Neighbor awareness networking password authentication

Patent metadata

Field	Value
Publication number	US-11296883-B2
Application number	US-201916586224-A
Country	US
Kind code	B2
Filing date	Sep 27, 2019
Priority date	Dec 14, 2018
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

An apparatus comprises a memory and at least one processor in communication with the memory. The at least one processor is to detect, during a discovery window, a neighboring client station that is to perform peer-to-peer Wi-Fi communication via a Neighbor Awareness Networking (NAN) protocol and establish, via a negotiation after the discovery window, a datapath with the neighboring client station, wherein the negotiation includes an exchange of NAN data path setup attributes in parallel with an exchange of encryption cipher attributes and the encryption cipher is based on a simultaneous authentication of equals (SAE) protocol. The SAE protocol can be used to generate key material to encrypt the datapath.

First claim

What is claimed is:

1. An apparatus comprising:
a memory; and
at least one processor in communication with the memory, wherein the at least one processor is configured to:
detect, during a discovery window, a neighboring client station that is to perform peer-to-peer Wi-Fi communication via a Neighbor Awareness Networking (NAN) protocol; and
establish, via a negotiation after the discovery window, a datapath with the neighboring client station that is detected during the discovery window, wherein the negotiation includes an exchange of NAN data path setup attributes in parallel with an exchange of attributes for an encryption cipher, wherein the encryption cipher is based on a simultaneous authentication of equals (SAE) protocol, and wherein the SAE protocol is used to generate key material to encrypt the datapath.

2. The apparatus as in claim 1 , wherein the negotiation includes a NAN data path setup handshake, the NAN data path setup handshake including a data path request message, a data path response message, a data path confirm message and a data path security install message.

3. The apparatus as in claim 1 , wherein the negotiation includes an SAE handshake, the SAE handshake including at least one SAE commit message and at least one SAE confirm message.

4. The apparatus as in claim 1 , wherein the at least one processor is to generate a password and cause a transmission or presentation of the password to the neighboring client station via an out-of-band channel.

5. The apparatus as in claim 1 , wherein the at least one processor is to receive a password from the neighboring client station via an out-of-band channel.

6. The apparatus as in claim 1 , additionally comprising a NAN protocol enabled communications device coupled with the at least one processor, the NAN protocol enabled communications device including at least one antenna, at least one radio coupled to the at least one antenna, and at least one processor.

7. The apparatus as in claim 6 , wherein the NAN protocol enabled communications device is to perform at least one of Wi-Fi communication or Bluetooth communication.

8. The apparatus as in claim 6 , wherein the NAN protocol enabled communications device is to:
generate a default password, wherein the default password is a binary password generated via a hash function, the default password used to generate key material to encrypt the datapath in absence of a password supplied by the at least one processor; and
generate one or more SAE protocol attributes based on the binary password.

9. The apparatus as in claim 6 , wherein the at least one processor is to:
generate or receive a password, the password used to generate key material to encrypt the datapath;
convert the password to a binary password via a hash function; and
transmit the binary password to the NAN protocol enabled communications device.

10. The apparatus as in claim 9 , wherein the NAN protocol enabled communications device is to generate one or more SAE protocol attributes based on the binary password received from the at least one processor.

11. The apparatus as in claim 10 , wherein the at least one processor is to store at least a first portion of the key material in the memory, the NAN protocol enabled communications device is to internally store at least a second portion of the key material, and the NAN protocol enabled communications device is to recover or re-setup the datapath with the neighboring client station via at least the first portion of the key material or the second portion of the key material.

12. A non-transitory machine-readable medium storing instructions to cause one or more processors of an electronic device to perform one or more operations comprising:
detecting, during a discovery window, a neighboring client station that is to perform peer-to-peer Wi-Fi communication via a Neighbor Awareness Networking (NAN) protocol;
negotiating, after the discovery window, NAN protocol parameters for a datapath with the neighboring client station that is detected during the discovery window, wherein the negotiating includes exchanging NAN data path setup attributes in parallel with an exchange of attributes for an encryption cipher, wherein the encryption cipher is based on a simultaneous authentication of equals (SAE) protocol;
generating key material to encrypt the datapath using the SAE protocol; and
establishing the datapath with the neighboring client station.

13. The non-transitory machine-readable medium as in claim 12 , wherein the negotiating includes performing a NAN data path setup handshake process and the NAN data path setup handshake process including a data path request message, a data path response message, a data path confirm message, and a data path security install message.

14. The non-transitory machine-readable medium as in claim 12 , wherein the negotiating includes an SAE handshake, the SAE handshake including at least one SAE commit message and at least one SAE confirm message.

15. The non-transitory machine-readable medium as in claim 12 , the operations additionally comprising generating a password and transmitting or presenting the password to the neighboring client station via an out-of-band channel.

16. The non-transitory machine-readable medium as in claim 12 , the operations additionally comprising receiving a password from the neighboring client station via an out-of-band channel.

17. The non-transitory machine-readable medium as in claim 12 , the operations additionally comprising:
via a NAN protocol enabled communications device coupled with the one or more processors:
generating a default password, wherein the default password is a binary password generated via a hash function, the default password used to generate key material to encrypt the datapath in absence of an out-of-band password supplied by the one or more processors; and
generating one or more SAE protocol attributes based on the binary password.

18. The non-transitory machine-readable medium as in claim 12 , the operations additionally comprising:
generating or receiving a password used to generate key material to encrypt the datapath;
convert the password to a binary password via a hash function; and
transmit the binary password to a NAN protocol enabled communications device coupled with the one or more processors.

19. The non-transitory machine-readable medium as in claim 18 , wherein the NAN protocol enabled communications device is to generate one or more SAE protocol attributes based on the binary password.

20. The non-transitory machine-readable medium as in claim 19 , the operations additionally comprising storing at least a first portion of the key material in a memory coupled with the one or more processors, wherein the NAN protocol enabled communications device is to internally store at least a second portion of the key material, and the NAN protocol enabled communications device is to recover or re-setup the datapath with the neighboring client station via at least the first portion of the key material or the second portion of the key material.

Assignees

• Apple Inc

Inventors

• Liu Yong
• Haque Tashbeeb
• Hartman Christiaan A
• Kurian Lawrie

Classifications

• H04L69/24

  Negotiation of communication capabilities · CPC title

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04W8/005

  Discovery of network devices, e.g. terminals · CPC title