Cisco Technology, Inc.

Krishna Kondaka

Jonathan W Hui

Wei Hong

Anjum Ahuja

Norman William Finn

Daniel Christian Biederman

Peter Geoffrey Jones

Amrik Singh Bains

Darrell Rice Heflin

In one embodiment, an authenticator in a communication network maintains a persistent authenticator epoch value that increments each time the authenticator restarts. The authenticator also maintains a persistent per-supplicant value for each supplicant of the authenticator, each per-supplicant value set to a current value of the authenticator epoch value each time the corresponding supplicant establishes a new security association with the authenticator. To communicate messages from the authenticator to a particular supplicant, each message uses a per-supplicant replay counter having a security association epoch counter and a message counter specific to the particular supplicant. In particular, the security association epoch counter for each message is set as a difference between the authenticator epoch value and the per-supplicant value for the particular supplicant when the message is communicated, while the message counter is incremented for each message communicated.

Scalable replay counters for network security

In one embodiment, each security protocol supplicant in a computer network determines its group temporal key (GTK) state, and exchanges the GTK state with one or more neighbor supplicants in the computer network. Based on the exchange, a supplicant may determine whether any inconsistencies exist in its GTK state, and in response to any inconsistencies in the GTK state, may perform a GTK state synchronization with a security protocol authenticator by indicating to the authenticator what is needed to resolve the inconsistent GTK state at the particular supplicant. In another embodiment, the authenticator, which is configured to not store per-supplicant GTK state, may transmit beacons containing GTK identifiers (IDs) of GTKs currently enabled on the authenticator, and also responds to supplicants having inconsistent GTK states with one or more needed GTKs as indicated by the supplicants.

Distributed group temporal key (GTK) state management

In an example embodiment, an apparatus comprising a physical layer processing device that comprises logic configured to process a packet received from a physical layer interface is disclosed. The physical layer processing device logic is further configured to determine a preamble portion of the packet and a data portion of the packet. The physical layer processing device logic is further configured to insert a timestamp into the preamble portion of the packet. The physical layer processing device logic forwards the packet with the timestamp inserted into the preamble.

Flexible time stamping

Growing community of inventors

Los Altos, CA, United States of America

Krishna Kondaka