Patent Description:
With emergence of wireless telecommunications, home network in which multiple computing devices are communicatively linked together in a consumer's home are becoming increasingly ubiquitous. A home environment may include one or more computers, a wireless router, one or more Internet Of Things (IOT) devices, and one or more other devices capable of connecting to the home network.

With the usage of the home network, there is also an increasing need for the establishment of security to provide privacy and protect confidentiality of user data in the home network. In general, a user chooses to secure their home network by establishing network credentials for connecting to a wireless access point associated with the home network. Typically, each client device in the home network must be individually configured to connect to the wireless access point.

Many consumer wireless access points are preconfigured to implement various security protocols such as Wired Equivalent Privacy (WEP), Wi-Fi™ Protected Access (WPA), Wi-Fi™ Protected Access II (WPA2), or the like. These security protocols may enable a user of the home network to associate a password with a particular wireless access point identified via a service set identifier (SSID). Conventionally, to connect the client device to the wireless access point protected with one of the security protocols described above, the user may be required to select the SSID associated with the secure wireless access point from a list of broadcast SSIDs (or manually enter the SSID) and enter the password associated with the secure wireless access point. The client device then uses the SSID and password to establish a connection with the wireless access point. Client devices may also store the SSID and password to automatically reconnect to the secure wireless access point whenever the client device is within range of the wireless access point.

However, the user generally does not change their wireless access point configuration, which leaves them vulnerable to cyber-attacks. This also leads to compromise of wireless access point configuration, and unauthorized access to wireless access point once the credentials are comprised.

Moreover, currently the user has to configure all the client devices with AP's new configuration manually if the configuration is modified and there is no standard solution available for the client devices to re-connect back to the wireless access point automatically. Further, configuring each client device with a new credential is a tedious process considering the growing number of connected devices at the home network.

Thus, it is desired to address the above-mentioned disadvantages or other shortcomings or at least provide a useful alternative.

The principal object of the embodiments herein is to provide a method implemented by a wireless device for securely handling re-connection of client devices associated with the wireless device in the wireless network. In the present disclosure, whenever there is a change in wireless device configuration, there is no need for the user to enter the changed configuration manually. Instead, the client devices automatically re-connects to the wireless device using the changed configuration. Thus, reducing a time required for re-connecting the client devices to the wireless device considerably compared to the conventional manual method of re-connecting to the wireless device.

Another object of the embodiment herein is to provide a method implemented by a client device for securely re-connecting with a wireless device.

Another object of the embodiment herein is to provide a wireless device that securely handles re-connection of client devices in a wireless network.

Another object of the embodiment herein is to provide a client device that securely re-connects with a wireless device upon disconnection of existing connection.

Accordingly, embodiments herein provide a method for securely handling re-connection by a wireless device. The method comprises establishing a connection with a plurality of client devices. The wireless device establishes the connection with the plurality of client devices using a first security configuration. The method further includes detecting whether criterion is met to re-establish the connection with the plurality of client devices. The method also includes dynamically generating a second security configuration to re-establish the connection with the plurality of client devices in response to detecting that the criterion is met. The method further includes encrypting the second security configuration and sending the encrypted second security configuration to the plurality of client devices to re-establish the connection with the wireless device.

In an embodiment, the method comprises receiving a request to re-establish the connection from the plurality of client devices using the second security configuration and reestablishing the connection with the plurality of client devices based on the second security configuration.

In an embodiment, the criterion comprises detecting an expiry of a time period associated with the wireless device to re-establish the connection with the plurality of client devices, detecting an expiry of a time period associated with the client device of the plurality of client devices to re-establish the connection with the wireless device, detecting a vulnerability in the wireless device, and detecting a vulnerability in the associated with the client device of the plurality of client devices.

In an embodiment, the first security configuration comprises at least one of a service set identifier (SSID) and password, wherein the second security configuration comprises at least one of a SSID and password different than the SSIDand password of the first security configuration.

In an embodiment, the method comprises sending a Wi-Fi Re-board (WR) public key request message to the plurality of client devices upon the successful establishment of a connection between the plurality of client devices and the wireless device, wherein the public key request message includes information about crypto groups supported by the wireless device; receiving, by the wireless device, a WR public key response message from one or more client devices in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey (i.e., public key)associated with that particular client device, and a selected crypto group from the crypto groups; and storing, by the wireless device, a unique identifier associated with each of the one or more client devices along with the WR public key response message, in a re-board list.

In an embodiment, the method comprises detecting an attempt from the plurality of client devices to connect the wireless device using the first security configuration after the wireless device is configured with the second security configuration; verifying an identifier associated with each of the plurality of client devices against the stored unique identifier in the re-board list; and generating a unique AReconnectMKey for each client device stored in the re-board list upon successful verification, wherein the unique AReconnectMKey is generated using the CReconnectPKey and an AReconnectSKey, and wherein the AReconnectSKey is a private key associated with the wireless device.

In an embodiment, the method comprises sending a AReconnectPKey of the wireless device along with the encrypted second security configuration, wherein encrypting the second security configuration comprises encrypting the second security configuration using the generated unique AReconnectMKey.

Accordingly, embodiments herein provide a method for re-connecting a client device to a wireless device. The method comprises establishing a connection with the wireless device and detecting a change in configuration of the wireless device from a first security configuration to a second security configuration in response to disconnection of the established connection. The method also comprises receiving an encrypted second security configuration from the wireless device and decrypting the encrypted second security configuration. The method further comprises re-connecting to the wireless device using the decrypted second security configuration.

In an embodiment, the method comprises receiving the encrypted second security configuration along with the AReconnectPKey of the wireless device.

In an embodiment, decrypting the encrypted second security configuration comprises generating a unique CReconnectMKey using the AReconnectPKey and a CReconnectSKey, wherein the CReconnectSKey is a private key associated with the client device, and decrypting the encrypted second security configuration using the generated CReconnectMKey.

Accordingly,embodiments herein provide a wireless device for securely handling re-connection. The wireless device comprises a memory and a processor, coupled to the memory. The processor is configured to establish a connection with a plurality of client devices, wherein the wireless device establishes the connection with the plurality of client devices using a first security configuration. The processor is also configured to detect whether at least one criteria is met to re-establish the connection with the plurality of client devicesand dynamically generate a second security configuration to reestablish the connection with the plurality of client devices in response to detecting that the at least one criteria is met. The processor is further configured to encrypt the second security configuration and send the encrypted second security configurationto the plurality of client devices to re-establish the connection with the wireless device.

In an embodiment, the processor is configured to receive a request to re-establish the connection from the plurality of client devices using the second security configuration and re-establish the connection with the plurality of client devices based on the second security configuration.

In an embodiment, to detect the at least one criteria, the processor is configured to detect an expiry of a time period associated with the wireless device to reestablish the connection with the plurality of client devices, detect an expiry of a time period associated with at least one client device of the plurality of client devices to reestablish the connection with the wireless device,detect a vulnerability in the wireless device, anddetect a vulnerability in the associated with at least one client device of the plurality of client devices.

In an embodiment, the processor is configured to send a WR public key request message to the plurality of client devices upon the successful establishment of connection between a plurality of client devices and the wireless device, wherein the public key request message includes information about crypto groups supported by the wireless device. The processor is also configured to receive a WR public key response message from one or more client devices in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey associated with that particular client device, and a selected crypto group from the crypto groups; and store a unique identifier associated with each of the one or more client devices along with the WR public key response message, in a re-board list.

In an embodiment, the processor is configured to detect an attempt from the plurality of client devices to connect the wireless device using the first security configuration after the wireless device is configured with the second security configuration and verify an identifier associated with each of the plurality of client devices against the stored unique identifier in the re-board list. The processor is also configured to generate a unique AReconnectMKey for each client device stored in the re-board list upon successful verification, wherein the unique AReconnectMKey is generated using the CReconnectPKey and a AReconnectSKey, and wherein the AReconnectSKey is a private key associated with the wireless device.

Accordingly, embodiments herein provide a client device for securely reconnects with a wireless device. The client device comprises a memory and a processor, coupled to the memory. The processor is configured to establish a connection with the wireless device and detect a change in configuration of the wireless device from a first security configuration to a second security configuration in response to disconnection of the established connection. The processor is configured to receive an encrypted second security configuration from the wireless device, decrypt the encrypted second security configuration, and re-connect to the wireless device using the decrypted second security configuration.

In an embodiment, the processor is configured to receive the encrypted second security configuration along with an AReconnectPKey of the wireless device.

In an embodiment, wherein to decrypt the encrypted second security configuration, the processor is configured to generate a unique CReconnectMKey using the AReconnectPKey and a CReconnectSKey, wherein the CReconnectSKey is a private key associated with the client device and decrypt the encrypted second security configuration using the generated CReconnectMKey.

Many changes and modifications may be made within the scope of the embodiments herein, and the embodiments herein include all such modifications.

This method and associated wireless device& client device are illustrated in the accompanying drawings, throughout which like reference letters indicate corresponding parts in the various figures. The embodiments herein will be better understood from the following description with reference to the drawings, in which:.

A phrase "at least one of" preceding as a series of items, with terms "and" or "or" to separate any of the items, allows a meaning that includes at least one of any one of the items, and/or at least one of any combination of the items, and/or at least one of each of the items. For example, each of the phrases "at least one of A, B, C and C" or "at least one of A, B, or C" refers to only A, only B, or only C; any combination of A, B, C; and/or at least one of each of A, B, and C.

As is traditional in the field, embodiments may be described and illustrated in terms of blocks which carry out a described function or functions. These blocks, which may be referred to herein as units or modules or the like, are physically implemented by analog or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits, or the like, and may optionally be driven by firmware. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like. The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block. Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of the invention. Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the invention.

The accompanying drawings are used to help easily understand various technical features and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. As such, the present disclosure should be construed to extend to any alterations, equivalents, and substitutes in addition to those which are particularly set out in the accompanying drawings.

The terms "client device" and "client" mean the same and are used interchangeably throughout this document. The terms "wireless device", "access point", and "AP" mean the same and are used interchangeably throughout this document.

Accordingly, embodiments herein provide a method for securely handling re-connection by a wireless device. The method comprises establishing a connection with a plurality of client devices. The wireless device establishes the connection with the plurality of client devices using a first security configuration. The method further includes detecting whether criterion is met to re-establish the connection with the plurality of client devices. The method also includes dynamically generating a second security configuration to reestablish the connection with the plurality of client devices in response to detecting that the criterion is met. The method further includes encrypting the second security configuration and sending the encrypted second security configuration to the plurality of client devices to reestablish the connection with the wireless device.

In the conventional methods and systems, when the configuration of the wireless device (i.e., SSID, password, or security type) is modified, the user has to connect all the clients with wireless device's new configuration manually. However, connecting each client with a new credential is a tedious process considering the growing number of connected devices at home.

Unlike to the conventional methods and systems, in the present disclosure when the configuration of the wireless device is changed, automatically the client devices re-connect with the wireless device using the modified configuration without having any user intervention. In the present disclosure, information about the modified configuration is encrypted and the encrypted modified configuration is shared with all client devices or only with the trusted client devices, which can decrypt the encrypted modified configuration. Using the decrypted modified configuration, the client devices automatically re-connect with the wireless device without any user intervention.

<FIG> illustrates a scenario of sequence flow of conventional methods. As depicted in <FIG>, the user initially onboarded the client device <NUM>-<NUM> (as an example Doorbell), client device <NUM>-<NUM> (as an example Mobile Phone), client device <NUM>-<NUM> (as an example Smart speaker), and client device <NUM>-<NUM> (as an example Wi-Fi bulb), to the wireless device or Access Point (AP) <NUM>. In order to onboard the client devices <NUM> to the AP <NUM>, the user enters the Wi-Fi AP configuration using either Mobile GUI or ad-hoc network to establish Wi-Fi connection <NUM>.

The client devices <NUM>, such as smartphones, laptops, tablets, etc., get the Wi-Fi credentials by scanning Quick Response (QR) codes or through Graphical User Interface (GUI). Some IoT client devices follow classical onboarding processes like connecting over the ad-hoc network.

In the ad-hoc network, the client devices <NUM> create an ad-hoc distributed network. Then the user connects the rich UI client devices <NUM> like a smartphone to the ad-hoc network and provides the new Wi-Fi AP configuration. Now, the client devices <NUM> disconnects from the ad-hoc network, connect to the Wi-Fi AP using that configuration and access the Internet.

When the user modifies the Wi-Fi AP configuration (SSID or password) <NUM>, all the client devices <NUM> connected to the AP <NUM> will be disconnected <NUM>. Then, the client devices <NUM> cannot connect back to the AP <NUM> with older configurations. Further, the user manually needs to re-board <NUM> each client device <NUM> back to the AP <NUM> by applying the new Wi-Fi AP configuration. The Mobile Phone <NUM>-<NUM> is re-boarded by entering the modified Wi-Fi AP configuration in the user interface (UI). However, the client devices <NUM> such as doorbells, Wi-Fi bulbs, and Smart speakers are re-boarded using the ad-hoc network technique, as explained previously.

Thus, whenever there is a change in the Wi-Fi AP configuration, it takes considerable user effort and time to reconnect all the client devices back to the AP <NUM>. It becomes even more tedious and time-consuming for the users to reconnect the IoT devices. This is because these devices do not have UI to enter the new Wi-Fi configuration. It becomes a serious concern when the Wi-Fi network contains many such IoT devices.

<FIG> illustrates a block diagram of a wireless device that securely handles re-connection of client devices in a wireless network, according to the embodiments as disclosed herein. In an embodiment, the wireless device <NUM> includes a memory <NUM>, processor <NUM>, and a communication controller <NUM>. The processor <NUM> comprises a connection establishment controller <NUM>, an event detector <NUM>, a security configuration generator (<NUM>), an encrypter <NUM>, and a security key generator <NUM>.

The memory <NUM> stores one or more data related to client devices <NUM> and the wireless device <NUM>, and also instructions to be executed by the processor <NUM>. The memory <NUM> may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory <NUM> may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory <NUM> is non-movable. In some examples, the memory <NUM> can be configured to store larger amounts of information than the memory. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache). In an embodiment, the memory <NUM> can be an internal storage unit or it can be an external storage unit of the wireless device <NUM>, a cloud storage, or any other type of external storage.

The processor <NUM> communicates with the memory <NUM> and the communicator controller <NUM>. The processor <NUM> is configured to execute instructions stored in the memory <NUM> and to perform various processes.

The communication controller <NUM> is configured for communicating internally between internal hardware components and with external devices via one or more networks. The communication controller <NUM> is implemented by processing circuitry such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits, or the like, and may optionally be driven by firmware. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like.

In an embodiment, the connection establishment controller <NUM> establishes a connection with a plurality of client devices <NUM>. The connection establishment controller <NUM> of the wireless device <NUM> is configured to establish the connection with the plurality of client devices <NUM> when each of the client devices <NUM> inputs a first security configuration of the wireless device <NUM>. In one embodiment, the first security configuration comprises a service set identifier (SSID), password, and security type of the wireless device <NUM>. After the connection is established successfully, the connection establishment controller <NUM> is configured to send a Wi-Fi Re-board (WR) public key request message to each of the plurality of client devices <NUM>. The WR public key request message includes information about crypto groups supported by the wireless device <NUM>. The connection establishment controller <NUM> is also configured to receive a WR public key response message from one or more client devices <NUM> in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey (i.e., public key) associated with that particular client device and a selected crypto group from the crypto groups. Upon receiving the WR public key response message, the connection establishment controller <NUM> enables the wireless device <NUM> to store a unique identifier (for example MAC identifier) associated with each of the one or more client devices <NUM> along with the WR public key response message, in a re-board list of the memory <NUM>.

In one embodiment, the event detector <NUM> is configured to detect whether criterion is met to re-establish the connection with the plurality of client devices <NUM>. In one embodiment, the criterion comprises detecting an expiry of a time period associated with the wireless device <NUM> to re-establish the connection with the plurality of client devices <NUM>. In one embodiment, the criterion comprises detecting a vulnerability in the wireless device <NUM>. In one embodiment, the criterion comprises detecting an expiry of a time period associated with at least one client device of the plurality of client devices <NUM> to re-establish the connection with the wireless device <NUM>. In one embodiment, the criterion comprises detecting a vulnerability associated with at least one client device of the plurality of client devices <NUM>.

In one embodiment, the security configuration generator <NUM> is configured to dynamically generate a second security configuration to reestablish the connection with the plurality of client devices <NUM> in response detecting that the criterion is met. The second security configuration can include modification to SSID, password, or security type, or combinations thereof, compared to the first security configuration. In one embodiment, the security configuration generator <NUM> is configured to dynamically generate the second security configuration to reestablish the connection with the plurality of client devices <NUM> based on user input to modify the configuration.

Further, the connection establishment controller <NUM> is configured to detect an attempt from the plurality of client device <NUM> to connect the wireless device <NUM> using the first security configuration after the wireless device <NUM> is changed configuration from the first security configuration to the second security configuration. The connection establishment controller <NUM> is configured to verify an identifier associated with each of the plurality of client device <NUM> against the stored unique identifier in the re-board list upon detecting the attempt.

In one embodiment, the security key generator <NUM> is configured to generate a unique AReconnectMKey (i.e., shared key) for each of client devices <NUM> stored in the re-board list upon successful verification. The unique AReconnectMKey is generated using the CReconnectPKey (i.e., public key of client device) and a AReconnectSKey (i.e., private key of the wireless device).

In one embodiment, the encrypter <NUM> is configured to encrypt the second security configuration using each of the unique AReconnectMKey for each client device included in the re-board list of the memory <NUM>.

In one embodiment, the processor <NUM> enables the wireless device <NUM> to send the encrypted second security configuration to the plurality of client devices <NUM> to reestablish the connection with the wireless device <NUM>. In one embodiment, the wireless device <NUM> is configured to send a public key of the wireless device <NUM> along with the encrypted second security configuration.

<FIG> illustrates a block diagram of a client device that securely re-connects with the wireless device, according to the embodiments as disclosed herein. In an embodiment, the client device <NUM> includes a memory <NUM>, processor <NUM>, and a communication controller <NUM>. The processor <NUM> comprises a connection establishment controller <NUM>, a communication disconnection detector <NUM>, a security key generator <NUM>, and a decrypter <NUM>.

The memory <NUM> stores one or more data related to client device <NUM> and the wireless device <NUM>, and also instructions to be executed by the processor <NUM>. The memory <NUM> may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory <NUM> may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory <NUM> is non-movable. In some examples, the memory <NUM> can be configured to store larger amounts of information than the memory <NUM>. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache). In an embodiment, the memory <NUM> can be an internal storage unit or it can be an external storage unit of the client device <NUM>, a cloud storage, or any other type of external storage.

In an embodiment, the connection establishment controller <NUM> is configured to establish the connection with the wireless device <NUM> when a user associated with the client device <NUM> inputs a first security configuration of the wireless device <NUM>. In one embodiment, the first security configuration comprises a service set identifier (SSID), password, and security type of the wireless device <NUM>. After the connection is established successfully, the connection establishment controller <NUM> is configured to receive a Wi-Fi Re-board (WR) public key request message from the wireless device <NUM>. The WR public key request message includes information about crypto groups supported by the wireless device <NUM>. The connection establishment controller <NUM> is then configured to send a WR public key response message in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey (i.e., public key) associated with the client device <NUM>, and a selected crypto group from the crypto groups.

In one embodiment, the communication disconnection detector <NUM> is configured to detect disconnection of an existing connection with the wireless device <NUM> and also detect the change in configuration of the wireless device <NUM> from a first security configuration to a second security configuration in response to the detected disconnection.

In one embodiment, the security key generator <NUM> is configured to generate the CReconnectPKey (i.e., public key of client device <NUM>) and CReconnectSKey (i.e., private key of client device <NUM>).

In one embodiment, the decrypter <NUM> is configured to decrypt an encrypted second security configuration received from the wireless device <NUM>. The decrypter <NUM> is configured to decrypt the encrypted second security configuration using a common shared key that is generated using the CReconnectSKey (i.e., private key) of the client device <NUM> and the AReconnectPKey (i.e., public key) of the wireless device <NUM>. Upon decrypting the encrypted second security configuration, the client device <NUM> automatically re-connects to the wireless device <NUM> using one of the standard techniques.

<FIG> is a flow diagram <NUM> illustrating various operations implemented by a wireless device for securely handling re-connections of client devices, according to the embodiments as disclosed herein.

As illustrated in <FIG>, the method <NUM> comprises one or more blocks implemented by the wireless device <NUM>. The order in which the method <NUM> is described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order to implement the method <NUM>. Additionally, individual blocks may be deleted from the method <NUM> without departing from the scope of the subject matter described herein.

At block <NUM>, a connection with a plurality of client devices <NUM> is established. In an embodiment, the connection establishment controller <NUM> is configured to establish a connection with a plurality of client devices <NUM>. The connection establishment controller <NUM> of the wireless device <NUM> is configured to establish the connection with the plurality of client devices <NUM> when each of the client devices <NUM> inputs a first security configuration of the wireless device <NUM>. In one embodiment, the first security configuration comprises a service set identifier (SSID), password, security type of the wireless device <NUM>, and combinations thereof. After the connection is established successfully, the connection establishment controller <NUM> is configured to send a Wi-Fi Re-board (WR) public key request message to each of the plurality of client devices <NUM>. The WR public key request message includes information about crypto groups supported by the wireless device <NUM>. The connection establishment controller <NUM> is also configured to receive a WR public key response message from one or more client devices <NUM> in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey (i.e., public key) associated with that particular client device, and a selected crypto group from the crypto groups. Upon receiving the WR public key response message, the connection establishment controller <NUM> enables the wireless device <NUM> to store a unique identifier (for example MAC identifier) associated with each of the one or more client devices <NUM> along with the WR public key response message, in a re-board list of the memory <NUM>.

At block <NUM>, whether at least one criterion is met to reestablish the connection with the plurality of client devices <NUM> is detected. In one embodiment, the event detector <NUM> is configured to detect whether at least one criterion is met to reestablish the connection with the plurality of client devices <NUM>. In one embodiment, the at least one criterion comprises detecting an expiry of a time period associated with the wireless device <NUM> to reestablish the connection with the plurality of client devices <NUM>. In one embodiment, the at least one criterion comprises detecting a vulnerability in the wireless device <NUM>. In one embodiment, the at least one criterion comprises detecting an expiry of a time period associated with at least one client device <NUM> of the plurality of client devices <NUM> to reestablish the connection with the wireless device <NUM>. In one embodiment, the at least one criterion comprises detecting a vulnerability in the associated with at least one client device of the plurality of client devices <NUM>.

At block <NUM>, a second security configuration to reestablish the connection with the plurality of client devices <NUM> is generated. In one embodiment, the security configuration generator <NUM> is configured to dynamically generate a second security configuration to reestablish the connection with the plurality of client devices <NUM> in response detecting that the at least one criterion is met. The second security configuration can includes modification to SSID, password, security type, or combinations thereof, compared to the first security configuration. Further, the connection establishment controller <NUM> is configured to detect an attempt from the plurality of client devices <NUM> to connect the wireless device <NUM> using the first security configuration after a change in configuration from the first security configuration to the second security configuration takes place in the wireless device <NUM>. The connection establishment controller <NUM> is configured to verify an identifier associated with each of the plurality of client device <NUM> against the stored unique identifier in the re-board list upon detecting the attempt. In one embodiment, the security key generator <NUM> is configured to generate a unique AReconnectMKey (i.e., shared key) for each of client devices <NUM> stored in the re-board list upon successful verification. The unique AReconnectMKey is generated using the CReconnectPKey (i.e., public key of client device) and a AReconnectSKey (i.e., private key of the wireless device).

At block <NUM>, the second security configuration is encrypted. In one embodiment, the encrypter <NUM> is configured to encrypt the second security configuration using each of the unique AReconnectMKey for each of client devices included in the re-board list of the memory <NUM>.

At block <NUM>, the encrypted second security configuration to the plurality of client devices <NUM> is sent to reestablish the connection with the wireless device <NUM>. In one embodiment, the processor <NUM> enables the wireless device <NUM> to send the encrypted second security configuration to the plurality of client devices <NUM> to reestablish the connection with the wireless device <NUM>. In one embodiment, the wireless device <NUM> is configured to send a public key of the wireless device <NUM> along with the encrypted second security configuration.

<FIG> is a flow diagram illustrating various operations implemented by a client device for securely re-connecting to wireless device, according to the embodiments as disclosed herein.

As illustrated in <FIG>, the method <NUM> comprises one or more blocks implemented by the client device <NUM>. The order in which the method <NUM> is described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order to implement the method <NUM>. Additionally, individual blocks may be deleted from the method <NUM> without departing from the scope of the subject matter described herein.

At block <NUM>, a connection with the wireless device <NUM> is established. In one embodiment, the connection establishment controller <NUM> is configured to establish the connection with the wireless device <NUM> when a user associated with the client device <NUM> inputs a first security configuration of the wireless device <NUM>. In one embodiment, the first security configuration comprises a service set identifier (SSID), password, security type, and any combination thereof, of the wireless device <NUM>. After the connection is established successfully, the connection establishment controller <NUM> is configured to receive a Wi-Fi Re-board (WR) public key request message from the wireless device <NUM>. The WR public key request message includes information about crypto groups supported by the wireless device <NUM>. The connection establishment controller <NUM> is then configured to send a WR public key response message in response to the WR public key request, wherein the WR public key response message includes a CReconnectPKey (i.e., public key) associated with the client device <NUM>, and a selected crypto group from the crypto groups.

At block <NUM>, a change in configuration of the wireless device <NUM> is detected from a first security configuration to a second security configuration. In one embodiment, the communication disconnection detector <NUM> is configured to detect disconnection of an existing connection with the wireless device <NUM> and also detect the change in configuration of the wireless device <NUM> from a first security configuration to a second security configuration in response to the detected disconnection.

At block <NUM>, an encrypted second security configuration is received from the wireless device <NUM>. In one embodiment, the processor <NUM> enables the client device <NUM> to receive the encrypted second security configuration from the wireless device <NUM>. In one embodiment, client device <NUM> receives the AReconnectPKey (i.e., public key) of the wireless device <NUM> along with the encrypted second security configuration from the wireless device <NUM>.

At block <NUM>, the encrypted second security configuration is decrypted. In one embodiment, the decrypter <NUM> is configured to decrypt an encrypted second security configuration received from the wireless device <NUM>. The decrypter <NUM> is configured to decrypt the encrypted second security configuration using a common shared key that is generated using the CReconnectSKey (i.e., private key) of the client device <NUM> and the AReconnectPKey (i.e., public key) of the wireless device <NUM>.

At block <NUM>, the client device <NUM> re-connects to the wireless device <NUM> using the decrypted second security configuration. In one embodiment, the client device <NUM> automatically re-connects to the wireless device <NUM> using one of the standard techniques upon decrypting the encrypted second security configuration.

<FIG> is an example illustrating the step-by-step procedure between client device and access point for establishing re-connection, according to the embodiments as disclosed herein. As shown in <FIG>, user on-boards the client device <NUM> to the Wi-Fi AP <NUM> using the existing on-boarding technique (as shown in steps 1A to 4C). After a successful connection to the AP <NUM>, the client <NUM> sends its public key (called CReconnectPKey) to the AP <NUM> (as shown in step 5C). Now, the client's public key and its Medium Access Control (MAC) address are stored in the AP <NUM> (in Re-board list) (at step 4A). The client devices <NUM> will be disconnected when the user modifies the Wi-Fi AP configuration (SSID or password or security type) (at step 5A and 6C). Now, the client <NUM> attempts to reconnect to the AP <NUM> using the previous AP's configuration (at step 7C). At this instant, the client validation at the AP <NUM> fails due to the configuration mismatch. Then, the AP <NUM> checks whether the client presents in the Re-board list (at step 8A) and its public key (CReconnectPKey) is stored or not. Once AP <NUM> finds the client's CReconnectPKey in the Re-board list, it derives a common secret key (called AReconnectMKey) using its private key along with. Then, AP <NUM> sends its public key (called AReconnectPKey) and the modified configuration (encrypted using common secret; AReconnectMKey) (at step 9A). Now the client <NUM>, upon receiving AReconnectPKey, derives a common secret key (called CReconnectMKey) and decrypts the modified configuration (at step 11C). After this, the client <NUM> attempts reconnection to the AP <NUM> using those modified configurations, and it will succeed.

<FIG> illustrates a sequential flow diagram for public key exchange between client device and wireless device, according to the embodiments as disclosed herein. As shown in <FIG>, at first, the client <NUM> gets on-boarded <NUM> to the AP <NUM>. Then, the AP <NUM> sends the WR Public Key Request frame <NUM> (as shown in <FIG>) with its supported crypto groups to the client <NUM>. On receiving the WR Public Key Request frame, the client <NUM> chooses one group (G) from the received crypto groups and derives a public key (CReconnectPKey) using the chosen crypto group (G).

The client <NUM> then responds with a WR Public Key Response frame (as shown in <FIG>) with the chosen crypto group (G) and CReconnectPKey <NUM> to the AP <NUM>. Upon receiving this, the AP <NUM> stores the CReconnectPKey, the chosen crypto group, and the client's MAC address in the Re-Board list of the memory <NUM>.

<FIG> illustrates a sequential flow diagram for sharing modified credentials for re-connecting, according to the embodiments as disclosed herein. As shown in <FIG>, the client <NUM> disconnects from the Wi-Fi network <NUM> when the Wi-Fi AP's configuration changes. Then, the client <NUM> tries to reconnect <NUM> to the AP <NUM> using its previously saved Wi-Fi AP configuration. Now, the AP <NUM> determines that the client <NUM> is not able to reconnect back (either by Simultaneous Authentication of Equals (SAE) authentication failure in Wi-Fi Protected Access (WPA) <NUM> or <NUM>-way handshake failure in WPA2). Then, AP <NUM> goes through the Re-Board list in the memory <NUM> and checks the client details.

Once the AP <NUM> finds the client <NUM> in the Re-board list, then the AP <NUM> derives its public key (called AReconnectPKey) and private key (called AReconnectSKey) from the crypto group G that the client <NUM> selected earlier. At this point, the AP <NUM> generates a common secret key (AReconnectMKey) using AP's private key (AReconnectSKey) and the client's public key (CReconnectPKey). Then, the AP <NUM> sends the WR Re-board frame <NUM> (as shown in <FIG>), containing the AP's public key (AReconnectPKey) and the new configuration that is encrypted using the derived AReconnectMKey. Meanwhile, on receiving the WR Re-board frame, the client <NUM> also prepares common secret key (CReconnectMKey) using its private key.

(CReconnectSKey) and AP's public key (AReconnectPKey). Using the common secret key (CReconnectMKey), the client <NUM> will decrypt the new configuration, send a re-connection request <NUM>, and reconnect back <NUM> to the AP <NUM> successfully. Now, the new configuration is only shared with the previously connected clients securely. So, all the client <NUM> (e.g., IoT, headless devices, Smartphones, etc.) will reconnect automatically to the AP <NUM> without any user intervention.

<FIG> illustrates a scenario of reconnection time for different client devices using an existing and proposed method, according to the embodiments as disclosed herein. As shown in <FIG>, let us consider there are 'N' number of Wi-Fi clients (e.g., headless and rich UI) connected to the Wi-Fi AP, and the user changes the AP configuration. The total reconnection time of 'N' clients for the existing method is given by eq.

Wherein, 'tj' is the reconnection time of the jth client.

We note that in the existing method, 'tj' represents a variable reconnection time, as shown in <FIG>. The parameter 'tj' is variable because it depends on the type of the client (headless or rich UI) and its manual procedure to enter the Wi-Fi AP configurations (including the length of the new password).

However, in the proposed method, the total reconnection time is calculated as shown in eq. (<NUM>)
<MAT>.

Here, 'Timeinitial' is the total time for the WR Public Key Request/Response frame exchanges between the AP and Wi-Fi clients.

Where 'Tj' is the time taken by each Wi-Fi client for the WR Public Key Request/ Response frame exchanges with AP. We note that 'Tj' is a constant as shown in <FIG> for all the clients (same frames are exchanged), and let us consider the initial time as 'α' for each client. Now, the equation (<NUM>) becomes:
<MAT>.

Next, 'Timereconn' is the total reconnection time for the Wi-Fi clients <NUM> when the AP configuration is changed using the WiFi Reboard method. However, in the proposed method, the reconnection time of each client is constant for all the clients irrespective of the type of the client and length of the new password (because it is automatic, without any user intervention), and let us consider the reconnection time as 'β' for each client. This reconnection time is calculated as shown below eq. (<NUM>):
<MAT>.

Now, substituting eq. (<NUM>) and (<NUM>) in eq. (<NUM>):
<MAT>.

Where, 'α' and 'β' are constant value in time and they are comparatively smaller as in simple Wi-Fi frame exchanges. Hence, the equation (<NUM>) becomes:
<MAT>.

Hence, the total time saved with proposed method compared to existing method is shown in eq. (<NUM>) and (<NUM>). <MAT><MAT>.

<FIG> illustrating a scenario of attack flow during re-board frame exchange, according to the embodiments as disclosed herein. As shown in <FIG>, let us assume there is a Probabilistic Polynomial Time (PPT) attacker 'A' monitoring all the Wi-Fi Re-board (WR) frames between the AP and the Wi-Fi client.

Let π= (Gen, Enc, Dec) is an Elliptic Curve El-Gamal (ECEG) scheme where 'Gen' is an ECEG public ('Pk') and private ('Sk') key generation function. Further, the 'Gen' function implementation and the derived public key are known to the entire world. Then, 'Enc' is a publicly known randomized encryption function that the AP uses. It is used to generate the cipher text of AP's modified configuration by using the client's 'Pk' and Wi-Fi AP's 'Sk'. Next, 'Dec' is a publicly known deterministic decryption function that the client uses. This decrypts the Wi-Fi AP's modified configuration from the cipher text by using Wi-Fi AP's 'Pk' and client's 'Sk'.

Any rogue station or a PPT attacker 'A' may also view the encrypted message and 'Pk' in the WR Re-board Frame. However, they cannot decrypt the AP's configuration without the corresponding 'Sk'. Similarly, any rogue AP or Evil Twin AP cannot influence the client connection by sharing its configuration to the client. As the client did not share its public key to the rogue AP earlier (or not connected), it cannot decrypt the corresponding rogue AP's modified configuration from the encrypted message. Hence, ð is CPA (Chosen Plain Text Attack) secure for every PPT attacker 'A' with the probability 'prob' as shown below eq. (<NUM>)
<MAT>.

Where 'p' is a length of the prime number that is used in ECEG scheme.

The embodiments disclosed herein can be implemented using at least one hardware device and performing network management functions to control the elements.

Claim 1:
A method for securely handling re-connection by a wireless device, the method comprising:
establishing, by the wireless device, a connection with a plurality of client devices using a first security configuration;
detecting, by the wireless device, whether at least one criterion is met to re-establish the connection with the plurality of client devices;
generating, by the wireless device, a second security configuration to re-establish the connection with the plurality of client devices in response to detecting that the at least one criterion is met;
configuring the wireless device with the second security configuration, thus disconnecting the one or more client devices
detecting, by the wireless device, an attempt from one or more client devices of the plurality of client devices to connect the wireless device using the first security configuration after the wireless device is configured with the second security configuration;
verifying, by the wireless device, an identifier associated with each of the one or more client devices of the plurality of client devices against stored unique identifier in a re-board list;
generating, by the wireless device, a common secret key for each of the one or more client devices stored in the re-board list upon successful verification, wherein the common secret key is generated using a public key associated with the particular client device and a private key associated with the wireless device.
encrypting, by the wireless device, the second security configuration using the common secret key; and
sending, by the wireless device, the encrypted second security configuration to the one or more client devices of the plurality of client devices to re-establish the connection with the wireless device.