TWI404393B - Node for securing wireless communications and mathod thereof - Google Patents

Abstract

The present invention is related to a method and system for deriving an encryption key using joint randomness not shared by others (JRNSO). Communicating entities generate JRNSO bits from a channel impulse response (CIR) estimate and the JRNSO bits are used in generation of an encryption key. The authentication type may be IEEE 802.1x or a pre-shared key system. In an IEEE 802.1x system, a master key, a pairwise master key or a pairwise transient key may be generated using the JRNSO bits. The encryption key may be generated by using a Diffie-Hellman key derivation algorithm.

Description

Node for ensuring wireless communication security and method thereof

The present invention relates to wireless communication security. More particularly, the present invention relates to methods and systems for using shared random access (JRNSO) derived secret keys that are not shared by others.

IEEE 802.11i is used to ensure that the wireless local area network (WLAN) operating under the IEEE 802.11 standard can use the Counter Authentication Mode (CTR) and the Message Authentication Code (CBC-MAC) using the Advanced Encryption Standard (AES) algorithm in sequence. The Protocol (CCMP) outlines the encryption barrier of the technology link for secure data communication. To achieve this, IEEE 802.11i provides two schemes that can cause a pair of communication nodes to derive keys that can be used to encrypt the exchanged packets.

The first solution is based on IEEE 802.1x authentication technology that requires a remote authentication server such as a RADIUS server. In IEEE 802.1x, an access point (AP) can be regarded as one of the routers between a wireless transmit/receive unit (WTRU) and a authentication server to be connected to the access point. The authentication server can provide a public key to the WTRU via the access point. The wireless transmitting/receiving unit can check the public key by checking it by the digital certificate provided by the verification server. The WTRU then derives the random secret (i.e., the master secret) and encrypts the master secret to the authentication server with the provided public key. Therefore, only the authentication server can decrypt the master secret using the corresponding private key. The authentication server and the wireless transmitting/receiving unit can use the master secret to derive a master key (MK). The authentication server and the wireless transmit/receive unit then derive from the master key into a master key (PMK). The verification server provides the pair of master keys to the access point. The access point and the wireless transmit/receive unit then use the pair of master keys to derive into a transient key (PTK). A portion of this pair of transient keys is the temporary key (TK) of the actual key used in the message verification code protocol technique used to seal the package. Because this solution uses a remote authentication server and digital credentials (currently expensive), this solution is typically implemented in an enterprise wireless local area network.

The second option that is more suitable for home or small business networks uses the first shared key (PSK). In this scheme, a 256-bit user configurable key is stored on the communication node. As in the IEEE 802.1x system, when the WTRU is to be connected to the access point, the WTRU can treat the first shared key as a paired master key (not deriving the master secret and the master key), and Derived into a transient key and use part of the pair of transient keys as a temporary key.

There are at least two problems in the IEEE 802.11i system. First, the final temporary key is only as secure as the primary secret exchanged in the IEEE 802.1x network instance, or as the first shared key in a home or small business network. In an IEEE 802.11x system, an intruder can decrypt the master secret by stealing the private key of the authentication server. In the home network, the first key to share can be derived using a brute force intruder (the first key in the family is changed from time to time or generated from a "weak" password) or by stealing the key. Knowing the master secret or sharing the key first allows the intruder to reach the same value for the master key in the same way as the two legitimate communication nodes, and derive the equivalent pair of transient key values. Therefore, knowing that the authentication is sufficient is sufficient to know the derived key. Furthermore, when the key is updated later than the session, the master key and the paired master key are usually left unchanged, and only the paired master key and the exchanged information in the purge are used to derive the new pair of transient keys (which are assumed) For the secret). When the paired master key does not change, the paired transient key is not new, so it is not a new key.

Furthermore, key derivations are complex and have many stages (such as master keys, paired master keys, paired transient keys and temporary keys). This consumes time and resources.

The key can be thought of as a sequence of bits. The completely random key of the N-bit length is the N-bit sequence shared by the entity, S. Assuming that all information is available in the system, anyone can be assigned a rough and equitable probability of all possible 2 ^N N bit sequences for the reason why this key sequence can be approximated.

Prior art cryptosystems rely on the fact that it is extremely difficult to guess the cryptographic key from the point of view of computable resources. However, in most of these systems, once a correct guess is made, it is very easy to verify that this is indeed the correct guess. In fact, prior art means that this can be applied to any public key system (ie, the secret key is public and the decryption key remains secret).

For example, assuming that p and q are two large prime numbers and s=pq, it is extremely difficult to calculate the problem of solving two large prime product factors. If a party secretly selects p and q and publicly obtains its product s, which is then treated as the secret key of the encryption system, it cannot be easily decrypted unless it knows p and q. An eavesdropper who wants to intercept an encrypted message may start by trying a factor s that is known to be difficult to calculate. However, if the eavesdropper guesses p, it is fairly easy to verify that it has the correct answer. The ability to know the correct answer is obtained by guessing the difference between the computable secret and the complete secret. Completely secret means that even if the intruder correctly guesses the key, it does not have the ability to determine it.

Therefore, it is expected that encryption will be generated by a key that is not limited to the prior art. IEEE 802.11i is used to ensure that the wireless local area network (WLAN) operating under the IEEE 802.11 standard can use the Counter Authentication Mode (CTR) and the Message Authentication Code (CBC-MAC) using the Advanced Encryption Standard (AES) algorithm in sequence. The Protocol (CCMP) outlines the encryption barrier of the technology link for secure data communication. To achieve this, IEEE 802.11i provides two schemes that can cause a pair of communication nodes to derive keys that can be used to encrypt the exchanged packets.

The first solution is based on IEEE 802.1x authentication technology that requires a remote authentication server such as a RADIUS server. In IEEE 802.1x, an access point (AP) can be regarded as one of the routers between a wireless transmit/receive unit (WTRU) and a authentication server to be connected to the access point. The authentication server can provide a public key to the WTRU via the access point. The wireless transmitting/receiving unit can check the public key by checking it by the digital certificate provided by the verification server. The WTRU then derives the random secret (i.e., the master secret) and encrypts the master secret to the authentication server with the provided public key. Therefore, only the authentication server can decrypt the master secret using the corresponding private key. The authentication server and the wireless transmitting/receiving unit can use the master secret to derive a master key (MK). The authentication server and the wireless transmit/receive unit then derive from the master key into a master key (PMK). The verification server provides the pair of master keys to the access point. The access point and the wireless transmit/receive unit then use the pair of master keys to derive into a transient key (PTK). A portion of this pair of transient keys is the temporary key (TK) of the actual key used in the message verification code protocol technique used to seal the package. Because this solution uses a remote authentication server and digital credentials (currently expensive), this solution is typically implemented in an enterprise wireless local area network.

The second option that is more suitable for home or small business networks uses the first shared key (PSK). In this scheme, a 256-bit user configurable key is stored on the communication node. As in the IEEE 802.1x system, when the WTRU is to be connected to the access point, the WTRU can treat the first shared key as a paired master key (not deriving the master secret and the master key), and Derived into a transient key and use part of the pair of transient keys as a temporary key.

There are at least two problems in the IEEE 802.11i system. First, the final temporary key is only as secure as the primary secret exchanged in the IEEE 802.1x network instance, or as the first shared key in a home or small business network. In an IEEE 802.11x system, an intruder can decrypt the master secret by stealing the private key of the authentication server. In the home network, the first key to share can be derived using a brute force intruder (the first key in the family is changed from time to time or generated from a "weak" password) or by stealing the key. Knowing the master secret or sharing the key first allows the intruder to reach the same value for the master key in the same way as the two legitimate communication nodes, and derive the equivalent pair of transient key values. Therefore, knowing that the authentication is sufficient is sufficient to know the derived key. Furthermore, when the key is updated later than the session, the master key and the paired master key are usually left unchanged, and only the paired master key and the exchanged information in the purge are used to derive the new pair of transient keys (which are assumed) For the secret). When the paired master key does not change, the paired transient key is not new, so it is not a new key.

Furthermore, key derivations are complex and have many stages (such as master keys, paired master keys, paired transient keys and temporary keys). This consumes time and resources.

The key can be thought of as a sequence of bits. The completely random key of the N-bit length is the N-bit sequence shared by the entity, S. Assuming that all information is available in the system, anyone can be assigned a rough and equitable probability of all possible 2 ^N N bit sequences for the reason why this key sequence can be approximated.

Prior art cryptosystems rely on the fact that it is extremely difficult to guess the cryptographic key from the point of view of computable resources. However, in most of these systems, once a correct guess is made, it is very easy to verify that this is indeed the correct guess. In fact, prior art means that this can be applied to any public key system (ie, the secret key is public and the decryption key remains secret).

For example, assuming that p and q are two large prime numbers and s=pq, it is extremely difficult to calculate the problem of solving two large prime product factors. If a party secretly selects p and q and publicly obtains its product S, which is then treated as the secret key of the encryption system, it cannot be easily decrypted unless it knows p and q. An eavesdropper who wants to intercept an encrypted message may start by trying a factor s that is known to be difficult to calculate. However, if the eavesdropper guesses p, it is fairly easy to verify that it has the correct answer. The ability to know the correct answer is obtained by guessing the difference between the computable secret and the complete secret. Completely secret means that even if the intruder correctly guesses the key, it does not have the ability to determine it.

Therefore, it is expected that encryption will be generated by a key that is not limited to the prior art.

The present invention relates to a method and system for using a joint random derivative key that is not shared by others. The communication real system generates a joint random bit that is not shared by others from the channel impulse response (CIR) estimation, and the unshared joint random bit system is used to generate the secret key. This type of authentication can be an IEEE 802.1x or a shared key system. In an IEEE 802.1x system, a master key, a paired master key, and/or a pair of transient key systems can be generated using the shared random bit that is not shared by others. This key can be generated using the Diffie-Hellman key derivative algorithm.

Hereinafter, the term "wireless transmitting/receiving unit" includes, but is not limited to, a user equipment, a station (STA), a fixed or mobile subscriber unit, a pager, or any other type of component operable in a wireless environment. Hereinafter, the term "access point (AP)" is used to include, but is not limited to, a Node B, a base station, an address controller, or any other interface device in a wireless environment.

Features of the invention may be incorporated into an integrated circuit (IC) or configured in a circuit comprising a plurality of interconnected components. The invention can be implemented as a digital signal processor (DSP), software, middleware, hardware, application or future system architecture. The component can be a sub-component of a large communication system or an application specific integrated circuit (ASIC), and some or all of the processing elements can be shared by other components.

In a wireless communication system, although the associated random resource is a priori that is difficult to generate without prior communication, the wireless channel provides the resource of the channel impulse response pattern. Specifically, in a particular communication system, communication between two parties (such as Alice and Bob) will measure a very similar channel impulse response estimate. Broadband Code Division Multiple Access (WCDMA) Time Division Multiplexing (TDD) systems have this feature. On the other hand, any channel that does not actually coexist with Alice and Bob may observe a very small channel impulse response with Alice and Bob. This difference can be exploited to produce a full secret key. The channel is a joint random resource that is not shared by others, and the channel impulse response estimate is a sample taken from the channel.

The Diffie-Hellman key derivative program is explained below. Alice and Bob agree to use the prime number p and the base g. Alice selects the secret integer a and then passes ga mod p to Bob. Bob selects the secret integer b and then passes g ^b mod p to Alice. Alice calculates (g ^b mod p) ^a modulo p. Bob calculates (g ^a mod p) ^b mod p. (g ^b mode p) ^a mode p and (g ^a mode p) ^b mode p system is the same. For example, Alice and Bob agree to use the prime number p=23 and the base number g=3. Alice selects the secret integer a=6, and then transmits ga mod p=36 modulo 23=16 to Bob. Bob selects the secret integer b=15, and then transmits g ^b modulo p=3 ^{1 5} modulo 23=12 to Alice. Alice calculates (g ^b mod p) ^a modulo p = 12 ⁶ modulo 23 = 9. Bob calculation (g ^a mod p) ^b modulo p = 16 ^{1 5} modulo 23 = 9.

Making this scenario secure requires many larger numbers. If p is a prime number greater than 300 digits, and a and b are greater than 100 digits, since the calculation is too resource intensive, it is virtually impossible to invade (even if it is a legitimate communication party). As such, this prevents the agreement from being implemented on battery-restricted mobile devices.

If one of the numbers p and q (or both) is secretly agreed to by sharing the joint random number, this will cause the two communication nodes to achieve a relatively safe use of a smaller number for a, b, p and/or q. . The Diffie-Hellman shared key can be used as a key or used to encrypt and transmit the actual key. The smaller number used allows the key derivation process to be less resource intensive, allowing it to be used on mobile devices.

1 is a block diagram of a system 100 in accordance with the present invention including two communication entities (a first node 110 and a second node 150) that can derive a joint random bit and a secret key that are not shared by others.

One of the entities may be a wireless transmit/receive unit and the other may be an access point. For simplicity, a point-to-point communication system having only two communicating entities 110, 150 is illustrated in FIG. However, the present invention can be applied to a point-to-multipoint communication system involving more than two entities. It should also be noted that the first node and the second node are substantially the same entity including the same elements, but for the sake of simplicity, FIG. 1 only depicts the relevant elements of the first node and the second node, and the first node is assumed to be the first. The joint random bit and the secret key are not shared by others, which will be explained in detail as follows.

According to the invention, one of the communicating entities takes the lead. Assume that the first node 110 takes the lead. The first node 110 includes a channel estimator 112, a post processor 114 (optional), an error correction encoder 118, a synchronization code generator 120 (optional), a key generator 116 and a plurality of Worker 122.

The channel estimator 112 of the first node generates a channel impulse response estimate 113 based on the signal 111 received from the second node 150. Channel estimator 152 in second node 150 also generates channel impulse response estimate 153 based on the transmissions transmitted by first node 110. Channel estimator 112, 152 is a digital representation of the channel impulse response estimate. Any prior art method can be used to generate a channel impulse response estimate. For example, entities 110, 150 may transmit special signals or preamble sequences to other nodes to assist in generating channel impulse response estimates. The channel impulse response estimate may include, but is not limited to, the time domain, the frequency domain or may be generated or stored in any manner using an abstract vector space representation or the like. The method of generating the channel impulse response estimation and representation scheme should be the same in the first node 110 and the second node 150.

Depending on the implementation, only the channel impulse response estimation portion information may be reciprocal and applicable to generate a shared secret key. For example, the entity 110, 150 may select only the amplitude/power profile information estimated using the channel impulse response and may ignore the phase information.

Post processor 114 can optionally process the channel impulse response estimate using prior art methods. Post processor 114 (such as a low pass filter or an interpolation filter) removes noise and redundancy. The post processor 114 is also required in the case where the entity is installed in multiple antennas for multiple input multiple output (MIMO), so the difference in the number of antennas and the antenna pattern may cause the channel impulse response estimation to be different. In this example, entities 110, 150 may have to exchange their antenna configuration related information.

Because the channels are reciprocal, the channel impulse response estimates generated by the first node 110 and the second node 150 are expected to be very similar. However, there are three main sources of error for introducing the channel impulse response estimate differences. First, the channel reciprocal assumes that the channels at both entities are simultaneously estimated. This simultaneity difference can lead to some differences in channel estimation. Second, the digitized channel impulse response estimate may have to be synchronized with the starting point. For example, if the channel impulse response estimate is digitized in the time domain, then the channel impulse response estimate meaningful portion initiation may occur at a different location in the two entities 110, 150 at reference zero. This problem is depicted in Figure 2. In another example, if the channel impulse response estimate is stored using a frequency domain representation, then a different starting frequency/reference phase may be assumed when deciding to store the parameters. Third, the channel impulse response estimate will also vary due to errors due to interference inherent in wireless communications.

Regarding the first source of error, in order to ensure channel estimation simultaneity, the channel estimation time point can be linked to a specific system time, such as a radio frame or slot boundary. Alternatively, the synchronization signal can be transmitted by the embedded entities 110, 150 to support channel estimation signals (e.g., preamble signals). Synchronization is obtained from the preamble signal without embedding a special signal. Alternatively, the channel estimate can be performed with reference to an absolute time reference such as the Global Positioning System (GPS). Alternatively, the round trip delay can be measured, and synchronization can be achieved based on this back and forth delay.

Regarding the second error source, the channel impulse response estimate starting point can be recorded at the first node 110 and can be transmitted to the second node 150. Alternatively, special synchronization nodes (such as no comma) can be used. Because the synchronization problem is usually limited to only a few samples, the password requires only limited performance. The special synchronization signal associated with the shared timing source can be generated by the terminal, and the channel impulse response measurement can be achieved for the signal. This synchronization problem can be handled by processing the channel impulse response in a field that is not an issue. For example, assuming that phase information can be ignored, the synchronization problem does not occur in the frequency domain.

The video channel interference level can be large or small, and the secret rate loss can be large or small. For example, in very noisy channels, phase information can be highly unreliable, so ignoring it will result in a minimum secret ratio loss.

Referring again to FIG. 1, post-processing channel impulse response estimate 115 is fed to key generator 116, error correction encoder 118 and synchronization code generator 120. Key generator 116 may generate secret key 117 from channel impulse response estimate 115, which is a joint random bit not shared by others.

The synchronization code generator 120 can generate a synchronization signal/code 121 for the simultaneous and synchronized "starting point". Error correction encoder 118 may perform error correction coding on channel impulse response estimate 115 and generate parity bits 119. The error correction coding can be block coding or convolutional coding. The present invention uses systematic error correction coding such that the original message (i.e., the encoder input of the channel impulse response estimate 115) is also output from the error correction encoder 118. In accordance with the present invention, only the parity bit 119 is transmitted to the second node 150 after being multiplexed by the multiplexer 122 with the synchronization signal/code 121. The multiplexed bit stream 123 is transmitted to the second node 150.

The second node 150 includes a channel estimator 152, a synchronization bit demodulator 154, a parity bit demodulator 156, a post processor 158 (optional), a synchronization unit 160, and an error correction. The decoder 162 and a key generator 164. Channel estimator 152 can estimate the channel impulse response generated by received signal 151 transmitted by first node 110. The channel impulse response estimate 153 is selectively processed by the co-located bit demodulator 156 described above. Synchronization bit demodulator 154 may demodulate the received signal 151 to reply to the synchronization signal/code 155. The parity bit demodulator 156 can demodulate the received signal 151 to reply to the parity bit 157. The synchronization signal/code 155 is fed to the synchronization unit 160, and the parity bit 157 is fed to the error correction decoder 162. The post-processing channel impulse response estimate 159 is processed by the synchronization unit 160. The synchronization unit 160 may correct the channel impulse response estimation difference due to lack of simultaneity and/or starting point error calibration in accordance with the synchronization signal/code 155.

Error correction decoder 162 may perform error correction decoding to treat channel impulse response estimate 159 processed by synchronization unit 160 as a coded word message portion, which may contain errors and use the received parity bit 157 to correct the error. If the block coding is well selected, the output 163 of the error correction decoder 162 is the same as the channel impulse response estimate produced by the first node 110 at a very high probability. Therefore, the first node 110 and the second node 150 successfully obtain the same data sequence, but only disclose some parts thereof (ie, the same bit) and can derive the same unshared random bit that is not shared by others.

Error correction decoder 162 can be used to support synchronization of the digital channel impulse response estimate starting point. The second node 150 can generate a set of channel impulse response estimates and decode the possible channel impulse response estimates with the parity bits 157. Error correction decoder 162 can count the number of errors in each channel impulse response estimate. Due to the very high probability, only the corrector will produce very high corrections; the corrector will produce very low corrections. In this method, the error correction decoding process can support the synchronization of the starting point.

Once the channel impulse response estimate has been calibrated between the first node 110 and the second node 150, the key generator 164 can generate the same secret key 165 as the secret key 117 generated by the first node 110.

Figure 3 is a flow diagram of a process 300 for deriving a joint random bit and key that is not shared by others in accordance with the present invention. The first node may generate a channel impulse response estimate from the transmission transmitted by the second node, and the second node may generate a channel impulse response estimate from the transmission transmitted by the first node (step 302). In order to correct the difference between the channel impulse response estimate generated by the first node and the channel impulse response estimate generated by the second node (and selectively support synchronization of the channel impulse response estimate), the first node may transmit The parity bit (and selectively synchronizing the signal/encoding) to the second node (step 304). The parity bit can be generated by an error correction code on the channel impulse response estimate generated by the first node. The second node may estimate the channel impulse response generated by the second node and the channel impulse response generated by the first node using the synchronization signal/encoding transmitted by the first node or using some other scheme described above Synchronization is measured (step 306). The second node then performs error correction decoding on the synchronized channel impulse response estimate by the parity bit to correct the estimated channel impulse response estimate and the channel impulse response estimate generated by the first node. The difference between the steps (step 308). Steps 302-308 can be repeated several times. In this method, the first node and the second node can obtain the same channel impulse response estimate (the joint random bit is not shared by others). The first node and the second node can then generate a secret key from the same channel impulse response estimate (step 310).

4 is a flow diagram of a process 400 for using a joint random bit-derived secret key that is not shared by others in accordance with an embodiment of the present invention. Once the WTRU is connected to the access point in step 402, it may be determined that the type of authentication supported by the wireless network is IEEE 802.1x or a shared key (step 404). If IEEE 802.1x is supported, the Authentication, Authorization and Accounting (AAA) server and the WTRU can use the digital credentials to authenticate each other (step 406). When a part of the verification signal is sent, the WTRU transmits the secret that the authentication and accounting server's public key is encrypted to the authentication, authorization and accounting server, so that only the verification, authorization and accounting servo are used. The device can decrypt it using the corresponding private key. This secret is used as the seed of the derivative key. The verification, authorization and accounting server then transmits the secret to the access point (step 408). If the supported authentication type is the first shared key, the first shared key is set as the preset secret (step 410).

The access point and the wireless transmit/receive unit may use the process described above to generate a joint random bit that is not shared by others (step 412). It should be noted that the joint random bit is not shared by others not only after the secret is forwarded, but also at any step prior to the generation of the key. The access point and the wireless transmit/receive unit may use the secret and the shared random bit not shared by others to derive the secret key (step 414). The access point and the WTRU then exchange a portion of the secret key to confirm the key and identity (step 416). The group key can be derived and transmitted to the wireless transmit/receive unit as a pair of transient keys, as currently done by IEEE 802.1i, using the secret key (step 418).

The processing according to the IEEE 802.11i standard can be followed in the event that the key preparation is not yet generated enough to share the joint random bit. It should be noted that the initial derivative system requires steps 402-410, and the key update or renewed can only be performed by deriving new unshared random bits that are not shared by others.

In order to update the key, in the 802.1x example, the new secret can be exchanged and the new unshared random bit can be generated by others, or alternatively, the new unshared joint random bit with the old secret can be used. Only the second part can be used to share the key case first. Historical data can be used to verify that joint random bits are not shared by others. Both parties can cache some of the early key prior consent sections. The intruder cannot use only the stolen private key, but must also guess the derived previous key to decrypt the master secret.

This process explicitly separates the verification and key generation roles in the system. Verification, authorization and accounting servers only process authentication clients, while access points handle key generation. This is different from IEEE 802.1x, where authentication, authorization, and accounting servers are involved in key derivation and verification. Sharing the joint randomness by others can cause the new and latest keys to be dynamically derived every few hundredths of a second (depending on the video channel). This differs from the prior art in that the key update is pre-programmed and not a new password, and the new secret must be exchanged where a new key is generated. There is no master key or pair of master keys in the process 400 of the present invention. Therefore, this process is simpler than the prior art.

In the existing 802.11i protocol, an intruder who knows the authentication credentials (in the 802.1x case) or shares the key first (in the shared key authentication example) only has to eavesdrop on the signal exchange to know the key. In contrast, when using the method of the present invention, when an intruder processing a verification credential (such as a digital credential or a shared key verification) does not share the same channel shared by the WTRU and the access point, it cannot derive the secret key. Cannot make the same unshared random bit that is not shared by others.

Under the current IEEE 802 standard, key updates are not really password-safe because only pairs of transient keys change and the master key and the paired master keys remain the same. If the intruder guesses the paired master key, then when the paired transient key happens to be the paired master key plus the random information exchanged in the purge, the update key does not serve any cryptographic purposes. The master secret used to derive the master key and the paired master key is very long (eg 48-bit) for the purpose of service cryptography. Therefore, for the new key in IEEE 802.11i, the number of long 48-bit tuples that have been truly randomly derived must be exchanged (which is resource intensive). However, in accordance with the present invention, the exchanged secret verifiable is derived from a key that does not share the joint random bit by others, but only needs to be long enough to prevent brute force intruders (e.g., about 16 bytes). This makes it possible to regenerate the key each time it has to share a joint random update without being shared by others. The present invention provides only one exchanged short secret and a set of derived keys, rather than a simple key exchanged with a long key and three sets of derived keys (ie, a master key, a paired master key, and a pair of transient keys) Derivative method. This saves power to the mobile device.

Figure 5 is a flow diagram 500 of a process 500 for using a shared random bit derived key that is not shared by others in accordance with another embodiment of the present invention. Process 500 is similar to process 400. Steps 502-512 are the same as steps 402-412 and will not be explained again for simplicity. After the secret is forwarded to the access point and the shared random bit is not shared by others, the access point and the WTRU can use the secret and the shared random bit is not shared by others to derive the master key (step 514). The group key can then be derived and transmitted to the wireless transmit/receive unit as currently done by IEEE 802.11i (step 516).

Figure 6 is a flow diagram of a process 600 for using a joint random bit-derived secret key that is not shared by others in accordance with yet another embodiment of the present invention. Once the WTRU is connected to the access point in step 602, it may be determined that the type of authentication supported by the wireless network is IEEE 802.1x or a shared key (step 604). If IEEE 802.1x is supported, the authentication, authorization and accounting server and the WTRU can use the digital credentials to authenticate and exchange the master secrets with each other (step 606). The verification, authorization and accounting server and the wireless transmit/receive unit then use the master secret to derive the master key (step 608). The verification, authorization and accounting server and the wireless transmit/receive unit then derive the master key from the master key, and the verification, authorization and accounting server transmits the paired master key to the access point (step 610). If the supported verification type is the first shared key, the first shared key is set as the paired master key (step 611).

The access point and the wireless transmit/receive unit use the process described above to generate a joint random bit that is not shared by others (step 612). It should be noted that the joint random bit is not shared by others not only after the paired master key is forwarded, but also at any step prior to the generation of the key. It can be executed before being derived into the master key (in the 802.1x case) to speed up the key derivation process. It can also be achieved during the 4-way handshake process to derive into a transient key. This allows the system to be compatible with the first shared key verification. The parity check can also be performed any time before it is derived into a transient key.

The access point and the wireless transmit/receive unit derive the paired transient key using the paired master key and the shared random bit not shared by others (step 614). Paired transient keys can be derived as follows: PTK=PRF (paired master key, clearing information, not shared random bits by others).

The group key can then be derived and exchanged as currently done by IEEE 802.11i (step 616).

Figure 7 is a flow diagram of a process 700 for using a joint random bit-derived secret key that is not shared by others in accordance with yet another embodiment of the present invention. Once the WTRU is connected to the access point in step 702, it may be determined that the type of authentication supported by the wireless network is IEEE 802.1x or a shared key (step 704). In this embodiment, the first share key is not supported and only IEEE 802.1x is supported. If the key is first shared by the network, the process ends. If IEEE 802.1x is supported, the authentication, authorization and accounting server and the WTRU can exchange the master secret, and the authentication, authorization and accounting server transmits the master secret to the access point (step 706).

The verification, authorization, and accounting server and access point use the master secret to derive the master key (step 710). The WTRU/access point then uses the master key and shares the joint random bit not shared by others to derive the master key (step 712). The access point and the wireless transmit/receive unit use the pair of master keys to derive into a transient key (step 714). The group key can then be derived and exchanged as currently done by IEEE 802.11i (step 716).

Figure 8 is a flow diagram of a process 800 for deriving a secret key using a Diffie-Hellman protocol in accordance with the present invention. The WTRU 802 and the access point 804 agree to use the unshared joint random exchange by others to exchange the joint random start message to drive the key to the access point and not share the joint random start confirmation by others (steps) 812,814). The WTRU 802 and the access point 804 generate a joint random bit that is not shared by others based on the channel impulse response estimate (steps 816, 818). The WTRU 802 (first) generates a parity bit by performing error correction coding on the generated channel impulse response estimate and transmits the parity bit to the access point 804 (step 820). Access point 804 uses the received parity bit to perform error correction decoding and selectively transmits an acknowledgment (step 822). Steps 816-822 can be repeated several times.

The WTRU 802 and the access point 804 have a predetermined lookup table (LUT) that can store secret numbers p and q (primary numbers) that are not shared by others from the joint random bits to the p and q values. For example, if the joint random measurement is not shared by others to generate 5-bit secret data, the WTRU 802 and the access point 804 can select one of the 16 possible unique values for the prime number p and another 16 for the base g. It should be noted that other schemes as would be apparent to the skilled artisan are available instead of lookup tables. Since the security add-on layer with p and g secrets in accordance with the present invention, the stored quality should be large, but not necessarily as large as the traditional Diffie-Hellman protocol. Preferably, the magnitude of the prime number should also be different to make it difficult for an intruder to guess the range of modulo values. Although it is known that the mapping of joint random bits to lookup table values is not shared by others, since the intruder cannot overhear the joint random measurement that is not shared by others, it does not know what value is actually selected.

The WTRU 802 and the access point 804 select the secret integers a and b, respectively, and transmit the g ^a modulo p and the g ^b modulo q to the other, respectively, and drive b and a, respectively (steps 824, 826). The wireless transmit/receive unit 802 and the access point 804 use this to derive a shared secret (step 828). The wireless transmitting/receiving unit 802 and the access point 804 use the shared secret to transmit the shared random key that is encrypted and not shared by others or treat the shared secret as if the joint random key was not shared by others (step 830).

The features and elements of the present invention are described in the preferred embodiments in the preferred embodiments, and the various features and elements are not required to be further Used separately.

100. . . Block diagram

110, 150. . . node

113, 115, 153, 159. . . Channel impulse response estimation

117, 165. . . Secret key

119, 157. . . Bit

121, 155. . . Signal/coding

123. . . Bit stream

163. . . Output

300, 400, 500, 600, 700, 800. . . flow chart

AP. . . Access point

a, b. . . Secret integer

g. . . Cardinal number

p, q. . . Prime number

PSK. . . Share the key first

WTRU. . . Wireless transmission/reception unit

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a system block diagram of two communicating entities including derivable secret keys in accordance with the present invention.

Figure 2 illustrates the difference in channel impulse response estimates due to different starting points at the first node and the second node.

Figure 3 is a flow chart showing the process of deriving a secret key in accordance with the present invention.

Figure 4 is a flow diagram showing the process of using a joint random bit-derived secret key that is not shared by others in accordance with an embodiment of the present invention.

FIG. 5 is a flow chart showing a process of using a joint random bit-derived secret key that is not shared by others according to another embodiment of the present invention.

Figure 6 is a flow chart showing the process of using a joint random bit-derived secret key that is not shared by others according to still another embodiment of the present invention.

Figure 7 is a flow chart showing a process for using a joint random bit-derived secret key that is not shared by others in accordance with still another embodiment of the present invention.

Figure 8 is a flow diagram of the process of deriving a secret key using a Diffie-Hellman key derivation algorithm in accordance with the present invention.

800. . . flow chart

AP. . . Access point

a, b. . . Secret integer

g. . . Cardinal number

p, q. . . Prime number

WTRU. . . Wireless transmission/reception unit

Claims (45)

A method for securing wireless communication between a first node and a second node, the method comprising: (a) the first node generating a first channel impulse response based on the transmission transmitted by the second node Estimating; (b) the first node performs an error correction coding on the first channel impulse response estimate to generate a parity bit; (c) the first node transmits the parity bit to the second node; The second node generates a second channel impulse response estimate based on the transmission transmitted by the first node; and (e) the second node responds to the second channel with the received parity bit An error correction decoding is performed such that the second node obtains the same channel impulse response estimate as the first node as the joint random bit is not shared by others. The method of claim 1, further comprising: the first node post-processing the first channel impulse response estimate; and the second node post-processing the second channel impulse response estimate, wherein the first node The error correction encoding is performed with the first channel impulse response estimate after post processing, and the second node performs the error correction decoding with the second channel impulse response estimate after post processing. The method of claim 1, wherein the parity bit is generated by applying block coding on the first channel impulse response estimate. The method of claim 1, wherein the parity bit is generated by applying system convolutional coding on the first channel impulse response estimate. The method of claim 1, wherein the first node transmits a synchronization code to the second node, whereby the second node synchronizes the second channel impulse response estimate with the synchronization code One channel impulse response estimate. The method of claim 1, wherein the first node and the second node synchronize the second channel impulse response estimate with the first channel impulse response estimate by using a global positioning system (GPS) signal . The method of claim 1, further comprising: the first node and the second node deriving a secret key by using the joint random bit that is not shared by others. The method of claim 7, further comprising: the first node and a verification server verifying each other; and the first node exchanging a secret with the verification server, wherein the first node and the second node are more The secret key is generated based on the secret. The method of claim 8, further comprising: the second node derives a group key from the key; and the second node provides the group key to the first node for the first node Communicate with the second node. The method of claim 7, wherein the first node and the second node generate the key based on a first shared key. The method of claim 7, wherein the first node and the second node periodically generate the joint random bit that is not shared by others to generate a new key. The method of claim 7, wherein the key is a pair of master keys. The method of claim 7, further comprising: the first node and a verification server verifying each other; the first node exchanging a master secret with the verification server; and the first node and the second node A pair of master keys are derived from the master secret, wherein the first node and the second node generate the secret key based on the paired master keys. The method of claim 13, further comprising: the second node deriving a group key from the secret key; and the second node providing the group key to the first node for the first node Communicate with the second node. The method of claim 12, wherein the first node and the second node set a first shared key as the paired master key. The method of claim 7, further comprising: the first node and a verification server verifying each other; the first node exchanges a pre-master secret with the verification server; and the verification server secretly transfers the first master secret To the second node; the first node and the second node derive a master key by using the master secret and the unshared joint random bit, and the first node and the second node use the master The secret derives a pair of master keys from the shared random bit that is not shared by others, wherein the first node and the second node use the paired master key to share the joint random bit with the others Secret key. The method of claim 16, further comprising: the second node derives a group key from the key; and the second node provides the group key to the first node for A node communicates with the second node. a first node, configured to ensure security of wireless communication between the first node and the second node in a wireless communication system including the first node and a second node, the first node comprising: a channel estimate a detector for generating a first channel impulse response estimate from the transmission transmitted by the second node; and an error correction encoder for performing error correction coding by estimating the first channel impulse response Generating a parity bit, the parity bit being transmitted to the second node, the second node generating a second channel impulse response estimate from the transmission transmitted by the first node, and using the parity bit The two-channel impulse response performs an error correction decoding whereby the first node and the second node obtain the same channel impulse response estimate as the joint random bit is not shared by others. The first node of claim 18, further comprising: a post processor for performing post-processing on the first channel impulse response estimation, whereby the first node uses the first after post-processing The channel impulse response estimate is performed to perform the error correction coding. The first node of claim 18, wherein the error correction encoder applies the block coding on the first channel impulse response estimate to generate the parity bit. The first node of claim 18, wherein the error correction encoder applies the system convolutional coding on the first channel impulse response estimate to generate the parity bit. The first node of claim 18, further comprising: a synchronization code generator for generating a synchronization code to be transmitted to the second node, whereby the second node synchronizes using the synchronization code The second channel impulse response estimate is estimated with the first channel impulse response. For example, the first node of claim 18 includes: a secret key generator for generating a secret key by using the shared random bit not shared by others. The first node of claim 23, wherein the first node and a verification server authenticate and exchange a secret with each other, wherein the first node and the second node further generate the secret based on the secret. For example, the first node of claim 23, wherein the secret key generator further generates the key based on a first shared key. The first node of claim 23, wherein the first node periodically generates the joint random bit that is not shared by others to generate a new key. For example, the first node of claim 23, wherein the key is a pair of master keys. For example, in the first node of claim 23, wherein the first node and a verification server mutually authenticate and exchange a master secret, the secret key generator derives a pair of master keys from the master secret and further The pair of master keys is used to generate the key. The first node of claim 23, wherein the secret key generator sets a first shared key as a pair of master keys, and generates the key based on the pair of master keys. The first node of claim 23, wherein the first node and a verification server mutually authenticate and exchange a master secret, and the secret key generator uses the prior master secret to share the joint random with the undistributed a master key is derived from the bit, the master key is used to share the joint random bit to derive a pair of master keys, and the paired master key is used to share the joint random bit with the unshared bit The key is derived. a second node, configured to ensure security of wireless communication between the first node and the second node in a wireless communication system including a first node and the second node, the second node comprising: a channel estimate a detector for generating a second channel impulse response estimate from the transmission transmitted by the first node; and an error correction decoder for performing error correction decoding on the second channel impulse response by the parity bit, The parity bit is generated by the first node performing error correction coding through a first channel impulse response estimation generated by the transmission transmitted from the second node, whereby the first node and the second node The same channel impulse response estimate is obtained as a joint random bit not shared by others. The second node of claim 31, further comprising: a post processor for performing post-processing on the second channel impulse response estimation, whereby the error correction decoder is after the post-processing The two-channel impulse response estimate performs the error correction decoding. The second node of claim 31, further comprising: a synchronization unit, configured to synchronize the second channel impulse response with the first channel by using a synchronization code transmitted by the first node Impulse response estimation. The second node of claim 31, wherein the second node synchronizes the first channel impulse response estimate with the second channel impulse response estimate by using a global positioning system signal. For example, the second node of claim 31 of the patent scope further includes: a secret key generator for generating a secret key by using the shared random bit not shared by others. The second node of claim 35, wherein the first node and a verification server authenticate and exchange a secret with each other, wherein the secret key generator further generates the secret based on the secret. The second node of claim 36, wherein the secret key generator derives a group key from the key and provides the group key for communication between the first node and the second node. To the first node. For example, the second node of claim 35, wherein the secret key generator further generates the key based on a first shared key. For example, the second node of claim 35, wherein the second node periodically generates the joint random bit that is not shared by others to generate a new key. For example, the second node of claim 35, wherein the key is a pair of master keys. For example, in the second node of claim 35, wherein the first node and a verification server mutually authenticate and exchange a master secret, the secret key generator derives a pair of master keys from the master secret and further The pair of master keys is used to generate the key. The second node of claim 41, wherein the secret key generator derives a group key from the key and provides the group key for communication between the first node and the second node To the first node. For example, in the second node of claim 35, the first node and the second node set a first shared key as a pair of master keys, and generate the key based on the paired master keys. The second node of claim 35, wherein the first node and a verification server mutually authenticate and exchange a master secret, and the secret key generator uses the prior master secret to share the joint random with the undistributed a master key is derived from the bit, the master key is used to share the joint random bit to derive a pair of master keys, and the paired master key is used to share the joint random bit with the unshared bit The key is derived. The second node of claim 44, wherein the secret key generator derives a group key from the key and provides the group key for communication between the first node and the second node To the first node.