DISTRIBUTED CONFIGURATOR ENTITY

A system and method for distributed storage and/or management of network credentials in a wireless network. A first device of the wireless network receives a set of network credentials from a first configurator. The network credentials may be used to authorize one or more devices to access the wireless network. The first device further receives a user authentication credential from a second device, and authenticates the second device as a second configurator for the wireless network based at least in part on the user authentication credential. Upon authenticating the second device as the second configurator, the first device may then transmit the set of network credentials to the second configurator.

TECHNICAL FIELD

The example embodiments relate generally to wireless networks, and specifically to a distributed storage and/or management of network credentials in a wireless network.

BACKGROUND OF RELATED ART

A client device (e.g., wireless station) may be configured to communicate with one or more access points (APs) of a wireless network using public key encryption techniques. Public key encryption (sometimes referred to as public/private key encryption) is a method of securely transferring data using a known (public) key and a secret (private) key. Each device may have a unique pair of public and private keys that are mathematically and/or algorithmically related to one another. In addition to transferring data, the public and private keys may be used to verify messages and certificates and/or generate digital signatures. For example, the client device may share its public key with the APs within the wireless network. The APs may use the client device's public key to authenticate and configure the client device to access (e.g., connect to) the wireless network. The authenticated client device may communicate with the APs and/or other devices within the wireless network.

In some wireless networks, a configurator may manage the network credentials of each device in the network. For example, the configurator may enroll and/or authenticate members (e.g., client devices and APs) of a wireless network based on the public/private keys associated with each device. More specifically, the configurator may store at least the public key information for each client device and/or AP in the wireless network. The configurator may use the stored public key information (e.g., network credentials) to communicate securely with each of the client devices and APs in the wireless network. The configurator may configure and/or provision client devices, for example, by providing the client devices with information to identify and/or communicate with the APs. Similarly, the configurator may provide the APs with information to identify and/or authenticate communications from the client devices.

The configurator is typically a smart phone or other portable device that may be lost, stolen, replaced, or otherwise removed (e.g., permanently) from the wireless network. Thus, it may be desirable to maintain the membership of the wireless network, in the absence of the configurator, without having to re-enroll each member device.

SUMMARY

A system and method for distributed storage and/or management of network credentials in wireless network is disclosed. A first device of the wireless network receives a set of network credentials from a first configurator. The network credentials are for authorizing one or more devices to access the wireless network. For example, the network credentials may include a list of trusted public keys associated with the one or more devices. Alternatively, or in addition, the network credentials may include a pair of public and private keys used to certify the one or more devices as members of the wireless network. The first device further receives a user authentication credential from a second device, and authenticates the second device as a second configurator for the wireless network based at least in part on the user authentication credential. Upon authenticating the second device as the second configurator, the first device may then transmit the set of network credentials to the second configurator.

In example embodiments, the user authentication credential may be used to verify that the first configurator and the second device belong to, or are otherwise used by, the same user. For example, the user authentication credential may include at least one of a password, voice data, or image data input by a user of the second device. The first device may receive a reference credential from the first configurator and compare the reference credential with the user authentication credential. In some aspects, the first device may offload the comparison to be performed by one or more processing resources external to the wireless network. More specifically, the first device may authenticate the second device as the second configurator upon determining that the user authentication credential substantially matches the reference credential.

Still further, in some embodiments, the first device may establish a secure channel with the second device based at least in part on a public identity key of the first device. For example, the public identity key may be provided to the first device in an out-of-band manner. Accordingly, the first device may receive the user authentication credential from the second device via the secure channel. Once authenticated, the second configurator may authorize additional devices to access the wireless network.

By distributing the network credentials among multiple devices in a wireless network, the example embodiments provide redundancy in managing access to the wireless network. For example, this may allow an access point (AP) storing a redundant set of network credentials to on-board new configurators in the event that the existing configurator becomes lost, stolen, replaced, or otherwise permanently removed from the wireless network. Furthermore, the user authentication credential allows configurators to be authenticated based on their users (e.g., rather than the devices themselves). This may ensure a greater level of “trustworthiness” when on-boarding a new configurator, for example, by verifying that the user of the new configurator is the same as the user of the old or existing configurator.

DETAILED DESCRIPTION

The example embodiments are described below in the context of WLAN systems for simplicity only. It is to be understood that the example embodiments are equally applicable to other wireless networks (e.g., cellular networks, pico networks, femto networks, satellite networks), as well as for systems using signals of one or more wired standards or protocols (e.g., Ethernet and/or HomePlug/PLC standards). As used herein, the terms “WLAN” and “Wi-Fi®” may include communications governed by the IEEE 802.11 family of standards, BLUETOOTH® (Bluetooth), HiperLAN (a set of wireless standards, comparable to the IEEE 802.11 standards, used primarily in Europe), and other technologies having relatively short radio propagation range. Thus, the terms “WLAN” and “Wi-Fi” may be used interchangeably herein. In addition, although described below in terms of an infrastructure WLAN system including one or more APs and a number of client devices, the example embodiments are equally applicable to other WLAN systems including, for example, multiple WLANs, peer-to-peer (or Independent Basic Service Set) systems, Wi-Fi Direct systems, and/or Hotspots.

In the following description, numerous specific details are set forth such as examples of specific components, circuits, and processes to provide a thorough understanding of the present disclosure. The term “coupled” as used herein means connected directly to or connected through one or more intervening components or circuits. The term “configurator” refers to a wireless device that manages and/or controls access to a wireless network. For example, the configurator may enroll or authorize new members to join the wireless network, and may de-authorize existing members from joining the wireless network. A “member” or “member device” refers to any wireless device (e.g., client device or AP) authorized, by the configurator, to access a particular wireless network.

Also, in the following description and for purposes of explanation, specific nomenclature is set forth to provide a thorough understanding of the example embodiments. However, it will be apparent to one skilled in the art that these specific details may not be required to practice the example embodiments. In other instances, well-known circuits and devices are shown in block diagram form to avoid obscuring the present disclosure. Some portions of the detailed descriptions which follow are presented in terms of procedures, logic blocks, processing and other symbolic representations of operations on data bits within a computer memory. These descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. In the present application, a procedure, logic block, process, or the like, is conceived to be a self-consistent sequence of steps or instructions leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, although not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated in a computer system.

FIG. 1is a block diagram of a wireless system100within which the example embodiments may be implemented. The wireless system100may include a wireless access point (AP)110, a wireless local area network (WLAN)120, a client device130(e.g., a station or STA), and a configurator140. The WLAN120may be formed by a plurality of Wi-Fi access points (APs) that may operate according to the IEEE 802.11 family of standards (or according to other suitable wireless protocols). Thus, although only one AP110is shown inFIG. 1for simplicity, it is to be understood that the WLAN120may be formed by any number of access points such as AP110. Similarly, the WLAN120may include any number of client devices such as client device130. For some embodiments, the wireless system100may correspond to a single user multiple-input multiple-output (SU-MIMO) or a multi-user MIMO (MU-MIMO) wireless network. Although the WLAN120is depicted inFIG. 1as an infrastructure basic service set (BSS), for other example embodiments, the WLAN120may be an independent basic service set (IBSS), an ad-hoc network, or a peer-to-peer (P2P) network (e.g., operating in accordance with the Wi-Fi Direct specification).

The AP110may be any suitable device that allows one or more wireless devices to connect to a network (e.g., a local area network (LAN), wide area network (WAN), metropolitan area network (MAN), and/or the Internet) via AP110using Wi-Fi, Bluetooth, or any other suitable wireless communication standards. The AP110is assigned a unique media access control (MAC) address that is programmed therein by, for example, a device manufacturer. For some embodiments, the AP110may be any suitable wireless device (e.g., cell phone, PDA, tablet device, laptop computer, and/or STA) acting as a software-enabled access point (“SoftAP”). For at least one embodiment, AP110may include one or more transceivers, one or more processing resources (e.g., processors and/or ASICs), one or more memory resources, and a power source. The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect toFIGS. 6 and 7.

The client device130may be any suitable Wi-Fi enabled wireless device including, for example, a cell phone, personal digital assistant (PDA), tablet device, laptop computer, or the like. The client device130may also be referred to as a user equipment (UE), a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless communications device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, a client, or some other suitable terminology. The client device130is also assigned a unique MAC address. For at least some embodiments, the client device130may include one or more transceivers, one or more processing resources (e.g., processors and/or ASICs), one or more memory resources, and a power source (e.g., a battery). The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect toFIG. 7.

The configurator140may be any suitable device that can communicate securely with the client device130and AP110. In example embodiments, the configurator140may communicate with each of the client device130and AP110using public key encryption techniques and/or in accordance with a Device Provisioning Protocol (DPP). For at least some embodiments, the configurator140may include user input features (e.g., touchscreen, keyboard, microphone, etc.) for receiving inputs from a user or operator of the device. For example, the configurator140may be a smartphone, personal digital assistant (PDA), tablet device, laptop computer, or the like. Further, for some embodiments, the configurator140may include one or more transceivers, one or more processing resources (e.g., processors and/or ASICs), one or more memory resources, and a power source (e.g., a battery). The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect toFIG. 7.

For the AP110, the client device130, and the configurator140, the one or more transceivers may include Wi-Fi transceivers, Bluetooth transceivers, cellular transceivers, and/or other suitable radio frequency (RF) transceivers (not shown for simplicity) to transmit and receive wireless communication signals. Each transceiver may communicate with other wireless devices in distinct operating frequency bands and/or using distinct communication protocols. For example, the Wi-Fi transceiver may communicate within a 2.4 GHz frequency band and/or within a 5 GHz frequency band in accordance with the IEEE 802.11 specification. The cellular transceiver may communicate within various RF frequency bands in accordance with a 4G Long Term Evolution (LTE) protocol described by the 3rd Generation Partnership Project (3GPP) (e.g., between approximately 700 MHz and approximately 3.9 GHz) and/or in accordance with other cellular protocols (e.g., a Global System for Mobile (GSM) communications protocol). In other embodiments, the transceivers included within the client device may be any technically feasible transceiver such as a ZigBee transceiver described by a specification from the ZigBee Alliance, a WiGig transceiver, and/or a HomePlug transceiver described by a specification from the HomePlug Alliance.

The configurator140manages access to and/or control of the WLAN120. For example, the configurator140may store a set of network credentials142that may be used to authorize member devices to access the WLAN120. In some aspects, the configurator140may enroll and/or authorize new devices to join (e.g., and become members of) the WLAN120. For example, before the client device130can access any services and/or devices of the WLAN120, the configurator140may first enroll the client device130as a member of the WLAN120. The enrollment process may include authenticating the client device130as a “trusted” device, and provisioning the client device130to communicate with the AP110and/or other members of the WLAN120. For purposes of discussion, it is assumed that the AP110is already enrolled (e.g., by the configurator140) as a member of the WLAN120.

In example embodiments, the configurator140may authenticate the client device130using public key encryption techniques. Public key encryption techniques may be used to establish a secure communications channel between the configurator140and the client device130. For example, the client device130may store, or otherwise be associated with, a public root identity key132and a private root identity key134. The public/private key pair132and134may be programmed and/or stored in the client device130at its time of manufacture. The public root identity key (or public key)132may be distributed to other devices (e.g., including the configurator140), whereas the private root identity key (or private key)134may be known only to the client device130. The configurator140may use the public root identity key132to encrypt messages intended for the client device130, and the client device130may decrypt the messages using its private root identity key134.

To ensure that the client device130is a “trusted” device, the configurator140may obtain the public root identity key132in an out-of-band manner (e.g., using quick response (QR) codes, near-field communication (NFC), label strings, Bluetooth low energy (BLE), Universal Serial Bus (USB), etc.). For example, the configurator140may acquire the public root identity key132by scanning (e.g., with an optical device and/or camera) a QR code printed on a surface or housing of the client device130. Alternatively, the public root identity key132may be manually input by a user of the configurator140(e.g., after reading it off a printed label on the client device130). Still further, in some aspects, the client device130may send its public root identity key132to the configurator140over a short-range communications channel (e.g., NFC, BLE, USB, etc.). The out-of-band manner in which configurator140obtains the public root identity key132ensures that the client device130is within a relatively close proximity of the configurator140during the authentication process. The configurator140can therefore trust that the client device130is indeed the device it is supposed to be.

During the authentication process, the configurator140may set up a secure communications channel with the client device130using public key encryption. For example, the configurator140may exchange encrypted messages with the client device130to verify that the client device130is in possession of the private root identity key134associated with the public root identity key132, and to provide its own public root identity key (not shown for simplicity) to the client device130. Once authenticated, the client device130may send messages securely to the configurator140(e.g., using the public root identity key132of the configurator140), and the configurator140may send messages securely to the client device130(e.g., using the public root identity key132).

The configurator140may then configure the client device130to access and/or connect to the WLAN120. For example, the configurator140may “introduce” the client device130to other devices in the WLAN120including, for example, the AP110. In some aspects, the configurator140may also communicate with the AP110using public key encryption, for example, based on a public root identity key112and a private root identity key114of the AP110. By introducing the client device130and the AP110, the configurator140certifies that both devices are authenticated (e.g., trusted) members of the WLAN120. The client device130and AP110may then negotiate a shared pairwise master key (PMK) that may be used to establish a secure communication link between the devices. For example, the client device130may use the PMK to access and/or connect to the WLAN120(e.g., via a 4-way handshake as defined by the IEEE 802.11 specification).

In some aspects, the configurator140may control access to the WLAN120using a public key whitelist-based access control technique. For example, the configurator140may store a list of trusted (e.g., member) devices that are authorized to access and/or join the WLAN120. The list of trusted devices may be stored as the set of the network credentials142. In some embodiments, the network credentials142may include identity key information for each member of the WLAN120. In the example ofFIG. 1, the network credentials142may include the public root identity key132of the client device130and a public root identity key112of the AP110. Accordingly, the configurator140may limit access to the WLAN120to only those devices identified by the network credentials142(e.g., member devices).

In other aspects, the configurator140may control access to the WLAN120using a certificate-based access control technique. For example, the configurator140may use a pair of certification authority (CA) public and private keys (not shown for simplicity) to sign and/or certify communications by member devices of the WLAN120. In some embodiments, the network credentials142may include the CA public/private key pair used to certify members of the WLAN120. Thus, the configurator140may distribute the CA public key to member devices (e.g., client device130and AP110) of the WLAN120, and may use the CA private key to sign or encrypt communications by the member devices. This ensures that only member devices of the WLAN120(e.g., devices in possession of the CA public key) may decrypt and/or verify communications by other member devices (e.g., communications signed using the CA private key).

In example embodiments, the configurator140may distribute copies of the network credentials142to other devices in the WLAN120. As described above, the configurator140may be lost stolen, replaced, or otherwise removed (e.g., permanently) from the WLAN120. The example embodiments also recognize that access points tend to be relatively permanent fixtures in a wireless network, and are less likely to be lost or stolen. Thus, in example embodiments, the configurator140may transfer a copy of the network credentials142to be stored on the AP110. Although only one entity (e.g., AP110) is shown receiving the network credentials142in the example ofFIG. 1, in other embodiments, the configurator140may distribute the network credentials142to any number of devices (e.g., APs and/or client devices) in the WLAN120. For example, in some embodiments, the configurator140may distribute the network credentials142to the AP110and/or client device130.

Storing the network credentials142in a distributed manner (e.g., on multiple devices in the WLAN120) may provide redundancy in managing access to the WLAN120. Although the AP110may be less likely (than the configurator140) to become lost, stolen, or removed from the WLAN120, the AP110may also have a less robust feature set than the configurator140. For example, the AP110may not have a camera, Bluetooth radio, user input device, and/or other features necessary to enroll and/or manage devices using the network credentials142. Thus, for some embodiments, the AP110may transfer the network credentials142to another wireless device (not shown for simplicity) and enable the wireless device to assume the role of a configurator for the WLAN120.

FIG. 2shows a block diagram of a system200for distributing network credentials among multiple devices, in accordance with example embodiments. The system200includes an AP210, a configurator220, and a wireless device230. The AP210and configurator220may be embodiments of AP110and configurator140, respectively, ofFIG. 1.

The configurator220manages access to and/or control of a wireless network (not shown for simplicity) provided, at least in part, by the AP210. More specifically, the configurator220stores a set of network credentials (NC)222that may be used to provide and/or limit access to the wireless network to trusted and/or authenticated devices (e.g., members of the wireless network). In some aspects, the network credentials222may include a list of public root identity keys for trusted member devices (e.g., for public key whitelist-based access control). In other aspects, the network credentials222may include a pair of CA public and private keys that may be used by the configurator220(e.g., or other certification authority) to sign and/or certify communications by member devices (e.g., for certificate-based access control).

In example embodiments, the AP210may also store a copy of the network credentials222used by the configurator220to manage access to the wireless network. For example, the configurator220may store a copy of the network credentials222on the AP210upon enrolling the AP210as a member of the wireless network. To maintain synchronization of the network credentials222between the AP210and configurator220, the configurator220may periodically update the network credentials222stored on the AP210to reflect any additions and/or removals of member devices during a given period. Alternatively, the configurator220may update the network credentials222stored on the AP210in response to any changes to the membership of the wireless network.

The wireless device230may be any suitable device capable of communicating securely with the AP210and managing access to the wireless network. For example, the wireless device230may communicate with the AP210using public key encryption techniques and/or in accordance with a DPP protocol. For at least some embodiments, the wireless device230may include user input features (e.g., touchscreen, keyboard, microphone, etc.) for receiving inputs from a user or operator of the device. For example, the wireless device230may be a smartphone, PDA, tablet device, laptop computer, or the like. Further, the wireless device230may include one or more transceivers, one or more processing resources, one or more memory resources, and a power source. The memory resources may include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that stores instructions for performing operations described below with respect toFIG. 7.

In example embodiments, the AP210may “on-board” (e.g., set up or configure) the wireless device230as a configurator for the wireless network. For example, the wireless device230may serve as a backup and/or provide redundancy for the configurator220. In addition, the wireless device230may assume the role of the configurator220(e.g., and thus maintain the membership of the wireless network) in the event that the configurator220becomes lost, stolen, replaced, and/or otherwise removed from the wireless network. The AP210may set up the wireless device230as a configurator by further distributing a copy of the network credentials222to the wireless device230. For some embodiments, the AP210may first determine that the wireless device230is a “trusted” device before transferring the network credentials222to the wireless device230. However, without the configurator220present, the AP210may be unable to determine the trustworthiness of the wireless device230through the member enrollment process (e.g., using DPP authentication).

The example embodiments recognize that a particular user201may own and/or operate both the configurator220and the wireless device230. Thus, in example embodiments, the AP210may determine the trustworthiness of the wireless device230by authenticating the user201of the wireless device230(e.g., or authenticating the wireless device230based on the user201in possession of and/or operating the device). For example, the AP210may receive and/or request a user authentication credential (UAC)224from the configurator220upon receiving the network credentials222. The user authentication credential224may include any information that uniquely identifies the user201as the owner and/or operator of the configurator220. To verify that the user201is in possession of the configurator220, the AP210may request the user201to manually input and/or provide the user authentication credential224upon receiving the network credentials222form the configurator220.

In some embodiments, the user authentication credential224may include an alphanumeric password. For example, the AP210may prompt the user201to enter or input a password via a keyboard or touchscreen of the configurator220. In other embodiments, the authentication credential224may include an audio recording and/or voice data. For example, the AP210may prompt the user201to repeat a phrase displayed on a screen and/or surface of the configurator220, while a microphone of the configurator220records the user's voice. Still further, in some embodiments, the user authentication credential224may include a photo and/or image data. For example, the AP210may cause a camera or optical device of the configurator220to capture a photo of the user201.

The AP210may store the user authentication credential224in connection with the network credentials222. In some embodiments, the AP210may subsequently use the user authentication credential224to authenticate the wireless device230as a configurator for the wireless network. For example, when attempting to on-board the wireless device230, the user201of the wireless device230may be prompted to input or provide another user authentication credential (UAC)232via one or more input features (e.g., microphone, camera, touchscreen, keyboard, etc.) of the wireless device230. The wireless device230then sends the user authentication credential232to the AP210for authentication purposes.

The AP210may compare the user authentication credential232from the wireless device230with the user authentication credential224received from the configurator220to determine whether the same user201is the owner and/or operator of both the configurator220and the wireless device230. If the AP210determines that the user authentication credential232from the wireless device230substantially matches the user authentication credential224from the configurator220, the AP210may distribute the network credentials222to the wireless device230and enable the wireless device230to assume the role of a configurator for the wireless network.

FIG. 3is a sequence diagram300depicting an operation for on-boarding a new configurator for a wireless network, in accordance with example embodiments. With reference, for example, to the system200ofFIG. 2, the AP210may initially communicate with the configurator220as a member of a WLAN310.

Upon establishing a secure communication channel with the AP210, the configurator220may distribute a copy of the network credentials222to be stored on or by the AP210. The configurator220may transmit the network credentials222to the AP210via a secure communications channel. For example, in some aspects, the configurator220may encrypt the network credentials222using public key encryption techniques. In other aspects, the configurator220may transmit the network credentials222over a wireless channel of the wireless network.

In example embodiments, the AP210may request a user authentication credential (UAC) from a user of the configurator220upon receiving the network credentials222. For example, the AP210may send a UAC request301to the configurator220. The UAC request301may cause the configurator220to prompt the user201to input or provide the user authentication credential224. As described above, the user authentication credential224may include an alphanumeric password, a voice recording, image, and/or other information that uniquely identifies the user201of the configurator220. The configurator220then forwards the user authentication credential224to the AP210, to be stored in connection with the network credentials222.

In the example ofFIG. 3, the wireless device (WD)230is initially not a member of the WLAN310. Thus, before the wireless device230can be set up as a configurator for the WLAN310, the wireless device230may first establish a secure channel for communicating with the AP210. For some embodiments, the wireless device230may establish the secure channel in accordance with the DPP authentication protocol (e.g., as described above with respect toFIG. 1). For example, the wireless device230may first acquire a public root identity key303of the AP210. For some embodiments, the wireless device230may acquire and/or receive the public root identity key303from the AP210in an out-of-band manner (e.g., using a QR code, BLE communication, NFC communication, USB connection, label string, etc.) to ensure that the AP210is a trusted device.

The wireless device230may then use the public root identity key303of the AP210to establish a secure channel of communication with the AP210. For example, the wireless device230may provide its own public root identity key to the AP210via a DPP authentication request305. The DPP authentication request305may be encrypted using the public root identity key303of the AP210, and may thus be decrypted only if the AP210possess the corresponding (e.g., counterpart) private root identity key. The AP210may then send a DPP authentication response307back to the wireless device230to confirm or otherwise indicate to the wireless device230that the AP210successfully received (and decrypted) the DPP authentication request305. At this time, the wireless device230may communicate securely with the AP210(e.g., using the public root identity key303of the AP210), and the AP210may communicate securely with the wireless device230(e.g., using the public root identity key of the wireless device230).

After the secure communications channel is established, the wireless device230may request a set of network credentials (NC) from the AP210. For example, the wireless device230may send an NC request309to the AP210to retrieve a copy of the network credentials222. In example embodiments, the NC request309may include the user authentication credential232input by the user201of the wireless device230. To ensure the authenticity of the user authentication credential232, the wireless device230may prompt the user201to input or provide the user authentication credential232upon triggering and/or generating the NC request309.

The AP210may authenticate the user201of the wireless device230by comparing the user authentication credential232from the wireless device230with the user authentication credential224previously received from the configurator220. Upon verifying that the user201of the wireless device230is the same as the user of the configurator220, the AP210may transmit a copy of the network credentials222to the wireless device230and enable the wireless device230to operate as a configurator for the WLAN310. Accordingly, the wireless device230may provide redundancy for the configurator220and/or preserve the membership of the WLAN310in the event the configurator220becomes lost, stolen, replaced, or otherwise removed from the WLAN310.

FIG. 4shows a block diagram of an access point (AP)400in accordance with example embodiments. The AP400may be one embodiment of AP110ofFIG. 1and/or AP210ofFIG. 2. The AP400includes at least a PHY device410, a network interface420, a processor430, memory440, and a number of antennas450(1)-450(n). The network interface420may be used to communicate with a WLAN server (not shown for simplicity) either directly or via one or more intervening networks, and to transmit signals.

The PHY device410includes at least a set of transceivers411and a baseband processor412. The transceivers411may be coupled to antennas450(1)-450(n), either directly or through an antenna selection circuit (not shown for simplicity). The transceivers411may be used to transmit signals to and receive signals from other wireless devices (e.g., APs, client devices, and/or other wireless devices), and may be used to scan the surrounding environment to detect and identify nearby wireless devices (e.g., within wireless range of the AP400). The baseband processor412may be used to process signals received from processor430and/or memory440and to forward the processed signals to transceivers411for transmission via one or more antennas450(1)-450(n). The baseband processor412may also be used to process signals received from one or more antennas450(1)-450(n) via transceivers411and to forward the processed signals to the processor430and/or memory440.

Memory440may include a network credential store442that stores a set of network credentials used for authorizing devices (e.g., member devices) to access the WLAN. In some aspects, the network credential store442may store identity key information (e.g., public root identity keys) for each member of the WLAN (e.g., for public key whitelist-based access control). In other aspects, the network credential store442may store a pair of certification authority (CA) public and private keys that may be used to certify communications by member devices (e.g., for certificate-based access control). For some embodiments, the network credential store442may include a user authentication credential (UAC) store443to store a user authentication credential to be associated with the network credentials. For example, the user authentication credential may include a password, voice data, image data, and/or other information that uniquely identifies a user of a wireless device.

Memory440may also include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that may store at least the following software (SW) modules:

a network credential distribution SW module445to acquire and/or distribute the network credentials stored in the network credential store442among members of the WLAN;

a configurator authentication SW module446to authenticate a wireless device as a new configurator for the WLAN based at least in part on the user authentication credential; and

a configurator on-boarding SW module447to provide the network credentials stored in the network credential store442to the new configurator, and to enable the new configurator to manage and/or control access to the WLAN.

Each software module includes instructions that, when executed by the processor430, cause the AP400to perform the corresponding functions. The non-transitory computer-readable medium of memory440thus includes instructions for performing all or a portion of the operations depicted inFIG. 6and/or the AP-side operations depicted inFIG. 7.

Processor430may be any suitable one or more processors capable of executing scripts or instructions of one or more software programs stored in the AP400(e.g., within memory440). For example, processor430may execute the network credential distribution SW module445to acquire and/or distribute the network credentials stored in the network credential store442among members of the WLAN. The processor430may also execute the configurator authentication SW module446to authenticate a wireless device as a new configurator for the WLAN based at least in part on the user authentication credential. Still further, the processor430may execute the configurator on-boarding SW module447to provide the network credentials stored in the network credential store442to the new configurator, and to enable the new configurator to manage and/or control access to the WLAN.

FIG. 5shows a block diagram of a wireless device500in accordance with example embodiments. The wireless device500may be one embodiment of wireless device230ofFIG. 2. The wireless device500may also be one embodiment of configurator140ofFIG. 1and/or configurator220ofFIG. 2. The wireless device500includes at least a PHY device510, a processor520, memory530, and a number of antennas540(1)-540(n).

The PHY device510includes at least a set of transceivers511and a baseband processor512. The transceivers511may be coupled to antennas540(1)-540(n), either directly or through an antenna selection circuit (not shown for simplicity). The transceivers511may be used to transmit signals to and receive signals from other wireless devices (e.g., APs, client devices, and/or other wireless devices), and may be used to scan the surrounding environment to detect and identify nearby wireless devices (e.g., within wireless range of the wireless device500). The baseband processor512may be used to process signals received from processor520and/or memory530and to forward the processed signals to transceivers511for transmission via one or more antennas540(1)-540(n). The baseband processor512may also be used to process signals received from one or more antennas540(1)-540(n) via transceivers511and to forward the processed signals to the processor520and/or memory530.

Memory530may include a network credential store531that stores a set of network credentials used for authorizing devices (e.g., member devices) to access the WLAN. For some embodiments, the network credential store531may store identity key information (e.g., public root identity keys) for each member of the WLAN (e.g., for public key whitelist-based access control). For other embodiments, the network credential store531may store a pair of certification authority (CA) public and private keys that may be used to certify communications by member devices (e.g., for certificate-based access control).

Memory530may also include a non-transitory computer-readable medium (e.g., one or more nonvolatile memory elements, such as EPROM, EEPROM, Flash memory, a hard drive, etc.) that may store at least the following software (SW) modules:

a user authentication SW module532to acquire a user authentication credential (UAC)533from a user of the wireless device500;

a network credential offloading SW module534to offload and/or distribute the network credentials stored in the network credential store531to one or more member devices (e.g., APs) of the WLAN; and

a configurator setup SW module536to configure and/or operate the wireless device500as a configurator for the WLAN.

Each software module includes instructions that, when executed by the processor520, cause the wireless device500to perform the corresponding functions. The non-transitory computer-readable medium of memory530thus includes instructions for performing all or a portion of the configurator-side operations and/or wireless device-side operations depicted inFIG. 7.

Processor520may be any suitable one or more processors capable of executing scripts or instructions of one or more software programs stored in the wireless device500(e.g., within memory530). For example, processor520may execute the user authentication SW module532to acquire a user authentication credential533from a user of the wireless device500. The processor520may also execute the network credential offloading SW module534to offload and/or distribute the network credentials stored in the network credential store531to one or more member devices (e.g., APs) of the WLAN. Still further, the processor520may execute the configurator setup SW module536to configure and/or operate the wireless device500as a configurator for the WLAN.

FIG. 6shows an illustrative flowchart depicting an operation600for distributing network credentials for a wireless network, in accordance with example embodiments. With reference, for example, toFIG. 2, the example operation600may be performed by the AP210to distribute and/or transfer the set of network credentials222from the configurator220to the wireless device230.

The AP210first receives a set of network credentials from a configurator (610). For example, the AP210may receive the network credentials222from the configurator220upon authenticating to the configurator220and/or periodically thereafter (e.g., or in response to changes to the network credentials222). The network credentials222may be used to limit access to the wireless network to trusted and/or authenticated devices (e.g., members of the wireless network). In some aspects, the network credentials222may include a list of public root identity keys for trusted member devices (e.g., for public key whitelist-based access control). In other aspects, the network credentials222may include a pair of CA public and private keys that may be used by a certification authority to sign and/or certify communications by member devices (e.g., for certificate-based access control).

The AP210may receive a user authentication credential (UAC) from a wireless device (620). For example, the AP210may receive the user authentication credential232from the wireless device230. More specifically, the user201of the wireless device230may provide the user authentication credential232via one or more input features (e.g., microphone, camera, touchscreen, keyboard, etc.) of the wireless device. In some embodiments, the user authentication credential232may include an alphanumeric password. In other embodiments, the user authentication credential232may include an audio recording and/or voice data. Still further, in some embodiments, the user authentication credential232may include a photo and/or image data.

The AP210may then authenticate the wireless device as a new configurator based at least in part on the user authentication credential (630). The example embodiments recognize that the same user201may own and/or operate both the wireless device230and the configurator220. Thus, the AP210may determine the trustworthiness of the wireless device230by authenticating the user201(e.g., rather than merely authenticating the wireless device230). For example, the AP210may compare the user authentication credential232form the wireless device230with a stored user authentication credential224(e.g., which may be previously received from the configurator220) to determine whether the same user201input both user authentication credentials224and232. The AP210may authenticate the wireless device as a new configurator if the user authentication credential232from the wireless device230substantially matches the stored user authentication credential224.

Finally, the AP210may transmit the network credentials to the wireless device upon authenticating the wireless device as the new configurator (640). For example, the AP210may distribute a copy of the network credentials222to the wireless device230to enable the wireless device230to serve as a backup and/or provide redundancy for the configurator220. Furthermore, by storing a local copy of the network credentials222, the wireless device230may assume the role of the configurator220(e.g., and thus maintain the membership of the wireless network) in the event that the configurator220becomes lost, stolen, replaced, and/or otherwise removed from the wireless network.

FIG. 7shows an illustrative flowchart depicting an operation700for on-boarding a new configurator in a wireless network, in accordance with example embodiments. With reference, for example, toFIG. 2, the example operation700may be carried out by the AP210, configurator220, and wireless device230, to on-board the wireless device230as a configurator for the wireless network.

The configurator220receives a first user authentication credential (UAC0) from a user of the configurator220(702). As described above, the first user authentication credential UAC0may include an alphanumeric password, a voice recording, image, and/or other information that uniquely identifies the user201of the configurator220. More specifically, the user201may input the first user authentication credential UAC0on the configurator220using one or more input features (e.g., microphone, camera, touchscreen, keyboard, etc.) of the configurator220.

The configurator220then sends a set of network credentials (NC), with the first user authentication credential UAC0, to the AP210(704). For example, the configurator220may distribute a copy of the network credentials222(e.g., for authorizing and/or limiting access to the wireless network to member devices) to be stored on or by the AP210. For some embodiments, the network credentials222may be redistributed (e.g., by the AP210) to other devices. Accordingly, the first user authentication credential UAC0may serve as a “reference credential” for verifying a trustworthiness (e.g., user) of any device attempting to acquire a copy of the network credentials222.

The AP210stores the network credentials and the first user authentication credential UAC0from the configurator220(706). For some embodiments, the AP210may request the first user authentication credential UAC0after first receiving a copy of the network credentials222from the configurator220. For example, upon receiving the network credentials222, the AP210may send a UAC request to the configurator220, causing the configurator220to prompt the user201to input or provide the first user authentication credential UAC0. In example embodiments, the AP210may use the network credentials222and first user authentication credential UAC0to on-board new configurator devices. For example, the AP210may on-board the wireless device230as a configurator for the wireless network.

The wireless device230receives a second user authentication credential (UAC1) from a user of the wireless device230(708). The second user authentication credential UAC1may be of the same format and/or type as the first user authentication credential UAC0. For example, the second user authentication credential UAC1may include an alphanumeric password, a voice recording, image, and/or other information that uniquely identifies the user201of the wireless device230. Specifically, the user201may input the second user authentication credential UAC1using one or more input features (e.g., microphone, camera, touchscreen, keyboard, etc.) of the wireless device230.

The wireless device230further establishes a secure channel of communications with the AP210(710). In example embodiments, the wireless device230may establish the secure channel in accordance with a DPP protocol. For example, the wireless device230may acquire a public root identity key of the AP210in an out-of-band manner (e.g., using a QR code, BLE communication, NFC communication, USB connection, label string, etc.), to ensure that the AP210is a trusted device. The wireless device230may then initiate a DPP authentication process with the AP210to establish the secure communications channel (e.g., via an exchange of encrypted messages). During the authentication process, the wireless device230may provide its own public root identity key to the AP210.

The wireless device230then sends the second user authentication credential UAC1to the AP210via the secure communication channel (712). For example, the wireless device230may encrypt the second user authentication credential UAC1using its own private root identity key. The AP210may then decrypt the second user authentication credential UAC1using the public root identity key of the wireless device230(e.g., received during the DPP authentication process).

The AP210may compare the second user authentication credential UAC1to the first user authentication credential UAC0to verify the user201of the wireless device230(714). In example embodiments, the AP210may determine whether the user201of the wireless device230is the same as the user201of the configurator220based on the comparison. If the second user authentication credential UAC1does not match the first user authentication credential UAC0(716), the AP210may terminate the configurator setup of the wireless device230(718). For example, the AP210may send a message to the wireless device230indicating that the wireless device230(and/or user of the wireless device230) could not be authenticated.

If the second user authentication credential UAC1substantially matches the first user authentication credential UAC0(as tested at716), the AP210may proceed to send the stored network credentials to the wireless device230(720), and enable the wireless device230to operate as a configurator for the wireless network using the network credentials (722). For example, the wireless device230may receive a copy of the network credentials222from the AP210, and may subsequently use the network credentials222to provide and/or limit access to the wireless network to member devices. Accordingly, the wireless device230may provide redundancy for the configurator220and/or preserve the membership of the wireless network in the event the configurator220becomes lost, stolen, replaced, or otherwise removed from the wireless network.