Patent Application
20160286390
The example embodiments relate generally to communication systems, and specifically to managing wireless device access within wireless networks.
A wireless local area network (WLAN) may be formed by one or more access points (APs) that provide a shared wireless communication medium for use by a number of wireless (e.g., client) devices. Each AP, which may correspond to a Basic Service Set (BSS), periodically broadcasts beacon frames to enable any client devices within wireless range of the AP to establish and/or maintain a communication link (e.g., a communication channel) with the WLAN.
In some WLANs, a first AP may be configured for use with one or more client devices via a common password or passphrase. For example, a password or passphrase may be entered (programmed) into the first AP. The client devices must then use the same password or passphrase to access the WLAN through the first AP. Adding a second AP to the WLAN may be a straightforward task by simply entering the current password or passphrase into the second AP. In contrast, securely removing the first AP from service may be difficult. For example, to de-authorize the first AP, the password or passphrase may be changed and entered into all the client devices as well as the second AP. Although the process of changing the password or passphrase may be time consuming and error prone, retaining the old password or passphrase may allow the WLAN to be easily compromised.
Accordingly, it is desirable to improve the management and configuration of the APs of the WLAN.
This Summary is provided to introduce in a simplified form a selection of concepts that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter.
In some aspects, a method of configuring an access point for use in a wireless network is disclosed. In accordance with example embodiments, a network manager may determine a public key of the access point and generate an access point certificate based, at least in part, on the public key of the access point. The network manager may transmit the access point certificate to the access point to establish communications between the access point and a plurality of wireless devices.
In another aspect, a wireless device is disclosed that may include a transceiver, a processor and a memory to store instructions that, when executed by the processor, causes the wireless device to: determine a public key of the access point, generate an access point certificate based, at least in part, on the public key of the access point, and transmit the access point certificate to the access point to establish communications between the access point and a plurality of wireless devices.
The example embodiments are illustrated by way of example and are not intended to be limited by the figures of the accompanying drawings.
Like reference numerals refer to corresponding parts throughout the drawing figures.
The example embodiments are described below in the context of WLAN systems for simplicity only. It is to be understood that the example embodiments are equally applicable to other wireless networks (e.g., cellular networks, pico networks, femto networks, satellite networks), as well as for systems using signals of one or more wired standards or protocols (e.g., Ethernet and/or HomePlug/PLC standards). As used herein, the terms “WLAN” and “Wi-Fi®” may include communications governed by the IEEE 802.11 family of standards, Bluetooth, HiperLAN (a set of wireless standards, comparable to the IEEE 802.11 standards, used primarily in Europe), and other technologies having relatively short radio propagation range. Thus, the terms “WLAN” and “Wi-Fi” may be used interchangeably herein. In addition, although described below in terms of an infrastructure WLAN system including one or more APs and a number of client devices, the example embodiments are equally applicable to other WLAN systems including, for example, multiple WLANs, peer-to-peer (or Independent Basic Service Set) systems, Wi-Fi Direct systems, and/or Hotspots.
In the following description, numerous specific details are set forth such as examples of specific components, circuits, and processes to provide a thorough understanding of the present disclosure. The term “coupled” as used herein means connected directly to or connected through one or more intervening components or circuits.
In addition, in the following description and for purposes of explanation, specific nomenclature is set forth to provide a thorough understanding of the example embodiments. However, it will be apparent to one skilled in the art that these specific details may not be required to practice the example embodiments. In other instances, well-known circuits and devices are shown in block diagram form to avoid obscuring the present disclosure. The example embodiments are not to be construed as limited to specific examples described herein but rather to include within their scopes all embodiments defined by the appended claims.
Each of the client devices 130(1)-130(n) and the smartphone 140 may be any suitable Wi-Fi enabled wireless device including, for example, a cell phone, personal digital assistant (PDA), tablet device, laptop computer, or the like. Each client device 130 and/or the smartphone 140 may also be referred to as a user equipment (UE), a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless communications device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, a client, or some other suitable terminology. For some embodiments, the client device 130 and/or the smartphone 140 may include one or more transceivers, one or more processing resources (e.g., processors and/or ASICs), one or more memory resources, and a power source (e.g., a battery). The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect to
The AP 110 may be any suitable device that allows one or more wireless devices to connect to a network (e.g., a local area network (LAN), wide area network (WAN), metropolitan area network (MAN), and/or the Internet) via the AP 110 using Wi-Fi, Bluetooth, or any other suitable wireless communication standards. For at least one embodiment, the AP 110 may include one or more transceivers, one or more processing resources (e.g., processors and/or ASICs), one or more memory resources, and a power source. In some embodiments, the AP 110 may also be any suitable Wi-Fi and network enabled device including, for example, a cell phone, PDA, tablet device, laptop computer, or the like. The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect to
For the AP 110, the client devices 130(1)-130(n), and the smartphone 140, the one or more transceivers may include Wi-Fi transceivers, Bluetooth transceivers, cellular transceivers, and/or other suitable radio frequency (RF) transceivers (not shown for simplicity) to transmit and receive wireless communication signals. Each transceiver may communicate with other wireless devices in distinct operating frequency bands and/or using distinct communication protocols. For example, the Wi-Fi transceiver may communicate within a 2.4 GHz frequency band and/or within a 5 GHz frequency band in accordance with the IEEE 802.11 specification. The cellular transceiver may communicate within various RF frequency bands in accordance with a 4G Long Term Evolution (LTE) protocol described by the 3rd Generation Partnership Project (3GPP) (e.g., between approximately 700 MHz and approximately 3.9 GHz) and/or in accordance with other cellular protocols (e.g., a Global System for Mobile (GSM) communications protocol). In other embodiments, the included transceivers may be any technically feasible transceiver such as a ZigBee transceiver described by a specification from the ZigBee specification, a WiGig transceiver, and/or a HomePlug transceiver described a specification from the HomePlug Alliance.
Before any one of the client devices 130(1)-130(n) can access any services and/or networks through the AP 110, the client devices 130(1)-130(n) and the AP 110 may be configured to communicate through one or more secure communication links. In some embodiments, a network manager 150 may aid and/or initiate the configuration of the AP 110 and the client devices 130(1)-130(n). In the example of
Each wireless device may have a public/private key pair. In some embodiments, the public/private key pair may be a Root Identity key pair (sometimes referred to as an identity key pair) and may be assigned (e.g., programmed) into a wireless device during manufacture. In other embodiments, the public/private key pair may be dynamically generated. For example, a wireless device may use a random number generator and/or may receive a random number seed to generate the public/private key pair.
For example, the AP 110 may include AP keys 111, client devices 130(1)-130(n) may include client device keys 131(1)-131(n) respectively, and the smartphone 140 may include smartphone keys 141. The AP keys 111 may include a public/private key pair of the AP 110, the smartphone keys 141 may include a public/private key pair of the smartphone 140, and the client device keys 131(1)-131(n) may include a public/private key pair of the respective client devices 130(1)-130(n). In addition, the network manager 150 may include a public Network Manager (NM) key 151 and a private NM key 152.
The network manager 150 may administer the WLAN 120 by generating signed certificates and distributing public keys associated with the wireless devices. The signed certificates and public keys may be used to establish secure communication links between the AP 110 and the client devices 130(1)-130(n). In some embodiments, the secure communication links may use public/private key encryption. Those skilled in the art will appreciate that public/private key encryption techniques may encrypt and decrypt messages between wireless devices such as the client devices 130(1)-130(n) and the AP 110. In some embodiments, other security mechanisms may be used in addition to, or alternately from the public/private key encryption described herein.
Configuration of the AP 110 may begin as the network manager 150 determines the public key of the AP 110. In some embodiments, the public key of the AP 110 may be determined in an out-of-band manner. For example, the smartphone 140 may include an optical device (e.g., camera) to scan labels and/or images. The AP 110 may include a label imprinted with a quick response (QR) code that may display the public key or may direct a scanning device to retrieve the public key from a remote device or service. Thus, the QR code may directly or indirectly provide the public key of the AP 110 to the network manager 150.
In other embodiments, other out-of-band methods may determine the public key of the AP 110. For example, a near field communication (NFC) link or a Bluetooth Low Energy (BLE) link may convey the public key of the AP 110 to the smartphone 140. Although only NFC links and BLE communication links are described herein, any other technically feasible communication link may be used.
The network manager 150 may generate an AP certificate 113 based, at least in part, on the public key of the AP 110. The AP certificate 113 may be signed with the private NM key 152. The signed AP certificate 113 may be provided to the AP 110 along with the public NM key 151. Thus, the AP 110 may store the public NM key 151 (as the public NM key 112) and the signed AP certificate 113. The AP 110 and the network manager 150 may establish a secure communication link based, at least in part, on the public NM key 151, the private NM key 152, and the AP certificate 113.
In parallel to, or in series with the configuration of the AP 110, the network manager 150 may determine the public keys of the client devices 130(1)-130(n). In some embodiments, the public keys may be also be determined in an out-of-band manner similar to as described above with respect to the AP 110. The network manager 150 may generate a public key list 153. The public key list 153 may include the public keys of the client devices 130(1)-130(n) and may be certified by the private NM key 152. The network manager 150 may provide the public key list 153 to the AP 110. The network manager 150 may also provide each client device 130(1)-130(n) with a copy of the public NM key 151 (stored as the public NM keys 132(1)-132(n)), respectively.
The AP 110 may use the public key list 153 to establish communication links between the AP 110 and each client device 130(1)-130(n). For example, the AP 110 may verify the public key list 153 using the public NM key 112. If the public key list 153 is verified, then the AP 110 may contact the client devices 130(1)-130(n) based on the public key list 153 and the AP 110 may present the AP certificate 113. The client devices 130(1)-130(n) may verify the AP certificate 113 and generate a shared Pairwise Master Key with each client device 130(1)-130(n) to establish a secure communications link. Thus, the AP 110 forms communication links based, at least in part, on the public key list 153.
Additional APs may be added to the WLAN 120 in a similar manner as described above with respect to the AP 110. To remove and/or de-authorize an AP, the network manager 150 may generate a de-authorization list 154. The de-authorization list 154 may include the public keys of the APs no longer permitted to function (e.g., denied to operate) within the WLAN 120. The de-authorization list 154 may be certified with the private NM key 152. The network manager 150 may provide the de-authorization list 154 to the AP 110. The AP 110 may verify and then distribute the de-authorization list 154 to the client devices 130(1)-130(n). Thereafter, connections and/or communications with APs included within the de-authorization list 154 are discontinued. Operations associated with configuring the WLAN 120 via the network manager 150 are described in more detail below in conjunction with
Next, the network manager 150 generates a signed AP certificate 113 based, at least in part, on the public key of the AP 110 (204). The AP certificate 113 may be signed with the private NM key 152. Next, the AP 110 receives the AP certificate 113 and the public NM key 151 (206). The AP certificate 113 may be presented to wireless devices as proof that the AP 110 is authorized to operate within the WLAN 120 by the network manager 150. The public NM key 151 may verify data, certificates, and/or lists provided by the network manager 150 or other wireless devices.
Next, the AP 110 and the network manager 150 generate a shared Pairwise Master Key (208a and 208b). For example, the network manager 150 and the AP 110 may exchange one or more messages using the public NM key 151 and the public key of the AP 110 to generate the shared Pairwise Master Key. In some embodiments, the AP 110 and the network manager 150 may use a well-known 4-way handshake algorithm to generate the shared Pairwise Master Key. The Pairwise Master Key may be used to establish a secure communication link between the AP 110 and the network manager 150.
Next, the network manager 150 determines the public keys of the client devices 130(1)-130(n) (210). The public keys of the client devices 130(1)-130(n) may be determined in an out-of-band manner as described above with respect to the AP 110. Next, the network manager 150 generates the public key list 153 (212). The public key list 153 may include the public keys of the client devices 130(1)-130(n). In some embodiments, the public key list 153 is signed by the private NM key 152.
Next, the client devices 130(1)-130(n) receive and store the public NM key 151 from the network manager 150 (214). As described above, the client devices 130(1)-130(n) may use the public NM key 151 to verify data, certificates, and/or lists received from other wireless devices. For example, the client devices 130(1)-130(n) may use the public NM key 151 to verify the AP certificate 113 signed with the private NM key 152. If the AP certificate 113 is successfully verified, then the information contained in the certificate may be trusted.
Next, the AP 110 receives the public key list 153 from the network manager 150 (216). The AP 110 may use the public keys in the public key list 153 to contact the client devices 130(1)-130(n). The public key list 153 may be transmitted and received through an encrypted communication link based, at least in part, on the Pairwise Master Key. Next, the AP 110 and each of the client devices 130(1)-130(n) generate a shared Pairwise Master key (218a and 218b). Each client device 130(1)-130(n) may be associated with a distinct Pairwise Master Key. In some embodiments, the AP 110 may transmit the public key of the AP 110 to the client devices 130(1)-130(n). The public key of the AP 110 may be signed with the private NM key 152. The client devices 130(1)-130(n) may verify the public key of the AP 110 with the public NM keys 132(1)-132(n). The Pairwise Master Key may be generated if the public key of the AP 110 is successfully verified. Next, the AP 110 and the client devices 130(1)-130(n) establish communication links using the shared Pairwise Master Key (220a and 220b).
In the example of
The second AP 320 may be added to the WLAN 120 by the network manager 150 in a similar manner as the first AP 310. The second AP 320 may include second AP keys 321 (e.g., a private/public key pair of the second AP 320). As the second AP 320 is configured to operate within the WLAN 120, the second AP 320 may store a copy of the public NM key 151 as a public NM key 322.
To de-authorize (e.g., remove from service) an AP from the WLAN 120, the network manager 150 may generate the de-authorization list 154. The de-authorization list 154 may include the public keys of the APs to de-authorize. The de-authorization list 154 may be distributed to wireless devices within the WLAN 120. The wireless devices may refuse connections to APs listed on the de-authorization list 154. Operations associated with adding the second AP 320 to the WLAN 120 and de-authorizing APs are described in more detail below in conjunction with
Next, the network manager 150 generates a second AP certificate based, at least in part, on the public key of the second AP 320 (404). The second AP certificate may be distinct from the AP certificate 113 described above with respect to
Next the second AP 320 and the network manager 150 generate a shared Pairwise Master Key (408a and 408b). For example, the network manager 150 and the second AP 320 may exchange one or more messages using the public NM key 151 and the public key of the second AP 320 to generate the shared Pairwise Master Key. The Pairwise Master Key may be used to establish a secure communication link between the second AP 320 and the network manager 150.
Next, the network manager 150 transmits the public key list 153 to the second AP 320 (410). As described above with respect to
Next, the second AP 320 and the client devices 130(1)-130(n) generate a shared Pairwise Master key (414). In some embodiments, the second AP 320 may present the second AP certificate to the client devices 130(1)-130(n) to prove that the second AP 320 is authorized to operate within the WLAN 120. The Pairwise Master Key may be generated if the second AP certificate is successfully verified. Next, the second AP 320 and the client devices 130(1)-130(n) establish communication links using the shared Pairwise Master key (416).
In some embodiments, one or more of the APs operating within the WLAN 120 may optionally be removed from service. For example, a new AP may be replacing an older AP; therefore, the older AP may be removed from the WLAN 120. The APs to be removed from service (e.g., de-authorized) may be identified by their associated public key. The optional operations are illustrated with dotted lines in
Operations to de-authorize one or more APs begin as the network manager 150 generates the de-authorization list 154 (418). The de-authorization list 154 may include the public AP keys corresponding to the APs that are to be removed from service. The de-authorization list 154 may be signed with the private NM key 152. The de-authorization list 154 may be transmitted to the second AP 320.
Next the second AP 320 may receive the de-authorization list 154 (420). The de-authorization list 154 may be verified with the public NM key 151 previously received by the second AP 320. The second AP 320 may block communications to APs that correspond to the public AP keys included in the de-authorization list 154. Next, the second AP 320 distributes the de-authorization list to the client devices 130(1)-130(n) (422). The client devices 130(1)-130(n) may also verify the de-authorization list 154 and block communications to the APs that correspond to the public AP keys included in the de-authorization list 154.
The transceiver 510 may include a baseband processor 512. The baseband processor 512 may process signals received from the processor 530 and/or the memory 540 and to transmit the processed signals via one or more of antennas 560(1)-560(n). Additionally, the baseband processor 512 may process signals received from one or more of antennas 560(1)-560(n) and forward the processed signals to the processor 530 and/or the memory 540.
The network interface 550 may access other networks and/or services. In some embodiments, the network interface 550 may include a wired interface. The network interface 550 may also communicate with a WLAN server (not shown for simplicity) either directly or via one or more intervening networks.
The processor 530, which is coupled to the transceiver 510, the network manager 520, the network interface 550, and the memory 540, may be any suitable one or more processors capable of executing scripts or instructions of one or more software programs stored in the wireless device 500 (e.g., within the memory 540). For actual embodiments, the transceiver 510, the processor 530, the memory 540, and/or the network interface 550 may be connected together using one or more buses (not shown for simplicity).
The memory 540 may include a certificate memory 542 to store certificates (e.g., the AP certificate 113). In some embodiments the certificates may be generated by the network manager 520 and/or a network manager software module 546 (described below).
The memory 540 may include a key memory 543 to store public, private, and/or shared keys. For example public and private keys associated with the wireless device 500 (e.g., a public/private key pair and/or a Pairwise Master Key) may be stored in the key memory 543. In some embodiments, the key memory 543 may store the public NM key 151 and the private NM key 152 (not shown for simplicity). In some embodiments, increased protection may be provided to the key memory 543 to safeguard sensitive keys, such as the private NM key 152.
The memory 540 may include a de-authorization list memory 544. The de-authorization list memory 544 may store the de-authorization list 154 (not shown for simplicity). In some embodiments, the de-authorization list 154 may be generated by the network manager 520 and certified by the private NM key 152.
The memory 540 may also include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, and so on) that may store at least the following software (SW) modules:
As mentioned above, the processor 530 may be any suitable one or more processors capable of executing scripts or instructions of one or more software programs stored in the wireless device 500 (e.g., within the memory 540). For example, the processor 530 may execute the transceiver controller software module 545 to facilitate the transmission and/or reception of data between the wireless device 500 and other wireless devices (not shown for simplicity).
The processor 530 may execute the network manager software module 546 to determine public keys associated with APs (e.g., the AP 110, the first AP 310, and/or the second AP 320) and/or the client devices 130(1)-130(n) (not shown for simplicity). The network manager software module 546 may also generate certificates (e.g., the AP certificate 113) and may sign the certificates with the private NM key 152. Further, the network manager software module 546 may generate the public key list 153 and the de-authorization list 154.
Those skilled in the art will appreciate that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.
Further, those of skill in the art will appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the disclosure.
The methods, sequences, or algorithms described in connection with the aspects disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor.
In the foregoing specification, the example embodiments have been described with reference to specific example embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader scope of the disclosure as set forth in the appended claims. The specification and drawings are, accordingly, to be regarded in an illustrative sense rather than a restrictive sense.
This application claims priority to U.S. Provisional Patent Application No. 62/139,489 entitled “FLEXIBLE AND SECURE NETWORK MANAGEMENT” filed Mar. 27, 2015, the entirety of which is incorporated by reference herein.
| Number | Date | Country | |
|---|---|---|---|
| 62139489 | Mar 2015 | US |
