Dynamic Wi-Fi Authentication Identifiers for PMKID Privacy Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing WiFi technologies lack effective protection for identification information such as PMKID, leading to potential leakage and threats to user privacy during network access.
Innovation Solution
Generate and update identifiers based on random numbers, using hash operations and public keys, to protect user privacy by making these identifiers dynamic and less susceptible to leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed identifier (such as MAC address or PMKID) is used for authentication between terminal device and access device, then authentication efficiency is improved and cached results can be utilized, but user privacy is compromised because the identifier can be easily leaked and tracked
Solution Approach 1:
The patent applies the dynamics principle by making the identifier dynamic instead of fixed. A random number generator generates a new random number for each authentication attempt, and this random number is used to derive a new identifier (such as a new PMKID). This ensures that even though authentication efficiency is maintained through cached results, the identifier changes with each session, preventing tracking and privacy leakage.
Solution Approach 2:
The patent applies parameter changes by modifying the identifier parameter from a fixed value (MAC address, fixed PMKID) to a variable value derived from random numbers. The identifier is regenerated based on new random numbers while maintaining the ability to use cached authentication results, thus changing the parameter state to balance security and efficiency.
2Object-affected harmful factors
If a temporary MAC address is used to protect user privacy, then tracking resistance is improved, but protection for other identification information (such as PMKID) remains insufficient
Solution Approach 1:
The patent applies universality by extending the random number-based identifier generation mechanism to cover multiple types of identification information, not just MAC addresses. The same approach is applied to PMKID and other authentication identifiers, making the protection mechanism universal across different identification types used in WiFi authentication.
Solution Approach 2:
The patent extends the dynamics principle from temporary MAC addresses to all identification information including PMKID. Each identifier is now derived from random numbers and changes dynamically with each authentication session, providing consistent tracking resistance across all identification types.
3Object-affected harmful factors
If random numbers are generated and identifiers are updated dynamically, then user privacy protection is improved, but computational complexity and authentication process complexity increase
Solution Approach 1:
The patent applies preliminary action by pre-generating random numbers and deriving identifiers before the actual authentication exchange. The random number generator produces random numbers, and the identifier derivation function creates the authentication identifier in advance, so that when authentication is needed, the process is already prepared and can proceed efficiently.
Solution Approach 2:
The patent applies self-service by implementing the random number generation and identifier derivation within the authentication protocol itself. The terminal device and access device autonomously generate random numbers and derive identifiers without requiring external intervention or complex external systems, making the complexity self-contained and manageable.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application provides a user privacy protection method, an apparatus, and a system, and relates to the field of communication technologies, to solve a problem that identification information used for interaction is easily leaked during access to a wireless network. The method includes: obtaining a first random number; determining a first identifier according to the first random number; sending a first message carrying the first identifier to a second device, where the first message indicates the second device to perform authentication with a first device according to a cached result corresponding to the first identifier; establishing a connection to the second device in a case that the authentication succeeds; obtaining a second random number; updating the first identifier according to the second random number to obtain the updated first identifier; and sending a second message carrying the updated first identifier to the second device, where the second message indicates the second device to perform authentication with the first device according to a cached result corresponding to the updated first identifier.