Trusted Third Party WLAN Device Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional wireless local area network (WLAN) provisioning methods are cumbersome and insecure, relying on shared secrets that compromise authentication and data integrity, and require additional infrastructure like Public Key Infrastructure (PKI) for secure device provisioning.
Innovation Solution
The use of a trusted third party and signature-less public key cryptography to provision devices for secure WLANs, where each device generates a public/private key pair within a finite cyclic group, allowing for a unique pairwise shared secret to be derived through a Diffie-Hellman key exchange, eliminating the need for shared secrets and infrastructure like PKI.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional provisioning methods using shared secrets are used, then devices can join the wireless network, but security is compromised allowing impersonation and data integrity violations
Solution Approach 1:
The patent introduces a trusted third party (configurator device) as an intermediary that provisions devices with public keys and facilitates secure key exchange. This mediator enables devices to establish unique pairwise shared secrets without directly sharing secrets, resolving the security vulnerability while maintaining ease of provisioning through automated configuration.
Solution Approach 2:
The patent replaces the mechanical/shared secret-based authentication system with a cryptographic public key infrastructure. Instead of devices sharing a common secret key, each device generates its own public/private key pair, and authentication is performed through cryptographic protocols (Diffie-Hellman key exchange, digital signatures) that provide both security and automated provisioning.
2Reliability
If trusted third party authentication protocols are used, then device authentication and key certification are achieved, but additional infrastructure like Public Key Infrastructure is required
Solution Approach 1:
The patent extracts the essential authentication function from the complex Public Key Infrastructure and implements a simplified trusted third party model. The configurator device performs the necessary key certification and distribution functions without requiring a full PKI with certificate authorities, registration authorities, and certificate validation infrastructure, thereby achieving secure authentication with reduced complexity.
Solution Approach 2:
The patent changes the cryptographic parameters and protocols used in authentication. Instead of relying on traditional PKI with certificates and digital signatures requiring infrastructure, the system uses pre-shared public keys and simplified key exchange protocols that maintain security while reducing infrastructure requirements. The configurator pre-provisions devices with authentication credentials before deployment.
3Ease of operation
If shared secrets are used for network authentication, then all devices can authenticate to the network, but data integrity protection and source authentication are voided
Solution Approach 1:
The patent segments the authentication credentials so that instead of all devices sharing a common secret, each device has its own unique public key and derives its own pairwise shared secret with the access point through Diffie-Hellman key exchange. This segmentation enables both easy network access (through automated key exchange) and strong data integrity protection (through unique per-device authentication).
Data Source
AI summary
Before establishing a connection between a first and a second devices, the first device determines whether a third device is a trusted or untrusted device. If it is a trusted device, the first device receives from the third device a public key and information indicating the public key of the second device; and, uses the public key by combining its own private key and the public key of the second device to generate a shared secret, and using the shared secret to communicate to the second device. Otherwise, the first device refrains from communications with the third device. Also, the second device combines its private key with the public key of the first device received from the trusted third device to generate the same shared secret, and uses the shared secret to provision the first device to access a secured wireless network provided by the second device.