Key distribution and caching mechanism to facilitate client handoffs in wireless network systems
AssigneeCisco Technology, Inc.
InventorsRobert O'Hara, Patrice Calhoun, Joshua Glenn Broch
Life of this patent
Estimating the term…
Abstract
Methods, apparatuses, and systems directed to a key distribution and caching mechanism that facilitates roaming in wireless networks. In one implementation, the present invention reduces the latency associated with handoffs by reducing the time required to set up encryption or other secure access mechanisms between access points and clients in the wireless network infrastructure. In one implementation, the present invention operates proactively to distribute authentication credential information to selected components of the wireless network infrastructure before a client roams to another access point.
Claims30
A wireless network access device operative to facilitate roaming in wireless networks, comprising
- a network interface;
- a processor;
- a memory comprising a key cache;
- a wireless network access application, stored in the memory, comprising instructions operable to cause the processor and the network interface to
- proxy an authentication between a wireless client and an authentication server, wherein the authentication results in the generation of a master key;
- store the master key in association with an identifier in the key cache;
- transmit the master key and the identifier to at least one other wireless network access device;
- determine whether a master key associated with the client is stored in the key cache;
- and
- generate, in connection with the wireless client, at least one encryption key based on the master key in the key cache.
A method for facilitating roaming in wireless networks, comprising:
- proxying an authentication between a wireless client and an authentication server, wherein the authentication results in the generation of a master key;
- storing the master key in association with an identifier in the key cache;
- transmitting the master key and the identifier to at least one other wireless network access device;
- determining whether a master key associated with the client is stored in the key cache;
- and
- generating, in connection with the wireless client, at least one encryption key based on the master key in the key cache.
A wireless network access device operative to facilitate roaming in wireless networks, comprising
- means for proxying an authentication between a wireless client and an authentication server, wherein the authentication results in the generation of a master key;
- means for storing the master key in association with an identifier in the key cache;
- means for transmitting the master key and the identifier to at least one other wireless network access device;
- means for determining whether a master key associated with the client is stored in the key cache;
- and
- means for generating, in connection with the wireless client, at least one encryption key based on the master key in the key cache.
A wireless client for communicating in a wireless network comprising at least two wireless network access devices, wherein the at least two wireless network access devices provide identifiers to wireless clients, comprising
- a wireless network interface;
- a processor;
- a memory comprising a key cache;
- a wireless network interface driver application, stored in the memory, comprising instructions operable to cause the processor and the wireless network interface to
- associate with a wireless network access device;
- receive an identifier corresponding to the wireless network access device;
- determine, based on the identifier received from the network access device, whether a master key associated with the wireless network access device is stored in the key cache;
- conditionally authenticate with an authentication server to generate a master key;
- store the master key in association with an identifier corresponding to the wireless network access device in the key cache;
- and
- generate, in connection with the wireless network access device, at least one encryption key based on the master key in the key cache.
In a wireless network comprising at least two wireless network access devices, wherein the at least two wireless network access devices provide identifiers to wireless clients, a method, implemented on a wireless client comprising a key cache, for facilitating roaming in a wireless network, the method comprising
- associating with a wireless network access device;
- receiving an identifier corresponding to the wireless network access device;
- determining, based on the identifier received from the network access device, whether a master key associated with the wireless network access device is stored in the key cache;
- conditionally authenticating with an authentication server to generate a master key;
- storing the master key in association with an identifier corresponding to the wireless network access device in the key cache;
- and
- generating, in connection with the wireless network access device, at least one encryption key based on the master key in the key cache.
A wireless client for communicating in a wireless network comprising at least two wireless network access devices, wherein the at least two wireless network access devices provide identifiers to wireless clients, comprising
- means for wirelessly communicating and associating with a wireless network access device,
- caching means for storing master keys in association with identifiers corresponding to wireless network access devices;
- means for receiving an identifier corresponding to the wireless network access device;
- means for determining, based on the identifier received from the network access device, whether a master key associated with the wireless network access device is stored in the caching means;
- means for conditionally authenticating with an authentication server to generate a master key;
- means for generating, in connection with the wireless network access device, at least one encryption key based on the master key in the key cache.
Dependencies are inferred from the claim text.