Secure Network Provisioning via Shared-Key Device Pairing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network connection methods are vulnerable to security breaches, allowing attackers to intercept and exploit network configuration information, compromising user privacy.
Innovation Solution
A network connection method involving a terminal and a to-be-accessed device that generates a key pair, shares a public key, and encrypts network configuration information with a shared key, ensuring only the intended device can decrypt and access the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network configuration information is transmitted in plaintext during terminal-to-device communication, then the connection establishment process is simple and fast, but the security of network configuration information is compromised and vulnerable to interception by attackers
Solution Approach 1:
The patent applies preliminary action by pre-generating key pairs on both the terminal and to-be-accessed device before the actual network configuration transmission. The terminal generates a first key pair and the to-be-accessed device generates a second key pair in advance, storing them securely. When connection is needed, these pre-established keys are used to encrypt/decrypt network configuration information, eliminating the need for complex real-time key generation and exchange protocols during the critical data transmission phase.
Solution Approach 2:
The patent uses public keys as intermediaries to enable secure communication without directly sharing private keys or sensitive network configuration information. The terminal encrypts network configuration information using the to-be-accessed device's public key, and the to-be-accessed device decrypts it using its private key. This intermediary mechanism allows secure information exchange while maintaining simplicity in the overall process.
2Object-affected harmful factors
If traditional WiFi hotspot connection methods are used without encryption, then the connection process is straightforward and compatible with existing systems, but attackers can intercept and steal network configuration information such as WiFi passwords
Solution Approach 1:
The patent implements self-service by enabling each device (terminal and to-be-accessed device) to autonomously generate its own key pair and manage its own cryptographic operations. The terminal independently encrypts network configuration information using the to-be-accessed device's public key, and the to-be-accessed device independently decrypts it using its private key. This self-service approach provides strong security protection without requiring complex external key management infrastructure or additional user operations.
3Reliability
If network configuration information is shared openly for easy device access, then device compatibility and ease of connection are improved, but user privacy and network security are compromised
Solution Approach 1:
The patent applies local quality by providing different levels of information access to different parties. The network configuration information is encrypted specifically for the intended to-be-accessed device using its unique public key, making it unreadable to any other device or attacker. The to-be-accessed device alone possesses the corresponding private key to decrypt and access the information. This localized security approach protects user privacy while maintaining compatibility, as each device receives information tailored to its specific cryptographic identity.
Data Source
AI summary
A network connection method is performed by a terminal, and the method comprises: establishing a pre-connection with a to-be-accessed device, and the to-be-accessed device being a device to access network; generating a first key pair, and sending a first public key In the first key pair to the to-be-accessed device; generating a first shared key based on the first key pair and first key negotiation information corresponding to the to-be-accessed device; encrypting network configuration information of a network device by using the first shared key, to obtain encrypted network configuration information; and sending the encrypted network configuration information to the to-be-accessed device, to allow the to-be-accessed device to decrypt the encrypted network configuration information by a second shared key, and access the network device based on the decrypted network configuration information.