Secure SAE Anti-Clogging Token Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Simultaneous Authentication of Equals (SAE) anti-clogging mechanisms in wireless networks are vulnerable to denial-of-service attacks, as the anti-clogging token transmitted by the access point is unencrypted, allowing attackers to intercept and replay tokens, leading to resource exhaustion and preventing legitimate clients from accessing the network.
Innovation Solution
The client generates the anti-clogging token using a shared secret and a multiplier, which is verified by the access point, ensuring only legitimate clients can authenticate, as the attacker lacks the necessary password seed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the access point transmits an unencrypted anti-clogging token to the client, then the authentication process can proceed, but the token becomes vulnerable to interception and replay attacks by attackers
Solution Approach 1:
The patent extracts the token generation function from the access point and assigns it to the client device. The client generates the anti-clogging token locally using its private key and the access point's public key, then transmits only the token (not the private key or password) to the access point for verification. This extraction removes the vulnerability where the access point transmitted unencrypted tokens that could be intercepted and replayed by attackers.
Solution Approach 2:
The patent changes the cryptographic parameters used in token generation. Instead of using symmetric encryption where the access point generates and transmits tokens, the system uses asymmetric cryptography (Elliptic Curve Cryptography) where the client generates tokens using its private key and the access point's public key. This parameter change ensures that only the legitimate client can generate valid tokens, preventing replay attacks while maintaining ease of authentication.
2Reliability
If the access point generates and transmits the anti-clogging token, then the client can authenticate, but attackers can intercept and replay the token causing resource exhaustion
Solution Approach 1:
The patent introduces cryptographic keys as intermediaries in the authentication process. The client's private key and the access point's public key serve as secure intermediaries that enable the client to generate tokens without the access point needing to transmit sensitive information. The token itself acts as an intermediary proof of authentication that cannot be replayed by attackers since it is generated cryptographically from the client's private key.
Solution Approach 2:
The patent uses cryptographic copying where the client creates a token that is a cryptographic copy of the authentication proof. The token is generated by the client using its private key and the access point's public key, creating a unique cryptographic copy that proves authentication without exposing the actual private key or password. This cryptographic copy cannot be replicated by attackers, preventing resource exhaustion from replay attacks.
3Ease of manufacture
If a traditional anti-clogging mechanism is used where the access point transmits tokens, then implementation is simple, but the mechanism is vulnerable to attacks lacking password protection
Solution Approach 1:
The patent replaces the mechanical system of token transmission (where the access point generates and sends tokens) with a cryptographic system. The client device uses Elliptic Curve Cryptography to generate tokens locally, substituting the mechanical token transmission approach with a cryptographic proof-of-authentication approach. This substitution maintains implementation feasibility while dramatically improving security against attacks.
Data Source
AI summary
A secure Simultaneous Authentication of Equals (SAE) anti-clogging mechanism may be provided. A public key of an access point may be provided from the access point to a client attempting to connect with a network via the access point. The access point may receive from the client a first anti-clogging token and a public key of the client. The first anti-clogging token may be generated by the first client using a shared secret based on a private key of the client and the public key of the access point and a multiplier. The access point may generate a second anti-clogging token using a shared secret based on a private key of the access point and the public key of the client and the multiplier. The access point may then verify the first anti-clogging token and the second anti-clogging token match to authenticate the client.