Backscatter device certificate on-boarding for secure communication
In Wi-Fi 8, backscatter devices (BKDs) may be viewed as part of the 802.11 wireless local area network (WLAN). BKDs in a WLAN have limited transmission interactions with a Wi-Fi access point (AP). Onboarding BKDs to the WLAN is described, which allows for the AP and BKD to participate as elements of the same local network, with security controls. The onboarding of the BKD to a WLAN may occur after discovery of the BKD at an AP and includes replacing an Initial Device Identifier (IDevID) on the BKD with a Local Device Identifier (LDevID) in order to provide for secure communications between the BKD and the WLAN.
1 . A method comprising:
detecting a backscatter device (BKD) at an Access Point (AP);
validating an identity of the BKD using an initial device identifier (IDevID) at the BKD;
onboarding the BKD to a local network by:
energizing the BKD to provide sufficient energy for a certificate enrollment process to be completed;
replacing the IDevID with a different device identifier based on the certificate enrollment process; and
upon receiving a success message from the BKD at the AP, entering a normal communication state with the BKD in the local network.
2 . The method of claim 1 , wherein validating the identity of the BKD further comprises:
determining a discovery identification for the BKD;
determining, using the discovery identification from the BKD and a local device identifier repository, the BKD is not connected to the local network; and
validating the discovery identification with a IDevID repository.
3 . The method of claim 2 , wherein the different device identifier is generated by a public key infrastructure (PKI) module for the local network, and wherein the method further comprises:
upon receiving the success message, updating the local device identifier repository with the different device identifier of the BKD.
4 . The method of claim 2 , wherein the discovery identification is the IDevId installed by a manufacturer of the BKD.
5 . The method of claim 1 , wherein onboarding the BKD to the local network further comprises:
determining a location of the BKD;
determining an energy requirement for the BKD to complete the certificate enrollment process;
determining, based on the location and the energy requirement, an energizing time;
transmitting an onboarding indication to the BKD indicating the certificate enrollment process will occur; and
wherein energizing the BKD further comprises:
transmitting a focused beam to the BKD for a duration equal to the energizing time.
6 . The method of claim 5 , wherein a second focused beam is transmitted by a second device in the local network.
7 . The method of claim 1 , further comprising:
in the normal communication state, securely communicating with the BKD using the different device identifier via encryption and trust parameters.
8 . An access point (AP), comprising:
a processor; and
a memory comprising instructions which, when executed on the processor, performs an operation, the operation comprising:
detecting a backscatter device (BKD);
validating an identity of the BKD using an initial device identifier (IDevID) at the BKD;
onboarding the BKD to a local network by:
energizing the BKD to provide sufficient energy for a certificate enrollment process to be completed;
replacing the IDevID with a different device identifier based on the certificate enrollment process; and
upon receiving a success message from the BKD, entering a normal communication state with the BKD in the local network.
9 . The AP of claim 8 , wherein validating the identity of the BKD further comprises:
determining a discovery identification for the BKD;
determining, using the discovery identification from the BKD and a local device identifier repository, the BKD is not connected to the local network; and
validating the discovery identification with a IDevID repository.
10 . The AP of claim 9 , wherein the different device identifier is generated by a public key infrastructure (PKI) module for the local network, and wherein the operation further comprises:
upon receiving the success message, updating the local device identifier repository with the different device identifier of the BKD.
11 . The AP of claim 9 , wherein the discovery identification is the IDevId installed by a manufacturer of the BKD.
12 . The AP of claim 8 , wherein onboarding the BKD to the local network further comprises:
determining a location of the BKD;
determining an energy requirement for the BKD to complete the certificate enrollment process;
determining, based on the location and the energy requirement, an energizing time;
transmitting an onboarding indication to the BKD indicating the certificate enrollment process will occur; and
wherein energizing the BKD further comprises:
transmitting a focused beam to the BKD for a duration equal to the energizing time.
13 . The AP of claim 12 , wherein a second focused beam is transmitted by a second device in the local network.
14 . The AP of claim 8 , further comprising:
in the normal communication state, securely communicating with the BKD using the different device identifier via encryption and trust parameters.
15 . A non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to perform an operation comprising:
detecting a backscatter device (BKD) at an Access Point (AP);
validating an identity of the BKD using an initial device identifier (IDevID) at the BKD;
onboarding the BKD to a local network by:
energizing the BKD to provide sufficient energy for a certificate enrollment process to be completed;
replacing the IDevID with a different device identifier based on the certificate enrollment process; and
upon receiving a success message from the BKD at the AP, entering a normal communication state with the BKD in the local network.
16 . The computer-readable storage medium of claim 15 , wherein validating the identity of the BKD further comprises:
determining a discovery identification for the BKD;
determining, using the discovery identification from the BKD and a local device identifier repository, the BKD is not connected to the local network; and
validating the discovery identification with a IDevID repository.
17 . The computer-readable storage medium of claim 16 , wherein the different device identifier is generated by a public key infrastructure (PKI) module for the local network, and wherein the operation further comprises:
upon receiving the success message, updating the local device identifier repository with the different device identifier of the BKD.
18 . The computer-readable storage medium of claim 16 , wherein the discovery identification is the IDevId installed by a manufacturer of the BKD.
19 . The computer-readable storage medium of claim 15 , wherein onboarding the BKD to the local network further comprises:
determining a location of the BKD;
determining an energy requirement for the BKD to complete the certificate enrollment process;
determining, based on the location and the energy requirement, an energizing time;
transmitting an onboarding indication to the BKD indicating the certificate enrollment process will occur; and
wherein energizing the BKD further comprises:
transmitting a focused beam to the BKD for a duration equal to the energizing time.
20 . The computer-readable storage medium of claim 15 , wherein the operation further comprises:
in the normal communication state, securely communicating with the BKD using the different device identifier via encryption and trust parameters.