Patent ID: 12231898

DETAILED DESCRIPTION OF PREFERRED IMPLEMENTATIONS

Detailed embodiments and implementations of the claimed subject matters are disclosed herein. However, it shall be understood that the disclosed embodiments and implementations are merely illustrative of the claimed subject matters which may be embodied in various forms. The present disclosure may, however, be embodied in many different forms and should not be construed as limited to the exemplary embodiments and implementations set forth herein. Rather, these exemplary embodiments and implementations are provided so that description of the present disclosure is thorough and complete and will fully convey the scope of the present disclosure to those skilled in the art. In the description below, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments and implementations.

Overview

Implementations in accordance with the present disclosure relate to various techniques, methods, schemes and/or solutions pertaining to improvement in the security of the WPS procedure. According to the present disclosure, a number of possible solutions may be implemented separately or jointly. That is, although these possible solutions may be described below separately, two or more of these possible solutions may be implemented in one combination or another.

As alluded to above, although it is convenient and easy to use, WPS tends to suffer from security flaws. The biggest problem is that the existing WPS procedure exposes all of the connected wireless devices. In case a hacker obtains access to a wireless device connected to a wireless network, the hacker could have unrestricted access to all the wireless devices on that network.

Referring toFIG.1, network environment100may involve a communication entity110(herein interchangeably referred to as “first communication entity”) and a communication entity120(herein interchangeably referred to as “second communication entity”) communicating wirelessly (e.g., in a WLAN in accordance with one or more Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards). For instance, communication entity110may be a first station (STA) and communication entity120may be a second STA, with each of the first STA and second STA functioning either as an access point (AP) STA or as a non-AP STA. Under various proposed schemes in accordance with the present disclosure, communication entity110and communication entity120may be configured to implement improvement in the security of the WPS procedure. More specifically, communication entity110and communication entity120may be configured to implement one or more defense mechanisms to reduce or otherwise minimize the possibility of attackers exploiting WPS, as described below.

Under a first proposed scheme in accordance with the present disclosure, a first defense mechanism may involve Tx power reduction for WPS Management frames. In a first approach under the first proposed scheme, the Tx power of the devices may be varied once the WPS button is pushed (e.g., by a user) to activate or otherwise initiate a WPS procedure. For instance, a user may be instructed by a user's manual to place a to-be-onboarded (or to-be-connected) device next to an AP and then power on the device. Alternatively, or additionally, the user may push the WPS button on the AP first and then push the WPS button on the device to be onboarded, thereby causing the AP to start transmitting Beacon frames with a WPS IE. Under the proposed scheme, certain modifications may be made to existing implementations. For instance, Beacon frames with the WPS IE may be transmitted or sent by the AP in addition to regular Beacon frames. The Beacon frames with WPS IE may be transmitted at a much lower Tx power level so as to ensure that only device(s) in a very close proximity of the AP may hear those beacons. During a Monitor Time (e.g., 2 minutes after the WPS button is pushed), Authentication and Association frames transmitted by the AP may also be transmitted with a lower Tx power.

Under this proposed scheme, in case the user pushes the WPS button on the to-be-onboarded device first (despite the user's manual instructing otherwise), the to-be-onboarded device may start transmitting Probe Request frames with WPS readiness. In order to avoid snooping by an attacker, the to-be-onboarded device may also transmit its Probe Request frames at a reduced Tx power. After its WPS button is pushed, the AP may respond with Probe Response frames with a reduced Tx power. Moreover, during the Monitor Time (e.g., 2 minutes after the WPS button is pushed), the AP may transmit the Authentication and Association frames with a lower Tx power.

In a second approach under the first proposed scheme, by transmitting Management frames at a reduced Tx power, the AP may ensure that only devices in close proximity may receive those Management frames and proceed with the WPS procedure. Example types of the Management frames may include, for example and without limitation, Association Request frame(s), Reassociation Request frame(s), Probe Request frame(s), Timing Advertisement frame(s), Beacon frame(s), Disassociation frame(s), De-authentication frame(s), Authentication frame(s), Action frame(s), Association Response frame(s), Reassociation Response frame(s), and Probe Response frame(s).

Under a second proposed scheme in accordance with the present disclosure, a second defense mechanism may involve ranging. Under the proposed scheme, prior to or during the WPS procedure (but before configuring the credentials to the to-be-onboarded device), the AP may perform ranging with the device. For instance, ranging may be passive and the AP may only proceed with configuring credentials to a given to-be-onboarded device in an event that a result of the ranging operation indicates that the to-be-onboarded device is in close proximity of the AP. One example of passive ranging may be Received Signal Strength Indicator (RSSI) monitoring. For instance, the AP may be configured with a policy to only provide password to a to-be-onboarded device in response to that device being within 5 meters or less from the AP based on a result of RSSI monitoring.

Alternatively, active ranging may be utilized when the to-be-onboarded device supports Wi-Fi Location (e.g., Fine Time Measurement (FTM)-based ranging). For instance, FTM frames may be exchanged either pre-association or post-association to measure a distance between the AP and each to-be-onboarded device. Similarly, the AP may only proceed with configuring credentials to a given to-be-onboarded device in an event that the FTM exchange results in the conclusion that the to-be-onboarded device is in close proximity of the AP. For instance, the AP may be configured with a policy to only provide password to a to-be-onboarded device in response to that device being within 1 meter, 5 meters, or 10 meters from the AP based on a result of active ranging (e.g., FTM-based ranging).

Alternatively, the AP may perform active or passive ranging based on variable measurement result(s) indicating that the Enrollee is in motion (e.g., manually waving the Enrollee to be configured until it is configured). For instance, the to-be-onboarded device may be moving and not stationary. Accordingly, the AP may alternate between passive ranging and active ranging in implementing the second defense mechanism under this proposed scheme.

Illustrative Implementations

FIG.2illustrates an example communication system200having an example apparatus210and an example apparatus220in accordance with an implementation of the present disclosure. Each of apparatus210and apparatus220may perform various functions to implement schemes, techniques, processes and methods described herein pertaining to improvement in the security of the WPS procedure, including scenarios/schemes described above as well as process(es) described below.

Each of apparatus210and apparatus220may be a part of an electronic apparatus, which may be a user equipment (UE) such as a portable or mobile apparatus, a wearable apparatus, a wireless communication apparatus or a computing apparatus. For instance, each of apparatus210and apparatus220may be implemented in a smartphone, a smartwatch, a personal digital assistant, a digital camera, or a computing equipment such as a tablet computer, a laptop computer or a notebook computer. Each of apparatus210and apparatus220may also be a part of a machine type apparatus, which may be a STA such as an AP STA or a non-AP STA. For instance, each of apparatus210and apparatus220may be implemented in a smart thermostat, a smart fridge, a smart door lock, a wireless speaker or a home control center. Alternatively, each of apparatus210and apparatus220may be implemented in the form of one or more integrated-circuit (IC) chips such as, for example and without limitation, one or more single-core processors, one or more multi-core processors, one or more reduced-instruction set computing (RISC) processors, or one or more complex-instruction-set-computing (CISC) processors. Each of apparatus210and apparatus220may include at least some of those components shown inFIG.2such as a processor212and a processor222, respective. Each of apparatus210and apparatus220may further include one or more other components not pertinent to the proposed scheme of the present disclosure (e.g., internal power supply, display device and/or user interface device), and, thus, such component(s) of each of apparatus210and apparatus220are neither shown inFIG.2nor described below in the interest of simplicity and brevity.

In one aspect, each of processor212and processor222may be implemented in the form of one or more single-core processors, one or more multi-core processors, one or more RISC processors, or one or more CISC processors. That is, even though a singular term “a processor” is used herein to refer to processor212and processor222, each of processor212and processor222may include multiple processors in some implementations and a single processor in other implementations in accordance with the present disclosure. In another aspect, each of processor212and processor222may be implemented in the form of hardware (and, optionally, firmware) with electronic components including, for example and without limitation, one or more transistors, one or more diodes, one or more capacitors, one or more resistors, one or more inductors, one or more memristors and/or one or more varactors that are configured and arranged to achieve specific purposes in accordance with the present disclosure. In other words, in at least some implementations, each of processor212and processor222is a special-purpose machine specifically designed, arranged and configured to perform specific tasks including improvement in the security of the WPS procedure in accordance with various implementations of the present disclosure.

In some implementations, apparatus210may also include a transceiver216coupled to processor212and capable of wirelessly transmitting and receiving data. In some implementations, apparatus210may further include a memory214coupled to processor212and capable of being accessed by processor212and storing data therein. In some implementations, apparatus220may also include a transceiver226coupled to processor222and capable of wirelessly transmitting and receiving data. In some implementations, apparatus220may further include a memory224coupled to processor222and capable of being accessed by processor222and storing data therein. Accordingly, apparatus210and apparatus220may wirelessly communicate with each other via transceiver216and transceiver226, respectively.

Each of apparatus210and apparatus220may be a communication entity capable of communicating with each other using various proposed schemes in accordance with the present disclosure. For instance, apparatus210may be an example implementation of communication entity110(or the first communication entity) and apparatus220may be an example implementation of communication entity120(or the second communication entity) in network environment100. To aid better understanding, the following description of the operations, functionalities and capabilities of each of apparatus210and apparatus220is provided in the context of a wireless communication environment in which apparatus210is implemented in or as a communication apparatus or a to-be-onboarded device and apparatus220is implemented in or as an AP or wireless router of a communication network (e.g., a Wi-Fi network). Under various proposed schemes in accordance with the present disclosure, processor222of apparatus220may be configured to execute either or both of a first defense procedure and a second defense procedure during a WPS procedure to improve security of the WPS procedure, with the first defense procedure involving Tx power reduction and the second defense procedure involving ranging. It is also noteworthy that, although the example implementations described below are provided in the context of mobile communications, the same may be implemented in other types of networks.

In one aspect under some proposed schemes pertaining to improvement in the security of the WPS procedure in accordance with the present disclosure, with apparatus210implemented in or as a to-be-onboarded device and apparatus220implemented in or as an AP or wireless router of a wireless network (e.g., a Wi-Fi network or otherwise a wireless local area network (WLAN)), processor222may determine that a WPS procedure is activated or otherwise initiated (e.g., due to a WPS on apparatus220being pushed by a user). Moreover, processor222may vary, via transceiver216, a Tx power in transmitting one or more WPS management frames to apparatus210during the WPS procedure. Furthermore, processor222may configure one or more credentials to apparatus210responsive to receiving one or more management frames from apparatus210.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, processor222may perform certain operations. For instance, processor222may transmit or broadcast one or more regular Beacon frames at a first power level. Additionally, processor222may transmit or broadcast one or more Beacon frames with a WPS IE at a second power level lower than the first power level. Moreover, processor222may transmit one or more Authentication frames and one or more Association frames (e.g., to apparatus210) at the second power level lower or a third power level lower than the first power level.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, processor222may perform other operations. For instance, processor222may receive one or more Probe Request frames from apparatus210at a first reduced power level. Moreover, processor222may transmit one or more Probe Response frames to apparatus210at a second reduced power level responsive to receiving the one or more Probe Request frames. In such cases, each of the first reduced power level and the second reduced power level may be lower than a regular power level used when the WPS procedure is not activated. Furthermore, processor222may transmit one or more Authentication frames and one or more Association frames to apparatus210at the second reduced power level lower or a third reduced power level. In such cases, the third reduced power level may also be lower than the regular power level.

In another aspect under some proposed schemes pertaining to improvement in the security of the WPS procedure in accordance with the present disclosure, with apparatus210implemented in or as a to-be-onboarded device and apparatus220implemented in or as an AP or wireless router of a wireless network (e.g., a Wi-Fi network or otherwise a WLAN), processor222may perform ranging prior to or during a WPS procedure. Additionally, processor222may determine a distance between apparatus210and apparatus220based on a result of the ranging. Furthermore, processor222may configure one or more credentials to apparatus210responsive to the distance being determined to be less than a threshold (e.g., 1 meter, 5 meter, 10 meter or another threshold value).

In some implementations, in performing the ranging, processor222may perform passive ranging. In some implementations, in performing the passive ranging, processor222may perform RSSI monitoring.

In some implementations, in performing the ranging, processor222may perform active ranging. In some implementations, in performing the active ranging, processor222may perform FTM-based ranging by exchanging FTM frames either pre-association or post-association to measure the distance. In some implementations, in performing the FTM-based ranging, processor222may exchange FTM frames with apparatus210either pre-association or post-association to measure the distance.

In some implementations, in performing the ranging, processor222may alternate between passive ranging and active ranging responsive to a relative movement between apparatus210and apparatus220.

Illustrative Processes

FIG.3illustrates an example process300in accordance with an implementation of the present disclosure. Process300may be an example implementation of schemes described above whether partially or completely, with respect to improvement in the security of the WPS procedure in accordance with the present disclosure. Process300may represent an aspect of implementation of features of apparatus210and/or apparatus220. Process300may include one or more operations, actions, or functions as illustrated by blocks310,320and330. Although illustrated as discrete blocks, various blocks of process300may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Moreover, the blocks of process300may executed in the order shown inFIG.3or, alternatively, in a different order. Process300may be implemented by apparatus210and apparatus220. Solely for illustrative purposes and without limitation, process300is described below in the context of apparatus210implemented in or as a to-be-onboarded device and apparatus220implemented in or as an AP or wireless router of a wireless network. Process300may begin at block310.

At310, process300may involve processor222of apparatus220, as an AP or wireless router, determining that a WPS procedure is activated or otherwise initiated (e.g., due to a WPS on apparatus220being pushed by a user). Process300may proceed from310to320.

At320, process300may involve processor222varying, via transceiver216, a Tx power in transmitting one or more WPS management frames to apparatus210, as a to-be-onboarded device, during the WPS procedure. Process300may proceed from320to330.

At330, process300may involve processor222configuring one or more credentials to a first communication entity (e.g., apparatus210) responsive to receiving one or more management frames from the first communication entity.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, process300may involve processor222performing certain operations. For instance, process300may involve processor222transmitting or broadcasting one or more regular Beacon frames at a first power level. Additionally, process300may involve processor222transmitting or broadcasting one or more Beacon frames with a WPS IE at a second power level lower than the first power level. Moreover, process300may involve processor222transmitting one or more Authentication frames and one or more Association frames (e.g., to apparatus210) at the second power level lower or a third power level lower than the first power level.

In some implementations, in varying the Tx power in transmitting the one or more WPS management frames during the WPS procedure, process300may involve processor222performing other operations. For instance, process300may involve processor222receiving one or more Probe Request frames from apparatus210at a first reduced power level. Moreover, process300may involve processor222transmitting one or more Probe Response frames to apparatus210at a second reduced power level responsive to receiving the one or more Probe Request frames. In such cases, each of the first reduced power level and the second reduced power level may be lower than a regular power level used when the WPS procedure is not activated. Furthermore, process300may involve processor222transmitting one or more Authentication frames and one or more Association frames to apparatus210at the second reduced power level lower or a third reduced power level. In such cases, the third reduced power level may also be lower than the regular power level.

FIG.4illustrates an example process400in accordance with an implementation of the present disclosure. Process400may be an example implementation of schemes described above whether partially or completely, with respect to improvement in the security of the WPS procedure in accordance with the present disclosure. Process400may represent an aspect of implementation of features of apparatus210and/or apparatus220. Process400may include one or more operations, actions, or functions as illustrated by blocks410,420and430. Although illustrated as discrete blocks, various blocks of process400may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Moreover, the blocks of process400may executed in the order shown inFIG.4or, alternatively, in a different order. Process400may be implemented by apparatus210and apparatus220. Solely for illustrative purposes and without limitation, process400is described below in the context of apparatus210implemented in or as a to-be-onboarded device and apparatus220implemented in or as an AP or wireless router of a wireless network. Process400may begin at block410.

At410, process400may involve processor222of apparatus220, as an AP or wireless router, performing ranging prior to or during a WPS procedure. Process400may proceed from410to420.

At420, process400may involve processor222determining a distance between apparatus210, as a to-be-onboarded device, and apparatus220based on a result of the ranging. Process400may proceed from420to430.

At430, process400may involve processor222configuring one or more credentials to apparatus210responsive to the distance being determined to be less than a threshold (e.g., 1 meter, 5 meter, 10 meter or another threshold value).

In some implementations, in performing the ranging, process400may involve processor222performing passive ranging. In some implementations, in performing the passive ranging, process400may involve processor222performing RSSI monitoring.

In some implementations, in performing the ranging, process400may involve processor222performing active ranging. In some implementations, in performing the active ranging, process400may involve processor222performing FTM-based ranging by exchanging FTM frames either pre-association or post-association to measure the distance. In some implementations, in performing the FTM-based ranging, process400may involve processor222exchanging FTM frames with apparatus210either pre-association or post-association to measure the distance.

In some implementations, in performing the ranging, process400may involve processor222alternating between passive ranging and active ranging responsive to a relative movement between apparatus210and apparatus220.

ADDITIONAL NOTES

The herein-described subject matter sometimes illustrates different components contained within, or connected with, different other components. It is to be understood that such depicted architectures are merely examples, and that in fact many other architectures can be implemented which achieve the same functionality. In a conceptual sense, any arrangement of components to achieve the same functionality is effectively “associated” such that the desired functionality is achieved. Hence, any two components herein combined to achieve a particular functionality can be seen as “associated with” each other such that the desired functionality is achieved, irrespective of architectures or intermedial components. Likewise, any two components so associated can also be viewed as being “operably connected”, or “operably coupled”, to each other to achieve the desired functionality, and any two components capable of being so associated can also be viewed as being “operably couplable”, to each other to achieve the desired functionality. Specific examples of operably couplable include but are not limited to physically mateable and/or physically interacting components and/or wirelessly interactable and/or wirelessly interacting components and/or logically interacting and/or logically interactable components.

Further, with respect to the use of substantially any plural and/or singular terms herein, those having skill in the art can translate from the plural to the singular and/or from the singular to the plural as is appropriate to the context and/or application. The various singular/plural permutations may be expressly set forth herein for sake of clarity.

Moreover, it will be understood by those skilled in the art that, in general, terms used herein, and especially in the appended claims, e.g., bodies of the appended claims, are generally intended as “open” terms, e.g., the term “including” should be interpreted as “including but not limited to,” the term “having” should be interpreted as “having at least,” the term “includes” should be interpreted as “includes but is not limited to,” etc. It will be further understood by those within the art that if a specific number of an introduced claim recitation is intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation no such intent is present. For example, as an aid to understanding, the following appended claims may contain usage of the introductory phrases “at least one” and “one or more” to introduce claim recitations. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles “a” or “an” limits any particular claim containing such introduced claim recitation to implementations containing only one such recitation, even when the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a” or “an,” e.g., “a” and/or “an” should be interpreted to mean “at least one” or “one or more;” the same holds true for the use of definite articles used to introduce claim recitations. In addition, even if a specific number of an introduced claim recitation is explicitly recited, those skilled in the art will recognize that such recitation should be interpreted to mean at least the recited number, e.g., the bare recitation of “two recitations,” without other modifiers, means at least two recitations, or two or more recitations. Furthermore, in those instances where a convention analogous to “at least one of A, B, and C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention, e.g., “a system having at least one of A, B, and C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and/or A, B, and C together, etc. In those instances where a convention analogous to “at least one of A, B, or C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention, e.g., “a system having at least one of A, B, or C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and/or A, B, and C together, etc. It will be further understood by those within the art that virtually any disjunctive word and/or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms. For example, the phrase “A or B” will be understood to include the possibilities of “A” or “B” or “A and B.”

From the foregoing, it will be appreciated that various implementations of the present disclosure have been described herein for purposes of illustration, and that various modifications may be made without departing from the scope and spirit of the present disclosure. Accordingly, the various implementations disclosed herein are not intended to be limiting, with the true scope and spirit being indicated by the following claims.