Secure extended authentication bypass
AssigneeCisco Technology, Inc.
InventorsStephane Beaulieu, David Silverman, Scott Fanning
Life of this patent
Estimating the term…
Abstract
Methods and apparatus are provided to allow Internet Key Exchange (IKE) phase 1 keying materials to be periodically refreshed in a secure manner without requiring user interaction. A client and server perform authentication and key exchange during set up of a secure connection. A token is passed to the client by the server during or after the initial user authentication phase. The token is stored both at the client and at the server. Instead of requiring user credentials, the token can be used to securely prove the identity of the client.
Claims23
A server for performing extended authentication, the system comprising:
- a network interface operable to transmit to a client an extended authentication request associated with an IKE phase 1 exchange and receive from the client an extended authentication reply along with a token request;
- a processor operable to generate a token, wherein the token is maintained at the server and the client and provides proof of identity for the client.
A method for bypassing extended authentication during a rekey of a secure session, the method comprising:
- receiving an extended authentication request from a server at a client, the extended authentication request associated with an IKE phase 1 exchange;
- responding with an extended authentication reply to the server;
- providing a token request to the server;
- receiving a token from the server during or after initial client authentication, wherein the token is stored both at the client and the server and is operable to provide proof of identity for the client.
A client configured to bypass extended authentication during a rekey of a secure session, the system comprising:
- means for receiving an extended authentication request from a server, the extended authentication request associated with an IKE phase 1 exchange;
- means for responding with an extended authentication reply to the server;
- means for providing a token request to the server;
- means for receiving a token from the server during or after initial client authentication, wherein the token is stored both at the client and the server and is operable to provide proof of identity for the client.
Dependencies are inferred from the claim text.