MAC Address Randomization with PMKID Cache for Fast Reconnection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
MAC address randomization for privacy purposes can hinder fast reconnection mechanisms like PMKSA caching, requiring devices to perform time-consuming 802.1X/SAE authentication when reconnecting to an access point with a different MAC address.
Innovation Solution
A method that allows devices to reconnect to an access point using PMKSA caching by generating an association request with a new MAC address and PMKID, enabling encryption and decryption processes to match cached PMKIDs, thereby bypassing the need for full 802.1X/SAE authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If MAC address randomization is used to protect user privacy, then user privacy is improved, but fast reconnection mechanism fails and authentication time increases
Solution Approach 1:
The patent segments the authentication process by separating the full 802.1X/SAE authentication into a cached verification phase. The PMKID cache stores pre-computed authentication credentials that can be quickly verified without re-running the complete authentication protocol, thus dividing the time-consuming authentication into a fast cache lookup and a periodic full authentication.
Solution Approach 2:
The patent applies preliminary action by pre-computing and caching the PMKID (Pairwise Master Key Identifier) during the initial 802.1X/SAE authentication. This cached credential is stored and can be quickly reused for reconnections, eliminating the need to perform the time-consuming 802.1X/SAE authentication again when the device reconnects with a randomized MAC address.
2Object-affected harmful factors
If MAC address randomization is used to prevent tracking, then device tracking prevention is improved, but PMKSA caching compatibility deteriorates
Solution Approach 1:
The patent introduces the PMKID cache as an intermediary mechanism that bridges MAC address randomization and fast reconnection. The PMKID serves as a mediator that links the randomized MAC address to the cached authentication credentials, allowing the system to verify identity without relying on MAC address consistency.
Solution Approach 2:
The patent changes the parameter used for cache matching from MAC address to PMKID. Instead of requiring the MAC address to match the cached entry, the system now uses the PMKID (which is derived from the authentication process but independent of MAC address) as the matching key, thus accommodating MAC address randomization while maintaining cache functionality.
3Reliability
If full 802.1X/SAE authentication is performed on reconnection, then authentication security is maintained, but connection speed deteriorates
Solution Approach 1:
The patent applies partial action by performing only a partial authentication verification using the cached PMKID instead of the full 802.1X/SAE authentication protocol. The cached PMKID provides sufficient security verification for reconnections, eliminating the need for the excessive full authentication process while maintaining adequate security.
Solution Approach 2:
The patent uses copying by creating and storing a copy of the authentication credential (PMKID) during the initial authentication. This copied credential can be quickly reused for verification without needing to re-execute the entire authentication process, thus maintaining security through credential verification while dramatically reducing connection time.
Data Source
AI summary
The present invention provides a wireless communication method of an access point. The wireless communication method comprises the steps of: establishing a cache table comprising a plurality of reference MAC and corresponding PMKs and reference PMKIDs; receiving an association request from a station; reading a MAC address of the station and a PMKID from the association request; if the MAC address of the station and the PMKID do not match items of the cache table, performing a calculation on the PMKID to obtain an original PMKID; determining if the original PMKID matches any one of the reference PMKIDs within the cache table; and if the original PMKID matches one reference PMKID within the cache table, determining that the reference MAC recorded in the cache table and the MAC address belong to the same station.