Wi-Fi Authentication with Device-Specific Password Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Wi-Fi security protocols, all user equipment shares a common password, leading to increased password leakage risk as the compromise of one password compromises all devices.
Innovation Solution
Implementing a method where a first device and an AP share a second password, and a second device shares a third password with the AP, managed by the first device, to prevent password sharing among multiple devices and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If all user equipment shares a common password for Wi-Fi access, then ease of operation is improved, but security reliability deteriorates due to increased password leakage risk
Solution Approach 1:
The patent segments the common password into multiple device-specific passwords. Each user equipment is assigned a unique password derived from the common password through a key derivation function that incorporates device identifiers. This segmentation maintains ease of operation (users still access Wi-Fi with their device's password) while improving security (compromise of one device's password does not affect others).
Solution Approach 2:
The patent applies local quality by making each device's password unique rather than uniform. The password for each device is locally customized using device-specific identifiers (such as MAC addresses or device names) combined with the common password through cryptographic key derivation. This ensures that while all devices can access the network, each has its own secure credential, preventing lateral movement if one device is compromised.
2Device complexity
If a common password is shared among multiple devices, then device complexity is reduced, but vulnerability to attacks increases
Solution Approach 1:
The patent segments the single common password into multiple device-specific passwords using cryptographic key derivation. The access point stores the common password and derives individual passwords for each device using their unique identifiers. This maintains low device complexity (devices still use simple passwords) while reducing vulnerability to attacks (each device has its own secure credential that cannot be used to compromise other devices).
Solution Approach 2:
The patent implements preliminary action by pre-configuring device-specific passwords before devices connect to the Wi-Fi network. The access point derives and stores individual device passwords in advance using the common password and device identifiers. When devices connect, they authenticate using their pre-configured passwords, eliminating the need for complex real-time password generation while ensuring each device has its own secure credential from the outset.
3Loss of information
If one device's password is compromised, then loss of information occurs for all devices, but implementing device-specific passwords increases system complexity
Solution Approach 1:
The patent segments the password space so that each device has its own unique password derived from the common password through cryptographic key derivation using device-specific identifiers. This segmentation ensures that compromise of one device's password does not result in loss of information for other devices. The access point manages this segmentation centrally, deriving individual passwords on-demand using the common password and device identifiers, thereby limiting password leakage to individual devices while maintaining manageable system complexity.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
This application provides a security authentication method and apparatus applied to Wi-Fi, to help prevent a password from being shared among a plurality of devices, and implement management of a second device by a first device. In the method, an access point AP receives a first password input by the first device, where the first password is a password preset before delivery; and when checking on the first password by the AP succeeds, the AP obtains a second password shared between the AP and the first device, and performs 4-way handshake with the first device based on the second password. The second password is a shared key between the first device and the AP. Then, the AP can receive a first request from the first device, and send a third password to the first device in response to the first request, where the first request is used to request the second device to access the AP, and the third password is a shared key between the second device and the AP.