Wireless Access Point Authentication via Challenge-Response

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Public wireless hotspots pose security risks due to 'Evil Twin' attacks, where hackers impersonate legitimate access points, and existing security solutions like encryption and client authentication are inadequate in protecting users from such fraudulent APs.

Innovation Solution

A method involving a client device that authenticates a wireless access point using a certificate and public key, generating a challenge, and receiving a response from the AP's private key stored in a hardware security module to verify the AP's identity, ensuring secure communication before providing confidential information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a client connects to a public wireless access point, then convenient Internet access is provided, but security risks from Evil Twin attacks increase

Engineering Contradiction:

Improveconvenience of wireless connectionVSAvoidsecurity risks from fraudulent APs

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The client performs authentication of the access point before establishing a data connection. The client obtains the AP's certificate and public key in advance, generates a challenge, and verifies the AP's identity through cryptographic proof before allowing any data transmission, thus preventing Evil Twin attacks while maintaining convenience

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A certificate authority acts as an intermediary that issues digital certificates to legitimate access points. The client uses this trusted third-party certificate to verify the AP's identity, creating a chain of trust that mediates between the client and the potentially fraudulent AP

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If encryption is used between client and AP, then data transmission security is improved, but it does not protect against Evil Twin attacks where the AP itself is fraudulent

Engineering Contradiction:

Improvedata transmission securityVSAvoidfraudulent AP impersonation

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent performs authentication of the access point's identity before establishing encrypted data transmission. By verifying the AP's certificate and public key in advance and obtaining cryptographic proof of identity through challenge-response, the system ensures the AP is legitimate before any sensitive data transmission occurs, thus preventing Evil Twin attacks that encryption alone cannot detect

Inventive Principle:

Principle #10Preliminary action

3Reliability

If client authentication is used, then network access control is improved, but it does not protect the client from connecting to fraudulent APs

Engineering Contradiction:

Improvenetwork access controlVSAvoidclient connection to fraudulent AP

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Instead of only authenticating the client to the network (traditional approach), the patent inverts the authentication direction by having the client authenticate the access point first. The client verifies the AP's identity using the AP's certificate and public key, and obtains cryptographic proof that the AP is legitimate before allowing the AP to authenticate the client, thus preventing connection to fraudulent APs

Inventive Principle:

Principle #13The other way round (Inversion)

4Reliability

If an authentication server is used to authenticate clients, then access control is improved, but the client must communicate directly through the AP which exposes the client to fraudulent APs

Engineering Contradiction:

Improveclient authenticationVSAvoidclient exposure to fraudulent AP

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent performs authentication of the access point's identity before establishing any communication channel to the authentication server. By verifying the AP's certificate and obtaining cryptographic proof of identity in advance, the system ensures the AP is legitimate before the client communicates through it, thus eliminating the security vulnerability where clients must trust the AP before authentication

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8327143B2Techniques to provide access point authentication for wireless network

Publication Date: 2012.12.04 AVAGO TECHNOLOGIES INTERNATIONAL SALES PTE LTD

AI summary

According to an example embodiment, an apparatus may include a client device including a processor and memory. The client device may be configured to obtain, via a secure communication, a certificate identifying a publically accessible wireless access point (AP) and a public key for the AP, the AP being publically accessible. The client (or client device) may be configured to generate a challenge, send the challenge to the AP, wherein the AP has a private key securely stored in a hardware security module of the AP. The private key may correspond to the public key for the AP. The client may be configured to receive a response from the AP, the response being generated by the AP based on the challenge and the private key for the AP, and authenticate the AP based on the response.