Wi-Fi Roaming Key Mapping for Randomized MAC Addresses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication technologies face challenges in facilitating seamless roaming within a Seamless Mobility Domain (SMD) due to the adoption of randomized Media Access Control (MAC) addresses, which hinder the target Access Point (AP) from identifying stations (STAs) and retrieving the correct pairwise transient key (PTK) for secure roaming without full reauthentication.
Innovation Solution
The solution involves using identifiable random MAC (IRM) addresses, Device IDs, or distribution system (DS) MAC addresses as stable identifiers in roaming requests, allowing target APs to recognize STAs and retrieve corresponding PTKs, either through shared PTKs or AP-specific PTKs, enabling secure and seamless roaming without full reauthentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If randomized MAC addresses are used for security purposes, then security is improved, but the target AP cannot identify the STA and retrieve the correct PTK
Solution Approach 1:
The MAC address functionality is segmented into two distinct components: a randomized MAC address for security/privacy protection during data transmission, and a separate stable identifier (such as a random identifier or IRM address) for STA identification and PTK retrieval during roaming. This segmentation allows each component to fulfill its specific function without interfering with the other.
Solution Approach 2:
A stable identifier acts as an intermediary between the randomized MAC address and the PTK retrieval process. When a STA roams to a target AP, the stable identifier is included in the roaming request, enabling the target AP to retrieve the correct PTK without exposing or relying on the randomized MAC address, thus maintaining both security and identification capability.
2Reliability
If full reauthentication is performed during roaming, then security is maintained, but roaming time and network performance deteriorate
Solution Approach 1:
The stable identifier is established and registered with the target AP before the actual roaming event occurs. This preliminary action enables the target AP to have the STA's identification information ready in advance, so when roaming occurs, the AP can immediately retrieve the correct PTK using the stable identifier without needing to perform full reauthentication, thus reducing roaming time while maintaining security.
3Measurement precision
If stable identifiers are transmitted in clear text for identification, then identification accuracy is improved, but security deteriorates
Solution Approach 1:
The stable identifier serves as an intermediary that enables accurate STA identification without requiring the transmission of sensitive information in clear text. The identifier allows the target AP to retrieve the correct PTK through a secure lookup process, maintaining identification accuracy while avoiding security risks associated with clear-text transmission of MAC addresses or other sensitive identifiers.
Data Source
AI summary
The present disclosure provides techniques for client device roaming using randomized media access control (MAC) addresses in enhanced data privacy (EDP) operation. A first access point (AP) in a seamless mobility domain (SMD) exchanges a message as part of an initial association process with a station (STA) in the same SMD, the message comprising an identifier of the STA. The first AP establishes a first pairwise transient key (PTK) with the STA, and generates a first PTK mapping that associates the first PTK with the identifier of the STA.