Sharing security keys with headless devices
View Patent ↗Systems and methods for provisioned configuration of wireless devices to allow access to restricted wireless networks are provided. Using an open wireless or wired network, a user of a wireless device may be authenticated. A configuration application, which includes the parameters and policies of the provisioned configuration, is generated, transferred to, and executed on the wireless device. Following configuration by the application, the wireless device is allowed to access the restricted wireless network within the parameters and policies of the provisioned configuration.
1. A method for sharing security keys with headless devices, the method comprising:
detecting a headless device within a wireless communication range;
executing instructions stored in memory, wherein execution of the instructions by a processor:
determines that the detected headless device is authenticated for access to a secured wireless network,
identifies that the detected headless device is not yet associated with any pre-shared keys, and
assigns a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;
transferring the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;
binding the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;
in response to one or more communications, identifying one or more other characteristics of the detected headless device and generating a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and
dynamically updating the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.
2. The method of claim 1 , further comprising storing one or more unassigned pre-shared keys in a database in memory.
3. The method of claim 2 , further comprising receiving the unassigned pre-shared keys from a remote secret generation module over the secured wireless network.
4. The method of claim 2 , further comprising executing a local secret generation module to generate the unassigned pre-shared keys.
5. The method of claim 1 , wherein the access point recognizes the assigned pre-shared key as being associated with the secured wireless network.
6. An apparatus for sharing security keys with headless devices, the apparatus comprising:
a communication interface that detects a headless device within a wireless communication range;
a processor that executes instructions stored in memory, wherein execution of the instructions by a processor:
determines that the detected headless device is authenticated for access to a secured wireless network,
identifies that the detected headless device is not yet associated with any pre-shared keys, and
assigns a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;
wherein the communication interface transfers the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;
in response to which, further execution of the instructions by the processor:
binds the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;
in response to one or more communications, identifies one or more other characteristics of the detected headless device and generates a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and
dynamically updates the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.
7. The apparatus of claim 6 , further comprising memory that stores a database of one or more unassigned pre-shared keys.
8. The apparatus of claim 7 , wherein the communication interface further receives the unassigned pre-shared keys from a remote secret generation module.
9. The apparatus of claim 7 , further comprising a local secret generation module stored in memory and executable by the processor to generate the unassigned pre-shared keys.
10. The apparatus of claim 6 , wherein the access point recognizes the assigned pre-shared key as being associated with the secured wireless network.
11. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for sharing security keys with headless devices, the method comprising:
detecting a headless device within a wireless communication range;
determining that the detected headless device is authenticated for access to a secured wireless network;
identifying that the detected headless device is not yet associated with any pre-shared keys;
assigning a pre-shared key to the detected headless device, wherein the assigned pre-shared key is unique to the detected headless device;
transferring the assigned pre-shared key to the detected headless device, wherein the pre-shared key is used to encrypt wireless communications between the detected headless device and an access point in the secured wireless network;
binding the assigned pre-shared key to the detected device at the access point by associating the assigned pre-shared key to a MAC address of the detected headless device;
in response to one or more communications, identifying one or more other characteristics of the detected headless device and generating a fingerprint of the detected headless device comprising at least the MAC address and the one or more other characteristics of the headless device; and
dynamically updating the binding to associate the assigned pre-shared key with the fingerprint of the detected headless device.