US 8,046,577 B2Granted

Secure IP access protocol framework and supporting network architecture

AssigneeAT&T Corp.

InventorsPaul Shala Henry, Hui Luo, Bruce Edwin McNair, Nemmara K. Shankaranarayanan

Life of this patent

Estimating the term…

Loading patent…

Abstract

A protocol framework for a Secure IP Access (SIA) method, and supporting components deployed on IP hosts and IP networks. Using this method, an IP host can establish a secure data channel within an IP network over an insecure shared link while requesting IP address and networking configuration parameters from the IP network. A system administrator can implement strong access control against various attacks that an edge IP network may have to face, such as a denial-of-service attack that exhausts assignable IP addresses. This is a lightweight, scalable, and backward-compatible solution that can improve security performance for public and corporate LANs having open access such as wireless access points and Ethernet jacks.

Claims18

Dependent claims

A method for a mobile wireless IP host to authenticate to an IP network, comprising:

broadcasting a dynamic host configuration protocol (DHCP)_DISCOVERY message including a HOST_HELLO message that specifies a plurality of cryptography options for the IP network including a host-to-network authentication method, network-to-host authentication method, key exchange algorithm, and encryption algorithm, wherein the DHCP_DISCOVERY message is transmitted from the mobile wireless IP host over a wireless interface to an access point;
after broadcasting the dynamic host configuration protocol (DHCP)_DISCOVERY message, receiving a DHCP_OFFER message including an option confirming the plurality of cryptography options when the plurality of cryptography options meet security requirements of the IP network, wherein the DHCP_OFFER message does not allocate an IP address to the mobile wireless IP host, wherein the DHCP_OFFER message is received at the mobile wireless IP host over the wireless interface from the access point;
after broadcasting the dynamic host configuration protocol (DHCP)_DISCOVERY message and after receiving the DHCP_OFFER message, sending a DHCP_REQUEST message including authentication credentials responsive to receiving the DHCP_OFFER, wherein the DHCP_REQUEST message is sent from the mobile wireless IP host over the wireless interface to the access point;
and
after sending the DHCP_REQUEST message, receiving a DHCP_ACK message when the mobile wireless IP host is authenticated by the network, the DHCP_ACK message including a NETWORK_CONFIG option with encrypted network configuration parameters, wherein the DHCP_ACK message is received at the mobile wireless IP host over the wireless interface from the access point.

2 more elements

A method of authenticating a mobile wireless IP host in an IP network, comprising:

receiving a broadcast dynamic host configuration protocol (DHCP)_DISCOVERY message including a HOST_HELLO message that specifies a plurality of cryptography options for the IP network including a host-to-network authentication method, network-to-host authentication method, key exchange algorithm, and encryption algorithm, wherein the DHCP_DISCOVERY message is received from the mobile wireless IP host over a wireless interface at an access point of the IP network;
responsive to receiving the dynamic host configuration protocol (DHCP)_DISCOVERY message, transmitting a DHCP_OFFER message including an option confirming the plurality of cryptography options when the plurality of cryptography options meet security requirements of the IP network, wherein the DHCP_OFFER message does not allocate an IP address to the mobile wireless IP host, wherein the DHCP_OFFER message is transmitted to the mobile wireless IP host over the wireless interface from the access point of the IP network;
after receiving the dynamic host configuration protocol (DHCP)_DISCOVERY message and after transmitting the DHCP_OFFER message, receiving a DHCP_REQUEST message including authentication credentials responsive to the DHCP_OFFER, wherein the DHCP_REQUEST message is received from the mobile wireless IP host over the wireless interface at the access point of the IP network;
responsive to receiving the DHCP_REQUEST message, authenticating the mobile wireless IP host;
and
responsive to authenticating the mobile wireless IP host, transmitting a DHCP_ACK message, the DHCP_ACK message including a NETWORK_CONFIG option with encrypted network configuration parameters, wherein the DHCP_ACK message is transmitted to the mobile wireless IP host over the wireless interface from the access point of the IP network.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/317,694Filed 12 Dec 2002 · us provisional application
Priority: 12 Dec 2001
Published: US 2003/0172144 A111 Sep 2003
Granted: 25 Oct 2011
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/061
For supporting key management in a packet data network: for key exchange, e.g. in peer-to-peer networks
H04L 61/5014
Internet protocol [IP] addresses: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
H04L 63/0869
For authentication of entities: for achieving mutual authentication
H04L 63/1458
Countermeasures against malicious traffic: denial of Service