Using a passphrase with Wi-Fi protected access 3
During operation, an access point may provide a first WLAN and a second WLAN, where the first WLAN uses a WPA2-compatible authentication protocol and the second WLAN uses a WPA3-compatible authentication protocol. In response to an association request or a probe request associated with (or from) an electronic device, the access point may establish a connection with the electronic device using the first WLAN. Then, the access point may confirm, with a computer system, that a binding between a passphrase associated with the electronic device and the second WLAN exists. Alternatively, when the binding does not exist, the access point may establish the binding in the computer system. Next, the access point may perform a BSS transition of the electronic device from the first WLAN to the second WLAN.
1 . A computer network device, comprising:
an interface circuit configured to communicate with an electronic device and a computer system;
a processor; and
a memory that stores program instructions, wherein, when executed by the processor, the program instructions cause the computer network device to perform operations, comprising:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with the electronic device, an association request or a probe request;
establishing a connection with the electronic device using the first WLAN;
after establishing the connection, confirming, with the computer system, that a binding between a passphrase associated with the electronic device and the second WLAN exists or, when the binding does not exist, establishing the binding in the computer system; and
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN.
2 . The computer network device of claim 1 , wherein the operations comprise updating a state entry associated with the electronic device in a state table when the binding is confirmed or is established.
3 . The computer network device of claim 2 , wherein the operations comprise communicating the state entry to additional computer network devices in a network.
4 . The computer network device of claim 3 , wherein the state entry is communicated using a layer-two (L2) broadcast to the additional computer network devices.
5 . The computer network device of claim 1 , wherein the connection with the electronic device is established using the first WLAN when the connection comprises a first instance of the connection.
6 . The computer network device of claim 5 , wherein the operations comprise confirming that an association with the electronic device is the first instance of the connection based at least in part on a state entry in the state table.
7 . The computer network device of claim 6 , wherein, when a request to establish a subsequent instance of a connection with the electronic device occurs, the operations comprise establishing the subsequent instance of the connection with the electronic device using the second WLAN based at least in part on the state entry in the state table.
8 . The computer network device of claim 1 , wherein the second WLAN uses WPA3-simultaneous authentication of equals (SAE).
9 . The computer network device of claim 1 , wherein the first WLAN and the second WLAN have a same service set identifier (SSID) and different basic service set identifiers (BSSIDs).
10 . The computer network device of claim 1 , wherein the BSS transition is based at least in part on an association of the electronic device and the computer network device using the first WLAN.
11 . The computer network device of claim 1 , wherein the passphrase comprises a dynamic pre-shared key (DPSK) of the electronic device.
12 . The computer network device of claim 1 , wherein the computer network device comprises an access point.
13 . The computer network device of claim 1 , wherein the confirming of the binding or the establishing of the binding comprises authenticating, by the computer system, the electronic device and the authentication occurs without the computer system performing a cryptographic calculation or using a single cryptographic calculation.
14 . A non-transitory computer-readable storage medium for use in conjunction with a computer network device, the computer-readable storage medium storing program instructions that, when executed by the computer network device, cause the computer network device to perform operations comprising:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with an electronic device, an association request or a probe request;
establishing a connection with the electronic device using the first WLAN;
after establishing the connection, confirming, with a computer system, that a binding between a passphrase associated with the electronic device and the second WLAN exists or, when the binding does not exist, establishing the binding in the computer system; and
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein the operations comprise updating a state entry associated with the electronic device in a state table when the binding is confirmed or is established.
16 . The non-transitory computer-readable storage medium of claim 15 , wherein the operations comprise communicating the state entry to additional computer network devices in a network.
17 . A method for establishing a connection, comprising:
by a computer network device:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with an electronic device, an association request or a probe request;
establishing the connection with the electronic device using the first WLAN;
after establishing the connection, confirming, with a computer system, that a binding between a passphrase associated with the electronic device and the second WLAN exists or, when the binding does not exist, establishing the binding in the computer system; and
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN.
18 . The method of claim 17 , wherein the method comprises updating a state entry associated with the electronic device in a state table when the binding is confirmed or is established.
19 . The method of claim 18 , wherein the method comprises communicating the state entry to additional computer network devices in a network.
20 . The method of claim 17 , wherein the connection with the electronic device is established using the first WLAN when the connection comprises a first instance of the connection; and
when a request to establish a subsequent instance of a connection with the electronic device occurs, the method comprises establishing the subsequent instance of the connection with the electronic device using the second WLAN based at least in part on a state entry in a state table.