US 10,945,127 B2Granted

Exclusive preshared key authentication

AssigneeExtreme Networks, Inc.

InventorsMingliang Li, Changming Liu

Life of this patent

Estimating the term…

Loading patent…

Abstract

Preshared keys are assigned to client devices, users, or user groups. The set of valid preshared keys or keys derived therefrom is distributed to network devices such as wireless access points. A client device attempts to establish a secure network connection with a network device using its assigned preshared key. A network device identifies the client device's preshared key by selecting a candidate key from its set of valid preshared keys. The network device determines a validation cryptographic checksum based on the selected candidate key. If the validation cryptographic checksum matches the client's cryptographic checksum, the network device establishes a secure network connection with the client device using this candidate key. If the validation cryptographic checksum does not match the cryptographic checksum provided by the client device, the network device repeats this comparison using different candidate keys selected from its set of valid preshared keys until a match is found.

Claims19

Dependent claims

A method comprising:

receiving an exclusive preshared key assigned to a user group, each user of the user group being different from a device, wherein the exclusive preshared key is uniquely associated with the user group to prevent the exclusive preshared key from being used by other user groups and wherein each user of the user group is enabled to simultaneously use the exclusive preshared key on a plurality of devices on respective network connections;
distributing, by a network device management application, the exclusive preshared key and a user credential of a user in the user group to a network device configured to provide wireless access to network services of a network;
wirelessly connecting a client device to the network device for purposes of the client device attempting to authenticate for accessing the network services;
determining, at the network device, whether a preshared key used by the client device to access the network services matches the exclusive preshared key;
in response to determining the preshared key used by the client device matches the exclusive preshared key, sending, from the network device to an authentication server, the user credential for authentication of the client device;
sending, by the network device, a message to an accounting server, the message instructing the accounting server to begin tracking an amount of time the client device has accessed the network services or an amount of bandwidth used by the client device in accessing the network services;
and
after the client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth, terminating, by the network device, access to the network services.

5 more elements

A non-transitory computer-readable medium including instructions adapted to direct a computer to perform operations, the operations comprising:

receiving an exclusive preshared key assigned to a user group, each user of the user group being different from a device, wherein the exclusive preshared key is uniquely associated with the user group to prevent the exclusive preshared key from being used by other user groups and wherein each user of the user group is enabled to simultaneously use the exclusive preshared key on a plurality of devices on respective network connections;
distributing, by a network device management application, the exclusive preshared key and user credential of a user in the user group to a network device configured to provide wireless access to network services of a network;
wirelessly connecting a client device to the network device for purposes of the client device attempting to authenticate for accessing the network services;
determining, at the network device, whether a preshared key used by the client device to access the network services matches the exclusive preshared key;
in response to determining the preshared key used by the client device matches the exclusive preshared key, sending, from the network device to an authentication server, the user credential for authentication of the client device;
sending, by the network device, a message to an accounting server, the message instructing the accounting server to begin tracking an amount of time the client device has accessed the network services or an amount of bandwidth used by the client device in accessing the network services;
and
after the client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth in accessing the network services, terminating, by the network device, access to the network services.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/496,522Filed 25 Apr 2017 · continuation
Priority: 4 Nov 2008
Published: US 2017/0230824 A110 Aug 2017
Granted: 9 Mar 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04W 12/04
Security arrangements; Authentication; Protecting privacy or anonymity: key management, e.g. using generic bootstrapping architecture [GBA]
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
H04L 63/104
For controlling access to devices or network resources: grouping of entities
H04L 63/123
Applying verification of the received information: received data contents, e.g. message integrity

Family

Application61/111,210Us provisional application · filed 4 Nov 2008
Application12/485,041Parent of this continuation · filed 16 Jun 2009
US 2017/0230824 A1Pre-grant publication · published 10 Aug 2017
US 9,674,892 B1Parent of this continuation
US 10,945,127 B2This patent

From the US filing history. Foreign family members aren’t listed.