System and method for a secure multi-level network access mechanism using virtual service set identifier broadcast

• US 20090019283A1
• Filed: 05/01/2007
• Published: 01/15/2009
• Est. Priority Date: 05/01/2006
• Status: Active Grant

• Current Assignee: Infosys Technologies Limited (Infosys Limited)
• Original Assignee: Infosys Technologies Limited (Infosys Limited)
• Inventors: Gupta, Puneet, Muralidharan, Kartik
• Granted Patent: US 8,166,309 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method, system, and computer program product for network management, including masking a true service set identifier (SSID) in beacon frame; and broadcasting the beacon frame with the masked true SSID, whereby an authorized device retrieve the true SSID from the broadcast beacon frame.

Claims

1. A method for network management, the method comprising:

masking a true service set identifier (SSID) in beacon frame; and

broadcasting the beacon frame with the masked true SSID,

whereby an authorized device retrieve the true SSID from the broadcast beacon frame.

2. The method of claim 1, further comprising facilitating multiple access levels by identifying the authorized device through an association response frame.

3. The method of claim 1, wherein the masking step includes:

sharing a key among a group of authorized devices; and

using the shared key to encrypt and decrypt the true SSID.

4. The method of claim 1, wherein the masking step includes:

dividing the broadcast SSID into a first portion, including the true SSID encrypted with a key, and a second portion including a seed value used to generate the key,

whereby the authorized device uses the seed value to derive the key to unencrypt the encrypted true SSID to obtain the true SSID.

5. The method of claim 2, further comprising including in the association request frame the true SSID encrypted with a random seed of the authorized device.

6. The method of claim 1, wherein the masking step includes:

encrypting the true SSID using a private key,

whereby the authorized device uses a public key corresponding to the private key and based on a media access control (MAC) address retrieved from the beacon frame to decrypt the encrypted true SSID to obtain the true SSID.

7. The method of claim 6, further comprising including in an association request frame the true SSID encrypted with a private key of the authorized device.

8. The method of claim 7, further comprising determining a network access level for the authorized device based on the public key of the authorized device.

9. The method of claim 1, wherein the masking step includes:

hashing the true SSID with a hashing function,

whereby the authorized device uses a reverse hashing function to derive the true SSID.

10. The method of claim 9, wherein the true SSID derived from the reverse hashing function is different within a finite range from the true SSID based on a seed value used with the hashing function.

11. The method of claim 10, further comprising determining a network access level for the authorized device based on the true SSID derived from the reverse hashing function and included in an association response frame.

12. The method of claim 1, further comprising embedding a security key with the broadcast SSID,

whereby the authorized device extracts the security key for a session.

13. The method of claim 1, further comprising embedding a wired equivalent privacy/Wi-Fi protected access-pre-shared key (WPA-PSK) within the broadcast SSID to provide communications channel security.

14. The method of claim 13, further comprising:

distributing a shared key among a group of authorized devices; and

encrypting the SSID and WEP/PSK pair with the shared key,

whereby the authorized device uses the shared key to unencrypt the encrypted SSID and WEP/PSK pair to obtain the SSID and WEP/PSK pair.

15. The method of claim 13, further comprising generating the WEP/PSK using the broadcast SSID.

16. The method of claim 13, further comprising generating the WEP/PSK using steganography.

17. A system for network management, the system comprising:

means for masking a true service set identifier (SSID) in beacon frame; and

means for broadcasting the beacon frame with the masked true SSID,

whereby an authorized device retrieve the true SSID from the broadcast beacon frame.

18. The system of claim 17, further comprising means for facilitating multiple access levels by identifying the authorized device through an association response frame.

19. The system of claim 17, wherein the masking means includes:

means for sharing a key among a group of authorized devices; and

means for using the shared key to encrypt and decrypt the true SSID.

20. The system of claim 17, wherein the masking means includes:

means for dividing the broadcast SSID into a first portion, including the true SSID encrypted with a key, and a second portion including a seed value used to generate the key,

whereby the authorized device uses the seed value to derive the key to unencrypt the encrypted true SSID to obtain the true SSID.

21. The system of claim 18, further comprising means for including in the association request frame the true SSID encrypted with a random seed of the authorized device.

22. The system of claim 17, wherein the masking means includes:

means for encrypting the true SSID using a private key,

whereby the authorized device uses a public key corresponding to the private key and based on a media access control (MAC) address retrieved from the beacon frame to decrypt the encrypted true SSID to obtain the true SSID.

23. The system of claim 22, further comprising means for including in an association request frame the true SSID encrypted with a private key of the authorized device.

24. The system of claim 23, further comprising means for determining a network access level for the authorized device based on the public key of the authorized device.

25. The system of claim 17, wherein the masking means includes:

means for hashing the true SSID with a hashing function,

whereby the authorized device uses a reverse hashing function to derive the true SSID.

26. The system of claim 25, wherein the true SSID derived from the reverse hashing function is different within a finite range from the true SSID based on a seed value used with the hashing function.

27. The system of claim 26, further comprising means for determining a network access level for the authorized device based on the true SSID derived from the reverse hashing function and included in an association response frame.

28. The system of claim 17, further comprising means for embedding a security key with the broadcast SSID,

whereby the authorized device extracts the security key for a session.

29. The system of claim 17, further comprising means for embedding a wired equivalent privacy/Wi-Fi protected access-pre-shared key (WPA-PSK) within the broadcast SSID to provide communications channel security.

30. The system of claim 29, further comprising:

means for distributing a shared key among a group of authorized devices; and

means for encrypting the SSID and WEP/PSK pair with the shared key,

whereby the authorized device uses the shared key to unencrypt the encrypted SSID and WEP/PSK pair to obtain the SSID and WEP/PSK pair.

31. The system of claim 29, further comprising means for generating the WEP/PSK using the broadcast SSID.

32. The system of claim 29, further comprising means for generating the WEP/PSK using steganography.

33. A computer storage device tangibly embodying a plurality of instructions on a computer readable medium for network management, comprising the steps of:

masking a true service set identifier (SSID) in beacon frame; and

broadcasting the beacon frame with the masked true SSID,

whereby an authorized device retrieve the true SSID from the broadcast beacon frame.

34. The computer storage device of claim 33, further comprising facilitating multiple access levels by identifying the authorized device through an association response frame.

35. The computer storage device of claim 33, wherein the masking step includes:

sharing a key among a group of authorized devices; and

using the shared key to encrypt and decrypt the true SSID.

36. The computer storage device of claim 33, wherein the masking step includes:

dividing the broadcast SSID into a first portion, including the true SSID encrypted with a key, and a second portion including a seed value used to generate the key,

whereby the authorized device uses the seed value to derive the key to unencrypt the encrypted true SSID to obtain the true SSID.

37. The computer storage device of claim 34, further comprising including in the association request frame the true SSID encrypted with a random seed of the authorized device.

38. The computer storage device of claim 33, wherein the masking step includes:

encrypting the true SSID using a private key,

whereby the authorized device uses a public key corresponding to the private key and based on a media access control (MAC) address retrieved from the beacon frame to decrypt the encrypted true SSID to obtain the true SSID.

39. The computer storage device of claim 38, further comprising including in an association request frame the true SSID encrypted with a private key of the authorized device.

40. The computer storage device of claim 33, further comprising determining a network access level for the authorized device based on the public key of the authorized device.

41. The computer storage device of claim 33, wherein the masking step includes:

hashing the true SSID with a hashing function,

whereby the authorized device uses a reverse hashing function to derive the true SSID.

42. The computer storage device of claim 41, wherein the true SSID derived from the reverse hashing function is different within a finite range from the true SSID based on a seed value used with the hashing function.

43. The computer storage device of claim 42, further comprising determining a network access level for the authorized device based on the true SSID derived from the reverse hashing function and included in an association response frame.

44. The computer storage device of claim 33, further comprising embedding a security key with the broadcast SSID,

whereby the authorized device extracts the security key for a session.

45. The computer storage device of claim 33, further comprising embedding a wired equivalent privacy/Wi-Fi protected access-pre-shared key (WPA-PSK) within the broadcast SSID to provide communications channel security.

46. The computer storage device of claim 45, further comprising:

distributing a shared key among a group of authorized devices; and

encrypting the SSID and WEP/PSK pair with the shared key,

whereby the authorized device uses the shared key to unencrypt the encrypted SSID and WEP/PSK pair to obtain the SSID and WEP/PSK pair.

47. The computer storage device of claim 45, further comprising generating the WEP/PSK using the broadcast SSID.

48. The computer storage device of claim 45, further comprising generating the WEP/PSK using steganography.