Client-Specific Pre-Shared Key Authentication in Wireless Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless communication network authentication methods, such as WPA/WPA2 Personal and WPA Enterprise, face challenges in managing security and user simplicity, particularly with the distribution and management of pre-shared keys (PSKs) across multiple users and access points, leading to increased complexity and security risks.
Innovation Solution
A system and method utilizing an authentication server to establish an encrypted communication channel between client devices and access points, where a client-specific pre-shared key is validated through a message integrity code (MIC) generated using a pair-wise master key (PMK) and attributes, allowing for secure authentication without the need for complex user input or extensive PSK distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If WPA/WPA2 Personal standard is used with a shared PSK for multiple users, then user authentication simplicity is improved, but security reliability deteriorates because the same PSK must be distributed to many users and changed for all devices when compromised
Solution Approach 1:
The patent segments the single shared PSK into multiple unique client-specific PSKs. Each client device receives a dedicated PSK that is independent of other clients, allowing the system to maintain both simplicity (clients only need to store their own PSK) and security (compromise of one PSK does not affect others). This segmentation is implemented through the authentication server distributing unique PSKs to each client during the authentication process.
2Reliability
If WPA Enterprise standard is used with RADIUS server authentication, then security reliability is improved, but device complexity and user input requirements worsen because clients must be configured with username and password
Solution Approach 1:
The patent extracts the complex username and password authentication mechanism from WPA Enterprise and replaces it with a simplified client-specific PSK approach. The authentication server handles the complexity of key management, while clients only need to store and use their unique PSK. This extraction removes the burden of username/password configuration from client devices while maintaining server-based security control.
Solution Approach 2:
The authentication server acts as an intermediary that manages the complex PSK distribution and validation process. Instead of clients directly managing credentials or configuring complex authentication parameters, the server mediates by distributing unique PSKs to clients and validating them during authentication, thereby simplifying client-side requirements while maintaining security.
3Reliability
If unique PSKs are stored on wireless LAN controllers for each user, then security is improved, but the quantity of configured users and system management burden worsens
Solution Approach 1:
The authentication server performs multiple functions: it authenticates clients, distributes unique PSKs, validates MICs, and manages the key database. This multi-functionality consolidates what would otherwise require separate systems, allowing the server to handle large numbers of users with unique PSKs without proportionally increasing system complexity or management burden.
Data Source
AI summary
Systems and methods for authenticating client devices accessing a wireless communication network through an access point communicatively coupled with an authentication server are provided. The authentication server receives an authentication request, including a first message integrity code (MIC) of a client-specific pre-shared key, from the access point or a wireless local area network (LAN) controller that manages the access point, to establish an encrypted communication channel between a client and the access point. In response to receipt of the authentication request, the authentication server validates the first MIC by receiving various attributes from the access point or the wireless LAN controller and determining a second MIC based on the client-specific pre-shared key of the client known to the authentication server and the received attributes so that the client-specific pre-shared key is validated to be authentic when the first MIC matches with the second MIC.