Public access point

Technical field The present invention relates to wireless public access to electronic networks. In particular, the present invention relates to an architecture that allows the creation of a virtual basic service set from within a physical access point to an electronic network.

Public WiFi hotspots are deployed using traditional IEEE standard 802.11 compliant access points, with a few exceptions. However, the IEEE standard 802.11 architecture and security model are unsuitable for public use. The stations associated with the access point (AP) share the 802.11 Basic Services Set (BSS) or wireless LAN. No station in the BSS is safe against attacks initiated by other members unless all members of the BSS are credible. Attacks of this type also include stealing basic services and any confidential information provided by subscribers to obtain services, such as password and credit card information. Other attacks include disrupting network integrity and quality of service. It is impractical to consider the public BSS, that is, all members of what consists of stations associated with public APs, to be credible. Therefore, stations are vulnerable to public BSS.

Sharing the public BSS also poses other threats. BSS members may contaminate other member stations with warm or Trojan horses. Port-based DCOM RPC attacks, MS blasters and Welchia warms are good examples. This threat is exacerbated by the public BSS, which is an electronic sewage reservoir. How can the agency deal with these threats? Stations in the BSS may protect themselves with defenses such as private firewalls. Public WiFi providers, on the other hand, may deploy security models that protect subscribers from each other. One approach is to ban inter-station communication. This approach, however, is an unsupportable solution. Stations that trust each other should be allowed to communicate between themselves, even in public settings. For example, the station must be able to access a file server on the same local LAN at a meeting held at a convention center. For example, this is what is normally done in a standard meeting. If this kind of sharing is allowed, the intruder will use the IEEE. Under standard 802.11, it will be easy to disable the entire BSS. This was demonstrated at the 2001 Yousenix Security Conference and the 2001 DEFCON Conference in Las Vegas. No security model for any wireless LAN today can support this type of sharing without leading to vulnerabilities.

It is advantageous to provide a security model for wireless LANs that can support the sharing of a single physical BSS without inducing vulnerabilities or compromising security between stations using BSS. There will be.

<p> The present invention provides a security model for wireless LANs that can support the sharing of a single physical BSS by a station without inducing vulnerabilities or compromising the security of the station. Thus, a new kind of access point is provided. And it is referred to herein as a public access point (PAP). PAP has a different security architecture than that specified by IEEE Standard 802.11. The PAP architecture allows the creation of virtual basic service sets from within a single physical AP. Any number of virtual service sets can be created, and any number of terminals can be attributed to the virtual BSS. The PAP appears to the terminal as multiple physical 802.11 access points, one for each virtual BSS. Therefore, PAPs are fully interoperable with any 802.11 terminal.</p><p> Consider a convention center as an example of using PAP. Different conferences may use 802.11 standard projectors. PAP provides separate link privacy and integrity for each, allowing separate LAN segments to be provided for each conference. Using only the IEEE standard 802.11 instead, the conference projector and all stations that can be projected using it use a private access point or ad hoc WLAN, and WLAN membership, authentication and keying. You have to manage the keying material. Otherwise, anyone can project with the projector, or worse, intercept valid projector traffic before it is displayed and it will be monitored by outsiders. , Could be modified.</p><p> In addition to the overwhelming security management burden associated with traditional approaches, conference planners utilize local access points rather than installing and configuring their own access points for each venue. I like that. PAP can manage all security. Thereby, all terminals in each conference, including shared projectors and any local file server, are efficiently associated with virtual 802.11 access points for that conference, and all virtual basic access points have the same physical. It arises from PAP.</p><p> The present invention also provides a location update protocol for updating the forwarding table of a bridge that connects public access points together.</p><p> The present invention also provides a method for more controlled bridging called fine bridging.</p>

<figref num="1">It is a schematic diagram of an IEEE standard 802.11 protocol entity.</figref><figref num="2">It is a block diagram of the configuration infrastructure of IEEE standard 802.11.</figref><figref num="3">It is a schematic diagram of the public access point architecture according to this invention.</figref><figref num="4">It is a block diagram of the policy for accessibility within the virtual BSS of three stations, one of which is an AP, according to the present invention.</figref><figref num="5">According to the present invention, stations A and B share server stations S and D, but A and B are block diagrams of a policy between four stations that are not allowed access to each.</figref><figref num="6">It is a block diagram of the policy modified by this invention so that the edge from B to A is added to the policy in FIG.</figref><figref num="7">A block diagram of an IEEE standard 802.1Q bridge that eliminates direct communication between edge hosts connected to an infrastructure system via port-based VLAN allocation, egress filtering, and shared VLAN learning (SVL). is there.</figref>

U.S. Patent Application No. 10 / 057,566 states a virtual bridge LAN (VLAN) in which a terminal clones an existing VLAN by duplicating a member set that is tagged and untagged with the existing VLAN. The protocols on which you can create are described. In addition, this new VLAN is unique because of its unique security association. This association provides a cryptographic keying material that keeps packets belonging to a VLAN private and allows VLAN membership to be cryptographically verified by a keyed MAC. This new VLAN is owned by its creator. This owner controls which stations can join, which stations can discover the VLAN, and the lifetime of the VLAN. Therefore, the VLAN is called a personal virtual bridge LAN (PVLAN).

An embodiment of the present invention provides an improved version of PVLAN that uses only the standard elements of IEEE Standard 802.11-1999. (See Part 11: Wireless LAN Media Access Control (MAC) and Physical Layer (PHY) Specifications, ISO / IEC 8802-11: 1999 (E) ANSI / IEEE Standard 802.11, 1999 Edition, and Part 11: Wireless LAN Media Access Control (MAC) and Physical Layer (PHY) Specifications, Media Access Control (MAC) Security Enhancements, Draft Amendments to IEEE Standard 802.11i / D7.0, ISO / IEC 8802-11,1999 (E) , ANSI / IEEE standard. 802.11, 1999 edition. ) Figure 1, which is a block diagram of IEEE standard 802.11 protocol entities, and where each BSS (BSS-A, BSS-B) is associated with its access point (AP-A, AP-B) (AP-A, AP-B). See Figure 2, which is a block diagram of an IEEE standard 802.11 configuration infrastructure with A1 / A2, B1 / B2). Modifications to the behavior of any 802.11 standard compliant terminal that does not act as an access point are unnecessary in the present invention. The improvements instantiate PVLANs for virtual 802.11 BSS and only affect access points.

FIG. 3 is a block diagram of the public access point architecture according to the present invention. Virtual 802.11 BSSs, such as BSS-1 or BSS-2, have a set of stations that share a unique security association, called a group security association, each with a hardware (MAC) address (see Figure 1). ). The security association consists of an encryption key and an authentication code key.

Exactly one of the stations in the virtual BSS is the public access point 31 (PAP). It bridges 802.11 wireless media (WM) 32 and 802.11 distribution system media (DSM) 33.

A unique unicast security association exists for every station in the virtual BSS. It is shared between the virtual BSS station and the PAP.

Each virtual BSS, such as BSS-1 or BSS-2, has its own identifier, the BSSID. It is the virtual MAC address of the PAP that belongs to that BSS. The PAP receives any frame from the WM destined for one of its virtual MAC addresses and uses one of its virtual MAC addresses as the source MAC address of the frame to frame the WM. To send.

A group of virtual basic services sets are supported by a shared TSF (timing synchronization function), DCF (distributed adjustment function), and optionally PCF (point adjustment function) in a single PAP. In each PAP, there is a single NAV (Network Allocation Vector) and PC (Point Coordinator). This type of sharing is possible because the 802.11 virtual carrier detection and media reservation mechanism is designed to work with multiple basic service sets that use the same channel overlap. This type of overlap can occur between virtual basic service sets supported by a single channel PAP. Virtual service sets can use one channel and can be overlapped in the PAP.

A PAP can belong to one or more virtual BSSs. See BSS-1 and BSS-2 on Figure 1. Any station that is not a PAP can belong to at most one virtual BSS.

Virtual 802.11 BSSs can be bridged with other virtual BSSs through the connection of their public access points via a virtual bridge LAN. The PAP of each virtual BSS connects to the distribution system (DS) through a trunked or untagged port on the VLAN-aware bridge. Frames sent to the DS can carry VLAN tags known to the DSM. The PAP may maintain a DSM VLAN mapping that maps the VLAN tag to the virtual BSSID.

Currently, there are two types of virtual BSS: Class-1 and Class-3 virtual BSS. The PAP supports exactly one Class-1 virtual BSS and one or more Multiple Class-3 virtual basic service sets. As managed by the PAP, a Class-1 virtual BSS is the only virtual BSS that a station is allowed to occupy while in state 1 or 2 of 802.11. When in state 3, the station is allowed to join a class-3 virtual BSS. Class-3 virtual BSS can be determined, for example, by authentication such as an open system or shared key used to authenticate a station.

A class-1 virtual BSSID is a BSSID field for any Class 1 and Class 2 frame that has this type of field. It is also a receiver or transmitter address field for Class 1 and Class 2 frames, where appropriate.

All virtual BSSs have the same Beacon Frame Content, except for Timestamp, Beacon Interval, Capability Information Privacy (Protection) Bits, Service Set Identifier (SSID), Security Capability Elements, and Traffic Direction Map (TIM) Element fields. Has.

The PAP does not need to send a beacon to a Class-3 virtual BSS if it does not support PS (Power Save) mode for the terminal in that BSS. If it is sending a beacon to a Class-3 virtual BSS, the SSID element of every beacon specifies the broadcast SSID. These steps prevent any Class-3 virtual BSS from being identified by the beacon.

Only Class-1 Virtual BSS Beacons have SSID elements with non-broadcast SSID fields. Stations can only be associated with class-1 virtual BSS. This station uses the non-broadcast SSID in the SSID element of the association or reassociation request frame.

U.S. Patent Application No. 10/057566 identifies PVLAN joins and discovery steps. PVLANs, represented as virtual BSS, instantiate these steps as follows:

join By default, every station is a member of a Class-1 virtual BSS with a PAP. The PAP can authenticate either the station user or the station itself in a Class-1 virtual BSS. If successful, the station enters 802.11 state 2 at that PAP. At this time, the PAP and the station may exchange class 1 and class 2 frames while in the class-1 virtual BSS.

Class 1 frames are not cryptographically protected. After successful authentication, Class 2 frames can be cryptographically protected if the station and PAP share a unicast security association. PAPs and stations can also share group security associations after authentication. The Group Security Association is for that Class-3 virtual BSS to which the station belongs once it completes the PAP and 802.11 association.

Before the station and PAP can exchange class 3 frames, the station 1) Request an association with a Class-1 virtual BSS from state 2 and 2) Must switch to Class-3 Virtual BSS.

The PAP classifies a station by responding to a station's association request with an association response MMPDU whose source address (address 2 field) or BSSID (address 3 field) is a class-3 virtual BSSID for that virtual BSS. Switch to virtual BSS. The ability information field of the association response may have its privacy bit set to 1.

Class-3 Virtual BSS is determined in one of three ways: 1) The authentication server in the DS specifies the DSM VLAN to the user, and the PAP maps it to a class-3 virtual BSSID using its DSM VLAN mapping. 2) The authentication server in DS specifies a class-3 virtual BSS for the user, or 3) PAP creates a new class-3 virtual BSS for the user. The PAP can inform the authentication server of the new virtual BSS and provide it with rules that allow other stations to join the new BSS.

Discovery Class-1 virtual BSSs are discovered by 802.11 beas or probe response management frames. Here, the BSSID field (address 3 field) and the source address field (address 2 field) are set for the class 1 virtual BSSID, respectively. The privacy bit of the capability information in these frames is set to zero. Beacon TIM elements apply to class-1 virtual BSS. Only Class-1 virtual BSSs are advertised via beacon frames.

Data frame (MPDU) distribution The PAP implements the MAC Protocol Data Unit (MPDU) Bridge Protocol. The protocol for MPDUs received from DSM or WM is defined by two cases: 1. MPDU received from DSM. There are two sub-cases. (Note: The two subcases deal with the delivery of received MPDUs to the PAP's local LLC, because every PAP station belongs to at least one virtual BSS.): The received MPDU has no VLAN tag or has an empty VLAN tag. If the destination address is the address of a station belonging to the BSS, and the station is associated with a PAP, the MPDU from the DSM is relayed to the virtual BSS, or the destination address is a group address. If so, the virtual BSS has stations that belong to the group, and that station is associated with the PAP. All stations belong to the broadcast group. b. The received MPDU has a non-empty VLAN tag. The virtual BSS through which the MPDU is relayed is identified by a BSSID whose non-empty VLAN tag is mapped under the PAP's DSM VLAN mapping. If the mapping is undefined for the given tag, the MPDU will not be relayed. Any virtual BSS to which a received MPDU is relayed has a BSSID that forms the source address (address 2 field) of the 802.11 MPDU relayed to that virtual BSS. 2. MPDU received from WM. The received 802.11 MPDU is in the virtual BSS identified by the address 1 field of the MPDU, if its destination address (address 3 field of the MPDU) is the address of the station belonging to the identified virtual BSS, and its The station is associated with a PAP, or is relayed if its destination address is a group address. Otherwise, the frame will not be relayed to any virtual BSS. The address 1 field of the received 802.11 MPDU is the source address (address 2 field) of the 802.11 MPDU relayed to the virtual BSS identified by the address 1 field. If the destination address (address 3 field of the MPDU) is the address of a station that is not associated with a PAP, or if the destination address is a group address, the received MPDU will also be relayed to the DSM. If the DS is aware of the VLAN, the MPDU relayed to the DSM will have a VLAN tag, otherwise it will not be tagged. VLAN tag is DSM of PAP A pre-image of the address 1 field of the received MPDU under VLAN mapping.

Encryption and decryption process Cryptography and decryption apply 802.11 data and management frames for subtype association request / response, reassociation request / response, disassociation and deauthentication.

The encryption process used by the PAP before sending 802.11 data or management frames to WM involves two main steps: Identifying security associations for frames and Use that association to build an extended frame for transmission according to some cryptographic and authentication code protocols. Different cryptographic and authentication code protocols can be used for broadcast and multicast traffic between virtual basic service sets, and different cryptographic and authentication code protocols can be used between stations in a single virtual BSS. Can be used for directed (unicast) traffic.

If the frame purpose address (address 1 field) is the address of a station, the unicast security association shared between that station and the PAP will be used in the extension. If this frame is a data frame and its destination address is a group address, the MPDU bridge protocol identifies the target virtual BSS for the frame. The Group Security Association for the identified BSS is used for extension.

A non-PAP station sends an 802.11 MPDU of type data or management to the DS using the Unicast Security Association it shares with the PAP in its BSS.

When receiving 802.11 data or management frames from the WM, the PAP decrypts them using a unicast security association for the station identified by the source address (address 2 field) of the MPDU and verifies the frame integrity. Try to do that.

When receiving a type data or management 802.11 MPDU from a PAP, the non-PAP station shares a unicast security association with the PAP if the target address (address 1 field) of the frame is the station's address. And if the target address of the frame is a group address, it attempts to decrypt and verify the integrity of the frame using its Class 3 Virtual BSS Group Security Association.

Location update protocol The present invention also comprises a location update protocol for updating the transfer table of the bridge, or other interconnect medium to which public access points are connected together.

Given multiple public access points attached to different bridges in the spanning tree of a bridge LAN, and terminals that associate and reassociate one of them with each other, the new PAP is the indicated bridge. The station sends a protocol data unit (BPDU) (called a relocation PDU) to the previously associated PAP. The BPDU's destination address is the current AP address of the reassociation request frame, which is a class-3 virtual BSSID. The source address is the hardware address of the station.

Upon receiving a relocation MPDU on a particular port, the bridge updates its forwarding table with an entry that binds the receiving port to the source address of the MPDU.

The receive bridge forwards the relocation MPDU to its designated root port unless the MPDU arrives at that port or the receive bridge is the root of the subaning tree. If it is received on or by the bridge's designated root port, it is forwarded according to the bridge's learned forwarding table, which is for all ports except the receiving port. Includes flooding MPDUs.

Fine bridging One embodiment of the invention discussed above narrows down PVLANs to virtual BSS. Under the MPDU Bridge Protocol, any station in a virtual BSS can send directed or group-addressed frames to any other station in that virtual BSS. This would be undesirable. Meetings at the conference center may have their own virtual BSS, for example, but not all attendees trust each other. By sharing the same virtual BSS, an attendee can fly a worm or virus. Attempting to thwart these attacks by assigning each attendee to a unique virtual BSS would prevent attendees from sharing the server. Ideally, the server should be shared by all conference participants, but no one should be able to access other participants, that is, send frames. The above public access points cannot provide this level of access control. APs that support fine bridging can provide it.

See also Figure 7, which is a block diagram of the IEEE standard 802.1.Q. An 802.1Q bridge connects a pair of edge hosts to an infrastructure system such as a LAN. Untagged frames arriving from the edge host are assigned to VLAN A by port-based VLAN assignment (PVID A), and untagged frames arriving from the infrastructure system are assigned to VLAN B (P). Assigned to PVID B). The described output rule allows frames belonging to A or B to go out to the infrastructure, while only frames belonging to B are allowed to go out to the edge host. To. In this way, edge hosts are prevented from communicating directly with each other.

Fine bridging decouples the identification of broadcast or multicast domains with BSS.

Under fine bridging, the bridging behavior of an AP is determined by a policy represented as a directed graph. The nodes in the graph are stations, and there is an edge from station A to station B only if station A has access to station B. In other words, station B must be able to receive station A's designated or group frames.

For a given policy, the broadcast domain for a node is itself and all the nodes it must access. A policy broadcast domain set is a set of broadcast domains for that node.

There is a group security association for each broadcast domain in implementing the policy. In addition, each station (node) owns a group security association for the broadcast domain to itself in the policy and for any other broadcast domain in the policy to which it is a member. The former association can be used by the station to send group frames, and the latter association to receive group frames.

Accessibility within a three-station virtual BSS, one of which is an AP, is captured by the policy shown in Figure 2. Each node in the policy has {A, B, AP} as its broadcast domain. Thus, there is only one broadcast domain for the policy, which is expected given that the policy reflects the virtual BSS. Each station knows the group security association for the domain and can send and receive group frames under that association.

In Figure 3, stations A and B share server stations S and D, but A and B capture policies between four stations that are not allowed access to each.

This policy has broadcast domains B1: {A, S, D}, B2: {B, S, D} and B3: {D, A, S, B}. Station A knows the group security association for B1 to send the group frame and knows the group security association for B3 to receive the group frame sent by S and D. Station D knows the group security association for B3 to send group frames and receive them from S, and the group security association for both B1 and B2 to receive group frames from A and B respectively. know.

If the policy in FIG. 3 is modified so that, for example, the edge from B to A is attached to the policy, domain B2 is removed and B1 and as shown in FIG. Only B3 will remain.

If the A-to-B edge is added to the policy in Figure 4, domains B1, B2 and B3 will shrink to a single domain B3 for this policy.

The provision of other policy variations is within the ability of those skilled in the art.

Although the present invention is described herein with respect to preferred embodiments, one of ordinary skill in the art will replace other applications with those described herein without departing from the spirit and scope of the invention. You will immediately understand that it is okay. Therefore, the present invention should be limited only by the appended claims.

31 Public access point 32 wireless media 33 Distribution system medium 33 Distribution system medium