Patent Description:
The present disclosure is generally related to Wi-Fi communications and, more particularly, to improvement in the security of a Wi-Fi Protected Setup (WPS) procedure.

In general, WPS refers to a network security standard with respect to creating a secure wireless home network. Put differently, WPS is a wireless router feature that is designed to simplify the process of setting up a secure wireless network. Rather than manually configuring security settings, a user can press a WPS button to create a secure wireless network. As a result, it is a common feature offered on many routers. When the WPS button is pressed, the router scans for nearby wireless devices. Next, the user can open the settings in the respective wireless devices to choose the wireless network. The devise would then automatically connect to the wireless network. With WPS, there is no need for the user to enter a password when connecting to the wireless network, thereby simplifying the process of setting up a secure wireless network. It is noteworthy that WPS only supports Wi-Fi Protected Access (WPA) Personal or WPA Personal encryption protocols. That is, a user cannot use this feature with the Wired Equivalent Privacy (WEP) encryption protocol.

However, there are some vulnerabilities in the existing WPS process or procedure. For instance, in cases where the WPS button on an access point (AP) or Registrar is pushed first to activate or otherwise initiate the WPS procedure, an attacker could listen to Beacon frames from the AP. Once Beacon(s) with WPS information element (IE) is/are detected, the attacker could go through WPS exchange immediately after the AP indicates that it has WPS Registrar enabled for push button configuration (PBC). The PBC allows a user to connect a wireless device to a wireless network by pressing both the WPS Settings menu on the control panel of the device and the WPS (PBC) button on a WPS-enabled AP (or wireless router), respectively. As long as the attacker completes the WPS procedure before a real Enrollee has had a chance to get its WPS button pushed and Probe Request frame out on the AP's operating channel, the attacker would succeed and thus could gain network credentials allowing the attacker to connect to the network (and, in case of WPA2-Personall, also allowing the attacker to decrypt all past traffic in the network).

Moreover, in case the WPS button is pressed first on the Enrollee, the attacker would need to bypass a PBC session overlap detection. Specifically, the attacker would observe both the Beacon frames from the AP and the Probe Request frames on the AP's operating channel. Once the attacker detects a Probe Request frame indicating readiness for PBC, the attacker could clone the medium access control (MAC) address and universally unique identifier (UUID) from that frame to use them to perform the WPS procedure with the AP as soon as the AP's WPS button is pushed.

Therefore, there is a need for a solution of improvement in the security of the WPS procedure.

<CIT> discloses a method for load balance for dual interface automotive WI-FI controllers for P2P devices.

<CIT> discloses a fast access control method of a wireless router based on a message authentication code white list.

<CIT> discloses a method for providing temporary access point functionality to an intermediary device to provide wireless network credentials to a wireless device.

<CIT> discloses a method for establishing a proximity-based wireless connection with a second device.

The following summary is illustrative only and is not intended to be limiting in any way. That is, the following summary is provided to introduce concepts, highlights, benefits and advantages of the novel and non-obvious techniques described herein. Select implementations are further described below in the detailed description. Thus, the following summary is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter. A Method according to the invention is defined by independent claim <NUM>. A device according to the invention is defined by the independent claim <NUM>. The dependent claims relate to preferred embodiments thereof.

An objective of the present disclosure is to propose solutions or schemes that address the aforementioned issues. More specifically, various schemes proposed in the present disclosure pertain to improvement in the security of the WPS procedure.

In one aspect, a method may involve determining that a WPS procedure is activated. The method may also involve varying a transmission
(Tx) power in transmitting one or more WPS management frames during the WPS procedure.

In another aspect, a method may involve performing ranging prior to or during a WPS procedure. The method may also involve determining a distance between a first communication entity and a second communication entity based on a result of the ranging. The method may further involve configuring one or more credentials to the first communication entity responsive to the distance being determined to be less than a threshold. The method may further involve configuring one or more credentials to a first communication entity responsive to receiving one or more management frames from the first communication entity.

In yet another aspect, an apparatus may include a transceiver configured to communicate wirelessly. The apparatus may also include a processor coupled to the transceiver and configured to execute either or both of a first defense procedure and a second defense procedure during a WPS procedure to improve security of the WPS procedure. The first defense procedure may involve Tx power reduction, and the second defense procedure may involve ranging.

It is noteworthy that, although description provided herein may be in the context of certain radio access technologies, networks and network topologies such as Wi-Fi, the proposed concepts, schemes and any variation(s)/derivative(s) thereof may be implemented in, for and by other types of radio access technologies, networks and network topologies such as, for example and without limitation, Bluetooth, ZigBee, infrared, Long-Term Evolution (LTE), LTE-Advanced, LTE-Advanced Pro, 5th Generation (<NUM>), New Radio (NR), Internet-of-Things (IoT), Narrow Band Internet of Things (NB-IoT), Industrial Internet of Things (IIoT). Thus, the scope of the present disclosure is not limited to the examples described herein.

It is appreciable that the drawings are not necessarily in scale as some components may be shown to be out of proportion than the size in actual implementation in order to clearly illustrate the concept of the present disclosure.

Implementations in accordance with the present disclosure relate to various techniques, methods, schemes and/or solutions pertaining to improvement in the security of the WPS procedure. According to the present disclosure, a number of possible solutions may be implemented separately or jointly. That is, although these possible solutions may be described below separately, two or more of these possible solutions may be implemented in one combination or another.

As alluded to above, although it is convenient and easy to use, WPS tends to suffer from security flaws. The biggest problem is that the existing WPS procedure exposes all of the connected wireless devices. In case a hacker obtains access to a wireless device connected to a wireless network, the hacker could have unrestricted access to all the wireless devices on that network.

Referring to <FIG>, network environment <NUM> may involve a communication entity <NUM> (herein interchangeably referred to as "first communication entity") and a communication entity <NUM> (herein interchangeably referred to as "second communication entity") communicating wirelessly (e.g., in a WLAN in accordance with one or more Institute of Electrical and Electronics Engineers (IEEE) <NUM> standards). For instance, communication entity <NUM> may be a first station (STA) and communication entity <NUM> may be a second STA, with each of the first STA and second STA functioning either as an access point (AP) STA or as a non-AP STA. Under various proposed schemes in accordance with the present disclosure, communication entity <NUM> and communication entity <NUM> may be configured to implement improvement in the security of the WPS procedure. More specifically, communication entity <NUM> and communication entity <NUM> may be configured to implement one or more defense mechanisms to reduce or otherwise minimize the possibility of attackers exploiting WPS, as described below.

Under a first proposed scheme in accordance with the present disclosure, a first defense mechanism may involve Tx power reduction for WPS Management frames. In a first approach under the first proposed scheme, the Tx power of the devices may be varied once the WPS button is pushed (e.g., by a user) to activate or otherwise initiate a WPS procedure. For instance, a user may be instructed by a user's manual to place a to-be-onboarded (or to-be-connected) device next to an AP and then power on the device. Alternatively, or additionally, the user may push the WPS button on the AP first and then push the WPS button on the device to be onboarded, thereby causing the AP to start transmitting Beacon frames with a WPS IE. Under the proposed scheme, certain modifications may be made to existing implementations. For instance, Beacon frames with the WPS IE may be transmitted or sent by the AP in addition to regular Beacon frames. The Beacon frames with WPS IE may be transmitted at a much lower Tx power level so as to ensure that only device(s) in a very close proximity of the AP may hear those beacons. During a Monitor Time (e.g., <NUM> minutes after the WPS button is pushed), Authentication and Association frames transmitted by the AP may also be transmitted with a lower Tx power.

Under this proposed scheme, in case the user pushes the WPS button on the to-be-onboarded device first (despite the user's manual instructing otherwise), the to-be-onboarded device may start transmitting Probe Request frames with WPS readiness. In order to avoid snooping by an attacker, the to-be-onboarded device may also transmit its Probe Request frames at a reduced Tx power. After its WPS button is pushed, the AP may respond with Probe Response frames with a reduced Tx power. Moreover, during the Monitor Time (e.g., <NUM> minutes after the WPS button is pushed), the AP may transmit the Authentication and Association frames with a lower Tx power.

In a second approach under the first proposed scheme, by transmitting Management frames at a reduced Tx power, the AP may ensure that only devices in close proximity may receive those Management frames and proceed with the WPS procedure. Example types of the Management frames may include, for example and without limitation, Association Request frame(s), Reassociation Request frame(s), Probe Request frame(s), Timing Advertisement frame(s), Beacon frame(s), Disassociation frame(s), Deauthentication frame(s), Authentication frame(s), Action frame(s), Association Response frame(s), Reassociation Response frame(s), and Probe Response frame(s).

Under a second proposed scheme in accordance with the present disclosure, a second defense mechanism may involve ranging. Under the proposed scheme, prior to or during the WPS procedure (but before configuring he credentials to the to-be-onboarded device), the AP may perform ranging with the device. For instance, ranging may be passive and the AP may only proceed with configuring credentials to a given to-be-onboarded device in an event that a result of the ranging operation indicates that the to-be-onboarded device is in close proximity of the AP. One example of passive ranging may be Received Signal Strength Indicator (RSSI) monitoring. For instance, the AP may be configured with a policy to only provide password to a to-be-onboarded device in response to that device being within <NUM> meters or less from the AP based on a result of RSSI monitoring.

Alternatively, active ranging may be utilized when the to-be-onboarded device supports Wi-Fi Location (e.g., Fine Time Measurement (FTM)-based ranging). For instance, FTM frames may be exchanged either pre-association or post-association to measure a distance between the AP and each to-be-onboarded device. Similarly, the AP may only proceed with configuring credentials to a given to-be-onboarded device in an event that the FTM exchange results in the conclusion that the to-be-onboarded device is in close proximity of the AP. For instance, the AP may be configured with a policy to only provide password to a to-be-onboarded device in response to that device being within <NUM> meter, <NUM> meters, or <NUM> meters from the AP based on a result of active ranging (e.g., FTM-based ranging).

Alternatively, the AP may perform active or passive ranging based on variable measurement result(s) indicating that the Enrollee is in motion (e.g., manually waving the Enrollee to be configured until it is configured). For instance, the to-be-onboarded device may be moving and not stationary. Accordingly, the AP may alternate between passive ranging and active ranging in implementing the second defense mechanism under this proposed scheme.

<FIG> illustrates an example communication system <NUM> having an example apparatus <NUM> and an example apparatus <NUM> in accordance with an implementation of the present disclosure. Each of apparatus <NUM> and apparatus <NUM> may perform various functions to implement schemes, techniques, processes and methods described herein pertaining to improvement in the security of the WPS procedure, including scenarios/schemes described above as well as process(es) described below.

Each of apparatus <NUM> and apparatus <NUM> may be a part of an electronic apparatus, which may be a user equipment (UE) such as a portable or mobile apparatus, a wearable apparatus, a wireless communication apparatus or a computing apparatus. For instance, each of apparatus <NUM> and apparatus <NUM> may be implemented in a smartphone, a smartwatch, a personal digital assistant, a digital camera, or a computing equipment such as a tablet computer, a laptop computer or a notebook computer. Each of apparatus <NUM> and apparatus <NUM> may also be a part of a machine type apparatus, which may be a STA such as an AP STA or a non-AP STA. For instance, each of apparatus <NUM> and apparatus <NUM> may be implemented in a smart thermostat, a smart fridge, a smart door lock, a wireless speaker or a home control center. Alternatively, each of apparatus <NUM> and apparatus <NUM> may be implemented in the form of one or more integrated-circuit (IC) chips such as, for example and without limitation, one or more single-core processors, one or more multi-core processors, one or more reduced-instruction set computing (RISC) processors, or one or more complex-instruction-set-computing (CISC) processors. Each of apparatus <NUM> and apparatus <NUM> may include at least some of those components shown in <FIG> such as a processor <NUM> and a processor <NUM>, respective. Each of apparatus <NUM> and apparatus <NUM> may further include one or more other components not pertinent to the proposed scheme of the present disclosure (e.g., internal power supply, display device and/or user interface device), and, thus, such component(s) of each of apparatus <NUM> and apparatus <NUM> are neither shown in <FIG> nor described below in the interest of simplicity and brevity.

In one aspect, each of processor <NUM> and processor <NUM> may be implemented in the form of one or more single-core processors, one or more multi-core processors, one or more RISC processors, or one or more CISC processors. That is, even though a singular term "a processor" is used herein to refer to processor <NUM> and processor <NUM>, each of processor <NUM> and processor <NUM> may include multiple processors in some implementations and a single processor in other implementations in accordance with the present disclosure. In another aspect, each of processor <NUM> and processor <NUM> may be implemented in the form of hardware (and, optionally, firmware) with electronic components including, for example and without limitation, one or more transistors, one or more diodes, one or more capacitors, one or more resistors, one or more inductors, one or more memristors and/or one or more varactors that are configured and arranged to achieve specific purposes in accordance with the present disclosure. In other words, in at least some implementations, each of processor <NUM> and processor <NUM> is a special-purpose machine specifically designed, arranged and configured to perform specific tasks including improvement in the security of the WPS procedure in accordance with various implementations of the present disclosure.

In some implementations, apparatus <NUM> may also include a transceiver <NUM> coupled to processor <NUM> and capable of wirelessly transmitting and receiving data. In some implementations, apparatus <NUM> may also include a transceiver <NUM> coupled to processor <NUM> and capable of wirelessly transmitting and receiving data. Accordingly, apparatus <NUM> and apparatus <NUM> may wirelessly communicate with each other via transceiver <NUM> and transceiver <NUM>, respectively.

Each of apparatus <NUM> and apparatus <NUM> may be a communication entity capable of communicating with each other using various proposed schemes in accordance with the present disclosure. For instance, apparatus <NUM> may be an example implementation of communication entity <NUM> (or the first communication entity) and apparatus <NUM> may be an example implementation of communication entity <NUM> (or the second communication entity) in network environment <NUM>. To aid better understanding, the following description of the operations, functionalities and capabilities of each of apparatus <NUM> and apparatus <NUM> is provided in the context of a wireless communication environment in which apparatus <NUM> is implemented in or as a communication apparatus or a to-be-onboarded device and apparatus <NUM> is implemented in or as an AP or wireless router of a communication network (e.g., a Wi-Fi network). Under various proposed schemes in accordance with the present disclosure, processor <NUM> of apparatus <NUM> may be configured to execute either or both of a first defense procedure and a second defense procedure during a WPS procedure to improve security of the WPS procedure, with the first defense procedure involving Tx power reduction and the second defense procedure involving ranging. It is also noteworthy that, although the example implementations described below are provided in the context of mobile communications, the same may be implemented in other types of networks.

In one aspect under some proposed schemes pertaining to improvement in the security of the WPS procedure in accordance with the present disclosure, with apparatus <NUM> implemented in or as a to-be-onboarded device and apparatus <NUM> implemented in or as an AP or wireless router of a wireless network (e.g., a Wi-Fi network or otherwise a wireless local area network (WLAN)), processor <NUM> may determine that a WPS procedure is activated or otherwise initiated (e.g., due to a WPS on apparatus <NUM> being pushed by a user). Moreover, processor <NUM> may vary, via transceiver <NUM>, a Tx power in transmitting one or more WPS management frames to apparatus <NUM> during the WPS procedure. Furthermore, processor <NUM> may configure one or more credentials to apparatus <NUM> responsive to receiving one or more management frames from apparatus <NUM>.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, processor <NUM> may perform certain operations. For instance, processor <NUM> may transmit or broadcast one or more regular Beacon frames at a first power level. Additionally, processor <NUM> may transmit or broadcast one or more Beacon frames with a WPS IE at a second power level lower than the first power level. Moreover, processor <NUM> may transmit one or more Authentication frames and one or more Association frames (e.g., to apparatus <NUM>) at the second power level lower or a third power level lower than the first power level.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, processor <NUM> may perform other operations. For instance, processor <NUM> may receive one or more Probe Request frames from apparatus <NUM> at a first reduced power level. Moreover, processor <NUM> may transmit one or more Probe Response frames to apparatus <NUM> at a second reduced power level responsive to receiving the one or more Probe Request frames. In such cases, each of the first reduced power level and the second reduced power level may be lower than a regular power level used when the WPS procedure is not activated. Furthermore, processor <NUM> may transmit one or more Authentication frames and one or more Association frames to apparatus <NUM> at the second reduced power level lower or a third reduced power level. In such cases, the third reduced power level may also be lower than the regular power level.

In another aspect under some proposed schemes pertaining to improvement in the security of the WPS procedure in accordance with the present disclosure, with apparatus <NUM> implemented in or as a to-be-onboarded device and apparatus <NUM> implemented in or as an AP or wireless router of a wireless network (e.g., a Wi-Fi network or otherwise a WLAN), processor <NUM> may perform ranging prior to or during a WPS procedure. Additionally, processor <NUM> may determine a distance between apparatus <NUM> and apparatus <NUM> based on a result of the ranging. Furthermore, processor <NUM> may configure one or more credentials to apparatus <NUM> responsive to the distance being determined to be less than a threshold (e.g., <NUM> meter, <NUM> meter, <NUM> meter or another threshold value).

In some implementations, in performing the ranging, processor <NUM> may perform passive ranging. In some implementations, in performing the passive ranging, processor <NUM> may perform RSSI monitoring.

In some implementations, in performing the ranging, processor <NUM> may perform active ranging. In some implementations, in performing the active ranging, processor <NUM> may perform FTM-based ranging by exchanging FTM frames either pre-association or post-association to measure the distance. In some implementations, in performing the FTM-based ranging, processor <NUM> may exchange FTM frames with apparatus <NUM> either pre-association or post-association to measure the distance.

In some implementations, in performing the ranging, processor <NUM> may alternate between passive ranging and active ranging responsive to a relative movement between apparatus <NUM> and apparatus <NUM>.

<FIG> illustrates an example process <NUM> in accordance with an implementation of the present disclosure. Process <NUM> may be an example implementation of schemes described above whether partially or completely, with respect to improvement in the security of the WPS procedure in accordance with the present disclosure. Process <NUM> may represent an aspect of implementation of features of apparatus <NUM> and/or apparatus <NUM>. Process <NUM> may include one or more operations, actions, or functions as illustrated by blocks <NUM>, <NUM> and <NUM>. Although illustrated as discrete blocks, various blocks of process <NUM> may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Moreover, the blocks of process <NUM> may executed in the order shown in <FIG> or, alternatively, in a different order. Process <NUM> may be implemented by apparatus <NUM> and apparatus <NUM>. Solely for illustrative purposes and without limitation, process <NUM> is described below in the context of apparatus <NUM> implemented in or as a to-be-onboarded device and apparatus <NUM> implemented in or as an AP or wireless router of a wireless network. Process <NUM> may begin at block <NUM>.

At <NUM>, process <NUM> may involve processor <NUM> of apparatus <NUM>, as an AP or wireless router, determining that a WPS procedure is activated or otherwise initiated (e.g., due to a WPS on apparatus <NUM> being pushed by a user). Process <NUM> may proceed from <NUM> to <NUM>.

At <NUM>, process <NUM> may involve processor <NUM> varying, via transceiver <NUM>, a Tx power in transmitting one or more WPS management frames to apparatus <NUM>, as a to-be-onboarded device, during the WPS procedure. Process <NUM> may proceed from <NUM> to <NUM>.

At <NUM>, process <NUM> may involve processor <NUM> configuring one or more credentials to a first communication entity (e.g., apparatus <NUM>) responsive to receiving one or more management frames from the first communication entity.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, process <NUM> may involve processor <NUM> performing certain operations. For instance, process <NUM> may involve processor <NUM> transmitting or broadcasting one or more regular Beacon frames at a first power level. Additionally, process <NUM> may involve processor <NUM> transmitting or broadcasting one or more Beacon frames with a WPS IE at a second power level lower than the first power level. Moreover, process <NUM> may involve processor <NUM> transmitting one or more Authentication frames and one or more Association frames (e.g., to apparatus <NUM>) at the second power level lower or a third power level lower than the first power level.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, process <NUM> may involve processor <NUM> performing other operations. For instance, process <NUM> may involve processor <NUM> receiving one or more Probe Request frames from apparatus <NUM> at a first reduced power level. Moreover, process <NUM> may involve processor <NUM> transmitting one or more Probe Response frames to apparatus <NUM> at a second reduced power level responsive to receiving the one or more Probe Request frames. In such cases, each of the first reduced power level and the second reduced power level may be lower than a regular power level used when the WPS procedure is not activated. Furthermore, process <NUM> may involve processor <NUM> transmitting one or more Authentication frames and one or more Association frames to apparatus <NUM> at the second reduced power level lower or a third reduced power level. In such cases, the third reduced power level may also be lower than the regular power level.

At <NUM>, process <NUM> may involve processor <NUM> of apparatus <NUM>, as an AP or wireless router, performing ranging prior to or during a WPS procedure. Process <NUM> may proceed from <NUM> to <NUM>.

At <NUM>, process <NUM> may involve processor <NUM> determining a distance between apparatus <NUM>, as a to-be-onboarded device, and apparatus <NUM> based on a result of the ranging. Process <NUM> may proceed from <NUM> to <NUM>.

At <NUM>, process <NUM> may involve processor <NUM> configuring one or more credentials to apparatus <NUM> responsive to the distance being determined to be less than a threshold (e.g., <NUM> meter, <NUM> meter, <NUM> meter or another threshold value).

In some implementations, in performing the ranging, process <NUM> may involve processor <NUM> performing passive ranging. In some implementations, in performing the passive ranging, process <NUM> may involve processor <NUM> performing RSSI monitoring.

In some implementations, in performing the ranging, process <NUM> may involve processor <NUM> performing active ranging. In some implementations, in performing the active ranging, process <NUM> may involve processor <NUM> performing FTM-based ranging by exchanging FTM frames either pre-association or post-association to measure the distance. In some implementations, in performing the FTM-based ranging, process <NUM> may involve processor <NUM> exchanging FTM frames with apparatus <NUM> either pre-association or post-association to measure the distance.

In some implementations, in performing the ranging, process <NUM> may involve processor <NUM> alternating between passive ranging and active ranging responsive to a relative movement between apparatus <NUM> and apparatus <NUM>.

Claim 1:
A method, comprising:
determining that a Wi-Fi Protected Setup, WPS, procedure is activated (<NUM>);
varying a transmission, Tx, power in transmitting one or more WPS management frames during the WPS procedure (<NUM>); and
configuring one or more credentials to a first communication entity responsive to receiving one or more management frames from the first communication entity (<NUM>),
characterized in that
the varying of the Tx power in transmitting the one or more WPS management frames during the WPS procedure comprises:
transmitting one or more regular Beacon frames at a first power level; and
transmitting one or more Beacon frames with a WPS information element, IE, at a second power level lower than the first power level.