Secure WiFi Connection via Out-of-Band Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing WiFi Protected Setup (WPS) configuration mechanism has a security vulnerability that allows attackers to steal WiFi resources by obtaining the PIN through offline exhaustive attacks, as they can decrypt the nonce and determine the PIN hash values, leading to unauthorized access.
Innovation Solution
A method that securely obtains a public key estimated value out-of-band and uses asymmetric encryption to establish a secure connection, preventing attackers from obtaining the correct public key and thus preventing PIN extraction, by encrypting the asymmetric encryption public key and key-exchange public key information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If WPS authentication uses only a PIN for network access, then the operation of wireless security setup is simplified, but the security is compromised as attackers can steal WiFi resources by obtaining the PIN through offline exhaustive attacks
Solution Approach 1:
The patent segments the authentication process into multiple independent components: out-of-band public key exchange, asymmetric encryption for key protection, and PIN-based authentication. This segmentation ensures that compromise of one component (PIN) does not lead to complete system compromise, as the asymmetric encryption layer remains secure.
Solution Approach 2:
The patent performs preliminary asymmetric key exchange and encryption setup before the actual authentication process. The asymmetric encryption public key is exchanged and stored securely in advance, creating a protective layer that prevents offline exhaustive attacks on the PIN, as attackers cannot decrypt authentication data without the private key.
2Device complexity
If DH public keys are exchanged by using plaintexts, then the key exchange process is simplified, but attackers can intercept and use these keys to establish unauthorized secure connections
Solution Approach 1:
The patent introduces asymmetric encryption as an intermediary layer between the DH key exchange and the authentication process. The asymmetric encryption public key acts as a mediator that protects the DH public key during transmission, allowing simplified plaintext exchange while preventing attacker interception and misuse.
Solution Approach 2:
The patent applies preliminary protective measures by encrypting DH public keys with asymmetric encryption before transmission. This preliminary anti-action prevents attackers from intercepting and misusing the keys, as the encryption renders intercepted data useless without the corresponding private key.
3Loss of time
If the asymmetric encryption public key is transmitted without protection, then the authentication process is faster, but attackers can obtain and misuse the key to decrypt communications
Solution Approach 1:
The patent merges the DH key exchange and asymmetric encryption key transmission into a single integrated process. Both public keys are exchanged together in the same authentication sequence, maintaining efficiency while the asymmetric encryption layer provides inherent protection against key misuse, as the encryption and decryption operations are tightly coupled with the authentication flow.
Data Source
AI summary
A method includes: securely obtaining, by a first device, a first public key estimated value of a second device in an out-of-band manner; encrypting an asymmetric encryption public key by using the first public key estimated value; sending the encrypted asymmetric encryption public key to the second device; receiving an encrypted first key-exchange public key sent by the second device; decrypting the encrypted first key-exchange public key by using an asymmetric encryption private key; performing an operation based on the decrypted first key-exchange public key, to obtain a second public key estimated value; and when the first public key estimated value is consistent with the second public key estimated value, determining that the decrypted first key-exchange public key is correct, generating a shared key by using a key-exchange private key and the first key-exchange public key, and establishing a secure connection to the second device by using the shared key.