Bootstrapping Kerberos from EAP (BKE)
AssigneesToshiba America Research, Inc., Telcordia Technologies, Inc.
InventorsYoshihiro Oba, Subir Das
Life of this patent
Estimating the term…
Abstract
The preferred embodiments involve a mechanism to bootstrap Kerberos from EAP in which EAP is used for initial network access authentication and Kerberos is used for provisioning session keys to multiple different protocols. The preferred embodiments make use of an EAP extension method (EAP-EXT) to realize the mechanism.
Claims18
A method for a mobile device to bootstrap Kerberos from EAP, wherein EAP is used for initial net work access authentication of the mobile device and Kerberos is used for provisioning session keys to multiple different protocols to support multiple network applications, comprising:
- a) configuring the mobile node with an EAP peer that negotiates with an EAP server on capabilities regarding an EAP extended functionality pertaining to Kerberos, including employing an EAP extension method (EAP-EXT) that provides capabilities exchange between the EAP server and the EAP peer regarding Kerberos functionality, including:
- i) the EAP peer receiving a request message transmitted from the EAP server having a new capability bit (K) in a capabilities field related to Kerberos functionality;
- and
- ii) having the EAP peer transmit a response message with a new capability bit (K) in a capabilities field related to the Kerberos functionality.
A method for a mobile node performing a single sign-on in which an initial authentication for network access in a visited or a home domain is used to provision session keys to multiple different protocols used within the domain, comprising:
- a) configuring the mobile device to bootstrap Kerberos from EAP in which EAP is used for initial network access authentication and Kerberos is used for provisioning session keys to multiple different protocols;
- and
- b) including provisioning session keys to link-layer protocols so as to optimize link-layer handover performance by eliminating EAP signaling for handovers within the domain.
A system for a mobile device to perform a single sign-on in which an initial authentication for network access in a domain is used to provision session keys to multiple different protocols used within the domain, comprising:
- a) a mobile device and a server configured to together bootstrap Kerberos from EAP, wherein EAP is used for initial network access authentication of the mobile device and Kerberos is used for provisioning session keys to multiple different protocols to support multiple network applications;
- b) the mobile device and the server being configured to together negotiate on capabilities regarding an EAP extended functionality pertaining to Kerberos, including employing an EAP extension method (EAP-EXT) that provides capabilities exchange between an EAP server and an EAP peer regarding Kerberos functionality, including:
- i) the server having an EAP server configured to transmit to the EAP peer a request message having a new capability bit (K) in a capabilities field related to the Kerberos functionality;
- and
- ii) the mobile device having an EAP peer configured to transmit a response message with a new capability bit (K) in a capabilities field related to the Kerberos functionality.
Dependencies are inferred from the claim text.