Patent Application
20070254614
In any of the examples herein, a wireless computing network can be a wireless network based on the IEEE 802.11 standards, such as 801.11 a, 802.11b, 802.11g, 802.11n, etc. A wireless network based on the IEEE 802.11 standards can also be referred to as a WI-FI wireless network (Wi-Fi is a registered trademark of the Wi-Fi Alliance).
A wireless computing network can comprise various components. A wireless computing network can include wireless network adapters. For example, wireless network adapters can include wireless cards (e.g., WI-FI cards) in computers, PDAs, cell phones, smart phones, or other computing devices. Wireless network adapters can be built-in (e.g., a PDA with built-in, or integrated, wireless capability) or added (e.g., a laptop with a wireless network adapter card).
A wireless computing network can operate in infrastructure mode or ad-hoc mode. For example, a wireless network operating in infrastructure mode can comprise one or more access points and one or more client wireless devices connected to the access points. A wireless network operating in ad-hoc mode can comprise one or more wireless network devices connected in a peer-to-peer arrangement.
Secure connections can be established within a wireless computing network by broadcasting wireless security parameters within service set identifier (SSID) fields (broadcast in the SSID frame field of the beacon frame). For example, standard wireless access points and standard client wireless devices can include custom software and/or firmware to encrypt/decrypt wireless security parameters from broadcast SSIDs. Secure connections can also be established within a wireless computing network by broadcasting wireless security parameters and connection SSIDs within SSID fields. For example, standard wireless access points and standard client wireless devices can include custom software and/or firmware to encrypt/decrypt wireless security parameters and connection SSIDs from broadcast SSIDs.
In an infrastructure wireless network, access points (e.g., standard 802.11 access points) that include custom software and/or firmware (e.g., special-purpose access points) can encrypt wireless security parameters (e.g., alone or with connection SSIDs used to establish connections) to create broadcast SSIDs which can then broadcast, by the access points, as SSID values in SSID fields of beacon frames. The access points can then establish secure connections with client wireless devices that have received and decrypted the wireless security parameters (e.g., alone or with connection SSIDs).
In an ad-hoc wireless network, wireless devices (e.g., wireless devices comprising standard 802.11 wireless network adapters) that include custom software and/or firmware can encrypt wireless security parameters (e.g., alone or with connection SSIDs used to establish connections) to create broadcast SSIDs which the wireless devices can then broadcast as SSID values in SSID fields of beacon frames. The wireless devices can then establish secure connections with other wireless devices that have received and decrypted the wireless security parameters (e.g., alone or with connection SSIDs).
By encrypting wireless security parameters, alone or along with connection SSIDs, and broadcasting the encrypted information in SSID fields, wireless devices can quickly and easily establish secure wireless connections (e.g., when operating in ad-hoc mode). For example, both broadcasting and receiving wireless devices can be configured with corresponding encryption/decryption algorithms (e.g., using the same encryption key). If a wireless security parameter changes (e.g., a new WEP key or WPA-PSK is used), the new wireless security parameter can be broadcast in encrypted form in the broadcast SSID. Wireless devices receiving the broadcast SSID can decrypt the new wireless security parameter if the wireless devices have been configured with the decryption algorithm (e.g., along with the encryption key).
In any of the examples herein, a wireless network zone can be a zone created by a wireless device. For example, a wireless network zone can be an area (e.g., a physical or geographic area) related to the communication range of a wireless adapter of the wireless device. For example, a wireless network adapter can have a range within which it can communicate with other wireless network adapters.
In any of the examples herein, a wireless device can be a computing device that is capable of wireless communication within a wireless computing network. For example, a wireless device can be a computing device such as a computer (e.g., a laptop, desktop, or tablet computer), a PDA, a mobile communications device (e.g., a cell phone or a smart phone), or another type of computing device with a built-in or add-on wireless network adapter (e.g., an 802.11 or WI-FI wireless network adapter). For example, a wireless device can be a laptop or PDA with an 802.11b or 802.11g wireless network adapter. Wireless devices can be mobile or stationary.
A wireless device can operate in infrastructure mode (e.g., a wireless network comprising access points and connected wireless devices) or ad-hoc mode (e.g., a number of wireless devices connected in a peer arrangement).
A wireless device can broadcast an SSID (e.g., a broadcasting wireless device). For example, a wireless device can broadcast an SSID comprising an encrypted wireless security parameter or comprising an encrypted wireless security parameter and connection SSID. A wireless device can be configured to automatically broadcast a broadcast SSID.
A wireless device can receive a broadcast SSID (e.g., a client wireless device). For example, the wireless device can receive the broadcast SSID, decrypt a wireless security parameter (and optionally a connection SSID), and use the decrypted information to establish a secure wireless connection.
A wireless device can comprise various wireless modules. For example, a wireless device, such as a wireless computing device, can comprise a wireless module (e.g., comprising hardware, software, or a combination) configured to perform various activities related to transmitting and/or receiving wireless communications (e.g., generating broadcast SSIDs, broadcasting broadcast SSIDs, encrypting and/or decrypting broadcast SSIDs, etc.).
In any of the examples herein, SSID fields can be used for broadcasting encrypted information. The SSID field is a field of the 802.11 beacon frame (the beacon frame subtype of the management frame type). According to the 802.11 specification, the SSID field of the beacon frame identifies a wireless network. The SSID field contains up to 32 bytes of data.
Instead of broadcasting a standard SSID value in the SSID field, other types of information can be broadcast in the SSID field. For example, a wireless security parameter can be encrypted and the encrypted wireless security parameter can then be broadcast, as an SSID value, in the SSID field (e.g., taking the place of a standard SSID value). A wireless security parameter along with a connection SSID can also be encrypted and broadcast, as an SSID value, in the SSID field (e.g., taking the place of a standard SSID value). An SSID (e.g., SSID value) comprising encrypted information (e.g., an encrypted wireless security parameter or a combination of an encrypted wireless security parameter and connection SSID) can be called a broadcast SSID (e.g., a broadcast SSID value).
A broadcast SSID containing encrypted information can appear (e.g., to a wireless device or user receiving the broadcast SSID) to be no different from a standard (e.g., non-encrypted) SSID value.
In any of the examples herein, information can be encrypted and broadcast in SSID fields. Encryption refers to obscuring information in order to make the information difficult to decipher without special knowledge. Information can be encrypted using various encryption algorithms or functions, including cipher algorithms and steganographic techniques. Information that has been encrypted can be decrypted using a corresponding decryption algorithm. Some encryption/decryption algorithms require the use of an encryption key that is used to encrypt and decrypt the information. Other encryption/decryption algorithms do not require the use of an encryption key.
Encryption can be used to obscure wireless network connection information (e.g., wireless security parameters and/or connection SSIDs) so that unauthorized wireless devices cannot connect to the wireless network. For example, encryption can be used to obscure wireless security parameters, which can be broadcast as broadcast SSIDs. Encryption can also be used to obscure combinations of wireless security parameters and connection SSIDs, which can also be broadcast as broadcast SSIDs.
A simple encryption algorithm can be used to encrypt/decrypt wireless network connection information. For example, in a specific implementation, a wireless device accepting secure wireless connections implements a simple encryption algorithm that reverses the characters of a wireless security parameter to create an encrypted wireless security parameter, and uses the encrypted wireless security parameter as the broadcast SSID. A wireless device receiving the broadcast SSID implements a corresponding decryption algorithm that reverses the broadcast SSID to extract the wireless security parameter, and uses the wireless security parameter, and the broadcast SSID, to establish a secure wireless connection. A specific example can be a wireless security parameter of “123cba” (e.g., a WEP key or WPA-PSK) that is encrypted, by a broadcasting wireless device, to “abc321” (which is then used as the broadcast SSID) and decrypted by a receiving wireless device to “123cba”. The receiving wireless device can use the decrypted wireless security parameter to establish a secure wireless connection to the broadcasting wireless device (e.g., connect to the SSID “abc321” using the wireless security parameter “123cba”). Other simple encryption algorithms can be used as well, such as ROT-13.
Other types of encryption algorithms can be used to encrypt/decrypt wireless network connection information. For example, encryption algorithms that require the use of an encryption key that is known by both the encrypting device and the decrypting device can be used.
In an example implementation, a broadcasting wireless device can be pre-configured with an encryption algorithm and an encryption key. The broadcasting wireless device can receive a wireless security parameter (e.g., a WEP key or WPA-PSK entered by a user). The broadcasting wireless device can encrypt the wireless security parameter using the encryption algorithm and encryption key. The broadcasting wireless device can then broadcast the encrypted wireless security parameter as an SSID (e.g., a broadcast SSID). Wireless devices receiving the broadcast SSID (e.g., client wireless devices) can be pre-configured with a corresponding decryption algorithm and the encryption key (e.g., with the same encryption key as the broadcasting wireless device). The wireless devices receiving the broadcast SSID can decrypt the broadcast SSID, using the decryption algorithm and encryption key, to extract the wireless security parameter. The wireless devices receiving the broadcast SSID can use the wireless security parameter to establish a secure wireless connection to the broadcasting wireless device. A specific example can be a wireless security parameter of “567xyz” (e.g., a WEP key or WPA-PSK) that is encrypted, by a broadcasting wireless device using an encryption key of “my encryption key”, to “Orange” (which is then used as the broadcast SSID). A wireless device receiving the broadcast SSID of “Orange” can decrypt the broadcast SSID using the encryption key of “my encryption key”, to extract the wireless security parameter “567xyz”. The receiving wireless device can use the decrypted wireless security parameter to establish a secure wireless connection to the broadcasting wireless device (e.g., connect to the SSID “Orange” using the wireless security parameter “567xyz”).
In another example implementation, a broadcasting wireless device can be pre-configured with an encryption algorithm and an encryption key. The broadcasting wireless device can receive a wireless security parameter (e.g., a WEP key or WPA-PSK entered by a user) and a connection SSID (e.g., entered by a user). The broadcasting wireless device can encrypt the wireless security parameter and connection SSID using the encryption algorithm and encryption key (e.g., encrypt the wireless security parameter and connection SSID together, or encrypt each separately and combine them afterwards). The broadcasting wireless device can then broadcast the encrypted wireless security parameter and connection SSID as an SSID (e.g., a broadcast SSID). Wireless devices receiving the broadcast SSID (e.g., client wireless devices) can be pre-configured with a corresponding decryption algorithm and the encryption key (e.g., with the same encryption key as the broadcasting wireless device). The wireless devices receiving the broadcast SSID can decrypt the broadcast SSID, using the decryption algorithm and encryption key, to extract the wireless security parameter and connection SSID. The wireless devices receiving the broadcast SSID can use the wireless security parameter and connection SSID to establish a secure wireless connection to the broadcasting wireless device. A specific example can be a wireless security parameter of “567xyz” (e.g., a WEP key or WPA-PSK) and connection SSID of “Apple” that is encrypted, by a broadcasting wireless device using an encryption key of “my encryption key”, to “Orange” (which is then used as the broadcast SSID). A wireless device receiving the broadcast SSID of “Orange” can decrypt the broadcast SSID using the encryption key of “my encryption key”, to extract the wireless security parameter “567xyz” and connection SSID “Apple”. The receiving wireless device can use the decrypted wireless security parameter and connection SSID to establish a secure wireless connection to the broadcasting wireless device (e.g., connect to the SSID “Apple” using the wireless security parameter “567xyz”).
In another example implementation, an encryption algorithm, such as a steganographic technique, can be used to embed a wireless security parameter, or a combination of a wireless security parameter and a connection SSID, within a broadcast SSID. For example, specific bits (e.g., every third bit) of the characters making up the broadcast SSID can be altered to embed the wireless security parameter (or wireless security parameter and connection SSID).
In other example implementations, broadcasting and receiving wireless devices can be configured (e.g., pre-configured) with corresponding encryption/decryption algorithms, with or without using encryption keys. Wireless security parameters, with or without connection SSIDs, can be encrypted and broadcast as broadcast SSIDs. Wireless security parameters, with or without connection SSIDs, can be decrypted and used to establish secure wireless connections.
The examples, technologies, and techniques described herein for establishing secure wireless connections using encrypted SSID information can have many applications.
The examples, technologies, and techniques can be used to improve the security of ad-hoc wireless networks. For example, wireless devices that are to participate in an ad-hoc wireless network can be configured (e.g., pre-configured) with an encryption, and corresponding decryption, algorithm. Secure ad-hoc wireless connections can then be established using an encrypted wireless security parameter that is broadcast as a broadcast SSID. Only those wireless devices that are equipped with the decryption algorithm will be able to decrypt the broadcast SSID, obtain the wireless security parameter, and establish a secure ad-hoc wireless connection. Wireless devices that cannot decrypt the broadcast SSID (e.g., that are not equipped with the decryption algorithm) can have their connection attempts refused or ignored.
The security of ad-hoc wireless network can also be improved by encrypting wireless security parameters along with connection SSIDs. For example, wireless devices that are to participate in an ad-hoc wireless network can be configured (e.g., pre-configured) with an encryption, and corresponding decryption, algorithm. Secure ad-hoc wireless connections can then be established using an encrypted wireless security parameter and connection SSID that is broadcast as a broadcast SSID. Only those wireless devices that are equipped with the decryption algorithm will be able to decrypt the broadcast SSID, obtain the wireless security parameter and connection SSID, and establish a secure ad-hoc wireless connection. By using both a wireless security parameter and a connection SSID, further security can be provided. For example, connection attempts using the broadcast SSID can be ignored or refused. Only those wireless devices that attempt to connect using both the connection SSID (as the SSID value) and the wireless security parameter (e.g., as the WEP or WPA-PSK) can be allowed. Wireless devices that cannot decrypt the broadcast SSID (e.g., that are not equipped with the decryption algorithm) can have their connection attempts refused or ignored.
The technologies and techniques can also be applied to wireless networks operating in infrastructure mode.
At 120, a broadcast SSID is generated from the wireless security parameter. For example, an encryption algorithm can be used to generate the broadcast SSID by encrypting the wireless security parameter (e.g., the broadcast SSID can be the encrypted wireless security parameter). The encryption algorithm can encrypt the wireless security parameter using an encryption key. A wireless network device can automatically generate the broadcast SSID using the received wireless security parameter 110.
At 130, the broadcast SSID is broadcast within a wireless computing network. For example, a wireless network device can broadcast the broadcast SSID as an SSID value in the SSID field of beacon frames (e.g., in anticipation of accepting connections from client wireless network devices).
Once the broadcast SSID has been broadcast within the wireless computing network, secure wireless connections can be established. For example, a wireless device receiving the broadcast SSID (e.g., a client wireless device) can decrypt the broadcast SSID (e.g., using a decryption algorithm corresponding to the encryption algorithm used to generate the broadcast SSID) to obtain the wireless security parameter. The wireless device receiving the broadcast SSID can decrypt the broadcast SSID using the same encryption key as was used to encrypt the wireless security parameter. The wireless device can then establish a secure wireless connection using, at least in part, the wireless security parameter.
For example, a first wireless device can broadcast a broadcast SSID (e.g., an encrypted WEP key) in ad-hoc mode. A second wireless device can receive the broadcast SSID and decrypt the WEP key. The second wireless device can establish a secure wireless connection to the first wireless device by connecting to the first wireless device (e.g., connecting to the broadcast SSID) and using the WEP key.
The example 200 can be implemented by a wireless device (e.g., implemented in hardware and/or software of the wireless device). For example, a wireless device accepting secure wireless connections (e.g., an access point operating in infrastructure mode or a wireless device operating in ad-hoc mode) can implement the example 200 in order to generate a broadcast SSID 240. The wireless device can broadcast the broadcast SSID 240 as an SSID value in SSID fields of beacon frames. Other wireless devices can receive the broadcast SSID 240, decrypt the wireless security parameter 210 (e.g., using the example depicted in
The example 300 can be implemented by a wireless device (e.g., implemented in hardware and/or software of the wireless device). For example, a wireless device can be configured to establish a secure wireless connection to another wireless device (e.g., to an access point operating in infrastructure mode or to a wireless device operating in ad-hoc mode). For example, a wireless device can receive the broadcast SSID 310. The wireless device can execute the decryption algorithm 330 to obtain the wireless security parameter 340 and use the wireless security parameter 340 to establish a secure wireless connection.
In this example 300, the decryption algorithm 330 corresponds to the encryption algorithm 230 of
The broadcasting wireless device 410 can broadcast a broadcast SSID within the wireless computing network 420 to one or more client wireless devices, such as client wireless devices 430A-N. The broadcast SSID can comprise encrypted wireless security parameters. The broadcast SSID can also comprise encrypted connection SSIDs.
The broadcasting wireless device 410 can accept secure wireless connections from client wireless devices (e.g., 430A, 430B, or 430N) that connect using a specific SSID and a specific wireless security parameter. For example, the broadcasting wireless device 410 can accept secure wireless connections from client wireless devices that connect using an SSID broadcast by the broadcasting wireless device 410 and a wireless security parameter that has been decrypted from the broadcast SSID. If the specific SSID and wireless security parameter are not used by a client wireless device, the broadcasting wireless device 410 can refuse the connection (e.g., refuse to establish a secure wireless connection).
The broadcasting wireless device 410 can also accept secure wireless connections from client wireless devices that connect using a connection SSID and a wireless security parameter that have both been decrypted from a broadcast SSID broadcast by the broadcasting wireless device 410. If the specific connection SSID and wireless security parameter are not used by a client wireless device, the broadcasting wireless device 410 can refuse the connection (e.g., refuse to establish a secure wireless connection).
The exemplary system 500 also includes a client wireless device 530. The broadcasting wireless device 510 and client wireless device 530 can represent, for example, two wireless devices configured in ad-hoc mode. The client wireless device 530 is configured (e.g., pre-configured) with a decryption algorithm 540 used to decrypt information that has been encrypted with the encryption algorithm 520. For example, both the encryption algorithm 520 and the decryption algorithm 540 can be configured with the same encryption key. The client wireless device 530 can receive a broadcast SSID from the broadcasting wireless device 510. The client wireless device 530 can decrypt the broadcast SSID to extract a wireless security parameter or to extract a combination of a connection SSID and a wireless security parameter. The client wireless device 530 can then use the wireless security parameter, or the wireless security parameter and the connection SSID, to establish a secure connection with the broadcasting wireless device 510.
At 620, a connection SSID is received. The connection SSID can be used to limit connections to those wireless devices which attempt to connect using the connection SSID as the SSID value. The connection SSID can be created by a user. For example, a user of a wireless network device (e.g., a notebook computer equipped with a wireless network adapter) can enter the connection SSID.
At 630, a broadcast SSID is generated from the wireless security parameter 610 and the connection SSID 620. For example, the broadcast SSID can be generated from a combination of the wireless security parameter and the connection SSID. An encryption algorithm can be used to generate the broadcast SSID by encrypting the wireless security parameter and connection SSID (e.g., the broadcast SSID can be the encrypted wireless security parameter and connection SSID). The encryption algorithm can encrypt the wireless security parameter and connection SSID using an encryption key. A wireless network device can automatically generate the broadcast SSID from the wireless security parameter 610 and connection SSID 620.
At 640, the broadcast SSID is broadcast within a wireless computing network. For example, a wireless network device can broadcast the broadcast SSID as an SSID value in the SSID field of beacon frames (e.g., in anticipation of accepting connections from client wireless network devices).
Once the broadcast SSID has been broadcast within the wireless computing network, secure wireless connections can be established. For example, a wireless device receiving the broadcast SSID can decrypt the broadcast SSID (e.g., using a decryption algorithm corresponding to the encryption algorithm used to generate the broadcast SSID) to obtain the wireless security parameter and connection SSID. The wireless device receiving the broadcast SSID can decrypt the broadcast SSID using the same encryption key as was used to encrypt the wireless security parameter and connection SSID. The wireless device can then establish a secure wireless connection using the wireless security parameter and connection SSID.
For example, a first wireless device can broadcast a broadcast SSID (e.g., an encrypted WEP key and connection SSID) in ad-hoc mode. A second wireless device can receive the broadcast SSID and decrypt the WEP key and connection SSID. The second wireless device can establish a secure wireless connection to the first wireless device by connecting to the first wireless device (e.g., connecting to the connection SSID) and using the WEP key.
The example 700 can be implemented by a wireless device (e.g., implemented in hardware and/or software of the wireless device). For example, a wireless device accepting secure wireless connections (e.g., an access point operating in infrastructure mode or a wireless device operating in ad-hoc mode) can implement the example 700 in order to generate a broadcast SSID 750. The wireless device can broadcast the broadcast SSID 750 as an SSID value in SSID fields of beacon frames. Other wireless devices can receive the broadcast SSID 750, decrypt the wireless security parameter 710 and connection SSID 720 (e.g., using the example depicted in
The example 800 can be implemented by a wireless device (e.g., implemented in hardware and/or software of the wireless device). For example, a wireless device can be configured to establish a secure wireless connection to another wireless device (e.g., to an access point operating in infrastructure mode or to a wireless device operating in ad-hoc mode). For example, a wireless device can receive the broadcast SSID 810. The wireless device can execute the decryption algorithm 830 to obtain the wireless security parameter 840 and connection SSID 850 and use the wireless security parameter 840 and connection SSID 850 to establish a secure wireless connection.
In this example 800, the decryption algorithm 830 corresponds to the encryption algorithm 740 of
At 920, a wireless security parameter is extracted from the broadcast SSID. For example, a decryption algorithm can be executed to extract the wireless security parameter from the Broadcast SSID. In addition to a wireless security parameter, a connection SSID can also be extracted, using a decryption algorithm, from the broadcast SSID. The decryption process can use an encryption key (e.g., the same encryption key as was used during encryption).
At 930, a secure wireless connection is established using the wireless security parameter. For example, a secure wireless connection can be established to a wireless network using the wireless security parameter and the broadcast SSID. A secure wireless connection can also be established using the wireless security parameter and the connection SSID.
With reference to
The storage 1040 may be removable or non-removable, and includes magnetic disks, magnetic tapes or cassettes, CD-ROMs, CD-RWs, DVDs, or any other medium which can be used to store information and which can be accessed within the computing environment 1000. The storage 1040 stores instructions for the software 1080, which can implement technologies described herein.
The input device(s) 1050 may be a touch input device, such as a keyboard, keypad, mouse, pen, or trackball, a voice input device, a scanning device, or another device, that provides input to the computing environment 1000. For audio, the input device(s) 1050 may be a sound card or similar device that accepts audio input in analog or digital form, or a CD-ROM reader that provides audio samples to the computing environment 1000. The output device(s) 1060 may be a display, printer, speaker, CD-writer, or another device that provides output from the computing environment 1000.
The communication connection(s) 1070 enable communication over a communication medium (e.g., a connecting network) to another computing entity. The communication medium conveys information such as computer-executable instructions, compressed graphics information, or other data in a modulated data signal.
Computer-readable media are any available media that can be accessed within a computing environment 1000. By way of example, and not limitation, with the computing environment 1000, computer-readable media include memory 1020, storage 1040, communication media (not shown), and combinations of any of the above.
Any of the methods described herein can be performed via one or more computer-readable media (e.g., storage or other tangible media) having computer-executable instructions for performing (e.g., causing a computing device or computer to perform) such methods. Operation can be fully automatic, semi-automatic, or involve manual intervention.
The technologies of any example described herein can be combined with the technologies of any one or more other examples described herein.
In view of the many possible embodiments to which the principles of the disclosed invention may be applied, it should be recognized that the illustrated embodiments are only preferred examples of the invention and should not be taken as limiting the scope of the invention. Rather, the scope of the invention is defined by the following claims. We therefore claim as our invention all that comes within the scope and spirit of these claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 789/CHE/2006 | May 2006 | IN | national |
