Per-Device Wi‑Fi Credentialing for Private Differentiated Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional wireless networking methods lack differentiated user access control and user privacy, and existing per-device credentialing methods incur high costs or complexity.
Innovation Solution
A method involving a wireless device storing a per-device credential (PDC) that distinguishes it from others, exchanging elements with an access point (AP) to generate encryption keys, and transmitting a hashed PDC encrypted with a mutual key for authentication, using public key fingerprints to ensure trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Wi-Fi Enterprise Mode with EAP-TLS is used for per-device credentialing, then user privacy is protected through encrypted user identifiers, but the system incurs high costs due to AAA server requirements and complex public key configuration
Solution Approach 1:
The patent extracts the essential privacy-protection function from the complex EAP-TLS framework by using only hashed credentials without requiring full public key infrastructure. The AAA server requirement is eliminated while retaining the core benefit of encrypted credential transmission through a simplified hashing mechanism.
Solution Approach 2:
The patent replaces expensive, complex public key certificates with simple, computationally inexpensive hash values. These hashed credentials are lightweight, easy to transmit, and provide sufficient security for the authentication purpose without the overhead of full EAP-TLS implementation.
2Ease of operation
If a single password is used for user authentication in conventional wireless networking, then the system is simple to configure, but differentiated user access control and services cannot be provided
Solution Approach 1:
The patent segments the single password approach into individual per-device hashed credentials. Each device receives its own unique hash value that can be individually managed and differentiated, enabling fine-grained access control while maintaining the simplicity of password-based authentication without requiring complex certificate management.
3Ease of operation
If password identifiers are passed in clear text for SAE authentication, then the authentication process is simple, but user privacy is compromised
Solution Approach 1:
The patent applies preliminary hashing to the credential before transmission. By pre-hashing the device identifier or credential data using a secure hash function, the system maintains the simplicity of automated authentication exchange while ensuring that no readable user identifier is exposed during transmission, thus protecting privacy from the outset.
Data Source
AI summary
A method can include, by operation of a first wireless device, storing a per-device credential (PDC). Authentication data frames can be exchanged with an access point device (AP) to generate at least one encryption key. An expected fingerprint can be compared to a system fingerprint. A hash of the PDC can be transmitted in an association request frame. The expected fingerprint can be a result of a predetermined hashing operation executed on at least a portion of a service set identifier of the AP and a public key corresponding to the AP. Corresponding devices and systems are also disclosed.