CROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of (i) U.S. provisional application serial No. 61/219,928 filed June 24, 2009, which is hereby wholly incorporated by reference, and (ii) of U.S. provisional application serial No.61/223,974 filed July 8, 2009, which is also hereby wholly incorporated by reference.

BACKGROUND

[0002] Networks can be arranged in a star topology. A star topology allowed a central actor(s) (e.g., access point (AP), authentication/authorization/accounting (AAA) server) to facilitate key generation and distribution. Networks can also be arranged in other topologies (e.g., a mesh). A mesh topology typically employs distributed techniques that do not rely on a single central actor to establish and generate keys. However, such techniques are computationally intensive and generally require , for example, on the order of O(N ² ) communications for key distribution, where N is an integer that represents the number of stations in the mesh topology.

[0003] Emerging topologies (e.g., piconet basic server set (PBSS)) that include a central secret holder/provider, that allow secure, direct, station-to-station communications and that allow secure station (STA) to station broadcast communications have faced challenges finding appropriate key generation and distribution techniques. [0004] In a conventional star topology, only a single broadcast key is required because all broadcast messages transit (or pass through) the access point. In a PBSS, where stations may broadcast without using a central actor (e.g., PBSS control point (PCP)), multiple broadcast keys may be required, thereby complicating issues associated with key generation and distribution. Additionally, in a conventional star topology, even station-to-station communications pass through the access point. In a PBSS, station-to-station communications can occur directly, without passing through a hub (e.g., AP, PCP). Once again this complicates pair-wise key generation and distribution issues.

[0005] Conventionally 802.11 networks have two basic modes of operation: an ad hoc mode, and an infrastructure mode. In the ad hoc mode, peers engage in peer to peer (P2P) communications with no AP access. The peers use an independent basic service set (IBSS) to support the P2P (a.k.a. station-to-station (S2S)) communications. In infrastructure mode, communicating stations rely on an AP.

[0006] Prior Art Figure 1 illustrates a conventional 802.11 star topology including an access point (AP) 100, a first station STA1 , a second station STA2, and an authentication, authorization, and accounting (AAA) server 110. When STA1 wants to have a secure communication with AP 100, then STA1 and AP 100 communicate with AAA server 110 to acquire copies of a pair-wise master key (PMK). The PMK can then serve as a shared secret from which STA1 and AP 100 can both compute pair-wise keys. For example, STA1 and AP 100 can compute a pair-wise transient key (PTK) as a function of the shared secret and some unique information communicated between STA1 and AP 100. The AAA server 110 may be, for example, a RADIUS server.

[0007] If STA2 also wants to have a secure communication with AP 100, then STA2 and AP 100 both communicate with AAA server 110 to acquire a different PMK and then compute a separate PTK based on this different PMK and different unique information communicated between STA2 and AP 100. If STA1 wants to have a secure communication with STA2 then in effect two separate pair-wise secure communications may occur, one between STA1 and AP 100 and one between STA2 and AP 100. The secured data that is communicated between STA1 and STA2 will transit the AP 100. In one configuration, STA1 and STA2 may have also acquired pair-wise keys that they use to secure communications that will transit AP 100. In one example, STA1 and STA2 may also use the pair-wise keys for direct secure communications between themselves without transiting the AP 100.

[0008] In the conventional topology illustrated in Prior Art Figure 1 , AP 100 may also generate a group-wise master key (GMK) and compute a group-wise transient key (GTK) based on the GMK for securing group (e.g., broadcast) communications. AP 100 may provide the GTK to STA1 , STA2, and other members of the group to which the message will be broadcast. Thus, Prior Art Figure 1 illustrates a conventional system where two stations that share a first secret (e.g., PMK) can each generate a second secret (e.g., PTK) as a function of the first secret and some unique information. The unique information can be shared using a conventional four-way handshake. Additionally Prior Art Figure 1 illustrates a conventional system where a central actor can provide a broadcast key.

SUMMARY

[0009] In one embodiment, a method includes creating pair-wise unique material for a first member of a pair of communicating stations. The stations are part of a topology (e.g., PBSS) that includes a central secret holder/provider that allows secure, direct, station-to-station communications and that also allows secure station (STA) to station broadcast communications. Members of the pair of communicating stations will have already established a security association (SA) with a topology control point (PCP). Members of the pair of communicating stations will be establishing a secure, direct, station-to-station communication that will not transit (or pass through) the PCP. The pair-wise unique material is computed as a function of a known shared secret associated with the PCP, a first piece of unique data associated with the first member, and a second piece of unique data associated with a second member of the pair. The method also includes securely communicating the pair-wise unique material from the first member to the second member. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate various examples of systems, methods, and other embodiments of various aspects of the invention. Element boundaries (e.g., boxes, groups of boxes, or other shapes) shown in the figures represent one example of the boundaries. In some examples one element may be designed as multiple elements or that multiple elements may be designed as one element. In some examples, an element shown as an internal component of another element may be implemented as an external component and vice versa. Furthermore, elements may not be drawn to scale.

[0011] Prior Art Figure 1 illustrates a conventional 802.11 star topology.

[0012] Figure 2 illustrates a topology associated with a piconet basic service set (PBSS).

[0013] Figure 3 illustrates keys associated with a PBSS.

[0014] Figure 4 illustrates a method associated with pair-wise key generation in a PBSS.

[0015] Figure 5 illustrates a method associated with group-wise key generation in a PBSS.

[0016] Figure 6 illustrates a method associated with pair-wise and group-wise key generation in a PBSS.

[0017] Figure 7 illustrates an apparatus associated with pair-wise key generation in a PBSS.

[0018] Figure 8 illustrates an apparatus associated with group-wise key generation in a PBSS.

[0019] Figure 9 illustrates an apparatus associated with pair-wise and group-wise key generation in a PBSS. DETAILED DESCRIPTION

[0020] The disclosure describes generating security material for pair-wise and group- wise communications in a hybrid networking topology that supports both secure station- to-station pair-wise communications and secure station-to-group group-wise communications. Example apparatuses and methods facilitate generating and distributing security material (e.g., pair-wise keys, group-wise keys) for a piconet basic service set (PBSS) having N members in a less than O(N ² ) order manner. While a PBSS is described, one skilled in the art will appreciate that example apparatuses and methods may also facilitate generating and distributing security materia! in, for example, tunneled direct link setup (TDLS) and/or independent basic service set (IBSS).

[0021] Figure 2 illustrates a topology associated with a piconet basic service set (PBSS) that includes a PBSS control point (PCP) 200, a first station 210, a second station 220, and a third station 230. The PCP 200 is illustrated providing a beacon to the first station 210, the second station 220, and the third station 230. The beacon may provide, for example, timing information for coordinating communications. The PCP 200 and the first station 210 may communicate data similarly to how data may be communicated in a conventional 802.11 star topology. However, the second station 220 and the third station 230 may communicate data between each other without having the data transit the PCP 200. The communication may be facilitated by the beacon provided by the PCP 200.

[0022] A PBSS is a self-contained topology that includes a PCP. Only the PCP sends beacons. A station (STA) in a PBSS may or may not associate with the PCP. Pair-wise station-to-station communications that do not transit the PCP are allowed. Group-wise station-to-station communications that do not transit the PCP are also allowed. A station may or may not trust the PCP. There are three different security considerations for a PBSS: PCP to STA security, STA-to-STA security, and STA to group security. Example apparatuses and methods concern efficient key generation and distribution for STA-to-STA security and for group-wise STA to group communications. Example apparatus and methods compute unique pair-wise keys between pairs of stations. Example apparatus and methods also compute unique group-wise keys for stations. In one embodiment, station-to-station communications may require unique keys per instance of communication, and thus example apparatus and methods may compute unique pair-wise keys per instance of communication using temporally unique information (e.g., nonces) that may be provided, for example, by a PCP.

[0023] Figure 3 illustrates keys associated with a PBSS. The PBSS includes a PCP 300, a first station Si 310, and a second station S ₂ 320. One skilled in the art will appreciate that a PBSS may include more than just two stations. PCP 300 may transmit security material (e.g., a group transient key (GTK _PC p)) to the stations. A station may then compute its own group-wise security material (e.g., GTK _S i, GTK _S 2) using the GTK _PC p and some material unique to the station (e.g., MAC address, nonce). Conventionally group-wise security materials may be transmitted back to the PCP 300 by the stations and then distributed out to other stations. For example, GTKsi may be computed at S ₁ 310, provided to PCP 300, and then provided out to S ₂ 320. Similarly, GTKs ₂ may be computed at S ₂ 320, provided to PCP 300, and then provided out to Si 310. This type of GTK distribution experiences significant overhead. To avoid this overhead, example systems and methods may employ a computation based GTK approach that does not experience the GTP distribution overhead. A pair of stations may also compute pair-wise security material (e.g., PMK _S is2, PTK _S is2) using the GTKpcp and some material unique to the stations (e.g., MAC addresses, nonces). Since both S ₁ 310 and S ₂ 320 will compute a GTK in the same manner, in an embodiment where a station computes its GTK based on its MAC address, a station that receives the GTK for another station will be able to verify that GTK when a message is received from that other station by recreating the GTK from the MAC address associated with the sending station.

[0024] Figure 4 illustrates a method 400 for computing pair-wise unique material. At 410, method 400 includes creating pair-wise unique material for a first station and a second station in a piconet basic service set (PBSS). While a PBSS is described, one skilled in the art will appreciate that more generally pair-wise unique material may be created for a station in a network topology that includes a central secret holder and that allows peer to peer communications that do not transit that central secret holder. The communicating stations will have already established a security association (SA) with a PBSS control point (PCP) and thus will be trusted with shared secret material. The pair of communicating stations want pair-wise unique material to secure a direct, station-to- station communication that will not transit the PCP.

[0025] In one example, the pair-wise unique material is computed as a function of secret material and unique material. The unique material may be computed from a known shared secret associated with the PCP, a first piece of unique data associated with the first member, and/or a second piece of unique data associated with a second member of the pair. In one example, the known shared secret is a group transient key (GTK) provided by the PCP. The first piece of unique data may be, for example, a media access control (MAC) address associated with the first member, and/or a nonce known to the first member. The nonce may have been provided in a beacon or other communication from the PCP. Similarly, the second piece of unique data may be, for example, a MAC address associated with the second member and/or a nonce known to the second member.

[0026] In one example, if pairwise nonces are required, it may be necessary to communicate the first piece of unique data to the second station and to communicate the second piece of unique data to the first station. In another example, if MAC addresses are used, the communication and exchange is not required. In one embodiment, the first piece of unique data and the second piece of unique data are communicated between the stations using an extensible authentication protocol over local area network (EAPoL) four-way handshake. One skilled in the art will appreciate that there are other secure ways to communicate this type of information.

[0027] At 420, method 400 includes securely communicating the pair-wise unique material from the first station to the second station. Once again, the pair-wise security material may be communicated using, for example, an EAPoL four-way handshake.

[0028] At 430, one embodiment of method 400 includes selectively resolving a first message race condition associated with colliding EAPoL four-way handshake establishment attempts by the first station and the second station. In one embodiment, the collision may be resolved using the MAC address of the first station and the second station. For example, a message associated with a higher addressed station may be kept while a message associated with a lower addressed station may be dropped.

[0029] At 440, method 400 includes securing a communication from the first station to the second station using the pair-wise unique material. Note that the communication between the first station and the second station will not transit the PCP. Securing the communication may include encrypting a portion of a message using the pair-wise unique material.

[0030] Figure 5 illustrates a method 500 associated with creating and distributing group-wise security material. At 560, method 500 includes creating group-wise security material for a broadcasting member of a piconet basic service set (PBSS). More generally, one skilled in the art will appreciate that the broadcasting member may be a member of a network topology that includes a central secret holder and that allows peer to peer broadcasting. To have access to secret material available from the PBSS control point (PCP), the broadcasting member will have already established a security association (SA) with the PCP. The broadcasting member seeks to have group-wise security material because the broadcasting member wants to securely transmit a message (e.g., broadcast, multicast) to one or more other members of the PBSS without having the message transit the PCP. Thus, the broadcasting member will be transmitting a message to a group without having the message transit the PCP, making the message a peer-to-peer broadcast message.

[0031] The group-wise security material is computed as a function of a known secret associated with the PCP and a piece of unique data associated with the broadcasting member. In one example, the known secret is a group transient key (GTK) provided by the PCP. The piece of unique data may be, for example, a media access control (MAC) address associated with the broadcasting member and/or a nonce known to the broadcasting member. The nonce may have been provided by the PCP.

[0032] At 570, method 500 includes securely communicating the group-wise security materia!. Thus, after computing its group-wise material, the broadcasting member may make that group-wise material available to another PBSS member. To allow both the PCP and the broadcasting member to have the same information involved in computing the group-wise security material, information may be transmitted between the broadcasting member and the PCP. The data communicated may include the piece of unique data and the group-wise security material. The data may be communicated using an extensible authentication protocol over local area network (EAPoL) four-way handshake.

[0033] At 580, method 500 includes communicating the group-wise security material from the PCP to other members of the PBSS and communicating group-wise security information associated with the one or more other members of the PBSS to the broadcasting member. Thus, after a broadcasting member establishes its group-wise material it may receive group-wise material established by other members of the PBSS.

[0034] At 590, method 500 includes securing a communication between the broadcasting member and the one or more other members of the PBSS using the group-wise security material. Securing the communication may include encrypting a portion of a message using the group-wise security material.

[0035] Figure 6 illustrates a method 600 that includes actions 410, 420, 430, and 440 from method 400 (Figure 4) and actions 560, 570, 580, and 590 from method 500 (Figure 5). Thus one skilled in the art will appreciate from the teachings herein that in one embodiment, method 600 may create and distribute both pair-wise security material and group-wise security material.

[0036] Example systems and methods therefore describe three different approaches. In a first approach, an STA generates its own GTK using its own GMK and a nonce. The STA then securely passes the GTK to other STAs either through the PCP or directly. When the information goes through the PCT, the STA uses PTK with the PCP. If the STA has direct PTK with another STA, then the STA can send the GTK directly to the other STA using the PTK with the other STA. In a second approach, an STA uses the GTK-PCP and a nonce to generate its own GTK. Since all STAs are assumed to know the GTK-PCP since they are associated with the PCP, the STA only needs to send its own nonce to other STAs. Once again the nonce can be sent either through the PCP or directly. Other STAs can compute the GTK based on the GTK-PCP and the received nonce. In a third approach, an STA uses the GTK-PCP and the STA's MAC address to generate its own GTK. In this case, the STA does not need to send anything to other STAs. The other STAs can simply calculate the STA's GTK based on the GTK- PCP and the STA's MAC address.

[0037] Figure 7 illustrates an apparatus 700. Apparatus 700 includes a pair-wise key logic 710 and a pair-wise communication logic 720. The pair-wise key logic 710 is configured to compute a pair-wise transient key (PTK) for a first member (S,) of a piconet basic service set (PBSS) that wants to have a secure pair-wise communication with a second member (S _j ) of the PBSS. S ₁ and S _j will have already established a security association (SA) with a PBSS control point (PCP). The secure, station-to- station communication between S ₁ and S _j will not transit the PCP. More generally, pair- wise key logic 710 may be configured to compute a pair-wise security materia! for a member of a pair of stations that are members of a topology having a shared secret holder and that want to have a secure, direct, station-to-station communication.

[0038] In one example, the pair-wise key logic 710 computes the PTK according to:

PTK _1J = f(GTKp _C p, Uniquesi, Unique _SJ )

where GTK _PC p is a group transient key generated by the PCP, where Uniquesi is information unique to S,, and where Unique _S j is information unique to S _j . In one example, Unique _S ι is a media access control (MAC) address associated with S ₁ . Uniquesj may also be, for example, a MAC address associated with S _j .

[0039] In another embodiment, PTK _1J is computed according to:

PTK _1J = f(GTKpcp, Uniquesi, Unique _S j, additional parameters)

where the additional parameters are based, at least in part, on beacon information provided by the PCP. The additional parameters may be, for example, nonces provided to apparatus 700 by a PCP.

[0040] Apparatus 700 also includes pair-wise communication logic 720. Pair-wise communication logic 720 secures a communication from S ₁ to S _j using PTK _1J . Securing the communication may include, for example, encrypting the communication. Pair-wise communication logic 720 may also securely communicate Uniquesi and Uniquesj between S ₁ and S _j . In some examples, Uniquesi and Unique _S j may not need to be communicated. If the communication is required, then the unique data may be communicated between S, and S ₁ using an extensible authentication protocol over local area network (EAPoL) four-way handshake. While an EAPoL four-way handshake is described, one skilled in the art of computer network security will appreciate that other communication techniques may be employed.

[0041] In one embodiment, apparatus 700 may also include race logic 730. Race logic 730 may be configured to resolve a race condition associated with communicating security material and/or unique data from which security material can be computed. Both S ₁ and S _j may be trying to compute pair-wise security material. Therefore both S ₁ and S _j may initiate a four-way handshake to communicate information. The race condition concerns the first message of the EAPoL four-way handshake establishment attempts by S, and S _j In one example, race logic 730 may resolve the race condition based on the MAC address of S ₁ and S _j . For example, S ₁ may receive a first message in a four-way handshake from S _j just after it sent a first message in a four-way handshake to S _j . S ₁ may look at its own MAC address and look at the MAC address for SJ. S ₁ may decide to ignore the first message from S _j because S ₁ has a higher MAC address. If S _j is operating under the same protocol, which is likely because both S ₁ and S _j will have already established an SA with the PCP, then S _j will take a similar action of accepting the first message from S ₁ while abandoning its attempted four-way handshake with S, upon determining that S _j has a lower MAC address than S ₁ . One skilled in the art will appreciate that other MAC address based resolution (e.g., keep lower addressed messages) techniques may be employed.

[0042] Figure 8 illustrates an apparatus 800. Apparatus 800 includes a group-wise key logic 810 and a group-wise communication logic 820. Group-wise key logic 810 is configured to compute, for a broadcasting member S _B of a piconet basic service set (PBSS), a group-wise transient key (GTKB). S _B will have already established a security association (SA) with a PBSS control point (PCP). S _B is computing the group-wise security information so that S _b can perform a secure, station-to-station communication that does not transit the PCP. The secure, station-to-station communication will involve one or more other members of the BSS. For example, the secure, station-to-station communication will be a broadcast or multicast message. In one example, group-wise key logic 810 computes GTK ₆ according to:

GTKB = f(GTKp _C p, Unique _SB )

where GTK ₆ is a group transient key generated by the PCP, and

where Unique _S B is information unique to S _B .

Uniques _B may be, for example, a media access control (MAC) address associated with S ₈ , a nonce provided by the PCP, and other information.

[0043] Apparatus 800 also includes group-wise communication logic 820. Group- wise communication logic 820 secures communications from S _B to the one or more other members of the PBSS using GTK ₆ . Securing the communications may include, for example, encrypting the communications.

[0044] In one example, the group-wise communication logic 820 securely communicates Unique _S B and GTK _SB to the PCP using an extensible authentication protocol over local area network (EAPoL) four-way handshake. The group-wise communication logic 820 may signal the PCP to selectively distribute the GTK _SB to one or more members of the PBSS. This facilitates getting group-wise information from S _B to other members. The group-wise communication logic 820 may also signal the PCP to selectively distribute group transient keys associated with other members of the PBSS to S _B . This facilitates getting group-wise information from other members to S _B .

[0045] Figure 9 illustrates an apparatus 900. Apparatus 900 includes elements 710, 720, and 730 from apparatus 700 and elements 810 and 820 from apparatus 800. Thus, one skilled in the art will appreciate from the teachings herein that apparatus 900 can generate and distribute both pair-wise and group-wise keys. In one example of apparatus 900, pair-wise key logic 710 and group-wise key logic 810 are configured to generate and distribute pair-wise keys and group-wise keys for a PBSS having N members in a less than O(N ² ) order manner.

[0048] To the extent that the term "includes" or "including" is employed in the detailed description or the claims, it is intended to be inclusive in a manner similar to the term "comprising" as that term is interpreted when employed as a transitional word in a claim. [0047] The following includes definitions of selected terms employed herein. The definitions include various examples and/or forms of components that fall within the scope of a term and that may be used for implementation. The examples are not intended to be limiting. Both singular and plural forms of terms may be within the definitions.

[0048] References to "one embodiment", "an embodiment", "one example", "an example", and so on, indicate that the embodiment(s) or example(s) so described may include a particular feature, structure, characteristic, property, element, or limitation, but that not every embodiment or example necessarily includes that particular feature, structure, characteristic, property, element or limitation. Furthermore, repeated use of the phrase "in one embodiment" does not necessarily refer to the same embodiment, though it may.

[0049] "Logic", as used herein, includes but is not limited to hardware, firmware stored in a memory, software stored on a storage medium or in execution on a machine, and/or combinations of each to perform a function(s) or an action(s), and/or to cause a function or action from another logic, method, and/or system. Logic may include a software controlled microprocessor, a discrete logic (e.g., ASIC), an analog circuit, a digital circuit, a programmed logic device, a memory device containing instructions, and so on. Logic may include one or more gates, combinations of gates, or other circuit components. Where multiple logical logics are described, it may be possible to incorporate the multiple logical logics into one physical logic. Similarly, where a single logical logic is described, it may be possible to distribute that single logical logic between multiple physical logics.

[0050] Example methods may be better appreciated with reference to flow diagrams. While for purposes of simplicity of explanation, the illustrated methodologies are shown and described as a series of blocks, it is to be appreciated that the methodologies are not limited by the order of the blocks, as some blocks can occur in different orders and/or concurrently with other blocks from that shown and described. Moreover, less than all the illustrated blocks may be required to implement a methodology. Blocks may be combined or separated into multiple components. Furthermore, additional and/or alternative methodologies can employ additional, not illustrated blocks.

[0051] While example systems, methods, and so on have been illustrated by describing examples, and while the examples have been described in considerable detail, it is not the intention of the applicants to restrict or in any way limit the scope of the appended claims to such detail. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the systems, methods, and so on described herein. Therefore, the invention is not limited to the specific details, the representative apparatus, and illustrative examples shown and described. Thus, this application is intended to embrace alterations, modifications, and variations that fall within the scope of the appended claims.