Dynamic Key Generation for Wireless Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless local area network (WLAN) systems face challenges in controlling access to client devices after distributing their public keys, making it difficult to manage access and ensure secure communication.
Innovation Solution
A method where a wireless station dynamically generates a first public and private key pair, and a shared key based on this pair, allowing secure communication with an access point, while also enabling the access point to generate a shared key for secure communication with the client device, thereby enhancing access control and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a client device uses a static public key for authentication with access points, then initial authentication can be established, but access control becomes difficult to manage after key distribution
Solution Approach 1:
The patent transforms the static public key system into a dynamic key generation system. The client device generates a new ephemeral key pair for each connection attempt, and the access point verifies these dynamic keys against a certificate authority signature. This dynamic approach maintains authentication reliability while enabling flexible access control, as the network can revoke access by updating the certificate authority's public key without redistributing individual client keys.
2Reliability
If public key encryption is used for secure data transfer, then data security is improved, but control over device access to the network deteriorates
Solution Approach 1:
The patent introduces a certificate authority as an intermediary between the client device and access points. The certificate authority signs the client's public key to create a certificate, which the access point verifies. This intermediary enables the network to control access flexibly by managing the certificate authority's public key distribution, while individual client keys remain secure and unchanged. The access point can revoke access by stopping acceptance of certificates from a particular certificate authority or updating its trust list.
3Adaptability or versatility
If a client device shares its public key with multiple access points, then network connectivity is improved, but security management becomes more complex
Solution Approach 1:
The patent segments the authentication system into two independent components: the client's ephemeral key pair (used only for authentication, not stored long-term) and the certificate authority's signed certificate (distributed by the network). This segmentation allows the client to connect to multiple access points using the same certificate without managing multiple key pairs, while security is maintained through the cryptographic verification of the certificate signature at each access point independently.
Data Source
AI summary
An apparatus and method for configuring a wireless station for use within a wireless local area network are disclosed. In at least one exemplary embodiment, a pairwise master key is generated by the wireless station and an access point within the wireless local area network. The pairwise master key may be based, at least in part, on a transient identity key pair of the wireless station. The transient identity key pair may be generated by the wireless station in response to receiving a message from the access point. In some embodiments, a public transient identity key of the transient identity key pair may be provided to additional access points to enable the wireless station to authenticate with the additional access points.