Variable Authentication Identifier for AP Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access points (APs) in wireless local area networks (WLANs) face privacy concerns as their Service Set Identifiers (SSIDs) can be tracked, allowing devices to identify and locate APs, compromising user privacy.
Innovation Solution
Implementing a variable authentication identifier (AID) instead of a static SSID, using a token-based system where probe requests and responses include a variable AID generated using a shared secret key, allowing APs to remain private while still being authenticated by associated stations (STAs).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a static SSID is used to identify an access point, then authentication and network identification are simplified, but the access point becomes trackable and user privacy is compromised
Solution Approach 1:
The patent implements a dynamic identifier system where the SSID is replaced with a variable AID that changes periodically or per authentication session. This dynamic approach maintains authentication functionality while preventing tracking, as the identifier is no longer static but evolves over time based on authentication state and session parameters.
Solution Approach 2:
The system changes the fundamental parameter of the identifier from static to variable, and from persistent to ephemeral. The AID is derived from dynamic parameters including timestamps, random nonces, and authentication state, transforming the identifier into a time-sensitive, state-dependent value that cannot be used for long-term tracking.
2Object-affected harmful factors
If a variable AID is used instead of a static SSID, then privacy is protected and tracking is prevented, but authentication complexity increases
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using tokens and challenge-response protocols. Instead of directly using complex variable AIDs for identification, the system uses tokens as intermediaries that encapsulate authentication state, allowing the variable AID to be generated and validated through a structured intermediary process that manages complexity.
Solution Approach 2:
The system performs preliminary authentication actions by establishing tokens and shared secrets before the actual authentication exchange. These preliminary actions pre-compute and store necessary authentication parameters, so that during the actual authentication process, the variable AID can be generated and verified efficiently without real-time complex computations.
3Reliability
If tokens and variable AIDs are used in probe requests and responses, then secure authentication is achieved, but communication overhead and processing time increase
Solution Approach 1:
The patent performs preliminary setup of tokens and shared authentication parameters during initial association or provisioning phases. This pre-computation allows subsequent authentication exchanges using variable AIDs to be faster, as the heavy cryptographic operations are performed in advance rather than during each probe request/response cycle.
Solution Approach 2:
The system uses partial authentication information in probe requests and responses, exchanging only the necessary variable AID and token verification data rather than complete authentication credentials. This partial action approach maintains security while reducing the amount of data transmitted and processed during each authentication exchange.
Data Source
AI summary
This disclosure provides methods, devices and systems for using a pseudonym service set identifier (pSSID) for access point (AP) and station (STA) privacy. For example, a pSSID is included by a STA or AP in place of a persistent SSID for over the air communications used for various functions (such as for the STA to determine the SSID of the AP before connecting to the AP). The pSSID is generated using a hash function that is defined at both the AP and the STA. An input to the hash function includes the SSID. Other inputs may include a temporary media access control (MAC) address of the device generating the pSSID, a time value associated with a time when the pSSID is generated, or a location value associated with a position measurement of the device generating the pSSID.