Method and apparatus for establishing a wireless secure link while maintaining privacy against tracking - Patents.com

Abstract

To provide a method and an apparatus for establishing a wireless secure link to alleviate privacy issues.SOLUTION: The present application relates to a device and a method for establishing a secure wireless link for communication between a first apparatus and a second apparatus via a wireless physical channel. A pairing protocol transmits identification information, which is data suitable for identifying an apparatus that transmits the identification information or a user thereof, over a wireless channel by the first apparatus, and uses private key information associated with public key information to extract the identification information. The apparatus uses a secret uniquely associated with the identification information to obtain a session key and uses the session key to establish a secure wireless link.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a method and an apparatus for establishing a wireless secure link over a wireless physical channel.

[0002] The present invention relates to the field of security for wireless data communications, and more particularly to an apparatus and method for establishing a wireless secure link over a wireless physical channel. [Background technology]

[0003] Given the growing number of connected devices, privacy and protection against tracking by third parties is of increasing concern.

[0004] A MAC address is a device address used at the link layer of the Open Systems Interconnection model (OSI). In particular, a wired or wireless device uses a MAC address to identify itself as the sender when sending a message on a link. Although MAC addresses have a clear technical purpose in the OSI model, namely to identify a specific device, this can lead to privacy issues as devices use a constant MAC address to identify themselves, since in most cases a fixed MAC address is given to every device during manufacturing.

[0005] A third party can use a receiver to receive the link layer messages, collect the sender MAC address, and track the device. Devices such as mobile phones are usually owned by a particular person, meaning that the person can also be tracked. For example, a store can keep track of its customers by collecting the sender MAC addresses of WiFi and / or Bluetooth transmissions. Many people use Bluetooth headsets wirelessly connected to their mobile phones to listen to music and make phone calls. Once inside the store, the store can detect their presence and even their location. Thus, a store that can track MAC addresses in combination with location identification can use this to track user interest in various products. Wi-Fi devices that are not associated with an AP may continue to send Wi-Fi messages (such as so-called probe requests) that contain their MAC address. These are used by Wi-Fi devices to query nearby access points (APs) about properties for connection. Thus, Wi-Fi devices that are not connected to any AP may also be tracked.

[0006] In response to the above, there is a trend towards using random MAC addresses for the sender address to overcome this privacy issue. Devices that use random addresses often change them after a series of requests and responses has been completed.

[0007] Many Wi-Fi deployments use WPA2-Personal for security (see [WPA2]). WPA2-Personal uses a passphrase or pre-shared key (PSK) that is common to the AP and all devices allowed to connect with it. Therefore, WPA2-Personal is also known as WPA-PSK. However, WPA3 supports a new method called Simultaneous Authentication of Equals (SAE) that uses a password to securely connect devices to the AP (see [WPA3] or Section 12.4 of [802.11]). With SAE, every device or group of devices can be given its own password. If a Wi-Fi device wants to associate with an AP using SAE, and if the Wi-Fi device uses its static MAC address, the AP can determine from the sender MAC address the SAE password that the device uses to authenticate itself. However, there is a problem if the device uses a random MAC address. Here, since the AP does not know the SAE password that the device uses to authenticate itself, the AP cannot execute the SAE protocol successfully.

[0008] The same privacy issues exist for many other protocols. For example, when a device is configured via the Device Provisioning Protocol (DPP; see [DPP]), it receives a configuration object from the DPP configurator. This configuration object contains a so-called connector. The connector is signed by the DPP configurator. The connector contains a public key belonging to the device. When a device wants to connect to an AP using DPP, it sends its connector to the AP in a so-called DPP Peer Discovery Request frame. This frame is not encrypted. The use of a connector to connect to an AP therefore allows the device to be tracked. Summary of the Invention [Problem to be solved by the invention]

[0009] It is an object of the present invention to provide a method and an apparatus for establishing a wireless secure link, which alleviates at least one of the above mentioned privacy problems. To this end an apparatus and a method are provided as defined in the accompanying claims. According to one aspect of the invention, an encryption method is provided as defined in claim 1. According to a further aspect of the invention, an apparatus is provided as defined in the independent apparatus claim. [Means for solving the problem]

[0010] In the case of MAC address randomization, it is simply believed that using a password ID to identify a device is sufficient for the pairing protocol to succeed, but sending the password ID without encryption negates the privacy that the random MAC address provides. Since a specific password ID is only used when associating with an AP of a network for which this password is valid, it is difficult to track a device from location to location, but not to a specific location. A device can be tracked by anyone whether a specific device is associated with a specific network, and can be tracked whether a specific device is in its vicinity. The inventors realized that this problem arises from the fact that a device must identify itself in order to connect to another device. The identification information required to establish a secure link can be used for tracking by a third party. The inventors further realized that a simple encryption of the identification with the target device's public key does not solve the problem, since the encrypted identification information is unique and traceable. To solve this problem, it is necessary to break the one-to-one mapping between the identification information and the corresponding data that is sent unencrypted. This result can be achieved by using additional random information in the encryption process, such that multiple sets of encrypted data correspond to the same identification information. The receiving device performs the decryption, extracts the identification information, and ignores the random information.

[0011] Further preferred embodiments of the device and method according to the invention are given in the accompanying dependent claims, the disclosure of which is incorporated herein by reference.

[0012] According to a further aspect of the invention, the identifying information is an identifier for a password or passphrase and the secret is a password or passphrase, for example a password used for an SAE algorithm.

[0013] According to a further aspect of the invention, the pairing protocol is based on a Device Provisioning Protocol, the identification information is part of the connector defined in the Device Provisioning Protocol, and the first device is adapted to send a modified connector that does not include the identification part in an unencrypted form to enable the second device to restore the original connector and thus verify the integrity of the connector. The first device may be adapted to receive and extract a public key of the target device information from the DPP configurator.

[0014] According to a further aspect of the invention, the 802.11 four-way handshake protocol is used to derive the keys that underlie the security of the secure channel, and the secret is a passphrase or PSK for use in the four-way handshake.

[0015] These and other aspects of the invention will become more apparent and will be explained with reference to the embodiments described by way of example in the following description and the accompanying drawings, in which: [Brief description of the drawings]

[0016] [Figure 1] 1 shows a system in which the invention can be implemented. The drawings are schematic and are not drawn to scale. In the drawings, elements corresponding to elements already described may have the same reference numbers. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] FIG. 1 shows a system comprising a first device (110), a second device (120) and a third device (130). Each of these devices has a communication module (111, 121, 131) including a suitable transmitter / receiver for communication over one or more channels, such as Wi-Fi, Bluetooth or a wired network. Each transmitter / receiver may have at least one antenna (112, 122, 132) acting as an input / output and a corresponding module controller (113, 123, 133). Each device operates under the control of a processor (114, 124, 134). The wireless module controller and the processor may be integrated in a single system on a chip. Each device may have a user interface (115, 125, 135) having at least one user control element. For example, the user control element may include a touch screen, various buttons, a mouse or a touch pad, etc. The buttons can be traditional physical buttons, touch sensors or virtual buttons, for example on a touch screen or icons activated via a mouse. The user interface may be a remote user interface.

[0018] In practice, the first device may correspond to a portable device such as a mobile phone, laptop or tablet that has an end user. The second device may correspond to an access point such as a router. The user of the first device is interested in connecting to the second device (the access point) in order to access one or more resources provided through the second device. The third device is not actually part of the present invention, but corresponds to a so-called eavesdropper, i.e. a device used by a malicious third party to obtain information about the first device or its user.

[0019] Specific embodiments of the present invention are described below with reference to the general system described above.

[0020] In a first exemplary embodiment of the present invention, the communication channel is Wi-Fi, the second device corresponds to an access point (AP), and the first device attempts to connect to the AP via the SAE protocol (see clause 12.4 of [WPA3] or [802.11]). In each device, the protocol according to the present invention is executed in the module controller (113, 123), in the processor (114, 124), or by both cooperating in executing the protocol. To protect its privacy, the user of the first device has configured the first device to operate via MAC address randomization, for example by using the user interface of the second device. Since SAE allows multiple passwords (which may be specifically configured for each device allowed to connect by the AP administrator) and the SAE protocol is relatively complex such that completion of the protocol may require several seconds for the passwords to be tested, it is not feasible in practice to test all passwords configured by the AP.

[0021] To overcome this problem, it is proposed that the device includes a password ID in the request to associate with the AP. The so-called password ID is known as the device ID or user ID. The purpose of this password ID is that the AP can select the correct SAE password to run the SAE protocol with this device, and therefore successfully run the SAE protocol for device authentication. WPA2-Personal authentication tests only the use of a single passphrase or pre-shared key (PSK) for all devices, but nothing in the protocol prohibits the use of a single passphrase or PSK for a group of devices or one per device. If the devices use random MAC addresses, a passphrase or PSK identifier is also required if the AP uses a separate passphrase or PSK for a specific device. There are many ways in WPA2-Enterprise to authenticate devices to associate with an AP (see [WPA2-E]). One of them is EAP-TLS (see [RFC 5216]), where the device sends a certificate to be authenticated. The certificate contains individual information and allows tracking of the devices that authenticate themselves using that certificate.

[0022] As mentioned above, the connecting device uses a so-called password ID, which is a unique identifier of the password used for the SAE protocol. However, since the password ID may be used by a third device to track the connecting device, according to this embodiment, the privacy of the password ID is protected by having the first device encrypt the password ID of the password used for SAE, the passphrase used for WPA-PSK or the PSK used for WPA-PSK, and some random data (e.g., a nonce, a random MAC address or other suitable information such as the last few digits of a timestamp) using the public key of the AP. The public key to be used can be configured in the wireless device together with the SAE password, passphrase or PSK, for example, using DPP to configure the wireless device. If DPP is used, the password ID itself can also be configured. The AP can also list the public key to be used to encrypt the SAE password ID in any or all different transmissions indicating that it supports SAE, such as beacons, DMG beacons, probe responses, announcements, information response frames, etc.

[0023] Encrypting the SAE password identifier directly with the AP's public key avoids having to perform a Diffie-Hellman exchange, for example as part of the TLS setup. Since the amount of bits in the SAE password identifier is much smaller than the amount of bits in the ECC coordinates, it can be easily encrypted, for example using method 6.1 of [SEC1702].

[0024] Although the above embodiments of the present invention have been described in terms of password IDs, to improve privacy, many similar things should be treated as password IDs, i.e. MAC addresses, user IDs, device IDs, public keys, since they are all suitable for use by malicious third parties to identify the user's device.

[0025] In particular, one option is to skip the password ID and send the encrypted MAC address itself as described above for the password ID. However, it should be noted that such a solution, while not too complicated at first glance, becomes complicated with respect to backward compatibility. The MAC address is 40 bits, and when encrypted, it becomes a number with more bits. For example, when performing ECC encryption, two elliptical points are generated. Each point must be represented with at least 256 bits when using the ECC curve P-256. Therefore, the size of the encrypted information must be larger than the MAC address, which is why a modification of the message in which the currently encrypted MAC address of the wireless device is sent to the AP is necessary. It should be noted that a truncated encrypted value cannot be decrypted anymore. The truncated encrypted value can only be used in a comparison to see if the encrypted values ​​are different.

[0026] In a second exemplary embodiment of the invention, the communication channel is Wi-Fi, the second device corresponds to an Access Point (AP) and the first device corresponds to a device that has become a DPP Enrollee since it has been configured by the Device Configurator according to the DPP protocol (see [DPP]) to associate with the second device. In each device, the protocol according to the invention is executed in the module controller (113, 123) or in the processor (114, 124) or by both cooperating in the execution of the protocol. If the device has been configured by DPP (see [DPP]), it has received a configuration object from the DPP configurator. This configuration object contains a so-called connector. The connector is signed by the DPP configurator. The connector contains a public key belonging to the device. If the device wants to connect to an AP using DPP, it sends the connector to the AP in a so-called DPP Peer Discovery Request frame. This frame is not encrypted. The use of the connector to connect to an AP therefore allows the device to be tracked to a similar extent as is possible if the device uses SAE by password ID. Using the present invention, instead of the first device sending the DPP Connector received during DPP setup, the first device encrypts its public key in the DPP Connector, replaces the unencrypted public key in the DPP Connector with the encrypted public key, and sends the modified DPP Connector to the AP via a DPP Peer Discovery Request frame. Other identifying information may be present unencrypted in the Connector (e.g., expiration timestamp). The expiration timestamp does not have to be universally unique, but only a limited set of devices will have one specific expiration timestamp in its DPP Connector. Devices should handle other identifying information in the same way they handle the public key in the DPP Connector according to the present invention. Obviously, modifying a signed DPP Connector will break the signature, but the AP can decrypt the encrypted public key, restore the DPP Connector, and successfully verify the signature on the restored DPP Connector.

[0027] Apparatus and methods according to various embodiments of the present invention require the use of encryption and random information.

[0028] According to a first solution to this aspect of the invention, public key encryption, for example based on the RSA algorithm (see [RSA]), is used. The identification information is for example concatenated with a second string (a nonce or other random information) and then encrypted. The receiving device uses its private key to decrypt the received encrypted information and then discards the second string in order to extract the identification information.

[0029] As an alternative to the above encryption solution based on RSA, elliptic curve cryptography can also be used (see [SEC1702]). Let a be A's private key and α=aG its public key, where G is the generator or base of a publicly known curve. B, who wants to send an encrypted message to A, does the following: 1. B chooses a random number r, 1≦r≦n-1, and computes rG, where n is the degree of G, i.e., nG is equal to the so-called point at infinity or identity point O, where P = O + P holds for every point P on the curve. 2. Next, B computes M+rα, where the message M (a binary string) is represented as a point in 〈G〉. 3. B sends the encrypted text pair 〈rG,M+rα〉 to A.

[0030] Upon receiving this encrypted text, A decrypts it as follows: 1. A extracts rG and calculates a (rG) = r (aG) = rα 2. A extracts the second part of the pair M+rα and subtracts rα to get M+rα-rα=M

[0031] In the above scheme, the generator G corresponds to the base point of the curve used, α=aG corresponds to the public key used in the ECC encryption algorithm, and a corresponds to the private key since it is the secret used for decryption. Note that ECC already has an inherent randomization during encryption with the random number r. Therefore, other mechanisms for concatenating the identification information and the random information are possible, as long as the receiving device can obtain the identification information.

[0032] Using ECC is more complicated than using RSA because a block of plaintext must be transformed into a point before it is encrypted, as shown by M above. After decryption, it must be transformed back into plaintext. The background is that not all values ​​of x, where 1 ≤ x ≤ n-1, are the x coordinates of a point on the curve. [SEC1702] lists several ways to transform a block of plaintext into an elliptic point and back. Another drawback is that if the message M is 2 The limitation is that it is limited to log n bits. However, with ECC, devices do not need to agree on how to combine the random information with the identifying information, since this is predefined in the standard.

[0033] As noted above, the apparatus and methods according to various embodiments of the present invention require public key cryptography. Various aspects of the present invention related to the distribution of public keys are described below.

[0034] In one embodiment of the present invention, the AP itself may distribute its public key. The AP may list one or more public keys for use by the present invention in any of the beacons, DMG beacons, probe responses, announcements, or information response frames. In particular, this may be done in the form of an additional information element (IE), i.e. a structure starting with an element ID field containing a value indicating that the AP's public key is listed in this IE, followed by a length field and a payload. Furthermore, the IE may contain one or more public key purposes (encryption of SAE password, encryption of pre-shared key (PSK), encryption of WPA2-Personal passphrase, encryption of (part of) DPP connector, etc.).

[0035] When the present invention is used for encryption of password IDs, one or more public keys may be specifically enumerated in a Robust Security Network Element (RSNE) in either a beacon, DMG beacon, probe response, announcement, or information response frame in which the AP announces that it supports SAE, DPP, or other methods that allow individual or group passwords. This enumeration is typically done in the Robust Security Network Element (see Section 9.4.2.25 of [802.11]).

[0036] Multiple public keys can be used to support multiple public key algorithms, e.g., ECC and RSA, or different curves for Elliptic Curve Cryptography (ECC) (see [ECC], e.g., P-256 or P-384; multiple key lengths for RSA see [RSA]).

[0037] In addition to the public key, the AP should also provide information including the type of cipher, key length or type of curve used, etc. A suitable format for listing the public key may be a JSON web key (see [RFC 7517] or the ASN.1 SEQUENCE SubjectPublicKeyInfo in [RFC 5280]).

[0038] The advantage of using a public key rather than a symmetric key is that only the AP can decrypt the password identifier.

[0039] In another aspect of the invention regarding key distribution, the distribution of the AP's public key is done by configuring the device. The AP's public key can be made known to the device during its configuration along with the SAP password, passphrase, or PSK and its password ID, or along with the DPP connector. Many conventional configuration methods are known, such as entering this information using a UI, or displaying it as a QR code and reading it on the device with a QR code reader.

[0040] A convenient way to configure the AP's public key is to use DPP (see [DPP]). The DPP configurator first authenticates and, after successful authentication, configures the device using a DPP configuration object. The configuration object allows the device to connect to the AP using a SAP password, passphrase, PSK, or DPP connector.

[0041] Including an SAE password, passphrase, or PSK in a DPP configuration object is already supported by DPP (see [DPP]). Extending a DPP configuration object with a password ID and a list of AP public keys is straightforward. The public keys can be added to the JSON web key format of [RFC 7517] since DPP already uses it in DPP configuration objects. DPP configuration objects holding DPP connectors can be extended in a similar way to include a list of AP public keys for encryption of (part of) the DPP connector.

[0042] The SAE Password ID may preferably be transmitted as part of the SAE Commit message (see [WPA3] or [802.11], section 12.4), although other messages during or preceding the SAE protocol may be used. According to the invention, an encrypted SAE Password ID is transmitted instead of the cleartext SAE Password ID. Preferably, the encrypted SAE Password ID is carried in an information element whose element ID indicates that the information element carries an encrypted SAE Password ID.

[0043] The method to encrypt the SAE Password ID is to first select one of the AP's public keys. If the AP has multiple public keys for this purpose, the selected public key must be indicated somehow in the IE that carries the encrypted SAE Password ID.

[0044] If this is an ECC public key, the SAE password is mapped to a point on the curve for the selected public key. This is preferably done by method 6.1 of [SEC1702], but many alternative methods are listed in [SEC1702] or are known elsewhere. Using method 6.1 of [SEC1702], the bits of the characters of the SAE password are concatenated into one large integer. Eight or more LSBs are added. This expanded number is used as a potential x coordinate. Then, using the equation for the curve, it is checked whether this potential x coordinate is in fact a point on the curve. If it is not, this potential x coordinate is incremented by one and the new potential x coordinate is again tested for being on the curve. This is repeated until a point M on the curve is found. This point M is encrypted as described in the "ECC Encryption" section above. The result of the encryption is two points rG and M+rα. The x- and y-coordinates of these points are stored in the information element as four large binary numbers, or as two octet strings resulting from the point to octet string convention of [802.11] clause 12.4.7.2.4 for each of the two points, or the two points are represented in a compact symbol where the full x-coordinate is used and only one bit is used for the sign of the y-coordinate.

[0045] If the selected public key is an RSA key, then the SAE Password ID may be encrypted using any of the RSA encryption methods in [RFC 8017].

[0046] When using a pre-shared key (PSK), the AP and a device wanting to associate with it perform what is called a four-way handshake (see Section 12.7.6 of [802.11]). Using both the PSK and the information exchanged in the first part of the four-way handshake, both devices compute a key on which they base further trust. The PSK ID can be encrypted and stored in an information element in a similar manner as described previously. The resulting IE can be sent in the first message of the four-way handshake that the device sends to the AP, or in any appropriate message prior to the four-way handshake.

[0047] The DPP connector contains the x and y coordinates of the unencrypted device public key, which is an ECC key. As mentioned above, by sending the DPP connector as defined in [DPP], an attacker can track the device to some extent. According to the present invention, the device first selects the AP's public key, which is an ECC public key of the same group as its own public key. Then, since the public key is a point on the curve, the device's public key is directly encrypted according to the procedure mentioned above. The resulting two points are then stored in the connector using a JSON attribute value pair with an appropriately selected attribute name, and the plaintext public key JSON attribute value pair is removed. The "encrypted" DPP connector is then sent to the AP in a DPP Peer Discovery Request frame. The AP can verify that it is the encrypted one from the JSON attribute name, which is the encrypted public key.

[0048] Removing the plaintext public key and adding the two points of the encrypted public key would, of course, corrupt the DPP Connector signature that the DPP configurator added to the DPP Connector when configuring the device. However, before verifying the DPP Connector signature, the AP can first decrypt the device public key from the two points resulting from the ECC encryption, remove these two points from the received DPP Connector, and insert the decrypted public key JSON attribute value pair using the attribute names specified in [DPP], such that the original DPP Connector is restored. The AP can then proceed with the DPP protocol as specified for the unencrypted public key.

[0049] The expiration timestamp can be encrypted similarly to that described for the SAE Password ID. The unencrypted expiration timestamp JSON attribute value pair is removed by the device and the two resulting ECC encrypted points are inserted into the DPP Connector using a JSON attribute value pair with appropriately selected attribute names.

[0050] It is also possible to encrypt the entire DPP connector using ECC encryption, using the "ECC encryption" procedure above, by breaking the DPP connector into chunks short enough to be encrypted using the "ECC encryption" procedure above, and a mapping from a large number of octets to a large number of ECC points, with the same random number r used for all chunks, or a different r used for some or each chunk.

[0051] These methods can be performed, for example, by circuits and software in a processor or Wi-Fi controller. Suitable encryption and decryption functions are described above. As will be apparent to those skilled in the art, many different ways of implementing the method are possible. For example, the order of stages or steps can be changed, or some stages can be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent improvements to the method as described herein, or may be unrelated to the method.

[0052] The computer program may be downloadable from a network and / or stored on a computer readable medium and / or a microprocessor executable medium, and includes program code instructions for implementing the above-mentioned methods, connection sequences, security processes, and further operations when executed on a computing device. Thus, the methods according to the present invention can be implemented using software that includes instructions for causing a processor system to execute the respective method.

[0053] Typically, the devices performing the above processes each comprise a processor coupled to a memory containing appropriate software code stored in the device. For example, the software may be downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM, or a non-volatile memory such as Flash (not shown). The devices may comprise, for example, a microprocessor and a memory (not shown). Alternatively, the devices may be implemented in whole or in part as programmable logic, e.g., a Field Programmable Gate Array (FPGA). The devices and servers may be implemented in whole or in part as so-called Application Specific Integrated Circuits (ASICs), i.e., integrated circuits (ICs) customized for their specific use. For example, the circuits may be implemented in CMOS using hardware description languages ​​such as Verilog, VHDL, etc.

[0054] The software may include only the steps executed by a particular subentity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, etc. The software may be transmitted as a signal, wired, wireless, or using a data network (e.g., the Internet). The software may be made available for download and / or remote use on a server. The method according to the invention may be executed using a bitstream configured to configure a programmable logic, e.g., a field programmable gate array (FPGA), to perform the method. It is understood that the software may be in the form of code intermediate source and object code, such as source code, object code, partially compiled form, or any other form suitable for use in implementing the method according to the invention. An embodiment of the computer program comprises computer executable instructions corresponding to each of the processing steps of at least one of the described methods. These instructions may be divided into subroutines and / or stored in one or more files, which may be statically or dynamically linked. Another embodiment of the computer program comprises computer executable instructions corresponding to each of the means of at least one of the described systems and / or products.

[0055] It will be appreciated that for clarity, the above description describes embodiments of the invention with reference to different functional units and processors. However, it will be apparent that any suitable distribution of functionality between different functional units or processors can be used without departing from the invention. For example, functionality shown to be performed by separate units, processors or controllers may be performed by the same processor or controller. Thus, references to specific functional units should not be considered as indicative of a strict logical or physical structure or organization, but only as a reference to suitable means for providing the described functionality. The invention can be implemented in any suitable form including hardware, software, firmware or any combination of these.

[0056] It should be noted that in this specification, the word "comprising" does not exclude the presence of elements or steps other than those listed, the article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements, and any reference signs do not limit the scope of the claims, and the invention may be implemented by both hardware and software, and several "means" or "units" may be represented by the same item of hardware or software, and a processor may possibly cooperate with a hardware element to realize the functions of one or more units. Moreover, the invention is not limited to the embodiments, and the invention consists in every novel feature or combination of features described above or recited in mutually different dependent claims.

[0057] In summary, the present application relates to a device and a method for establishing a secure wireless link for communication between a first device and a second device over a wireless physical channel, in which a pairing protocol transmits, by the first device, an identification information, which is data suitable for identifying the device transmitting the identification information or its user, over the wireless channel (the first device encrypts and transmits the identification information using public key information and random information of the second device, and the second device receives the encrypted identification information), and extracts the identification information using private key information associated with the public key information. The device obtains a session key using a secret uniquely related to the identification information, and establishes a secure wireless link using the session key. For example, the wireless channel is Wi-Fi, the identification information is an identifier for a password or passphrase, the secret is a password or passphrase, and the authentication method is Simultaneous Authentication of Equals (SAE). Alternatively, the pairing protocol is DPP, and the identification information is part of a DPP connector. The public key information can be transmitted in a beacon, a DMG beacon, a probe response, an announcement, or an information response frame.

[0058] [References] [802.11] IEEE Computer Society, “IEEE Standard for Information Technology- Telecommunications and Information Exchange Between Systems - Local and Metropolitan Area Networks - Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications,” (IEEE Std. 802.11-2016), December 2016 [DH]Diffie, W.; Hellman, M. (1976), "New directions in cryptography", IEEE Transactions on Information Theory, 22 (6): 644-654 [DPP]Device Provisioning Protocol - Technical Specification - Version 1.0, Wi-Fi Alliance, 2018. [ECC]Koblitz, N. (1987). "Elliptic curve cryptosystems". Mathematics of Computation. 48 (177): 203-209. [RFC 5216]"The EAP-TLS Authentication Protocol", March 2008, https: / / datatracker.ietf.org / doc / rfc5216 / [RFC 5280]Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, May 2008, https: / / datatracker.ietf.org / doc / rfc5280 / [RFC 7517]JSON Web Key (JWK), May 2015, https: / / datatracker.ietf.org / doc / rfc7517 / [RFC 8017]PKCS #1: RSA Cryptography Specifications Version 2.2, November 2016, https: / / datatracker.ietf.org / doc / rfc8017 / [RSA]Rivest, R.; Shamir, A.; Adleman, L. (February 1978). "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", Communications of the ACM. 21 (2): 120-126. [SEC1702]Aritro Sengupta and Utpal Kumar Ray, "Message mapping and reverse mapping in elliptic curve cryptosystem", Security Comm. Networks 2016; 9:5363-5375, Published online 22 November 2016 in Wiley Online Library (wileyonlinelibrary.com). DOI: 10.1002 / sec.1702. [WPA2-E]WPA2-Enterprise Provides Security-Protected Authentication and Enables Product Use in Multiple Markets, Wi-Fi Alliance Security Marketing TG, 30 April 2008, https: / / groups.wi-fi.org / apps / org / workgroup / gmdocs / download.php / 10413 / 20080430%20WPA2-Enterprise%20Technical%20Note%20for%20WFA%20Members.pdf [WPA2]Wi-Fi Protected Access (WPA), Enhanced Security Implementation Based on IEEE P802.11i standard, Version 3.1, August, 2004, Wi-Fi Alliance. [WPA3]WPA3 Specification, Version 1.0, April 2018, Wi-Fi Alliance.

Claims

1. A method for establishing a secure communications link for communication between a first device and a second device over a communications channel, comprising: a pairing protocol requiring the first device to transmit identifying information over the communication channel; the identification information being data suitable for identifying the device transmitting the identification information and its user; The pairing protocol is based on Simultaneous Authentication of Equals (SAE), the identification information is an SAE password identifier defined in IEEE 802.11; The method comprises: generating random information; the first device encrypting the identification information by using public key information of the second device and the random information; the first device transmitting the encrypted identification information over the communication channel in an SAE protocol message; the second device receiving the encrypted identification information and extracting the identification information using private key information associated with the public key information; deriving a session key using a secret uniquely associated with the identity; establishing the secure communications link using the session key; The method according to claim 1,

2. The method of claim 1, wherein encryption of the identification information is performed using elliptic curve cryptography.

3. A method as described in claim 1 or 2, wherein an SAE algorithm is used to derive the session key, and the secret is a password used for the SAE algorithm.

4. A first device configured to establish a secure communications link for communications between a first device and a second device over a communications channel, comprising: a pairing protocol requiring the first device to transmit identifying information over the communication channel; the identification information being data suitable for identifying the device transmitting the identification information and its user; The pairing protocol is based on Simultaneous Authentication of Equals (SAE), the identification information is an SAE password identifier defined in IEEE 802.11; The first device is a processor configured to generate random information, encrypt the identity using public key information of the second device and the random information, obtain a session key using a secret uniquely associated with the identity, and establish the secure communications link with the second device using the session key; a transmitter for transmitting the encrypted identification information over the communication channel in an SAE protocol message; A first device having:

5. The first device of claim 4 , wherein an SAE algorithm is used to derive the session key, and the secret is a password used for the SAE algorithm.

6. The first device of claim 4 , wherein the first device receives and extracts the public key information from a beacon, a DMG beacon, a probe response, an announcement, or an information response frame.

7. 5. The first device of claim 4, wherein an 802.11 four-way handshake protocol is used to derive a key that is the basis for the security of the secure channel, and the secret is a passphrase or PSK used in the four-way handshake.

8. A second device configured to establish a secure communications link for communications between a first device and a second device over a communications channel, comprising: a pairing protocol requiring the first device to transmit identifying information over the communication channel; the identification information being data suitable for identifying the device transmitting the identification information and its user; The pairing protocol is based on Simultaneous Authentication of Equals (SAE), the identification information is an SAE password identifier defined in IEEE 802.11; The second device is a receiver for receiving encrypted identification information in an SAE protocol message over the communication channel, the encrypted identification information being identification information encrypted by using public key information of the second device and random information; a processor that uses private key information associated with the public key information to extract the encrypted identification information, uses a secret uniquely associated with the identification information to obtain a session key, and uses the session key to establish the secure communications link; A second device having:

9. The second device of claim 8 , wherein an SAE algorithm is used to derive the session key, and the secret is a password used for the SAE algorithm.

10. The second device of claim 8 or 9, configured to receive and extract the public key information from a beacon, a DMG beacon, a probe response, an announcement or an information response frame.

Images