Wireless network authentication using isolated security key

A method includes generating, at a first station, a security key that is usable for authentication with an access point associated with a wireless network. The method includes switching from an infrastructure mode to an ad hoc communication mode, and while in the ad hoc communication mode, broadcasting a beacon frame and receiving a request, from a second station, to join the wireless network. The method includes determining that the second station is an approved device and sending a first authentication request to the access point on behalf of the second station. The method includes receiving a first authentication response, including challenge text, from the access point. The method includes encrypting the challenge text based on the security key and sending the encrypted challenge text as part of a second authentication request to the access point to authenticate the second station with the access point.

The present disclosure is generally related to wireless network authentication.

A mobile device can authenticate with an access point to become part of a wireless network. Typically, the mobile device uses a security key to authenticate with the access point. As a non-limiting example, in a home setting, a user can enter a security key (e.g., a password) into the user's mobile device to authenticate the user's mobile device with an access point of the user's home wireless network.

If a guest enters the user's home and wishes to access the user's home wireless network with a guest mobile device, the user will typically have to give the guest the security key so that the guest can enter the security key into the guest mobile device. However, once the security key is shared, the likelihood that additional mobile devices will access the user's home wireless network, with or without the user's permission, increases. As a result, the user's home wireless network can become susceptible to network congestion and security threats.

According to a particular implementation of the techniques disclosed herein, a method of station authentication includes generating, at a first station, a security key that is usable for authentication with an access point associated with a wireless network during an infrastructure mode. The method also includes switching from the infrastructure mode to an ad hoc communication mode for a particular time period. While in the ad hoc communication mode for the particular time period, the method includes broadcasting a beacon frame and receiving a request, from a second station, to join the wireless network in response to broadcasting the beacon frame. The beacon frame includes network information associated with the wireless network, and the request includes device information associated with the second station. The method also includes determining, based on the device information, whether the second station is an approved device. The method further includes sending a first authentication request to the access point on behalf of the second station in response to a determination that the second station is an approved device. The first authentication request includes the device information associated with the second station. The method also includes receiving a first authentication response from the access point in response to sending the first authentication request. The first authentication response includes challenge text. The method further includes encrypting the challenge text based on the security key to generate encrypted challenge text. The security key is isolated from the second station. The method also includes sending the encrypted challenge text as part of a second authentication request to the access point to authenticate the second station with the access point.

According to another implementation of the techniques disclosed herein, a station includes a memory and a processor coupled to the memory. The processor is configured to generate a security key that is usable for authentication with an access point associated with a wireless network during an infrastructure mode. The processor is also configured to initiate a switch from the infrastructure mode to an ad hoc communication mode for a particular time period. The station also includes a transceiver coupled to the processor. The transceiver is configured to, while in the ad hoc communication mode for the particular time period, broadcast a beacon frame and receive a request, from a second station, to join the wireless network in response to broadcasting the beacon frame. The beacon frame includes network information associated with the wireless network, and the request includes device information associated with the second station. The processor is further configured to determine, based on the device information, whether the second station is an approved device. The transceiver is further configured to send a first authentication request to the access point on behalf of the second station in response to a determination that the second station is an approved device. The first authentication request includes the device information associated with the second station. The transceiver is also configured to receive a first authentication response from the access point in response to sending the first authentication request. The first authentication response includes challenge text. The processor is further configured to encrypt the challenge text based on the security key to generate encrypted challenge text. The security key is isolated from the second station. The transceiver is further configured to send the encrypted challenge text as part of a second authentication request to the access point to authenticate the second station with the access point.

According to another implementation of the techniques disclosed herein, a non-transitory computer-readable medium includes instructions for station authentication. The instructions, when executed by a processor in a station, cause the processor to perform operations including generating a security key that is usable for authentication with an access point associated with a wireless network during an infrastructure mode. The operations also include initiating a switch from the infrastructure mode to an ad hoc communication mode for a particular time period. While in the ad hoc communication mode for the particular time period, the operations include initiating a broadcast of a beacon frame and processing a received request, from a second station, to join the wireless network in response to broadcasting the beacon frame. The beacon frame includes network information associated with the wireless network, and the request includes device information associated with the second station. The operations also include determining, based on the device information, whether the second station is an approved device. The operations further include initiating transmission of a first authentication request to the access point on behalf of the second station in response to a determination that the second station is an approved device. The first authentication request includes the device information associated with the second station. The operations also include processing a received first authentication response from the access point in response to sending the first authentication request. The first authentication response includes challenge text. The operations further include encrypting the challenge text based on the security key to generate encrypted challenge text. The security key is isolated from the second station. The operations also include initiating transmission of the encrypted challenge text as part of a second authentication request to the access point to authenticate the second station with the access point.

One advantage of the above-described implementations is an ability to permit access to a wireless network without having to disclose a security key for the wireless network. For example, a station can use the security key to authenticate other approved stations with an access point of the wireless network without disclosing the security key. Other implementations, advantages, and features of the present disclosure will become apparent after review of the entire application, including the following sections: Brief Description of the Drawings, Detailed Description, and the Claims.

V. DETAILED DESCRIPTION

Particular aspects of the present disclosure are described below with reference to the drawings. In the description, common features are designated by common reference numbers. As used herein, various terminology is used for the purpose of describing particular implementations only and is not intended to be limiting of implementations. For example, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It may be further understood that the terms “comprise,” “comprises,” and “comprising” may be used interchangeably with “include,” “includes,” or “including.” Additionally, it will be understood that the term “wherein” may be used interchangeably with “where.” As used herein, “exemplary” may indicate an example, an implementation, and/or an aspect, and should not be construed as limiting or as indicating a preference or a preferred implementation. As used herein, an ordinal term (e.g., “first,” “second,” “third,” etc.) used to modify an element, such as a structure, a component, an operation, etc., does not by itself indicate any priority or order of the element with respect to another element, but rather merely distinguishes the element from another element having a same name (but for use of the ordinal term). As used herein, the term “set” refers to one or more of a particular element, and the term “plurality” refers to multiple (e.g., two or more) of a particular element.

In the present disclosure, terms such as “determining”, “calculating”, “detecting”, “estimating”, “shifting”, “adjusting”, etc. may be used to describe how one or more operations are performed. It should be noted that such terms are not to be construed as limiting and other techniques may be utilized to perform similar operations. Additionally, as referred to herein, “generating”, “calculating”, “estimating”, “using”, “selecting”, “accessing”, and “determining” may be used interchangeably. For example, “generating”, “calculating”, “estimating”, or “determining” a parameter (or a signal) may refer to actively generating, estimating, calculating, or determining the parameter (or the signal) or may refer to using, selecting, or accessing the parameter (or signal) that is already generated, such as by another component or device.

Referring toFIG. 1, a system100that is operable to authenticate wireless communication stations with an access point using an isolated security key is shown. The system100includes a station110, a station120, a station130, and an access point140. Although illustrated as laptop computers, in different implementations, one or more of the stations110,120,130may include a headset, a smart watch, a mobile communication device, a smart phone, a cellular phone, a laptop computer, a computer, a tablet, a personal digital assistant, a display device, a television, a gaming console, a music player, a radio, a digital video player, a digital video disc (DVD) player, a tuner, a camera, a navigation device, a vehicle, a component of a vehicle, or any combination thereof, as illustrative, non-limiting examples.

The access point140is a networking hardware device that enables stations to connect to a wired network160. For example, the access point140establishes a wireless network150. Stations within the wireless network150can communicate with the wired network160through the access point140. According to one implementation, the wireless network150includes an Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless network. The wireless network150can be a wireless local area network (WLAN).

To join the wireless network150, a station must use a security key232to authenticate with the access point140. The access point140sends an authentication message at the end of the authentication process to indicate that a station receiving the authentication message has been authenticated. After authentication, the station can associated with the wireless network150using conventional techniques. As illustrated inFIG. 1, the station110has access to the security key232. As a result, the station110is included in the wireless network150and can communicate with the wired network160through the access point140. The stations120,130are isolated from the security key232. That is, the security key232is not readily available to the stations120,130to use for authentication with the access point140.

The techniques described herein enable the station110to selectively authenticate the other stations120,130with the access point140using the security key232upon a determination that the stations120,130are approved devices. As described below, it should be appreciated that the station110can perform the authentication on behalf of the other stations120,130without sharing the security key232with the other stations120,130. As a result of not sharing the security key232, it will become increasingly difficult for unauthorized parties to access the wireless network150. Thus, the wireless network150will be less susceptible to network congestion and security threats.

Referring toFIG. 2, a diagram of the station110having access to the security key232is shown. The station110includes a processor202. According to some implementations, the processor202is a multi-core processor. According to other implementations, the processor202is a single-core processor. The processor202can be a central processing unit (CPU), a digital signal processor (DSP), or another type of processor. The station110also includes a memory204coupled to the processor202, a database206coupled to the processor202, a wireless transceiver208coupled to the processor202, and a display controller210coupled to the processor202. An interactive user display212is coupled to the display controller210.

The memory204can be a non-transitory computer-readable medium that stores instructions214. The instructions214are executable by the processor202to perform the operations described herein. According to one implementation, the instructions214are executable by the processor202to cause the processor202to perform or initiate steps in the method700ofFIG. 7. The memory204can be random access memory (RAM), magnetoresistive random access memory (MRAM), spin-torque transfer MRAM (STT-MRAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disk, a removable disk, or a compact disc read-only memory (CD-ROM).

The processor202includes a security key generator220, a mode selector222, a data transfer monitor224, a prompt generator226, a frame generator228, and an encryption unit230. According to some implementations, one or more of the processor components220,222,224,226,228,230can correspond to software (e.g., instructions214) executable by the processor202. According to other implementations, one or more the processor components220,222,224,226,228,230can correspond to dedicated circuitry (e.g., application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs)) integrated into the processor202. Additionally, one or more of the processor components220,222,224,226,228,230can be integrated with another processor component.

The security key generator220is configured to generate the security key232used to authenticate the station110with the access point140. According to one implementation, the security key232can have an ASCII form such that it includes a sequence of letters, decimal numbers, or a combination thereof. According to another implementation, the security key232can have a Hex form such that it includes a sequence of hexadecimal numbers. The security key232is usable by the station110to authenticate with the access point140. As a non-limiting example, during a four-way handshake, the security key232is used by the station110during an encryption process to grant the station110access into the wireless network150.

As described above, with respect toFIG. 1, the station110is configured to selectively authenticate the other stations120,130with the access point140using the security key232upon a determination that the stations120,130are approved devices. To begin the authentication, the processor202is configured to establish an ad hoc communication network (e.g., a peer-to-peer network) with the other stations120,130using a service set identifier (SSID) of the ad hoc communication network. After the ad hoc communication network is established such that the station110can directly exchange messages with the other stations110,120based on peer-to-peer transmissions, the mode selector222switches the station110from an infrastructure mode234to an ad hoc communication mode236for a particular time period. According to some implementations, the particular time period can be equal to one time unit, two time units, three time units, or four time units, where each time unit is equal to 1024 microseconds. Although the above examples of the particular time period are not intended to be limiting, it should be appreciated that a shorter particular time period is preferable to reduce the amount of time that the station110is not operating in the infrastructure mode234. While operating in the infrastructure mode234, the wireless transceiver208can communicate messages with the access point140. However, while operating in the ad hoc communication mode236, the wireless transceiver208can directly communicate messages with the stations120,130using the ad hoc communication network.

According to some implementations, the data transfer monitor224is configured to monitor a data transfer amount238(e.g., an amount of data transfer) associated with the wireless network150while operating in the infrastructure mode234. To reduce network interference when the data transfer amount238is relatively high, the mode selector222can be configured to switch from the infrastructure mode234to the ad hoc communication mode236in response to a determination that the data transfer amount238fails to satisfy a data transfer threshold.

According to other implementations, the mode selector222is configured to periodically switch from the infrastructure mode234to the ad hoc communication mode236. As non-limiting examples, the mode selector222can switch from the infrastructure mode234to the ad hoc communication mode236every twenty time units, every twenty-five time units, every thirty time units, every fifty time units, etc. If the mode selector222performs periodic switching, according to some implementations, the period can be determined based on a number of stations that have historically authenticated with the access point140. For example, if a relatively large number of stations have been authenticated with the access point140in the past, the period can be relatively small (e.g., twenty time units) because it is more likely that stations are trying to access the wireless network150. However, if a relatively small number of stations have been authenticated with the access point140in the past, the period can be relatively large (e.g., fifty time units) because it is not likely that stations are trying to access the wireless network150. Thus, a frequency at which the mode selector222initiates a periodic switch from the infrastructure mode234to the ad hoc communication mode236can be dependent on a historical number of stations that have been authenticated with the access point140. According to yet another implementation, switching from the infrastructure mode234to the ad hoc communication mode236is initiated by a user request.

While operating in the ad hoc communication mode236during the particular time period, the frame generator228is configured to generate a beacon frame242, and the wireless transceiver208is configured to broadcast the beacon frame242to stations in the ad hoc communication network (e.g., the stations120,130). The beacon frame242includes network information244associated with the wireless network150. According to some implementations, the network information244includes a SSID of the wireless network150, capability information of the access point140, etc. Although described as a “broadcast,” it should be understood that term “broadcast” as used herein can also mean a multicast or unicast.

According to some implementations, the station110can receive an “original” beacon frame (having the network information244) from the access point140while operating in the infrastructure mode234. The frame generator228can generate the beacon frame242using the network information244from the original beacon frame broadcast from the access point140. For example, after receiving the original beacon frame from the access point140, the frame generator228can populate the relative fields in the beacon frame142with the SSID of the wireless network150, the capability information of the access point140, etc.

Additionally, while operating in the ad hoc communication mode236during the particular time period, the wireless transceiver208can receive a request180, from the station120, to join the wireless network150in response to broadcasting the beacon frame242, as shown inFIG. 1. The request180includes device information248associated with the station120. The device information248can include an address of the station120(e.g., a media access control (MAC) address of the station120), capability information of the station120, etc. Although the request180is described as being received during the particular time period, in some implementations, the request180can be received during a subsequent switch from the infrastructure mode234to the ad hoc communication mode236.

The processor202is configured to determine, based on the device information248associated with the station120, whether the station120is an approved device. For example, the processor202can make a determination of whether to grant the station120access to the wireless network150.

According to one implementation, to determine whether the station120is an approved device, the prompt generator226can generate a prompt240to verify whether the station120has permission to join the wireless network150. The prompt240displays information about the station120based on the device information248. The display controller210is configured to display the prompt240at the interactive user display212.

Referring toFIG. 3, an illustrative example of the prompt240on the interactive user display212is shown. The prompt240inquires whether the station120(e.g., “Sammy David's Phone”) has permission to join the wireless network150. According to the illustrative example, the name of the station120(e.g., “Sammy David's Phone”) in the prompt240can be generated based on the device information248of the station120transmitted in the request180. The prompt240also includes a user-selectable option302and a user-selectable option304. A user response is received by the processor202and indicates which user-selectable option302,304was selected. The station120is an approved device if the user response indicates that the station120has permission to join the wireless network150(e.g., if the user-selectable option302is selected). The station120is not an approved device if the user response indicates that the station120does not have permission to join the wireless network304(e.g., if the user-selectable option304is selected).

Referring back toFIG. 2and according to another implementation, to determine whether the station120is an approved device, the processor202is configured to access a list of stations260that have previously been granted permission to join the wireless network150. The list of stations260can be stored in the database206coupled to the processor202. In the illustrative example inFIG. 2, the list of stations260includes device information248of the station120and device information262for another station (not shown). The processor202is configured to compare the device information248associated with the station120to device information248,262associated with stations in the list of stations260. The station120is an approved device if the device information248associated with the station120matches device information of a station in the list of stations260, and the station120is not an approved device if the device information associated with the station120fails to match device information of a station in the list of stations260.

For purposes of description, assume that the station120is an approved station. That is, according to the user prompt240implementation, assume that the user-selectable option302is selected. Additionally, or in the alternative, according to the illustrative example inFIG. 2, because the device information248associated with the station120matches an entry in the list of stations260, the processor202determines that the station120is an approved device. It should be understood that other techniques can be used to determine whether the station120is an approved device and the examples above are merely for illustrative purposes and should not be construed as limiting.

In response to the determination that the station120is an approved device, the frame generator228is configured to generate an authentication request246that includes the device information248associated with the station120. The wireless transceiver208is configured to send the authentication request246to the access point140on behalf of the station120in response to the determination that the station120is an approved device. One implementation of generating the authentication request246and sending the authentication request246on behalf of the station120is described with respect toFIG. 4. However, it should be understood that the techniques described with respect toFIG. 4are merely illustrative and should not be construed as limiting.

Referring toFIG. 4, an illustrative example of the authentication request246is shown. The authentication request246includes a MAC header450and a frame body460. The MAC header450includes a frame control field402, a duration field404, a destination address field406, a source address field408, a transmitter address field410(e.g., a relay address field), a SSID field412, and a sequence control field414. The frame body460includes an authentication algorithm number field416, an authentication transaction sequence number field418, a status code field420, and a challenge text field422. The authentication request246also includes a frame check sequence field424.

For the station110to send the authentication request246to the access point140on behalf of the station120, the frame generator228is configured to populate the destination address field406in the authentication request246with a MAC address140A of the access point140(e.g., an address of the access point140). Populating the destination address field406with the MAC address140of the access point140results in transmission of the authentication request246to the access point140. The MAC address140A of the access point140can be determined based on the network information244.

Additionally, to send the authentication request246to the access point140on behalf of the station120, the frame generator228is configured to populate the source address field408in the authentication request246with a MAC address120A of the station120. Although the source of the authentication request246is the station110in reality, populating the source address field408with the MAC address120A of the station120indicates to the access point140that the station120is requesting authentication (as opposed to the station110). Thus, by populating the source address field408with the MAC address120A of the station120, the station110is sending the authentication request246“on behalf” of of the station120. The MAC address120A of the station120can be determined based on the device information248.

The frame generator228is also configured to populate the transmitter address field410with a MAC address110A of the station110. The transmitter address field410indicates, to the access point140, an address to send a response frame. By populating the transmitter address field410with the MAC address110A of the station110, the access point140will send the response frame (e.g., an authentication response190as shown inFIG. 1) to the station110, although the authentication request246is for the station120. Thus, populating the transmitter address field410with the MAC address110A of the station110promotes the access point140to relay the authentication response190to the station120by way of the station110. It should be understood that a “relay” from station to station would be performed when switching to the ad hoc communication mode236as opposed to during the infrastructure mode234where messages are communicated with the access point140. The other fields402,404,412,414,416,418,420,422,424can be populated according to a shared key authentication (SKA) method.

Referring back toFIG. 1, the access point140sends the authentication response190to the station110(as opposed to the station120that is in the process of authentication) because the transmitter address field410(e.g., the relay address field) in the authentication request246identified the station110. Thus, according to one implementation of the techniques described herein, the access point140sends response frames to the MAC address identified in the transmitter address field in a request or probe, as opposed to sending response frames to the source address field in the request or probe.

Referring toFIG. 5, an illustrative example of the authentication response190is shown. The authentication response190includes a MAC header550and a frame body560. The MAC header550includes a frame control field502, a duration field504, a destination address field506, a source address field508, a transmitter address field510(e.g., a relay address field), a SSID field512, and a sequence control field514. The frame body560includes an authentication algorithm number field516, an authentication transaction sequence number field518, a status code field520, and a challenge text field522. The authentication response190also includes a frame check sequence field524.

The access point140populates the destination address field506with the MAC address110A of the station110in response to the frame generator228populating the transmitter address field410in the authentication request246with the MAC address110A of the station. Thus, the access point140sends the authentication response190to the station110that sent the authentication request246. The access point140populates the source address field508and the transmitter address field510with the MAC address140A of the access point140.

The access point140also populates the challenge text field522with challenge text552. The challenge text552is a sequence of characters that are to be encrypted by the receiving station (e.g., the station110) for verification. For example, the access point140, in addition to the station110, has access to the security key232. The access point140sends the challenge text552for encryption to a station requesting authentication. If the station has the security key232, the station encrypts the challenge text552using the security key232and sends the encrypted version of the challenge text552to the access point140. If the access point140decrypts the encrypted version of the challenge text552using the security key232and gets the challenge text552, then the access point140authenticates the station. However, if the access point140decrypts the encrypted version of the challenge text552using the security key232and does not get the challenge text552as sent, then the access point140does not authenticate the station. To increase security, the challenge text552can change for each authentication process.

As described below, sending the authentication response190to the station110enables the station190to encrypt the challenge text552(on behalf of the station120) using the security key232while isolating the station120from the security key232. The other fields502,504,512,514,516,518,520,524can be populated according to a SKA method.

Referring back toFIG. 2, the wireless transceiver208is configured to receive the authentication response190in response to sending the authentication request246to the access point140. The station110is configured to bypass relaying the authentication response190to the station120after receiving the authentication response190to isolate the station120from the challenge text552. That is, the station110can bypass switching to the ad hoc communication mode236to relay the authentication response190to the station120.

Upon receiving the authentication response190, the encryption unit230is configured to encrypt the challenge text552based on the security key232to generate encrypted challenge text258. The frame generator228is configured to generate an authentication request250after the encrypted challenge text258is generated, and the wireless transceiver208is configured to send the encrypted challenge text258as part of the authentication request250to the access point140to authenticate the station120with the access point140.

Referring toFIG. 6, an illustrative example of the authentication request250is shown. The authentication request250includes a MAC header650and a frame body660. The MAC header650includes a frame control field602, a duration field604, a destination address field606, a source address field608, a transmitter address field610(e.g., a relay address field), a SSID field612, and a sequence control field614. The frame body660includes an authentication algorithm number field616, an authentication transaction sequence number field618, a status code field620, and a challenge text field622. The authentication request250also includes a frame check sequence field624.

For the station110to send the authentication request250to the access point140on behalf of the station120, the frame generator228is configured to populate the destination address field606in the authentication request246with the MAC address140A of the access point140. Populating the destination address field606with the MAC address140of the access point140results in transmission of the authentication request250to the access point140.

Additionally, to send the authentication request250to the access point140on behalf of the station120, the frame generator228is configured to populate the source address field608in the authentication request250and the transmitter address field610in the authentication request250with the MAC address120A of the station120. Populating the source and transmitter address fields608,610with the MAC address120A of the station120promotes the access point140to send an authentication message192to the station120, as illustrated inFIG. 1.

The frame generator228is configured to populate the challenge text field622with the encrypted challenge text258. As described above, once the authentication request250is received by the access point140, the encrypted challenge text258is decrypted by the access point140using the security key232for verification. The other fields402,404,412,414,416,418,420,422,424can be populated according to a SKA method.

Referring back toFIG. 1, the access point140receives, from the station110, the authentication request250having the encrypted challenge text258. The access point140is configured to decrypt the encrypted challenge text258using the security key232to re-generate the challenge text552sent to the station110. Upon successful regeneration of the challenge text552, the access point140sends the authentication message192to the station120to enable the station120to join the wireless network150. Thus, the station110permits and controls access of the station120to the wireless network150without having to disclose the security key232for the wireless network150to the station120. For example, the station110uses the security key232to authenticate other approved stations (e.g., the station120) with the access point140of the wireless network150without disclosing the security key232.

According to another implementation, the frame generator228is configured to populate the transmitter address field610in the authentication request250with the MAC address110A of the station110to promote the access point140to send the authentication message192to the station110. In this implementation, the station110receives the authentication message192from the access point140and relays the authentication message192to the station120while in the ad hoc communication mode236.

In other scenarios, the station110can inhibit another station from joining the wireless network150. To illustrate, while operating in the ad hoc communication mode236during the particular time period, the wireless transceiver208can receive a request182, from the station130, to join the wireless network150in response to broadcasting the beacon frame242, as shown inFIG. 1. The request182includes device information256associated with the station130. The device information256can include an address of the station130(e.g., a MAC address of the station130), capability information of the station130, etc.

The processor202is configured to determine, based on the device information256associated with the station130, whether the station130is an approved device. For example, the processor202can make a determination of whether to grant the station130access to the wireless network120.

In a similar manner as described above, to determine whether the station130is an approved device, the prompt generator226can generate a prompt to verify whether the station130has permission to join the wireless network150. According to another implementation, to determine whether the station130is an approved device, the processor202is configured to access the list of stations260that have previously been granted permission to join the wireless network150. For purposes of description, assume that the station130is not an approved device.

In response to the determination that the station130is not an approved device, the frame generator228is configured to generate an exclusion frame254that includes the device information256associated with the station130. The wireless transceiver208is configured to send the exclusion frame254to the access point140, as shown inFIG. 1, and the access point140rejects authentication requests from the station130in response to receiving the exclusion frame254.

It should be appreciated that the techniques described with respect toFIGS. 1-6enable the station110to permit and control access to the wireless network150without having to disclose the security key232for the wireless network150. For example, the station110uses the security key232to authenticate other approved stations (e.g., the station120) with the access point140of the wireless network150without disclosing the security key232to the approved stations. The station110can also send messages to exclude unapproved stations (e.g., the station130) from the wireless network150. As a result, by performing the authentication on behalf of other stations and controlling access to the wireless network150without disclosing the security key232, the likelihood that additional mobile devices will access the wireless network150, with or without the user's permission, decreases. Thus, the wireless network150is less susceptible to network congestion and security threats.

Referring toFIG. 7, a method700of station authentication is shown. The method700may be performed by the station110ofFIGS. 1 and 2, as illustrative examples.

The method700includes generating, at a first station, a security key that is usable for authentication with an access point associated with a wireless network during an infrastructure mode, at702. For example, referring toFIG. 2, the security key generator220generates the security key232that is usable for authentication with the access point140associated with the wireless network150during the infrastructure mode234. According to one implementation of the method700, the wireless network includes an IEEE 802.11 wireless network. According to one implementation of the method700, the wireless network includes a WLAN.

The method700also includes switching from the infrastructure mode to an ad hoc communication mode for a particular time period, at704. For example, referring toFIG. 2, the mode selector222switches the station110from the infrastructure mode234to the ad hoc communication mode236for the particular time period.

According to one implementation of the method700, switching from the infrastructure mode to the ad hoc communication mode includes monitoring an amount of data transfer associated with the wireless network while operating in the infrastructure mode and switching from the infrastructure mode to the ad hoc communication mode in response to a determination that the amount of data transfer fails to satisfy a data transfer threshold. For example, referring toFIG. 2, the data transfer monitor224monitors the data transfer amount238associated with the wireless network150while operating in the infrastructure mode234, and the mode selector222switches the station110from the infrastructure mode234to the ad hoc communication mode236in response to a determination that the data transfer amount238fails to satisfy the data transfer threshold.

According to another implementation of the method700, switching from the infrastructure mode to the ad hoc communication mode is periodically initiated by the first station. For example, referring toFIG. 2, the mode selector222periodically switches from the infrastructure mode234to the ad hoc communication mode236. A frequency at which the first station initiates a periodic switch from the infrastructure mode to the ad hoc communication mode can be dependent on a historical number of stations that have been authenticated with the access point.

According to another implementation of the method700, switching from the infrastructure mode to the ad hoc communication mode is initiated by a user request. For example, referring toFIG. 2, the mode selector222switches from the infrastructure mode234to the ad hoc communication mode236in response to a user request.

While in the ad hoc communication mode for the particular time period, the method700includes (i) broadcasting a beacon frame and (ii) receiving a request, from a second station, to join the wireless network in response to broadcasting the beacon frame. The beacon frame includes network information associated with the wireless network, and the request includes device information associated with the second station. For example, referring toFIGS. 1 and 2, while operating in the ad hoc communication mode236, the station110broadcasts (e.g., sends) the beacon frame242to the stations120,130and receives the request180, from the station120, to join the wireless network150in response to broadcasting the beacon frame242. The beacon frame242includes the network information244associated with the wireless network150, and the request180includes the device information248associated with the station120. According to one implementation of the method700, the network information includes a service set identifier (SSID) of the wireless network and capability information of the access point. According to one implementation of the method700, the device information associated with the second station includes an address of the second station and capability information of the second station.

The method700also includes determining, based on the device information, whether the second station is an approved device, at706. For example, referring toFIGS. 2-3, the processor202determines, based on the device information248associated with the station120, whether the station120is an approved device.

According to one implementation of the method700, determining whether the second station is an approved device comprises generating, based on the device information associated with the second station, a prompt to verify whether the second station has permission to join the wireless network. For example, referring toFIG. 2, the prompt generator226generates the prompt240, based on the device information248, to verify whether the station120has permission to join the wireless network150. According to the above-implementation, determining whether the second station is an approved device also includes displaying the prompt at the first station and receiving a user response to the prompt. For example, referring toFIGS. 2-3, the display controller210can display the prompt240at the interactive user display212(as shown inFIG. 3), and the processor202receives the user response (e.g., the selection of one of the options302,304). The second station (e.g. the station120) is an approved device if the user response indicates that the second station has permission to join the wireless network150. The second station is not an approved device if the user response indicates that the second station does not have permission to join the wireless network150.

According to one implementation of the method700, determining whether the second station is an approved device comprises accessing a list of stations that have previously been granted permission to join the wireless network. For example, referring toFIG. 2, the processor202accesses the list of stations260in the database206. According to the above-implementation, determining whether the second station is an approved device also includes comparing the device information associated with the second station to device information associated with stations in the list of stations. For example, referring toFIG. 2, the processor202compares the device information248associated with the station120with the device information248,262of stations in the list of stations260. The second station (e.g., the station120) is an approved device if the device information associated with the second station matches device information of a station in the list of stations, and the second station is not an approved device if the device information associated with the second station fails to match device information of a station in the list of stations.

The method700also includes sending a first authentication request to the access point on behalf of the second station in response to a determination that the second station is an approved device, at708. The first authentication request includes the device information associated with the second station. For example, referring toFIGS. 1, 2, and 4, the wireless transceiver208sends the authentication request246to the access point140on behalf of station120in response to a determination the station120is an approved device.

According to one implementation, prior to sending the first authentication request to the access point, the method700includes determining an address of the second station based on the device information associated with the second station. For example, referring toFIG. 2, the processor202determines the MAC address120A of the station120based on the device information248associated with the station120. According to the above-implementation, the method700also includes populating a source address field in the first authentication request with the address of the second station to send the first authentication request on behalf of the second station. For example, referring toFIGS. 2 and 4, the frame generator228populates the source address field408in the authentication request246with the MAC address120A of the station120to send the authentication request246on behalf of the station120. According to the above-implementation, the method700also includes populating a transmitter address field in the first authentication request with an address of the first station to promote the access point to relay the first authentication response to the second station by way of the first station. For example, referring toFIGS. 2 and 4, the frame generator228populates the transmitter address field410in the authentication request246with the MAC address110A of the station110to promote the access point140to relay the authentication response190to the station120by way of the station110. It should be understood that a “relay” from station to station would be performed when switching to the ad hoc communication mode236as opposed to during the infrastructure mode234where messages are communicated with the access point140.

The method700also includes receiving a first authentication response from the access point in response to sending the first authentication request, at710. The first authentication response includes challenge text. For example, referring toFIGS. 1 and 5, the station110receives the authentication response190from the access point140in response to sending the authentication request246. The authentication response190includes the challenge text552. According to one implementation of the method700, a destination address of the first authentication response is the address of the first station in response to populating the transmitter address field in the first authentication request with the address of the first station. For example, referring toFIG. 5, the destination address field506includes the MAC address110A of the station110A. The method700can also include bypassing the relay of the first authentication response to the second station after receiving the first authentication response to isolate the second station from the challenge text. For example, referring toFIG. 1, the station110bypasses relaying the authentication response190to the station120while in the ad hoc communication mode236after receiving the authentication response190to isolate the station120from the challenge text552.

The method700also includes encrypting the challenge text based on the security key to generate encrypted challenge text, at712. The security key is isolated from the second station. For example, referring toFIG. 2, the encryption unit230encrypts the challenge text552based on the security key232to generate the encrypted challenge text258.

The method700also includes sending the encrypted challenge text as part of a second authentication request to the access point to authenticate the second station with the access point, at714. For example, referring toFIGS. 1 and 6, the station110sends the encrypted challenge text258as part of the authentication request250to the access point140to authenticate the station120with the access point140.

According to one implementation, prior to sending the second authentication request to the access point, the method700includes populating a source address field in the second authentication request and a transmitter address field in the second authentication request with the address of the second station to promote the access point to send an authentication message to the second station. For example, referring toFIGS. 2 and 6, the frame generator228populates the source address field608in the authentication request250and the transmitter address field610in the authentication request250with the MAC address120A of the station120to promote the access point140to send the authentication message192to the station120.

According to one implementation, prior to sending the second authentication request to the access point, the method700includes populating a transmitter address field in the second authentication request with the address of the first station to promote the access point to send an authentication message to the first station. According to this implementation, the method700can also include receiving the authentication message from the access point and relaying the authentication message to the second station while in the ad hoc communication mode.

According to one implementation, the method700also includes receiving a second request, from a third station, to join the wireless network in response to broadcasting the beacon frame. The second request includes device information associated with the third station. For example, referring toFIGS. 1 and 2, the station110receives the request182, from the station130, to join the wireless network150in response to broadcasting the beacon frame242. The request182includes the device information256associated with the station130. According to the above implementation, the method700includes determining, based on the device information associated with the third station, whether the third station is an approved device. For example, referring toFIG. 2, the processor202determines, based on the device information256, whether the station130is an approved device. According to the above-implementation, the method700also includes sending an exclusion frame to the access point in response to a determination that the third station is not an approved device. The exclusion frame includes the device information associated with the third station, and the access point rejects authentication requests from the third station in response to receiving the exclusion frame. For example, referring toFIGS. 1 and 2, the station110sends the exclusion frame254to the access point140in response to a determination that the station130is not an approved device. The exclusion frame254includes the device information256associated with the station130, and the access point140rejects authentication requests from the station130in response to receiving the exclusion frame254. Thus, in response to sending the exclusion frame254, a MAC address130A of the station130is not recognized as a viable address to perform direct authentication.

According to one implementation, the method700includes establishing an ad hoc communication network prior to switching from the infrastructure mode to the ad hoc communication mode. The second station and the third station are included in the ad hoc communication network. For example, the station110can establish the ad hoc communication network prior to switching from the infrastructure mode234to the ad hoc communication mode236. The stations120,130can be included in the ad hoc communication network.

The method700ofFIG. 7enables the station110to permit and control access to the wireless network150without having to disclose the security key232for the wireless network150. For example, the station110uses the security key232to authenticate other approved stations (e.g., the station120) with the access point140of the wireless network150without disclosing the security key232to the approved stations. The station110can also send messages to exclude unapproved stations (e.g., the station130) from the wireless network150. As a result, by performing the authentication on behalf of other stations and controlling access to the wireless network150without disclosing the security key232, the likelihood that additional mobile devices will access the wireless network150, with or without the user's permission, decreases. Thus, the wireless network150is less susceptible to network congestion and security threats.

Those of skill would further appreciate that the various illustrative logical blocks, configurations, modules, circuits, and algorithm steps described in connection with the implementations disclosed herein may be implemented as electronic hardware, computer software executed by a processing device such as a hardware processor, or combinations of both. Various illustrative components, blocks, configurations, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or executable software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

The steps of a method or algorithm described in connection with the implementations disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in a memory device, such as random access memory (RAM), magnetoresistive random access memory (MRAM), spin-torque transfer MRAM (STT-MRAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disk, a removable disk, or a compact disc read-only memory (CD-ROM). An exemplary memory device is coupled to the processor such that the processor can read information from, and write information to, the memory device. In the alternative, the memory device may be integral to the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). The ASIC may reside in a computing device or a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a computing device or a user terminal.

The previous description of the disclosed implementations is provided to enable a person skilled in the art to make or use the disclosed implementations. Various modifications to these implementations will be readily apparent to those skilled in the art, and the principles defined herein may be applied to other implementations without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the implementations shown herein but is to be accorded the widest scope possible consistent with the principles and novel features as defined by the following claims.