Pre-derived PTKs for Seamless Wi-Fi Roaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wi-Fi 8's multi-link security protocol fails when links span across multiple physical APs due to different MAC addresses, which is not compatible with Wi-Fi 7's security protocol, leading to limitations in roaming and multi-link operations across different APs.
Innovation Solution
The solution involves enhancing the Robust Security Network Information Element (RSNIE) to include information about security protocols used by multiple APs in an extended service set, allowing STAs to derive and cache Pairwise Transient Keys (PTKs) for each AP, enabling seamless roaming and multi-link operations across different Wi-Fi generations without requiring repeated association and key management protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Wi-Fi 7's security protocol is used to establish links across multiple physical APs, then multi-link security is provided, but the protocol fails because different physical APs have different MAC addresses
Solution Approach 1:
The patent performs preliminary action by pre-deriving Pairwise Transient Keys (PTKs) for multiple APs before actual connection. The STA receives RSNIEs from APs during scanning, extracts PMK and security protocol information, and pre-computes PTKs using the formula: PTK = PRF(PMK + ANONCE + SNONCE + MAC(AA) + MAC(SA)). This allows the STA to have ready-to-use security keys for multiple APs without performing full 4-way handshakes when connecting, resolving the contradiction between security reliability and cross-AP adaptability.
2Reliability
If a 4-way handshake encryption protocol is performed for each AP connection, then secure key establishment is achieved, but roaming efficiency is reduced due to repeated protocols
Solution Approach 1:
The patent applies preliminary action by pre-deriving PTKs before connection. During scanning, the STA receives RSNIEs containing PMK and security protocol information for multiple APs. The STA then pre-computes PTKs for all these APs using the established key derivation formula. When roaming occurs, the STA can immediately use the pre-derived PTKs without performing complete 4-way handshakes, significantly improving roaming efficiency while maintaining security.
Solution Approach 2:
The patent uses copying by creating reusable PTKs that can be applied across multiple AP connections. Instead of generating unique keys through full handshakes for each AP, the system copies the key derivation process by using the same PRF function with different inputs (ANONCE, SNONCE, MAC addresses) to generate PTKs that can be reused and shared across AP boundaries, improving efficiency while maintaining security equivalence.
3Ease of manufacture
If MAC addresses are used for key derivation, then key generation is simplified, but compatibility is lost when spanning multiple physical APs with different MAC addresses
Solution Approach 1:
The patent applies universality by creating a multi-functional key derivation system. The PTK derivation formula PTK = PRF(PMK + ANONCE + SNONCE + MAC(AA) + MAC(SA)) serves multiple functions: it works for single-AP connections, multi-AP connections, Wi-Fi 7 intra-BSS roaming, and Wi-Fi 8 inter-BSS roaming. By incorporating multiple variables (PMK, nonces, MAC addresses) into a universal PRF function, the system maintains simplicity while achieving broad compatibility across different AP configurations and Wi-Fi versions.
Data Source
AI summary
The present technology provides a mechanism for more efficient make-before-you-break roaming (MMBR) between devices in the same extended service set (ESS) that utilize a common Pairwise Master Key (PMK). Association and key management (AKM) procedures can be time-consuming, and the present technology provides for a more efficient mechanism by which the Pairwise Transient Key (PTK) can be derived in advance so that the STA can directly associate with a new AP. More specifically, the Robust Security Network Information Element (RSNIE) that is exchanged prior to key derivation and association between the STA and the AP can be enhanced to include information about the security protocols used by other APs in the extended service set (ESS), which can be used to derive respective Pairwise Transient Keys (PTKs) in advance for use with other APs.