PSK Authentication via Message Integrity Check Values
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating client devices to wireless access points rely on pre-shared keys (PSKs), which can be insecure due to the use of a single PSK for all clients or the burden of pre-registering client device MAC addresses.
Innovation Solution
Implementing a system where an authentication server identifies the correct pre-shared key (PSK) for a client device based on vendor-specific attributes (VSAs) without requiring client device identifying information like MAC addresses, using message integrity check (MIC) values to cryptographically bind the message content to the PSK.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-shared keys are used for authenticating client devices to wireless access points, then authentication can be performed, but security is compromised due to single PSK usage for all clients and administrative burden increases due to MAC address pre-registration
Solution Approach 1:
The patent segments the authentication process by separating the PSK distribution phase (where multiple PSKs are generated and stored) from the authentication phase (where the correct PSK is identified using MIC values). This eliminates the need for MAC address pre-registration while maintaining security, as the authentication server can identify the correct PSK through cryptographic verification of MIC values without requiring device identifiers.
2Device complexity
If a single pre-shared key is used for all client devices, then authentication process is simplified, but network security is weakened
Solution Approach 1:
The patent changes the authentication parameter from relying on device identifiers (MAC addresses) to relying on cryptographic proof (MIC values). The authentication server generates multiple PSKs and uses MIC values as the distinguishing parameter to identify the correct PSK for each client device, thereby maintaining simple authentication flow while enhancing security through cryptographic verification.
3Measurement precision
If MAC addresses are pre-registered for client devices, then authentication accuracy is improved, but the system requires additional infrastructure and administrative overhead
Solution Approach 1:
The patent uses MIC values as a cryptographic copy or representation of device identity. Instead of storing and processing actual MAC addresses, the system stores MIC values that cryptographically bind to specific PSKs. This allows the authentication server to accurately identify the correct PSK for each device without requiring infrastructure for MAC address management or pre-registration.
Data Source
AI summary
A process includes accessing a first message that is sent from an access point device. The first message includes data representing a second message that is sent by a client device. The second message is part of an exchange of messages between the client device and the access point device associated with authentication of the client device and a derivation of a first key used to encrypt and decrypt data communicated between the client device and the access point device. The second message includes a first message integrity check value. The process includes identifying, based on the second message, a pre-shared key corresponding to the client device. The identification of the pre-shared key includes determining a second message integrity check value based on a candidate pre-shared key of a plurality of candidate pre-shared keys; comparing the second message integrity check value with the first message integrity check value; and based on a result of the comparison, selecting the given candidate pre-shared key as the pre-shared key. The process includes determining a user role based on the pre-shared key. The process includes causing a third message to be sent to the access point device, where the third message includes data representing the pre-shared key and data representing the user role.