Preventing attacks in hybrid WPA2 and WPA3 environments

Abstract

The present disclosure provides methods, devices and systems for improving security in a wireless communication network. An example method includes scanning a wireless medium for a presence of an access point (AP) in a wireless communication range of the first wireless STA; identifying, based on the scanning, two or more APs each having a same first service set identifier (SSID), the two or more APs including a first AP that supports a Wi-Fi protected access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol; selecting a first peer-to-peer simultaneous authentication (SAE) authentication type for a first group of APs including the first AP based on at least one AP supporting the WPA 3 wireless security protocol among the first group of APs; and authenticating the first AP based at least in part on the same first SSID and the first SAE authentication type.

Description

Technical Field

[0001] The present disclosure relates generally to wireless communications, and more particularly to improving the security of wireless communications systems. Background Art

[0002] A wireless local area network (WLAN) may be formed by one or more wireless access points (APs) that provide a shared wireless communication medium for use by multiple client devices, also referred to as wireless stations (STAs). The basic building block of a WLAN that complies with the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards is a basic service set (BSS) managed by an AP. Each BSS is identified by a basic service set identifier (BSSID) announced by the AP. The AP periodically broadcasts beacon frames to enable any STA within the wireless range of the AP to establish or maintain a communication link with the WLAN.

[0003] The connection established or maintained between the STA and the AP may be protected using one or more security protocols such as the Wi-Fi Protected Access (WPA) wireless security protocol, which may include, for example, the WPA 2 or WPA 3 wireless security protocol. An AP operating in accordance with WPA 2 may coexist with an AP operating in accordance with WPA 3. In addition, the AP may operate in accordance with the WPA 3 transition mode (or mixed mode) wireless security protocol, which provides improved compatibility for STAs that are not compatible with WPA 3. Summary of the invention

[0004] The systems, methods and devices of the present disclosure each have several innovative aspects, no single one of which is solely responsible for the desirable attributes disclosed herein.

[0005] One innovative aspect of the subject matter described in the present disclosure may be implemented in a method for wireless communication. The method includes: scanning a wireless medium for the presence of an access point (AP) in a wireless communication range of a first wireless STA; identifying two or more APs each having a same first service set identifier (SSID) based on the scanning, the two or more APs including a first AP supporting a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP supporting the WPA 2 wireless security protocol but not supporting the WPA 3 wireless security protocol; selecting a first simultaneous authentication of peers (SAE) authentication type for a first group of APs including the first AP based on at least one AP supporting the WPA 3 wireless security protocol in the first group of APs including the first AP; and authenticating to the first AP based at least in part on the same first SSID and the first SAE authentication type.

[0006] Another innovative aspect of the subject matter described in the present disclosure can be implemented in a wireless communication device. The wireless communication device includes: at least one modem; at least one processor, the at least one processor is communicatively coupled to the at least one modem; and at least one memory, the at least one memory is communicatively coupled to the at least one processor. The at least one memory stores processor-readable code, which, when executed by the at least one processor in conjunction with the at least one modem, is configured to: scan a wireless medium for the presence of an access point (AP) in a wireless communication range of the first wireless STA; identify two or more APs each having the same first service set identifier (SSID) based on the scan, the two or more APs including a first AP supporting a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA2 wireless security protocol and including a second AP supporting the WPA 2 wireless security protocol but not supporting the WPA 3 wireless security protocol; select a first simultaneous authentication for peers (SAE) authentication type for the first group of APs including the first AP based on at least one AP supporting the WPA 3 wireless security protocol; and authenticate to the first AP based at least in part on the same first SSID and the first SAE authentication type.

[0007] In some implementations, the first AP is associated with a 5 GHz frequency band and the second AP is associated with a 2.4 GHz frequency band. In some aspects, the first group of APs includes the second AP. In some aspects, the second AP is in a second group of APs that does not include the first AP.

[0008] In some implementations, the methods and wireless communication devices may be configured to: provide a result of the scan to a user interface of the first wireless STA, the result including the first set of APs; and receive a request from the user interface to authenticate to an AP in the first set of APs, wherein authenticating to the first AP is responsive to receiving the request. In some aspects, receiving the request to connect includes: receiving a selection of the first set of APs from the user interface.

[0009] In some implementations, authenticating to the first AP may include transmitting a request to a supplicant of the first wireless STA, wherein the request indicates the first SSID and the first SAE authentication type. In some aspects, the supplicant authenticates to the first AP based at least on the first SAE authentication type and the first SSID. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Details of one or more aspects of the subject matter described in the present disclosure are set forth in the accompanying drawings and the following description. However, the accompanying drawings illustrate only some typical aspects of the present disclosure and are therefore not to be considered as limiting its scope. Other features, aspects, and advantages will become apparent from the specification, drawings, and claims.

[0011] Figure 1 A schematic diagram of an example wireless communication network is shown.

[0012] Figure 2 A block diagram of an example wireless communication device is shown.

[0013] Figure 3A A block diagram of an example access point (AP) is shown.

[0014] Figure 3B A block diagram of an example station (STA) is shown.

[0015] Figure 4 A timing diagram illustrating the vulnerability of conventional STA to malicious actors is shown.

[0016] Figure 5 A timing diagram illustrating an example selection of and connection to an AP by a wireless communication device is shown.

[0017] Figure 6 A flow chart illustrating an example process for supporting increased security in wireless communications according to some implementations is shown.

[0018] Figure 7 A block diagram of an example wireless communication device supporting increased security in wireless communications according to some implementations is shown.

[0019] The same reference numbers and designations in different drawings indicate the same elements. DETAILED DESCRIPTION

[0020] The following description is directed to certain specific examples in order to describe the innovative aspects of the present disclosure. However, one of ordinary skill in the art will readily recognize that the teachings herein can be applied in a variety of different ways. Some or all of the examples described may be implemented in a manner that is capable of being implemented in accordance with the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, the IEEE 802.15 standard, the Bluetooth Special Interest Group (SIG), or the like. The described implementations may be implemented in any device, system, or network capable of transmitting and receiving radio frequency (RF) signals in accordance with one or more of the Long Term Evolution (LTE), 3G, 4G, or 5G (New Radio (NR)) standards, or the like released by the Third Generation Partnership Project (3GPP). The described implementations may be implemented in any device, system, or network capable of transmitting and receiving RF signals in accordance with one or more of the following technologies or techniques: code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single carrier FDMA (SC-FDMA), single user (SU) multiple input multiple output (MIMO), and multi-user (MU) MIMO. The described implementations may also be implemented using other wireless communication protocols or RF signals suitable for use in one or more of a wireless personal area network (WPAN), a wireless local area network (WLAN), a wireless wide area network (WWAN), or an Internet of Things (IOT) network.

[0021] Some aspects more specifically relate to scanning the wireless communication range of the first STA and identifying two or more APs each having the same service set identifier (SSID) based on the scan. Conventional techniques may prioritize compatibility, group APs based on their SSIDs, and assign the authentication type that is most compatible with the group. Thereafter, upon receiving a request to an AP in the group, such conventional techniques may prioritize connections to the APs based on the frequency bands of the APs, such as giving priority to an AP operating on the 5 GHz band over another AP operating on the 2.4 GHz band. Therefore, even in the presence of another AP having the same SSID and employing the more secure WPA 3, conventional techniques may undesirably connect to an AP employing the less secure but more widely compatible WPA 2. This provides an opportunity for malicious actors because the malicious actors may monitor signals exchanged with an AP operating according to the less secure WPA 2 that is near a non-malicious AP operating according to the more secure WPA 3 and shares the SSID with the non-malicious AP. Such a malicious actor may be able to determine the password associated with this WPA 2 AP, may be able to decrypt packets transmitted to the WPA 2 AP, may be able to replay packets transmitted to the WPA 2 AP, and may be able to forge packets transmitted to the WPA 2 AP. For example, such a malicious actor may be able to use an offline dictionary attack or other vulnerability to compromise the WPA 2 AP. In some cases, the malicious actor may use this password to generate a fraudulent AP that masquerades as a WPA 2 AP, for example, in order to compromise STAs and other connected devices.

[0022] Various aspects are generally directed to improving security in a wireless networking environment that includes access points (APs) operating according to Wi-Fi Protected Access (WPA) 2 and WPA 3 wireless security protocols. In some aspects, a STA may be configured to prioritize connections to APs operating with WPA 3 (via a Simultaneous Authentication of Equals (SAE) authentication type) over conventional techniques, where the STA may prioritize connections to APs based on the frequency band on which the APs operate or based on the most compatible (but potentially least secure) authentication type supported by a group of APs sharing a shared SSID. In some other examples, a STA may be configured to present two APs with the same SSID separately, rather than grouping them, in order to reduce the likelihood that the STA automatically authenticates to a less secure WPA 2 AP in the presence of a more secure WPA 3 AP.

[0023] Certain aspects of the subject matter described in this disclosure may be implemented to achieve one or more of the following potential advantages. In some examples, when a WPA 2 AP and a WPA 3 AP have the same service set identifier (SSID), the described techniques may be used to improve the security of a wireless networking environment by reducing the chance that a STA authenticates to an AP operating according to a less secure WPA 2 protocol and increasing the chance that a STA authenticates to an AP operating according to a more secure WPA 3 protocol. This preference for the WPA 3 protocol may reduce the likelihood that a malicious actor may compromise the network by monitoring signals exchanged with a less secure WPA 2 AP.

[0024] Figure 1 A block diagram of an example wireless communication network 100 is shown. According to some aspects, the wireless communication network 100 may be an example of a wireless local area network (WLAN) such as a Wi-Fi network (and will be referred to as WLAN 100 hereinafter). For example, the WLAN 100 may be a network that implements at least one of the IEEE 802.11 series of wireless communication protocol standards, such as standards defined by the IEEE 802.11-2016 specification or its revisions, including but not limited to 802.11ay, 802.11ax, 802.11az, 802.11ba, and 802.11be. The WLAN 100 may include numerous wireless communication devices, such as an access point (AP) 102 and a plurality of stations (STAs) 104. Although only one AP 102 is shown, the WLAN network 100 may also include a plurality of APs 102.

[0025] Each STA 104 may also be referred to as a mobile station (MS), a mobile device, a mobile phone, a wireless phone, an access terminal (AT), a user equipment (UE), a subscriber station (SS), or a subscriber unit, among other examples. STA 104 may represent a variety of devices, such as mobile phones, personal digital assistants (PDAs), other handheld devices, netbooks, notebook computers, tablet computers, laptops, display devices (e.g., TVs, computer monitors, navigation systems, etc.), music or other audio or stereo equipment, remote control devices ("remote controls"), printers, kitchen or other home appliances, remote control keys (e.g., for passive keyless entry and start (PKES) systems), and the like.

[0026] A single AP 102 and a set of associated STAs 104 may be referred to as a basic service set (BSS), which is managed by the corresponding AP 102 . Figure 1 Additionally shown is an example coverage area 106 of the AP 102, which may represent a basic service area (BSA) of the WLAN 100. The BSS may be identified to users by a basic service set identifier (BSSID), and to other devices by a service set identifier (SSID), which may be a medium access control (MAC) address of the AP 102. The AP 102 periodically broadcasts a beacon frame (“beacon”) including the SSID to enable any STA 104 within the wireless range of the AP 102 to “associate” or re-associate with the AP 102 to establish or maintain a corresponding communication link 108 (hereinafter also referred to as a “Wi-Fi link”) with the AP 102. For example, the beacon may include an identification of a primary channel used by the corresponding AP 102 and a timing synchronization function for establishing or maintaining timing synchronization with the AP 102. The AP 102 may provide access to external networks to the respective STAs 104 in the WLAN via the corresponding communication links 108.

[0027] To establish a communication link 108 with the AP 102, each of the STAs 104 is configured to perform passive or active scanning operations ("scans") on frequency channels in one or more frequency bands (eg, 2.4 GHz, 5 GHz, 6 GHz, or 60 GHz bands). To perform passive scanning, the STA 104 listens for beacons transmitted by the corresponding AP 102 at periodic time intervals (referred to as target beacon transmission time (TBTT)) (measured in time units (TUs), where one TU may be equal to 1024 microseconds (μs)). To perform active scanning, the STA 104 generates probe requests and transmits them sequentially on each channel to be scanned, and listens for probe responses from the AP 102. Each STA 104 may be configured to identify or select an AP 102 to associate with based on the scanning information obtained through passive or active scanning, and perform authentication and association operations to establish a communication link 108 with the selected AP 102. For example, when the AP 102 operates according to the WPA 2 wireless security protocol, the authentication and association operations may include a 4-way handshake between the AP 102 and the STA 104. When the AP 102 operates according to the WPA 3 wireless security protocol, the authentication and association operations may include authentication according to a Simultaneous Authentication of Equals (SAE) authentication type. The AP 102 sends a message to the STA 104 at the end of the association operation. 104 assigns an association identifier (AID) that AP 102 uses to track STA 104.

[0028] As wireless networks become more and more common, a STA 104 may have the opportunity to select one of many BSSs within the range of the STA or to select among multiple APs 102 that together form an extended service set (ESS) (including multiple connected BSSs). An extended network station associated with a WLAN 100 can be connected to a wired or wireless distribution system that allows multiple APs 102 to be connected in such an ESS. Therefore, a STA 104 may be covered by more than one AP 102 and may be associated with different APs 102 at different times for different transmissions. Additionally, after associating with an AP 102, the STA 104 may also be configured to periodically scan its surroundings to find a more appropriate AP 102 to associate with. For example, a STA 104 that is moving relative to its associated AP 102 may perform a "roaming" scan to find another AP 102 with a more desirable network characteristic (such as a larger received signal strength indicator (RSSI) or a reduced traffic load).

[0029] In some cases, STA 104 may form a network without AP 102 or other equipment other than STA 104 itself. An example of such a network is an ad hoc network (or wireless ad hoc network). An ad hoc network may alternatively be referred to as a mesh network or a peer-to-peer (P2P) network. In some cases, an ad hoc network may be implemented within a larger wireless network (such as WLAN 100). In such a specific implementation, although STA 104 may be able to communicate with each other through AP 102 using communication link 108, STA 104 may also communicate directly with each other via direct wireless link 110. Additionally, two STA 104 may communicate via direct communication link 110, regardless of whether the two STA 104 are associated with the same AP 102 and served by the same AP. In such an ad hoc system, one or more STA 104 may assume the role played by AP 102 in the BSS. Such STA 104 may be referred to as a group owner (GO) and may coordinate the transmission within the ad hoc network. Examples of the direct wireless link 110 include a Wi-Fi direct connection, a connection established by using a Wi-Fi Tunnel Direct Link Setup (TDLS) link, and other P2P group connections.

[0030] The AP 102 and the STA 104 may function and communicate (via corresponding communication links 108) in accordance with the IEEE 802.11 family of wireless communication protocol standards, such as those defined by the IEEE 802.11-2016 specification or its revisions, including but not limited to 802.11ay, 802.11ax, 802.11az, 802.11ba, and 802.11be. These standards define WLAN radio and baseband protocols for the PHY and medium access control (MAC) layers. The AP 102 and the STA 104 send and receive wireless communications (hereinafter also referred to as "Wi-Fi communications") to and from each other in the form of PHY protocol data units (PPDUs) (or physical layer convergence protocol (PLCP) PDUs). The AP 102 and STA 104 in the WLAN 100 may send PPDUs on an unlicensed spectrum, which may be a portion of a spectrum that includes frequency bands traditionally used by Wi-Fi technology, such as the 2.4 GHz band, the 5 GHz band, the 60 GHz band, the 3.6 GHz band, and the 900 MHz band. Some implementations of the AP 102 and STA 104 described herein may also communicate in other frequency bands, such as the 6 GHz band, that may support both licensed and unlicensed communications. The AP 102 and STA 104 may also be configured to communicate on other frequency bands, such as shared licensed frequency bands, where multiple operators may have licenses to operate in one or more of the same or overlapping frequency bands.

[0031] Each frequency band in the frequency band may include multiple sub-bands or frequency channels. For example, PPDUs that comply with IEEE 802.11n, 802.11ac, 802.11ax, and 802.11be standard revisions may be sent on 2.4 GHz, 5 GHz, or 6 GHz frequency bands, where each frequency band is divided into multiple 20 MHz channels. Therefore, these PPDUs are sent on a physical channel with a minimum bandwidth of 20 MHz, but larger channels may be formed by channel bonding. For example, a PPDU may be sent on a physical channel with a bandwidth of 40 MHz, 80 MHz, 160 MHz, or CCC20 MHz by bonding multiple 20 MHz channels together.

[0032] Each PPDU is a composite structure including a PHY preamble and a payload in the form of a PHY service data unit (PSDU). The information provided in the preamble can be used by the receiving device to decode subsequent data in the PSDU. In an instance where the PPDU is sent on a bound channel, the preamble field can be copied and sent in each component channel of a plurality of component channels. The PHY preamble may include both a legacy part (or "legacy preamble") and a non-legacy part (or "non-legacy preamble"). Legacy preambles can be used for other purposes such as packet detection, automatic gain control, and channel estimation. Legacy preambles can also be used to maintain compatibility with legacy devices. The format, decoding, and information provided therein of the non-legacy part of the preamble are based on the specific IEEE 802.11 protocol to be used to send the payload.

[0033] Figure 2 2 shows a block diagram of an example wireless communication device 200. In some implementations, the wireless communication device 200 may be a wireless communication device for a STA (such as the one described above with reference to FIG. Figure 1 In some implementations, the wireless communication device 200 may be an example of a device in an AP (such as one of the STAs 104 described above). Figure 1 The wireless communication device 200 is capable of sending and receiving wireless communications, for example, in the form of wireless packets. For example, the wireless communication device can be configured to send and receive packets in the form of physical layer convergence protocol (PLCP) protocol data units (PPDUs) and medium access control (MAC) protocol data units (MPDUs) that comply with IEEE 802.11 wireless communication protocol standards (such as those defined by the IEEE 802.11-2016 specification or its amendments, including but not limited to 802.11ay, 802.11ax, 802.11az, 802.11ba, and 802.11be).

[0034] The wireless communication device 200 may be or may include a chip, system on chip (SoC), chipset, package, or device that includes one or more modems 202 (e.g., Wi-Fi (IEEE 802.11 compatible) modems). In some implementations, one or more modems 202 (collectively, “modems 202”) additionally include a WWAN modem (e.g., a 3GPP 4G LTE or 5G compatible modem). In some implementations, the wireless communication device 200 also includes one or more processors, processing blocks, or processing elements 204 (collectively, “processors 204”) coupled to the modems 202. In some implementations, the wireless communication device 200 additionally includes one or more radios 206 (collectively, “radios 206”) coupled to the modems 202. In some implementations, the wireless communication device 200 also includes one or more memory blocks or elements 208 (collectively, “memory 208”) coupled to the processor 204 or the modem 202.

[0035] The modem 202 may include an intelligent hardware block or device (such as, for example, an application specific integrated circuit (ASIC) and other examples). The modem 202 is generally configured to implement the PHY layer, and in some specific implementations, also implement a portion of the MAC layer (e.g., a hardware portion of the MAC layer). For example, the modem 202 is configured to modulate packets and output the modulated packets to the radio component 204 for transmission over the wireless medium. Similarly, the modem 202 is configured to obtain modulated packets received by the radio component 204 and demodulate the packets to provide demodulated packets. In addition to the modulator and demodulator, the modem 202 may also include digital signal processing (DSP) circuitry, automatic gain control (AGC) circuitry, a decoder, a decoder, a multiplexer, and a demultiplexer. For example, when in a transmit mode, data obtained from the processor 206 may be provided to an encoder, which encodes the data to provide decoded bits. The decoded bits may then be mapped to a number (N SS ) spatial streams for spatial multiplexing or several (N STSThe decoded bits in each stream may then be mapped (using the selected MCS) to points in the modulation constellation to provide modulated symbols. The modulated symbols in the corresponding spatial stream or space-time stream may be multiplexed, transformed via an inverse fast Fourier transform (IFFT) block, and then provided to a DSP circuit (e.g., for Tx windowing and filtering). The digital signal may then be provided to a digital-to-analog converter (DAC). The resulting analog signal may then be provided to a frequency upconverter and ultimately to the radio component 204. In a specific implementation involving beamforming, the modulated symbols in the corresponding spatial stream are pre-decoded via a steering matrix before being provided to the IFFT block.

[0036] When in receive mode, the DSP circuit is configured to acquire a signal including modulated symbols received from the radio component 204, for example, by detecting the presence of the signal and estimating initial timing and frequency offsets. The DSP circuit is further configured to digitally condition the signal, for example using channel (narrowband) filtering and analog impairment conditioning (such as correcting I / Q imbalance) and by applying digital gain to ultimately obtain a narrowband signal. The output of the DSP circuit may then be fed to an AGC, which is configured to use information extracted from the digital signal (e.g., in one or more received training fields) to determine an appropriate gain. The output of the DSP circuit is also coupled to a demultiplexer, which demultiplexes the modulated symbols when multiple spatial streams or space-time streams are received. The demultiplexed symbols may be provided to a demodulator, which is configured to extract the symbols from the signal and, for example, calculate a log-likelihood ratio (LLR) for each bit position of each subcarrier in each spatial stream. The demodulator is coupled to a decoder, which may be configured to process the LLRs to provide decoded bits. The decoded bits may then be descrambled and provided to the MAC layer (processor 206) for processing, evaluation, or interpretation.

[0037] The radio 204 generally includes at least one radio frequency (RF) transmitter (or "transmitter chain") and at least one RF receiver (or "receiver chain"), which may be combined into one or more transceivers. For example, each of the RF transmitter and receiver may include various analog circuits, including at least one power amplifier (PA) and at least one low noise amplifier (LNA), respectively. The RF transmitter and RF receiver may in turn be coupled to one or more antennas. For example, in some implementations, the wireless communication device 200 may include or be coupled to multiple transmit antennas (each having a corresponding transmit chain) and multiple receive antennas (each having a corresponding receive chain). The symbols output from the modem 202 are provided to the radio component 204, which then transmits the symbols via the coupled antennas. Similarly, the symbols received via the antennas are obtained by the radio component 204, which then provides the symbols to the modem 202.

[0038] The processor 206 may include an intelligent hardware block or device designed to perform the functions described herein, such as, for example, a processing core, a processing block, a central processing unit (CPU), a microprocessor, a microcontroller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a programmable logic device (PLD) (such as a field programmable gate array (FPGA)), discrete gate or transistor logic, discrete hardware components, or any combination thereof. The processor 206 processes information received through the radio component 204 and the modem 202, and processes information to be output by the modem 202 and the radio component 204 to be sent through the wireless medium. For example, the processor 206 may implement at least a portion of the control plane and the MAC layer, which is configured to perform various operations related to the generation, transmission, reception and processing of MPDUs, frames or packets. In some specific implementations, the MAC layer is configured to generate MPDUs to provide to the PHY layer for decoding, and receive decoded information bits from the PHY layer for processing as MPDUs. The MAC layer may be further configured to allocate time and frequency resources, such as for OFDMA and other operations or technologies. In some implementations, the processor 206 can generally control the modem 202 to cause the modem to perform the various operations described above.

[0039] The memory 204 may include a tangible storage medium, such as a random access memory (RAM) or a read-only memory (ROM) or a combination thereof. The memory 204 may also store non-transitory processor-executable or computer-executable software (SW) code containing instructions that, when executed by the processor 206, cause the processor to perform various operations for wireless communication described herein, including generation, transmission, reception, and interpretation of MPDUs, frames, or packets. For example, the various functions of the components disclosed herein or the various blocks or steps of the methods, operations, processes, or algorithms disclosed herein may be implemented as one or more modules of one or more computer programs.

[0040] Figure 3A 302 is a block diagram of an example AP 302. For example, AP 302 may be a reference Figure 1 The AP 102 is described as an example implementation. The AP 302 includes a wireless communication device (WCD) 310 (although the AP 302 itself may also be generally referred to as a wireless communication device, as used herein). For example, the wireless communication device 310 may be a wireless communication device. Figure 2 The example implementation of the wireless communication device 2000 described. The AP 302 also includes a plurality of antennas 320 coupled to the wireless communication device 310 to send and receive wireless communications. In some implementations, the AP 302 additionally includes an application processor 330 coupled to the wireless communication device 310 and a memory 340 coupled to the application processor 330. The AP 302 also includes at least one external network interface 350 that enables the AP 302 to communicate with a core network or a backhaul network to gain access to an external network including the Internet. For example, the external network interface 350 may include one or both of a wired (e.g., Ethernet) network interface and a wireless network interface (such as a WWAN interface). Components of the above components may communicate directly or indirectly with other components of the components via at least one bus. The AP 302 also includes a housing that encloses the wireless communication device 310, the application processor 330, the memory 340, and at least portions of the antenna 320 and the external network interface 350.

[0041] Figure 3B 304. For example, STA 304 may be a reference Figure 1 The example implementation of STA 104 is described. STA 304 includes a wireless communication device 315 (although STA 304 itself may also be generally referred to as a wireless communication device as used herein). For example, wireless communication device 315 may be a reference Figure 2An example implementation of the wireless communication device 200 described. The STA 304 also includes one or more antennas 325 coupled to the wireless communication device 315 for sending and receiving wireless communications. The STA 304 additionally includes an application processor 335 coupled to the wireless communication device 315 and a memory 345 coupled to the application processor 335. In some implementations, the STA 304 also includes a user interface (UI) 355 (such as a touch screen or keyboard) and a display 365, which can be integrated with the UI 355 to form a touch screen display. In some implementations, the STA 304 can also include one or more sensors 375, such as, for example, one or more inertial sensors, accelerometers, temperature sensors, pressure sensors, or altitude sensors. Components of the above components can communicate directly or indirectly with other components of the components via at least one bus. The STA 304 also includes a housing that encloses the wireless communication device 315, the application processor 335, the memory 345, and at least portions of the antenna 325, the UI 355, and the display 365.

[0042] As described above, APs within the wireless communication range of a STA may operate according to different wireless security protocols. For example, a STA may be within the wireless communication range of both a first AP operating according to a WPA 3 wireless security protocol and a second AP operating according to a WPA 2 wireless communication protocol. Although the STA may be able to authenticate to either the first AP or the second AP, WPA 3 is much more secure than WPA 2. For example, WPA 2 is vulnerable to attacks such as offline dictionary attacks. If a malicious actor monitors an attempt by a STA to authenticate to a WPA 2 AP, and more specifically a four-way handshake between WPA 2 and the STA, the malicious actor may be able to determine the password for the WPA 2 AP, and then impersonate the WPA 2 AP in order to compromise a device communicating with the WPA 2 AP.

[0043] A malicious observer of this four-way handshake may be able to determine the password for the WPA 2 AP, or may be able to replay, decrypt, or forge packets exchanged between the STA and the WPA 2 AP.

[0044] Recently, the WPA 3 wireless security protocol has been introduced to provide stronger protection for wireless communications. For example, instead of adopting the 4-way handshake used for WPA 2, WPA 3 adopts a new handshake called Simultaneous Authentication of Equivalents (or SAE), which is much less susceptible to dictionary attacks. Some APs may also operate in a WPA 3 transition mode (which is sometimes referred to as a mixed mode) and may allow connections to STAs that are not compatible with WPA 3 (for simplicity, this WPA 3 transition mode will be described as WPA 3 in this article). Therefore, it is desirable for STAs to avoid authenticating to APs operating according to WPA 2, especially in the presence of APs operating according to the more secure WPA 3.

[0045] Various aspects are generally directed to improving security in a wireless networking environment that includes access points (APs) operating according to Wi-Fi Protected Access (WPA) 2 and WPA 3 wireless security protocols. Compared to conventional techniques, example implementations may be configured to prioritize authentication to APs according to WPA 3 (via Simultaneous Authentication of Equals (SAE) authentication types), where a STA may prioritize authentication to an AP based on the frequency band on which the AP operates or based on the most compatible (but least secure) authentication type supported by a group of APs sharing a shared SSID. In some other implementations, even when two APs share an SSID, a STA may be configured to present the two APs in two separate groups in order to reduce the likelihood that the STA may inadvertently authenticate to a less secure WPA 2 AP in the presence of a more secure WPA 3 AP.

[0046] Certain aspects of the subject matter described in this disclosure may be implemented to achieve one or more of the following potential advantages. In some examples, the described techniques may be used to prevent a user from erroneously authenticating to a WPA 2AP and prioritize authenticating to a WPA 3AP even when a WPA 2 AP and a WPA 3AP have the same service set identifier (SSID). This prioritization may reduce the likelihood that a malicious actor may compromise a network by monitoring signals exchanged with a WPA 2AP. Additionally, various aspects may improve the security of a wireless networking environment by reducing the chance that a user authenticates to an AP operating in accordance with the less secure WPA 2 and increasing the chance that a user authenticates to an AP operating in accordance with the more secure WPA 3, even in the absence of a malicious actor.

[0047] As described above, when multiple APs with the same SSID are within the wireless communication range of a regular STA, the security of the STA may be compromised. For example, when a first AP operating according to WPA 3 and a second AP operating according to WPA 2 are both within the wireless communication range of a regular STA, the STA may regard the first AP and the second AP as having the same authentication type or "authtype". Despite the presence of the first AP operating according to the more secure WPA 3 using the SAE authentication type, the regular STA may set the authentication type of both the first AP and the second AP to WPA-PSK or Wi-Fi Protected Access Pre-Shared Key associated with WPA 2.

[0048] In addition, a regular STA may give more priority to an AP operating in a preferred frequency band. For example, a STA may prefer to select an AP operating in the 5 GHz frequency band rather than an AP operating in the 2.4 GHz frequency band.

[0049] Figure 4 A timing diagram 400 illustrating the vulnerability of a conventional STA to malicious actors is shown. Figure 4 , STA 402 may be within the wireless communication range of a WPA 3 or WPA 3 transition AP 404 operating on the 2.4 GHz band and a WPA 2 AP 406 operating on the 5 GHz band. STA 402 may be Figure 1 STA 103 Figure 2 The wireless communication device 200 or Figure 3B An example of STA304, and APs 404 and 406 may be Figure 1 AP 102 Figure 2 The wireless communication device 200 or Figure 3A404 and AP 406. STA 402 may receive a first beacon 410 from AP 404 and a second beacon 420 from AP 406. For example, the first beacon 410 and the second beacon 420 may be received by STA 402 after STA 402 initiates a scan for the presence of APs within the wireless communication range of STA 402 (not shown for simplicity). As discussed above, for compatibility, STA 402 may consider the authentication type of both AP 404 and AP 406 as WPA-PSK, although AP 404 is capable of a more secure SAE authentication type. In addition, because AP 406 operates via the 5 GHz band, STA 402 may again select AP 406 instead of AP 404, although AP 404 operates using a more secure authentication type. Therefore, STA 402 may select (406) to authenticate to AP 406. STA 402 may then initiate an authentication attempt 440 with AP 406 and engage in a 4-way handshake 450 with AP 406. Because AP 406 operates in accordance with WPA 2 rather than the more secure WPA 3, 4-way handshake 450 may be monitored by malicious monitor 408, which may capture signals exchanged during 4-way handshake 450 and compromise the security of subsequent communications with AP 406. For example, as discussed above, compromising the security of AP 406 may allow a malicious actor to decrypt, replay, or forge packets exchanged with AP 406, such as using an offline dictionary attack or the like. In some aspects, a malicious actor may use this password to generate a rogue AP masquerading as AP 406, for example, in order to compromise STAs and connected devices.

[0050] Figure 5 A timing diagram 500 is shown showing an example selection of an AP and authentication to the AP by a wireless communication device. For example, the wireless communication device may be Figure 1 STA 103 Figure 2 A wireless communication device 200, or Figure 3B500. The wireless communication device that performs the steps shown in the timing diagram 500 may include a user interface 502, a Wi-Fi framework 504, a driver 506, and a supplicant 508. The user interface 502 may present selectable options to a user for scanning and connecting to one or more APs. The Wi-Fi framework 504 may receive instructions from the user interface 502, initiate a wireless scan based on the instructions from the user interface 502, receive and process the scan results for display, and issue commands to the supplicant 508, for example, based on the instructions received from the user interface 502. The driver 506 may control one or more modems of the wireless communication device to send or receive signals based on the instructions received from the Wi-Fi framework 504 and the supplicant 508. The supplicant 508 may be responsible for login requests to the wireless network, and more specifically may process login and encryption credentials for connecting to the wireless network, such as via one or more APs within the wireless communication range of the wireless communication device.

[0051] about Figure 5, the user interface 502 may request (510) a scan for APs within the wireless communication range of the wireless communication device. For example, the scan may be triggered by a user selecting one or more options on the user interface 502 (not shown for simplicity). A scan request 520 may be transmitted to the Wi-Fi framework 504. In response to the scan request 510, the Wi-Fi framework 504 may transmit a message to the driver 506 to initiate (512) the scan. The driver 506 may perform the scan and receive one or more results of the scan. The driver 506 may return the scan results 514 to the Wi-Fi framework 504, which may sort and group the scan results (520) for presentation on the user interface 502. The sorted and grouped scan results (530) may then be transmitted for display at the user interface 502. A connection request 540 may be transmitted from the user interface 502 to the Wi-Fi framework 504. The connection request 540 may request a connection to an AP having at least a specified SSID. In some aspects, the connection request may be a request to connect to an AP from a set of APs based on the sorting and grouping of the scan results (520). In some aspects, the connection request may be triggered by a user selecting one or more options (not shown for simplicity) on the user interface 502. In response to receiving the connection request 540, the Wi-Fi framework 504 may issue (550) a connection instruction to the supplicant 508 to authenticate to an AP having a specified SSID and authentication type. The supplicant 508 may then select (560) an AP having the specified SSID and authentication type, and initiate authentication (570) to the selected AP. For example, the supplicant 508 may select from the APs having the specified SSID and authentication type based on the operating band of the selected AP. The supplicant may then initiate a connection with the selected AP based on the SSID and authentication type specified by the framework and the BSSID of the selected AP. For example, initiating authentication with the selected AP may include performing one or more authentication functions, such as a 4-way handshake associated with WPA 2, or SAE authentication associated with WPA 3.

[0052] As discussed above, even in the presence of a WPA 3AP, a regular STA may not be expected to authenticate to a WPA 2AP. This may be due in part to a Wi-Fi framework (such as Wi-Fi framework 504) and in part to a supplicant (such as supplicant 508).

[0053] For example, when sorting and grouping the scan results (such as sorting and grouping 520), when the first AP operates according to WPA3 or WPA 3 transition mode (mixed mode) and the second AP operates according to WPA 2, the Wi-Fi framework may place the first AP and the second AP in a single group. In addition, for wider compatibility, in a conventional STA, the Wi-Fi framework may set the authentication type of this group to the most compatible authentication type of all APs in the group. That is, even if the first AP can be authenticated according to the more secure SAE, the Wi-Fi framework may set the authentication type of this group to the less secure WPA-PSK.

[0054] Furthermore, upon receiving an instruction to authenticate to an AP having a specified SSID and an authentication type, the supplicant selects an AP based on the specified SSID and the authentication type, such as Figure 5 560. In a conventional STA, the supplicant may undesirably select a WPA 2 AP for connection even in the presence of a more secure WPA 3 AP. For example, consider a situation where a first AP (WPA 3 or mixed mode) and a second AP (WPA 2) are grouped and the first AP operates on the 2.4 GHz band and the second AP operates on the 5 GHz band. As discussed above, in a conventional AP, the group is associated with a WPA-PSK authentication type. In a conventional STA, even when the first AP has a greater signal strength, the supplicant may select the second AP to connect to it because the second AP operates on the 5 GHz band. Again, this is undesirable because the second AP operates according to the more vulnerable WPA 2.

[0055] To avoid these vulnerabilities, example implementations may alter the functionality of the Wi-Fi framework, the supplicant, or both.

[0056] In some aspects, the Wi-Fi framework may assign an SAE authentication type to any group that includes APs that are compatible with SAE (that is, APs that operate in accordance with WPA 3 or WPA 3 transition mode (mixed mode)). Rather than assigning an authentication type based on the most widely compatible authentication type supported by the APs in the group, the Wi-Fi framework may assign an authentication type based on the most secure authentication type supported by any AP in the group. For example, consider again a group that includes a first AP (WPA 3 or mixed mode) and a second AP (WPA 2) with the same SSID. While a conventional STA may assign a WPA-PSK authentication type to this group, an example implementation may assign an SAE authentication type to this group. Thus, when instructions are provided to the supplicant, the instructions include the SAE authentication type, so the supplicant may select the more secure first AP for connection even when the first AP operates on the 2.4 GHz band and the second AP operates on the 5 GHz band.

[0057] While implementations are described above in terms of APs compatible with WPA 3 and WPA 2 wireless security protocols, in some other implementations, an example STA may be configured to prioritize authentication to APs compatible with wireless security protocols more secure than WPA 3, such as subsequent iterations of the WPA wireless security protocol or the like. More specifically, consider a STA that scans for the presence of APs within the wireless communication range of the STA and identifies two APs with the same SSID, the first AP being compatible with a wireless security protocol more secure than WPA 3, and the second AP being compatible with a less secure wireless security protocol, such as WPA 3 or WPA 2. In some aspects, the Wi-Fi framework may group the first AP and the second AP because the first AP and the second AP share an SSID. The Wi-Fi framework may then assign an authentication type to the group based on the most secure authentication type supported by the group, such as the most secure authentication type supported by the first AP. Rather than assigning an authentication type based on the most widely compatible authentication type supported by the APs in the group, the Wi-Fi framework may assign an authentication type based on the most secure authentication type supported by any AP in the group.

[0058] In some other aspects, unlike the Wi-Fi framework that groups APs with the same SSID but different authentication types, an example implementation may present such ungrouped APs. For example, consider again a first AP (WPA 3 or mixed mode) and a second AP (WPA 2), each having the same SSID. According to some implementations, the first AP and the second AP are not grouped in the scan results provided to the user interface, that is, the first AP may be presented in a first group and the second AP may be presented in a second group. Then, the user is less likely to inadvertently select a less secure second AP. In some aspects, in order to increase the chances of the user selecting a more secure first AP, the scan results may emphasize APs compatible with a more secure authentication type. For example, the user interface may present APs operating according to WPA 3 higher in the list, may highlight such APs (e.g., using a color indicating preference), or otherwise emphasize that such APs are preferred. Additionally or alternatively, the user interface may de-emphasize the display of APs with less secure authentication types. For example, the user interface may present such APs lower in the list, may fade the text associated with such APs, may highlight such APs using unpleasant colors, may de-emphasize such APs, or otherwise indicate that such APs are unwelcome. In addition, the user interface may provide a warning message when a user chooses to connect to an AP operating according to WPA 2 when there is another AP with the same SSID and operating according to WPA 3 or mixed mode. Such techniques may reduce the probability that a user chooses to connect to a less secure WPA 2 AP when there is a more secure WPA 3 AP. In some other aspects, when a first AP is compatible with a wireless security protocol that is more secure than WPA 3 and a second AP is compatible with a less secure wireless security protocol (such as WPA 3 or WPA 2), the Wi-Fi framework may not group the first AP and the second AP and may present the first AP and the second AP separately in the scan results provided to the user interface. Similar techniques may be employed in order to emphasize a more secure first AP or de-emphasize a less secure second AP.

[0059] Figure 6 A flowchart illustrating an example process 600 for supporting improved security in wireless communications according to some implementations is shown. The operations of process 600 may be implemented by a STA or a component thereof as described herein. For example, process 600 may be performed by a wireless communication device (such as the one described above with reference to FIG. Figure 2 In some implementations, process 600 may be performed by a STA (such as the wireless communication device 200 described above). Figure 1 and Figure 3B 104 and 304) described herein.

[0060] In some implementations, in block 602, the wireless communication device scans a wireless medium for the presence of access points (APs) within wireless communication range of a first wireless communication device. In some implementations, in block 604, the wireless communication device identifies, based on the scanning, two or more APs each having a same first service set identifier (SSID), the two or more APs including a first AP that supports a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol. In some implementations, in block 606, the wireless communication device selects a first simultaneous authentication of peers (SAE) authentication type for a first group of APs including the first AP based at least in part on at least one AP in the first group of APs that supports the WPA 3 wireless security protocol. In some implementations, in block 608, the wireless communication device authenticates to the first AP based at least in part on the first SSID and the first SAE authentication type.

[0061] In some implementations, the first AP is associated with a 5 GHz frequency band and the second AP is associated with a 2.4 GHz frequency band. In some implementations, the first group of APs includes the second AP. In some implementations, the second AP is in a second group of APs that does not include the first AP.

[0062] In some implementations, process 600 further includes: providing the scan results to a user interface of the wireless communication device, wherein the results include the first set of APs; and receiving a request from the user interface of the wireless communication device to authenticate with an AP in the first set of APs, wherein authenticating with the first AP is responsive to receiving the request. In some aspects, receiving the request includes: receiving a selection of the first set of APs from the user interface.

[0063] In some implementations, authenticating to the first AP in block 608 includes transmitting a request to a supplicant of the wireless communication device, wherein the request indicates the first SSID and the first SAE authentication type. In some aspects, the supplicant authenticates to the first AP based at least in part on the first SAE authentication type and the first SSID.

[0064] Figure 7 A block diagram of an example wireless communication device 700 supporting improved security in wireless communications according to some implementations is shown. In some implementations, the wireless communication device 700 is configured to perform the above-referenced Figure 6 The wireless communication device 700 may be the one described above with reference to Figure 2Example implementations of the wireless communication device 200 are described. For example, the wireless communication device 700 can be a chip, SoC, chipset, package, or device that includes at least one processor (such as the processor 202), at least one modem (e.g., a Wi-Fi (IEEE 802.11) modem or a cellular modem such as the modem 204), at least one memory (such as the memory 208), and at least one radio component (such as the radio component 206). In some implementations, the wireless communication device 700 can be a STA (such as the STAs described above, respectively). Figure 1 and Figure 3B In some other implementations, the wireless communication device 700 may be a STA including such a chip, SoC, chipset, package or device and at least one antenna (such as antenna 322).

[0065] The wireless communication device 700 includes a scanning component 702, an AP identification component 704, an authentication type component 706, and an AP authentication component 708. Portions of one or more of the components 702, 704, 706, and 708 may be implemented at least in part in hardware or firmware. For example, the scanning component 702 may be implemented at least in part by a modem (such as modem 202). In some specific implementations, at least some of the components 702, 704, 706, and 708 are at least partially implemented as software stored in a memory (such as memory 208). For example, portions of one or more of the components 702, 704, 706, and 708 may be implemented as non-transitory instructions (or "code") that can be executed by a processor (such as processor 206) to perform the functions or operations of the corresponding module.

[0066] The scanning component 702 is configured to scan the wireless medium for the presence of access points (APs) within wireless communication range of the wireless communication device.

[0067] The AP identification component 704 is configured to identify two or more APs, each having the same first service set identifier (SSID), based on scanning, the two or more APs including a first AP that supports a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol.

[0068] The authentication type component 706 is configured to select a first Simultaneous Authentication of Equivalents (SAE) authentication type for a first set of APs including the first AP based at least in part on at least one AP in the first set of APs supporting the WPA 3 wireless security protocol.

[0069] AP authentication component 708 is configured to authenticate with the first AP based at least in part on the first SSID and the first SAE authentication type.

[0070] As used herein, "or" is intended to be interpreted in an inclusive sense unless expressly stated otherwise. For example, "a or b" may include only a, only b, or a combination of a and b. As used herein, phrases referring to "at least one of" or "one or more of" a list of items refer to any combination of those items, including single members. For example, "at least one of a, b, or c" is intended to cover the following examples: only a, only b, only c, a combination of a and b, a combination of a and c, a combination of b and c, and a combination of a, b, and c.

[0071] The various illustrative components, logic, logic blocks, modules, circuits, operations, and algorithmic processes described in conjunction with the specific implementations disclosed herein may be implemented as electronic hardware, firmware, software, or a combination of hardware, firmware, or software, including the structures disclosed in this specification and their structural equivalents. This interchangeability of hardware, firmware, and software has been generally described in terms of their functionality and exemplified in the various illustrative components, blocks, modules, circuits, and processes described above. Whether such functionality is implemented in hardware, firmware, or software depends on the specific application and the design constraints imposed on the overall system.

[0072] Various modifications to the specific implementations described in this disclosure will be apparent to those of ordinary skill in the art, and the general principles defined herein may be applied to other specific implementations without departing from the spirit or scope of the disclosure. Therefore, the claims are not intended to be limited to the specific implementations shown herein, but should be granted the widest scope consistent with the disclosure, the principles and novel features disclosed herein.

[0073] Additionally, various features described in this specification in the context of separate implementations may also be implemented in combination in a single implementation. Conversely, individual features described in the context of a single implementation may also be implemented in multiple implementations individually or in any suitable subcombination. Thus, although features may be described above as functioning in a particular combination, and even initially claimed as such, one or more features from a claimed combination may in some cases be deleted from the combination, and a claimed combination may be directed to a subcombination or a variation of a subcombination.

[0074] Similarly, although operations are depicted in a specific order in the accompanying drawings, this should not be understood as requiring such operations to be performed in the specific order shown or in a sequential order, or to perform all illustrated operations to achieve the desired result. In addition, the accompanying drawings may schematically depict one or more example processes in the form of a flow chart or a flow diagram. However, other operations not depicted can be incorporated into the example processes schematically illustrated. For example, one or more additional operations can be performed before, after, simultaneously or between any operations in the illustrated operations. In some environments, multitasking and parallel processing may be advantageous. In addition, the separation of various system components in the specific implementation described above should not be understood as requiring such separation in all specific implementations, but it should be understood as described program components and systems can usually be integrated together in a single software product, or be packaged in multiple software products.

Claims

1. A method for wireless communication by a first wireless station (STA), the method comprising: scanning a wireless medium for the presence of an access point (AP) within a wireless communication range of the first wireless STA; identifying, based on the scanning, two or more APs each having a same first service set identifier (SSID), the two or more APs including a first AP that supports a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol; selecting a first simultaneous authentication of peers (SAE) authentication type for the first group of APs based on at least one AP in a first group of APs including the first AP supporting the WPA 3 wireless security protocol; as well as Authenticate with the first AP based at least in part on the first SSID and the first SAE authentication type. 2 . The method of claim 1 , wherein the first AP is associated with a 5 GHz frequency band and the second AP is associated with a 2.4 GHz frequency band. The method of claim 2 , wherein the first group of APs further includes the second AP. The method of claim 2 , wherein the second AP is in a second group of APs that does not include the first AP.

5. The method according to claim 1, further comprising: providing a result of the scanning to the user interface of the first wireless STA, the result indicating the first group of APs; A request is received from a user interface of the first wireless STA to authenticate with an AP in the first set of APs, wherein the authentication with the first AP is in response to receiving the request.

6. The method of claim 5, wherein receiving the request comprises: A selection of the first set of APs is received from the user interface.

7. The method of claim 1, wherein authenticating to the first AP comprises: A request is transmitted to a supplicant of the first wireless STA, the request indicating the first SSID and the first SAE authentication type.

8. The method of claim 7, wherein the supplicant authenticates with the first AP based at least in part on the first SAE authentication type and the first SSID.

9. A first wireless station (STA), the first wireless station (STA) comprising: at least one processor; and at least one memory communicatively coupled to the at least one processor and storing processor-readable code that, when executed by the at least one processor, is configured to cause the first wireless STA to: scanning a wireless medium for the presence of an access point (AP) within a wireless communication range of the first wireless STA; identifying, based on the scanning, two or more APs each having a same first service set identifier (SSID), the two or more APs including a first AP that supports a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol; selecting a first Simultaneous Authentication of Equals (SAE) authentication type for the first set of APs based at least in part on at least one AP in a first set of APs including the first AP supporting the WPA 3 wireless security protocol; as well as Authenticate with the first AP based at least in part on the first SSID and the first SAE authentication type.

10. The first wireless STA of claim 9, wherein the first AP is associated with a 5 GHz frequency band, and the second AP is associated with a 2.4 GHz frequency band. The first wireless STA according to claim 10 , wherein the first group of APs further includes the second AP. 12 . The first wireless STA according to claim 10 , wherein the second AP is in a second group of APs excluding the first AP.

13. The first wireless STA of claim 9, wherein the at least one processor in conjunction with the at least one modem is further configured to: Providing a result of the scan to the user interface of the first wireless STA, the result including the first group of APs; receiving, from a user interface of the first wireless STA, a request for authentication to an AP in the first group of APs; and Wherein authenticating to the first AP is in response to receiving the request.

14. The first wireless STA of claim 13, wherein receiving the request comprises: A selection of the first set of APs is received from the user interface.

15. The first wireless STA of claim 9, wherein authenticating to the first AP comprises: A request is transmitted to a supplicant of the first wireless STA, the request indicating the first SSID and the first SAE authentication type.

16. The first wireless STA of claim 15, wherein the supplicant authenticates to the first AP based at least in part on the first SAE authentication type and the first SSID.

17. The first wireless STA according to claim 1, wherein the first wireless STA further comprises: at least one transceiver coupled to the at least one modem; at least one antenna coupled to the at least one transceiver to wirelessly transmit signals output from the at least one transceiver and to wirelessly receive signals for input into the at least one transceiver; and A housing enclosing at least a portion of the at least one modem, the at least one processor, the at least one memory, the at least one transceiver, and the at least one antenna.

18. A first wireless station (STA), the first wireless station (STA) comprising: means for scanning a wireless medium for the presence of an access point (AP) within wireless communication range of the first wireless STA; means for identifying, based on the scanning, two or more APs each having a same first service set identifier (SSID), the two or more APs including a first AP that supports a Wi-Fi Protected Access (WPA) 3 wireless security protocol and a WPA 2 wireless security protocol and including a second AP that supports the WPA 2 wireless security protocol but does not support the WPA 3 wireless security protocol; means for selecting a first simultaneous authentication of peers (SAE) authentication type for the first group of APs based on at least one AP in a first group of APs including the first AP supporting the WPA 3 wireless security protocol; and Means for authenticating to the first AP based at least in part on the same first SSID and the first SAE authentication type. The first wireless STA according to claim 18 , wherein the first group of APs further includes the second AP.

20. The first wireless STA of claim 18, wherein the second AP is in a second group of APs that does not include the first AP.

Images