USING A MOBILE DEVICE TO ENABLE ANOTHER DEVICE TO CONNECT TO A WIRELESS NETWORK

• US 20130286889A1
• Filed: 10/23/2012
• Published: 10/31/2013
• Est. Priority Date: 04/17/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Cherian, George, Abraham, Santosh Paul, Tinnakornsrisuphap, Peerapol, De Vegt, Rolf, Malinen, Jouni, Kapoor, Samir
• Granted Patent: US 9,031,050 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 76/14 Direct-mode setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method includes, at a first device while the first device is connected to a wireless local area network (WLAN) and a second device is unconnected to the WLAN, establishing a secure channel to the second device using an EAP exchange. The method also includes sending at least one credential associated with the WLAN to the second device via the secure channel to enable the second device to connect to the WLAN.

Claims

1. A method comprising:

at a first device, while the first device is connected to a wireless local area network (WLAN) and a second device is unconnected to the WLAN, establishing a secure channel to the second device using an extensible authentication protocol (EAP) exchange; and

sending, to the second device via the secure channel, at least one credential associated with the WLAN to enable the second device to connect to the WLAN.

2. The method of claim 1, wherein the first device comprises a mobile telephone, a portable computing device, a tablet computing device, a personal digital assistant (PDA), a portable media player, or any combination thereof.

3. The method of claim 1, wherein the second device comprises a smart energy profile (SEP)-compatible device.

4. The method of claim 1, wherein the second device comprises a headless device that includes at least one network interface but does not include an input device or an output device.

5. The method of claim 1, wherein the at least one credential comprises a service set identifier (SSID), a passphrase, a security key, or any combination thereof.

6. The method of claim 1, further comprising:

receiving input at the first device indicating a security credential associated with the second device; and

sending the security credential from the first device to the second device during the EAP exchange.

7. The method of claim 1, further comprising:

receiving at least one application layer credential at the first device; and

sending the at least one application layer credential to the second device to enable the second device to access a network external to the WLAN.

8. The method of claim 1, wherein the first device comprises an autonomous Wi-Fi Direct group owner with respect to the second device.

9. The method of claim 8, wherein the first device refrains from issuing a notice of absence while communicating with the second device.

10. The method of claim 1, further comprising, at the first device, discovering the second device via a Wi-Fi Protected Setup (WPS) discovery operation.

11. The method of claim 1, further comprising:

performing a four-way handshake operation after the EAP exchange; and

performing a Wi-Fi Protected Setup (WPS) authentication and configuration operation using a null personal identification number (PIN).

12. The method of claim 1, wherein the EAP exchange comprises an EAP using only a password (EAP-pwd) exchange, and further comprising:

determining a personal identification number (PIN) based on a portion of a master session key (MSK) associated with the EAP exchange; and

performing a Wi-Fi Protected Setup (WPS) authentication and configuration operation using the PIN.

13. The method of claim 12, wherein the portion of the MSK comprises the ten least significant bytes of the MSK.

14. The method of claim 1, wherein the EAP exchange comprises an EAP with encrypted key exchange (EAP-eke).

15. The method of claim 1, wherein the EAP exchange is triggered by a Wi-Fi Protected Setup (WPS) failure.

16. The method of claim 1, further comprising, at the first device, broadcasting a service set identification (SSID) associated with the second device, a device identifier associated with the second device, or a combination thereof to discover the second device.

17. A method comprising:

at a first device, while the first device is unconnected to a wireless local area network (WLAN) and a second device is connected to the WLAN, establishing a secure channel to the second device using an extensible authentication protocol (EAP) exchange;

receiving, at the first device via the secure channel, at least one credential associated with the WLAN; and

establishing, at the first device, a connection to the WLAN using the at least one credential.

18. The method of claim 17, further comprising,

receiving a security credential from the second device during the EAP exchange;

and

comparing the received security credential to a stored security credential,

wherein the first device terminates the EAP exchange when the received security credential does not match the stored security credential.

19. The method of claim 17, further comprising:

receiving at least one application layer credential from the second device; and

replacing a stored security credential with at least a portion of the at least one application layer credential.

20. The method of claim 17, further comprising:

receiving at least one application layer credential from the second device; and

accessing, via the WLAN, a network external to the WLAN using the at least one application layer credential.

21. A method comprising:

at a first device, sending a first message to a second device during a Wi-Fi Protected Setup (WPS) discovery operation; and

at the first device, sending a second message to the second device during a WPS authentication and configuration operation that follows the WPS discovery operation,

wherein the second message includes data associated with an extensible authentication protocol (EAP) using a password (EAP-pwd) exchange.

22. The method of claim 21, wherein the data includes at least one link layer credential, at least one application layer credential, or any combination thereof.

23. A method comprising:

at a first device, while the first device is connected to a wireless local area network (WLAN) and a second device is unconnected to the WLAN, establishing a secure channel to the second device using a Wi-Fi Protected Access 2 Pre-shared Key (WPA2-PSK) exchange; and

sending, to the second device via the secure channel, at least one credential associated with the WLAN to enable the second device to connect to the WLAN.

24. The method of claim 23, further comprising:

determining a personal identification number (PIN) based on a portion of a pairwise master key (PMK) associated with the WPA2-PSK exchange; and

performing a Wi-Fi Protected Setup (WPS) authentication and configuration operation using the PIN.

25. The method of claim 24, wherein the portion of the PMK comprises the ten least significant bytes of the PMK.

26. The method of claim 23, further comprising discovering the second device via a Wi-Fi Direct discovery operation.

27. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions executable by the processor to;

establish, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange; and

direct a transmitter to send, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.

28. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions executable by the processor to;

establish, while the apparatus is unconnected to a wireless local area network (WLAN) and a second apparatus is connected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange;

receive, via the secure channel, at least one credential associated with the WLAN; and

establish a connection to the WLAN using the at least one credential.

29. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions executable by the processor to;

direct a transmitter to send a first message to a second apparatus during a Wi-Fi Protected Setup (WPS) discovery operation; and

direct the transmitter to send a second message to the second apparatus during a WPS authentication and configuration operation that follows the WPS discovery operation,

wherein the second message includes data associated with an extensible authentication protocol (EAP) using a password (EAP-pwd) exchange.

30. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions executable by the processor to;

establish, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to a second apparatus using a Wi-Fi Protected Access 2 Pre-shared Key (WPA2-PSK) exchange; and

direct a transmitter to send, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.

31. An apparatus comprising:

means for establishing, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange; and

means for sending, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.

32. An apparatus comprising:

means for establishing, while the apparatus is unconnected to a wireless local area network (WLAN) and a second apparatus is connected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange; and

means for receiving, via the secure channel, at least one credential associated with the WLAN, wherein the means for establishing establishes a connection to the WLAN using the at least one credential.

33. An apparatus comprising:

means for generating a first message and a second message; and

means for sending, wherein the means for sending is configured to;

send the first message to a second apparatus during a Wi-Fi Protected Setup (WPS) discovery operation; and

send the second message to the second apparatus during a WPS authentication and configuration operation that follows the WPS discovery operation,

wherein the second message includes data associated with an extensible authentication protocol (EAP) using a password (EAP-pwd) exchange.

34. An apparatus comprising:

means for establishing, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to a second apparatus using a Wi-Fi Protected Access 2 Pre-shared Key (WPA2-PSK) exchange; and

means for sending, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.

35. A non-transitory computer-readable medium comprising instructions that when executed cause an apparatus to:

establish, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange; and

send, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.

36. A non-transitory computer-readable medium comprising instructions that when executed cause an apparatus to:

establish, while the apparatus is unconnected to a wireless local area network (WLAN) and a second apparatus is connected to the WLAN, a secure channel to the second apparatus using an extensible authentication protocol (EAP) exchange;

receive, via the secure channel, at least one credential associated with the WLAN; and

establish a connection to the WLAN using the at least one credential.

37. A non-transitory computer-readable medium comprising instructions that when executed cause an apparatus to:

send a first message to a second apparatus during a Wi-Fi Protected Setup (WPS) discovery operation; and

send a second message to the second apparatus during a WPS authentication and configuration operation that follows the WPS discovery operation,

wherein the second message includes data associated with an extensible authentication protocol (EAP) using a password (EAP-pwd) exchange.

38. A non-transitory computer-readable medium comprising instructions that when executed cause an apparatus to:

establish, while the apparatus is connected to a wireless local area network (WLAN) and a second apparatus is unconnected to the WLAN, a secure channel to a second apparatus using a Wi-Fi Protected Access 2 Pre-shared Key (WPA2-PSK) exchange; and

send, to the second apparatus via the secure channel, at least one credential associated with the WLAN to enable the second apparatus to connect to the WLAN.