Neighbor Awareness Networking Password Authentication via SAE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Neighbor Awareness Networking (NAN) password authentication methods are vulnerable to brute force cracking and dictionary attacks due to the use of insufficiently complex passwords or pre-shared master keys, compromising the security of peer-to-peer Wi-Fi communication channels.
Innovation Solution
Implementing a simultaneous authentication of equals (SAE) protocol based on asymmetric cryptographic techniques to derive a pairwise master key using public/private keys, ensuring that attackers cannot determine the password or resulting key via brute force or dictionary attacks, and enabling secure data path establishment without introducing major changes to the NAN specification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pre-shared master keys or simple passwords are used for NAN authentication, then device complexity is reduced and ease of operation is improved, but security against brute force and dictionary attacks deteriorates
Solution Approach 1:
The patent changes the fundamental parameter of authentication from pre-shared master keys to Simultaneous Authentication of Equals (SAE) protocol, which uses asymmetric cryptography to derive keys dynamically. This transforms the authentication mechanism from static to dynamic, making each authentication session unique and resistant to brute force attacks while maintaining ease of use through automatic key derivation.
Solution Approach 2:
The patent replaces the mechanical key-sharing system with a cryptographic protocol-based system. Instead of relying on pre-shared keys that can be cracked, the SAE protocol uses mathematical operations on public/private key pairs to derive session keys, substituting the mechanical vulnerability of key storage with the mathematical strength of asymmetric cryptography.
2Adaptability or versatility
If pre-shared master keys are used for NAN authentication, then compatibility with existing NAN specification is maintained, but vulnerability to dictionary attacks increases
Solution Approach 1:
The patent nests the SAE protocol within the existing NAN framework, integrating the advanced authentication mechanism into the standard NAN discovery and connection establishment process. The SAE protocol is embedded in the NAN data path setup attributes exchange, allowing existing NAN-compatible devices to benefit from enhanced security without requiring complete protocol replacement.
Solution Approach 2:
The patent performs preliminary key material generation and authentication before establishing the actual data communication path. By completing the SAE authentication exchange during the NAN setup phase, the system prepares secure session keys in advance, ensuring that subsequent data transmission is protected without requiring changes to the core NAN communication flow.
3Device complexity
If simple password authentication is used, then device complexity is reduced, but protection against key compromise deteriorates
Solution Approach 1:
The patent introduces dynamic key derivation where session keys are not static but are generated dynamically during each authentication exchange. The SAE protocol creates unique session keys based on the specific public/private key pairs exchanged between devices, making each key valid only for its specific session. This dynamic approach provides forward secrecy, as compromise of one session key does not affect other sessions.
Data Source
AI summary
An apparatus comprises a memory and at least one processor in communication with the memory. The at least one processor is to detect, during a discovery window, a neighboring client station that is to perform peer-to-peer Wi-Fi communication via a Neighbor Awareness Networking (NAN) protocol and establish, via a negotiation after the discovery window, a datapath with the neighboring client station, wherein the negotiation includes an exchange of NAN data path setup attributes in parallel with an exchange of encryption cipher attributes and the encryption cipher is based on a simultaneous authentication of equals (SAE) protocol. The SAE protocol can be used to generate key material to encrypt the datapath.