Wireless access point authentication system and method

1 . A system comprising:

a wireless switch, including:

a shared secret, embodied in a computer-readable medium, including a public key and a private key;

a verification engine capable of generating a partial fingerprint using the private key;

an access point (AP) coupled to the wireless switch through a secure connection;

wherein, in operation:

after AP startup or reset, the AP sends a reset number to the wireless switch,

the verification engine computes a partial fingerprint from the reset number; a starting sequence number, and the public key;

the wireless switch sends the starting sequence number, the partial fingerprint, and the public key over the secure connection to the AP.

2 . The system of claim 1 , wherein the reset number has a value R[x], where R[x] is one of a sequence of monotonically increasing values, R[ 0 ], R[ 1 ], . . . R[x], R[y], . . . , R[n] that denote the reset count of the AP.

3 . The system of claim 1 , wherein the starting sequence number has a value S[ 0 ], where S[ 0 ] is a first of a sequence of values, S[ 0 ], S[ 1 ], . . . , S[j], S[k], . . . , S[n], wherein S[ 0 ] is easily determinable if S[k] is known, and wherein S[k] is easily computable if S[j] is known.

4 . The system of claim 1 , wherein the partial fingerprint is derived from a function, f( ), wherein f( ) is a one-way hash function that is difficult to reverse engineer in a reasonable time even after a large sample size for the output of f( ) is made available, and wherein f( ) is cannot reasonably be expected to be performed on a per-packet basis.

5 . The system of claim 1 , further comprising a plurality of wireless switches, including the wireless switch, wherein the shared secret is shared among the plurality of wireless switches.

6 . The system of claim 1 , wherein the AP is a first AP, further comprising:

a distribution system, including the wireless switch, for a wireless domain;

a second AP of the wireless domain;

wherein, in operation:

after AP startup or reset, the second AP sends a reset number to the distribution system,

the distribution system computes a partial fingerprint from the reset number; a starting sequence number, and the public key;

the distribution system sends the starting sequence number, the partial fingerprint, and the public key over a secure connection to the second AP.

7 . The system of claim 1 , further comprising a wired backbone to which the wireless switch is coupled.

8 . The system of claim 1 , wherein the AP is a first AP, further comprising:

a second AP;

an AP identifier (AP ID) database, embodied in a computer-readable medium at the first AP, including records having fields;

an authentication engine embodied in a computer-readable medium at the first AP;

wherein, in operation:

the second AP broadcasts a message including an AP ID and first data;

the first AP receives the message including the AP ID and first data;

the authentication engine computes a fingerprint using the first data and second data;

the authentication engine compares the computed fingerprint to a record in the AP ID database having a first field that includes the AP ID, and a second field that includes a recorded fingerprint;

the authentication engine determines that the first AP and the second AP are in a same wireless domain if the computer fingerprint and the recorded fingerprint match.

9 . The system of claim 8 , wherein the reset number is a first reset number and the partial fingerprint is a first partial fingerprint, wherein the first data includes a second reset number, a sequence number, a second partial fingerprint, and a secondary fingerprint.

10 . The system of claim 8 , wherein the second data includes the public key.

11 . The system of claim 8 , wherein the AP ID database is a bssid database, and the AP ID includes a bssid.

12 . A system comprising:

a means for sharing a shared secret, including a public key, at a distribution system associated with a wireless domain;

a means for initializing an access point (AP) of the wireless domain, including:

receiving a reset number from the AP;

providing a starting sequence number, a partial fingerprint, and a public key to the AP;

a means for authenticating a station at the AP, including:

receiving a bssid and a fingerprint from the station;

computing a fingerprint from the received fingerprint and the public key;

determining whether the computed fingerprint matches the received fingerprint;

updating a record associated with the bssid if the computed fingerprint and the received fingerprint match.

13 . A method comprising:

receiving a message having a bssid and a fingerprint;

computing a fingerprint from the received fingerprint and known data;

determining whether the computed fingerprint matches the received fingerprint;

updating a record associated with the bssid if the computed fingerprint and the received fingerprint match.

14 . The method of claim 13 , further comprising:

determining whether a record of the bssid is available;

creating a record for the bssid if a record of the bssid is not-available.

15 . The method of claim 13 , further comprising:

determining whether a record of the bssid indicates the bssid is being used;

marking the record as spoofed if the bssid is being used.

16 . The method of claim 13 , wherein the message includes a reset number further comprising:

determining that a received reset number is greater than a recorded reset number, wherein the received reset number is received in association with the message and the recorded reset number is recorded in association with a recorded bssid that matches the bssid of the message.

17 . The method of claim 13 , further comprising:

determining whether a received reset number matches a recorded reset number, wherein the received reset number is received in association with the message and the recorded reset number is recorded in association with a recorded bssid that matches the bssid of the message.

if the received reset number matches the recorded reset number:

determining whether a received partial print matches a recorded partial print;

marking the record as spoofed if the received partial print and the recorded partial print do not match.

18 . The method of claim 13 , further comprising:

determining whether a received reset number matches a recorded reset number, wherein the received reset number is received in association with the message and the recorded reset number is recorded in association with a recorded bssid that matches the bssid of the message.

if the received reset number matches the recorded reset number:

determining whether a received sequence number follows a recorded sequence number;

marking the record as spoofed if the received sequence number does not follow the recorded sequence number.

19 . The method of claim 13 , further comprising, if the computed fingerprint and the received fingerprint are different:

updating a record associated with the bssid with the computed fingerprint;

marking the record as spoofed.

20 . The method of claim 13 , further comprising:

updating a distribution system with relevant bssid records;

verifying the bssid records at the distribution system.