Access Point Credential Exchange for Secure Device Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices in wireless communication systems, particularly those not associated with access points, face challenges in establishing secure communication with cloud computing systems due to the lack of necessary credentials, leading to difficulties in relaying data and obtaining access.
Innovation Solution
Devices transmit a frame indicating a device credential and a payload, which is received by an access point that relays it to a cloud computing system for validation. Upon successful validation, the access point associates with the device, enabling secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a wireless device attempts to connect to a wireless network, then network connectivity is established, but the device may be associated with a rogue access point instead of the legitimate one
Solution Approach 1:
The system performs preliminary verification of access point credentials before allowing device association. The network controller obtains and validates credentials (such as cryptographic keys or certificates) of access points in advance, maintaining a trusted list of authorized access points. When a device attempts to connect, the system checks whether the target access point's credentials match the pre-verified credentials, preventing association with rogue access points before the harmful connection can be established.
Solution Approach 2:
The network controller acts as an intermediary between wireless devices and access points. Instead of allowing direct device-to-access-point association, the network controller mediates the connection process by verifying access point credentials and providing credential information to devices. This intermediary layer enables devices to make informed connection decisions and prevents rogue access point association through centralized credential management and verification.
2Ease of operation
If devices use traditional connection methods, then connection process is simple, but devices cannot distinguish between legitimate and rogue access points
Solution Approach 1:
The system implements feedback mechanisms where the network controller provides credential information and authentication status back to wireless devices. Devices receive feedback about whether an access point is legitimate or rogue based on credential verification results. This feedback enables devices to make informed connection decisions without complicating the user interface, maintaining ease of operation while significantly improving authentication accuracy through automated backend verification.
3Reliability
If the network controller verifies credentials for every connection attempt, then security is enhanced, but processing time and computational resources increase
Solution Approach 1:
The network controller performs credential verification in advance and maintains a cached list of authorized access points with their verified credentials. For subsequent connection attempts, the system performs rapid lookups against this pre-verified list rather than conducting full credential verification each time. This preliminary action significantly reduces connection establishment time while maintaining security, as the pre-verification process ensures the cached credentials are valid.
Solution Approach 2:
The system performs partial verification by checking against pre-verified credential lists rather than conducting complete credential validation for every connection attempt. This partial action (checking against cached authorized lists) is sufficient for routine connections and dramatically reduces processing time, while full verification can be performed periodically or when anomalies are detected, balancing security reliability with connection speed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a device may transmit, via a broadcast, a first frame that indicates one or more of a device credential or a payload. The device may receive, from the access point, a second frame that indicates one or more of the payload or an access point credential. The device may associate with the access point based at least in part on the access point credential. The device may perform a communication, to a cloud computing system via the access point, after the device has been associated with the access point. Numerous other aspects are described.