Secure Connection Establishment Using Pre-Generated Nonces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless communications systems face delays in establishing new connections due to the exchange of multiple messages between users and communications controllers, which can interrupt service, and the process of securing these connections further slows down the establishment of a secure link.
Innovation Solution
The method involves transmitting a communications system management message with an access point nonce and receiving a station nonce to determine a security key, which is used to secure the connection between the access point and station, reducing the number of messages exchanged and preventing nonce replay.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple messages are exchanged between user and communications controller to establish a new connection, then the connection establishment is secure and authenticated, but the connection establishment time increases and service interruption occurs
Solution Approach 1:
The access point pre-generates and stores multiple authentication credentials (PMKs) and their corresponding nonces before the station needs to connect. When a station associates, the access point can immediately select a valid credential pair without waiting for a full authentication exchange, thus establishing security in advance and reducing connection establishment time.
2Reliability
If additional messages are exchanged to perform authentication and session key agreement, then the connection is secured, but the connection establishment process is further delayed
Solution Approach 1:
The patent extracts the authentication and key agreement messages from the normal connection establishment flow. By separating these security functions into a pre-computed credential validation process, the main connection establishment can proceed quickly using only association messages, while security is ensured through the pre-validated credentials.
3Reliability
If nonces are exchanged for key generation, then replay attacks are prevented and security is enhanced, but the message exchange count increases
Solution Approach 1:
Instead of generating new nonces during connection establishment, the access point uses pre-generated nonce copies that are stored with each PMK. The station receives a selected nonce from the access point's credential list, eliminating the need for the station to generate and exchange its own nonce, thus reducing message count while maintaining replay attack prevention.
Data Source
AI summary
A method for establishing a secure connection between a station and an access point includes transmitting a communications system management message to the station, the communications system management message including an access point nonce. The method also includes receiving a station nonce from the station, and determining a first security key according to the access point nonce and the station nonce. The method further includes securing a connection between the station and the access point using the first security key.