Methods, access point device and station device for closed Wi-Fi hotspot network

Patent metadata

Field	Value
Publication number	US-12081967-B2
Application number	US-202217804536-A
Country	US
Kind code	B2
Filing date	May 27, 2022
Priority date	Apr 1, 2021
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

Disclosed herein is a method, an Access Point (AP) device for creating a closed Wireless Fidelity (Wi-Fi) hotspot network, and a method, a station device for connecting to the closed Wi-Fi hotspot network. The AP device receives a first input for creating the closed Wi-Fi hotspot network, transmits an encryption key to the station device, which is present within a predefined region, over an in-band communication medium or an out-of-band communication medium, and creates the closed Wi-Fi hotspot network by communicating management frames in cipher text with the station device. The station device receives the encryption key and the management frames from the AP device; and transmits a connection request to the AP device for connecting to the closed Wi-Fi hotspot network. The communication of the management frames in the cipher text provides improved security against attacks associated with Wi-Fi hotspot networks.

First claim

We claim:

1. A method for creating a closed Wi-Fi hotspot network, the method comprising:
receiving, by an Access Point (AP) device, a first input for creating the closed Wi-Fi hotspot network;
transmitting, by the AP device, an encryption key to one or more station devices over an in-band communication medium or an out-of-band communication medium in response to receiving the first input, wherein the one or more station devices are present within a predefined region associated with the AP device ;
transmitting, by the AP device, one or more management frames including cipher text to the one or more station devices over the closed Wi-Fi hotspot network;
receiving, by the AP device, a connection request from a station device for connecting to the closed Wi-Fi hotspot network, wherein the connection request is generated based on connection information of the AP device and a Medium Access Control (MAC) address of the station device, wherein the connection information of the AP device is extracted from one or more encrypted information elements of the one or more management frames using the encryption key; and
creating, by the AP device, the closed Wi-Fi hotspot network.

2. The method as claimed in claim 1 , further comprises:
extracting, by the AP device, the encryption key stored in a memory configured in the AP device in response to receiving the first input.

3. The method as claimed in claim 1 , further comprise:
generating, by the AP device, a random number utilizing a random key generator in response to receiving a second input for changing a network identification, wherein the generated random number is set as the encryption key.

4. The method as claimed in claim 1 , wherein transmitting, by the AP device, the encryption key to the one or more station devices over the in-band communication medium comprises:
transmitting the encryption key in one of a plurality of messages associated with handshake-based authentication to the one or more station devices over a Wi-Fi network.

5. The method as claimed in claim 4 , wherein transmitting the encryption key in one of a plurality of messages associated with the handshake-based authentication comprises:
transmitting, by the AP device, a first message comprising an ANonce to the one or more station devices over the Wi-Fi network;
receiving, by the AP device, a second message comprising a SNonce and a Message Integrity Check (MIC) value from the one or more station devices over the Wi-Fi network in response to transmitting the first message;
transmitting, by the AP device, a third message comprising a Group Transient Key (GTK), an Integrity Group Transient Key (IGTK), and the encryption key to the one or more station devices over the Wi-Fi network, wherein each of the GTK, the IGTK, and the encryption key is encrypted with a Key Encryption key (KEK) generated from a Pairwise Transient Key (PTK); and
receiving, by the AP device, a fourth message comprising an acknowledgement indicating successful installation of the GTK, the IGTK and the encryption key from the one or more station devices over the Wi-Fi network.

6. The method as claimed in claim 5 , wherein the PTK is generated, by the AP device, by applying a pseudo-random function to at least one selected from the group of a prestored Pairwise Master Key (PMK), the ANonce, the SNonce, a Medium Access Control (MAC) address of the AP device, Medium Access Control (MAC) addresses of the one or more station devices, and combinations thereof.

7. The method as claimed in claim 1 , wherein transmitting, by the AP device, the encryption key to the one or more station devices over the out-of-band communication medium comprises:
authenticating the one or more station devices connected to the AP device over a short- range wireless network or a cellular network;
establishing a secure wireless channel with each of the authenticated one or more station devices; and
transmitting the encryption key to each of the authenticated one or more station devices through the secure wireless channel.

8. The method as claimed in claim 1 , further comprises:
determining, by the AP device, a distance of each of the one or more station devices; and
determining whether each of the one or more station devices is present within the predefined region associated with the AP device based on the determined distance.

9. The method as claimed in claim 1 , wherein transmitting, by the AP device, the one or more management frames including the cipher text to the one or more station devices comprises:
encrypting, by the AP device, one or more information elements of the one or more management frames utilizing the encryption key; and
broadcasting, by the AP device, the one or more management frames to the one or more station devices, wherein each of the one or more management frames comprises a management frame encryption information element and the one or more encrypted information elements.

10. The method as claimed in claim 9 , further comprises receiving, by the AP device, a connection request from at least one station device among the one or more station devices in response to broadcasting the one or more management frames.

11. The method as claimed in claim 10 , further comprises creating the closed Wi-Fi hotspot network based on the received connection request from the at least one station device.

12. The method as claimed in claim 1 , wherein the one or more management frames are a beacon frame, a probe frame or an association frame.

13. The method as claimed in claim 9 , wherein the one or more information elements comprises capability information, Service Set Identifier (SSID) information, supported rate information, extended supported rate information, Robust Secure Network (RSN) information, and Basic Service Set (BSS) load information.

14. A station device for connecting to a closed Wi-Fi hotspot network, the station device comprising:
a processor; and
a memory coupled to the processor, wherein the memory stores processor-executable instructions, which, on execution, causes the processor to:
receive an encryption key from an Access Point (AP) device over an in-band communication medium or an out-of-band communication medium, wherein the station device is present within a predefined region associated with the AP device;
receive one or more management frames including cipher text from the AP device over the closed Wi-Fi hotspot network;
extract connection information of the AP device by decrypting one or more encrypted information elements of the received one or more management frames using the received encryption key;
generate a connection request based on the extracted connection information and a Medium Access Control (MAC) address of the station device; and
transmit the generated connection request to the AP device for connecting to the closed Wi-Fi hotspot network in response to receiving the one or more management frames.

15. The station device as claimed in claim 14 , wherein the processor is configured to:
receive the encryption key in one of a plurality of messages associated with handshake-based authentication with the AP device over a Wi-Fi network.

16. The station device as claimed in claim 15 , wherein the processor is configured to:
receive a first message comprising an ANonce from the AP device over the Wi-Fi network;
transmit a second message comprising a SNonce and a Message Integrity Check (MIC) value to the AP device over the Wi-Fi network in response to receiving the first message;
receive a third message comprising a Group Transient Key (GTK), an Integrity Group Transient Key

Assignees

• Samsung Electronics Co Ltd

Inventors

• Murugesan Kumar
• Thangadorai Kavin Kumar
• Sriram Srihari
• Mundra Radhika
• Sahu Mayank Kumar

Classifications

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W12/06

  Authentication · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L9/0827

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title