WLAN Access Point Authentication via Certificate Authority
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for authenticating wireless local area network (WLAN) access points (APs) are inadequate in protecting public users from rogue APs, as they require provisioning of public keys on client machines, which is impractical for public users, and do not provide positive identification of AP ownership.
Innovation Solution
A method and system using a trusted certificate authority (CA) to register AP operator identities, create authentication certificates, and provision both APs and clients with public keys, enabling secure verification of AP ownership through digital signatures and certificate validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key provisioning is required on client machines for mutual authentication, then authentication security is improved, but ease of operation deteriorates for public users
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary entity that issues authentication certificates to APs and distributes them to clients. This mediator enables mutual authentication without requiring clients to manually provision public keys, as the CA handles the certificate distribution and validation process automatically.
Solution Approach 2:
The system enables self-service authentication where clients automatically verify AP certificates against trusted CAs without manual intervention. The authentication process occurs automatically during network association, eliminating the need for users to manually configure authentication parameters while maintaining security.
2Reliability
If existing authentication protocols are used, then network access control is improved, but ability to identify AP ownership deteriorates
Solution Approach 1:
The authentication process is segmented into distinct components: the CA issues certificates to AP operators, clients verify certificates against trusted CAs, and the system separately identifies AP ownership through certificate validation. This segmentation allows independent optimization of access control and ownership identification functions.
Solution Approach 2:
The patent replaces manual or indirect AP identification methods with automated digital certificate validation. Clients use cryptographic verification to automatically identify and validate AP ownership, substituting manual processes with automated cryptographic mechanisms that provide precise ownership identification.
Data Source
AI summary
A method for authenticating an operator of an AP includes: registering the operator's identity with a CA, by providing the operator's identification information and public key; creating a certificate including the foregoing; signing the certificate with the CA's private key; provisioning the AP with the signed certificate; provisioning a client with the CA's public key; sending a request from the client to the AP; generating a signature with the operator's private key; returning a reply to the client, including the AP provisioned certificate signed with the generated signature; using the client provisioned CA's public key to obtain the operator's public key from the certificate received in the reply; and, using the operator's public key obtained from the certificate received in the reply to verify the signature generated with the operator's private key and used by the AP to sign the certificate received in the reply.