WO2006131852A1

WO2006131852A1 - Protected wireless network access

Info

Publication number: WO2006131852A1
Application number: PCT/IB2006/051749
Authority: WO
Inventors: Philippe Teuwen
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2005-06-06
Filing date: 2006-06-01
Publication date: 2006-12-14

Abstract

An access point (12) for a wireless network is provided with two operating modes. In a first operating mode, network access is limited to home devices (14) using a home encryption key. In a second operating mode, access to the network by a guest device (16) is enabled using a guest encryption key.

Description

PROTECTED WIRELESS NETWORK ACCESS

The present invention relates to wireless networks.

Wireless networks, such as those defined in the IEEE standard 802.1, are becoming more common, in both home and office environments. To ensure adequate security of the network, a wired equivalent protocol (WEP) technique can be used in which communications are encrypted using a secret WEP key. For example, see http://staiidards.ieee. org/getieee8G2/8Q2.11.html. The WEP technique is intended to make security of wireless networks straightforward by using a predefined encryption key for devices on the network. However, using a single, predetermined key value has a significant disadvantage, as will be described.

The problem occurs with such WEP enabled networks: when a guest device is to access the network services, the guest device must be given the secret WEP key. The network host must then change the WEP key for the network following the guest device's departure, in order to avoid unauthorised further use of the network services. Alternatively, a temporary key is assigned to the network, and then the key returned to the original settings following the guest departure.

Such reconfiguration of the network requires some fairly detailed knowledge of network administration, and, even then, is relatively cumbersome and so very unlikely to be performed, particularly in the home environment.

However, failure to change WEP key values means that the guest device would always have access to the network services and resources, since the guest device would always have a valid WEP key for the network.

Accordingly, it is an object of the present invention to provide a technique that enables straightforward guest access to a wireless network, but which overcomes the security disadvantages of existing techniques. Accordingly, an embodiment of the present invention provides an access point having a first operating mode in which communication is enabled with a first predefined set of wireless devices using a first encryption key. The access point is provided with a second operating mode in which communication is enabled with the first predefined set of wireless devices and with a guest wireless device, using a second encryption key different from the first encryption key.

In one particular embodiment, communication is enabled using the IEEE802.11 wireless communication standard incorporating the wired equivalent protocol security technique. Such embodiments have the advantage that complex network administration is avoided, by providing an appropriate number of preset operating modes, which merely need switching between. In one embodiment, the access point includes a switch operable to switch the access point between the operating modes.

In the second operating mode, communication can be enabled with a plurality of guest devices using the second encryption key, thereby enabling a plurality of guest devices access to the network.

An access point embodying the present invention may also include a memory device operable to store the first and second encryption keys. The memory device can store a plurality of guest encryption keys, and the access point can then, in the second operating mode, retrieve a selected guest encryption key for use as the second encryption key.

In another aspect of the present invention, a method of operating a wireless network access point comprises, in a first operating mode, communicating with a first predetermined set of wireless devices using a first encryption key, and, in a second operating mode, communicating with the first predetermined set of wireless devices and with a guest wireless device using a second encryption key.

In another aspect of the present invention, a method of enabling communication between a wireless access point, a first predetermined set of wireless devices and a guest wireless device comprises, in a first operating mode, communicating with a first predetermined set of wireless devices using a first encryption key, and, in a second operating mode, communicating with the first predetermined set of wireless devices and with a guest wireless device using a second encryption key.

In one embodiment of such a method, the access point and each of the first predetermined set of wireless devices store the first and second encryption keys, and the or each guest wireless device stores only the second encryption key. Fig. 1 is a block diagram illustrating a wireless network; and Fig. 2 is a block diagram illustrating an access point embodying the present invention.

Figure 1 illustrates a wireless network 1 embodying one aspect of the present invention. The network 1 includes a server 10 which provides the network services and resources. It will be appreciated that the server shown in Figure 1 is merely illustrative of the network services and resources, and that these may be provided by any combination of appropriate devices.

The server 10 is connected with a wireless access point (AP) 12. The server 10 and access point 12 transfer data with one another, and the access point 12 defines a wireless node for the network. A home wireless device 14 communicates wirelessly with the access point 12, for example using radio frequency (RF) communications in the manner specified by the IEEE 802.11 standard.

In a wireless network embodying the present invention, the wired equivalent protocol technique is used for ensuring security of the wireless network. The wired equivalent protocol (WEP) technique uses an encryption and decryption key which is kept secret. Every device can have up to four WEP keys, that are generally numbered 0 to 3. Each device in the wireless network is configured to set values for at least one of the keys, with a flag used to indicate the number of the key to be used for transmission.

A guest device 16 is also shown in Figure 1 communicating with the access point 12. The guest device 16 is granted temporary access to the network 1 using a technique embodying one aspect of the present invention. Figure 2 illustrates an access point 12 which embodies a further aspect of the present invention. The access point 12 includes a controller 121 which communicates with the server 10 (of Figure 1) via a network interface 122. The access point includes a radio frequency (RF) transceiver 123 which transmits and receives radio frequency signals via an antenna 124. The controller 121 transfers data with the RF transceiver 123 to control transmission of data therefrom, and to receive incoming data therefrom. The access point 12 also includes a memory device 125 for storing configuration settings and key values, for example, and also includes an input device 126 for providing user inputs to the controller 121. The input device can be provided by physical buttons on the access point, or by inputs received from the server 10 or the mobile wireless devices 14, 16. The access point 12 is provided with two modes of operation, namely a "home mode" and a "guest mode". In the home mode, a home WEP key is used by "home" devices on the network, and no other devices are able to access the network 1. In the guest mode, the guest WEP key is used for transmissions to and from the guest device. A data value trkey is used to indicate the key being used by the transmitting device.

The home mode allows only designated "home" devices to access the network, by using a home WEP key. Each home device is assigned the home key, for example as key [0], and the access point 12 and home device 14 use this key [0] for communication. The access point 12 and the home device 14 both transmit using key [O]. In this case trkey=O.

In the guest mode, key[l] is used for transmissions from the access point 12. The guest device 16 is provided only with the value of key [I]. In the guest mode, the host will give to the guest the following WEP configuration for him to configure the guest device: Key [ 1 ]=GGGGG; trkey=l . The static configuration of the home device therefore includes both the home key and the guest key. This configuration is set at the initial configuration of the network, and need not be changed on each of the home devices.

The two modes of operation use different configurations. In the home mode, the access point 12 is provided only with the home key, and in the guest mode the access point 12 is provided with both the home and guest keys, and is set for transmission using the guest key.

The mode of operation of the access point 12 is therefore all that need be changed when allowing a guest access to the network. The access point 12 can be provided with a hardware switch to change the mode of operation, in order that the change is simple. In the home mode, the home device 14 and the access point 12 both use the exclusively home WEP key, key[0], trkey=O in this example, for communications. The guest device is unable to eavesdrop on the communication, or access network resources because the home key is unknown to the guest device.

In the guest mode, all of the access point 12 transmissions are performed using the guest key, in this example key[l], trkey=l. The home device 14 transmits to the access point 12 using the home key, key [O]. The access point 12 transmits to the home device using the guest key, key[l]. Since the home device has the guest key as key[l], such transmission is possible. The transmissions from the home device use the home key in order to avoid the need to reconfigure the home device 14. The transmissions from the home device use the same (home) key in both the home and guest modes of operation.

The guest device 16 knows the guest key, and so communications in the guest mode between the access point 12 and the guest device 16 make use of the guest key. In the infrastructure mode of operation of IEEE 802.11 , all transmissions are routed through the access point 12, and so communication between the home and guest devices 14 and 16 is possible using the access point to re-encrypt home device communications using the guest key.

When the guest device 16 leaves the network, the access point 12 is switched back to the home mode, such that access point transmissions are performed using the home key. This means that the guest device is no longer known to the access point 12, and so the access point refuses communication request from the guest device. This refusal is a product of the configuration of the access point in the home mode. The home mode simply does not include the guest key, and so illegitimate communications are prevented. In a further embodiment of the present invention, more than one guest key can be defined, and the guest mode can use one of the guest keys. For example, the guest keys can be chosen in succession, or be chosen randomly. Use of multiple guest keys can prevent unwanted access from a previous guest device when the guest mode is entered again. In the case where a single guest key is used, all previous guests could access the network whenever it is in the guest mode. Using multiple possible guest keys substantially reduces the probability of this occurring. If multiple keys are to be used, then these are defined upon initialisation of the network, and the home devices are configured with all of the possible guest keys. In accordance with IEEE802.11, up to three additional guest keys can be defined. It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be capable of designing many alternative embodiments without departing from the scope of the invention as defined by the appended claims. In the claims, any reference signs placed in parentheses shall not be construed as limiting the claims. The words "comprising" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. The singular reference of an element does not exclude the plural reference of such elements and vice-versa. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer, if appropriate. In a claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

CLAIMS:

1. A wireless network access point (12) having a first operating mode in which communication is enabled with a first predefined set of wireless devices (14) using a first encryption key, and a second operating mode in which communication is enabled with the first predefined set of wireless devices (14) and with a guest wireless device (16), using a second encryption key different from the first encryption key.

2. An access point as claimed in claim 1, comprising a switch (126) operable to switch the access point between the operating modes.

3. An access point as claimed in claim 1 or 2, wherein, in the second operating mode, communication is enabled with a plurality of guest devices (16) using the second encryption key.

4. An access point as claimed in any one of claims 1 to 3, comprising a memory device (125) operable to store the first and second encryption keys.

5. An access point as claimed in claim 4, wherein the memory device (125) is operable to store a plurality of guest encryption keys, and the access point (12) is operable, in the second operating mode, to retrieve a selected guest encryption key for use as the second encryption key.

6. A method of operating a wireless network access point (12), the method comprising: in a first operating mode, communicating with a first predetermined set of wireless devices (14) using a first encryption key; and in a second operating mode, communicating with the first predetermined set of wireless devices (14) and with a guest wireless device (16) using a second encryption key.

7. A method as claimed in claim 6, comprising, in the second operating mode, communicating with a plurality of wireless guest devices (16) using the second encryption key.

8. A method as claimed in claim 6, or 7, comprising storing a plurality of guest encryption keys in a memory device (126), selecting the second encryption key from the plurality of guest encryption keys, and retrieving the selected guest key from the memory device (126) for use as the second encryption key.

9. A method of enabling communication between a wireless access point, a first predetermined set of wireless devices and a guest wireless device, the method comprising: in a first operating mode, communicating with a first predetermined set of wireless devices (14) using a first encryption key; and in a second operating mode, communicating with the first predetermined set of wireless devices (14) and with a guest wireless device (16) using a second encryption key.

10. A method as claimed in claim 9, wherein the access point and each of the first predetermined set of wireless devices store the first and second encryption keys, and the or each guest wireless device stores only the second encryption key.