Wi-Fi Authentication Using Pairwise Keys to Prevent Password Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In existing Wi-Fi security protocols, all user equipment shares a single password, leading to increased risk of password compromise if one device's password is compromised, affecting all devices.
Innovation Solution
Implementing a method where a first device and an access point share a second password, and a second device shares a third password through a 4-way handshake, using a twin base password encrypted key exchange (TBPEKE) protocol to generate pairwise master keys with high entropy, enhancing resistance to rainbow table and side channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all user equipment shares a single password to access the AP, then ease of operation is improved, but security is worsened due to increased risk of password compromise
Solution Approach 1:
The patent segments the single shared password into multiple unique passwords, where each user equipment (UE) has its own dedicated password for authentication with the AP. This is achieved through the TBPEKE protocol which generates individual pairwise master keys (PMKs) for each UE-AP pair, eliminating the need for all UEs to share a common password while maintaining ease of access through automated key management.
Solution Approach 2:
The patent implements local quality by providing each UE with a customized authentication credential (unique password/PMK) tailored to its specific identity and relationship with the AP. Instead of a uniform shared password, each UE receives locally optimized security parameters through the TBPEKE key exchange, allowing personalized security while maintaining operational simplicity.
2Device complexity
If a single password is shared among multiple devices, then device complexity is reduced, but the risk of password compromise increases
Solution Approach 1:
The patent introduces the TBPEKE protocol as an intermediary mechanism that mediates between the AP and multiple UEs during the authentication process. This intermediary protocol automatically generates and distributes unique PMKs to each UE without requiring manual password management, thus reducing device complexity while eliminating the security vulnerability of shared passwords through cryptographic key isolation.
Solution Approach 2:
The patent changes the authentication parameter from a static shared password to dynamically generated pairwise master keys through the TBPEKE protocol. Each UE-AP authentication session uses unique cryptographic parameters (nonces, random values) that are exchanged during the key establishment process, transforming the security model from password-based to key-based authentication, thereby reducing complexity while enhancing security.
3Reliability
If unique passwords are assigned to each device for enhanced security, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service by enabling UEs to automatically obtain and manage their unique authentication credentials through the TBPEKE protocol without requiring manual intervention. Each UE autonomously participates in the key exchange process, generating its own PMK in conjunction with the AP, thereby achieving enhanced security through unique passwords while eliminating the complexity of manual password distribution and management.
Data Source
AI summary
This application provides a security authentication method and apparatus applied to Wi-Fi, to help prevent a password from being shared among a plurality of devices, and implement management of a second device by a first device. In the method, an access point AP receives a first password input by the first device, where the first password is a password preset before delivery; and when checking the first password by the AP succeeds, the AP obtains a second password shared between the AP and the first device, and performs a 4-way handshake with the first device based on the second password. The second password is a shared key between the first device and the AP. Then, the AP can receive a first request from the first device, and send a third password to the first device in response to the first request.