Pre-Association AP Verification for Faster Secure Wi-Fi Roaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication systems face security challenges in establishing encrypted connections with multiple Access Points (APs) without mutual authentication, leading to potential attacks from malicious APs that can provide invalid information, compromising the integrity and privacy of data exchanges.
Innovation Solution
Implementing AP verification logic using crowd-sourcing techniques to establish secure, non-verified connections between STAs and APs within the same infrastructure, utilizing extensions like OWE-FT and PASN-FT to ensure legitimate APs communicate coherently, thereby enhancing security and reducing unnecessary negotiation time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mutual authentication is implemented between STA and multiple APs, then security against malicious APs is improved, but negotiation time and connection establishment complexity increase
Solution Approach 1:
The system performs security verification in advance by having the STA authenticate with a first AP before connecting to a second AP. The first AP verifies the STA's credentials and establishes a trusted relationship, so that when the STA connects to the second AP, the verification has already been completed preliminarily, avoiding repeated authentication negotiations.
Solution Approach 2:
The first AP acts as an intermediary that vouches for the STA's legitimacy. Instead of requiring the STA to authenticate directly with each AP independently, the first AP serves as a mediator that has already verified the STA, allowing the second AP to trust the STA based on the first AP's verification without conducting its own full authentication process.
2Reliability
If security verification is performed with each AP independently, then authentication reliability is improved, but device complexity and negotiation overhead increase
Solution Approach 1:
The patent merges the authentication processes by combining the verification with the association procedure. Instead of separate authentication and association steps, the STA authenticates with the first AP during the association process itself, and this combined verification is then recognized by the second AP, reducing the overall complexity of the negotiation process.
Solution Approach 2:
The authentication mechanism designed with the first AP serves multiple functions: it verifies the STA's credentials, establishes a trusted relationship, and enables the STA to connect to subsequent APs without repeating the full authentication process. This multi-functional approach reduces the complexity of individual authentication interactions.
3Productivity
If pre-association security negotiation is implemented, then connection establishment speed is improved, but security against malicious APs may be compromised
Solution Approach 1:
The security negotiation is performed in advance during the association with the first AP, before the STA needs to connect to the second AP. This preliminary security establishment allows for faster subsequent connections while maintaining security, as the verification has already been completed and can be reused.
Data Source
AI summary
Techniques are provided for verifying Access Points (APs) using crowd sourcing. In one example, a STA establishes a first non-verified connection, based on security material, with a source AP in a wireless infrastructure. A target AP in a wireless infrastructure obtains an indication that the STA is attempting to establish a second non-verified connection with the target AP. In response, the target AP establishes the second non-verified connection based on the security material.