USING A BLOCKCHAIN FOR OPTIMIZED FAST-SECURE ROAMING ON WLANs

• US 20190223089A1
• Filed: 01/16/2018
• Published: 07/18/2019
• Est. Priority Date: 01/16/2018
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Salgueiro, Gonzalo, Ramanathan, Shankar, Henry, Jerome
• Granted Patent: US 11,122,500 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/14 using user query or user detection
• CPC Class Codes: H04W 48/20 Selecting an access point
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

In one embodiment, a device receives data regarding a wireless client attempting to form an association with a particular wireless access point in a network. The device queries a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client. The device uses, when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point. The device updates the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point.

Claims

1. A method comprising:

receiving, at a device, data regarding a wireless client attempting to form an association with a particular wireless access point in a network;

querying, by the device, a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client;

using, by the device and when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point; and

updating, by the device, the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point.

2. The method as in claim 1, wherein the wireless roaming data regarding the wireless client comprises a master session key (MSK).

3. The method as in claim 1, wherein updating the data regarding the association between the wireless client and the particular wireless access point comprises:

adding, by the device, a child block to the blockchain ledger, wherein the child block indicates the media access control (MAC) address of the wireless client, a basic service set identification (BSSID) of the particular wireless access point, and a timestamp regarding the association between the wireless client and the particular wireless access point.

4. The method as in claim 1, wherein the device comprises a controller for the particular wireless access point.

5. The method as in claim 1, wherein the roaming data regarding the wireless client from the blockchain ledger comprises data regarding an association between the wireless client and a wireless access point located in a second network that is administered separately from that of the network in which the particular wireless access point is located.

6. The method as in claim 1, further comprising:

using, by the device, the blockchain ledger to determine whether the wireless client is attempting to perform media access control (MAC) address spoofing.

7. The method as in claim 1, further comprising:

determining, by the device, that a timer for the association between the wireless client and the particular wireless access point has expired; and

removing, by the device and in response to expiration of the timer, the blockchain ledger from the blockchain database.

8. The method as in claim 1, further comprising:

receiving, at the device, data regarding a second wireless client attempting to form an association with the particular wireless access point in the network; and

adding, by the device, a new blockchain ledger to the blockchain database regarding the association between the second wireless client and the particular wireless access point, when the blockchain database does not already store roaming data regarding the second wireless client.

9. The method as in claim 1, further comprising:

using the roaming data regarding the wireless client to make a security assessment of the wireless client.

10. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to;

receive data regarding a wireless client attempting to form an association with a particular wireless access point in a network;

query a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client;

use, when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point; and

update the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point.

11. The apparatus as in claim 10, wherein the wireless roaming data regarding the wireless client comprises a master session key (MSK).

12. The apparatus as in claim 10, wherein the apparatus updates the data regarding the association between the wireless client and the particular wireless access point by:

adding a child block to the blockchain ledger, wherein the child block indicates the media access control (MAC) address of the wireless client, a basic service set identification (BSSID) of the particular wireless access point, and a timestamp regarding the association between the wireless client and the particular wireless access point.

13. The apparatus as in claim 10, wherein the apparatus comprises a controller for the particular wireless access point.

14. The apparatus as in claim 10, wherein the roaming data regarding the wireless client from the blockchain ledger comprises data regarding an association between the wireless client and a wireless access point located in a second network that is administered separately from that of the network in which the particular wireless access point is located.

15. The apparatus as in claim 10, wherein the process when executed is further configured to:

use the blockchain ledger to determine whether the wireless client is attempting to perform media access control (MAC) address spoofing.

16. The apparatus as in claim 10, wherein the process when executed is further configured to:

determine that a timer for the association between the wireless client and the particular wireless access point has expired; and

remove, in response to expiration of the timer, the blockchain ledger from the blockchain database.

17. The apparatus as in claim 10, wherein the process when executed is further configured to:

receive data regarding a second wireless client attempting to form an association with the particular wireless access point in the network; and

add a new blockchain ledger to the blockchain database regarding the association between the second wireless client and the particular wireless access point, when the blockchain database does not already store roaming data regarding the second wireless client.

18. The apparatus as in claim 10, wherein the process when executed is further configured to:

use the roaming data regarding the wireless client to make a security assessment of the wireless client.

19. The apparatus as in claim 10, wherein the blockchain ledger comprises at least one of:

a pairwise master key (PMK), a group master key (GMK), a pairwise transient key (PTK), a group temporal key (GTK), fast transition (FT) data, robust security network information exchange (RSNIE) data, mobility domain information element (MDIE) data, or fast base substation system transitional information element (FTIE) data.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

receiving, at the device, data regarding a wireless client attempting to form an association with a particular wireless access point in a network;

querying, by the device, a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client;

using, by the device and when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point; and

updating, by the device, the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point.