3com Corporation

Joe Tsai

Danny M Nessett

Albert Young

BoFu Chen

Bob O'Hara

A process for mutual authentication of users and networks over an unsecured wireless communication channel. In one embodiment, sensitive information (e.g., passwords) is not communicated over the unsecured channel. Rather, hashed representations of user identifiers, passwords, etc., and randomly generated numbers are communicated between the client and the network during the log-in process. The representations may be encrypted with a one-way hash function such that it is not computationally feasible for an eavesdropper to decrypt. In one embodiment, the representation may be generated based on the user identifier, password and/or MAC address of a wireless LAN card.

Protected mutual authentication over an unsecured wireless communication channel

The present invention provides a method and system for using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed. In one embodiment, the primary authentication protocol comprises a strong, secure, computationally complex authentication protocol. Moreover, the secondary authentication protocol comprises a less complex (compared to the primary authentication protocol) and less secure (compared to the primary authentication protocol) authentication protocol which can be performed in a length of time that is shorter than a length of time required to perform the primary authentication protocol. In one embodiment, a wireless client electronic system (WC) completes the primary authentication protocol with a wireless network access point electronic system of a wireless network (AP). When the WC is required to authenticate with another AP, the WC authenticates itself with another AP by using the secondary authentication protocol. However, the WC is required to periodically complete the primary authentication protocol, guarding against the possibility that the secondary authentication protocol may be exploited by an unauthorized intruder to attack the wireless network. In one embodiment, a third party technique is implemented to store a key necessary to perform the secondary authentication protocol.

Using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed

The present invention provides a method and system for performing an authenticated Diffie-Hellman key agreement protocol over a network where the communicating parties share a secret key with a third party. In one embodiment, the network is a wireless network, wherein a wireless client electronic system (WC) and a network access point electronic system (AP) are the parties executing the authenticated Diffie-Hellman key agreement protocol. In this embodiment, the WC and the AP exchange a shared secret key for encrypting wireless communications between the wireless client electronic system and the network access point electronic system. In one embodiment, the WC shares a first secret key with a RADIUS server of the network. Similarly, the AP shares a second secret key with the RADIUS server of the network. The first and second secret keys are utilized for performing an authentication protocol.

Growing community of inventors

Saratoga, CA, United States of America

Joe Tsai