Secure IP access protocol framework and supporting network architecture

Abstract

A protocol framework for a Secure IP Access (SIA) method, and supporting components deployed on IP hosts and IP networks. Using this method, an IP host can establish a secure data channel within an IP network over an insecure shared link while requesting IP address and networking configuration parameters from the IP network. A system administrator can implement strong access control against various attacks that an edge IP network may have to face, such as a denial-of-service attack that exhausts assignable IP addresses. This is a lightweight, scalable, and backward-compatible solution that can improve security performance for public and corporate LANs having open access such as wireless access points and Ethernet jacks.

1 . A method for a first IP host to authenticate to a second IP host on the same link of an IP network, comprising the steps of: 
 (a) sending a DHCP_INFORM message including an option specifying the IP address of the second IP host;    (b) receiving a DHCP_ACK message including an option containing a security token for establishing a secure data channel between the first and second IP hosts;    (c) broadcasting an ARP request message including an option containing authentication credentials derived from the security token; and    (d) receiving an ARP response message.    
   
   
       2 . The method recited in  1 , wherein the initiating IP host requests a security token from a secure IP access server on the IP network.  
   
   
       3 . The method recited in  2 , wherein the security token is a Kerboros ticket.