Sharing security keys with headless devices

• US 9,769,655 B2
• Filed: 06/26/2015
• Issued: 09/19/2017
• Est. Priority Date: 04/24/2006
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: Ruckus Wireless, Inc. (CommScope Holding Company, Inc.)
• Inventors: Sheu, Ming-Jye
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US14/751,833
• Publication Number:
  US 20150296377A1
• Time in Patent Office: 816 Days
• Field of Search: 380278
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 74/00 Wireless channel access

Abstract

Systems and methods for provisioned configuration of wireless devices to allow access to restricted wireless networks are provided. Using an open wireless or wired network, a user of a wireless device may be authenticated. A configuration application, which includes the parameters and policies of the provisioned configuration, is generated, transferred to, and executed on the wireless device. Following configuration by the application, the wireless device is allowed to access the restricted wireless network within the parameters and policies of the provisioned configuration.

Claims

1. A method for sharing security keys with headless devices, the method comprising:

detecting a headless device within a wireless communication range;

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that the detected headless device is authenticated for access to a secured wireless network,

identifies that the detected headless device is not yet associated with any pre-shared keys, and

assigns a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;

transferring the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;

binding the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;

in response to one or more communications, identifying one or more other characteristics of the detected headless device and generating a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and

dynamically updating the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.

2. The method of claim 1, further comprising storing one or more unassigned pre-shared keys in a database in memory.

3. The method of claim 2, further comprising receiving the unassigned pre-shared keys from a remote secret generation module over the secured wireless network.

4. The method of claim 2, further comprising executing a local secret generation module to generate the unassigned pre-shared keys.

5. The method of claim 1, wherein the access point recognizes the assigned pre-shared key as being associated with the secured wireless network.

6. An apparatus for sharing security keys with headless devices, the apparatus comprising:

a communication interface that detects a headless device within a wireless communication range;

a processor that executes instructions stored in memory, wherein execution of the instructions by a processor;

determines that the detected headless device is authenticated for access to a secured wireless network,

identifies that the detected headless device is not yet associated with any pre-shared keys, and

assigns a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;

wherein the communication interface transfers the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;

in response to which, further execution of the instructions by the processor;

binds the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;

in response to one or more communications, identifies one or more other characteristics of the detected headless device and generates a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and

dynamically updates the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.

7. The apparatus of claim 6, further comprising memory that stores a database of one or more unassigned pre-shared keys.

8. The apparatus of claim 7, wherein the communication interface further receives the unassigned pre-shared keys from a remote secret generation module.

9. The apparatus of claim 7, further comprising a local secret generation module stored in memory and executable by the processor to generate the unassigned pre-shared keys.

10. The apparatus of claim 6, wherein the access point recognizes the assigned pre-shared key as being associated with the secured wireless network.

11. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for sharing security keys with headless devices, the method comprising:

detecting a headless device within a wireless communication range;

determining that the detected headless device is authenticated for access to a secured wireless network;

identifying that the detected headless device is not yet associated with any pre-shared keys;

assigning a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;

transferring the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;

binding the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;

in response to one or more communications, identifying one or more other characteristics of the detected headless device and generating a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and

dynamically updating the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.