computer Associates Think, Inc.Method and System for Synchronizing Access Points in a Wireless NetworkUS20090029691 *Jul 25, 2007Jan 29, 2009Microsoft CorporationBase station initiated proximity service discovery and connection establishmentUS20100241861 *Dec 2, 2008Sep 23, 2010Tetsuro YoshimotoDhcp client server system, dhcp client device and dhcp server deviceUS20100290351 *May 14, 2010Nov 18, 2010Fisher-Rosemount Systems, Inc.Maintenance of wireless field devicesUS20110201275 *Apr 26, 2011Aug 18, 2011E3 LlcSystem and method for management of a dynamic network using wireless communication devicesUS20110211690 *Aug 27, 2010Sep 1, 2011Research In Motion LimitedProtocol for protecting content protection dataUS20110289229 *May 2, 2011Nov 24, 2011BridgeCo Inc.Methods and systems for wi-fi setup and configurationUS20120102328 *Dec 8, 2009Apr 26, 2012Zte CorporationMethod for implementing the real time data service and real time data service systemUS20120233657 *Mar 7, 2012Sep 13, 2012Adtran, Inc., A Delaware CorporationMethod And Apparatus For Network Access ControlUS20130054966 *Aug 25, 2011Feb 28, 2013Netapp, Inc.Systems and methods for providing secure multicast intra-cluster communicationUS20130062420 *May 30, 2012Mar 14, 2013Sca PromotionsMethod and system for the generation and validation of personal identification numbers* Cited by examinerClassifications U.S. Classification380/255, 370/412, 370/428, 370/401International ClassificationH04L12/54Cooperative ClassificationH04W88/02, H04L9/0841, H04W88/08, H04L9/3226, H04W12/04, H04L2463/062European ClassificationH04L9/08F4B, H04W12/04, H04L9/32JLegal EventsDateCodeEventDescriptionMay 10, 2011ASAssignmentFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:TEWARI, CLAUDIUS;BOSSO, BRIAN;LAW, CHOR-TECK;AND OTHERS;SIGNING DATES FROM 20060216 TO 20060217;REEL/FRAME:026251/0580Owner name: MARVELL SEMICONDUCTOR, INC., CALIFORNIAFeb 21, 2006ASAssignmentEffective date: 20060221Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MARVELL SEMICONDUCTOR, INC.;REEL/FRAME:017605/0950Owner name: MARVELL INTERNATIONAL LTD., BERMUDARotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google