WLAN Access Point Forwarding Control Based on PSK Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless networks face inefficiencies in managing access and forwarding of encrypted data due to the use of a single pre-shared key (PSK) for all stations, leading to unnecessary network resource utilization and delivery of content to devices that cannot decrypt it, especially when data is transmitted between networks with different encryption techniques.
Innovation Solution
Implementing a system where access points check the association of the pre-shared key (PSK) used for encryption with the destination device before forwarding data, allowing access control based on key association records maintained by management nodes or access points, and using different encryption keys for final delivery when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end to end encryption is used to secure data transmission, then security is improved by requiring destination devices to have the decryption key, but network resources are wasted transmitting encrypted data to unauthorized devices
Solution Approach 1:
The access point performs preliminary access control verification before forwarding encrypted data. It checks whether the destination device is authorized to receive data encrypted with a specific PSK by verifying key association in its database. This preliminary action prevents unauthorized devices from receiving encrypted traffic, eliminating the need to transmit data that would be undecryptable and thus preventing network resource waste.
Solution Approach 2:
The access point acts as an intermediary between the source and destination devices. It maintains a database of key associations and uses this information to control data forwarding. The access point verifies whether the destination device is associated with the PSK used to encrypt the data before allowing transmission, thereby enforcing security policies and preventing resource waste on unauthorized deliveries.
2Ease of operation
If a single PSK is used for all stations on the WLAN, then ease of operation is improved with simplified key management, but security is reduced as all devices share the same key
Solution Approach 1:
The system segments the key management space by creating multiple PSKs for different user groups or individuals while maintaining a single PSK for basic network access. The access point stores key association information that maps specific PSKs to specific devices or user groups. This segmentation allows fine-grained access control where data can be encrypted with a specific PSK that only authorized devices possess, thereby improving security while maintaining operational simplicity through automated key management.
Solution Approach 2:
The access point serves multiple functions: it acts as a standard wireless access point for basic connectivity using a single PSK, and simultaneously functions as a security policy enforcement point by maintaining key association databases and controlling data forwarding based on PSK verification. This multi-functionality allows the system to support both simplified operation (single PSK for access) and enhanced security (multiple PSKs for data protection) within the same infrastructure.
3Reliability
If multiple PSKs are implemented for different users, then security is improved with per-user encryption, but device complexity increases with multiple key management requirements
Solution Approach 1:
The access point automatically manages multiple PSKs and their associations with devices without requiring manual intervention. When a device associates with the network, the access point automatically learns which PSK the device uses and stores this key association information in its database. This self-service capability eliminates the need for manual key distribution and management, thereby reducing operational complexity while maintaining per-user security through multiple PSKs.
Solution Approach 2:
The system implements feedback mechanisms where the access point monitors and learns about PSK usage patterns. When data is received from a source device, the access point checks its database to determine which PSK was used for encryption and whether the destination device is associated with that PSK. This feedback loop enables automated security policy enforcement, reducing the complexity of managing multiple PSKs by allowing the system to automatically make forwarding decisions based on learned key associations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and apparatus for controlling access to and/or forwarding of communicated information, e.g. traffic, in a wireless communication system are described. The key, e.g., PSK, used to secure data that is transmitted to an access point for communication to a destination device is taken into consideration when deciding whether or not to provide the destination device access to the communicated content. The decision of whether or not to provide the destination device access to a communication may involve deciding whether or not to forward the received data to another device, e.g., another access point, for delivery to the destination device and/or may involve deciding whether or not to transmit the data to the destination device. If the destination device is not associated with, e.g., does not have access to and/or authorization to use, the key used to secure the received data, the data is not communicated to the destination device.