Wireless Station Pre-Authentication for Roaming Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless networking protocols, such as IEEE 802.11i, incur significant delays and increased traffic due to the need for multiple messages during roaming, and lack effective safeguards against replay attacks when a wireless station switches to a new access point.
Innovation Solution
Implementing a pre-authentication method where a wireless station increments its rekey number and pre-authenticates with neighboring access points before roaming, using a two-way handshake to establish a new secure session, thereby reducing messaging overhead and protecting against replay attacks by ensuring the rekey number is only used once.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a wireless station uses the IEEE 802.11i protocol for authentication during roaming, then security is improved through mutual authentication and key establishment, but the roaming delay increases due to the requirement of exchanging eight messages
Solution Approach 1:
The patent performs authentication and key establishment in advance before the wireless station actually roams. The station pre-authenticates with potential target access points and pre-establishes security keys while still connected to the current access point. This preliminary action eliminates the need for time-consuming authentication exchanges during the actual roaming event, thus reducing roaming delay while maintaining security.
Solution Approach 2:
The patent introduces a key distribution center as an intermediary entity that facilitates the pre-authentication process. The KDC acts as a trusted mediator that distributes pre-authentication keys to both the wireless station and potential target access points, enabling fast roaming without direct complex authentication exchanges between the station and multiple access points during roaming.
2Speed
If a wireless station pre-authenticates with multiple neighboring access points, then roaming speed is improved, but the initial authentication overhead and network traffic increase
Solution Approach 1:
The patent applies local quality by making pre-authentication selective rather than universal. The wireless station identifies and pre-authenticates only with specific neighboring access points that are geographically relevant or likely to be the next target, rather than all possible access points. This localized approach reduces unnecessary authentication traffic while maintaining fast roaming capability for relevant scenarios.
3Productivity
If the rekey number is forwarded to the new parent access point during roaming, then authentication efficiency is improved, but the system becomes vulnerable to replay attacks
Solution Approach 1:
The patent makes the rekey number dynamic and time-sensitive rather than static. The rekey number changes with each authentication cycle and is validated against the current time or sequence. This dynamic approach ensures that even if a rekey number is captured, it cannot be replayed successfully as it will have expired or been superseded by a newer value, thus preventing replay attacks while maintaining authentication efficiency.
Solution Approach 2:
The patent applies preliminary anti-action by implementing replay detection mechanisms that anticipate and counteract replay attacks before they can succeed. The system pre-validates the freshness and authenticity of rekey numbers through timestamps, sequence counters, or cryptographic proofs of liveness, rejecting any rekey numbers that show signs of being replayed rather than freshly generated, thus neutralizing the threat before it can compromise security.
Data Source
AI summary
A wireless station prepares to roam by pre-authenticating itself with a neighboring access point. The wireless station sends a rekey request, which can include an incremented rekey number. The wireless station receives a rekey response. The rekey response can include the incremented rekey number. Because the wireless station is pre-authenticated, after it roams it only needs to perform a two-way handshake with a new access point to establish secure communications with the new access point. The two-way handshake starts by the wireless station sending a reassociation request to the neighboring access point, the reassociation request comprising the incremented rekey number established during pre-authentication. The wireless station receives a reassociation response from the neighboring access point. To protect against replay attacks, the neighboring access point can verify the rekey number sent in the reassociation request matches the rekey number sent in the rekey response.