Authentication for relay deployment

Patent metadata

Field	Value
Publication number	US-2016269183-A1
Application number	US-201615161105-A
Country	US
Kind code	A1
Filing date	May 20, 2016
Priority date	Mar 15, 2013
Publication date	Sep 15, 2016
Grant date	—

Abstract

Techniques for proving enterprise mode security for relays are disclosed. For example, enterprise mode security based on IEEE 802.1x is provided for relays or other similar devices to extend the coverage of access point hotspots or other similar access point use cases. According to one aspect, a relay incorporates an authentication client associated with an authentication server. According to another aspect, a four address format is employed for tunneling messages via a relay between a station and an access point. According to another aspect, a cryptographic master key associated with an access point and a station is provided to a relay to enable the relay to be an authenticator for the station.

First claim

What is claimed is:

1 . An apparatus for communication, wherein a second apparatus is configured to be associated with the apparatus, the apparatus is configured to be associated with a third apparatus, and the second apparatus is configured to be connected to a server, the apparatus comprising:
a communication device configured to receive an authentication credential from the second apparatus to setup a session with the server; and a processing system configured to set up the session using the authentication credential, wherein the communication device is further configured to communicate with the server via the session to authenticate the third apparatus with the server.

2 . The apparatus of claim 1 , wherein:
the server comprises a RADIUS server or a DIAMETER server; the communication with the server employs a RADIUS message or a DIAMETER message; and the authentication credential comprises a RADIUS authentication credential or a DIAMETER authentication credential.

3 . The apparatus of claim 1 , wherein:
the communication device is further configured to receive a cryptographic key from the server; the processing system is further configured to use the cryptographic key to establish secure communication with the third apparatus over a wireless channel.

4 . The apparatus of claim 1 , wherein:
the communication device is further configured to receive, from the second apparatus, a cryptographic master key generated by the server for the second apparatus; and the processing system is further configured to use the cryptographic master key to establish secure communication with the third apparatus over a wireless channel.

5 . The apparatus of claim 4 , wherein the cryptographic master key comprises a pairwise master key.

6 . The apparatus of claim 4 , wherein the processing system is further configured to obtain a second cryptographic key from the cryptographic master key, a Media Access Control (MAC) address of the apparatus, a MAC address of the third apparatus, a nonce selected by the apparatus, and a nonce selected by the third apparatus.

7 . A method of communication, wherein a first apparatus is associated with a second apparatus, the first apparatus is associated with a third apparatus, and the second apparatus is connected to a server, the method comprising:
receiving, by the first apparatus, an authentication credential from the second apparatus to setup a session with the server; setting up the session using the authentication credential; and communicating with the server via the session to authenticate the third apparatus with the server.

8 . The method of claim 7 , wherein:
the server comprises a RADIUS server or a DIAMETER server; the communication with the server employs a RADIUS message or a DIAMETER message; and the authentication credential comprises a RADIUS authentication credential or a DIAMETER authentication credential.

9 . The method of claim 7 , further comprising:
receiving a cryptographic key from the server; using the cryptographic key to establish secure communication with the third apparatus over a wireless channel.

10 . The method of claim 7 , further comprising:
receiving, by the first apparatus from the second apparatus, a cryptographic master key generated by the server for the second apparatus; and using the cryptographic master key to establish secure communication with the third apparatus over a wireless channel.

11 . The method of claim 10 , wherein the cryptographic master key comprises a pairwise master key.

12 . The method of claim 10 , further comprising obtaining a second cryptographic key from the cryptographic master key, a Media Access Control (MAC) address of the first apparatus, a MAC address of the third apparatus, a nonce selected by the first apparatus, and a nonce selected by the third apparatus.

13 . A relay for communication, wherein the relay is configured to be associated with an access point, the relay is configured to be associated with a station, and the access point is configured to be connected to a server, the relay comprising:
a communication device configured to receive an authentication credential from the access point to setup a session with the server; and a processing system configured to set up the session using the authentication credential, wherein the communication device is further configured to communicate with the server via the session to authenticate the station with the server.

Assignees

• Qualcomm Inc

Inventors

• Cherian George
• Abraham Santosh Paul
• Wentink Maarten Menzo
• Merlin Simone

Classifications

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L2209/80

  Wireless · CPC title