Over-the-air network provisioning using pre-shared keys - Patents.com

Abstract

Various preparatory configurations for wireless network provisioning using a pre-shared key (PSK) are presented. A plurality of wireless network access profiles indicating the plurality of PSKs can be stored. An access point can receive a first value based on the PSK from a wireless device. The access point can transmit the first value to a cloud-based provisioning system. A plurality of values ​​based on the plurality of PSKs for the plurality of wireless network access profiles can be created, and a match between a second value of the plurality of values ​​and the transmitted first value can be identified. A third value can be provided to the access point based on the PSK of the wireless network access profile used to generate the value of the plurality of wireless network access profiles. Network access can then be granted based on the third value.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Patent Application No. 62 / 908,221, entitled "Wireless Network Provisioning using a Pre-Shared Key," filed September 30, 2019, and U.S. Provisional Patent Application No. 62 / 986,255, entitled "Wireless Network Provisioning using a Pre-Shared Key," filed March 6, 2020, which claims priority to U.S. Provisional Patent Application No. 17 / 028,401, entitled "Wireless Network Provisioning using a Pre-Shared Key," filed September 22, 2022, the disclosure of which is incorporated herein by reference in its entirety for all purposes. [Background technology]

[0002] Enabling wireless devices for wireless network access can be challenging. Only some wireless devices may be capable of authentication-based provisioning, such as Hotspot 2.0. Alternatively, 802.1x Extensible Authentication Protocol (EAP) may allow a user to provide credentials via a wireless device after connecting to a wireless network. However, this provisioning may not be possible if the wireless device attempting to connect to the wireless network does not have a usable user interface to present such a request and collect user credentials. For example, many Internet of Things (IoT) devices, such as sensor devices, may not have a sufficient user interface for a user to efficiently enter such credentials.

[0003] In a traditional pre-shared key (PSK) provisioning configuration, such as for a home Wi-Fi network, a user may perform an initial configuration of an access point (AP), such as a wireless router. The user may create a PSK, such as a string of characters that the user can easily remember or otherwise store (e.g., write down), and provide the PSK to the AP. For a wireless device that the user wishes to connect to the wireless network, the user may enter or select the SSID of the wireless network to be established by the AP and enter the PSK. Based on encrypted communications between the AP and the wireless device, a determination may be made as to whether the PSK provided to the wireless device matches the PSK stored by the AP without directly transmitting the PSK.

[0004] However, there are many situations where having the same PSK used between wireless devices associated with different users' devices can be detrimental. For example, an apartment complex or hotel may have a shared wireless network. If multiple users all use the same PSK, one user's device may be able to eavesdrop on and decrypt another user's device's communications with the wireless network. Also, restricting access to the wireless network for users who have already received a PSK can be cumbersome, such as when a previously authorized user needs to be restricted from accessing the wireless network after checking out of the hotel, or in other situations. In such situations, an administrator may need to manually whitelist or blacklist individual MAC addresses that are allowed or barred from accessing the wireless network, respectively.

[0005] Various preparatory configurations for over-the-air network provisioning using a pre-shared key (PSK) may be presented. In some embodiments, a method for over-the-air network provisioning using a pre-shared key (PSK) may be presented. A plurality of wireless network access profiles may be created indicating a plurality of PSKs. An access point may receive a first value from a wireless device, the first value being based at least in part on the PSK. The access point may transmit the first value to a cloud-based provisioning system. The cloud-based provisioning system may create a plurality of values ​​based on the plurality of PSKs of the plurality of wireless network access profiles. The cloud-based provisioning system may identify a second value of the plurality of values ​​that matches the transmitted first value. A third value may be provided based on a PSK of a wireless network access profile of the plurality of wireless network access profiles used to generate the value. Network access may be provided to the wireless device based on the third value.

[0006] An embodiment of such a method may include one or more of the following features: The third value may be a PMK. Internet access may be granted to the wireless device for a period of time defined by the wireless network access profile. The first value may be a Message Integrity Code (MIC). The access point may send the ANonce and SNonce values ​​to a cloud-based provisioning system. The access point may send a MAC address of the wireless device to the cloud-based provisioning system. The PSK may not be sent between the wireless device and the access point at all. Based on the wireless network access profile, the cloud-based provisioning system may determine that the wireless device is a first wireless device to access the wireless network using the PSK. Based on a determination that the wireless device is a first wireless device to access the wireless network using the PSK, a service agreement may be provided to the wireless device for presentation. A unique identifier may be requested from the wireless device. The unique identifier may be received from the wireless device. The cloud-based provisioning system may compare the unique identifier to a stored unique identifier that is part of the network access profile, and the provision of Internet access is conditional on the unique identifier matching the stored unique identifier.

[0007] In some embodiments, a system is presented. The system may be a system for wireless network provisioning using a pre-shared key (PSK). The system may include an access point configured to provide internet access to the wireless device and receive a first value from the wireless device based at least in part on the PSK. The system may include a cloud-based provisioning system in communication with the access point. The cloud-based provisioning system may create a plurality of wireless network access profiles indicating the plurality of PSKs. The cloud-based provisioning system may receive the first value from the access point. The cloud-based provisioning system may create the plurality of values ​​based on the plurality of PSKs of the plurality of wireless network access profiles. The cloud-based provisioning system may identify a second value of the plurality of values ​​that matches the received first value. The cloud-based provisioning system may send a third value to the access point based on the PSK of the wireless network access profile used to generate the value of the plurality of wireless network access profiles.

[0008] An embodiment of such a system may include one or more of the following features: The access point may be configured to provide network access based on a third value. The third value may be a PMK. Internet access may be granted to the wireless device for a period of time defined by the wireless network access profile. The first value may be a Message Integrity Code (MIC). The access point may be further configured to transmit the ANonce value and the SNonce value to a cloud-based provisioning system, the SNonce value being received by the access point from the wireless device. The system may include the wireless device. The system may include a second access point that provides Internet access to the wireless device. The PSK may not be transmitted between the wireless device and the access point at all. The cloud-based provisioning system may be further configured to determine, based on the wireless network access profile, that the wireless device is a first wireless device accessing the wireless network in association with the wireless network access profile. The cloud-based provisioning system may be further configured to provide, via the access point, a service agreement to the wireless device for presentation based on a determination that the wireless device is a first wireless device accessing the wireless network in association with the wireless network access profile. The cloud-based provisioning system may be further configured to request a unique identifier from the wireless device via the access point. The cloud-based provisioning system can be further configured to receive a unique identifier from the wireless device via the access point, the cloud-based provisioning system can be further configured to compare the unique identifier to a stored unique identifier that is part of a wireless network access profile, and the provision of Internet access is conditioned on the unique identifier matching the stored unique identifier.

[0009] The nature and advantages of the various embodiments may be further understood by reference to the following drawings. In the accompanying drawings, similar components or features may have the same reference numerals. Also, various components of the same type may be distinguished by following the reference numeral with a dash and a second numeral that distinguishes the similar components. When only a first numeral is used in this specification, the description is applicable to any one of the similar components having the same first numeral, regardless of the second numeral. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 illustrates an embodiment of a wireless pre-shared key provisioning system. [Diagram 2] FIG. 1 illustrates another embodiment of a wireless pre-shared key provisioning system. [Diagram 3] FIG. 1 illustrates an embodiment of a method for over-the-air network provisioning using a pre-shared key. [Figure 4A] FIG. 1 illustrates another embodiment of a method for over-the-air network provisioning using a pre-shared key. [Figure 4B] FIG. 1 illustrates another embodiment of a method for over-the-air network provisioning using a pre-shared key. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Detailed herein are embodiments that enable centralized wireless network access based on a unique pre-shared key (PSK). Similar to a traditional Wi-Fi network, a user may select a wireless network based on the wireless network's SSID and may enter a PSK. In the embodiments detailed herein, the PSK may be unique to a user (or group of users) and may have been provided to the user separately (e.g., in a registration email, by text message, verbally, in writing, etc.). Data based at least in part on the PSK is passed by an access point (AP) over a network to a remote cloud-based provisioning system. The cloud-based provisioning system may determine whether a wireless network access profile is stored that is mapped to the received data based on the PSK. If so, data from that wireless network access profile is passed to the AP and used to grant network access to the wireless device that provided the data based on the PSK.

[0012] Further details regarding these and additional embodiments are detailed in conjunction with the drawings. Figure 1 illustrates one embodiment of a wireless pre-shared key provisioning system 100 ("system 100"). System 100 can include a cloud-based provisioning system 110, a Pairwise Master Key (PMK) database 112, a wireless network access profile database 114 ("profile database 114"), a registration system 120, the Internet 130, an access point 140, a wireless device 150, a wireless device 154, and an IoT device 156.

[0013] The registration system 120 may include one or more computer systems and may be operated or configurable by an administrator tasked with managing access to the wireless network hosted by the APs. When one or more of the user's devices are provided with access to the wireless network, the registration system 120 may be used to generate a unique PSK. In some embodiments, the user may be allowed to define their own PSK or a portion of the PSK (the registration system 120 defines the remaining portion). The unique PSK may need to be unique compared to other PSKs used by the cloud-based provisioning system 110. The PSK may be provided only to the user or a small group of related users (e.g., residents of a particular apartment complex, members of a particular travel organization). The registration system 120 may be used to send a message to the user indicating a unique PSK, the SSID of the wireless network, a unique identifier associated with the user (e.g., an email address, a loyalty identifier, a patient record number, a reservation number, a social security number, a user-created password, etc.), and / or other details and / or rules that may be relevant to the user, such as the dates and times the user is allowed to access the wireless network, the bandwidth allocated to the user, access and / or creation of a personal area network (PAN), access to a virtual local area network (VLAN), etc.

[0014] The registration system 120 can send this message to the user in many forms, such as an email to the user's email address on file, a text message to the user's mobile phone number, a letter mailed to the user (e.g., as part of a reservation or in a hotel welcome package), an agent or automated system could call (or otherwise speak to) the user (e.g., upon hotel check-in), a message could be presented on a display screen for the user to read, a code could be presented for the user to photograph with their device, NFC, Bluetooth, or other short-range data transfer, etc.

[0015] The enrollment system 120 may communicate directly with the cloud based provisioning system 110 or may communicate with the cloud based provisioning system 110 over a network such as the Internet 130. Alternatively, the enrollment system 120 and the cloud based provisioning system 110 may function as software implemented components of the same server system. In some embodiments, the enrollment system 120 may have direct access to the profile database 114.

[0016] In addition to providing the unique PSK to the user, a wireless network access profile may be created in profile database 114 based on data retrieved from registration system 120 to profile database 114. The wireless network access profile may include the unique PSK, the SSID of the wireless network, a unique identifier associated with the user, rules that may be associated with the user (e.g., the date and time that the wireless network access profile allows access to the wireless network, the amount of allocated bandwidth, access to the PAN, access to a VLAN), and data regarding use of the wireless network access profile (e.g., whether the unique PSK has been used previously for wireless network access).

[0017] The AP 140 may correspond to a device that creates a wireless network or functions as part of a wireless network through which one or more wireless devices may access the Internet and / or any other public or private network if properly authorized. In the illustrated embodiment, there is a single AP. The AP 140 may use the IEEE 802.11 suite of protocols to communicate with the wireless devices. Wi-Fi Protected Access (WPA), such as WPA1-3, may be used as a security protocol to protect network communications. It should be understood that the embodiments detailed herein may also be adapted and used with other communication and security protocols. For example, the embodiments detailed herein may be implemented in a cellular network, such as to allow full or limited access to 3G, 4G, 5G, or any other generation of cellular network systems.

[0018] Wireless devices, such as wireless device 150, wireless device 154, and IoT device 156, may generally be any form of computerized device capable of communicating with a wireless network. In some embodiments, one or more wired network devices may also be present. For example, a wired network device may be directly connected to AP 140 using a cable (e.g., an Ethernet cable). When a wireless device, such as wireless device 150, is granted access to a wireless network, the wireless device may also be able to communicate with some or all of the wired devices connected to the network.

[0019] For example IoT devices 156 (e.g., sensor devices, home automation devices), there may be no or limited user interface. The IoT device 156 may require or benefit from a network connection, but it may be difficult or impossible for a user to perform some form of network authentication for the IoT device 156. In some embodiments, an application may run on another device, such as the wireless device 150 or the wireless device 152, to configure the IoT device 156. Via such a device, a user may be able to provide credentials that the IoT device 156 can use to authenticate with the AP 140.

[0020] Wireless devices 150 and 154 may include smartphones, tablet computers, laptop computers, desktop computers, gaming devices, smart televisions, home assistant devices, smart doorbells, smart smoke detectors, smart carbon monoxide detectors, streaming video cameras, set-top boxes (STBs), etc. When a user wants a wireless device, such as wireless device 150 in this example, to communicate with a wireless network for the first time, the user can enter or select the correct SSID and enter a unique PSK provided by registration system 120 into wireless device 150.

[0021] For example, the wireless device 150 may perform an initial pairing procedure to determine whether the unique PSK will grant access to the wireless network established by the AP 140. A handshake procedure such as a WPA 4-way handshake may be performed. This preparation may include the AP 140 sending an AP announcement message (ANonce) to the wireless device 150. The wireless device 150 may construct a pairwise transient key (PTK) by combining (concatenating) various attributes such as the unique PMK, the ANonce, the SNonce, the AP MAC address, and the MAC address of the wireless device. This combined value may then be processed using a pseudorandom function to generate a final PTK. The PTK may be used to generate a MIC using an HMAC cryptographic function based on the EAPoL (Extensible Authentication Protocol over LAN) frame, the encryption type, and the PTK. The wireless device 150 may provide the station announcement message (SNonce) and a message integrity code (MIC, sometimes also referred to as a message authentication code MAC) to the AP 140.

[0022] At this point, because the AP 140 does not have a unique PSK to be used by the wireless device 150 to construct the PTK, the AP 140 transmits the SNonce and MIC received from the wireless device, along with any other necessary data, such as the EAPoL frame, the ANonce, the AP MAC address, and the wireless device's MAC address, to the cloud-based provisioning system 110 via the Internet 130 (or additionally or alternatively, via some other public and / or private network, or directly).

[0023] The cloud-based provisioning system 110 may include one or more computer server systems in communication with one or more databases stored using a non-transitory processor-readable medium. The PMK database 112 may be used to store PMKs created based on PSKs distributed by the registration system 120. A password-based key derivation function may be applied multiple times, such as 4096 times, to calculate the PMK based on the PSK. The derivation function may use the PSK as the password and the SSID of the wireless network as the salt. Pre-calculating the PMK based on the PSK and the associated SSID may reduce the amount of processing that needs to be done at the time of searching for a match, as described in more detail below. Alternatively, the PMK may be calculated on the fly using the PSK and SSID pairs stored in the PMK database 112.

[0024] The cloud-based provisioning system 110 may use the received data to calculate a PTK for every stored PMK from the PMK database 112 or for each PMK from the PMK database 112 until a match between the calculated MIC and the received MIC is found. The PTK is calculated using the same pseudorandom function used by the AP to calculate the PTK. A MIC may then be calculated based on the PTK. A match may be identified if the MIC calculated for the PTK calculated by the cloud-based provisioning system (which was also calculated based on the PMK retrieved from the PMK database 112) matches the MIC received from the AP 140. If the calculated MIC matches the MIC received from the AP 140, the cloud-based provisioning system 110 has determined the correct PMK from the PMK database 112 to use to create the PTK. If no MIC match is found, the PSK entered by the user into the wireless device 150 is not valid and access to the wireless network established by the AP 140 is not provided.

[0025] Assuming there is a MIC match, then a lookup can be performed in the profile database 114 using the PSK from the PMK database 112. The profile database 114 stores wireless network access profiles. A particular wireless network access profile can be retrieved from the profile database 114 for the PSK. Whether access to the wireless network is granted by the AP 140 depends on the information present in the particular wireless network access profile mapped to that PSK. For example, the wireless network access profile can include an allowed time range for access, an allowed date range for access, whitelisted and / or blacklisted MAC addresses, bandwidth amount, total amount of uplink and / or downlink data allowed within a given period (e.g., one month), allowed or not allowed usage (e.g., no video streaming), whether further authentication is required, level of access, which networks access is allowed, etc.

[0026] In some embodiments, data from the wireless network access profile is transmitted over the Internet 130 (or some other network) to the AP 140 and / or other components of the network. In such an embodiment, the AP 140 may analyze the contents of the wireless network access profile to determine whether the wireless device 150 should be provided with network access. In other embodiments, the determination of whether access is granted is made by the cloud-based provisioning system 110. In either embodiment, when the wireless device 150 is provided with any amount of access, at least the PMK and / or the PSK used to create the PMK whose calculated MIC resulted in a match with the received MIC may be transmitted to the AP 140. The advantage of transmitting the PMK is that no encryption algorithms need to be applied by the AP. The AP 140 may use the received PSK to complete the handshake procedure with the wireless device 150 and begin communication. As a result of this preparation, the PSK is never transmitted between the wireless device 150 and the AP 140, either in encrypted or unencrypted form.

[0027] In some embodiments, the data stored as part of the wireless network access profile in the profile database 114 may be dynamic. For example, when a PSK associated with a wireless network access profile is used by a wireless device to initially connect to any AP, one or more additional steps may need to be taken. The data in the wireless network access profile may indicate whether the PSK has been used previously to connect to an AP for which the cloud-based provisioning system 110 manages access. For example, after communication between the wireless device 150 and the AP 140 is established using the PSK, but before the AP 140 grants network access (e.g., access to the Internet 130), a service agreement may be sent to the wireless device 150 for presentation to the user of the wireless device 150 and approval by the user. Once the service agreement has been agreed to and an indication to that effect is received by the AP 140, the AP 140 may send an indication to the cloud-based provisioning system 110 to change the wireless network access profile mapped to the PSK to indicate that the service agreement has been agreed to and does not need to be presented again. In other embodiments, the service agreement may be provided at a different step in the provisioning process. For example, in some embodiments, a user may be required to first agree to terms of service in order to receive a PSK and / or SSID.

[0028] In some embodiments, in response to a wireless device being successfully granted access to the wireless network, the MAC address (or some other form of identifier of the wireless device) may be stored and mapped to the correct PMK. This mapping may be stored in the AP through which the connection was established, another component of the wireless network, or may be stored by the cloud-based provisioning system 110. If the device attempts to reconnect to the wireless network in the future, rather than repeating the entire provisioning process and searching through all stored PMKs, a matching MAC address may be identified and its associated PMK may first be checked for a match. A full search of stored PMKs may only be performed if there is no MAC address match or if the PMK associated with the matching MAC address is incorrect. Such a preparatory configuration may significantly reduce the amount of processing that needs to be done to identify a PMK / MIC match.

[0029] In some embodiments, an administrator operating the registration system 120 may desire additional security beyond providing a valid PSK with the wireless device. As previously described, additional information such as the user's unique identifier (e.g., email address, password) may be stored in the profile database 114 as part of the wireless network access profile. After the PSK is validated, the AP may request that the wireless device provide additional information. For example, the AP 140 may request an email address, loyalty identifier / number, or some other form of unique identifier from the user wireless device 150. The user may then provide the email address (or other form of unique identifier) ​​provided to the registration system 120 during the registration process. The AP 140 or cloud-based provisioning system 110 may verify whether the provided unique identifier matches a stored unique identifier in the wireless network access profile. If there is a match, network access may be provided. If there is no match, network access may not be provided and / or the wireless network access profile may be disabled. Depending on the desires of the administrator of the registration system 120, such additional security steps may be performed only once for a given wireless network access profile, each time a wireless device connects to a new AP, and / or for each new wireless device that uses its PSK to connect to an AP whose access is controlled by the cloud-based provisioning system 110.

[0030] In the embodiment shown in FIG. 1, PMK database 112 and profile database 114 are shown as separate databases. In some embodiments, there may be a single database that stores PMKs and wireless network access profiles. Alternatively, the stored data may be stored across more databases or in other forms of data storage mechanisms (e.g., tables). Also, while FIGS. 1 and 2 show cloud-based provisioning system 110 as being remote from APs 140 and 142, in some embodiments, cloud-based provisioning system 110 may be co-located with one or more APs and may communicate without using the Internet. For example, a wired local area network connection may be used.

[0031] In some embodiments, rather than a PSK being used to access a single AP, the PSK may be used to access multiple APs, which may be co-located or geographically distributed. Figure 2 illustrates another embodiment of a wireless pre-shared key provisioning system 200 ("system 200"). System 200 may function similarly to system 100 of Figure 1. However, system 200 may include multiple APs, such as AP 140 and AP 142.

[0032] APs 140 and 142 may be geographically distributed or substantially co-located. Co-located may refer to APs being located in the same building, facility, campus, etc. Distributed may refer to different buildings, hotels, facilities, etc. For example, an enterprise may want to provide users with one PSK access to APs across its offices distributed across a city, state, country, continent, or even the world.

[0033] If the APs are co-located, the wireless device may switch APs with which it communicates as the wireless device moves a relatively short distance, such as within a building, but access may remain permitted because access is managed for both APs by cloud-based provisioning system 110. Similarly, even if APs 140 and 142 are located in geographically dispersed locations, network access can be centrally managed by cloud-based provisioning system 110. For example, an entity such as a property rental company can centrally manage guest access across many properties via cloud-based provisioning system 110.

[0034] In some embodiments, AP 140 and AP 142 may correspond to different base stations of a cellular network. For example, in a 5G network, gNodeBs can be used instead of AP 140 and AP 142. Full or partial access to the cellular network can be granted in a similar manner to a wireless local area network.

[0035] If the initial registration process is performed with a first AP, such as when the wireless device 152 previously communicated with the AP 140, the data stored in the profile database 114 may indicate that the wireless device is already authorized for access. Thus, when the wireless device 152 accesses the AP 142, the back-end process for the AP 142 to obtain the correct PSK may need to be repeated, but the terms of service (or some other one-time event) will not need to be presented or repeated again by the wireless device 152 because the wireless network access profile stored in the profile database 114 indicates that the event has already occurred. Similarly, if the user (or related use) reuses the PSK on another device, the terms of service may not need to be presented and agreed to because the same wireless network access profile is used.

[0036] Various methods can be performed using the described systems of Figures 1 and 2. Figure 3 illustrates one embodiment of a method 300 for over-the-air network provisioning using a pre-shared key. Method 300 can be performed using system 100, system 200, or any other form of system that allows over-the-air network provisioning using a PSK.

[0037] At block 305, a wireless network access profile may be created using the unique PSK. The unique PSK may be generated randomly and may be verified to not match any other PSK associated with the wireless network access profile. The unique PSK may be created using the cloud-based provisioning system 110, the registration system 120, or some other computerized component that has access to the profile database 114. The unique PSK may be created and stored in the profile database of the cloud-based provisioning system. The unique PSK may be provided to the user by any of the configurations disclosed above, possibly along with other relevant information (e.g., network SSID) so that the user can enter the unique PSK to connect to the wireless network.

[0038] In some embodiments, a user may be able to create their own PSK and provide it to the cloud-based provisioning system for storage in the profile database. For example, a user may access the cloud-based provisioning system via the web and may be given the opportunity to enter a desired PSK. In one such embodiment, the user-created PSK may be checked against other PSKs in the profile database to ensure there is no match with other PSKs assigned to other users. If there is a match, the user may be required to create a different PSK, or both the user and other users already mapped to the matching PSK may be required to each create a new PSK before being allowed access to the network. In some embodiments, the cloud-based provisioning system may define a portion of the PSK, or the user may define a portion of the PSK. Defining a portion of the PSK by the cloud-based provisioning system may prevent matches with other PSKs in the profile database. For example, the cloud-based provisioning system may specify a unique front portion of the PSK (ensuring there is no match with other PSKs in the profile database) and the user may define a back portion of the PSK.

[0039] At block 307, the unique PSK, possibly along with other information, may be provided to the wireless device that will be accessing the wireless network. The user may access a network configuration interface and select or enter the correct SSID. The user may then be prompted to enter the PSK. If the wireless device is an IoT device without a user interface that allows direct entry of data, the user may run an application on another computerized device or take some other action to enter data on behalf of the IoT device. This other computerized device may forward the SSID and PSK to the IoT device for use in connecting with the AP.

[0040] At block 310, the wireless device may attempt to connect to an AP of the wireless network. The wireless device uses the unique PSK, possibly along with other data (e.g., its MAC address), to generate a value that is sent to the AP. In some embodiments, the PSK is concatenated with the SNonce, ANonce, AP MAC address, and wireless device MAC address to create a single value. A pseudorandom function may then be applied to generate a PTK. The PTK may then be processed to generate a MIC value. The MIC, SNonce, and / or wireless device MAC address may be sent to the AP at block 310, such as a portion of the EAPoL frame that may also indicate the type of encryption. Upon receiving these values, the AP may forward the MIC, SNonce, EAPoL frame, and / or other data for evaluation to the cloud-based provisioning system at block 315.

[0041] At block 320, the cloud-based provisioning system may calculate a PTK value using the received data and the stored PMK. The calculated PTK may then be used to calculate a MIC value. The calculated MIC value may be evaluated for a match with the MIC value received at block 315, at least until a match is identified. If no match is identified, an error or rejection message is sent back to the AP indicating that no valid PMK was found that matches the MIC received at block 315.

[0042] In a conventional provisioning configuration, if the AP stores a single valid PSK, it may be relatively easy to calculate a single value (e.g., a MIC). However, because the PSK used by the wireless device in block 310 is unknown (because the PSK is not transmitted by the wireless device to the AP), a value (e.g., a MIC) needs to be calculated based on each stored stored PSK of the cloud-based provisioning system, at least until a match is identified. To save processing time, each stored PSK may have an associated PMK that is pre-calculated and stored. For example, each PMK may be pre-calculated using a password-based key derivation function that uses the PSK as a password and the SSID of the wireless network as a salt. In some embodiments, this function may be iterated 4096 times. For each PMK, a PTK may be calculated using information received from the AP, such as the SNonce. A match may be identified in block 325. A match is determined to exist if the MIC calculated based on the stored PSK (or pre-calculated PMK) matches the MIC received from the AP. In other embodiments, values ​​other than the MIC may be used to determine whether a match exists.

[0043] The stored PSK used to generate the PMK and the MIC that matches the MIC received from the AP are provided to the AP in block 330. Alternatively or additionally, a PMK calculated by a cloud-based provisioning system may be provided. The PSK / SSID (or pre-calculated PMK) can then be used by the AP to complete the handshake process with the wireless device to provide network access. The data stored in the wireless network access profile mapped to the PSK may be used to restrict network access or impose additional conditions, such as, for example, the need to agree to terms of service, the amount of bandwidth provided, the total amount of data allowed to be uploaded or downloaded, temporary restrictions, and / or whether additional layers of security such as a match of a user's unique identifier must occur before network access is granted via the AP and / or other devices used to set up the connection and / or grant access.

[0044] At block 335, the provisioning process can be completed and the wireless device is provided with network access based at least in part on the unique PSK. For example, the network access can be used to access the Internet. In other embodiments, the access can be used to grant access to another network, such as an intranet, a corporate LAN, etc. In some embodiments, the provisioning process can be used to restrict access to the network. For example, a particular device or type of device (mapped to a particular PSK) may be limited in the level of access granted to the wireless network. For example, a device may be given intranet access but not be allowed to access the Internet via that intranet.

[0045] 4A and 4B show an embodiment of a method 400 of over-the-air network provisioning using a pre-shared key. The method 400 may correspond to a more detailed embodiment of the method 300. The method 400 may be performed using the system 100, the system 200, or some other form of system that allows over-the-air network provisioning using a PSK. In the method 400, the wireless device may be, for example, the wireless device 150, 152, 154, or 156 of FIG. 1 and FIG. 2. The AP may be the AP 140 or 142 of FIG. 1 and FIG. 2. The provisioning system may include a cloud-based provisioning system 110, a PMK database 112, a profile database 114, and a registration system 120.

[0046] At block 405, a unique PSK may be generated. The PSK may be generated because a new user or group of users is identified to receive network access. The unique PSK may be randomly generated and verified to not match any other PSK associated with a wireless network access profile. The unique PSK may be created using the cloud-based provisioning system 110, the registration system 120, or any other computerized component that has access to the profile database 114. At block 410, a wireless network access profile may be created using the PSK. The unique PSK may be created and stored in the profile database of the cloud-based provisioning system. The profile created at block 410 may store various information related to the PSK, such as the SSID of the associated network, information about the user, whether the terms of service have been accepted by the user, an identifier for the user, etc. At block 415, the PSK, possibly along with other relevant information (e.g., the network SSID), may be provided to the user via any of the configurations disclosed above so that the user can enter the unique PSK to connect to the wireless network.

[0047] At block 420, the PSK, possibly along with other information, may be provided to a wireless device that will access the wireless network. A user may access a network configuration interface and select or enter the correct SSID. The user may then be prompted to enter the PSK. If the wireless device is an IoT device that does not have a user interface that allows direct entry of data, the user may run an application on another computerized device that may transfer the SSID and PSK to the IoT device for use in connecting with the AP.

[0048] At block 425, the AP may broadcast data to announce its presence to the surroundings. The broadcast data may include the SSID, ANonce, and / or MAC address. In some embodiments, the SSID is hidden and needs to be known. At block 430, a concatenated string data may be created using the PSK, SNonce, ANonce, AP MAC address, and wireless device MAC address. At block 430, a PTK may be generated by the wireless device using a pseudorandom function. The PTK may then be used to calculate a MIC at block 435. At block 440, the MIC, SNonce, station MAC address, and / or EAPoL frame may be sent to the AP. It should be noted that the PSK and PMK are not sent to the AP.

[0049] Upon receiving the MIC and SNonce (and / or PTK), the AP may determine in block 450 that communication with a provisioning system is required to determine whether access should be granted to the wireless device. In some embodiments, the AP may be capable of processing multiple PSKs. A first PSK may be stored locally and may authenticate with the wireless device without communicating with the provisioning system. One or more remotely stored PSKs may require the PSK to be retrieved from the provisioning system. If the MIC received in block 445 does not match the MIC calculated locally by the AP based on the received information (e.g., PTK, SNonce, MAC address, etc.) and the locally stored PSK, a decision may be made to pass the AP MAC address, the device MAC address, the ANonce packet provided by the access point to the network-enabled device, the SNonce packet provided by the network-enabled device to the access point, and the entire EAPoL key frame to the provisioning system.

[0050] Method 400 continues in FIG. 4B. At block 455, the AP may transmit the AP MAC address, the network-enabled device MAC address, the ANonce packet provided by the AP to the network-enabled device, the SNonce packet provided by the network-enabled device to the AP, and / or the entire EAPoL Key frame to the provisioning system. The transmission may occur over the Internet or some other network. In other embodiments, the provisioning system may be local to the AP. At block 460, the AP MAC address, the network-enabled device MAC address, the ANonce packet provided by the AP to the network-enabled device, the SNonce packet provided by the network-enabled device to the AP, and / or the entire EAPoL Key frame may be received by the provisioning system. In some embodiments, additional data may be transmitted, such as the SNonce, the AP MAC address, and / or the wireless device MAC address.

[0051] At blocks 465 through 480, the provisioning system attempts to calculate a MIC based on the received information using the PSK stored by the profile database. At block 465, the provisioning system may use the received information along with other data obtained from the AP, such as the SNonce, the AP MAC address, and the wireless device MAC address, to calculate a first PTK value. The PTK value may be determined by creating a concatenated string of values, as constructed by the wireless device, and applying a pseudorandom function to obtain the PTK. At block 470, a MIC may then be calculated for the PTK. At block 475, it is determined whether the calculated MIC matches the MIC received at block 460. If there is a match, method 400 may proceed to block 480. If there is not a match, method 400 may return to block 465 and perform a calculation for the next PSK stored in the profile database. If no match is identified after calculating the MIC for all PMKs in the database, an error message may be sent by the provisioning system to the AP and network access may not be granted to the wireless device.

[0052] At block 482, the MAC address of the wireless device (or some other form of identifier for the wireless device) may be stored and mapped to the determined correct PMK, which can be used when the method is performed in the future to avoid having to re-calculate the MIC for many PMKs to identify a match. Rather, if the device with this MAC address again attempts to access the wireless network, the PMK mapped to the MAC address may be the first PMK used to calculate a MIC value to determine whether a match exists.

[0053] If a match between the stored MIC and the calculated MIC is identified at block 480, the PMK that caused the match is sent to the AP. The AP may receive the PMK at block 485. Using this PMK, the AP may establish an encrypted communications session with the wireless device and may grant network (Internet) access to the wireless device at block 490. As previously mentioned, in some embodiments, additional data may be collected from the wireless device before access is granted based on data stored in a profile with a matching PMK. For example, the user may be required to provide an identifier (e.g., username, email address, loyalty number) that matches a stored identifier in the profile and / or the user may be required to accept a set of terms of service provided to the wireless device (or provided to an associated wireless device). At block 495, the wireless device obtains network access via the AP. At block 499, the profile from which the PMK was obtained may be updated to include data about the wireless device that successfully connected (e.g., that the wireless device agreed to the terms of service, the MAC address of the wireless device, etc.).

[0054] The methods, systems, and devices described above are examples. Various configurations may omit, substitute, or add various procedures or components, as appropriate. For example, in alternative configurations, the methods may be performed in an order different from that described, and / or various steps may be added, omitted, and / or combined. Also, features described with respect to a particular configuration may be combined with various other configurations. Different aspects and elements of the configurations may be combined in a similar manner. Also, technology evolves, and thus many of the elements are examples and do not limit the scope of the disclosure or claims.

[0055] Specific details are provided in the description so that example configurations (including implementations) can be fully understood. However, the configurations can be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures and techniques are shown without unnecessary detail so as not to obscure the configurations. This description provides only example configurations and does not limit the scope, applicability or configurations of the claims. On the contrary, the description of the configurations above provides those skilled in the art with an enabling description for implementing the described technology. Various changes can be made in the function and arrangement of elements without departing from the spirit or scope of the present disclosure.

[0056] Also, the configurations may be described as processes that are illustrated as flow charts or block diagrams. Although each may describe operations as a sequential process, many of the operations may occur in parallel or simultaneously. Additionally, the order of operations may be rearranged. A process may have additional steps not included in the figures. Also, method embodiments may be implemented in hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. If implemented in software, firmware, middleware, or microcode, the program code or code segments to perform the necessary tasks may be stored in a non-transitory computer-readable medium, such as a storage medium. A processor may perform the tasks described.

[0057] Although several example configurations have been described, various modifications, alternative configurations, and equivalents may be used without departing from the spirit of the disclosure. For example, the above elements may be components of a larger system, in which case other rules may take precedence over or modify the application of the invention in other circumstances. Also, some steps may take place before, during, or after the above elements are considered.

Claims

1. 1. A method for over-the-air network provisioning using a pre-shared key (PSK), comprising: creating, in a cloud based provisioning system, a plurality of wireless network access profiles indicating a plurality of PSKs; receiving, by an access point, a first value from a wireless device, the first value being based at least in part on the PSK; transmitting, by the access point, the first value to the cloud based provisioning system; generating, by the cloud based provisioning system, a plurality of values ​​based on the plurality of PSKs for the plurality of wireless network access profiles; identifying a second value of the plurality of values ​​that matches the first value transmitted by the cloud based provisioning system; and providing, by the cloud based provisioning system, to the access point a third value based on the PSK of a wireless network access profile of the plurality of wireless network access profiles that was used to generate the second value that matches the transmitted first value; providing, by the access point, network access to the wireless device based on the third value; determining, by the cloud based provisioning system, based on the wireless network access profile, that the wireless device is a first wireless device to access a wireless network using the PSK; providing service terms to the wireless device for presentation based on a determination that the wireless device is a first wireless device accessing the wireless network using the PSK.

2. 2. The method of claim 1, wherein the third value is a Pairwise Master Key (PMK).

3. 3. The method of claim 2, wherein the wireless device is granted Internet access for a period of time defined by the wireless network access profile.

4. 2. The method of claim 1, wherein the first value is a Message Integrity Code (MIC).

5. The method of claim 1 , further comprising transmitting, by the access point, ANonce and SNonce values ​​to the cloud-based provisioning system.

6. The method of claim 5 further comprising transmitting, by the access point, a MAC address of the wireless device to the cloud-based provisioning system.

7. The method of claim 1 , wherein the PSK is never transmitted between the wireless device and the access point.

8. The method of claim 7, further comprising: requesting, by the access point, a unique identifier from the wireless device; receiving, by the access point, the unique identifier from the wireless device; 2. The method of claim 1, further comprising: comparing, by the cloud based provisioning system, the unique identifier with a stored unique identifier that is part of the wireless network access profile, and wherein providing Internet access is conditional on the unique identifier matching the stored unique identifier.

9. 1. A system for over-the-air network provisioning using a pre-shared key (PSK), comprising: an access point configured to provide internet access to the wireless device and to receive a first value based at least in part on the PSK from the wireless device; a cloud-based provisioning system in communication with the access point; The cloud-based provisioning system includes: creating a plurality of wireless network access profiles indicating a plurality of PSKs, where each of the plurality of wireless network access profiles indicates: 1) a PSK; 2) a bandwidth limit; and 3) a time period during which network access is permitted; receiving the first value from the access point; generating a plurality of values ​​based on the plurality of PSKs for the plurality of wireless network access profiles; identifying a second value of the plurality of values ​​that matches the received first value; a third value based on the PSK of a wireless network access profile used to generate the second value of the plurality of wireless network access profiles, said third value being transmitted to said access point;

10. 10. The system for over-the-air network provisioning using PSK of claim 9, wherein the access point is configured to provide network access based on the third value.

11. 10. The system for over-the-air network provisioning using PSK as recited in claim 9, wherein the third value is a Pairwise Master Key (PMK).

12. 10. The system for over-the-air network provisioning using PSK of claim 9, wherein the wireless device is granted Internet access for a period of time defined by the wireless network access profile.

13. 10. The system for over-the-air network provisioning using PSK as recited in claim 9, wherein said first value is a Message Integrity Code (MIC).

14. 10. The system for over-the-air network provisioning using PSK as recited in claim 9, wherein the access point is further configured to transmit an ANonce value and an SNonce value to the cloud-based provisioning system, the SNonce value being received by the access point from the wireless device.

15. The system for over-the-air network provisioning using PSK of claim 14 further comprising the wireless device.

16. 15. The system for over-the-air network provisioning using PSK as recited in claim 14, further comprising a second access point providing internet access to the wireless device.

17. 10. The system for over-the-air network provisioning using PSK of claim 9, wherein the PSK is never transmitted between the wireless device and the access point.

18. The cloud-based provisioning system includes: determining, based on the wireless network access profile, that the wireless device is a first wireless device to access a wireless network associated with the wireless network access profile; 10. The system for over-the-air network provisioning using a PSK as recited in claim 9, further configured to provide, via the access point, service terms to the wireless device for presentation based on a determination that the wireless device is a first wireless device accessing the wireless network in association with the wireless network access profile.

19. The cloud-based provisioning system includes: requesting a unique identifier from the wireless device via the access point; receiving the unique identifier from the wireless device via the access point; 10. The system for wireless network provisioning using a PSK as recited in claim 9, further configured to compare the unique identifier to a stored unique identifier that is part of the wireless network access profile, and wherein providing Internet access is conditional on the unique identifier matching the stored unique identifier.

Images