EP2030404A1

EP2030404A1 - Method and system for providing a mesh key

Info

Publication number: EP2030404A1
Application number: EP07729627A
Authority: EP
Inventors: Rainer Falk; Florian Kohlmayer
Original assignee: Nokia Siemens Networks GmbH and Co KG
Current assignee: Nokia Solutions and Networks GmbH and Co KG
Priority date: 2006-06-01
Filing date: 2007-05-29
Publication date: 2009-03-04
Also published as: US8959333B2; KR20090016029A; DE102006036109A1; US20090307483A1; WO2007138060A1; DE102006036109B4

Abstract

Method for providing a mesh key which can be used to encrypt messages between a first node (1A) and a second node (1B) of a mesh network (1), wherein a session key is generated when authenticating the first node (1A) in an authentication server (2), the first node (1A) and the authentication server (2) or an authentication proxy server (3) using a predefined key derivation function (KDF) to derive the mesh key from said session key, which mesh key is transmitted to the second node (1B).

Description

Method and system for providing a mesh key

The invention relates to a method and a system for providing a key for encrypting messages between nodes of a mesh network.

A wireless mesh network is a meshed network implemented, for example, in a Wireless Local Area Network (WLAN). In a mesh network, a mobile node may forward data originating from another mobile node to another mobile node or transmit it to a base station. In a mesh network or mesh network can be spanned over long distances, especially in uneven or difficult terrain. Mesh networks also work very reliably as each mobile node is connected to several other nodes. If a node fails, for example because of a hardware failure, its neighbor nodes look for an alternate data transmission route. Mesh networks or mesh networks can include fixed or mobile devices.

Fig. 1 shows schematically a mesh network according to the prior art. The nodes include dedicated mesh nodes

(MN), which belong to the infrastructure of the network. These dedicated mesh nodes may be a fixed base station BS but also a mobile station MS. In addition to the dedicated mesh nodes, the mesh network also includes mobile devices or mobile nodes of users. The mobile nodes can communicate directly with another mobile node and, directly or indirectly through other nodes, exchange data with a base station BS connected to a gateway GW of a data network. In this case, data packets DP are forwarded from one device or node to the next device until the destination device or the gateway GW has been reached. The forwarding of the data packets DP takes place by dynamic routing. The routes on which The data packets DP are transmitted, are calculated dynamically based on the availability of nodes and on the basis of network utilization. In general, mesh networks are characterized by high network coverage, high reliability and economical use of available resources. In wireless mesh networks, the wireless transmission link is conventionally realized by a WLAN (Wireless Local Area Network) transmission link. Unlike a Wireless Personal Area Network (WPAN), WLAN networks have larger transmission powers and ranges and offer higher data transmission rates.

For the authentication of nodes or computers, the so-called EAP (Extensible Authentication Protocol) is used. FIG. 2 shows a signal diagram for illustrating an authentication process in a conventional WLAN network. The EAP protocol is used in WLAN to secure network access. Various concrete authentication methods, so-called EAP methods, can be transported via the EAP protocol, eg EAP-TLS, EAP-AKA, PEAP-MSChapv2. During the authentication, a cryptographic key or session key MSK, EMSK (MSK: Master-Session Key, EMSK: Extended Master Session Key) is determined which is subsequently used to protect the data communication, for example in the case of link-layer encryption. The authentication of a subscriber takes place between the subscriber (supplicant) and an authentication server (AAA server). If authentication is successful, the authentication server sends the result of the authentication and the session key MSK originating from the authentication to the authenticator, for example a WLAN access point AP. The communication between the access node or access point AP and the authentication server usually takes place via the radius or diameter data transmission protocol. In this case, the session key MSK is sent as a data attribute to the access node AP as part of an EAP Success message. The transmitting session key MSK is then connected via an 802.11 4-way handshake 4WHS between the subscriber and the access node according to the 802.11 IEEE standard.

In a conventional network, the access node AP is a trusted node, i. around a node of the network infrastructure. The access node is thus not an end user node in a conventional network.

3 shows the authentication of two nodes MPA, MPB in a conventional WLAN network. For example, the two nodes MPA, MPB can be two mesh nodes of a mesh network. To set up a data connection between the two nodes MPA, MPB, the end node MPA (as supplicant) first authenticates with the associated authentication server AS-B by means of the EAP data transmission protocol. In an EAP Success message, the node MPB (Authenticator) receives a session key MSK1. Subsequently, the node MPB performs a 4-way handshake with the node MPA, using the received session key MSK1. Subsequently, the node MPB (now as supplicant) performs an authentication on the associated authentication server AS-A, and MPA (now authenticator) receives a second session key MSK2 in an EAP success message. The node MPA then performs a 4-way handshake with the node MPB using the second session key MSK2.

In the further communication between the two nodes MPA, MPB this can be secured by one of the two session keys MSKL, MSK2.

A disadvantage of the prior art approach illustrated in Figure 3 is that nodes MPA, MPB may be mesh nodes that are not part of the network access infrastructure and thus manipulatable. For example, in the case of an authentication of a mesh node MPA at its authentication server, an EAP authentication message can be forwarded via another mesh node MPB, which uses the received session key MSK1 for manipulation purposes. For example, the mesh node MPB can use the received session key MSK for other services and pretend to the other mesh node MPA that it is, for example, a VPN (Virtual Private Network) server. From the point of view of the mesh node MPA, the manipulated node MPB will behave like a VPN server of a company intranet.

It is therefore the object of the present invention to provide a method and system for providing a mesh key which can be used for the encryption of messages between two nodes of a mesh network in which a manipulation is excluded.

This object is achieved by a method having the features specified in claim 1.

The invention provides a method for providing a mesh key, which can be used for encrypting messages between a first node and a second node of a mesh network, wherein upon authentication of the first node at an authentication server, a session key is generated, from which the first node and the authentication server or an authentication proxy server by means of a predetermined key derivation function derive the mesh key, which is transmitted to the second node.

In the preferred embodiment of the method according to the invention, the authentication server is formed by an AAA server. In a further embodiment of the method according to the invention, the AAA proxy server is provided in a mesh gateway node.

In a preferred embodiment of the method according to the invention, the session key is formed by an MSK key (master session key).

In one embodiment of the method according to the invention, the key derivation function KDF is formed by a cryptographic hash function.

In a preferred embodiment of the method according to the invention, the key derivative function KDF is formed by an HMAC-SHA1, HMAC-MD5, HMAC-SHA256, PRF, SHA-I, MD5 or SHA256 function.

In a further embodiment of the method according to the invention, the mesh key is derived by means of a derivative function KDF as a function of the session key and a character string.

The string is preferably composed of a plurality of concatenated substrings.

In a preferred embodiment of the method according to the invention, a substring is formed by a network identification of the mesh network.

In one embodiment of the inventive method, a sub-string is formed by a MAC address of the second node.

In a preferred embodiment of the method according to the invention, when the mesh key is transmitted to the second node, a flag indicates that the transmitted key is a mesh key. In one embodiment of the method according to the invention, the authentication of the first node takes place according to an EAP protocol.

In a preferred embodiment of the method according to the invention, the second node exchanges messages with the authentication server according to the radius or diameter protocol.

In a method according to the invention, the second node is provided with a mesh key derived therefrom instead of the generated session key.

In one embodiment of the method according to the invention, the authentication server is also used for further authentications relating to communications other than communication between the mesh nodes.

In the case of authentications which relate to the other communications, preferably generated session keys are provided. The mesh key is preferably not usable as a session key for the other communications.

The invention further provides a system for providing a mesh key, which can be used for encrypting messages between a first node and a second node of a mesh network, wherein an authentication of the first node is generated at an authentication server, a session key the first node and the authentication server or an authentication proxy server derive the mesh key, which is transferable to the second node, by means of a predetermined key derivation function.

Furthermore, preferred embodiments of the method according to the invention and of the system according to the invention are described below. ter reference to the accompanying figures for explaining features essential to the invention described.

Show it:

Fig. 1 shows a mesh network according to the prior art;

2 is a diagram for explaining the authentication process in a conventional WLAN network access;

3 shows a further diagram for explaining the authentication process in a conventional WLAN network access for two nodes of a mesh network;

4 shows a signal diagram for explaining a first embodiment of the method according to the invention for providing a mesh key;

Fig. 5 is a further signal diagram for explaining a further embodiment of the method according to the invention for providing a mesh key.

As can be seen from Fig. 4, a mesh network 1 includes at least two nodes IA and IB which can communicate directly with each other. The mesh nodes IA, IB can be mobile terminals but also base stations. The authentication of a node IA, IB is carried out by means of an associated authentication server 2. The nodes IA, IB may have a common authentication server 2 or locally separate authentication servers 2A, 2B may be provided for the respective node IA, IB. The authentication process takes place in the embodiment illustrated in FIG. 4 via an authentication proxy server 3, which is preferably located in a gateway node GW of an access network. The authentication of a network node IA at the authentication server 2 is carried out by means of the EAP data protocol, wherein the network node IA an associated subscriber identity NAI to its Authen- tisierungsserver 2 transmits, which reads from a table a zughorigen session key MSK or is generated in the context of authentication by means of the EAP data protocol. The session key MSK-A for the network node IA is in the inventive method in an EAP Success-

Message to the authentication proxy server 3, as shown in Fig. 4 can be seen. The authentication proxy server 3 derives from the received session key MSK-A by means of a key derivation function KDF (Key Derivation Function) a unique mesh key (mesh key A) and transmits it within an EAP success message to the second node IB.

In a preferred embodiment, an indicator flag is additionally transmitted to the second node IB, which indicates that the transmitted key is a mesh key. Subsequently, a 4-way handshake between the two nodes IA, IB using the transmitted mesh key (mesh key A). The derived mesh key is used to secure transmitted messages in the mesh network and not for other services such as VPN.

The authentication of the second node IB in the associated authentication server 2 takes place in the same way as in the case of the first node IA. After transferring a subscriber identity NAI of the second node IB, the authentication server 2 reads out an associated session key MSK-B or determines it in the context of authentication by means of the EAP data protocol and transmits it to the authentication proxy server 3. Derivation of the Mesh key B by means of the derivation function KDF is performed by the authentication proxy server 3, which transmits the derived mesh key (mesh key B) with an appropriate display flag in an EAP success message to the other node IA transfers. Subsequently, a 4-way handshake takes place between the two nodes IA, IB, which is secured by the second mesh key (mesh key B). Thereupon secure data transmission or communication between the two nodes IA, IB is possible using one of the two or using both mesh keys (mesh key A, mesh key B).

5 shows a further signal diagram for explaining the method according to the invention for providing a mesh key. In the example shown in FIG. 5, in the authentication of the first node IA, the authentication proxy server 3 is not integrated in the communication between the authenticator IB and the authentication server 2B. Therefore, in this embodiment, the authentication server 3 does not perform the mesh key derivation function. Rather, the second node IB directly receives the session key MSK-A. If the EAP Success message received from the node IB does not contain a display flag indicating that the key is a mesh key, the node IB recognizes that the derivation function KDF is yet to be performed. The node IB therefore derives the mesh key (mesh key A) from the received session key MSK-A by means of a predefined derivation function KDF. In the subsequent authentication of the other node, the authentication takes place, as already shown in FIG. 4, via the authentication proxy server 3. The derivation of the second mesh key (mesh key B) accordingly takes place by the authentication proxy Server 3.

In another embodiment, the authentication of both nodes IA, IB takes place directly without the help of an authentication proxy server 3, whereby the key derivation takes place in each case through the other node.

In the method according to the invention, a further key is derived from the session key read or generated in the authentication process by means of a predefined key derivation function KDF, the original session key being determined on the basis of the derived mesh key. Key is no longer reconstructable. The additional key derivation increases security because a node in the meshed network only receives a derived mesh key that is usable only within a mesh network, but not for other applications for which it is to be separately authenticated.

In the method according to the invention, the existing authentication infrastructure is used.

In a preferred embodiment of the method according to the invention, the generated session key is formed by an MSK key (master session key).

The key derivation function KDF (Key Derivation Function) is preferably a cryptographic hash function. The key derivation function used is preferably an HMAC-SHA1, HMAC-MD5, HMAC-SHA256, PRF, SHA-I, MD5 or SHA256 function. From the mesh key derived by means of the cryptographic key derivation function KDF, the original session key MSK can not be deduced. This prevents a mesh node from deriving the session key from the mesh key and using it for manipulation purposes.

The actual key derivation can take place on the one hand by an authentication proxy server 3 or authentication server 2 or on the other hand by a node of the mesh network. The key derivation is preferably performed by an authentication proxy server 3, i. a Radius proxy server or a Diameter proxy server, which forms part of a gateway node and thus belongs to the network infrastructure.

In an alternative embodiment, the key derivation of the mesh key can already be performed by the authentication server 2 itself. In this embodiment The session key MSK can be used or alternatively also an extended session key EMSK (Extended MSK). From the extended session key, the authentication key server 2 derives the mesh key.

In a further embodiment of the inventive method, the authentication server 2 can transmit the session key MSK and the mesh key derived therefrom. The authentication proxy server 3 can then simply delete or ignore the unnecessary session key MSK.

In a preferred embodiment of the method according to the invention, the mesh key is derived by means of a key derivation function KDF in dependence on the session key MSK and a string.

The string can be composed of several substrings. In this case, a sign string is preferably formed by a network identification of the mesh network (mesh ID).

Another substring is preferably formed by a MAC address of a mesh node (MAC-Auth).

The key derivation of the mesh key (mesh MSK) results, for example, as follows:

Mesh MSK = HMAC-SHAl (MSK, "Mesh-MSK | MAC-Auth | Mesh-ID")

The symbol "| "for the concatenation of sub-strings.

The additional key derivation according to the method of the invention substantially increases the security of the data transmission since the authenticator mesh node only receives a derived key that is only within a mesh network is usable, but not for other applications in which a separate EAP authentication is done, can be used.

Claims

claims

A method for providing a mesh key, which is used for encryption of messages between a first node (IA) and a second node (IB) of a mesh network (1), wherein in an authentication of the first node (IA) at an authentication server (2) a session key is generated, from which the first node (IA) and the authentication server (2) or an authentication proxy server (3) by means of a predetermined key derivation function (KDF) derive the mesh key, which is transmitted to the second node (IB).

2. The method of claim 1, wherein the authentication server (2) is formed by an AAA server.

The method of claim 1, wherein the AAA proxy server (3) is provided in a mesh gateway node.

4. The method of claim 1, wherein the generated session key is formed by an MSK (Master Session Key) key.

5. The method of claim 1, wherein the key derivation function (KDF: Key Derivation Function) is formed by a cryptographic hash function.

6. The method of claim 5, wherein the key derivation function (KDF) is formed by an HMAC-SHAl, HMAC-MD5, HMAC-SHA256, PRF, SHA-I, MD5 or SHA256 function.

7. The method according to claim 1, wherein the mesh key is derived by means of a key derivation function (KDF) depending on the session key and a string.

8. The method of claim 7, wherein the string is composed of a plurality of concatenated substrings.

The method of claim 8, wherein a substring is formed by network identification of the mesh network.

10. The method of claim 8, wherein a substring is formed by a MAC address of the second node (IB).

The method of claim 1, wherein upon transmission of the mesh key to the second node (IB), a flag indicates that the transmitted key is a mesh key.

The method of claim 1, wherein the authentication of the first node (IA) is according to an EAP protocol.

13. The method of claim 1, wherein the second node (IB) exchanges messages with the authentication server according to the RADIUS or DIAMETER protocol.

The method of claim 1, wherein the second node (IB) is provided with the mesh key derived therefrom instead of the generated session key

15. The method according to claim 1, wherein the authentication server (2) is also used for further authentications which relate to communications other than those between mesh nodes (IA, IB).

The method of claim 15, wherein a generated session key is provided for authentication involving communications other than communication between mesh nodes (IA, IB)

17. A system for providing a mesh key, which is used for encryption of messages between a first node (IA) and a second node (IB) of a mesh network (1), wherein in an authentication of the first node (IA) at an authentication server (2) generates a session key from which the first node (IA) and the authentication server (2) or an authentication proxy server (3) derive the mesh key by means of a predefined key derivation function (KDF) which is transferable to the second node (IB).

18. The system of claim 17, wherein the authentication server (2) is an AAA server.

The system of claim 17, wherein the authentication proxy server is an AAA proxy server.

20. The system of claim 19, wherein the AAA proxy server (3) is provided in a gateway node.

The system of claim 14, wherein a mesh node (IA, IB) is an end-user device.

The system of claim 14, wherein a mesh node is a WLAN access node.