PASN Tunneling for Multi-AP Authentication Without Channel Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless local area networks, pre-association security negotiation (PASN) exchanges are unprotected and unauthenticated, allowing attackers to impersonate legitimate access points, leading to potential spoofing and GPS attacks, with existing methods failing to provide a reliable mechanism for identifying consistent information from multiple access points.
Innovation Solution
A method is introduced to tunnel pre-association security negotiation (PASN) sessions through an established PASN tunnel with a first access point, enabling a client device to establish sessions with multiple access points without leaving its active channel, using tunneled PASN logic to verify the legitimacy of neighboring access points and ensure they belong to the same mobility domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a STA queries all APs in the ESS for public information, then the STA can obtain information from multiple APs, but the STA has difficulty identifying AP impersonators and the analysis is non-deterministic and compute consuming
Solution Approach 1:
The patent introduces a mobility domain identifier as an intermediary element that is distributed by legitimate APs within the same mobility domain. This identifier serves as a mediator that enables the STA to quickly and reliably identify legitimate APs without requiring complex computational analysis of all queried information. The mobility domain identifier acts as a trusted marker that simplifies the identification process while maintaining high reliability.
2Reliability
If the STA establishes PASN sessions with multiple APs by switching channels, then the STA can authenticate each AP, but the process is time-consuming and disrupts active communications
Solution Approach 1:
The patent applies preliminary action by having the STA pre-authenticate with a first AP and establish a PASN session before needing to communicate with other APs. This pre-established session is then leveraged to facilitate subsequent authentication with other APs in the same mobility domain, eliminating the need to switch channels and re-establish sessions repeatedly. The preliminary authentication with the first AP serves as a foundation for efficient subsequent authentications.
Solution Approach 2:
The first AP acts as an intermediary that facilitates the authentication between the STA and subsequent APs. Through the tunneled PASN mechanism, the first AP helps verify and establish secure sessions with other APs in the mobility domain, allowing the STA to authenticate multiple APs without leaving its active channel or repeating the full authentication process with each AP.
3Ease of operation
If unauthenticated PASN exchanges are used, then the exchange is protected and encrypted, but the STA has no proof that the AP is legitimate and is vulnerable to spoofing attacks
Solution Approach 1:
The mobility domain identifier serves as a mediator that bridges the gap between easy setup of protected exchanges and reliable authentication. By incorporating this identifier into the PASN exchange, the system maintains the simplicity of unauthenticated setup while adding a verification mechanism that proves the AP's legitimacy through its membership in a known mobility domain.
Solution Approach 2:
The patent modifies the PASN exchange by adding the mobility domain identifier as a new parameter. This parameter change transforms the exchange from purely unauthenticated to authenticated, as the STA can verify the AP's legitimacy by checking its mobility domain identifier against known legitimate domains, while maintaining the overall ease of operation.
Data Source
AI summary
Presented herein are techniques to tunnel Pre-Association Security Negotiation (PASN) communications within another PASN protected exchange established with an (initial) access point (AP), thus allowing a station (STA) to establish one or more PASN sessions with one or more other access points (APs) through the initial AP, thereby enabling the STA to pre-establish PASN sessions with multiple APs without leaving its active channel with the initial AP. In at least embodiment, a method may include establishing a first PASN session between a STA and a first AP through initial PASN communications exchanged between the STA and the first AP and performing subsequent PASN communications between the STA and at least one other AP that are facilitated through the first PASN session established between the STA and the first AP to enable at least one subsequent PASN session to be established between the STA and the at least one other AP.