Hidden WLAN Authentication for Secure Zero-Touch Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing secure access to Wireless Local Area Networks (WLANs) is burdensome due to the need for manual identification and input of access credentials, and existing 'zero touch connection' methods are vulnerable to spoofing attacks that misdirect UEs to malicious networks, overloading legitimate WLANs.
Innovation Solution
A method involving cryptographically derived hidden network identifiers is used to authenticate and connect to target WLANs, ensuring authenticity by deriving hidden network identifiers from first network identifiers, and only connecting to verified target WLANs after discovering hidden WLANs, using cryptographic processing and access credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If access credentials are encoded within broadcast network identifiers for zero touch connection, then user input is eliminated and connection automation is achieved, but the system becomes vulnerable to spoofing attacks where malicious WLANs can misdirect UEs
Solution Approach 1:
The patent introduces a hidden WLAN as an intermediary verification layer between the broadcast WLAN and the UE. The hidden WLAN does not broadcast its identifier but can be discovered through cryptographic derivation from the broadcast network identifier. This intermediary serves as a trust anchor that verifies the authenticity of the connection target before the UE establishes a connection, thereby preventing spoofing attacks while maintaining automation.
Solution Approach 2:
The patent performs preliminary cryptographic verification before the actual connection is established. The UE derives the hidden network identifier from the broadcast identifier and attempts to discover the hidden WLAN in advance. Only after successful discovery of the hidden WLAN does the UE proceed to connect to the target WLAN, ensuring authentication occurs before the connection is made, thus preventing misdirection to malicious networks.
2Speed
If zero touch connection methods are used without verification, then connection speed is improved, but legitimate WLANs can be overloaded with access requests from spoofed connections
Solution Approach 1:
The hidden WLAN acts as a filtering intermediary that prevents spurious connection requests from reaching the target WLAN. By requiring successful discovery of the hidden WLAN as a prerequisite, the system ensures that only authenticated UEs with correct cryptographic credentials will attempt to connect, thereby preventing overload of legitimate WLANs while maintaining fast connection establishment for authorized devices.
3Reliability
If manual identification and input of access credentials is required, then connection security is maintained, but user burden increases and ease of operation decreases
Solution Approach 1:
The patent enables the UE to automatically perform cryptographic derivation of the hidden network identifier from the broadcast network identifier without user intervention. The system uses pre-shared cryptographic keys and algorithms stored in the UE to self-verify the authenticity of the WLAN, eliminating the need for users to manually input or verify access credentials while maintaining security through cryptographic authentication.
Data Source
AI summary
A method 200 of operating a telecommunications network (100), the telecommunications network comprising: User Equipment (UE) (110); a first Wireless Local Area Network (WLAN) (130), identifiable by means of a first network identifier: a hidden WLAN (130); and a target WLAN (130); and the method comprising the steps of: configuring the hidden WLAN so as to have a hidden network identifier that is cryptographically derived from the first network identifier (240)); by means of the UE: retrieving, from the first WLAN, the first network identifier (230); cryptographically processing the retrieved first network identifier thereby to derive the hidden network identifier (240); searching for a WLAN using the derived hidden network identifier (250): and requesting a connection to, or via, the target WLAN only after discovering the hidden WLAN (270). There is also provided a method of operating the User Equipment (UE), a method of operating set of Wireless Access Points (120), as well as User Equipment, a set of Wireless Access Points. and a telecommunications system therefor.