WLAN Access Control via Encrypted Network Information Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional wireless local area networks (WLANs) face security issues such as unauthorized device connections, inability to differentiate between authorized and unauthorized users, limited access control, and inefficient power management due to active scanning, which compromises network security and management, especially in large-scale deployments.
Innovation Solution
A method and system that utilize an Encrypted Network Access Information (ENAI) file shared between a network administration device and a communication device, which includes user authentication requirements and access duration criteria, enabling secure and controlled access to the WLAN through biometric or password-based authentication, and optimizing scanning based on location to prevent unnecessary power consumption and data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the NAI is shared with the user over a secure channel, then the user can connect to the WLAN, but the authorized user is not prevented from connecting unauthorized devices to the WLAN
Solution Approach 1:
The patent segments the NAI into multiple components (network identifier, authentication credentials, device identifier, encryption key) and distributes them across different storage locations (secure element, file system, registry) with different access controls. This segmentation prevents unauthorized devices from obtaining complete access credentials even if one component is compromised.
Solution Approach 2:
The patent introduces a supplicant as an intermediary component that mediates between the user's device and the WLAN access point. The supplicant manages the segmented NAI components, performs authentication operations, and controls device connections based on policy rules, thereby preventing unauthorized devices from connecting while allowing authorized users to connect their devices.
2Reliability
If the NAI is provided to the user after verifying the identity, then the user can access the WLAN, but the ability to control the duration for which the user has access is limited
Solution Approach 1:
The patent performs preliminary actions by embedding access duration limits, time windows, and revocation policies directly into the NAI during the initial authentication process. The network administrator can specify valid-from and valid-until timestamps, and the supplicant automatically enforces these time-based constraints without requiring ongoing manual management or complex policy updates.
Solution Approach 2:
The patent changes the NAI from a static credential to a dynamic parameter set that includes time-based validity periods, device-specific identifiers, and conditional access rules. These parameters can be modified by the network administrator to control access duration, time windows, and device-specific permissions, enabling flexible access control without increasing system complexity.
3Ease of operation
If the user's client device scans for saved WLANs periodically, then the device can identify and connect to WLANs, but private information associated with the user may be leaked
Solution Approach 1:
The patent applies local quality by encrypting the network identifier portion of the NAI and storing it in a secure element or protected storage area that is inaccessible to applications and other processes. Only the supplicant, which holds the decryption key, can access and use this encrypted identifier for scanning and connection operations, thereby preventing privacy leakage while maintaining automatic connection functionality.
4Speed
If the user's client device scans for saved WLANs continuously, then the device can quickly connect to WLANs, but power consumption increases
Solution Approach 1:
The patent implements periodic action by having the supplicant scan for WLANs at scheduled intervals rather than continuously. The scanning operation is triggered periodically based on time-based policies or event-driven conditions (such as user request or location changes), reducing power consumption while still enabling timely connection to authorized networks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for providing a communication device access to a Wireless Local Area Network (WLAN) is disclosed. The method includes receiving, by a communication device, an Encrypted Network Access Information (ENAI) file from a network administration device, wherein the ENAI file comprises the network access information for the wireless local area network and user authentication requirement criteria. The ENAI file is decrypted to retrieve the network access information and the user authentication requirement criteria. A user authentication input is received to satisfy the user authentication requirement criteria. Thereafter, the communication device is provided access to the WLAN using the network access information, when the user authentication input satisfies the user authentication requirement criteria.